|WARNING| net/vhost: support queue info query

[dpdklab at iol.unh.edu]

Test-Label: ai-code-review
Test-Status: WARNING
https://dpdk.org/patch/166441

_AI Code Review_

=== Patch Review: series.patch (via Claude) ===
Review date: 2026-07-01

# DPDK Patch Review

## Patch Summary
Adding `rxq_info_get` and `txq_info_get` callbacks to the vhost PMD to report actual vring sizes negotiated with the virtio frontend.

---

## Errors

### 1. Missing NULL pointer check on queue array access
**Location:** `eth_rxq_info_get()` line 1488, `eth_txq_info_get()` line 1502

The code accesses `dev->data->rx_queues[rx_queue_id]` and `dev->data->tx_queues[tx_queue_id]` without first verifying that `dev->data->rx_queues` / `dev->data->tx_queues` is non-NULL.

If `dev->data` or the queue arrays are NULL (e.g., before configuration or after close), this will dereference a NULL pointer.

**Fix:**
```c
static void
eth_rxq_info_get(struct rte_eth_dev *dev, uint16_t rx_queue_id,
		 struct rte_eth_rxq_info *qinfo)
{
	struct rte_vhost_vring vring;
	struct vhost_queue *vq;

	qinfo->nb_desc = 0;

	if (dev->data->rx_queues == NULL)
		return;

	vq = dev->data->rx_queues[rx_queue_id];
	if (vq == NULL || vq->vid < 0)
		return;
	/* ... */
}
```

Apply the same check to `eth_txq_info_get()`.

---

### 2. Missing bounds check on queue_id
**Location:** `eth_rxq_info_get()` line 1488, `eth_txq_info_get()` line 1502

The `rx_queue_id` and `tx_queue_id` parameters are used as array indices without verifying they are within bounds (`< dev->data->nb_rx_queues` / `< dev->data->nb_tx_queues`).

Out-of-bounds access causes undefined behavior.

**Fix:**
```c
static void
eth_rxq_info_get(struct rte_eth_dev *dev, uint16_t rx_queue_id,
		 struct rte_eth_rxq_info *qinfo)
{
	struct rte_vhost_vring vring;
	struct vhost_queue *vq;

	qinfo->nb_desc = 0;

	if (dev->data->rx_queues == NULL ||
	    rx_queue_id >= dev->data->nb_rx_queues)
		return;

	vq = dev->data->rx_queues[rx_queue_id];
	/* ... */
}
```

Apply the same check to `eth_txq_info_get()`.

---

## Warnings

### 1. Missing release notes entry
The patch adds new device operations (`rxq_info_get`, `txq_info_get`) which enhance the PMD's capabilities. This should be documented in the release notes under the vhost PMD section.

**Suggested addition to `doc/guides/rel_notes/release_26_03.rst`** (or current release):
```rst
* **Updated vhost PMD.**

  * Added support for queue info query to report actual vring descriptor counts.
```

---

### 2. No update to PMD feature matrix
The patch enables the `Queue information` feature for the vhost PMD. This should be reflected in the features matrix.

**Action:** Update `doc/guides/nics/features/vhost.ini` to include:
```ini
Queue information     = Y
```

Ensure this matches the features documented in `doc/guides/nics/features.rst` where `Queue information` maps to `rxq_info_get` and `txq_info_get` operations.

---

## Info

### 1. Consider documenting the dynamic nature of queue size
The vhost PMD's queue size is negotiated dynamically with the virtio frontend and may be zero before the frontend connects. The current implementation returns `nb_desc = 0` when `vq->vid < 0` (not connected), which is reasonable.

Consider adding a comment explaining this behavior:
```c
static void
eth_rxq_info_get(struct rte_eth_dev *dev, uint16_t rx_queue_id,
		 struct rte_eth_rxq_info *qinfo)
{
	struct rte_vhost_vring vring;
	struct vhost_queue *vq;

	/* Return zero descriptors if frontend not connected */
	qinfo->nb_desc = 0;
	/* ... */
}
```

This helps future maintainers understand the zero-initialization is intentional.

---

## Summary

**Must Fix (Errors):**
- Add NULL check on `dev->data->rx_queues` before accessing
- Add NULL check on `dev->data->tx_queues` before accessing  
- Add bounds check on `rx_queue_id >= dev->data->nb_rx_queues`
- Add bounds check on `tx_queue_id >= dev->data->nb_tx_queues`

**Should Fix (Warnings):**
- Add release notes entry for the new feature
- Update `doc/guides/nics/features/vhost.ini` to mark `Queue information = Y`

**Consider (Info):**
- Add comment explaining that zero descriptors indicates frontend not connected

The core functionality is sound, but the missing input validation creates crash risks that must be addressed.