Series comparison

-[Qemu-devel] [PULL 00/14] Net patches
+[PULL V2 00/33] Net patches
-The following changes since commit 6632f6ff96f0537fc34cdc00c760656fc62e23c5:
+The following changes since commit 3f429a3400822141651486193d6af625eeab05a5:
-  Merge remote-tracking branch 'remotes/famz/tags/block-and-testing-pull-request' into staging (2017-07-17 11:46:36 +0100)
+  Merge remote-tracking branch 'remotes/kraxel/tags/microvm-20200617-pull-request' into staging (2020-06-18 11:23:15 +0100)
 are available in the git repository at:
   https://github.com/jasowang/qemu.git tags/net-pull-request
-for you to fetch changes up to 189ae6bb5ce1f5a322f8691d00fe942ba43dd601:
+for you to fetch changes up to 71830d8430e65dd20aec4765d87e60336148e1a6:
-  virtio-net: fix offload ctrl endian (2017-07-17 20:13:56 +0800)
+  net: Drop the NetLegacy structure, always use Netdev instead (2020-06-18 21:05:52 +0800)
 ----------------------------------------------------------------
-- fix virtio-net ctrl offload endian
+Changes from V1:
-- vnet header support for variou COLO netfilters and compare thread
+- Fix build failure for virtio-net
 ----------------------------------------------------------------
+Derek Su (1):
+      colo-compare: Fix memory leak in packet_enqueue()
+Helge Deller (1):
+      Fix tulip breakage
 Jason Wang (1):
-      virtio-net: fix offload ctrl endian
+      net: use peer when purging queue in qemu_flush_or_purge_queue_packets()
-Michal Privoznik (1):
+Lukas Straub (6):
-      virtion-net: Prefer is_power_of_2()
+      net/colo-compare.c: Create event_bh with the right AioContext
       chardev/char.c: Use qemu_co_sleep_ns if in coroutine
       net/colo-compare.c: Fix deadlock in compare_chr_send
       net/colo-compare.c: Only hexdump packets if tracing is enabled
       net/colo-compare.c: Check that colo-compare is active
       net/colo-compare.c: Correct ordering in complete and finalize
-Zhang Chen (12):
+Philippe Mathieu-Daudé (3):
-      net: Add vnet_hdr_len arguments in NetClientState
+      hw/net/tulip: Fix 'Descriptor Error' definition
-      net/net.c: Add vnet_hdr support in SocketReadState
+      hw/net/tulip: Log descriptor overflows
-      net/filter-mirror.c: Introduce parameter for filter_send()
+      hw/net/e1000e: Do not abort() on invalid PSRCTL register value
       net/filter-mirror.c: Make filter mirror support vnet support.
       net/filter-mirror.c: Add new option to enable vnet support for filter-redirector
       net/colo.c: Make vnet_hdr_len as packet property
       net/colo-compare.c: Introduce parameter for compare_chr_send()
       net/colo-compare.c: Make colo-compare support vnet_hdr_len
       net/colo.c: Add vnet packet parse feature in colo-proxy
       net/colo-compare.c: Add vnet packet's tcp/udp/icmp compare
       net/filter-rewriter.c: Make filter-rewriter support vnet_hdr_len
       docs/colo-proxy.txt: Update colo-proxy usage of net driver with vnet_header
- docs/colo-proxy.txt   | 26 ++++++++++++++++
+Sai Pavan Boddu (11):
- hw/net/virtio-net.c   |  4 ++-
+      net: cadence_gem: Fix debug statements
- include/net/net.h     | 10 ++++--
+      net: cadence_gem: Fix the queue address update during wrap around
- net/colo-compare.c    | 84 ++++++++++++++++++++++++++++++++++++++++++---------
+      net: cadence_gem: Fix irq update w.r.t queue
- net/colo.c            |  9 +++---
+      net: cadence_gem: Define access permission for interrupt registers
- net/colo.h            |  4 ++-
+      net: cadence_gem: Set ISR according to queue in use
- net/filter-mirror.c   | 75 +++++++++++++++++++++++++++++++++++++++++----
+      net: cadence_gem: Move tx/rx packet buffert to CadenceGEMState
- net/filter-rewriter.c | 37 ++++++++++++++++++++++-
+      net: cadence_gem: Fix up code style
- net/net.c             | 37 ++++++++++++++++++++---
+      net: cadence_gem: Add support for jumbo frames
- net/socket.c          |  8 ++---
+      net: cadnece_gem: Update irq_read_clear field of designcfg_debug1 reg
- qemu-options.hx       | 19 ++++++------
+      net: cadence_gem: Update the reset value for interrupt mask register
-files changed, 265 insertions(+), 48 deletions(-)
+      net: cadence_gem: TX_LAST bit should be set by guest
 Thomas Huth (2):
       net: Drop the legacy "name" parameter from the -net option
       net: Drop the NetLegacy structure, always use Netdev instead
 Tong Ho (1):
       net: cadence_gem: Fix RX address filtering
 Yuri Benditovich (7):
       virtio-net: implement RSS configuration command
       virtio-net: implement RX RSS processing
       tap: allow extended virtio header with hash info
       virtio-net: reference implementation of hash report
       vmstate.h: provide VMSTATE_VARRAY_UINT16_ALLOC macro
       virtio-net: add migration support for RSS and hash report
       virtio-net: align RSC fields with updated virtio-net header
  chardev/char.c                 |   7 +-
  docs/system/deprecated.rst     |  15 +-
  hw/net/Makefile.objs           |   1 +
  hw/net/cadence_gem.c           | 458 +++++++++++++++++++++++------------------
  hw/net/e1000e_core.c           |  10 +-
  hw/net/trace-events            |   3 +
  hw/net/tulip.c                 |  12 +-
  hw/net/tulip.h                 |   2 +-
  hw/net/virtio-net.c            | 387 ++++++++++++++++++++++++++++++----
  include/hw/net/cadence_gem.h   |   6 +
  include/hw/virtio/virtio-net.h |  16 ++
  include/migration/vmstate.h    |  10 +
  net/colo-compare.c             | 277 ++++++++++++++++++-------
  net/colo.c                     |   7 +
  net/colo.h                     |   1 +
  net/net.c                      |  89 ++------
  net/tap.c                      |   3 +-
  net/trace-events               |   1 +
  qapi/net.json                  |  49 -----
 files changed, 905 insertions(+), 449 deletions(-)

-[Qemu-devel] [PULL 04/14] net/filter-mirror.c: Make filter mirror support vnet support.
+[PULL V2 01/33] virtio-net: implement RSS configuration command
-From: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
+From: Yuri Benditovich <yuri.benditovich@daynix.com>
-We add the vnet_hdr_support option for filter-mirror, default is disabled.
+Optionally report RSS feature.
-If you use virtio-net-pci or other driver needs vnet_hdr, please enable it.
+Handle RSS configuration command and keep RSS parameters
-You can use it for example:
+in virtio-net device context.
--object filter-mirror,id=m0,netdev=hn0,queue=tx,outdev=mirror0,vnet_hdr_support
+Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
 If it has vnet_hdr_support flag, we will change the sending packet format from
 struct {int size; const uint8_t buf[];} to {int size; int vnet_hdr_len; const uint8_t buf[];}.
 make other module(like colo-compare) know how to parse net packet correctly.
 Signed-off-by: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- net/filter-mirror.c | 42 +++++++++++++++++++++++++++++++++++++++++-
+ hw/net/trace-events            |   3 +
- qemu-options.hx     |  5 ++---
+ hw/net/virtio-net.c            | 167 ++++++++++++++++++++++++++++++++++++++---
-files changed, 43 insertions(+), 4 deletions(-)
+ include/hw/virtio/virtio-net.h |  13 ++++
+files changed, 174 insertions(+), 9 deletions(-)
-diff --git a/net/filter-mirror.c b/net/filter-mirror.c
 diff --git a/hw/net/trace-events b/hw/net/trace-events
 index XXXXXXX..XXXXXXX 100644
---- a/net/filter-mirror.c
+--- a/hw/net/trace-events
-+++ b/net/filter-mirror.c
++++ b/hw/net/trace-events
-@@ -XXX,XX +XXX,XX @@ typedef struct MirrorState {
+@@ -XXX,XX +XXX,XX @@ virtio_net_announce_notify(void) ""
-     CharBackend chr_in;
+ virtio_net_announce_timer(int round) "%d"
-     CharBackend chr_out;
+ virtio_net_handle_announce(int round) "%d"
-     SocketReadState rs;
+ virtio_net_post_load_device(void)
-+    bool vnet_hdr;
++virtio_net_rss_disable(void)
- } MirrorState;
++virtio_net_rss_error(const char *msg, uint32_t value) "%s, value 0x%08x"
++virtio_net_rss_enable(uint32_t p1, uint16_t p2, uint8_t p3) "hashes 0x%x, table of %d, key of %d"
- static int filter_send(MirrorState *s,
-                        const struct iovec *iov,
+ # tulip.c
-                        int iovcnt)
+ tulip_reg_write(uint64_t addr, const char *name, int size, uint64_t val) "addr 0x%02"PRIx64" (%s) size %d value 0x%08"PRIx64
- {
+diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
-+    NetFilterState *nf = NETFILTER(s);
+index XXXXXXX..XXXXXXX 100644
-     int ret = 0;
+--- a/hw/net/virtio-net.c
-     ssize_t size = 0;
++++ b/hw/net/virtio-net.c
-     uint32_t len = 0;
+@@ -XXX,XX +XXX,XX @@
-@@ -XXX,XX +XXX,XX @@ static int filter_send(MirrorState *s,
+    tso/gso/gro 'off'. */
-         goto err;
+ #define VIRTIO_NET_RSC_DEFAULT_INTERVAL 300000
 +#define VIRTIO_NET_RSS_SUPPORTED_HASHES (VIRTIO_NET_RSS_HASH_TYPE_IPv4 | \
 +                                         VIRTIO_NET_RSS_HASH_TYPE_TCPv4 | \
 +                                         VIRTIO_NET_RSS_HASH_TYPE_UDPv4 | \
 +                                         VIRTIO_NET_RSS_HASH_TYPE_IPv6 | \
 +                                         VIRTIO_NET_RSS_HASH_TYPE_TCPv6 | \
 +                                         VIRTIO_NET_RSS_HASH_TYPE_UDPv6 | \
 +                                         VIRTIO_NET_RSS_HASH_TYPE_IP_EX | \
 +                                         VIRTIO_NET_RSS_HASH_TYPE_TCP_EX | \
 +                                         VIRTIO_NET_RSS_HASH_TYPE_UDP_EX)
 +
  /* temporary until standard header include it */
  #if !defined(VIRTIO_NET_HDR_F_RSC_INFO)
@@ -XXX,XX +XXX,XX @@ static VirtIOFeature feature_sizes[] = {
       .end = endof(struct virtio_net_config, mtu)},
      {.flags = 1ULL << VIRTIO_NET_F_SPEED_DUPLEX,
       .end = endof(struct virtio_net_config, duplex)},
 +    {.flags = 1ULL << VIRTIO_NET_F_RSS,
 +     .end = endof(struct virtio_net_config, supported_hash_types)},
      {}
  };
@@ -XXX,XX +XXX,XX @@ static void virtio_net_get_config(VirtIODevice *vdev, uint8_t *config)
      memcpy(netcfg.mac, n->mac, ETH_ALEN);
      virtio_stl_p(vdev, &netcfg.speed, n->net_conf.speed);
      netcfg.duplex = n->net_conf.duplex;
 +    netcfg.rss_max_key_size = VIRTIO_NET_RSS_MAX_KEY_SIZE;
 +    virtio_stw_p(vdev, &netcfg.rss_max_indirection_table_length,
 +                 VIRTIO_NET_RSS_MAX_TABLE_LEN);
 +    virtio_stl_p(vdev, &netcfg.supported_hash_types,
 +                 VIRTIO_NET_RSS_SUPPORTED_HASHES);
      memcpy(config, &netcfg, n->config_size);
  }
@@ -XXX,XX +XXX,XX @@ static uint64_t virtio_net_get_features(VirtIODevice *vdev, uint64_t features,
          return features;
      }
-+    if (s->vnet_hdr) {
++    virtio_clear_feature(&features, VIRTIO_NET_F_RSS);
-+        /*
+     features = vhost_net_get_features(get_vhost_net(nc->peer), features);
-+         * If vnet_hdr = on, we send vnet header len to make other
+     vdev->backend_features = features;
-+         * module(like colo-compare) know how to parse net
-+         * packet correctly.
+@@ -XXX,XX +XXX,XX @@ static void virtio_net_set_features(VirtIODevice *vdev, uint64_t features)
 +         */
 +        ssize_t vnet_hdr_len;
 +
 +        vnet_hdr_len = nf->netdev->vnet_hdr_len;
 +
 +        len = htonl(vnet_hdr_len);
 +        ret = qemu_chr_fe_write_all(&s->chr_out, (uint8_t *)&len, sizeof(len));
 +        if (ret != sizeof(len)) {
 +            goto err;
 +        }
 +    }
 +
      buf = g_malloc(size);
      iov_to_buf(iov, iovcnt, 0, buf, size);
      ret = qemu_chr_fe_write_all(&s->chr_out, (uint8_t *)buf, size);
@@ -XXX,XX +XXX,XX @@ static void filter_redirector_setup(NetFilterState *nf, Error **errp)
          }
      }
--    net_socket_rs_init(&s->rs, redirector_rs_finalize, false);
+     virtio_net_set_multiqueue(n,
-+    net_socket_rs_init(&s->rs, redirector_rs_finalize, s->vnet_hdr);
++                              virtio_has_feature(features, VIRTIO_NET_F_RSS) ||
+                               virtio_has_feature(features, VIRTIO_NET_F_MQ));
-     if (s->indev) {
-         chr = qemu_chr_find(s->indev);
+     virtio_net_set_mrg_rx_bufs(n,
-@@ -XXX,XX +XXX,XX @@ static void filter_mirror_set_outdev(Object *obj,
+@@ -XXX,XX +XXX,XX @@ static int virtio_net_handle_announce(VirtIONet *n, uint8_t cmd,
      }
  }
-+static bool filter_mirror_get_vnet_hdr(Object *obj, Error **errp)
++static void virtio_net_disable_rss(VirtIONet *n)
 +{
-+    MirrorState *s = FILTER_MIRROR(obj);
++    if (n->rss_data.enabled) {
-+
++        trace_virtio_net_rss_disable();
-+    return s->vnet_hdr;
++    }
 +    n->rss_data.enabled = false;
 +}
 +
-+static void filter_mirror_set_vnet_hdr(Object *obj, bool value, Error **errp)
++static uint16_t virtio_net_handle_rss(VirtIONet *n,
 +                                      struct iovec *iov, unsigned int iov_cnt)
 +{
-+    MirrorState *s = FILTER_MIRROR(obj);
++    VirtIODevice *vdev = VIRTIO_DEVICE(n);
-+
++    struct virtio_net_rss_config cfg;
-+    s->vnet_hdr = value;
++    size_t s, offset = 0, size_get;
 +    uint16_t queues, i;
 +    struct {
 +        uint16_t us;
 +        uint8_t b;
 +    } QEMU_PACKED temp;
 +    const char *err_msg = "";
 +    uint32_t err_value = 0;
 +
 +    if (!virtio_vdev_has_feature(vdev, VIRTIO_NET_F_RSS)) {
 +        err_msg = "RSS is not negotiated";
 +        goto error;
 +    }
 +    size_get = offsetof(struct virtio_net_rss_config, indirection_table);
 +    s = iov_to_buf(iov, iov_cnt, offset, &cfg, size_get);
 +    if (s != size_get) {
 +        err_msg = "Short command buffer";
 +        err_value = (uint32_t)s;
 +        goto error;
 +    }
 +    n->rss_data.hash_types = virtio_ldl_p(vdev, &cfg.hash_types);
 +    n->rss_data.indirections_len =
 +        virtio_lduw_p(vdev, &cfg.indirection_table_mask);
 +    n->rss_data.indirections_len++;
 +    if (!is_power_of_2(n->rss_data.indirections_len)) {
 +        err_msg = "Invalid size of indirection table";
 +        err_value = n->rss_data.indirections_len;
 +        goto error;
 +    }
 +    if (n->rss_data.indirections_len > VIRTIO_NET_RSS_MAX_TABLE_LEN) {
 +        err_msg = "Too large indirection table";
 +        err_value = n->rss_data.indirections_len;
 +        goto error;
 +    }
 +    n->rss_data.default_queue =
 +        virtio_lduw_p(vdev, &cfg.unclassified_queue);
 +    if (n->rss_data.default_queue >= n->max_queues) {
 +        err_msg = "Invalid default queue";
 +        err_value = n->rss_data.default_queue;
 +        goto error;
 +    }
 +    offset += size_get;
 +    size_get = sizeof(uint16_t) * n->rss_data.indirections_len;
 +    g_free(n->rss_data.indirections_table);
 +    n->rss_data.indirections_table = g_malloc(size_get);
 +    if (!n->rss_data.indirections_table) {
 +        err_msg = "Can't allocate indirections table";
 +        err_value = n->rss_data.indirections_len;
 +        goto error;
 +    }
 +    s = iov_to_buf(iov, iov_cnt, offset,
 +                   n->rss_data.indirections_table, size_get);
 +    if (s != size_get) {
 +        err_msg = "Short indirection table buffer";
 +        err_value = (uint32_t)s;
 +        goto error;
 +    }
 +    for (i = 0; i < n->rss_data.indirections_len; ++i) {
 +        uint16_t val = n->rss_data.indirections_table[i];
 +        n->rss_data.indirections_table[i] = virtio_lduw_p(vdev, &val);
 +    }
 +    offset += size_get;
 +    size_get = sizeof(temp);
 +    s = iov_to_buf(iov, iov_cnt, offset, &temp, size_get);
 +    if (s != size_get) {
 +        err_msg = "Can't get queues";
 +        err_value = (uint32_t)s;
 +        goto error;
 +    }
 +    queues = virtio_lduw_p(vdev, &temp.us);
 +    if (queues == 0 || queues > n->max_queues) {
 +        err_msg = "Invalid number of queues";
 +        err_value = queues;
 +        goto error;
 +    }
 +    if (temp.b > VIRTIO_NET_RSS_MAX_KEY_SIZE) {
 +        err_msg = "Invalid key size";
 +        err_value = temp.b;
 +        goto error;
 +    }
 +    if (!temp.b && n->rss_data.hash_types) {
 +        err_msg = "No key provided";
 +        err_value = 0;
 +        goto error;
 +    }
 +    if (!temp.b && !n->rss_data.hash_types) {
 +        virtio_net_disable_rss(n);
 +        return queues;
 +    }
 +    offset += size_get;
 +    size_get = temp.b;
 +    s = iov_to_buf(iov, iov_cnt, offset, n->rss_data.key, size_get);
 +    if (s != size_get) {
 +        err_msg = "Can get key buffer";
 +        err_value = (uint32_t)s;
 +        goto error;
 +    }
 +    n->rss_data.enabled = true;
 +    trace_virtio_net_rss_enable(n->rss_data.hash_types,
 +                                n->rss_data.indirections_len,
 +                                temp.b);
 +    return queues;
 +error:
 +    trace_virtio_net_rss_error(err_msg, err_value);
 +    virtio_net_disable_rss(n);
 +    return 0;
 +}
 +
- static char *filter_redirector_get_outdev(Object *obj, Error **errp)
+ static int virtio_net_handle_mq(VirtIONet *n, uint8_t cmd,
                                  struct iovec *iov, unsigned int iov_cnt)
  {
-     MirrorState *s = FILTER_REDIRECTOR(obj);
+     VirtIODevice *vdev = VIRTIO_DEVICE(n);
-@@ -XXX,XX +XXX,XX @@ static void filter_redirector_set_outdev(Object *obj,
+-    struct virtio_net_ctrl_mq mq;
+-    size_t s;
- static void filter_mirror_init(Object *obj)
+     uint16_t queues;
- {
-+    MirrorState *s = FILTER_MIRROR(obj);
+-    s = iov_to_buf(iov, iov_cnt, 0, &mq, sizeof(mq));
-+
+-    if (s != sizeof(mq)) {
-     object_property_add_str(obj, "outdev", filter_mirror_get_outdev,
+-        return VIRTIO_NET_ERR;
-                             filter_mirror_set_outdev, NULL);
+-    }
-+
++    virtio_net_disable_rss(n);
-+    s->vnet_hdr = false;
++    if (cmd == VIRTIO_NET_CTRL_MQ_RSS_CONFIG) {
-+    object_property_add_bool(obj, "vnet_hdr_support",
++        queues = virtio_net_handle_rss(n, iov, iov_cnt);
-+                             filter_mirror_get_vnet_hdr,
++    } else if (cmd == VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET) {
-+                             filter_mirror_set_vnet_hdr, NULL);
++        struct virtio_net_ctrl_mq mq;
 +        size_t s;
 +        if (!virtio_vdev_has_feature(vdev, VIRTIO_NET_F_MQ)) {
 +            return VIRTIO_NET_ERR;
 +        }
 +        s = iov_to_buf(iov, iov_cnt, 0, &mq, sizeof(mq));
 +        if (s != sizeof(mq)) {
 +            return VIRTIO_NET_ERR;
 +        }
 +        queues = virtio_lduw_p(vdev, &mq.virtqueue_pairs);
 -    if (cmd != VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET) {
 +    } else {
          return VIRTIO_NET_ERR;
      }
 -    queues = virtio_lduw_p(vdev, &mq.virtqueue_pairs);
 -
      if (queues < VIRTIO_NET_CTRL_MQ_VQ_PAIRS_MIN ||
          queues > VIRTIO_NET_CTRL_MQ_VQ_PAIRS_MAX ||
          queues > n->max_queues ||
@@ -XXX,XX +XXX,XX @@ static void virtio_net_device_unrealize(DeviceState *dev)
      g_free(n->vqs);
      qemu_del_nic(n->nic);
      virtio_net_rsc_cleanup(n);
 +    g_free(n->rss_data.indirections_table);
      virtio_cleanup(vdev);
  }
- static void filter_redirector_init(Object *obj)
+@@ -XXX,XX +XXX,XX @@ static Property virtio_net_properties[] = {
-diff --git a/qemu-options.hx b/qemu-options.hx
+     DEFINE_PROP_BIT64("ctrl_guest_offloads", VirtIONet, host_features,
                      VIRTIO_NET_F_CTRL_GUEST_OFFLOADS, true),
      DEFINE_PROP_BIT64("mq", VirtIONet, host_features, VIRTIO_NET_F_MQ, false),
 +    DEFINE_PROP_BIT64("rss", VirtIONet, host_features,
 +                    VIRTIO_NET_F_RSS, false),
      DEFINE_PROP_BIT64("guest_rsc_ext", VirtIONet, host_features,
                      VIRTIO_NET_F_RSC_EXT, false),
      DEFINE_PROP_UINT32("rsc_interval", VirtIONet, rsc_timeout,
 diff --git a/include/hw/virtio/virtio-net.h b/include/hw/virtio/virtio-net.h
 index XXXXXXX..XXXXXXX 100644
---- a/qemu-options.hx
+--- a/include/hw/virtio/virtio-net.h
-+++ b/qemu-options.hx
++++ b/include/hw/virtio/virtio-net.h
-@@ -XXX,XX +XXX,XX @@ queue @var{all|rx|tx} is an option that can be applied to any netfilter.
+@@ -XXX,XX +XXX,XX @@ typedef struct VirtioNetRscChain {
- @option{tx}: the filter is attached to the transmit queue of the netdev,
+ /* Maximum packet size we can receive from tap device: header + 64k */
-              where it will receive packets sent by the netdev.
+ #define VIRTIO_NET_MAX_BUFSIZE (sizeof(struct virtio_net_hdr) + (64 * KiB))
--@item -object filter-mirror,id=@var{id},netdev=@var{netdevid},outdev=@var{chardevid}[,queue=@var{all|rx|tx}]
++#define VIRTIO_NET_RSS_MAX_KEY_SIZE     40
-+@item -object filter-mirror,id=@var{id},netdev=@var{netdevid},outdev=@var{chardevid},queue=@var{all|rx|tx}[,vnet_hdr_support]
++#define VIRTIO_NET_RSS_MAX_TABLE_LEN    128
++
--filter-mirror on netdev @var{netdevid},mirror net packet to chardev
++typedef struct VirtioNetRssData {
--@var{chardevid}
++    bool    enabled;
-+filter-mirror on netdev @var{netdevid},mirror net packet to chardev@var{chardevid}, if it has the vnet_hdr_support flag, filter-mirror will mirror packet with vnet_hdr_len.
++    uint32_t hash_types;
++    uint8_t key[VIRTIO_NET_RSS_MAX_KEY_SIZE];
- @item -object filter-redirector,id=@var{id},netdev=@var{netdevid},indev=@var{chardevid},
++    uint16_t indirections_len;
- outdev=@var{chardevid}[,queue=@var{all|rx|tx}]
++    uint16_t *indirections_table;
 +    uint16_t default_queue;
 +} VirtioNetRssData;
 +
  typedef struct VirtIONetQueue {
      VirtQueue *rx_vq;
      VirtQueue *tx_vq;
@@ -XXX,XX +XXX,XX @@ struct VirtIONet {
      bool failover;
      DeviceListener primary_listener;
      Notifier migration_state;
 +    VirtioNetRssData rss_data;
  };
  void virtio_net_set_netclient_name(VirtIONet *n, const char *name,
 --
-.7.4
+.5.0

