Series comparison

-[Qemu-devel] [PULL 0/9] Net patches
+[PULL 0/5] Net patches
-The following changes since commit 56821559f0ba682fe6b367815572e6f974d329ab:
+The following changes since commit 23895cbd82be95428e90168b12e925d0d3ca2f06:
-  Merge remote-tracking branch 'dgilbert/tags/pull-hmp-20170517' into staging (2017-05-18 13:36:15 +0100)
+  Merge remote-tracking branch 'remotes/awilliam/tags/vfio-update-20201123.0' into staging (2020-11-23 18:51:13 +0000)
 are available in the git repository at:
   https://github.com/jasowang/qemu.git tags/net-pull-request
-for you to fetch changes up to 82342e91b60a4a078811df4e1a545e57abffa11d:
+for you to fetch changes up to 9925990d01a92564af55f6f69d0f5f59b47609b1:
-  e1000e: Fix ICR "Other" causes clear logic (2017-05-23 10:10:38 +0800)
+  net: Use correct default-path macro for downscript (2020-11-24 10:40:17 +0800)
 ----------------------------------------------------------------
 ----------------------------------------------------------------
-Sameeh Jubran (1):
+Keqian Zhu (1):
-      e1000e: Fix ICR "Other" causes clear logic
+      net: Use correct default-path macro for downscript
-Thomas Huth (3):
+Paolo Bonzini (1):
-      net/tap: Replace tap-haiku.c and tap-aix.c by a generic tap-stub.c
+      net: do not exit on "netdev_add help" monitor command
       net/dump: Issue a warning for the deprecated "-net dump"
       hmp / net: Mark host_net_add/remove as deprecated
-Yunjian Wang (1):
+Prasad J Pandit (1):
-      virtio-net: fix wild pointer when remove virtio-net queues
+      hw/net/e1000e: advance desc_offset in case of null descriptor
-Zhang Chen (4):
+Yuri Benditovich (1):
-      COLO-compare: Improve tcp compare trace event readability
+      net: purge queued rx packets on queue deletion
       net/filter-mirror.c: Remove duplicate check code.
       net/filter-mirror.c: Rename filter_mirror_send() and fix codestyle
       net/filter-rewriter: Remove unused option in filter-rewriter
- hmp-commands.hx               |  8 ++--
+yuanjungong (1):
- hw/net/e1000e_core.c          | 10 ++++-
+      tap: fix a memory leak
- hw/net/virtio-net.c           |  3 ++
- net/Makefile.objs             | 15 ++++----
+ hw/net/e1000e_core.c |  8 +++---
- net/colo-compare.c            | 33 ++++++++++------
+ include/net/net.h    |  1 +
- net/dump.c                    |  3 ++
+ monitor/hmp-cmds.c   |  6 ++++
- net/filter-mirror.c           | 35 ++++++++---------
+ net/net.c            | 80 +++++++++++++++++++++++++++-------------------------
- net/net.c                     | 13 +++++++
+ net/tap.c            |  5 +++-
- net/tap-haiku.c               | 87 -------------------------------------------
+files changed, 57 insertions(+), 43 deletions(-)
  net/{tap-aix.c => tap-stub.c} |  3 +-
  net/trace-events              |  3 +-
  qemu-options.hx               |  2 +-
 files changed, 80 insertions(+), 135 deletions(-)
  delete mode 100644 net/tap-haiku.c
  rename net/{tap-aix.c => tap-stub.c} (97%)

-[Qemu-devel] [PULL 1/9] net/tap: Replace tap-haiku.c and tap-aix.c by a generic tap-stub.c
+Deleted patch
-From: Thomas Huth <thuth@redhat.com>
-The files tap-haiku.c and tap-aix.c are identical (except one line
-of error message). We should avoid such code duplication, so replace
-these by a generic tap-stub.c file instead.
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Jason Wang <jasowang@redhat.com>
----
- net/Makefile.objs | 15 +++++-----
- net/tap-aix.c     | 88 -------------------------------------------------------
- net/tap-haiku.c   | 87 ------------------------------------------------------
- net/tap-stub.c    | 87 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
-files changed, 95 insertions(+), 182 deletions(-)
- delete mode 100644 net/tap-aix.c
- delete mode 100644 net/tap-haiku.c
- create mode 100644 net/tap-stub.c
-diff --git a/net/Makefile.objs b/net/Makefile.objs
-index XXXXXXX..XXXXXXX 100644
---- a/net/Makefile.objs
-+++ b/net/Makefile.objs
-@@ -XXX,XX +XXX,XX @@ common-obj-y += socket.o
- common-obj-y += dump.o
- common-obj-y += eth.o
- common-obj-$(CONFIG_L2TPV3) += l2tpv3.o
--common-obj-$(CONFIG_POSIX) += tap.o vhost-user.o
--common-obj-$(CONFIG_LINUX) += tap-linux.o
--common-obj-$(CONFIG_WIN32) += tap-win32.o
--common-obj-$(CONFIG_BSD) += tap-bsd.o
--common-obj-$(CONFIG_SOLARIS) += tap-solaris.o
--common-obj-$(CONFIG_AIX) += tap-aix.o
--common-obj-$(CONFIG_HAIKU) += tap-haiku.o
-+common-obj-$(CONFIG_POSIX) += vhost-user.o
- common-obj-$(CONFIG_SLIRP) += slirp.o
- common-obj-$(CONFIG_VDE) += vde.o
- common-obj-$(CONFIG_NETMAP) += netmap.o
-@@ -XXX,XX +XXX,XX @@ common-obj-y += colo-compare.o
- common-obj-y += colo.o
- common-obj-y += filter-rewriter.o
- common-obj-y += filter-replay.o
-+
-+tap-obj-$(CONFIG_LINUX) = tap-linux.o
-+tap-obj-$(CONFIG_BSD) = tap-bsd.o
-+tap-obj-$(CONFIG_SOLARIS) = tap-solaris.o
-+tap-obj-y ?= tap-stub.o
-+common-obj-$(CONFIG_POSIX) += tap.o $(tap-obj-y)
-+common-obj-$(CONFIG_WIN32) += tap-win32.o
-diff --git a/net/tap-aix.c b/net/tap-aix.c
-deleted file mode 100644
-index XXXXXXX..XXXXXXX
---- a/net/tap-aix.c
-+++ /dev/null
-@@ -XXX,XX +XXX,XX @@
--/*
-- * QEMU System Emulator
-- *
-- * Copyright (c) 2003-2008 Fabrice Bellard
-- *
-- * Permission is hereby granted, free of charge, to any person obtaining a copy
-- * of this software and associated documentation files (the "Software"), to deal
-- * in the Software without restriction, including without limitation the rights
-- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-- * copies of the Software, and to permit persons to whom the Software is
-- * furnished to do so, subject to the following conditions:
-- *
-- * The above copyright notice and this permission notice shall be included in
-- * all copies or substantial portions of the Software.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
-- * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-- * THE SOFTWARE.
-- */
--
--#include "qemu/osdep.h"
--#include "qapi/error.h"
--#include "tap_int.h"
--
--int tap_open(char *ifname, int ifname_size, int *vnet_hdr,
--             int vnet_hdr_required, int mq_required, Error **errp)
--{
--    error_setg(errp, "no tap on AIX");
--    return -1;
--}
--
--void tap_set_sndbuf(int fd, const NetdevTapOptions *tap, Error **errp)
--{
--}
--
--int tap_probe_vnet_hdr(int fd)
--{
--    return 0;
--}
--
--int tap_probe_has_ufo(int fd)
--{
--    return 0;
--}
--
--int tap_probe_vnet_hdr_len(int fd, int len)
--{
--    return 0;
--}
--
--void tap_fd_set_vnet_hdr_len(int fd, int len)
--{
--}
--
--int tap_fd_set_vnet_le(int fd, int is_le)
--{
--    return -EINVAL;
--}
--
--int tap_fd_set_vnet_be(int fd, int is_be)
--{
--    return -EINVAL;
--}
--
--void tap_fd_set_offload(int fd, int csum, int tso4,
--                        int tso6, int ecn, int ufo)
--{
--}
--
--int tap_fd_enable(int fd)
--{
--    return -1;
--}
--
--int tap_fd_disable(int fd)
--{
--    return -1;
--}
--
--int tap_fd_get_ifname(int fd, char *ifname)
--{
--    return -1;
--}
--
-diff --git a/net/tap-haiku.c b/net/tap-haiku.c
-deleted file mode 100644
-index XXXXXXX..XXXXXXX
---- a/net/tap-haiku.c
-+++ /dev/null
-@@ -XXX,XX +XXX,XX @@
--/*
-- * QEMU System Emulator
-- *
-- * Copyright (c) 2003-2008 Fabrice Bellard
-- *
-- * Permission is hereby granted, free of charge, to any person obtaining a copy
-- * of this software and associated documentation files (the "Software"), to deal
-- * in the Software without restriction, including without limitation the rights
-- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-- * copies of the Software, and to permit persons to whom the Software is
-- * furnished to do so, subject to the following conditions:
-- *
-- * The above copyright notice and this permission notice shall be included in
-- * all copies or substantial portions of the Software.
-- *
-- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
-- * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-- * THE SOFTWARE.
-- */
--
--#include "qemu/osdep.h"
--#include "qapi/error.h"
--#include "tap_int.h"
--
--int tap_open(char *ifname, int ifname_size, int *vnet_hdr,
--             int vnet_hdr_required, int mq_required, Error **errp)
--{
--    error_setg(errp, "no tap on Haiku");
--    return -1;
--}
--
--void tap_set_sndbuf(int fd, const NetdevTapOptions *tap, Error **errp)
--{
--}
--
--int tap_probe_vnet_hdr(int fd)
--{
--    return 0;
--}
--
--int tap_probe_has_ufo(int fd)
--{
--    return 0;
--}
--
--int tap_probe_vnet_hdr_len(int fd, int len)
--{
--    return 0;
--}
--
--void tap_fd_set_vnet_hdr_len(int fd, int len)
--{
--}
--
--int tap_fd_set_vnet_le(int fd, int is_le)
--{
--    return -EINVAL;
--}
--
--int tap_fd_set_vnet_be(int fd, int is_be)
--{
--    return -EINVAL;
--}
--
--void tap_fd_set_offload(int fd, int csum, int tso4,
--                        int tso6, int ecn, int ufo)
--{
--}
--
--int tap_fd_enable(int fd)
--{
--    return -1;
--}
--
--int tap_fd_disable(int fd)
--{
--    return -1;
--}
--
--int tap_fd_get_ifname(int fd, char *ifname)
--{
--    return -1;
--}
-diff --git a/net/tap-stub.c b/net/tap-stub.c
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/net/tap-stub.c
-@@ -XXX,XX +XXX,XX @@
-+/*
-+ * QEMU System Emulator
-+ *
-+ * Copyright (c) 2003-2008 Fabrice Bellard
-+ *
-+ * Permission is hereby granted, free of charge, to any person obtaining a copy
-+ * of this software and associated documentation files (the "Software"), to deal
-+ * in the Software without restriction, including without limitation the rights
-+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-+ * copies of the Software, and to permit persons to whom the Software is
-+ * furnished to do so, subject to the following conditions:
-+ *
-+ * The above copyright notice and this permission notice shall be included in
-+ * all copies or substantial portions of the Software.
-+ *
-+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
-+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-+ * THE SOFTWARE.
-+ */
-+
-+#include "qemu/osdep.h"
-+#include "qapi/error.h"
-+#include "tap_int.h"
-+
-+int tap_open(char *ifname, int ifname_size, int *vnet_hdr,
-+             int vnet_hdr_required, int mq_required, Error **errp)
-+{
-+    error_setg(errp, "tap is not supported in this build");
-+    return -1;
-+}
-+
-+void tap_set_sndbuf(int fd, const NetdevTapOptions *tap, Error **errp)
-+{
-+}
-+
-+int tap_probe_vnet_hdr(int fd)
-+{
-+    return 0;
-+}
-+
-+int tap_probe_has_ufo(int fd)
-+{
-+    return 0;
-+}
-+
-+int tap_probe_vnet_hdr_len(int fd, int len)
-+{
-+    return 0;
-+}
-+
-+void tap_fd_set_vnet_hdr_len(int fd, int len)
-+{
-+}
-+
-+int tap_fd_set_vnet_le(int fd, int is_le)
-+{
-+    return -EINVAL;
-+}
-+
-+int tap_fd_set_vnet_be(int fd, int is_be)
-+{
-+    return -EINVAL;
-+}
-+
-+void tap_fd_set_offload(int fd, int csum, int tso4,
-+                        int tso6, int ecn, int ufo)
-+{
-+}
-+
-+int tap_fd_enable(int fd)
-+{
-+    return -1;
-+}
-+
-+int tap_fd_disable(int fd)
-+{
-+    return -1;
-+}
-+
-+int tap_fd_get_ifname(int fd, char *ifname)
-+{
-+    return -1;
-+}
---
-.7.4