-[Qemu-devel] [PULL 05/14] net/filter-mirror.c: Add new option to enable vnet support for filter-redirector
+[PULL V2 02/33] virtio-net: implement RX RSS processing
-From: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
+From: Yuri Benditovich <yuri.benditovich@daynix.com>
-We add the vnet_hdr_support option for filter-redirector, default is disabled.
+If VIRTIO_NET_F_RSS negotiated and RSS is enabled, process
-If you use virtio-net-pci net driver or other driver needs vnet_hdr, please enable it.
+incoming packets, calculate packet's hash and place the
-Because colo-compare or other modules needs the vnet_hdr_len to parse
+packet into respective RX virtqueue.
 packet, we add this new option send the len to others.
 You can use it for example:
 -object filter-redirector,id=r0,netdev=hn0,queue=tx,outdev=red0,vnet_hdr_support
-Signed-off-by: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
+Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- net/filter-mirror.c | 23 +++++++++++++++++++++++
+ hw/net/Makefile.objs           |  1 +
- qemu-options.hx     |  6 +++---
+ hw/net/virtio-net.c            | 88 +++++++++++++++++++++++++++++++++++++++++-
-files changed, 26 insertions(+), 3 deletions(-)
+ include/hw/virtio/virtio-net.h |  1 +
 files changed, 88 insertions(+), 2 deletions(-)
-diff --git a/net/filter-mirror.c b/net/filter-mirror.c
+diff --git a/hw/net/Makefile.objs b/hw/net/Makefile.objs
 index XXXXXXX..XXXXXXX 100644
---- a/net/filter-mirror.c
+--- a/hw/net/Makefile.objs
-+++ b/net/filter-mirror.c
++++ b/hw/net/Makefile.objs
-@@ -XXX,XX +XXX,XX @@ static void filter_redirector_set_outdev(Object *obj,
+@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_MILKYMIST) += milkymist-minimac2.o
-     s->outdev = g_strdup(value);
+ obj-$(CONFIG_PSERIES) += spapr_llan.o
  obj-$(CONFIG_XILINX_ETHLITE) += xilinx_ethlite.o
 +common-obj-$(CONFIG_VIRTIO_NET) += net_rx_pkt.o
  obj-$(CONFIG_VIRTIO_NET) += virtio-net.o
  common-obj-$(call land,$(CONFIG_VIRTIO_NET),$(CONFIG_VHOST_NET)) += vhost_net.o
  common-obj-$(call lnot,$(call land,$(CONFIG_VIRTIO_NET),$(CONFIG_VHOST_NET))) += vhost_net-stub.o
 diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/net/virtio-net.c
 +++ b/hw/net/virtio-net.c
@@ -XXX,XX +XXX,XX @@
  #include "trace.h"
  #include "monitor/qdev.h"
  #include "hw/pci/pci.h"
 +#include "net_rx_pkt.h"
  #define VIRTIO_NET_VM_VERSION    11
@@ -XXX,XX +XXX,XX @@ static int receive_filter(VirtIONet *n, const uint8_t *buf, int size)
      return 0;
  }
-+static bool filter_redirector_get_vnet_hdr(Object *obj, Error **errp)
++static uint8_t virtio_net_get_hash_type(bool isip4,
 +                                        bool isip6,
 +                                        bool isudp,
 +                                        bool istcp,
 +                                        uint32_t types)
 +{
-+    MirrorState *s = FILTER_REDIRECTOR(obj);
++    if (isip4) {
 +        if (istcp && (types & VIRTIO_NET_RSS_HASH_TYPE_TCPv4)) {
 +            return NetPktRssIpV4Tcp;
 +        }
 +        if (isudp && (types & VIRTIO_NET_RSS_HASH_TYPE_UDPv4)) {
 +            return NetPktRssIpV4Udp;
 +        }
 +        if (types & VIRTIO_NET_RSS_HASH_TYPE_IPv4) {
 +            return NetPktRssIpV4;
 +        }
 +    } else if (isip6) {
 +        uint32_t mask = VIRTIO_NET_RSS_HASH_TYPE_TCP_EX |
 +                        VIRTIO_NET_RSS_HASH_TYPE_TCPv6;
 +
-+    return s->vnet_hdr;
++        if (istcp && (types & mask)) {
 +            return (types & VIRTIO_NET_RSS_HASH_TYPE_TCP_EX) ?
 +                NetPktRssIpV6TcpEx : NetPktRssIpV6Tcp;
 +        }
 +        mask = VIRTIO_NET_RSS_HASH_TYPE_UDP_EX | VIRTIO_NET_RSS_HASH_TYPE_UDPv6;
 +        if (isudp && (types & mask)) {
 +            return (types & VIRTIO_NET_RSS_HASH_TYPE_UDP_EX) ?
 +                NetPktRssIpV6UdpEx : NetPktRssIpV6Udp;
 +        }
 +        mask = VIRTIO_NET_RSS_HASH_TYPE_IP_EX | VIRTIO_NET_RSS_HASH_TYPE_IPv6;
 +        if (types & mask) {
 +            return (types & VIRTIO_NET_RSS_HASH_TYPE_IP_EX) ?
 +                NetPktRssIpV6Ex : NetPktRssIpV6;
 +        }
 +    }
 +    return 0xff;
 +}
 +
-+static void filter_redirector_set_vnet_hdr(Object *obj,
++static int virtio_net_process_rss(NetClientState *nc, const uint8_t *buf,
-+                                           bool value,
++                                  size_t size)
 +                                           Error **errp)
 +{
-+    MirrorState *s = FILTER_REDIRECTOR(obj);
++    VirtIONet *n = qemu_get_nic_opaque(nc);
 +    unsigned int index = nc->queue_index, new_index;
 +    struct NetRxPkt *pkt = n->rx_pkt;
 +    uint8_t net_hash_type;
 +    uint32_t hash;
 +    bool isip4, isip6, isudp, istcp;
 +
-+    s->vnet_hdr = value;
++    net_rx_pkt_set_protocols(pkt, buf + n->host_hdr_len,
 +                             size - n->host_hdr_len);
 +    net_rx_pkt_get_protocols(pkt, &isip4, &isip6, &isudp, &istcp);
 +    if (isip4 && (net_rx_pkt_get_ip4_info(pkt)->fragment)) {
 +        istcp = isudp = false;
 +    }
 +    if (isip6 && (net_rx_pkt_get_ip6_info(pkt)->fragment)) {
 +        istcp = isudp = false;
 +    }
 +    net_hash_type = virtio_net_get_hash_type(isip4, isip6, isudp, istcp,
 +                                             n->rss_data.hash_types);
 +    if (net_hash_type > NetPktRssIpV6UdpEx) {
 +        return n->rss_data.default_queue;
 +    }
 +
 +    hash = net_rx_pkt_calc_rss_hash(pkt, net_hash_type, n->rss_data.key);
 +    new_index = hash & (n->rss_data.indirections_len - 1);
 +    new_index = n->rss_data.indirections_table[new_index];
 +    if (index == new_index) {
 +        return -1;
 +    }
 +    return new_index;
 +}
 +
- static void filter_mirror_init(Object *obj)
+ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
 -                                      size_t size)
 +                                      size_t size, bool no_rss)
  {
-     MirrorState *s = FILTER_MIRROR(obj);
+     VirtIONet *n = qemu_get_nic_opaque(nc);
-@@ -XXX,XX +XXX,XX @@ static void filter_mirror_init(Object *obj)
+     VirtIONetQueue *q = virtio_net_get_subqueue(nc);
+@@ -XXX,XX +XXX,XX @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
- static void filter_redirector_init(Object *obj)
+         return -1;
      }
 +    if (!no_rss && n->rss_data.enabled) {
 +        int index = virtio_net_process_rss(nc, buf, size);
 +        if (index >= 0) {
 +            NetClientState *nc2 = qemu_get_subqueue(n->nic, index);
 +            return virtio_net_receive_rcu(nc2, buf, size, true);
 +        }
 +    }
 +
      /* hdr_len refers to the header we supply to the guest */
      if (!virtio_net_has_buffers(q, size + n->guest_hdr_len - n->host_hdr_len)) {
          return 0;
@@ -XXX,XX +XXX,XX @@ static ssize_t virtio_net_do_receive(NetClientState *nc, const uint8_t *buf,
  {
-+    MirrorState *s = FILTER_REDIRECTOR(obj);
+     RCU_READ_LOCK_GUARD();
 -    return virtio_net_receive_rcu(nc, buf, size);
 +    return virtio_net_receive_rcu(nc, buf, size, false);
  }
  static void virtio_net_rsc_extract_unit4(VirtioNetRscChain *chain,
@@ -XXX,XX +XXX,XX @@ static void virtio_net_device_realize(DeviceState *dev, Error **errp)
      QTAILQ_INIT(&n->rsc_chains);
      n->qdev = dev;
 +
-     object_property_add_str(obj, "indev", filter_redirector_get_indev,
++    net_rx_pkt_init(&n->rx_pkt, false);
                              filter_redirector_set_indev, NULL);
      object_property_add_str(obj, "outdev", filter_redirector_get_outdev,
                              filter_redirector_set_outdev, NULL);
 +
 +    s->vnet_hdr = false;
 +    object_property_add_bool(obj, "vnet_hdr_support",
 +                             filter_redirector_get_vnet_hdr,
 +                             filter_redirector_set_vnet_hdr, NULL);
  }
- static void filter_mirror_fini(Object *obj)
+ static void virtio_net_device_unrealize(DeviceState *dev)
-diff --git a/qemu-options.hx b/qemu-options.hx
+@@ -XXX,XX +XXX,XX @@ static void virtio_net_device_unrealize(DeviceState *dev)
      qemu_del_nic(n->nic);
      virtio_net_rsc_cleanup(n);
      g_free(n->rss_data.indirections_table);
 +    net_rx_pkt_uninit(n->rx_pkt);
      virtio_cleanup(vdev);
  }
 diff --git a/include/hw/virtio/virtio-net.h b/include/hw/virtio/virtio-net.h
 index XXXXXXX..XXXXXXX 100644
---- a/qemu-options.hx
+--- a/include/hw/virtio/virtio-net.h
-+++ b/qemu-options.hx
++++ b/include/hw/virtio/virtio-net.h
-@@ -XXX,XX +XXX,XX @@ queue @var{all|rx|tx} is an option that can be applied to any netfilter.
+@@ -XXX,XX +XXX,XX @@ struct VirtIONet {
+     DeviceListener primary_listener;
- filter-mirror on netdev @var{netdevid},mirror net packet to chardev@var{chardevid}, if it has the vnet_hdr_support flag, filter-mirror will mirror packet with vnet_hdr_len.
+     Notifier migration_state;
+     VirtioNetRssData rss_data;
--@item -object filter-redirector,id=@var{id},netdev=@var{netdevid},indev=@var{chardevid},
++    struct NetRxPkt *rx_pkt;
--outdev=@var{chardevid}[,queue=@var{all|rx|tx}]
+ };
-+@item -object filter-redirector,id=@var{id},netdev=@var{netdevid},indev=@var{chardevid},outdev=@var{chardevid},queue=@var{all|rx|tx}[,vnet_hdr_support]
+ void virtio_net_set_netclient_name(VirtIONet *n, const char *name,
  filter-redirector on netdev @var{netdevid},redirect filter's net packet to chardev
 -@var{chardevid},and redirect indev's packet to filter.
 +@var{chardevid},and redirect indev's packet to filter.if it has the vnet_hdr_support flag,
 +filter-redirector will redirect packet with vnet_hdr_len.
  Create a filter-redirector we need to differ outdev id from indev id, id can not
  be the same. we can just use indev or outdev, but at least one of indev or outdev
  need to be specified.
 --
-.7.4
+.5.0