-[Qemu-devel] [PULL 2/9] net/dump: Issue a warning for the deprecated "-net dump"
+Deleted patch
-From: Thomas Huth <thuth@redhat.com>
-Network dumping should be done with "-object filter-dump" nowadays.
-Using "-net dump" via the VLAN mechanism is considered as deprecated
-and might be removed in a future release. So warn the users now
-to inform them to user the filter-dump method instead.
-Signed-off-by: Thomas Huth <thuth@redhat.com>
-Signed-off-by: Jason Wang <jasowang@redhat.com>
----
- net/dump.c | 3 +++
-file changed, 3 insertions(+)
-diff --git a/net/dump.c b/net/dump.c
-index XXXXXXX..XXXXXXX 100644
---- a/net/dump.c
-+++ b/net/dump.c
-@@ -XXX,XX +XXX,XX @@ int net_init_dump(const Netdev *netdev, const char *name,
-     assert(peer);
-+    error_report("'-net dump' is deprecated. "
-+                 "Please use '-object filter-dump' instead.");
-+
-     if (dump->has_file) {
-         file = dump->file;
-     } else {
---
-.7.4

-[Qemu-devel] [PULL 3/9] virtio-net: fix wild pointer when remove virtio-net queues
+Deleted patch
-From: Yunjian Wang <wangyunjian@huawei.com>
-The tx_bh or tx_timer will free in virtio_net_del_queue() function, when
-removing virtio-net queues if the guest doesn't support multiqueue. But
-it might be still referenced by virtio_net_set_status(), which needs to
-be set NULL. And also the tx_waiting needs to be set zero to prevent
-virtio_net_set_status() accessing tx_bh or tx_timer.
-Cc: qemu-stable@nongnu.org
-Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>
-Signed-off-by: Jason Wang <jasowang@redhat.com>
----
- hw/net/virtio-net.c | 3 +++
-file changed, 3 insertions(+)
-diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/virtio-net.c
-+++ b/hw/net/virtio-net.c
-@@ -XXX,XX +XXX,XX @@ static void virtio_net_del_queue(VirtIONet *n, int index)
-     if (q->tx_timer) {
-         timer_del(q->tx_timer);
-         timer_free(q->tx_timer);
-+        q->tx_timer = NULL;
-     } else {
-         qemu_bh_delete(q->tx_bh);
-+        q->tx_bh = NULL;
-     }
-+    q->tx_waiting = 0;
-     virtio_del_queue(vdev, index * 2 + 1);
- }
---
-.7.4

-[Qemu-devel] [PULL 4/9] COLO-compare: Improve tcp compare trace event readability
+Deleted patch
-From: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
-Because of previous patch's trace arguments over the limit
-of UST backend, so I rewrite the patch.
-Signed-off-by: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
-Signed-off-by: Jason Wang <jasowang@redhat.com>
----
- net/colo-compare.c | 33 ++++++++++++++++++++++-----------
- net/trace-events   |  3 +--
-files changed, 23 insertions(+), 13 deletions(-)
-diff --git a/net/colo-compare.c b/net/colo-compare.c
-index XXXXXXX..XXXXXXX 100644
---- a/net/colo-compare.c
-+++ b/net/colo-compare.c
-@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_tcp(Packet *spkt, Packet *ppkt)
-     }
-     if (res != 0 && trace_event_get_state(TRACE_COLO_COMPARE_MISCOMPARE)) {
--        trace_colo_compare_pkt_info_src(inet_ntoa(ppkt->ip->ip_src),
--                                        ntohl(stcp->th_seq),
--                                        ntohl(stcp->th_ack),
--                                        res, stcp->th_flags,
--                                        spkt->size);
--
--        trace_colo_compare_pkt_info_dst(inet_ntoa(ppkt->ip->ip_dst),
--                                        ntohl(ptcp->th_seq),
--                                        ntohl(ptcp->th_ack),
--                                        res, ptcp->th_flags,
--                                        ppkt->size);
-+        char pri_ip_src[20], pri_ip_dst[20], sec_ip_src[20], sec_ip_dst[20];
-+
-+        strcpy(pri_ip_src, inet_ntoa(ppkt->ip->ip_src));
-+        strcpy(pri_ip_dst, inet_ntoa(ppkt->ip->ip_dst));
-+        strcpy(sec_ip_src, inet_ntoa(spkt->ip->ip_src));
-+        strcpy(sec_ip_dst, inet_ntoa(spkt->ip->ip_dst));
-+
-+        trace_colo_compare_ip_info(ppkt->size, pri_ip_src,
-+                                   pri_ip_dst, spkt->size,
-+                                   sec_ip_src, sec_ip_dst);
-+
-+        trace_colo_compare_tcp_info("pri tcp packet",
-+                                    ntohl(ptcp->th_seq),
-+                                    ntohl(ptcp->th_ack),
-+                                    res, ptcp->th_flags,
-+                                    ppkt->size);
-+
-+        trace_colo_compare_tcp_info("sec tcp packet",
-+                                    ntohl(stcp->th_seq),
-+                                    ntohl(stcp->th_ack),
-+                                    res, stcp->th_flags,
-+                                    spkt->size);
-         qemu_hexdump((char *)ppkt->data, stderr,
-                      "colo-compare ppkt", ppkt->size);
-diff --git a/net/trace-events b/net/trace-events
-index XXXXXXX..XXXXXXX 100644
---- a/net/trace-events
-+++ b/net/trace-events
-@@ -XXX,XX +XXX,XX @@ colo_compare_icmp_miscompare(const char *sta, int size) ": %s = %d"
- colo_compare_ip_info(int psize, const char *sta, const char *stb, int ssize, const char *stc, const char *std) "ppkt size = %d, ip_src = %s, ip_dst = %s, spkt size = %d, ip_src = %s, ip_dst = %s"
- colo_old_packet_check_found(int64_t old_time) "%" PRId64
- colo_compare_miscompare(void) ""
--colo_compare_pkt_info_src(const char *src, uint32_t sseq, uint32_t sack, int res, uint32_t sflag, int ssize) "src/dst: %s s: seq/ack=%u/%u res=%d flags=%x spkt_size: %d\n"
--colo_compare_pkt_info_dst(const char *dst, uint32_t dseq, uint32_t dack, int res, uint32_t dflag, int dsize) "src/dst: %s d: seq/ack=%u/%u res=%d flags=%x dpkt_size: %d\n"
-+colo_compare_tcp_info(const char *pkt, uint32_t seq, uint32_t ack, int res, uint32_t flag, int size) "side: %s seq/ack= %u/%u res= %d flags= %x pkt_size: %d\n"
- # net/filter-rewriter.c
- colo_filter_rewriter_debug(void) ""
---
-.7.4

-[Qemu-devel] [PULL 9/9] e1000e: Fix ICR "Other" causes clear logic
+[PULL 1/5] hw/net/e1000e: advance desc_offset in case of null descriptor
-From: Sameeh Jubran <sameeh@daynix.com>
+From: Prasad J Pandit <pjp@fedoraproject.org>
-This commit fixes a bug which causes the guest to hang. The bug was
+While receiving packets via e1000e_write_packet_to_guest() routine,
-observed upon a "receive overrun" (bit #6 of the ICR register)
+'desc_offset' is advanced only when RX descriptor is processed. And
-interrupt which could be triggered post migration in a heavy traffic
+RX descriptor is not processed if it has NULL buffer address.
-environment. Even though the "receive overrun" bit (#6) is masked out
+This may lead to an infinite loop condition. Increament 'desc_offset'
-by the IMS register (refer to the log below) the driver still receives
+to process next descriptor in the ring to avoid infinite loop.
 an interrupt as the "receive overrun" bit (#6) causes the "Other" -
 bit #24 of the ICR register - bit to be set as documented below. The
 driver handles the interrupt and clears the "Other" bit (#24) but
 doesn't clear the "receive overrun" bit (#6) which leads to an
 infinite loop. Apparently the Windows driver expects that the "receive
 overrun" bit and other ones - documented below - to be cleared when
 the "Other" bit (#24) is cleared.
-So to sum that up:
+Reported-by: Cheol-woo Myung <330cjfdn@gmail.com>
-. Bit #6 of the ICR register is set by heavy traffic
+Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
 . As a results of setting bit #6, bit #24 is set
 . The driver receives an interrupt for bit 24 (it doesn't receieve an
    interrupt for bit #6 as it is masked out by IMS)
 . The driver handles and clears the interrupt of bit #24
 . Bit #6 is still set.
 . 2 happens all over again
 The Interrupt Cause Read - ICR register:
 The ICR has the "Other" bit - bit #24 - that is set when one or more
 of the following ICR register's bits are set:
 LSC - bit #2, RXO - bit #6, MDAC - bit #9, SRPD - bit #16, ACK - bit
 #17, MNG - bit #18
 This bug can occur with any of these bits depending on the driver's
 behaviour and the way it configures the device. However, trying to
 reproduce it with any bit other than RX0 is challenging and came to
 failure as the drivers don't implement most of these bits, trying to
 reproduce it with LSC (Link Status Change - bit #2) bit didn't succeed
 too as it seems that Windows handles this bit differently.
 Log sample of the storm:
 @1494850819.411877:e1000e_irq_pending_interrupts ICR PENDING: 0x1000000 (ICR: 0x815000c2, IMS: 0x1a00004)
 @1494850819.411900:e1000e_irq_pending_interrupts ICR PENDING: 0x0 (ICR: 0x815000c2, IMS: 0xa00004)
 @1494850819.411915:e1000e_irq_pending_interrupts ICR PENDING: 0x0 (ICR: 0x815000c2, IMS: 0xa00004)
 @1494850819.412380:e1000e_irq_pending_interrupts ICR PENDING: 0x0 (ICR: 0x815000c2, IMS: 0xa00004)
 @1494850819.412395:e1000e_irq_pending_interrupts ICR PENDING: 0x0 (ICR: 0x815000c2, IMS: 0xa00004)
 @1494850819.412436:e1000e_irq_pending_interrupts ICR PENDING: 0x0 (ICR: 0x815000c2, IMS: 0xa00004)
 @1494850819.412441:e1000e_irq_pending_interrupts ICR PENDING: 0x0 (ICR: 0x815000c2, IMS: 0xa00004)
 @1494850819.412998:e1000e_irq_pending_interrupts ICR PENDING: 0x1000000 (ICR: 0x815000c2, IMS: 0x1a00004)
 * This bug behaviour wasn't observed with the Linux driver.
 This commit solves:
 https://bugzilla.redhat.com/show_bug.cgi?id=1447935
 https://bugzilla.redhat.com/show_bug.cgi?id=1449490
 Cc: qemu-stable@nongnu.org
 Signed-off-by: Sameeh Jubran <sjubran@redhat.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- hw/net/e1000e_core.c | 10 ++++++++--
+ hw/net/e1000e_core.c | 8 ++++----
-file changed, 8 insertions(+), 2 deletions(-)
+file changed, 4 insertions(+), 4 deletions(-)
 diff --git a/hw/net/e1000e_core.c b/hw/net/e1000e_core.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/net/e1000e_core.c
 +++ b/hw/net/e1000e_core.c
-@@ -XXX,XX +XXX,XX @@ e1000e_set_ics(E1000ECore *core, int index, uint32_t val)
+@@ -XXX,XX +XXX,XX @@ e1000e_write_packet_to_guest(E1000ECore *core, struct NetRxPkt *pkt,
- static void
+                           (const char *) &fcs_pad, e1000x_fcs_len(core->mac));
- e1000e_set_icr(E1000ECore *core, int index, uint32_t val)
+                 }
- {
+             }
-+    uint32_t icr = 0;
+-            desc_offset += desc_size;
-     if ((core->mac[ICR] & E1000_ICR_ASSERTED) &&
+-            if (desc_offset >= total_size) {
-         (core->mac[CTRL_EXT] & E1000_CTRL_EXT_IAME)) {
+-                is_last = true;
-         trace_e1000e_irq_icr_process_iame();
+-            }
-         e1000e_clear_ims_bits(core, core->mac[IAM]);
+         } else { /* as per intel docs; skip descriptors with null buf addr */
-     }
+             trace_e1000e_rx_null_descriptor();
+         }
--    trace_e1000e_irq_icr_write(val, core->mac[ICR], core->mac[ICR] & ~val);
++        desc_offset += desc_size;
--    core->mac[ICR] &= ~val;
++        if (desc_offset >= total_size) {
-+    icr = core->mac[ICR] & ~val;
++            is_last = true;
-+    /* Windows driver expects that the "receive overrun" bit and other
++        }
-+     * ones to be cleared when the "Other" bit (#24) is cleared.
-+     */
+         e1000e_write_rx_descr(core, desc, is_last ? core->rx_pkt : NULL,
-+    icr = (val & E1000_ICR_OTHER) ? (icr & ~E1000_ICR_OTHER_CAUSES) : icr;
+                            rss_info, do_ps ? ps_hdr_len : 0, &bastate.written);
 +    trace_e1000e_irq_icr_write(val, core->mac[ICR], icr);
 +    core->mac[ICR] = icr;
      e1000e_update_interrupt_state(core);
  }
 --
 .7.4

-[Qemu-devel] [PULL 5/9] hmp / net: Mark host_net_add/remove as deprecated
+[PULL 2/5] net: do not exit on "netdev_add help" monitor command
-From: Thomas Huth <thuth@redhat.com>
+From: Paolo Bonzini <pbonzini@redhat.com>
-The netdev_add and netdev_del commands should be used nowadays instead.
+"netdev_add help" is causing QEMU to exit because the code that
 invokes show_netdevs is shared between CLI and HMP processing.
 Move the check to the callers so that exit(0) remains only
 in the CLI flow.
-Signed-off-by: Thomas Huth <thuth@redhat.com>
+"netdev_add help" is not fixed by this patch; that is left for
 later work.
 Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- hmp-commands.hx |  8 ++++----
+ include/net/net.h  |  1 +
- net/net.c       | 13 +++++++++++++
+ monitor/hmp-cmds.c |  6 +++++
-files changed, 17 insertions(+), 4 deletions(-)
+ net/net.c          | 68 +++++++++++++++++++++++++++---------------------------
 files changed, 41 insertions(+), 34 deletions(-)
-diff --git a/hmp-commands.hx b/hmp-commands.hx
+diff --git a/include/net/net.h b/include/net/net.h
 index XXXXXXX..XXXXXXX 100644
---- a/hmp-commands.hx
+--- a/include/net/net.h
-+++ b/hmp-commands.hx
++++ b/include/net/net.h
-@@ -XXX,XX +XXX,XX @@ ETEXI
+@@ -XXX,XX +XXX,XX @@ extern const char *host_net_devices[];
-         .name       = "host_net_add",
-         .args_type  = "device:s,opts:s?",
+ /* from net.c */
-         .params     = "tap|user|socket|vde|netmap|bridge|vhost-user|dump [options]",
+ int net_client_parse(QemuOptsList *opts_list, const char *str);
--        .help       = "add host VLAN client",
++void show_netdevs(void);
-+        .help       = "add host VLAN client (deprecated, use netdev_add instead)",
+ int net_init_clients(Error **errp);
-         .cmd        = hmp_host_net_add,
+ void net_check_clients(void);
-         .command_completion = host_net_add_completion,
+ void net_cleanup(void);
-     },
+diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
-@@ -XXX,XX +XXX,XX @@ ETEXI
+index XXXXXXX..XXXXXXX 100644
- STEXI
+--- a/monitor/hmp-cmds.c
- @item host_net_add
++++ b/monitor/hmp-cmds.c
- @findex host_net_add
+@@ -XXX,XX +XXX,XX @@
--Add host VLAN client.
+ #include "qemu/option.h"
-+Add host VLAN client. Deprecated, please use @code{netdev_add} instead.
+ #include "qemu/timer.h"
- ETEXI
+ #include "qemu/sockets.h"
++#include "qemu/help_option.h"
-     {
+ #include "monitor/monitor-internal.h"
-         .name       = "host_net_remove",
+ #include "qapi/error.h"
-         .args_type  = "vlan_id:i,device:s",
+ #include "qapi/clone-visitor.h"
-         .params     = "vlan_id name",
+@@ -XXX,XX +XXX,XX @@ void hmp_netdev_add(Monitor *mon, const QDict *qdict)
--        .help       = "remove host VLAN client",
+ {
-+        .help       = "remove host VLAN client (deprecated, use netdev_del instead)",
+     Error *err = NULL;
-         .cmd        = hmp_host_net_remove,
+     QemuOpts *opts;
-         .command_completion = host_net_remove_completion,
++    const char *type = qdict_get_try_str(qdict, "type");
-     },
-@@ -XXX,XX +XXX,XX @@ ETEXI
++    if (type && is_help_option(type)) {
- STEXI
++        show_netdevs();
- @item host_net_remove
++        return;
- @findex host_net_remove
++    }
--Remove host VLAN client.
+     opts = qemu_opts_from_qdict(qemu_find_opts("netdev"), qdict, &err);
-+Remove host VLAN client. Deprecated, please use @code{netdev_del} instead.
+     if (err) {
- ETEXI
+         goto out;
      {
 diff --git a/net/net.c b/net/net.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/net.c
 +++ b/net/net.c
 @@ -XXX,XX +XXX,XX @@
- #include "qapi-visit.h"
+ #include "qemu/config-file.h"
- #include "qapi/opts-visitor.h"
+ #include "qemu/ctype.h"
- #include "sysemu/sysemu.h"
+ #include "qemu/iov.h"
-+#include "sysemu/qtest.h"
++#include "qemu/qemu-print.h"
- #include "net/filter.h"
+ #include "qemu/main-loop.h"
- #include "qapi/string-output-visitor.h"
+ #include "qemu/option.h"
+ #include "qapi/error.h"
-@@ -XXX,XX +XXX,XX @@ void hmp_host_net_add(Monitor *mon, const QDict *qdict)
+@@ -XXX,XX +XXX,XX @@ static int net_client_init1(const Netdev *netdev, bool is_netdev, Error **errp)
-     const char *opts_str = qdict_get_try_str(qdict, "opts");
+     return 0;
-     Error *local_err = NULL;
+ }
-     QemuOpts *opts;
-+    static bool warned;
+-static void show_netdevs(void)
 +void show_netdevs(void)
  {
      int idx;
      const char *available_netdevs[] = {
@@ -XXX,XX +XXX,XX @@ static void show_netdevs(void)
  #endif
      };
 -    printf("Available netdev backend types:\n");
 +    qemu_printf("Available netdev backend types:\n");
      for (idx = 0; idx < ARRAY_SIZE(available_netdevs); idx++) {
 -        puts(available_netdevs[idx]);
 +        qemu_printf("%s\n", available_netdevs[idx]);
      }
  }
@@ -XXX,XX +XXX,XX @@ static int net_client_init(QemuOpts *opts, bool is_netdev, Error **errp)
      int ret = -1;
      Visitor *v = opts_visitor_new(opts);
 -    const char *type = qemu_opt_get(opts, "type");
 -
 -    if (is_netdev && type && is_help_option(type)) {
 -        show_netdevs();
 -        exit(0);
 -    } else {
 -        /* Parse convenience option format ip6-net=fec0::0[/64] */
 -        const char *ip6_net = qemu_opt_get(opts, "ipv6-net");
 +    /* Parse convenience option format ip6-net=fec0::0[/64] */
 +    const char *ip6_net = qemu_opt_get(opts, "ipv6-net");
 -        if (ip6_net) {
 -            char *prefix_addr;
 -            unsigned long prefix_len = 64; /* Default 64bit prefix length. */
 +    if (ip6_net) {
 +        char *prefix_addr;
 +        unsigned long prefix_len = 64; /* Default 64bit prefix length. */
 -            substrings = g_strsplit(ip6_net, "/", 2);
 -            if (!substrings || !substrings[0]) {
 -                error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "ipv6-net",
 -                           "a valid IPv6 prefix");
 -                goto out;
 -            }
 +        substrings = g_strsplit(ip6_net, "/", 2);
 +        if (!substrings || !substrings[0]) {
 +            error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "ipv6-net",
 +                       "a valid IPv6 prefix");
 +            goto out;
 +        }
 -            prefix_addr = substrings[0];
 +        prefix_addr = substrings[0];
 -            /* Handle user-specified prefix length. */
 -            if (substrings[1] &&
 -                qemu_strtoul(substrings[1], NULL, 10, &prefix_len))
 -            {
 -                error_setg(errp, QERR_INVALID_PARAMETER_VALUE,
 -                           "ipv6-prefixlen", "a number");
 -                goto out;
 -            }
 -
 -            qemu_opt_set(opts, "ipv6-prefix", prefix_addr, &error_abort);
 -            qemu_opt_set_number(opts, "ipv6-prefixlen", prefix_len,
 -                                &error_abort);
 -            qemu_opt_unset(opts, "ipv6-net");
 +        /* Handle user-specified prefix length. */
 +        if (substrings[1] &&
 +            qemu_strtoul(substrings[1], NULL, 10, &prefix_len))
 +        {
 +            error_setg(errp, QERR_INVALID_PARAMETER_VALUE,
 +                       "ipv6-prefixlen", "a number");
 +            goto out;
          }
 +
-+    if (!warned && !qtest_enabled()) {
++        qemu_opt_set(opts, "ipv6-prefix", prefix_addr, &error_abort);
-+        error_report("host_net_add is deprecated, use netdev_add instead");
++        qemu_opt_set_number(opts, "ipv6-prefixlen", prefix_len,
-+        warned = true;
++                            &error_abort);
 +        qemu_opt_unset(opts, "ipv6-net");
      }
      /* Create an ID for -net if the user did not specify one */
@@ -XXX,XX +XXX,XX @@ static int net_init_client(void *dummy, QemuOpts *opts, Error **errp)
  static int net_init_netdev(void *dummy, QemuOpts *opts, Error **errp)
  {
 +    const char *type = qemu_opt_get(opts, "type");
 +
 +    if (type && is_help_option(type)) {
 +        show_netdevs();
 +        exit(0);
 +    }
+     return net_client_init(opts, true, errp);
-     if (!net_host_check_device(device)) {
+ }
-         monitor_printf(mon, "invalid host network device %s\n", device);
@@ -XXX,XX +XXX,XX @@ void hmp_host_net_remove(Monitor *mon, const QDict *qdict)
      NetClientState *nc;
      int vlan_id = qdict_get_int(qdict, "vlan_id");
      const char *device = qdict_get_str(qdict, "device");
 +    static bool warned;
 +
 +    if (!warned && !qtest_enabled()) {
 +        error_report("host_net_remove is deprecated, use netdev_del instead");
 +        warned = true;
 +    }
      nc = net_hub_find_client_by_name(vlan_id, device);
      if (!nc) {
 --
 .7.4