-New patch
+[PULL V2 03/33] tap: allow extended virtio header with hash info
+From: Yuri Benditovich <yuri.benditovich@daynix.com>
+Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ net/tap.c | 3 ++-
+file changed, 2 insertions(+), 1 deletion(-)
+diff --git a/net/tap.c b/net/tap.c
+index XXXXXXX..XXXXXXX 100644
+--- a/net/tap.c
++++ b/net/tap.c
+@@ -XXX,XX +XXX,XX @@ static void tap_set_vnet_hdr_len(NetClientState *nc, int len)
+     assert(nc->info->type == NET_CLIENT_DRIVER_TAP);
+     assert(len == sizeof(struct virtio_net_hdr_mrg_rxbuf) ||
+-           len == sizeof(struct virtio_net_hdr));
++           len == sizeof(struct virtio_net_hdr) ||
++           len == sizeof(struct virtio_net_hdr_v1_hash));
+     tap_fd_set_vnet_hdr_len(s->fd, len);
+     s->host_vnet_hdr_len = len;
+--
+.5.0

-New patch
+[PULL V2 04/33] virtio-net: reference implementation of hash report
+From: Yuri Benditovich <yuri.benditovich@daynix.com>
 Suggest VIRTIO_NET_F_HASH_REPORT if specified in device
 parameters.
 If the VIRTIO_NET_F_HASH_REPORT is set,
 the device extends configuration space. If the feature
 is negotiated, the packet layout is extended to
 accomodate the hash information. In this case deliver
 packet's hash value and report type in virtio header
 extension.
 Use for configuration the same procedure as already
 used for RSS. We add two fields in rss_data that
 controls what the device does with the calculated hash
 if rss_data.enabled is set. If field 'populate' is set
 the hash is set in the packet, if field 'redirect' is
 set the hash is used to decide the queue to place the
 packet to.
 Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
  hw/net/virtio-net.c            | 99 +++++++++++++++++++++++++++++++++---------
  include/hw/virtio/virtio-net.h |  2 +
 files changed, 81 insertions(+), 20 deletions(-)
 diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/net/virtio-net.c
 +++ b/hw/net/virtio-net.c
@@ -XXX,XX +XXX,XX @@ static VirtIOFeature feature_sizes[] = {
       .end = endof(struct virtio_net_config, mtu)},
      {.flags = 1ULL << VIRTIO_NET_F_SPEED_DUPLEX,
       .end = endof(struct virtio_net_config, duplex)},
 -    {.flags = 1ULL << VIRTIO_NET_F_RSS,
 +    {.flags = (1ULL << VIRTIO_NET_F_RSS) | (1ULL << VIRTIO_NET_F_HASH_REPORT),
       .end = endof(struct virtio_net_config, supported_hash_types)},
      {}
  };
@@ -XXX,XX +XXX,XX @@ static void virtio_net_get_config(VirtIODevice *vdev, uint8_t *config)
      netcfg.duplex = n->net_conf.duplex;
      netcfg.rss_max_key_size = VIRTIO_NET_RSS_MAX_KEY_SIZE;
      virtio_stw_p(vdev, &netcfg.rss_max_indirection_table_length,
 -                 VIRTIO_NET_RSS_MAX_TABLE_LEN);
 +                 virtio_host_has_feature(vdev, VIRTIO_NET_F_RSS) ?
 +                 VIRTIO_NET_RSS_MAX_TABLE_LEN : 1);
      virtio_stl_p(vdev, &netcfg.supported_hash_types,
                   VIRTIO_NET_RSS_SUPPORTED_HASHES);
      memcpy(config, &netcfg, n->config_size);
@@ -XXX,XX +XXX,XX @@ static int peer_has_ufo(VirtIONet *n)
  }
  static void virtio_net_set_mrg_rx_bufs(VirtIONet *n, int mergeable_rx_bufs,
 -                                       int version_1)
 +                                       int version_1, int hash_report)
  {
      int i;
      NetClientState *nc;
@@ -XXX,XX +XXX,XX @@ static void virtio_net_set_mrg_rx_bufs(VirtIONet *n, int mergeable_rx_bufs,
      n->mergeable_rx_bufs = mergeable_rx_bufs;
      if (version_1) {
 -        n->guest_hdr_len = sizeof(struct virtio_net_hdr_mrg_rxbuf);
 +        n->guest_hdr_len = hash_report ?
 +            sizeof(struct virtio_net_hdr_v1_hash) :
 +            sizeof(struct virtio_net_hdr_mrg_rxbuf);
 +        n->rss_data.populate_hash = !!hash_report;
      } else {
          n->guest_hdr_len = n->mergeable_rx_bufs ?
              sizeof(struct virtio_net_hdr_mrg_rxbuf) :
@@ -XXX,XX +XXX,XX @@ static uint64_t virtio_net_get_features(VirtIODevice *vdev, uint64_t features,
          virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_TSO4);
          virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_TSO6);
          virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_ECN);
 +
 +        virtio_clear_feature(&features, VIRTIO_NET_F_HASH_REPORT);
      }
      if (!peer_has_vnet_hdr(n) || !peer_has_ufo(n)) {
@@ -XXX,XX +XXX,XX @@ static uint64_t virtio_net_get_features(VirtIODevice *vdev, uint64_t features,
      }
      virtio_clear_feature(&features, VIRTIO_NET_F_RSS);
 +    virtio_clear_feature(&features, VIRTIO_NET_F_HASH_REPORT);
      features = vhost_net_get_features(get_vhost_net(nc->peer), features);
      vdev->backend_features = features;
@@ -XXX,XX +XXX,XX @@ static void virtio_net_set_features(VirtIODevice *vdev, uint64_t features)
                                 virtio_has_feature(features,
                                                    VIRTIO_NET_F_MRG_RXBUF),
                                 virtio_has_feature(features,
 -                                                  VIRTIO_F_VERSION_1));
 +                                                  VIRTIO_F_VERSION_1),
 +                               virtio_has_feature(features,
 +                                                  VIRTIO_NET_F_HASH_REPORT));
      n->rsc4_enabled = virtio_has_feature(features, VIRTIO_NET_F_RSC_EXT) &&
          virtio_has_feature(features, VIRTIO_NET_F_GUEST_TSO4);
      n->rsc6_enabled = virtio_has_feature(features, VIRTIO_NET_F_RSC_EXT) &&
          virtio_has_feature(features, VIRTIO_NET_F_GUEST_TSO6);
 +    n->rss_data.redirect = virtio_has_feature(features, VIRTIO_NET_F_RSS);
      if (n->has_vnet_hdr) {
          n->curr_guest_offloads =
@@ -XXX,XX +XXX,XX @@ static void virtio_net_disable_rss(VirtIONet *n)
  }
  static uint16_t virtio_net_handle_rss(VirtIONet *n,
 -                                      struct iovec *iov, unsigned int iov_cnt)
 +                                      struct iovec *iov,
 +                                      unsigned int iov_cnt,
 +                                      bool do_rss)
  {
      VirtIODevice *vdev = VIRTIO_DEVICE(n);
      struct virtio_net_rss_config cfg;
@@ -XXX,XX +XXX,XX @@ static uint16_t virtio_net_handle_rss(VirtIONet *n,
      const char *err_msg = "";
      uint32_t err_value = 0;
 -    if (!virtio_vdev_has_feature(vdev, VIRTIO_NET_F_RSS)) {
 +    if (do_rss && !virtio_vdev_has_feature(vdev, VIRTIO_NET_F_RSS)) {
          err_msg = "RSS is not negotiated";
          goto error;
      }
 +    if (!do_rss && !virtio_vdev_has_feature(vdev, VIRTIO_NET_F_HASH_REPORT)) {
 +        err_msg = "Hash report is not negotiated";
 +        goto error;
 +    }
      size_get = offsetof(struct virtio_net_rss_config, indirection_table);
      s = iov_to_buf(iov, iov_cnt, offset, &cfg, size_get);
      if (s != size_get) {
@@ -XXX,XX +XXX,XX @@ static uint16_t virtio_net_handle_rss(VirtIONet *n,
      n->rss_data.indirections_len =
          virtio_lduw_p(vdev, &cfg.indirection_table_mask);
      n->rss_data.indirections_len++;
 +    if (!do_rss) {
 +        n->rss_data.indirections_len = 1;
 +    }
      if (!is_power_of_2(n->rss_data.indirections_len)) {
          err_msg = "Invalid size of indirection table";
          err_value = n->rss_data.indirections_len;
@@ -XXX,XX +XXX,XX @@ static uint16_t virtio_net_handle_rss(VirtIONet *n,
          err_value = n->rss_data.indirections_len;
          goto error;
      }
 -    n->rss_data.default_queue =
 -        virtio_lduw_p(vdev, &cfg.unclassified_queue);
 +    n->rss_data.default_queue = do_rss ?
 +        virtio_lduw_p(vdev, &cfg.unclassified_queue) : 0;
      if (n->rss_data.default_queue >= n->max_queues) {
          err_msg = "Invalid default queue";
          err_value = n->rss_data.default_queue;
@@ -XXX,XX +XXX,XX @@ static uint16_t virtio_net_handle_rss(VirtIONet *n,
          err_value = (uint32_t)s;
          goto error;
      }
 -    queues = virtio_lduw_p(vdev, &temp.us);
 +    queues = do_rss ? virtio_lduw_p(vdev, &temp.us) : n->curr_queues;
      if (queues == 0 || queues > n->max_queues) {
          err_msg = "Invalid number of queues";
          err_value = queues;
@@ -XXX,XX +XXX,XX @@ static int virtio_net_handle_mq(VirtIONet *n, uint8_t cmd,
      uint16_t queues;
      virtio_net_disable_rss(n);
 +    if (cmd == VIRTIO_NET_CTRL_MQ_HASH_CONFIG) {
 +        queues = virtio_net_handle_rss(n, iov, iov_cnt, false);
 +        return queues ? VIRTIO_NET_OK : VIRTIO_NET_ERR;
 +    }
      if (cmd == VIRTIO_NET_CTRL_MQ_RSS_CONFIG) {
 -        queues = virtio_net_handle_rss(n, iov, iov_cnt);
 +        queues = virtio_net_handle_rss(n, iov, iov_cnt, true);
      } else if (cmd == VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET) {
          struct virtio_net_ctrl_mq mq;
          size_t s;
@@ -XXX,XX +XXX,XX @@ static uint8_t virtio_net_get_hash_type(bool isip4,
      return 0xff;
  }
 +static void virtio_set_packet_hash(const uint8_t *buf, uint8_t report,
 +                                   uint32_t hash)
 +{
 +    struct virtio_net_hdr_v1_hash *hdr = (void *)buf;
 +    hdr->hash_value = hash;
 +    hdr->hash_report = report;
 +}
 +
  static int virtio_net_process_rss(NetClientState *nc, const uint8_t *buf,
                                    size_t size)
  {
      VirtIONet *n = qemu_get_nic_opaque(nc);
 -    unsigned int index = nc->queue_index, new_index;
 +    unsigned int index = nc->queue_index, new_index = index;
      struct NetRxPkt *pkt = n->rx_pkt;
      uint8_t net_hash_type;
      uint32_t hash;
      bool isip4, isip6, isudp, istcp;
 +    static const uint8_t reports[NetPktRssIpV6UdpEx + 1] = {
 +        VIRTIO_NET_HASH_REPORT_IPv4,
 +        VIRTIO_NET_HASH_REPORT_TCPv4,
 +        VIRTIO_NET_HASH_REPORT_TCPv6,
 +        VIRTIO_NET_HASH_REPORT_IPv6,
 +        VIRTIO_NET_HASH_REPORT_IPv6_EX,
 +        VIRTIO_NET_HASH_REPORT_TCPv6_EX,
 +        VIRTIO_NET_HASH_REPORT_UDPv4,
 +        VIRTIO_NET_HASH_REPORT_UDPv6,
 +        VIRTIO_NET_HASH_REPORT_UDPv6_EX
 +    };
      net_rx_pkt_set_protocols(pkt, buf + n->host_hdr_len,
                               size - n->host_hdr_len);
@@ -XXX,XX +XXX,XX @@ static int virtio_net_process_rss(NetClientState *nc, const uint8_t *buf,
      net_hash_type = virtio_net_get_hash_type(isip4, isip6, isudp, istcp,
                                               n->rss_data.hash_types);
      if (net_hash_type > NetPktRssIpV6UdpEx) {
 -        return n->rss_data.default_queue;
 +        if (n->rss_data.populate_hash) {
 +            virtio_set_packet_hash(buf, VIRTIO_NET_HASH_REPORT_NONE, 0);
 +        }
 +        return n->rss_data.redirect ? n->rss_data.default_queue : -1;
      }
      hash = net_rx_pkt_calc_rss_hash(pkt, net_hash_type, n->rss_data.key);
 -    new_index = hash & (n->rss_data.indirections_len - 1);
 -    new_index = n->rss_data.indirections_table[new_index];
 -    if (index == new_index) {
 -        return -1;
 +
 +    if (n->rss_data.populate_hash) {
 +        virtio_set_packet_hash(buf, reports[net_hash_type], hash);
      }
 -    return new_index;
 +
 +    if (n->rss_data.redirect) {
 +        new_index = hash & (n->rss_data.indirections_len - 1);
 +        new_index = n->rss_data.indirections_table[new_index];
 +    }
 +
 +    return (index == new_index) ? -1 : new_index;
  }
  static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
@@ -XXX,XX +XXX,XX @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
              }
              receive_header(n, sg, elem->in_num, buf, size);
 +            if (n->rss_data.populate_hash) {
 +                offset = sizeof(mhdr);
 +                iov_from_buf(sg, elem->in_num, offset,
 +                             buf + offset, n->host_hdr_len - sizeof(mhdr));
 +            }
              offset = n->host_hdr_len;
              total += n->guest_hdr_len;
              guest_offset = n->guest_hdr_len;
@@ -XXX,XX +XXX,XX @@ static int virtio_net_post_load_device(void *opaque, int version_id)
      trace_virtio_net_post_load_device();
      virtio_net_set_mrg_rx_bufs(n, n->mergeable_rx_bufs,
                                 virtio_vdev_has_feature(vdev,
 -                                                       VIRTIO_F_VERSION_1));
 +                                                       VIRTIO_F_VERSION_1),
 +                               virtio_vdev_has_feature(vdev,
 +                                                       VIRTIO_NET_F_HASH_REPORT));
      /* MAC_TABLE_ENTRIES may be different from the saved image */
      if (n->mac_table.in_use > MAC_TABLE_ENTRIES) {
@@ -XXX,XX +XXX,XX @@ static void virtio_net_device_realize(DeviceState *dev, Error **errp)
      n->vqs[0].tx_waiting = 0;
      n->tx_burst = n->net_conf.txburst;
 -    virtio_net_set_mrg_rx_bufs(n, 0, 0);
 +    virtio_net_set_mrg_rx_bufs(n, 0, 0, 0);
      n->promisc = 1; /* for compatibility */
      n->mac_table.macs = g_malloc0(MAC_TABLE_ENTRIES * ETH_ALEN);
@@ -XXX,XX +XXX,XX @@ static Property virtio_net_properties[] = {
      DEFINE_PROP_BIT64("mq", VirtIONet, host_features, VIRTIO_NET_F_MQ, false),
      DEFINE_PROP_BIT64("rss", VirtIONet, host_features,
                      VIRTIO_NET_F_RSS, false),
 +    DEFINE_PROP_BIT64("hash", VirtIONet, host_features,
 +                    VIRTIO_NET_F_HASH_REPORT, false),
      DEFINE_PROP_BIT64("guest_rsc_ext", VirtIONet, host_features,
                      VIRTIO_NET_F_RSC_EXT, false),
      DEFINE_PROP_UINT32("rsc_interval", VirtIONet, rsc_timeout,
 diff --git a/include/hw/virtio/virtio-net.h b/include/hw/virtio/virtio-net.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/virtio/virtio-net.h
 +++ b/include/hw/virtio/virtio-net.h
@@ -XXX,XX +XXX,XX @@ typedef struct VirtioNetRscChain {
  typedef struct VirtioNetRssData {
      bool    enabled;
 +    bool    redirect;
 +    bool    populate_hash;
      uint32_t hash_types;
      uint8_t key[VIRTIO_NET_RSS_MAX_KEY_SIZE];
      uint16_t indirections_len;
 --
 .5.0