-[Qemu-devel] [PULL 7/9] net/filter-mirror.c: Rename filter_mirror_send() and fix codestyle
+[PULL 3/5] net: purge queued rx packets on queue deletion
-From: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
+From: Yuri Benditovich <yuri.benditovich@daynix.com>
-Because filter_mirror_receive_iov() and filter_redirector_receive_iov()
+https://bugzilla.redhat.com/show_bug.cgi?id=1829272
-both use the filter_mirror_send() to send packet, so I change
+When deleting queue pair, purge pending RX packets if any.
-filter_mirror_send() to filter_send() that looks more common.
+Example of problematic flow:
-And fix some codestyle.
+. Bring up q35 VM with tap (vhost off) and virtio-net or e1000e
 . Run ping flood to the VM NIC ( 1 ms interval)
 . Hot unplug the NIC device (device_del)
    During unplug process one or more packets come, the NIC
    can't receive, tap disables read_poll
 . Hot plug the device (device_add) with the same netdev
 The tap stays with read_poll disabled and does not receive
 any packets anymore (tap_send never triggered)
-Signed-off-by: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
+Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- net/filter-mirror.c | 29 ++++++++++++++++-------------
+ net/net.c | 12 ++++++++----
-file changed, 16 insertions(+), 13 deletions(-)
+file changed, 8 insertions(+), 4 deletions(-)
-diff --git a/net/filter-mirror.c b/net/filter-mirror.c
+diff --git a/net/net.c b/net/net.c
 index XXXXXXX..XXXXXXX 100644
---- a/net/filter-mirror.c
+--- a/net/net.c
-+++ b/net/filter-mirror.c
++++ b/net/net.c
-@@ -XXX,XX +XXX,XX @@ typedef struct MirrorState {
+@@ -XXX,XX +XXX,XX @@ void qemu_del_nic(NICState *nic)
-     SocketReadState rs;
- } MirrorState;
+     qemu_macaddr_set_free(&nic->conf->macaddr);
--static int filter_mirror_send(CharBackend *chr_out,
+-    /* If this is a peer NIC and peer has already been deleted, free it now. */
--                              const struct iovec *iov,
+-    if (nic->peer_deleted) {
--                              int iovcnt)
+-        for (i = 0; i < queues; i++) {
-+static int filter_send(CharBackend *chr_out,
+-            qemu_free_net_client(qemu_get_subqueue(nic, i)->peer);
-+                       const struct iovec *iov,
++    for (i = 0; i < queues; i++) {
-+                       int iovcnt)
++        NetClientState *nc = qemu_get_subqueue(nic, i);
- {
++        /* If this is a peer NIC and peer has already been deleted, free it now. */
-     int ret = 0;
++        if (nic->peer_deleted) {
-     ssize_t size = 0;
++            qemu_free_net_client(nc->peer);
-@@ -XXX,XX +XXX,XX @@ static ssize_t filter_mirror_receive_iov(NetFilterState *nf,
++        } else if (nc->peer) {
-     MirrorState *s = FILTER_MIRROR(nf);
++            /* if there are RX packets pending, complete them */
-     int ret;
++            qemu_purge_queued_packets(nc->peer);
+         }
 -    ret = filter_mirror_send(&s->chr_out, iov, iovcnt);
 +    ret = filter_send(&s->chr_out, iov, iovcnt);
      if (ret) {
 -        error_report("filter_mirror_send failed(%s)", strerror(-ret));
 +        error_report("filter mirror send failed(%s)", strerror(-ret));
      }
-     /*
-@@ -XXX,XX +XXX,XX @@ static ssize_t filter_redirector_receive_iov(NetFilterState *nf,
-     int ret;
-     if (qemu_chr_fe_get_driver(&s->chr_out)) {
--        ret = filter_mirror_send(&s->chr_out, iov, iovcnt);
-+        ret = filter_send(&s->chr_out, iov, iovcnt);
-         if (ret) {
--            error_report("filter_mirror_send failed(%s)", strerror(-ret));
-+            error_report("filter redirector send failed(%s)", strerror(-ret));
-         }
-         return iov_size(iov, iovcnt);
-     } else {
-@@ -XXX,XX +XXX,XX @@ static char *filter_redirector_get_indev(Object *obj, Error **errp)
-     return g_strdup(s->indev);
- }
--static void
--filter_redirector_set_indev(Object *obj, const char *value, Error **errp)
-+static void filter_redirector_set_indev(Object *obj,
-+                                        const char *value,
-+                                        Error **errp)
- {
-     MirrorState *s = FILTER_REDIRECTOR(obj);
-@@ -XXX,XX +XXX,XX @@ static char *filter_mirror_get_outdev(Object *obj, Error **errp)
-     return g_strdup(s->outdev);
- }
--static void
--filter_mirror_set_outdev(Object *obj, const char *value, Error **errp)
-+static void filter_mirror_set_outdev(Object *obj,
-+                                     const char *value,
-+                                     Error **errp)
- {
-     MirrorState *s = FILTER_MIRROR(obj);
-@@ -XXX,XX +XXX,XX @@ static char *filter_redirector_get_outdev(Object *obj, Error **errp)
-     return g_strdup(s->outdev);
- }
--static void
--filter_redirector_set_outdev(Object *obj, const char *value, Error **errp)
-+static void filter_redirector_set_outdev(Object *obj,
-+                                         const char *value,
-+                                         Error **errp)
- {
-     MirrorState *s = FILTER_REDIRECTOR(obj);
 --
 .7.4

-[Qemu-devel] [PULL 8/9] net/filter-rewriter: Remove unused option in filter-rewriter
+[PULL 4/5] tap: fix a memory leak
-From: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
+From: yuanjungong <ruc_gongyuanjun@163.com>
-Signed-off-by: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
+Close fd before returning.
 Buglink: https://bugs.launchpad.net/qemu/+bug/1904486
 Signed-off-by: yuanjungong <ruc_gongyuanjun@163.com>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- qemu-options.hx | 2 +-
+ net/tap.c | 2 ++
-file changed, 1 insertion(+), 1 deletion(-)
+file changed, 2 insertions(+)
-diff --git a/qemu-options.hx b/qemu-options.hx
+diff --git a/net/tap.c b/net/tap.c
 index XXXXXXX..XXXXXXX 100644
---- a/qemu-options.hx
+--- a/net/tap.c
-+++ b/qemu-options.hx
++++ b/net/tap.c
-@@ -XXX,XX +XXX,XX @@ Create a filter-redirector we need to differ outdev id from indev id, id can not
+@@ -XXX,XX +XXX,XX @@ int net_init_tap(const Netdev *netdev, const char *name,
- be the same. we can just use indev or outdev, but at least one of indev or outdev
+         if (ret < 0) {
- need to be specified.
+             error_setg_errno(errp, -ret, "%s: Can't use file descriptor %d",
+                              name, fd);
--@item -object filter-rewriter,id=@var{id},netdev=@var{netdevid},rewriter-mode=@var{mode}[,queue=@var{all|rx|tx}]
++            close(fd);
-+@item -object filter-rewriter,id=@var{id},netdev=@var{netdevid}[,queue=@var{all|rx|tx}]
+             return -1;
+         }
- Filter-rewriter is a part of COLO project.It will rewrite tcp packet to
- secondary from primary to keep secondary tcp connection,and rewrite
+@@ -XXX,XX +XXX,XX @@ int net_init_tap(const Netdev *netdev, const char *name,
                           vhostfdname, vnet_hdr, fd, &err);
          if (err) {
              error_propagate(errp, err);
 +            close(fd);
              return -1;
          }
      } else if (tap->has_fds) {
 --
 .7.4

-[Qemu-devel] [PULL 6/9] net/filter-mirror.c: Remove duplicate check code.
+[PULL 5/5] net: Use correct default-path macro for downscript
-From: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
+From: Keqian Zhu <zhukeqian1@huawei.com>
-The s->outdev have checked in filter_mirror_set_outdev().
+Fixes: 63c4db4c2e6d (net: relocate paths to helpers and scripts)
+Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com>
 Signed-off-by: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- net/filter-mirror.c | 6 ------
+ net/tap.c | 3 ++-
-file changed, 6 deletions(-)
+file changed, 2 insertions(+), 1 deletion(-)
-diff --git a/net/filter-mirror.c b/net/filter-mirror.c
+diff --git a/net/tap.c b/net/tap.c
 index XXXXXXX..XXXXXXX 100644
---- a/net/filter-mirror.c
+--- a/net/tap.c
-+++ b/net/filter-mirror.c
++++ b/net/tap.c
-@@ -XXX,XX +XXX,XX @@ static void filter_mirror_setup(NetFilterState *nf, Error **errp)
+@@ -XXX,XX +XXX,XX @@ free_fail:
-     MirrorState *s = FILTER_MIRROR(nf);
+             script = default_script = get_relocated_path(DEFAULT_NETWORK_SCRIPT);
-     Chardev *chr;
+         }
+         if (!downscript) {
--    if (!s->outdev) {
+-            downscript = default_downscript = get_relocated_path(DEFAULT_NETWORK_SCRIPT);
--        error_setg(errp, "filter mirror needs 'outdev' "
++            downscript = default_downscript =
--                   "property set");
++                                 get_relocated_path(DEFAULT_NETWORK_DOWN_SCRIPT);
--        return;
+         }
--    }
--
+         if (tap->has_ifname) {
      chr = qemu_chr_find(s->outdev);
      if (chr == NULL) {
          error_set(errp, ERROR_CLASS_DEVICE_NOT_FOUND,
 --
 .7.4

The following changes since commit 56821559f0ba682fe6b367815572e6f974d329ab:

Merge remote-tracking branch 'dgilbert/tags/pull-hmp-20170517' into staging (2017-05-18 13:36:15 +0100)

are available in the git repository at:

https://github.com/jasowang/qemu.git tags/net-pull-request

for you to fetch changes up to 82342e91b60a4a078811df4e1a545e57abffa11d:

e1000e: Fix ICR "Other" causes clear logic (2017-05-23 10:10:38 +0800)

----------------------------------------------------------------

----------------------------------------------------------------
Sameeh Jubran (1):
      e1000e: Fix ICR "Other" causes clear logic

Thomas Huth (3):
      net/tap: Replace tap-haiku.c and tap-aix.c by a generic tap-stub.c
      net/dump: Issue a warning for the deprecated "-net dump"
      hmp / net: Mark host_net_add/remove as deprecated

Yunjian Wang (1):
      virtio-net: fix wild pointer when remove virtio-net queues

Zhang Chen (4):
      COLO-compare: Improve tcp compare trace event readability
      net/filter-mirror.c: Remove duplicate check code.
      net/filter-mirror.c: Rename filter_mirror_send() and fix codestyle
      net/filter-rewriter: Remove unused option in filter-rewriter

hmp-commands.hx               |  8 ++--
 hw/net/e1000e_core.c          | 10 ++++-
 hw/net/virtio-net.c           |  3 ++
 net/Makefile.objs             | 15 ++++----
 net/colo-compare.c            | 33 ++++++++++------
 net/dump.c                    |  3 ++
 net/filter-mirror.c           | 35 ++++++++---------
 net/net.c                     | 13 +++++++
 net/tap-haiku.c               | 87 -------------------------------------------
 net/{tap-aix.c => tap-stub.c} |  3 +-
 net/trace-events              |  3 +-
 qemu-options.hx               |  2 +-
 12 files changed, 80 insertions(+), 135 deletions(-)
 delete mode 100644 net/tap-haiku.c
 rename net/{tap-aix.c => tap-stub.c} (97%)

From: Thomas Huth <thuth@redhat.com>

The files tap-haiku.c and tap-aix.c are identical (except one line
of error message). We should avoid such code duplication, so replace
these by a generic tap-stub.c file instead.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/Makefile.objs | 15 +++++-----
 net/tap-aix.c     | 88 -------------------------------------------------------
 net/tap-haiku.c   | 87 ------------------------------------------------------
 net/tap-stub.c    | 87 ++++++++++++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 95 insertions(+), 182 deletions(-)
 delete mode 100644 net/tap-aix.c
 delete mode 100644 net/tap-haiku.c
 create mode 100644 net/tap-stub.c

diff --git a/net/Makefile.objs b/net/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/net/Makefile.objs
+++ b/net/Makefile.objs
@@ -XXX,XX +XXX,XX @@ common-obj-y += socket.o
 common-obj-y += dump.o
 common-obj-y += eth.o
 common-obj-$(CONFIG_L2TPV3) += l2tpv3.o
-common-obj-$(CONFIG_POSIX) += tap.o vhost-user.o
-common-obj-$(CONFIG_LINUX) += tap-linux.o
-common-obj-$(CONFIG_WIN32) += tap-win32.o
-common-obj-$(CONFIG_BSD) += tap-bsd.o
-common-obj-$(CONFIG_SOLARIS) += tap-solaris.o
-common-obj-$(CONFIG_AIX) += tap-aix.o
-common-obj-$(CONFIG_HAIKU) += tap-haiku.o
+common-obj-$(CONFIG_POSIX) += vhost-user.o
 common-obj-$(CONFIG_SLIRP) += slirp.o
 common-obj-$(CONFIG_VDE) += vde.o
 common-obj-$(CONFIG_NETMAP) += netmap.o
@@ -XXX,XX +XXX,XX @@ common-obj-y += colo-compare.o
 common-obj-y += colo.o
 common-obj-y += filter-rewriter.o
 common-obj-y += filter-replay.o
+
+tap-obj-$(CONFIG_LINUX) = tap-linux.o
+tap-obj-$(CONFIG_BSD) = tap-bsd.o
+tap-obj-$(CONFIG_SOLARIS) = tap-solaris.o
+tap-obj-y ?= tap-stub.o
+common-obj-$(CONFIG_POSIX) += tap.o $(tap-obj-y)
+common-obj-$(CONFIG_WIN32) += tap-win32.o
diff --git a/net/tap-aix.c b/net/tap-aix.c
deleted file mode 100644
index XXXXXXX..XXXXXXX
--- a/net/tap-aix.c
+++ /dev/null
@@ -XXX,XX +XXX,XX @@
-/*
- * QEMU System Emulator
- *
- * Copyright (c) 2003-2008 Fabrice Bellard
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
- * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- */
-
-#include "qemu/osdep.h"
-#include "qapi/error.h"
-#include "tap_int.h"
-
-int tap_open(char *ifname, int ifname_size, int *vnet_hdr,
-             int vnet_hdr_required, int mq_required, Error **errp)
-{
-    error_setg(errp, "no tap on AIX");
-    return -1;
-}
-
-void tap_set_sndbuf(int fd, const NetdevTapOptions *tap, Error **errp)
-{
-}
-
-int tap_probe_vnet_hdr(int fd)
-{
-    return 0;
-}
-
-int tap_probe_has_ufo(int fd)
-{
-    return 0;
-}
-
-int tap_probe_vnet_hdr_len(int fd, int len)
-{
-    return 0;
-}
-
-void tap_fd_set_vnet_hdr_len(int fd, int len)
-{
-}
-
-int tap_fd_set_vnet_le(int fd, int is_le)
-{
-    return -EINVAL;
-}
-
-int tap_fd_set_vnet_be(int fd, int is_be)
-{
-    return -EINVAL;
-}
-
-void tap_fd_set_offload(int fd, int csum, int tso4,
-                        int tso6, int ecn, int ufo)
-{
-}
-
-int tap_fd_enable(int fd)
-{
-    return -1;
-}
-
-int tap_fd_disable(int fd)
-{
-    return -1;
-}
-
-int tap_fd_get_ifname(int fd, char *ifname)
-{
-    return -1;
-}
-
diff --git a/net/tap-haiku.c b/net/tap-haiku.c
deleted file mode 100644
index XXXXXXX..XXXXXXX
--- a/net/tap-haiku.c
+++ /dev/null
@@ -XXX,XX +XXX,XX @@
-/*
- * QEMU System Emulator
- *
- * Copyright (c) 2003-2008 Fabrice Bellard
- *
- * Permission is hereby granted, free of charge, to any person obtaining a copy
- * of this software and associated documentation files (the "Software"), to deal
- * in the Software without restriction, including without limitation the rights
- * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
- * copies of the Software, and to permit persons to whom the Software is
- * furnished to do so, subject to the following conditions:
- *
- * The above copyright notice and this permission notice shall be included in
- * all copies or substantial portions of the Software.
- *
- * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
- * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
- * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
- * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
- * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
- * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
- * THE SOFTWARE.
- */
-
-#include "qemu/osdep.h"
-#include "qapi/error.h"
-#include "tap_int.h"
-
-int tap_open(char *ifname, int ifname_size, int *vnet_hdr,
-             int vnet_hdr_required, int mq_required, Error **errp)
-{
-    error_setg(errp, "no tap on Haiku");
-    return -1;
-}
-
-void tap_set_sndbuf(int fd, const NetdevTapOptions *tap, Error **errp)
-{
-}
-
-int tap_probe_vnet_hdr(int fd)
-{
-    return 0;
-}
-
-int tap_probe_has_ufo(int fd)
-{
-    return 0;
-}
-
-int tap_probe_vnet_hdr_len(int fd, int len)
-{
-    return 0;
-}
-
-void tap_fd_set_vnet_hdr_len(int fd, int len)
-{
-}
-
-int tap_fd_set_vnet_le(int fd, int is_le)
-{
-    return -EINVAL;
-}
-
-int tap_fd_set_vnet_be(int fd, int is_be)
-{
-    return -EINVAL;
-}
-
-void tap_fd_set_offload(int fd, int csum, int tso4,
-                        int tso6, int ecn, int ufo)
-{
-}
-
-int tap_fd_enable(int fd)
-{
-    return -1;
-}
-
-int tap_fd_disable(int fd)
-{
-    return -1;
-}
-
-int tap_fd_get_ifname(int fd, char *ifname)
-{
-    return -1;
-}
diff --git a/net/tap-stub.c b/net/tap-stub.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/net/tap-stub.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU System Emulator
+ *
+ * Copyright (c) 2003-2008 Fabrice Bellard
+ *
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/error.h"
+#include "tap_int.h"
+
+int tap_open(char *ifname, int ifname_size, int *vnet_hdr,
+             int vnet_hdr_required, int mq_required, Error **errp)
+{
+    error_setg(errp, "tap is not supported in this build");
+    return -1;
+}
+
+void tap_set_sndbuf(int fd, const NetdevTapOptions *tap, Error **errp)
+{
+}
+
+int tap_probe_vnet_hdr(int fd)
+{
+    return 0;
+}
+
+int tap_probe_has_ufo(int fd)
+{
+    return 0;
+}
+
+int tap_probe_vnet_hdr_len(int fd, int len)
+{
+    return 0;
+}
+
+void tap_fd_set_vnet_hdr_len(int fd, int len)
+{
+}
+
+int tap_fd_set_vnet_le(int fd, int is_le)
+{
+    return -EINVAL;
+}
+
+int tap_fd_set_vnet_be(int fd, int is_be)
+{
+    return -EINVAL;
+}
+
+void tap_fd_set_offload(int fd, int csum, int tso4,
+                        int tso6, int ecn, int ufo)
+{
+}
+
+int tap_fd_enable(int fd)
+{
+    return -1;
+}
+
+int tap_fd_disable(int fd)
+{
+    return -1;
+}
+
+int tap_fd_get_ifname(int fd, char *ifname)
+{
+    return -1;
+}
-- 
2.7.4