-New patch
+[PULL V2 05/33] vmstate.h: provide VMSTATE_VARRAY_UINT16_ALLOC macro
+From: Yuri Benditovich <yuri.benditovich@daynix.com>
+Similar to VMSTATE_VARRAY_UINT32_ALLOC, but the size is
+-bit field.
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
+Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ include/migration/vmstate.h | 10 ++++++++++
+file changed, 10 insertions(+)
+diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/migration/vmstate.h
++++ b/include/migration/vmstate.h
+@@ -XXX,XX +XXX,XX @@ extern const VMStateInfo vmstate_info_qlist;
+     .offset     = vmstate_offset_pointer(_state, _field, _type),     \
+ }
++#define VMSTATE_VARRAY_UINT16_ALLOC(_field, _state, _field_num, _version, _info, _type) {\
++    .name       = (stringify(_field)),                               \
++    .version_id = (_version),                                        \
++    .num_offset = vmstate_offset_value(_state, _field_num, uint16_t),\
++    .info       = &(_info),                                          \
++    .size       = sizeof(_type),                                     \
++    .flags      = VMS_VARRAY_UINT16 | VMS_POINTER | VMS_ALLOC,       \
++    .offset     = vmstate_offset_pointer(_state, _field, _type),     \
++}
++
+ #define VMSTATE_VARRAY_UINT16_UNSAFE(_field, _state, _field_num, _version, _info, _type) {\
+     .name       = (stringify(_field)),                               \
+     .version_id = (_version),                                        \
+--
+.5.0

-[Qemu-devel] [PULL 13/14] virtion-net: Prefer is_power_of_2()
+[PULL V2 06/33] virtio-net: add migration support for RSS and hash report
-From: Michal Privoznik <mprivozn@redhat.com>
+From: Yuri Benditovich <yuri.benditovich@daynix.com>
-We have a function that checks if given number is power of two.
+Save and restore RSS/hash report configuration.
 We should prefer it instead of expanding the check on our own.
-Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
+Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- hw/net/virtio-net.c | 2 +-
+ hw/net/virtio-net.c | 37 +++++++++++++++++++++++++++++++++++++
-file changed, 1 insertion(+), 1 deletion(-)
+file changed, 37 insertions(+)
 diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/net/virtio-net.c
 +++ b/hw/net/virtio-net.c
-@@ -XXX,XX +XXX,XX @@ static void virtio_net_device_realize(DeviceState *dev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ static int virtio_net_post_load_device(void *opaque, int version_id)
-      */
+         }
-     if (n->net_conf.rx_queue_size < VIRTIO_NET_RX_QUEUE_MIN_SIZE ||
+     }
-         n->net_conf.rx_queue_size > VIRTQUEUE_MAX_SIZE ||
--        (n->net_conf.rx_queue_size & (n->net_conf.rx_queue_size - 1))) {
++    if (n->rss_data.enabled) {
-+        !is_power_of_2(n->net_conf.rx_queue_size)) {
++        trace_virtio_net_rss_enable(n->rss_data.hash_types,
-         error_setg(errp, "Invalid rx_queue_size (= %" PRIu16 "), "
++                                    n->rss_data.indirections_len,
-                    "must be a power of 2 between %d and %d.",
++                                    sizeof(n->rss_data.key));
-                    n->net_conf.rx_queue_size, VIRTIO_NET_RX_QUEUE_MIN_SIZE,
++    } else {
 +        trace_virtio_net_rss_disable();
 +    }
      return 0;
  }
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_virtio_net_has_vnet = {
      },
  };
 +static bool virtio_net_rss_needed(void *opaque)
 +{
 +    return VIRTIO_NET(opaque)->rss_data.enabled;
 +}
 +
 +static const VMStateDescription vmstate_virtio_net_rss = {
 +    .name      = "virtio-net-device/rss",
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .needed = virtio_net_rss_needed,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_BOOL(rss_data.enabled, VirtIONet),
 +        VMSTATE_BOOL(rss_data.redirect, VirtIONet),
 +        VMSTATE_BOOL(rss_data.populate_hash, VirtIONet),
 +        VMSTATE_UINT32(rss_data.hash_types, VirtIONet),
 +        VMSTATE_UINT16(rss_data.indirections_len, VirtIONet),
 +        VMSTATE_UINT16(rss_data.default_queue, VirtIONet),
 +        VMSTATE_UINT8_ARRAY(rss_data.key, VirtIONet,
 +                            VIRTIO_NET_RSS_MAX_KEY_SIZE),
 +        VMSTATE_VARRAY_UINT16_ALLOC(rss_data.indirections_table, VirtIONet,
 +                                    rss_data.indirections_len, 0,
 +                                    vmstate_info_uint16, uint16_t),
 +        VMSTATE_END_OF_LIST()
 +    },
 +};
 +
  static const VMStateDescription vmstate_virtio_net_device = {
      .name = "virtio-net-device",
      .version_id = VIRTIO_NET_VM_VERSION,
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_virtio_net_device = {
                              has_ctrl_guest_offloads),
          VMSTATE_END_OF_LIST()
     },
 +    .subsections = (const VMStateDescription * []) {
 +        &vmstate_virtio_net_rss,
 +        NULL
 +    }
  };
  static NetClientInfo net_virtio_info = {
 --
-.7.4
+.5.0

-[Qemu-devel] [PULL 14/14] virtio-net: fix offload ctrl endian
+[PULL V2 07/33] virtio-net: align RSC fields with updated virtio-net header
-Spec said offloads should be le64, so use virtio_ldq_p() to guarantee
+From: Yuri Benditovich <yuri.benditovich@daynix.com>
 valid endian.
-Fixes: 644c98587d4c ("virtio-net: dynamic network offloads configuration")
+Removal of duplicated RSC definitions. Changing names of the
-Cc: qemu-stable@nongnu.org
+fields to ones defined in the Linux header.
-Cc: Dmitry Fleytman <dfleytma@redhat.com>
 Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- hw/net/virtio-net.c | 2 ++
+ hw/net/virtio-net.c | 28 ++++------------------------
-file changed, 2 insertions(+)
+file changed, 4 insertions(+), 24 deletions(-)
 diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/net/virtio-net.c
 +++ b/hw/net/virtio-net.c
-@@ -XXX,XX +XXX,XX @@ static int virtio_net_handle_offloads(VirtIONet *n, uint8_t cmd,
+@@ -XXX,XX +XXX,XX @@
-     if (cmd == VIRTIO_NET_CTRL_GUEST_OFFLOADS_SET) {
+                                          VIRTIO_NET_RSS_HASH_TYPE_TCP_EX | \
-         uint64_t supported_offloads;
+                                          VIRTIO_NET_RSS_HASH_TYPE_UDP_EX)
-+        offloads = virtio_ldq_p(vdev, &offloads);
+-/* temporary until standard header include it */
-+
+-#if !defined(VIRTIO_NET_HDR_F_RSC_INFO)
-         if (!n->has_vnet_hdr) {
+-
-             return VIRTIO_NET_ERR;
+-#define VIRTIO_NET_HDR_F_RSC_INFO  4 /* rsc_ext data in csum_ fields */
-         }
+-#define VIRTIO_NET_F_RSC_EXT       61
 -
 -#endif
 -
 -static inline __virtio16 *virtio_net_rsc_ext_num_packets(
 -    struct virtio_net_hdr *hdr)
 -{
 -    return &hdr->csum_start;
 -}
 -
 -static inline __virtio16 *virtio_net_rsc_ext_num_dupacks(
 -    struct virtio_net_hdr *hdr)
 -{
 -    return &hdr->csum_offset;
 -}
 -
  static VirtIOFeature feature_sizes[] = {
      {.flags = 1ULL << VIRTIO_NET_F_MAC,
       .end = endof(struct virtio_net_config, mac)},
@@ -XXX,XX +XXX,XX @@ static size_t virtio_net_rsc_drain_seg(VirtioNetRscChain *chain,
                                         VirtioNetRscSeg *seg)
  {
      int ret;
 -    struct virtio_net_hdr *h;
 +    struct virtio_net_hdr_v1 *h;
 -    h = (struct virtio_net_hdr *)seg->buf;
 +    h = (struct virtio_net_hdr_v1 *)seg->buf;
      h->flags = 0;
      h->gso_type = VIRTIO_NET_HDR_GSO_NONE;
      if (seg->is_coalesced) {
 -        *virtio_net_rsc_ext_num_packets(h) = seg->packets;
 -        *virtio_net_rsc_ext_num_dupacks(h) = seg->dup_ack;
 +        h->rsc.segments = seg->packets;
 +        h->rsc.dup_acks = seg->dup_ack;
          h->flags = VIRTIO_NET_HDR_F_RSC_INFO;
          if (chain->proto == ETH_P_IP) {
              h->gso_type = VIRTIO_NET_HDR_GSO_TCPV4;
 --
-.7.4
+.5.0

-New patch
+[PULL V2 08/33] Fix tulip breakage
+From: Helge Deller <deller@gmx.de>
+The tulip network driver in a qemu-system-hppa emulation is broken in
+the sense that bigger network packages aren't received any longer and
+thus even running e.g. "apt update" inside the VM fails.
+The breakage was introduced by commit 8ffb7265af ("check frame size and
+r/w data length") which added checks to prevent accesses outside of the
+rx/tx buffers.
+But the new checks were implemented wrong. The variable rx_frame_len
+counts backwards, from rx_frame_size down to zero, and the variable len
+is never bigger than rx_frame_len, so accesses just can't happen and the
+checks are unnecessary.
+On the contrary the checks now prevented bigger packages to be moved
+into the rx buffers.
+This patch reverts the wrong checks and were sucessfully tested with a
+qemu-system-hppa emulation.
+Fixes: 8ffb7265af ("check frame size and r/w data length")
+Buglink: https://bugs.launchpad.net/bugs/1874539
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ hw/net/tulip.c | 6 ------
+file changed, 6 deletions(-)
+diff --git a/hw/net/tulip.c b/hw/net/tulip.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/tulip.c
++++ b/hw/net/tulip.c
+@@ -XXX,XX +XXX,XX @@ static void tulip_copy_rx_bytes(TULIPState *s, struct tulip_descriptor *desc)
+             len = s->rx_frame_len;
+         }
+-        if (s->rx_frame_len + len > sizeof(s->rx_frame)) {
+-            return;
+-        }
+         pci_dma_write(&s->dev, desc->buf_addr1, s->rx_frame +
+             (s->rx_frame_size - s->rx_frame_len), len);
+         s->rx_frame_len -= len;
+@@ -XXX,XX +XXX,XX @@ static void tulip_copy_rx_bytes(TULIPState *s, struct tulip_descriptor *desc)
+             len = s->rx_frame_len;
+         }
+-        if (s->rx_frame_len + len > sizeof(s->rx_frame)) {
+-            return;
+-        }
+         pci_dma_write(&s->dev, desc->buf_addr2, s->rx_frame +
+             (s->rx_frame_size - s->rx_frame_len), len);
+         s->rx_frame_len -= len;
+--
+.5.0

-New patch
+[PULL V2 09/33] hw/net/tulip: Fix 'Descriptor Error' definition
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Bit #14 is "DE" for 'Descriptor Error':
+  When set, indicates a frame truncation caused by a frame
+  that does not fit within the current descriptor buffers,
+  and that the 21143 does not own the next descriptor.
+  [Table 4-1. RDES0 Bit Fields Description]
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ hw/net/tulip.h | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/hw/net/tulip.h b/hw/net/tulip.h
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/tulip.h
++++ b/hw/net/tulip.h
+@@ -XXX,XX +XXX,XX @@
+ #define RDES0_RF         BIT(11)
+ #define RDES0_DT_SHIFT   12
+ #define RDES0_DT_MASK    3
+-#define RDES0_LE         BIT(14)
++#define RDES0_DE         BIT(14)
+ #define RDES0_ES         BIT(15)
+ #define RDES0_FL_SHIFT   16
+ #define RDES0_FL_MASK    0x3fff
+--
+.5.0

-New patch
+[PULL V2 10/33] hw/net/tulip: Log descriptor overflows
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Log with GUEST_ERROR what the guest is doing wrong.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ hw/net/tulip.c | 6 ++++++
+file changed, 6 insertions(+)
+diff --git a/hw/net/tulip.c b/hw/net/tulip.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/tulip.c
++++ b/hw/net/tulip.c
+@@ -XXX,XX +XXX,XX @@ static int tulip_copy_tx_buffers(TULIPState *s, struct tulip_descriptor *desc)
+     int len2 = (desc->control >> TDES1_BUF2_SIZE_SHIFT) & TDES1_BUF2_SIZE_MASK;
+     if (s->tx_frame_len + len1 > sizeof(s->tx_frame)) {
++        qemu_log_mask(LOG_GUEST_ERROR,
++                      "%s: descriptor overflow (ofs: %u, len:%d, size:%zu)\n",
++                      __func__, s->tx_frame_len, len1, sizeof(s->tx_frame));
+         return -1;
+     }
+     if (len1) {
+@@ -XXX,XX +XXX,XX @@ static int tulip_copy_tx_buffers(TULIPState *s, struct tulip_descriptor *desc)
+     }
+     if (s->tx_frame_len + len2 > sizeof(s->tx_frame)) {
++        qemu_log_mask(LOG_GUEST_ERROR,
++                      "%s: descriptor overflow (ofs: %u, len:%d, size:%zu)\n",
++                      __func__, s->tx_frame_len, len2, sizeof(s->tx_frame));
+         return -1;
+     }
+     if (len2) {
+--
+.5.0

-New patch
+[PULL V2 11/33] net: cadence_gem: Fix debug statements
+From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+Enabling debug breaks the build, Fix them and make debug statements
+always compilable. Fix few statements to use sized integer casting.
+Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ hw/net/cadence_gem.c | 27 +++++++++++++--------------
+file changed, 13 insertions(+), 14 deletions(-)
+diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/cadence_gem.c
++++ b/hw/net/cadence_gem.c
+@@ -XXX,XX +XXX,XX @@
+ #include "sysemu/dma.h"
+ #include "net/checksum.h"
+-#ifdef CADENCE_GEM_ERR_DEBUG
+-#define DB_PRINT(...) do { \
+-    fprintf(stderr,  ": %s: ", __func__); \
+-    fprintf(stderr, ## __VA_ARGS__); \
+-    } while (0)
+-#else
+-    #define DB_PRINT(...)
+-#endif
++#define CADENCE_GEM_ERR_DEBUG 0
++#define DB_PRINT(...) do {\
++    if (CADENCE_GEM_ERR_DEBUG) {   \
++        qemu_log(": %s: ", __func__); \
++        qemu_log(__VA_ARGS__); \
++    } \
++} while (0)
+ #define GEM_NWCTRL        (0x00000000/4) /* Network Control reg */
+ #define GEM_NWCFG         (0x00000004/4) /* Network Config reg */
+@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
+         size += 4;
+     }
+-    DB_PRINT("config bufsize: %d packet size: %ld\n", rxbufsize, size);
++    DB_PRINT("config bufsize: %u packet size: %zd\n", rxbufsize, size);
+     /* Find which queue we are targeting */
+     q = get_queue_from_screen(s, rxbuf_ptr, rxbufsize);
+@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
+             return -1;
+         }
+-        DB_PRINT("copy %u bytes to 0x%" PRIx64 "\n",
+-                 MIN(bytes_to_copy, rxbufsize),
+-                 rx_desc_get_buffer(s, s->rx_desc[q]));
++        DB_PRINT("copy %" PRIu32 " bytes to 0x%" PRIx64 "\n",
++                MIN(bytes_to_copy, rxbufsize),
++                rx_desc_get_buffer(s, s->rx_desc[q]));
+         /* Copy packet data to emulated DMA buffer */
+         address_space_write(&s->dma_as, rx_desc_get_buffer(s, s->rx_desc[q]) +
+@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
+              */
+             if ((tx_desc_get_buffer(s, desc) == 0) ||
+                 (tx_desc_get_length(desc) == 0)) {
+-                DB_PRINT("Invalid TX descriptor @ 0x%x\n",
+-                         (unsigned)packet_desc_addr);
++                DB_PRINT("Invalid TX descriptor @ 0x%" HWADDR_PRIx "\n",
++                         packet_desc_addr);
+                 break;
+             }
+--
+.5.0