From: Yunjian Wang <wangyunjian@huawei.com>

The tx_bh or tx_timer will free in virtio_net_del_queue() function, when
removing virtio-net queues if the guest doesn't support multiqueue. But
it might be still referenced by virtio_net_set_status(), which needs to
be set NULL. And also the tx_waiting needs to be set zero to prevent
virtio_net_set_status() accessing tx_bh or tx_timer.

Cc: qemu-stable@nongnu.org
Signed-off-by: Yunjian Wang <wangyunjian@huawei.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/virtio-net.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -XXX,XX +XXX,XX @@ static void virtio_net_del_queue(VirtIONet *n, int index)
     if (q->tx_timer) {
         timer_del(q->tx_timer);
         timer_free(q->tx_timer);
+        q->tx_timer = NULL;
     } else {
         qemu_bh_delete(q->tx_bh);
+        q->tx_bh = NULL;
     }
+    q->tx_waiting = 0;
     virtio_del_queue(vdev, index * 2 + 1);
 }
 
-- 
2.7.4

From: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>

Because of previous patch's trace arguments over the limit
of UST backend, so I rewrite the patch.

Signed-off-by: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/colo-compare.c | 33 ++++++++++++++++++++++-----------
 net/trace-events   |  3 +--
 2 files changed, 23 insertions(+), 13 deletions(-)

diff --git a/net/colo-compare.c b/net/colo-compare.c
index XXXXXXX..XXXXXXX 100644
--- a/net/colo-compare.c
+++ b/net/colo-compare.c
@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_tcp(Packet *spkt, Packet *ppkt)
     }
 
     if (res != 0 && trace_event_get_state(TRACE_COLO_COMPARE_MISCOMPARE)) {
-        trace_colo_compare_pkt_info_src(inet_ntoa(ppkt->ip->ip_src),
-                                        ntohl(stcp->th_seq),
-                                        ntohl(stcp->th_ack),
-                                        res, stcp->th_flags,
-                                        spkt->size);
-
-        trace_colo_compare_pkt_info_dst(inet_ntoa(ppkt->ip->ip_dst),
-                                        ntohl(ptcp->th_seq),
-                                        ntohl(ptcp->th_ack),
-                                        res, ptcp->th_flags,
-                                        ppkt->size);
+        char pri_ip_src[20], pri_ip_dst[20], sec_ip_src[20], sec_ip_dst[20];
+
+        strcpy(pri_ip_src, inet_ntoa(ppkt->ip->ip_src));
+        strcpy(pri_ip_dst, inet_ntoa(ppkt->ip->ip_dst));
+        strcpy(sec_ip_src, inet_ntoa(spkt->ip->ip_src));
+        strcpy(sec_ip_dst, inet_ntoa(spkt->ip->ip_dst));
+
+        trace_colo_compare_ip_info(ppkt->size, pri_ip_src,
+                                   pri_ip_dst, spkt->size,
+                                   sec_ip_src, sec_ip_dst);
+
+        trace_colo_compare_tcp_info("pri tcp packet",
+                                    ntohl(ptcp->th_seq),
+                                    ntohl(ptcp->th_ack),
+                                    res, ptcp->th_flags,
+                                    ppkt->size);
+
+        trace_colo_compare_tcp_info("sec tcp packet",
+                                    ntohl(stcp->th_seq),
+                                    ntohl(stcp->th_ack),
+                                    res, stcp->th_flags,
+                                    spkt->size);
 
         qemu_hexdump((char *)ppkt->data, stderr,
                      "colo-compare ppkt", ppkt->size);
diff --git a/net/trace-events b/net/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/net/trace-events
+++ b/net/trace-events
@@ -XXX,XX +XXX,XX @@ colo_compare_icmp_miscompare(const char *sta, int size) ": %s = %d"
 colo_compare_ip_info(int psize, const char *sta, const char *stb, int ssize, const char *stc, const char *std) "ppkt size = %d, ip_src = %s, ip_dst = %s, spkt size = %d, ip_src = %s, ip_dst = %s"
 colo_old_packet_check_found(int64_t old_time) "%" PRId64
 colo_compare_miscompare(void) ""
-colo_compare_pkt_info_src(const char *src, uint32_t sseq, uint32_t sack, int res, uint32_t sflag, int ssize) "src/dst: %s s: seq/ack=%u/%u res=%d flags=%x spkt_size: %d\n"
-colo_compare_pkt_info_dst(const char *dst, uint32_t dseq, uint32_t dack, int res, uint32_t dflag, int dsize) "src/dst: %s d: seq/ack=%u/%u res=%d flags=%x dpkt_size: %d\n"
+colo_compare_tcp_info(const char *pkt, uint32_t seq, uint32_t ack, int res, uint32_t flag, int size) "side: %s seq/ack= %u/%u res= %d flags= %x pkt_size: %d\n"
 
 # net/filter-rewriter.c
 colo_filter_rewriter_debug(void) ""
-- 
2.7.4

From: Thomas Huth <thuth@redhat.com>

The netdev_add and netdev_del commands should be used nowadays instead.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hmp-commands.hx |  8 ++++----
 net/net.c       | 13 +++++++++++++
 2 files changed, 17 insertions(+), 4 deletions(-)

diff --git a/hmp-commands.hx b/hmp-commands.hx
index XXXXXXX..XXXXXXX 100644
--- a/hmp-commands.hx
+++ b/hmp-commands.hx
@@ -XXX,XX +XXX,XX @@ ETEXI
         .name       = "host_net_add",
         .args_type  = "device:s,opts:s?",
         .params     = "tap|user|socket|vde|netmap|bridge|vhost-user|dump [options]",
-        .help       = "add host VLAN client",
+        .help       = "add host VLAN client (deprecated, use netdev_add instead)",
         .cmd        = hmp_host_net_add,
         .command_completion = host_net_add_completion,
     },
@@ -XXX,XX +XXX,XX @@ ETEXI
 STEXI
 @item host_net_add
 @findex host_net_add
-Add host VLAN client.
+Add host VLAN client. Deprecated, please use @code{netdev_add} instead.
 ETEXI
 
     {
         .name       = "host_net_remove",
         .args_type  = "vlan_id:i,device:s",
         .params     = "vlan_id name",
-        .help       = "remove host VLAN client",
+        .help       = "remove host VLAN client (deprecated, use netdev_del instead)",
         .cmd        = hmp_host_net_remove,
         .command_completion = host_net_remove_completion,
     },
@@ -XXX,XX +XXX,XX @@ ETEXI
 STEXI
 @item host_net_remove
 @findex host_net_remove
-Remove host VLAN client.
+Remove host VLAN client. Deprecated, please use @code{netdev_del} instead.
 ETEXI
 