-New patch
+[PULL V2 12/33] net: cadence_gem: Fix the queue address update during wrap around
+From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+During wrap around and reset, queues are pointing to initial base
+address of queue 0, irrespective of what queue we are dealing with.
+Fix it by assigning proper base address every time.
+Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ hw/net/cadence_gem.c | 37 +++++++++++++++++++++++++++++++++----
+file changed, 33 insertions(+), 4 deletions(-)
+diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/cadence_gem.c
++++ b/hw/net/cadence_gem.c
+@@ -XXX,XX +XXX,XX @@ static int get_queue_from_screen(CadenceGEMState *s, uint8_t *rxbuf_ptr,
+     return 0;
+ }
++static uint32_t gem_get_queue_base_addr(CadenceGEMState *s, bool tx, int q)
++{
++    uint32_t base_addr = 0;
++
++    switch (q) {
++    case 0:
++        base_addr = s->regs[tx ? GEM_TXQBASE : GEM_RXQBASE];
++        break;
++    case 1 ... (MAX_PRIORITY_QUEUES - 1):
++        base_addr = s->regs[(tx ? GEM_TRANSMIT_Q1_PTR :
++                                 GEM_RECEIVE_Q1_PTR) + q - 1];
++        break;
++    default:
++        g_assert_not_reached();
++    };
++
++    return base_addr;
++}
++
++static inline uint32_t gem_get_tx_queue_base_addr(CadenceGEMState *s, int q)
++{
++    return gem_get_queue_base_addr(s, true, q);
++}
++
++static inline uint32_t gem_get_rx_queue_base_addr(CadenceGEMState *s, int q)
++{
++    return gem_get_queue_base_addr(s, false, q);
++}
++
+ static hwaddr gem_get_desc_addr(CadenceGEMState *s, bool tx, int q)
+ {
+     hwaddr desc_addr = 0;
+@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
+         /* Next descriptor */
+         if (rx_desc_get_wrap(s->rx_desc[q])) {
+             DB_PRINT("wrapping RX descriptor list\n");
+-            s->rx_desc_addr[q] = s->regs[GEM_RXQBASE];
++            s->rx_desc_addr[q] = gem_get_rx_queue_base_addr(s, q);
+         } else {
+             DB_PRINT("incrementing RX descriptor list\n");
+             s->rx_desc_addr[q] += 4 * gem_get_desc_len(s, true);
+@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
+                                     sizeof(desc_first));
+                 /* Advance the hardware current descriptor past this packet */
+                 if (tx_desc_get_wrap(desc)) {
+-                    s->tx_desc_addr[q] = s->regs[GEM_TXQBASE];
++                    s->tx_desc_addr[q] = gem_get_tx_queue_base_addr(s, q);
+                 } else {
+                     s->tx_desc_addr[q] = packet_desc_addr +
+* gem_get_desc_len(s, false);
+@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
+                 } else {
+                     packet_desc_addr = 0;
+                 }
+-                packet_desc_addr |= s->regs[GEM_TXQBASE];
++                packet_desc_addr |= gem_get_tx_queue_base_addr(s, q);
+             } else {
+                 packet_desc_addr += 4 * gem_get_desc_len(s, false);
+             }
+@@ -XXX,XX +XXX,XX @@ static void gem_write(void *opaque, hwaddr offset, uint64_t val,
+         if (!(val & GEM_NWCTRL_TXENA)) {
+             /* Reset to start of Q when transmit disabled. */
+             for (i = 0; i < s->num_priority_queues; i++) {
+-                s->tx_desc_addr[i] = s->regs[GEM_TXQBASE];
++                s->tx_desc_addr[i] = gem_get_tx_queue_base_addr(s, i);
+             }
+         }
+         if (gem_can_receive(qemu_get_queue(s->nic))) {
+--
+.5.0

-New patch
+[PULL V2 13/33] net: cadence_gem: Fix irq update w.r.t queue
+From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+Set irq's specific to a queue, present implementation is setting q1 irq
+based on q0 status.
+Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ hw/net/cadence_gem.c | 25 +++----------------------
+file changed, 3 insertions(+), 22 deletions(-)
+diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/cadence_gem.c
++++ b/hw/net/cadence_gem.c
+@@ -XXX,XX +XXX,XX @@ static void gem_update_int_status(CadenceGEMState *s)
+ {
+     int i;
+-    if (!s->regs[GEM_ISR]) {
+-        /* ISR isn't set, clear all the interrupts */
+-        for (i = 0; i < s->num_priority_queues; ++i) {
+-            qemu_set_irq(s->irq[i], 0);
+-        }
+-        return;
+-    }
++    qemu_set_irq(s->irq[0], !!s->regs[GEM_ISR]);
+-    /* If we get here we know s->regs[GEM_ISR] is set, so we don't need to
+-     * check it again.
+-     */
+-    if (s->num_priority_queues == 1) {
+-        /* No priority queues, just trigger the interrupt */
+-        DB_PRINT("asserting int.\n");
+-        qemu_set_irq(s->irq[0], 1);
+-        return;
+-    }
+-
+-    for (i = 0; i < s->num_priority_queues; ++i) {
+-        if (s->regs[GEM_INT_Q1_STATUS + i]) {
+-            DB_PRINT("asserting int. (q=%d)\n", i);
+-            qemu_set_irq(s->irq[i], 1);
+-        }
++    for (i = 1; i < s->num_priority_queues; ++i) {
++        qemu_set_irq(s->irq[i], !!s->regs[GEM_INT_Q1_STATUS + i - 1]);
+     }
+ }
+--
+.5.0

-New patch
+[PULL V2 14/33] net: cadence_gem: Define access permission for interrupt registers
+From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+Q1 to Q7 ISR's are clear-on-read, IER/IDR registers
+are write-only, mask reg are read-only.
+Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ hw/net/cadence_gem.c | 14 ++++++++++++++
+file changed, 14 insertions(+)
+diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/cadence_gem.c
++++ b/hw/net/cadence_gem.c
+@@ -XXX,XX +XXX,XX @@ static const uint8_t broadcast_addr[] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
+  */
+ static void gem_init_register_masks(CadenceGEMState *s)
+ {
++    unsigned int i;
+     /* Mask of register bits which are read only */
+     memset(&s->regs_ro[0], 0, sizeof(s->regs_ro));
+     s->regs_ro[GEM_NWCTRL]   = 0xFFF80000;
+@@ -XXX,XX +XXX,XX @@ static void gem_init_register_masks(CadenceGEMState *s)
+     s->regs_ro[GEM_ISR]      = 0xFFFFFFFF;
+     s->regs_ro[GEM_IMR]      = 0xFFFFFFFF;
+     s->regs_ro[GEM_MODID]    = 0xFFFFFFFF;
++    for (i = 0; i < s->num_priority_queues; i++) {
++        s->regs_ro[GEM_INT_Q1_STATUS + i] = 0xFFFFFFFF;
++        s->regs_ro[GEM_INT_Q1_ENABLE + i] = 0xFFFFF319;
++        s->regs_ro[GEM_INT_Q1_DISABLE + i] = 0xFFFFF319;
++        s->regs_ro[GEM_INT_Q1_MASK + i] = 0xFFFFFFFF;
++    }
+     /* Mask of register bits which are clear on read */
+     memset(&s->regs_rtc[0], 0, sizeof(s->regs_rtc));
+     s->regs_rtc[GEM_ISR]      = 0xFFFFFFFF;
++    for (i = 0; i < s->num_priority_queues; i++) {
++        s->regs_rtc[GEM_INT_Q1_STATUS + i] = 0x00000CE6;
++    }
+     /* Mask of register bits which are write 1 to clear */
+     memset(&s->regs_w1c[0], 0, sizeof(s->regs_w1c));
+@@ -XXX,XX +XXX,XX @@ static void gem_init_register_masks(CadenceGEMState *s)
+     s->regs_wo[GEM_NWCTRL]   = 0x00073E60;
+     s->regs_wo[GEM_IER]      = 0x07FFFFFF;
+     s->regs_wo[GEM_IDR]      = 0x07FFFFFF;
++    for (i = 0; i < s->num_priority_queues; i++) {
++        s->regs_wo[GEM_INT_Q1_ENABLE + i] = 0x00000CE6;
++        s->regs_wo[GEM_INT_Q1_DISABLE + i] = 0x00000CE6;
++    }
+ }
+ /*
+--
+.5.0

-New patch
+[PULL V2 15/33] net: cadence_gem: Set ISR according to queue in use
+From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+Set ISR according to queue in use, added interrupt support for
+all queues.
+Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ hw/net/cadence_gem.c | 27 +++++++++++++++++----------
+file changed, 17 insertions(+), 10 deletions(-)
+diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/cadence_gem.c
++++ b/hw/net/cadence_gem.c
+@@ -XXX,XX +XXX,XX @@ static inline void rx_desc_set_sar(uint32_t *desc, int sar_idx)
+ /* The broadcast MAC address: 0xFFFFFFFFFFFF */
+ static const uint8_t broadcast_addr[] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
++static void gem_set_isr(CadenceGEMState *s, int q, uint32_t flag)
++{
++    if (q == 0) {
++        s->regs[GEM_ISR] |= flag & ~(s->regs[GEM_IMR]);
++    } else {
++        s->regs[GEM_INT_Q1_STATUS + q - 1] |= flag &
++                                      ~(s->regs[GEM_INT_Q1_MASK + q - 1]);
++    }
++}
++
+ /*
+  * gem_init_register_masks:
+  * One time initialization.
+@@ -XXX,XX +XXX,XX @@ static void gem_get_rx_desc(CadenceGEMState *s, int q)
+     if (rx_desc_get_ownership(s->rx_desc[q]) == 1) {
+         DB_PRINT("descriptor 0x%" HWADDR_PRIx " owned by sw.\n", desc_addr);
+         s->regs[GEM_RXSTATUS] |= GEM_RXSTATUS_NOBUF;
+-        s->regs[GEM_ISR] |= GEM_INT_RXUSED & ~(s->regs[GEM_IMR]);
++        gem_set_isr(s, q, GEM_INT_RXUSED);
+         /* Handle interrupt consequences */
+         gem_update_int_status(s);
+     }
+@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
+     gem_receive_updatestats(s, buf, size);
+     s->regs[GEM_RXSTATUS] |= GEM_RXSTATUS_FRMRCVD;
+-    s->regs[GEM_ISR] |= GEM_INT_RXCMPL & ~(s->regs[GEM_IMR]);
++    gem_set_isr(s, q, GEM_INT_RXCMPL);
+     /* Handle interrupt consequences */
+     gem_update_int_status(s);
+@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
+                 DB_PRINT("TX descriptor next: 0x%08x\n", s->tx_desc_addr[q]);
+                 s->regs[GEM_TXSTATUS] |= GEM_TXSTATUS_TXCMPL;
+-                s->regs[GEM_ISR] |= GEM_INT_TXCMPL & ~(s->regs[GEM_IMR]);
+-
+-                /* Update queue interrupt status */
+-                if (s->num_priority_queues > 1) {
+-                    s->regs[GEM_INT_Q1_STATUS + q] |=
+-                            GEM_INT_TXCMPL & ~(s->regs[GEM_INT_Q1_MASK + q]);
+-                }
++                gem_set_isr(s, q, GEM_INT_TXCMPL);
+                 /* Handle interrupt consequences */
+                 gem_update_int_status(s);
+@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
+         if (tx_desc_get_used(desc)) {
+             s->regs[GEM_TXSTATUS] |= GEM_TXSTATUS_USED;
+-            s->regs[GEM_ISR] |= GEM_INT_TXUSED & ~(s->regs[GEM_IMR]);
++            /* IRQ TXUSED is defined only for queue 0 */
++            if (q == 0) {
++                gem_set_isr(s, 0, GEM_INT_TXUSED);
++            }
+             gem_update_int_status(s);
+         }
+     }
+--
+.5.0

-New patch
+[PULL V2 16/33] net: cadence_gem: Move tx/rx packet buffert to CadenceGEMState
+From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+Moving this buffers to CadenceGEMState, as their size will be increased
+more when JUMBO frames support is added.
+Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ hw/net/cadence_gem.c         | 38 +++++++++++++++++---------------------
+ include/hw/net/cadence_gem.h |  4 ++++
+files changed, 21 insertions(+), 21 deletions(-)
+diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/cadence_gem.c
++++ b/hw/net/cadence_gem.c
+@@ -XXX,XX +XXX,XX @@ static void gem_get_rx_desc(CadenceGEMState *s, int q)
+  */
+ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
+ {
+-    CadenceGEMState *s;
++    CadenceGEMState *s = qemu_get_nic_opaque(nc);
+     unsigned   rxbufsize, bytes_to_copy;
+     unsigned   rxbuf_offset;
+-    uint8_t    rxbuf[2048];
+     uint8_t   *rxbuf_ptr;
+     bool first_desc = true;
+     int maf;
+     int q = 0;
+-    s = qemu_get_nic_opaque(nc);
+-
+     /* Is this destination MAC address "for us" ? */
+     maf = gem_mac_address_filter(s, buf);
+     if (maf == GEM_RX_REJECT) {
+@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
+     } else {
+         unsigned crc_val;
+-        if (size > sizeof(rxbuf) - sizeof(crc_val)) {
+-            size = sizeof(rxbuf) - sizeof(crc_val);
++        if (size > MAX_FRAME_SIZE - sizeof(crc_val)) {
++            size = MAX_FRAME_SIZE - sizeof(crc_val);
+         }
+         bytes_to_copy = size;
+         /* The application wants the FCS field, which QEMU does not provide.
+          * We must try and calculate one.
+          */
+-        memcpy(rxbuf, buf, size);
+-        memset(rxbuf + size, 0, sizeof(rxbuf) - size);
+-        rxbuf_ptr = rxbuf;
+-        crc_val = cpu_to_le32(crc32(0, rxbuf, MAX(size, 60)));
+-        memcpy(rxbuf + size, &crc_val, sizeof(crc_val));
++        memcpy(s->rx_packet, buf, size);
++        memset(s->rx_packet + size, 0, MAX_FRAME_SIZE - size);
++        rxbuf_ptr = s->rx_packet;
++        crc_val = cpu_to_le32(crc32(0, s->rx_packet, MAX(size, 60)));
++        memcpy(s->rx_packet + size, &crc_val, sizeof(crc_val));
+         bytes_to_copy += 4;
+         size += 4;
+@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
+ {
+     uint32_t desc[DESC_MAX_NUM_WORDS];
+     hwaddr packet_desc_addr;
+-    uint8_t     tx_packet[2048];
+     uint8_t     *p;
+     unsigned    total_bytes;
+     int q = 0;
+@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
+      * Packets scattered across multiple descriptors are gathered to this
+      * one contiguous buffer first.
+      */
+-    p = tx_packet;
++    p = s->tx_packet;
+     total_bytes = 0;
+     for (q = s->num_priority_queues - 1; q >= 0; q--) {
+@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
+                 break;
+             }
+-            if (tx_desc_get_length(desc) > sizeof(tx_packet) -
+-                                               (p - tx_packet)) {
++            if (tx_desc_get_length(desc) > MAX_FRAME_SIZE -
++                                               (p - s->tx_packet)) {
+                 DB_PRINT("TX descriptor @ 0x%" HWADDR_PRIx \
+                          " too large: size 0x%x space 0x%zx\n",
+                          packet_desc_addr, tx_desc_get_length(desc),
+-                         sizeof(tx_packet) - (p - tx_packet));
++                         MAX_FRAME_SIZE - (p - s->tx_packet));
+                 break;
+             }
+@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
+                 /* Is checksum offload enabled? */
+                 if (s->regs[GEM_DMACFG] & GEM_DMACFG_TXCSUM_OFFL) {
+-                    net_checksum_calculate(tx_packet, total_bytes);
++                    net_checksum_calculate(s->tx_packet, total_bytes);
+                 }
+                 /* Update MAC statistics */
+-                gem_transmit_updatestats(s, tx_packet, total_bytes);
++                gem_transmit_updatestats(s, s->tx_packet, total_bytes);
+                 /* Send the packet somewhere */
+                 if (s->phy_loop || (s->regs[GEM_NWCTRL] &
+                                     GEM_NWCTRL_LOCALLOOP)) {
+-                    gem_receive(qemu_get_queue(s->nic), tx_packet,
++                    gem_receive(qemu_get_queue(s->nic), s->tx_packet,
+                                 total_bytes);
+                 } else {
+-                    qemu_send_packet(qemu_get_queue(s->nic), tx_packet,
++                    qemu_send_packet(qemu_get_queue(s->nic), s->tx_packet,
+                                      total_bytes);
+                 }
+                 /* Prepare for next packet */
+-                p = tx_packet;
++                p = s->tx_packet;
+                 total_bytes = 0;
+             }
+diff --git a/include/hw/net/cadence_gem.h b/include/hw/net/cadence_gem.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/net/cadence_gem.h
++++ b/include/hw/net/cadence_gem.h
+@@ -XXX,XX +XXX,XX @@
+ #define MAX_TYPE1_SCREENERS             16
+ #define MAX_TYPE2_SCREENERS             16
++#define MAX_FRAME_SIZE 2048
++
+ typedef struct CadenceGEMState {
+     /*< private >*/
+     SysBusDevice parent_obj;
+@@ -XXX,XX +XXX,XX @@ typedef struct CadenceGEMState {
+     uint8_t can_rx_state; /* Debug only */
++    uint8_t tx_packet[MAX_FRAME_SIZE];
++    uint8_t rx_packet[MAX_FRAME_SIZE];
+     uint32_t rx_desc[MAX_PRIORITY_QUEUES][DESC_MAX_NUM_WORDS];
+     bool sar_active[4];
+--
+.5.0

-New patch
+[PULL V2 17/33] net: cadence_gem: Fix up code style
+From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
 Fix the code style for register definitions.
 Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
 Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
  hw/net/cadence_gem.c | 204 ++++++++++++++++++++++++++-------------------------
 file changed, 103 insertions(+), 101 deletions(-)
 diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/net/cadence_gem.c
 +++ b/hw/net/cadence_gem.c
@@ -XXX,XX +XXX,XX @@
      } \
  } while (0)
 -#define GEM_NWCTRL        (0x00000000/4) /* Network Control reg */
 -#define GEM_NWCFG         (0x00000004/4) /* Network Config reg */
 -#define GEM_NWSTATUS      (0x00000008/4) /* Network Status reg */
 -#define GEM_USERIO        (0x0000000C/4) /* User IO reg */
 -#define GEM_DMACFG        (0x00000010/4) /* DMA Control reg */
 -#define GEM_TXSTATUS      (0x00000014/4) /* TX Status reg */
 -#define GEM_RXQBASE       (0x00000018/4) /* RX Q Base address reg */
 -#define GEM_TXQBASE       (0x0000001C/4) /* TX Q Base address reg */
 -#define GEM_RXSTATUS      (0x00000020/4) /* RX Status reg */
 -#define GEM_ISR           (0x00000024/4) /* Interrupt Status reg */
 -#define GEM_IER           (0x00000028/4) /* Interrupt Enable reg */
 -#define GEM_IDR           (0x0000002C/4) /* Interrupt Disable reg */
 -#define GEM_IMR           (0x00000030/4) /* Interrupt Mask reg */
 -#define GEM_PHYMNTNC      (0x00000034/4) /* Phy Maintenance reg */
 -#define GEM_RXPAUSE       (0x00000038/4) /* RX Pause Time reg */
 -#define GEM_TXPAUSE       (0x0000003C/4) /* TX Pause Time reg */
 -#define GEM_TXPARTIALSF   (0x00000040/4) /* TX Partial Store and Forward */
 -#define GEM_RXPARTIALSF   (0x00000044/4) /* RX Partial Store and Forward */
 -#define GEM_HASHLO        (0x00000080/4) /* Hash Low address reg */
 -#define GEM_HASHHI        (0x00000084/4) /* Hash High address reg */
 -#define GEM_SPADDR1LO     (0x00000088/4) /* Specific addr 1 low reg */
 -#define GEM_SPADDR1HI     (0x0000008C/4) /* Specific addr 1 high reg */
 -#define GEM_SPADDR2LO     (0x00000090/4) /* Specific addr 2 low reg */
 -#define GEM_SPADDR2HI     (0x00000094/4) /* Specific addr 2 high reg */
 -#define GEM_SPADDR3LO     (0x00000098/4) /* Specific addr 3 low reg */
 -#define GEM_SPADDR3HI     (0x0000009C/4) /* Specific addr 3 high reg */
 -#define GEM_SPADDR4LO     (0x000000A0/4) /* Specific addr 4 low reg */
 -#define GEM_SPADDR4HI     (0x000000A4/4) /* Specific addr 4 high reg */
 -#define GEM_TIDMATCH1     (0x000000A8/4) /* Type ID1 Match reg */
 -#define GEM_TIDMATCH2     (0x000000AC/4) /* Type ID2 Match reg */
 -#define GEM_TIDMATCH3     (0x000000B0/4) /* Type ID3 Match reg */
 -#define GEM_TIDMATCH4     (0x000000B4/4) /* Type ID4 Match reg */
 -#define GEM_WOLAN         (0x000000B8/4) /* Wake on LAN reg */
 -#define GEM_IPGSTRETCH    (0x000000BC/4) /* IPG Stretch reg */
 -#define GEM_SVLAN         (0x000000C0/4) /* Stacked VLAN reg */
 -#define GEM_MODID         (0x000000FC/4) /* Module ID reg */
 -#define GEM_OCTTXLO       (0x00000100/4) /* Octects transmitted Low reg */
 -#define GEM_OCTTXHI       (0x00000104/4) /* Octects transmitted High reg */
 -#define GEM_TXCNT         (0x00000108/4) /* Error-free Frames transmitted */
 -#define GEM_TXBCNT        (0x0000010C/4) /* Error-free Broadcast Frames */
 -#define GEM_TXMCNT        (0x00000110/4) /* Error-free Multicast Frame */
 -#define GEM_TXPAUSECNT    (0x00000114/4) /* Pause Frames Transmitted */
 -#define GEM_TX64CNT       (0x00000118/4) /* Error-free 64 TX */
 -#define GEM_TX65CNT       (0x0000011C/4) /* Error-free 65-127 TX */
 -#define GEM_TX128CNT      (0x00000120/4) /* Error-free 128-255 TX */
 -#define GEM_TX256CNT      (0x00000124/4) /* Error-free 256-511 */
 -#define GEM_TX512CNT      (0x00000128/4) /* Error-free 512-1023 TX */
 -#define GEM_TX1024CNT     (0x0000012C/4) /* Error-free 1024-1518 TX */
 -#define GEM_TX1519CNT     (0x00000130/4) /* Error-free larger than 1519 TX */
 -#define GEM_TXURUNCNT     (0x00000134/4) /* TX under run error counter */
 -#define GEM_SINGLECOLLCNT (0x00000138/4) /* Single Collision Frames */
 -#define GEM_MULTCOLLCNT   (0x0000013C/4) /* Multiple Collision Frames */
 -#define GEM_EXCESSCOLLCNT (0x00000140/4) /* Excessive Collision Frames */
 -#define GEM_LATECOLLCNT   (0x00000144/4) /* Late Collision Frames */
 -#define GEM_DEFERTXCNT    (0x00000148/4) /* Deferred Transmission Frames */
 -#define GEM_CSENSECNT     (0x0000014C/4) /* Carrier Sense Error Counter */
 -#define GEM_OCTRXLO       (0x00000150/4) /* Octects Received register Low */
 -#define GEM_OCTRXHI       (0x00000154/4) /* Octects Received register High */
 -#define GEM_RXCNT         (0x00000158/4) /* Error-free Frames Received */
 -#define GEM_RXBROADCNT    (0x0000015C/4) /* Error-free Broadcast Frames RX */
 -#define GEM_RXMULTICNT    (0x00000160/4) /* Error-free Multicast Frames RX */
 -#define GEM_RXPAUSECNT    (0x00000164/4) /* Pause Frames Received Counter */
 -#define GEM_RX64CNT       (0x00000168/4) /* Error-free 64 byte Frames RX */
 -#define GEM_RX65CNT       (0x0000016C/4) /* Error-free 65-127B Frames RX */
 -#define GEM_RX128CNT      (0x00000170/4) /* Error-free 128-255B Frames RX */
 -#define GEM_RX256CNT      (0x00000174/4) /* Error-free 256-512B Frames RX */
 -#define GEM_RX512CNT      (0x00000178/4) /* Error-free 512-1023B Frames RX */
 -#define GEM_RX1024CNT     (0x0000017C/4) /* Error-free 1024-1518B Frames RX */
 -#define GEM_RX1519CNT     (0x00000180/4) /* Error-free 1519-max Frames RX */
 -#define GEM_RXUNDERCNT    (0x00000184/4) /* Undersize Frames Received */
 -#define GEM_RXOVERCNT     (0x00000188/4) /* Oversize Frames Received */
 -#define GEM_RXJABCNT      (0x0000018C/4) /* Jabbers Received Counter */
 -#define GEM_RXFCSCNT      (0x00000190/4) /* Frame Check seq. Error Counter */
 -#define GEM_RXLENERRCNT   (0x00000194/4) /* Length Field Error Counter */
 -#define GEM_RXSYMERRCNT   (0x00000198/4) /* Symbol Error Counter */
 -#define GEM_RXALIGNERRCNT (0x0000019C/4) /* Alignment Error Counter */
 -#define GEM_RXRSCERRCNT   (0x000001A0/4) /* Receive Resource Error Counter */
 -#define GEM_RXORUNCNT     (0x000001A4/4) /* Receive Overrun Counter */
 -#define GEM_RXIPCSERRCNT  (0x000001A8/4) /* IP header Checksum Error Counter */
 -#define GEM_RXTCPCCNT     (0x000001AC/4) /* TCP Checksum Error Counter */
 -#define GEM_RXUDPCCNT     (0x000001B0/4) /* UDP Checksum Error Counter */
 -
 -#define GEM_1588S         (0x000001D0/4) /* 1588 Timer Seconds */
 -#define GEM_1588NS        (0x000001D4/4) /* 1588 Timer Nanoseconds */
 -#define GEM_1588ADJ       (0x000001D8/4) /* 1588 Timer Adjust */
 -#define GEM_1588INC       (0x000001DC/4) /* 1588 Timer Increment */
 -#define GEM_PTPETXS       (0x000001E0/4) /* PTP Event Frame Transmitted (s) */
 -#define GEM_PTPETXNS      (0x000001E4/4) /* PTP Event Frame Transmitted (ns) */
 -#define GEM_PTPERXS       (0x000001E8/4) /* PTP Event Frame Received (s) */
 -#define GEM_PTPERXNS      (0x000001EC/4) /* PTP Event Frame Received (ns) */
 -#define GEM_PTPPTXS       (0x000001E0/4) /* PTP Peer Frame Transmitted (s) */
 -#define GEM_PTPPTXNS      (0x000001E4/4) /* PTP Peer Frame Transmitted (ns) */
 -#define GEM_PTPPRXS       (0x000001E8/4) /* PTP Peer Frame Received (s) */
 -#define GEM_PTPPRXNS      (0x000001EC/4) /* PTP Peer Frame Received (ns) */
 +#define GEM_NWCTRL        (0x00000000 / 4) /* Network Control reg */
 +#define GEM_NWCFG         (0x00000004 / 4) /* Network Config reg */
 +#define GEM_NWSTATUS      (0x00000008 / 4) /* Network Status reg */
 +#define GEM_USERIO        (0x0000000C / 4) /* User IO reg */
 +#define GEM_DMACFG        (0x00000010 / 4) /* DMA Control reg */
 +#define GEM_TXSTATUS      (0x00000014 / 4) /* TX Status reg */
 +#define GEM_RXQBASE       (0x00000018 / 4) /* RX Q Base address reg */
 +#define GEM_TXQBASE       (0x0000001C / 4) /* TX Q Base address reg */
 +#define GEM_RXSTATUS      (0x00000020 / 4) /* RX Status reg */
 +#define GEM_ISR           (0x00000024 / 4) /* Interrupt Status reg */
 +#define GEM_IER           (0x00000028 / 4) /* Interrupt Enable reg */
 +#define GEM_IDR           (0x0000002C / 4) /* Interrupt Disable reg */
 +#define GEM_IMR           (0x00000030 / 4) /* Interrupt Mask reg */
 +#define GEM_PHYMNTNC      (0x00000034 / 4) /* Phy Maintenance reg */
 +#define GEM_RXPAUSE       (0x00000038 / 4) /* RX Pause Time reg */
 +#define GEM_TXPAUSE       (0x0000003C / 4) /* TX Pause Time reg */
 +#define GEM_TXPARTIALSF   (0x00000040 / 4) /* TX Partial Store and Forward */
 +#define GEM_RXPARTIALSF   (0x00000044 / 4) /* RX Partial Store and Forward */
 +#define GEM_HASHLO        (0x00000080 / 4) /* Hash Low address reg */
 +#define GEM_HASHHI        (0x00000084 / 4) /* Hash High address reg */
 +#define GEM_SPADDR1LO     (0x00000088 / 4) /* Specific addr 1 low reg */
 +#define GEM_SPADDR1HI     (0x0000008C / 4) /* Specific addr 1 high reg */
 +#define GEM_SPADDR2LO     (0x00000090 / 4) /* Specific addr 2 low reg */
 +#define GEM_SPADDR2HI     (0x00000094 / 4) /* Specific addr 2 high reg */
 +#define GEM_SPADDR3LO     (0x00000098 / 4) /* Specific addr 3 low reg */
 +#define GEM_SPADDR3HI     (0x0000009C / 4) /* Specific addr 3 high reg */
 +#define GEM_SPADDR4LO     (0x000000A0 / 4) /* Specific addr 4 low reg */
 +#define GEM_SPADDR4HI     (0x000000A4 / 4) /* Specific addr 4 high reg */
 +#define GEM_TIDMATCH1     (0x000000A8 / 4) /* Type ID1 Match reg */
 +#define GEM_TIDMATCH2     (0x000000AC / 4) /* Type ID2 Match reg */
 +#define GEM_TIDMATCH3     (0x000000B0 / 4) /* Type ID3 Match reg */
 +#define GEM_TIDMATCH4     (0x000000B4 / 4) /* Type ID4 Match reg */
 +#define GEM_WOLAN         (0x000000B8 / 4) /* Wake on LAN reg */
 +#define GEM_IPGSTRETCH    (0x000000BC / 4) /* IPG Stretch reg */
 +#define GEM_SVLAN         (0x000000C0 / 4) /* Stacked VLAN reg */
 +#define GEM_MODID         (0x000000FC / 4) /* Module ID reg */
 +#define GEM_OCTTXLO       (0x00000100 / 4) /* Octects transmitted Low reg */
 +#define GEM_OCTTXHI       (0x00000104 / 4) /* Octects transmitted High reg */
 +#define GEM_TXCNT         (0x00000108 / 4) /* Error-free Frames transmitted */
 +#define GEM_TXBCNT        (0x0000010C / 4) /* Error-free Broadcast Frames */
 +#define GEM_TXMCNT        (0x00000110 / 4) /* Error-free Multicast Frame */
 +#define GEM_TXPAUSECNT    (0x00000114 / 4) /* Pause Frames Transmitted */
 +#define GEM_TX64CNT       (0x00000118 / 4) /* Error-free 64 TX */
 +#define GEM_TX65CNT       (0x0000011C / 4) /* Error-free 65-127 TX */
 +#define GEM_TX128CNT      (0x00000120 / 4) /* Error-free 128-255 TX */
 +#define GEM_TX256CNT      (0x00000124 / 4) /* Error-free 256-511 */
 +#define GEM_TX512CNT      (0x00000128 / 4) /* Error-free 512-1023 TX */
 +#define GEM_TX1024CNT     (0x0000012C / 4) /* Error-free 1024-1518 TX */
 +#define GEM_TX1519CNT     (0x00000130 / 4) /* Error-free larger than 1519 TX */
 +#define GEM_TXURUNCNT     (0x00000134 / 4) /* TX under run error counter */
 +#define GEM_SINGLECOLLCNT (0x00000138 / 4) /* Single Collision Frames */
 +#define GEM_MULTCOLLCNT   (0x0000013C / 4) /* Multiple Collision Frames */
 +#define GEM_EXCESSCOLLCNT (0x00000140 / 4) /* Excessive Collision Frames */
 +#define GEM_LATECOLLCNT   (0x00000144 / 4) /* Late Collision Frames */
 +#define GEM_DEFERTXCNT    (0x00000148 / 4) /* Deferred Transmission Frames */
 +#define GEM_CSENSECNT     (0x0000014C / 4) /* Carrier Sense Error Counter */
 +#define GEM_OCTRXLO       (0x00000150 / 4) /* Octects Received register Low */
 +#define GEM_OCTRXHI       (0x00000154 / 4) /* Octects Received register High */
 +#define GEM_RXCNT         (0x00000158 / 4) /* Error-free Frames Received */
 +#define GEM_RXBROADCNT    (0x0000015C / 4) /* Error-free Broadcast Frames RX */
 +#define GEM_RXMULTICNT    (0x00000160 / 4) /* Error-free Multicast Frames RX */
 +#define GEM_RXPAUSECNT    (0x00000164 / 4) /* Pause Frames Received Counter */
 +#define GEM_RX64CNT       (0x00000168 / 4) /* Error-free 64 byte Frames RX */
 +#define GEM_RX65CNT       (0x0000016C / 4) /* Error-free 65-127B Frames RX */
 +#define GEM_RX128CNT      (0x00000170 / 4) /* Error-free 128-255B Frames RX */
 +#define GEM_RX256CNT      (0x00000174 / 4) /* Error-free 256-512B Frames RX */
 +#define GEM_RX512CNT      (0x00000178 / 4) /* Error-free 512-1023B Frames RX */
 +#define GEM_RX1024CNT     (0x0000017C / 4) /* Error-free 1024-1518B Frames RX */
 +#define GEM_RX1519CNT     (0x00000180 / 4) /* Error-free 1519-max Frames RX */
 +#define GEM_RXUNDERCNT    (0x00000184 / 4) /* Undersize Frames Received */
 +#define GEM_RXOVERCNT     (0x00000188 / 4) /* Oversize Frames Received */
 +#define GEM_RXJABCNT      (0x0000018C / 4) /* Jabbers Received Counter */
 +#define GEM_RXFCSCNT      (0x00000190 / 4) /* Frame Check seq. Error Counter */
 +#define GEM_RXLENERRCNT   (0x00000194 / 4) /* Length Field Error Counter */
 +#define GEM_RXSYMERRCNT   (0x00000198 / 4) /* Symbol Error Counter */
 +#define GEM_RXALIGNERRCNT (0x0000019C / 4) /* Alignment Error Counter */
 +#define GEM_RXRSCERRCNT   (0x000001A0 / 4) /* Receive Resource Error Counter */
 +#define GEM_RXORUNCNT     (0x000001A4 / 4) /* Receive Overrun Counter */
 +#define GEM_RXIPCSERRCNT  (0x000001A8 / 4) /* IP header Checksum Err Counter */
 +#define GEM_RXTCPCCNT     (0x000001AC / 4) /* TCP Checksum Error Counter */
 +#define GEM_RXUDPCCNT     (0x000001B0 / 4) /* UDP Checksum Error Counter */
 +
 +#define GEM_1588S         (0x000001D0 / 4) /* 1588 Timer Seconds */
 +#define GEM_1588NS        (0x000001D4 / 4) /* 1588 Timer Nanoseconds */
 +#define GEM_1588ADJ       (0x000001D8 / 4) /* 1588 Timer Adjust */
 +#define GEM_1588INC       (0x000001DC / 4) /* 1588 Timer Increment */
 +#define GEM_PTPETXS       (0x000001E0 / 4) /* PTP Event Frame Transmitted (s) */
 +#define GEM_PTPETXNS      (0x000001E4 / 4) /*
 +                                            * PTP Event Frame Transmitted (ns)
 +                                            */
 +#define GEM_PTPERXS       (0x000001E8 / 4) /* PTP Event Frame Received (s) */
 +#define GEM_PTPERXNS      (0x000001EC / 4) /* PTP Event Frame Received (ns) */
 +#define GEM_PTPPTXS       (0x000001E0 / 4) /* PTP Peer Frame Transmitted (s) */
 +#define GEM_PTPPTXNS      (0x000001E4 / 4) /* PTP Peer Frame Transmitted (ns) */
 +#define GEM_PTPPRXS       (0x000001E8 / 4) /* PTP Peer Frame Received (s) */
 +#define GEM_PTPPRXNS      (0x000001EC / 4) /* PTP Peer Frame Received (ns) */
  /* Design Configuration Registers */
 -#define GEM_DESCONF       (0x00000280/4)
 -#define GEM_DESCONF2      (0x00000284/4)
 -#define GEM_DESCONF3      (0x00000288/4)
 -#define GEM_DESCONF4      (0x0000028C/4)
 -#define GEM_DESCONF5      (0x00000290/4)
 -#define GEM_DESCONF6      (0x00000294/4)
 +#define GEM_DESCONF       (0x00000280 / 4)
 +#define GEM_DESCONF2      (0x00000284 / 4)
 +#define GEM_DESCONF3      (0x00000288 / 4)
 +#define GEM_DESCONF4      (0x0000028C / 4)
 +#define GEM_DESCONF5      (0x00000290 / 4)
 +#define GEM_DESCONF6      (0x00000294 / 4)
  #define GEM_DESCONF6_64B_MASK (1U << 23)
 -#define GEM_DESCONF7      (0x00000298/4)
 +#define GEM_DESCONF7      (0x00000298 / 4)
  #define GEM_INT_Q1_STATUS               (0x00000400 / 4)
  #define GEM_INT_Q1_MASK                 (0x00000640 / 4)
 --
 .5.0