     {
diff --git a/net/net.c b/net/net.c
index XXXXXXX..XXXXXXX 100644
--- a/net/net.c
+++ b/net/net.c
@@ -XXX,XX +XXX,XX @@
 #include "qapi-visit.h"
 #include "qapi/opts-visitor.h"
 #include "sysemu/sysemu.h"
+#include "sysemu/qtest.h"
 #include "net/filter.h"
 #include "qapi/string-output-visitor.h"
 
@@ -XXX,XX +XXX,XX @@ void hmp_host_net_add(Monitor *mon, const QDict *qdict)
     const char *opts_str = qdict_get_try_str(qdict, "opts");
     Error *local_err = NULL;
     QemuOpts *opts;
+    static bool warned;
+
+    if (!warned && !qtest_enabled()) {
+        error_report("host_net_add is deprecated, use netdev_add instead");
+        warned = true;
+    }
 
     if (!net_host_check_device(device)) {
         monitor_printf(mon, "invalid host network device %s\n", device);
@@ -XXX,XX +XXX,XX @@ void hmp_host_net_remove(Monitor *mon, const QDict *qdict)
     NetClientState *nc;
     int vlan_id = qdict_get_int(qdict, "vlan_id");
     const char *device = qdict_get_str(qdict, "device");
+    static bool warned;
+
+    if (!warned && !qtest_enabled()) {
+        error_report("host_net_remove is deprecated, use netdev_del instead");
+        warned = true;
+    }
 
     nc = net_hub_find_client_by_name(vlan_id, device);
     if (!nc) {
-- 
2.7.4

From: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>

Because filter_mirror_receive_iov() and filter_redirector_receive_iov()
both use the filter_mirror_send() to send packet, so I change
filter_mirror_send() to filter_send() that looks more common.
And fix some codestyle.

Signed-off-by: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/filter-mirror.c | 29 ++++++++++++++++-------------
 1 file changed, 16 insertions(+), 13 deletions(-)

diff --git a/net/filter-mirror.c b/net/filter-mirror.c
index XXXXXXX..XXXXXXX 100644
--- a/net/filter-mirror.c
+++ b/net/filter-mirror.c
@@ -XXX,XX +XXX,XX @@ typedef struct MirrorState {
     SocketReadState rs;
 } MirrorState;
 
-static int filter_mirror_send(CharBackend *chr_out,
-                              const struct iovec *iov,
-                              int iovcnt)
+static int filter_send(CharBackend *chr_out,
+                       const struct iovec *iov,
+                       int iovcnt)
 {
     int ret = 0;
     ssize_t size = 0;
@@ -XXX,XX +XXX,XX @@ static ssize_t filter_mirror_receive_iov(NetFilterState *nf,
     MirrorState *s = FILTER_MIRROR(nf);
     int ret;
 
-    ret = filter_mirror_send(&s->chr_out, iov, iovcnt);
+    ret = filter_send(&s->chr_out, iov, iovcnt);
     if (ret) {
-        error_report("filter_mirror_send failed(%s)", strerror(-ret));
+        error_report("filter mirror send failed(%s)", strerror(-ret));
     }
 
     /*
@@ -XXX,XX +XXX,XX @@ static ssize_t filter_redirector_receive_iov(NetFilterState *nf,
     int ret;
 
     if (qemu_chr_fe_get_driver(&s->chr_out)) {
-        ret = filter_mirror_send(&s->chr_out, iov, iovcnt);
+        ret = filter_send(&s->chr_out, iov, iovcnt);
         if (ret) {
-            error_report("filter_mirror_send failed(%s)", strerror(-ret));
+            error_report("filter redirector send failed(%s)", strerror(-ret));
         }
         return iov_size(iov, iovcnt);
     } else {
@@ -XXX,XX +XXX,XX @@ static char *filter_redirector_get_indev(Object *obj, Error **errp)
     return g_strdup(s->indev);
 }
 
-static void
-filter_redirector_set_indev(Object *obj, const char *value, Error **errp)
+static void filter_redirector_set_indev(Object *obj,
+                                        const char *value,
+                                        Error **errp)
 {
     MirrorState *s = FILTER_REDIRECTOR(obj);
 
@@ -XXX,XX +XXX,XX @@ static char *filter_mirror_get_outdev(Object *obj, Error **errp)
     return g_strdup(s->outdev);
 }
 
-static void
-filter_mirror_set_outdev(Object *obj, const char *value, Error **errp)
+static void filter_mirror_set_outdev(Object *obj,
+                                     const char *value,
+                                     Error **errp)
 {
     MirrorState *s = FILTER_MIRROR(obj);
 
@@ -XXX,XX +XXX,XX @@ static char *filter_redirector_get_outdev(Object *obj, Error **errp)
     return g_strdup(s->outdev);
 }
 
-static void
-filter_redirector_set_outdev(Object *obj, const char *value, Error **errp)
+static void filter_redirector_set_outdev(Object *obj,
+                                         const char *value,
+                                         Error **errp)
 {
     MirrorState *s = FILTER_REDIRECTOR(obj);
 
-- 
2.7.4

From: Sameeh Jubran <sameeh@daynix.com>

This commit fixes a bug which causes the guest to hang. The bug was
observed upon a "receive overrun" (bit #6 of the ICR register)
interrupt which could be triggered post migration in a heavy traffic
environment. Even though the "receive overrun" bit (#6) is masked out
by the IMS register (refer to the log below) the driver still receives
an interrupt as the "receive overrun" bit (#6) causes the "Other" -
bit #24 of the ICR register - bit to be set as documented below. The
driver handles the interrupt and clears the "Other" bit (#24) but
doesn't clear the "receive overrun" bit (#6) which leads to an
infinite loop. Apparently the Windows driver expects that the "receive
overrun" bit and other ones - documented below - to be cleared when
the "Other" bit (#24) is cleared.

So to sum that up:
1. Bit #6 of the ICR register is set by heavy traffic
2. As a results of setting bit #6, bit #24 is set
3. The driver receives an interrupt for bit 24 (it doesn't receieve an
   interrupt for bit #6 as it is masked out by IMS)
4. The driver handles and clears the interrupt of bit #24
5. Bit #6 is still set.
6. 2 happens all over again

The Interrupt Cause Read - ICR register:

The ICR has the "Other" bit - bit #24 - that is set when one or more
of the following ICR register's bits are set:

LSC - bit #2, RXO - bit #6, MDAC - bit #9, SRPD - bit #16, ACK - bit
#17, MNG - bit #18

This bug can occur with any of these bits depending on the driver's
behaviour and the way it configures the device. However, trying to
reproduce it with any bit other than RX0 is challenging and came to
failure as the drivers don't implement most of these bits, trying to
reproduce it with LSC (Link Status Change - bit #2) bit didn't succeed
too as it seems that Windows handles this bit differently.

Log sample of the storm:

27563@1494850819.411877:e1000e_irq_pending_interrupts ICR PENDING: 0x1000000 (ICR: 0x815000c2, IMS: 0x1a00004)
27563@1494850819.411900:e1000e_irq_pending_interrupts ICR PENDING: 0x0 (ICR: 0x815000c2, IMS: 0xa00004)
27563@1494850819.411915:e1000e_irq_pending_interrupts ICR PENDING: 0x0 (ICR: 0x815000c2, IMS: 0xa00004)
27563@1494850819.412380:e1000e_irq_pending_interrupts ICR PENDING: 0x0 (ICR: 0x815000c2, IMS: 0xa00004)
27563@1494850819.412395:e1000e_irq_pending_interrupts ICR PENDING: 0x0 (ICR: 0x815000c2, IMS: 0xa00004)
27563@1494850819.412436:e1000e_irq_pending_interrupts ICR PENDING: 0x0 (ICR: 0x815000c2, IMS: 0xa00004)
27563@1494850819.412441:e1000e_irq_pending_interrupts ICR PENDING: 0x0 (ICR: 0x815000c2, IMS: 0xa00004)
27563@1494850819.412998:e1000e_irq_pending_interrupts ICR PENDING: 0x1000000 (ICR: 0x815000c2, IMS: 0x1a00004)

* This bug behaviour wasn't observed with the Linux driver.

This commit solves:
https://bugzilla.redhat.com/show_bug.cgi?id=1447935
https://bugzilla.redhat.com/show_bug.cgi?id=1449490

Cc: qemu-stable@nongnu.org
Signed-off-by: Sameeh Jubran <sjubran@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/e1000e_core.c | 10 ++++++++--
 1 file changed, 8 insertions(+), 2 deletions(-)

diff --git a/hw/net/e1000e_core.c b/hw/net/e1000e_core.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/e1000e_core.c
+++ b/hw/net/e1000e_core.c
@@ -XXX,XX +XXX,XX @@ e1000e_set_ics(E1000ECore *core, int index, uint32_t val)
 static void
 e1000e_set_icr(E1000ECore *core, int index, uint32_t val)
 {
+    uint32_t icr = 0;
     if ((core->mac[ICR] & E1000_ICR_ASSERTED) &&
         (core->mac[CTRL_EXT] & E1000_CTRL_EXT_IAME)) {
         trace_e1000e_irq_icr_process_iame();
         e1000e_clear_ims_bits(core, core->mac[IAM]);
     }
 
-    trace_e1000e_irq_icr_write(val, core->mac[ICR], core->mac[ICR] & ~val);
-    core->mac[ICR] &= ~val;
+    icr = core->mac[ICR] & ~val;
+    /* Windows driver expects that the "receive overrun" bit and other
+     * ones to be cleared when the "Other" bit (#24) is cleared.
+     */
+    icr = (val & E1000_ICR_OTHER) ? (icr & ~E1000_ICR_OTHER_CAUSES) : icr;
+    trace_e1000e_irq_icr_write(val, core->mac[ICR], icr);
+    core->mac[ICR] = icr;
     e1000e_update_interrupt_state(core);
 }
 
-- 
2.7.4

The following changes since commit 23895cbd82be95428e90168b12e925d0d3ca2f06:

Merge remote-tracking branch 'remotes/awilliam/tags/vfio-update-20201123.0' into staging (2020-11-23 18:51:13 +0000)

are available in the git repository at:

https://github.com/jasowang/qemu.git tags/net-pull-request

for you to fetch changes up to 9925990d01a92564af55f6f69d0f5f59b47609b1:

net: Use correct default-path macro for downscript (2020-11-24 10:40:17 +0800)

----------------------------------------------------------------

----------------------------------------------------------------
Keqian Zhu (1):
      net: Use correct default-path macro for downscript

Paolo Bonzini (1):
      net: do not exit on "netdev_add help" monitor command

Prasad J Pandit (1):
      hw/net/e1000e: advance desc_offset in case of null descriptor

Yuri Benditovich (1):
      net: purge queued rx packets on queue deletion

yuanjungong (1):
      tap: fix a memory leak

From: Prasad J Pandit <pjp@fedoraproject.org>

While receiving packets via e1000e_write_packet_to_guest() routine,
'desc_offset' is advanced only when RX descriptor is processed. And
RX descriptor is not processed if it has NULL buffer address.
This may lead to an infinite loop condition. Increament 'desc_offset'
to process next descriptor in the ring to avoid infinite loop.