-[Qemu-devel] [PULL 11/14] net/filter-rewriter.c: Make filter-rewriter support vnet_hdr_len
+[PULL V2 18/33] net: cadence_gem: Add support for jumbo frames
-From: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
+From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
-We add the vnet_hdr_support option for filter-rewriter, default is disabled.
+Add a property "jumbo-max-len", which sets default value of jumbo frames
-If you use virtio-net-pci or other driver needs vnet_hdr, please enable it.
+up to 16,383 bytes. Add Frame length checks for standard and jumbo
-You can use it for example:
+frames.
 -object filter-rewriter,id=rew0,netdev=hn0,queue=all,vnet_hdr_support
-We get the vnet_hdr_len from NetClientState that make us
+Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
-parse net packet correctly.
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 Signed-off-by: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- net/filter-rewriter.c | 37 ++++++++++++++++++++++++++++++++++++-
+ hw/net/cadence_gem.c         | 51 +++++++++++++++++++++++++++++++++++++++-----
- qemu-options.hx       |  4 ++--
+ include/hw/net/cadence_gem.h |  4 +++-
-files changed, 38 insertions(+), 3 deletions(-)
+files changed, 49 insertions(+), 6 deletions(-)
-diff --git a/net/filter-rewriter.c b/net/filter-rewriter.c
+diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
 index XXXXXXX..XXXXXXX 100644
---- a/net/filter-rewriter.c
+--- a/hw/net/cadence_gem.c
-+++ b/net/filter-rewriter.c
++++ b/hw/net/cadence_gem.c
 @@ -XXX,XX +XXX,XX @@
- #include "qemu-common.h"
+ #define GEM_TXPAUSE       (0x0000003C / 4) /* TX Pause Time reg */
- #include "qapi/error.h"
+ #define GEM_TXPARTIALSF   (0x00000040 / 4) /* TX Partial Store and Forward */
- #include "qapi/qmp/qerror.h"
+ #define GEM_RXPARTIALSF   (0x00000044 / 4) /* RX Partial Store and Forward */
-+#include "qemu/error-report.h"
++#define GEM_JUMBO_MAX_LEN (0x00000048 / 4) /* Max Jumbo Frame Size */
- #include "qapi-visit.h"
+ #define GEM_HASHLO        (0x00000080 / 4) /* Hash Low address reg */
- #include "qom/object.h"
+ #define GEM_HASHHI        (0x00000084 / 4) /* Hash High address reg */
- #include "qemu/main-loop.h"
+ #define GEM_SPADDR1LO     (0x00000088 / 4) /* Specific addr 1 low reg */
-@@ -XXX,XX +XXX,XX @@ typedef struct RewriterState {
+@@ -XXX,XX +XXX,XX @@
-     NetQueue *incoming_queue;
+ #define GEM_NWCFG_LERR_DISC    0x00010000 /* Discard RX frames with len err */
-     /* hashtable to save connection */
+ #define GEM_NWCFG_BUFF_OFST_M  0x0000C000 /* Receive buffer offset mask */
-     GHashTable *connection_track_table;
+ #define GEM_NWCFG_BUFF_OFST_S  14         /* Receive buffer offset shift */
-+    bool vnet_hdr;
++#define GEM_NWCFG_RCV_1538     0x00000100 /* Receive 1538 bytes frame */
- } RewriterState;
+ #define GEM_NWCFG_UCAST_HASH   0x00000080 /* accept unicast if hash match */
+ #define GEM_NWCFG_MCAST_HASH   0x00000040 /* accept multicast if hash match */
- static void filter_rewriter_flush(NetFilterState *nf)
+ #define GEM_NWCFG_BCAST_REJ    0x00000020 /* Reject broadcast packets */
-@@ -XXX,XX +XXX,XX @@ static ssize_t colo_rewriter_receive_iov(NetFilterState *nf,
+ #define GEM_NWCFG_PROMISC      0x00000010 /* Accept all packets */
-     ConnectionKey key;
++#define GEM_NWCFG_JUMBO_FRAME  0x00000008 /* Jumbo Frames enable */
-     Packet *pkt;
-     ssize_t size = iov_size(iov, iovcnt);
+ #define GEM_DMACFG_ADDR_64B    (1U << 30)
-+    ssize_t vnet_hdr_len = 0;
+ #define GEM_DMACFG_TX_BD_EXT   (1U << 29)
-     char *buf = g_malloc0(size);
+@@ -XXX,XX +XXX,XX @@
-     iov_to_buf(iov, iovcnt, 0, buf, size);
+ /* GEM_ISR GEM_IER GEM_IDR GEM_IMR */
--    pkt = packet_new(buf, size, 0);
+ #define GEM_INT_TXCMPL        0x00000080 /* Transmit Complete */
 +#define GEM_INT_AMBA_ERR      0x00000040
  #define GEM_INT_TXUSED         0x00000008
  #define GEM_INT_RXUSED         0x00000004
  #define GEM_INT_RXCMPL        0x00000002
@@ -XXX,XX +XXX,XX @@ static inline void rx_desc_set_sar(uint32_t *desc, int sar_idx)
  /* The broadcast MAC address: 0xFFFFFFFFFFFF */
  static const uint8_t broadcast_addr[] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
 +static uint32_t gem_get_max_buf_len(CadenceGEMState *s, bool tx)
 +{
 +    uint32_t size;
 +    if (s->regs[GEM_NWCFG] & GEM_NWCFG_JUMBO_FRAME) {
 +        size = s->regs[GEM_JUMBO_MAX_LEN];
 +        if (size > s->jumbo_max_len) {
 +            size = s->jumbo_max_len;
 +            qemu_log_mask(LOG_GUEST_ERROR, "GEM_JUMBO_MAX_LEN reg cannot be"
 +                " greater than 0x%" PRIx32 "\n", s->jumbo_max_len);
 +        }
 +    } else if (tx) {
 +        size = 1518;
 +    } else {
 +        size = s->regs[GEM_NWCFG] & GEM_NWCFG_RCV_1538 ? 1538 : 1518;
 +    }
 +    return size;
 +}
 +
-+    if (s->vnet_hdr) {
+ static void gem_set_isr(CadenceGEMState *s, int q, uint32_t flag)
-+        vnet_hdr_len = nf->netdev->vnet_hdr_len;
+ {
      if (q == 0) {
@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
      /* Find which queue we are targeting */
      q = get_queue_from_screen(s, rxbuf_ptr, rxbufsize);
 +    if (size > gem_get_max_buf_len(s, false)) {
 +        qemu_log_mask(LOG_GUEST_ERROR, "rx frame too long\n");
 +        gem_set_isr(s, q, GEM_INT_AMBA_ERR);
 +        return -1;
 +    }
 +
-+    pkt = packet_new(buf, size, vnet_hdr_len);
+     while (bytes_to_copy) {
-     g_free(buf);
+         hwaddr desc_addr;
-     /*
+@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
-@@ -XXX,XX +XXX,XX @@ static void colo_rewriter_setup(NetFilterState *nf, Error **errp)
+                 break;
-     s->incoming_queue = qemu_new_net_queue(qemu_netfilter_pass_to_next, nf);
+             }
 -            if (tx_desc_get_length(desc) > MAX_FRAME_SIZE -
 +            if (tx_desc_get_length(desc) > gem_get_max_buf_len(s, true) -
                                                 (p - s->tx_packet)) {
 -                DB_PRINT("TX descriptor @ 0x%" HWADDR_PRIx \
 -                         " too large: size 0x%x space 0x%zx\n",
 +                qemu_log_mask(LOG_GUEST_ERROR, "TX descriptor @ 0x%" \
 +                         HWADDR_PRIx " too large: size 0x%x space 0x%zx\n",
                           packet_desc_addr, tx_desc_get_length(desc),
 -                         MAX_FRAME_SIZE - (p - s->tx_packet));
 +                         gem_get_max_buf_len(s, true) - (p - s->tx_packet));
 +                gem_set_isr(s, q, GEM_INT_AMBA_ERR);
                  break;
              }
@@ -XXX,XX +XXX,XX @@ static void gem_reset(DeviceState *d)
      s->regs[GEM_RXPARTIALSF] = 0x000003ff;
      s->regs[GEM_MODID] = s->revision;
      s->regs[GEM_DESCONF] = 0x02500111;
 -    s->regs[GEM_DESCONF2] = 0x2ab13fff;
 +    s->regs[GEM_DESCONF2] = 0x2ab10000 | s->jumbo_max_len;
      s->regs[GEM_DESCONF5] = 0x002f2045;
      s->regs[GEM_DESCONF6] = GEM_DESCONF6_64B_MASK;
 +    s->regs[GEM_JUMBO_MAX_LEN] = s->jumbo_max_len;
      if (s->num_priority_queues > 1) {
          queues_mask = MAKE_64BIT_MASK(1, s->num_priority_queues - 1);
@@ -XXX,XX +XXX,XX @@ static void gem_write(void *opaque, hwaddr offset, uint64_t val,
          s->regs[GEM_IMR] &= ~val;
          gem_update_int_status(s);
          break;
 +    case GEM_JUMBO_MAX_LEN:
 +        s->regs[GEM_JUMBO_MAX_LEN] = val & MAX_JUMBO_FRAME_SIZE_MASK;
 +        break;
      case GEM_INT_Q1_ENABLE ... GEM_INT_Q7_ENABLE:
          s->regs[GEM_INT_Q1_MASK + offset - GEM_INT_Q1_ENABLE] &= ~val;
          gem_update_int_status(s);
@@ -XXX,XX +XXX,XX @@ static void gem_realize(DeviceState *dev, Error **errp)
      s->nic = qemu_new_nic(&net_gem_info, &s->conf,
                            object_get_typename(OBJECT(dev)), dev->id, s);
 +
 +    if (s->jumbo_max_len > MAX_FRAME_SIZE) {
 +        error_setg(errp, "jumbo-max-len is greater than %d",
 +                  MAX_FRAME_SIZE);
 +        return;
 +    }
  }
-+static bool filter_rewriter_get_vnet_hdr(Object *obj, Error **errp)
+ static void gem_init(Object *obj)
-+{
+@@ -XXX,XX +XXX,XX @@ static Property gem_properties[] = {
-+    RewriterState *s = FILTER_COLO_REWRITER(obj);
+                       num_type1_screeners, 4),
-+
+     DEFINE_PROP_UINT8("num-type2-screeners", CadenceGEMState,
-+    return s->vnet_hdr;
+                       num_type2_screeners, 4),
-+}
++    DEFINE_PROP_UINT16("jumbo-max-len", CadenceGEMState,
-+
++                       jumbo_max_len, 10240),
-+static void filter_rewriter_set_vnet_hdr(Object *obj,
+     DEFINE_PROP_END_OF_LIST(),
 +                                         bool value,
 +                                         Error **errp)
 +{
 +    RewriterState *s = FILTER_COLO_REWRITER(obj);
 +
 +    s->vnet_hdr = value;
 +}
 +
 +static void filter_rewriter_init(Object *obj)
 +{
 +    RewriterState *s = FILTER_COLO_REWRITER(obj);
 +
 +    s->vnet_hdr = false;
 +    object_property_add_bool(obj, "vnet_hdr_support",
 +                             filter_rewriter_get_vnet_hdr,
 +                             filter_rewriter_set_vnet_hdr, NULL);
 +}
 +
  static void colo_rewriter_class_init(ObjectClass *oc, void *data)
  {
      NetFilterClass *nfc = NETFILTER_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static const TypeInfo colo_rewriter_info = {
      .name = TYPE_FILTER_REWRITER,
      .parent = TYPE_NETFILTER,
      .class_init = colo_rewriter_class_init,
 +    .instance_init = filter_rewriter_init,
      .instance_size = sizeof(RewriterState),
  };
-diff --git a/qemu-options.hx b/qemu-options.hx
+diff --git a/include/hw/net/cadence_gem.h b/include/hw/net/cadence_gem.h
 index XXXXXXX..XXXXXXX 100644
---- a/qemu-options.hx
+--- a/include/hw/net/cadence_gem.h
-+++ b/qemu-options.hx
++++ b/include/hw/net/cadence_gem.h
-@@ -XXX,XX +XXX,XX @@ Create a filter-redirector we need to differ outdev id from indev id, id can not
+@@ -XXX,XX +XXX,XX @@
- be the same. we can just use indev or outdev, but at least one of indev or outdev
+ #define MAX_TYPE1_SCREENERS             16
- need to be specified.
+ #define MAX_TYPE2_SCREENERS             16
--@item -object filter-rewriter,id=@var{id},netdev=@var{netdevid}[,queue=@var{all|rx|tx}]
+-#define MAX_FRAME_SIZE 2048
-+@item -object filter-rewriter,id=@var{id},netdev=@var{netdevid},queue=@var{all|rx|tx},[vnet_hdr_support]
++#define MAX_JUMBO_FRAME_SIZE_MASK 0x3FFF
++#define MAX_FRAME_SIZE MAX_JUMBO_FRAME_SIZE_MASK
- Filter-rewriter is a part of COLO project.It will rewrite tcp packet to
- secondary from primary to keep secondary tcp connection,and rewrite
+ typedef struct CadenceGEMState {
- tcp packet to primary from secondary make tcp packet can be handled by
+     /*< private >*/
--client.
+@@ -XXX,XX +XXX,XX @@ typedef struct CadenceGEMState {
-+client.if it has the vnet_hdr_support flag, we can parse packet with vnet header.
+     uint8_t num_type1_screeners;
+     uint8_t num_type2_screeners;
- usage:
+     uint32_t revision;
- colo secondary:
++    uint16_t jumbo_max_len;
      /* GEM registers backing store */
      uint32_t regs[CADENCE_GEM_MAXREG];
 --
-.7.4
+.5.0

-New patch
+[PULL V2 19/33] net: cadnece_gem: Update irq_read_clear field of designcfg_debug1 reg
+From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+Advertise support of clear-on-read for ISR registers.
+Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ hw/net/cadence_gem.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/cadence_gem.c
++++ b/hw/net/cadence_gem.c
+@@ -XXX,XX +XXX,XX @@ static void gem_reset(DeviceState *d)
+     s->regs[GEM_TXPARTIALSF] = 0x000003ff;
+     s->regs[GEM_RXPARTIALSF] = 0x000003ff;
+     s->regs[GEM_MODID] = s->revision;
+-    s->regs[GEM_DESCONF] = 0x02500111;
++    s->regs[GEM_DESCONF] = 0x02D00111;
+     s->regs[GEM_DESCONF2] = 0x2ab10000 | s->jumbo_max_len;
+     s->regs[GEM_DESCONF5] = 0x002f2045;
+     s->regs[GEM_DESCONF6] = GEM_DESCONF6_64B_MASK;
+--
+.5.0

-New patch
+[PULL V2 20/33] net: cadence_gem: Update the reset value for interrupt mask register
+From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+Mask all interrupt on reset.
+Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ hw/net/cadence_gem.c | 1 +
+file changed, 1 insertion(+)
+diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/cadence_gem.c
++++ b/hw/net/cadence_gem.c
+@@ -XXX,XX +XXX,XX @@ static void gem_reset(DeviceState *d)
+     s->regs[GEM_DESCONF2] = 0x2ab10000 | s->jumbo_max_len;
+     s->regs[GEM_DESCONF5] = 0x002f2045;
+     s->regs[GEM_DESCONF6] = GEM_DESCONF6_64B_MASK;
++    s->regs[GEM_INT_Q1_MASK] = 0x00000CE6;
+     s->regs[GEM_JUMBO_MAX_LEN] = s->jumbo_max_len;
+     if (s->num_priority_queues > 1) {
+--
+.5.0

-New patch
+[PULL V2 21/33] net: cadence_gem: TX_LAST bit should be set by guest
+From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+TX_LAST bit should not be set by hardware, its set by guest to inform
+the last bd of the frame.
+Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ hw/net/cadence_gem.c | 6 ------
+file changed, 6 deletions(-)
+diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/cadence_gem.c
++++ b/hw/net/cadence_gem.c
+@@ -XXX,XX +XXX,XX @@ static inline unsigned tx_desc_get_last(uint32_t *desc)
+     return (desc[1] & DESC_1_TX_LAST) ? 1 : 0;
+ }
+-static inline void tx_desc_set_last(uint32_t *desc)
+-{
+-    desc[1] |= DESC_1_TX_LAST;
+-}
+-
+ static inline unsigned tx_desc_get_length(uint32_t *desc)
+ {
+     return desc[1] & DESC_1_LENGTH;
+@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
+             /* read next descriptor */
+             if (tx_desc_get_wrap(desc)) {
+-                tx_desc_set_last(desc);
+                 if (s->regs[GEM_DMACFG] & GEM_DMACFG_ADDR_64B) {
+                     packet_desc_addr = s->regs[GEM_TBQPH];
+--
+.5.0