Reported-by: Cheol-woo Myung <330cjfdn@gmail.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/e1000e_core.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/net/e1000e_core.c b/hw/net/e1000e_core.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/e1000e_core.c
+++ b/hw/net/e1000e_core.c
@@ -XXX,XX +XXX,XX @@ e1000e_write_packet_to_guest(E1000ECore *core, struct NetRxPkt *pkt,
                           (const char *) &fcs_pad, e1000x_fcs_len(core->mac));
                 }
             }
-            desc_offset += desc_size;
-            if (desc_offset >= total_size) {
-                is_last = true;
-            }
         } else { /* as per intel docs; skip descriptors with null buf addr */
             trace_e1000e_rx_null_descriptor();
         }
+        desc_offset += desc_size;
+        if (desc_offset >= total_size) {
+            is_last = true;
+        }
 
         e1000e_write_rx_descr(core, desc, is_last ? core->rx_pkt : NULL,
                            rss_info, do_ps ? ps_hdr_len : 0, &bastate.written);
-- 
2.7.4

From: Paolo Bonzini <pbonzini@redhat.com>

"netdev_add help" is causing QEMU to exit because the code that
invokes show_netdevs is shared between CLI and HMP processing.
Move the check to the callers so that exit(0) remains only
in the CLI flow.

"netdev_add help" is not fixed by this patch; that is left for
later work.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 include/net/net.h  |  1 +
 monitor/hmp-cmds.c |  6 +++++
 net/net.c          | 68 +++++++++++++++++++++++++++---------------------------
 3 files changed, 41 insertions(+), 34 deletions(-)

diff --git a/include/net/net.h b/include/net/net.h
index XXXXXXX..XXXXXXX 100644
--- a/include/net/net.h
+++ b/include/net/net.h
@@ -XXX,XX +XXX,XX @@ extern const char *host_net_devices[];
 
 /* from net.c */
 int net_client_parse(QemuOptsList *opts_list, const char *str);
+void show_netdevs(void);
 int net_init_clients(Error **errp);
 void net_check_clients(void);
 void net_cleanup(void);
diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
index XXXXXXX..XXXXXXX 100644
--- a/monitor/hmp-cmds.c
+++ b/monitor/hmp-cmds.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/option.h"
 #include "qemu/timer.h"
 #include "qemu/sockets.h"
+#include "qemu/help_option.h"
 #include "monitor/monitor-internal.h"
 #include "qapi/error.h"
 #include "qapi/clone-visitor.h"
@@ -XXX,XX +XXX,XX @@ void hmp_netdev_add(Monitor *mon, const QDict *qdict)
 {
     Error *err = NULL;
     QemuOpts *opts;
+    const char *type = qdict_get_try_str(qdict, "type");
 
+    if (type && is_help_option(type)) {
+        show_netdevs();
+        return;
+    }
     opts = qemu_opts_from_qdict(qemu_find_opts("netdev"), qdict, &err);
     if (err) {
         goto out;
diff --git a/net/net.c b/net/net.c
index XXXXXXX..XXXXXXX 100644
--- a/net/net.c
+++ b/net/net.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/config-file.h"
 #include "qemu/ctype.h"
 #include "qemu/iov.h"
+#include "qemu/qemu-print.h"
 #include "qemu/main-loop.h"
 #include "qemu/option.h"
 #include "qapi/error.h"
@@ -XXX,XX +XXX,XX @@ static int net_client_init1(const Netdev *netdev, bool is_netdev, Error **errp)
     return 0;
 }
 
-static void show_netdevs(void)
+void show_netdevs(void)
 {
     int idx;
     const char *available_netdevs[] = {
@@ -XXX,XX +XXX,XX @@ static void show_netdevs(void)
 #endif
     };
 
-    printf("Available netdev backend types:\n");
+    qemu_printf("Available netdev backend types:\n");
     for (idx = 0; idx < ARRAY_SIZE(available_netdevs); idx++) {
-        puts(available_netdevs[idx]);
+        qemu_printf("%s\n", available_netdevs[idx]);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static int net_client_init(QemuOpts *opts, bool is_netdev, Error **errp)
     int ret = -1;
     Visitor *v = opts_visitor_new(opts);
 
-    const char *type = qemu_opt_get(opts, "type");
-
-    if (is_netdev && type && is_help_option(type)) {
-        show_netdevs();
-        exit(0);
-    } else {
-        /* Parse convenience option format ip6-net=fec0::0[/64] */
-        const char *ip6_net = qemu_opt_get(opts, "ipv6-net");
+    /* Parse convenience option format ip6-net=fec0::0[/64] */
+    const char *ip6_net = qemu_opt_get(opts, "ipv6-net");
 
-        if (ip6_net) {
-            char *prefix_addr;
-            unsigned long prefix_len = 64; /* Default 64bit prefix length. */
+    if (ip6_net) {
+        char *prefix_addr;
+        unsigned long prefix_len = 64; /* Default 64bit prefix length. */
 
-            substrings = g_strsplit(ip6_net, "/", 2);
-            if (!substrings || !substrings[0]) {
-                error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "ipv6-net",
-                           "a valid IPv6 prefix");
-                goto out;
-            }
+        substrings = g_strsplit(ip6_net, "/", 2);
+        if (!substrings || !substrings[0]) {
+            error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "ipv6-net",
+                       "a valid IPv6 prefix");
+            goto out;
+        }
 
-            prefix_addr = substrings[0];
+        prefix_addr = substrings[0];
 
-            /* Handle user-specified prefix length. */
-            if (substrings[1] &&
-                qemu_strtoul(substrings[1], NULL, 10, &prefix_len))
-            {
-                error_setg(errp, QERR_INVALID_PARAMETER_VALUE,
-                           "ipv6-prefixlen", "a number");
-                goto out;
-            }
-
-            qemu_opt_set(opts, "ipv6-prefix", prefix_addr, &error_abort);
-            qemu_opt_set_number(opts, "ipv6-prefixlen", prefix_len,
-                                &error_abort);
-            qemu_opt_unset(opts, "ipv6-net");
+        /* Handle user-specified prefix length. */
+        if (substrings[1] &&
+            qemu_strtoul(substrings[1], NULL, 10, &prefix_len))
+        {
+            error_setg(errp, QERR_INVALID_PARAMETER_VALUE,
+                       "ipv6-prefixlen", "a number");
+            goto out;
         }
+
+        qemu_opt_set(opts, "ipv6-prefix", prefix_addr, &error_abort);
+        qemu_opt_set_number(opts, "ipv6-prefixlen", prefix_len,
+                            &error_abort);
+        qemu_opt_unset(opts, "ipv6-net");
     }
 
     /* Create an ID for -net if the user did not specify one */
@@ -XXX,XX +XXX,XX @@ static int net_init_client(void *dummy, QemuOpts *opts, Error **errp)
 
 static int net_init_netdev(void *dummy, QemuOpts *opts, Error **errp)
 {
+    const char *type = qemu_opt_get(opts, "type");
+
+    if (type && is_help_option(type)) {
+        show_netdevs();
+        exit(0);
+    }
     return net_client_init(opts, true, errp);
 }
 
-- 
2.7.4

From: Yuri Benditovich <yuri.benditovich@daynix.com>

https://bugzilla.redhat.com/show_bug.cgi?id=1829272
When deleting queue pair, purge pending RX packets if any.
Example of problematic flow:
1. Bring up q35 VM with tap (vhost off) and virtio-net or e1000e
2. Run ping flood to the VM NIC ( 1 ms interval)
3. Hot unplug the NIC device (device_del)
   During unplug process one or more packets come, the NIC
   can't receive, tap disables read_poll
4. Hot plug the device (device_add) with the same netdev
The tap stays with read_poll disabled and does not receive
any packets anymore (tap_send never triggered)

Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/net.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/net/net.c b/net/net.c
index XXXXXXX..XXXXXXX 100644
--- a/net/net.c
+++ b/net/net.c
@@ -XXX,XX +XXX,XX @@ void qemu_del_nic(NICState *nic)
 
     qemu_macaddr_set_free(&nic->conf->macaddr);
 
-    /* If this is a peer NIC and peer has already been deleted, free it now. */
-    if (nic->peer_deleted) {
-        for (i = 0; i < queues; i++) {
-            qemu_free_net_client(qemu_get_subqueue(nic, i)->peer);
+    for (i = 0; i < queues; i++) {
+        NetClientState *nc = qemu_get_subqueue(nic, i);
+        /* If this is a peer NIC and peer has already been deleted, free it now. */
+        if (nic->peer_deleted) {
+            qemu_free_net_client(nc->peer);
+        } else if (nc->peer) {
+            /* if there are RX packets pending, complete them */
+            qemu_purge_queued_packets(nc->peer);
         }
     }
 
-- 
2.7.4

From: yuanjungong <ruc_gongyuanjun@163.com>

Close fd before returning.

Buglink: https://bugs.launchpad.net/qemu/+bug/1904486

Signed-off-by: yuanjungong <ruc_gongyuanjun@163.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/tap.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/tap.c b/net/tap.c
index XXXXXXX..XXXXXXX 100644
--- a/net/tap.c
+++ b/net/tap.c
@@ -XXX,XX +XXX,XX @@ int net_init_tap(const Netdev *netdev, const char *name,
         if (ret < 0) {
             error_setg_errno(errp, -ret, "%s: Can't use file descriptor %d",
                              name, fd);
+            close(fd);
             return -1;
         }
 
@@ -XXX,XX +XXX,XX @@ int net_init_tap(const Netdev *netdev, const char *name,
                          vhostfdname, vnet_hdr, fd, &err);
         if (err) {
             error_propagate(errp, err);
+            close(fd);
             return -1;
         }
     } else if (tap->has_fds) {
-- 
2.7.4