-[Qemu-devel] [PULL 03/14] net/filter-mirror.c: Introduce parameter for filter_send()
+[PULL V2 22/33] net: cadence_gem: Fix RX address filtering
-From: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
+From: Tong Ho <tong.ho@xilinx.com>
-This patch change the filter_send() parameter from CharBackend to MirrorState,
+Two defects are fixed:
 we can get more information like vnet_hdr(We use it to support packet with vnet_header).
-Signed-off-by: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
+/ Detection of multicast frames
 / Treating drop of mis-addressed frames as non-error
 Signed-off-by: Tong Ho <tong.ho@xilinx.com>
 Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
 Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- net/filter-mirror.c | 10 +++++-----
+ hw/net/cadence_gem.c | 26 +++++++++++---------------
-file changed, 5 insertions(+), 5 deletions(-)
+file changed, 11 insertions(+), 15 deletions(-)
-diff --git a/net/filter-mirror.c b/net/filter-mirror.c
+diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
 index XXXXXXX..XXXXXXX 100644
---- a/net/filter-mirror.c
+--- a/hw/net/cadence_gem.c
-+++ b/net/filter-mirror.c
++++ b/hw/net/cadence_gem.c
-@@ -XXX,XX +XXX,XX @@ typedef struct MirrorState {
+@@ -XXX,XX +XXX,XX @@
-     SocketReadState rs;
+ #include "qemu/module.h"
- } MirrorState;
+ #include "sysemu/dma.h"
+ #include "net/checksum.h"
--static int filter_send(CharBackend *chr_out,
++#include "net/eth.h"
-+static int filter_send(MirrorState *s,
-                        const struct iovec *iov,
+ #define CADENCE_GEM_ERR_DEBUG 0
-                        int iovcnt)
+ #define DB_PRINT(...) do {\
@@ -XXX,XX +XXX,XX @@ static unsigned calc_mac_hash(const uint8_t *mac)
  static int gem_mac_address_filter(CadenceGEMState *s, const uint8_t *packet)
  {
-@@ -XXX,XX +XXX,XX @@ static int filter_send(CharBackend *chr_out,
+     uint8_t *gem_spaddr;
 -    int i;
 +    int i, is_mc;
      /* Promiscuous mode? */
      if (s->regs[GEM_NWCFG] & GEM_NWCFG_PROMISC) {
@@ -XXX,XX +XXX,XX @@ static int gem_mac_address_filter(CadenceGEMState *s, const uint8_t *packet)
      }
-     len = htonl(size);
+     /* Accept packets -w- hash match? */
--    ret = qemu_chr_fe_write_all(chr_out, (uint8_t *)&len, sizeof(len));
+-    if ((packet[0] == 0x01 && (s->regs[GEM_NWCFG] & GEM_NWCFG_MCAST_HASH)) ||
-+    ret = qemu_chr_fe_write_all(&s->chr_out, (uint8_t *)&len, sizeof(len));
+-        (packet[0] != 0x01 && (s->regs[GEM_NWCFG] & GEM_NWCFG_UCAST_HASH))) {
-     if (ret != sizeof(len)) {
++    is_mc = is_multicast_ether_addr(packet);
-         goto err;
++    if ((is_mc && (s->regs[GEM_NWCFG] & GEM_NWCFG_MCAST_HASH)) ||
 +        (!is_mc && (s->regs[GEM_NWCFG] & GEM_NWCFG_UCAST_HASH))) {
 +        uint64_t buckets;
          unsigned hash_index;
          hash_index = calc_mac_hash(packet);
 -        if (hash_index < 32) {
 -            if (s->regs[GEM_HASHLO] & (1<<hash_index)) {
 -                return packet[0] == 0x01 ? GEM_RX_MULTICAST_HASH_ACCEPT :
 -                                           GEM_RX_UNICAST_HASH_ACCEPT;
 -            }
 -        } else {
 -            hash_index -= 32;
 -            if (s->regs[GEM_HASHHI] & (1<<hash_index)) {
 -                return packet[0] == 0x01 ? GEM_RX_MULTICAST_HASH_ACCEPT :
 -                                           GEM_RX_UNICAST_HASH_ACCEPT;
 -            }
 +        buckets = ((uint64_t)s->regs[GEM_HASHHI] << 32) | s->regs[GEM_HASHLO];
 +        if ((buckets >> hash_index) & 1) {
 +            return is_mc ? GEM_RX_MULTICAST_HASH_ACCEPT
 +                         : GEM_RX_UNICAST_HASH_ACCEPT;
          }
      }
-     buf = g_malloc(size);
+@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
-     iov_to_buf(iov, iovcnt, 0, buf, size);
+     /* Is this destination MAC address "for us" ? */
--    ret = qemu_chr_fe_write_all(chr_out, (uint8_t *)buf, size);
+     maf = gem_mac_address_filter(s, buf);
-+    ret = qemu_chr_fe_write_all(&s->chr_out, (uint8_t *)buf, size);
+     if (maf == GEM_RX_REJECT) {
-     g_free(buf);
+-        return -1;
-     if (ret != size) {
++        return size;  /* no, drop siliently b/c it's not an error */
          goto err;
@@ -XXX,XX +XXX,XX @@ static ssize_t filter_mirror_receive_iov(NetFilterState *nf,
      MirrorState *s = FILTER_MIRROR(nf);
      int ret;
 -    ret = filter_send(&s->chr_out, iov, iovcnt);
 +    ret = filter_send(s, iov, iovcnt);
      if (ret) {
          error_report("filter mirror send failed(%s)", strerror(-ret));
      }
-@@ -XXX,XX +XXX,XX @@ static ssize_t filter_redirector_receive_iov(NetFilterState *nf,
-     int ret;
+     /* Discard packets with receive length error enabled ? */
      if (qemu_chr_fe_backend_connected(&s->chr_out)) {
 -        ret = filter_send(&s->chr_out, iov, iovcnt);
 +        ret = filter_send(s, iov, iovcnt);
          if (ret) {
              error_report("filter redirector send failed(%s)", strerror(-ret));
          }
 --
-.7.4
+.5.0

-New patch
+[PULL V2 23/33] net: use peer when purging queue in qemu_flush_or_purge_queue_packets()
+The sender of packet will be checked in the qemu_net_queue_purge() but
+we use NetClientState not its peer when trying to purge the incoming
+queue in qemu_flush_or_purge_packets(). This will trigger the assert
+in virtio_net_reset since we can't pass the sender check:
+hw/net/virtio-net.c:533: void virtio_net_reset(VirtIODevice *): Assertion
+`!virtio_net_get_subqueue(nc)->async_tx.elem' failed.
+#9 0x55a33fa31b78 in virtio_net_reset hw/net/virtio-net.c:533:13
+#10 0x55a33fc88412 in virtio_reset hw/virtio/virtio.c:1919:9
+#11 0x55a341d82764 in virtio_bus_reset hw/virtio/virtio-bus.c:95:9
+#12 0x55a341dba2de in virtio_pci_reset hw/virtio/virtio-pci.c:1824:5
+#13 0x55a341db3e02 in virtio_pci_common_write hw/virtio/virtio-pci.c:1252:13
+#14 0x55a33f62117b in memory_region_write_accessor memory.c:496:5
+#15 0x55a33f6205e4 in access_with_adjusted_size memory.c:557:18
+#16 0x55a33f61e177 in memory_region_dispatch_write memory.c:1488:16
+Reproducer:
+https://www.mail-archive.com/qemu-devel@nongnu.org/msg701914.html
+Fix by using the peer.
+Reported-by: "Alexander Bulekov" <alxndr@bu.edu>
+Acked-by: Alexander Bulekov <alxndr@bu.edu>
+Fixes: ca77d85e1dbf9 ("net: complete all queued packets on VM stop")
+Cc: qemu-stable@nongnu.org
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ net/net.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/net/net.c b/net/net.c
+index XXXXXXX..XXXXXXX 100644
+--- a/net/net.c
++++ b/net/net.c
+@@ -XXX,XX +XXX,XX @@ void qemu_flush_or_purge_queued_packets(NetClientState *nc, bool purge)
+         qemu_notify_event();
+     } else if (purge) {
+         /* Unable to empty the queue, purge remaining packets */
+-        qemu_net_queue_purge(nc->incoming_queue, nc);
++        qemu_net_queue_purge(nc->incoming_queue, nc->peer);
+     }
+ }
+--
+.5.0

-[Qemu-devel] [PULL 10/14] net/colo-compare.c: Add vnet packet's tcp/udp/icmp compare
+[PULL V2 24/33] net/colo-compare.c: Create event_bh with the right AioContext
-From: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
+From: Lukas Straub <lukasstraub2@web.de>
-COLO-Proxy just focus on packet payload, so we skip vnet header.
+qemu_bh_new will set the bh to be executed in the main
 loop. This causes crashes as colo_compare_handle_event assumes
 that it has exclusive access the queues, which are also
 concurrently accessed in the iothread.
-Signed-off-by: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
+Create the bh with the AioContext of the iothread to fulfill
 these assumptions and fix the crashes. This is safe, because
 the bh already takes the appropriate locks.
 Signed-off-by: Lukas Straub <lukasstraub2@web.de>
 Reviewed-by: Zhang Chen <chen.zhang@intel.com>
 Reviewed-by: Derek Su <dereksu@qnap.com>
 Tested-by: Derek Su <dereksu@qnap.com>
 Signed-off-by: Zhang Chen <chen.zhang@intel.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- net/colo-compare.c | 8 ++++++--
+ net/colo-compare.c | 3 ++-
-file changed, 6 insertions(+), 2 deletions(-)
+file changed, 2 insertions(+), 1 deletion(-)
 diff --git a/net/colo-compare.c b/net/colo-compare.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/colo-compare.c
 +++ b/net/colo-compare.c
-@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_common(Packet *ppkt, Packet *spkt, int offset)
+@@ -XXX,XX +XXX,XX @@ static void colo_compare_handle_event(void *opaque)
-                                    sec_ip_src, sec_ip_dst);
  static void colo_compare_iothread(CompareState *s)
  {
 +    AioContext *ctx = iothread_get_aio_context(s->iothread);
      object_ref(OBJECT(s->iothread));
      s->worker_context = iothread_get_g_main_context(s->iothread);
@@ -XXX,XX +XXX,XX @@ static void colo_compare_iothread(CompareState *s)
      }
-+    offset = ppkt->vnet_hdr_len + offset;
+     colo_compare_timer_init(s);
-+
+-    s->event_bh = qemu_bh_new(colo_compare_handle_event, s);
-     if (ppkt->size == spkt->size) {
++    s->event_bh = aio_bh_new(ctx, colo_compare_handle_event, s);
--        return memcmp(ppkt->data + offset, spkt->data + offset,
+ }
-+        return memcmp(ppkt->data + offset,
-+                      spkt->data + offset,
+ static char *compare_get_pri_indev(Object *obj, Error **errp)
                        spkt->size - offset);
      } else {
          trace_colo_compare_main("Net packet size are not the same");
@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_tcp(Packet *spkt, Packet *ppkt)
       */
      if (ptcp->th_off > 5) {
          ptrdiff_t tcp_offset;
 +
          tcp_offset = ppkt->transport_header - (uint8_t *)ppkt->data
 -                     + (ptcp->th_off * 4);
 +                     + (ptcp->th_off * 4) - ppkt->vnet_hdr_len;
          res = colo_packet_compare_common(ppkt, spkt, tcp_offset);
      } else if (ptcp->th_sum == stcp->th_sum) {
          res = colo_packet_compare_common(ppkt, spkt, ETH_HLEN);
 --
-.7.4
+.5.0

-New patch
+[PULL V2 25/33] chardev/char.c: Use qemu_co_sleep_ns if in coroutine
+From: Lukas Straub <lukasstraub2@web.de>
+To be able to convert compare_chr_send to a coroutine in the
+next commit, use qemu_co_sleep_ns if in coroutine.
+Signed-off-by: Lukas Straub <lukasstraub2@web.de>
+Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
+Reviewed-by: Zhang Chen <chen.zhang@intel.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Signed-off-by: Zhang Chen <chen.zhang@intel.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ chardev/char.c | 7 ++++++-
+file changed, 6 insertions(+), 1 deletion(-)
+diff --git a/chardev/char.c b/chardev/char.c
+index XXXXXXX..XXXXXXX 100644
+--- a/chardev/char.c
++++ b/chardev/char.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/module.h"
+ #include "qemu/option.h"
+ #include "qemu/id.h"
++#include "qemu/coroutine.h"
+ #include "chardev/char-mux.h"
+@@ -XXX,XX +XXX,XX @@ static int qemu_chr_write_buffer(Chardev *s,
+     retry:
+         res = cc->chr_write(s, buf + *offset, len - *offset);
+         if (res < 0 && errno == EAGAIN && write_all) {
+-            g_usleep(100);
++            if (qemu_in_coroutine()) {
++                qemu_co_sleep_ns(QEMU_CLOCK_REALTIME, 100000);
++            } else {
++                g_usleep(100);
++            }
+             goto retry;
+         }
+--
+.5.0

-[Qemu-devel] [PULL 06/14] net/colo.c: Make vnet_hdr_len as packet property
+[PULL V2 26/33] net/colo-compare.c: Fix deadlock in compare_chr_send
-From: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
+From: Lukas Straub <lukasstraub2@web.de>
-We can use this property flush and send packet with vnet_hdr_len.
+The chr_out chardev is connected to a filter-redirector
+running in the main loop. qemu_chr_fe_write_all might block
-Signed-off-by: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
+here in compare_chr_send if the (socket-)buffer is full.
 If another filter-redirector in the main loop want's to
 send data to chr_pri_in it might also block if the buffer
 is full. This leads to a deadlock because both event loops
 get blocked.
 Fix this by converting compare_chr_send to a coroutine and
 putting the packets in a send queue.
 Signed-off-by: Lukas Straub <lukasstraub2@web.de>
 Reviewed-by: Zhang Chen <chen.zhang@intel.com>
 Tested-by: Zhang Chen <chen.zhang@intel.com>
 Signed-off-by: Zhang Chen <chen.zhang@intel.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- net/colo-compare.c    | 8 ++++++--
+ net/colo-compare.c | 193 ++++++++++++++++++++++++++++++++++++++++-------------
- net/colo.c            | 3 ++-
+ net/colo.c         |   7 ++
- net/colo.h            | 4 +++-
+ net/colo.h         |   1 +
- net/filter-rewriter.c | 2 +-
+files changed, 156 insertions(+), 45 deletions(-)
 files changed, 12 insertions(+), 5 deletions(-)
 diff --git a/net/colo-compare.c b/net/colo-compare.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/colo-compare.c
 +++ b/net/colo-compare.c
-@@ -XXX,XX +XXX,XX @@ static int packet_enqueue(CompareState *s, int mode)
+@@ -XXX,XX +XXX,XX @@
-     Connection *conn;
+ #include "migration/migration.h"
+ #include "util.h"
-     if (mode == PRIMARY_IN) {
--        pkt = packet_new(s->pri_rs.buf, s->pri_rs.packet_len);
++#include "block/aio-wait.h"
-+        pkt = packet_new(s->pri_rs.buf,
++#include "qemu/coroutine.h"
-+                         s->pri_rs.packet_len,
++
-+                         s->pri_rs.vnet_hdr_len);
+ #define TYPE_COLO_COMPARE "colo-compare"
  #define COLO_COMPARE(obj) \
      OBJECT_CHECK(CompareState, (obj), TYPE_COLO_COMPARE)
@@ -XXX,XX +XXX,XX @@ static int event_unhandled_count;
   *                    |packet  |  |packet  +    |packet  | |packet  +
   *                    +--------+  +--------+    +--------+ +--------+
   */
 +
 +typedef struct SendCo {
 +    Coroutine *co;
 +    struct CompareState *s;
 +    CharBackend *chr;
 +    GQueue send_list;
 +    bool notify_remote_frame;
 +    bool done;
 +    int ret;
 +} SendCo;
 +
 +typedef struct SendEntry {
 +    uint32_t size;
 +    uint32_t vnet_hdr_len;
 +    uint8_t *buf;
 +} SendEntry;
 +
  typedef struct CompareState {
      Object parent;
@@ -XXX,XX +XXX,XX @@ typedef struct CompareState {
      SocketReadState pri_rs;
      SocketReadState sec_rs;
      SocketReadState notify_rs;
 +    SendCo out_sendco;
 +    SendCo notify_sendco;
      bool vnet_hdr;
      uint32_t compare_timeout;
      uint32_t expired_scan_cycle;
@@ -XXX,XX +XXX,XX @@ enum {
  static int compare_chr_send(CompareState *s,
 -                            const uint8_t *buf,
 +                            uint8_t *buf,
                              uint32_t size,
                              uint32_t vnet_hdr_len,
 -                            bool notify_remote_frame);
 +                            bool notify_remote_frame,
 +                            bool zero_copy);
  static bool packet_matches_str(const char *str,
                                 const uint8_t *buf,
@@ -XXX,XX +XXX,XX @@ static void notify_remote_frame(CompareState *s)
      char msg[] = "DO_CHECKPOINT";
      int ret = 0;
 -    ret = compare_chr_send(s, (uint8_t *)msg, strlen(msg), 0, true);
 +    ret = compare_chr_send(s, (uint8_t *)msg, strlen(msg), 0, true, false);
      if (ret < 0) {
          error_report("Notify Xen COLO-frame failed");
      }
@@ -XXX,XX +XXX,XX @@ static void colo_release_primary_pkt(CompareState *s, Packet *pkt)
                             pkt->data,
                             pkt->size,
                             pkt->vnet_hdr_len,
 -                           false);
 +                           false,
 +                           true);
      if (ret < 0) {
          error_report("colo send primary packet failed");
      }
      trace_colo_compare_main("packet same and release packet");
 -    packet_destroy(pkt, NULL);
 +    packet_destroy_partial(pkt, NULL);
  }
  /*
@@ -XXX,XX +XXX,XX @@ static void colo_compare_connection(void *opaque, void *user_data)
      }
  }
 -static int compare_chr_send(CompareState *s,
 -                            const uint8_t *buf,
 -                            uint32_t size,
 -                            uint32_t vnet_hdr_len,
 -                            bool notify_remote_frame)
 +static void coroutine_fn _compare_chr_send(void *opaque)
  {
 +    SendCo *sendco = opaque;
 +    CompareState *s = sendco->s;
      int ret = 0;
 -    uint32_t len = htonl(size);
 -    if (!size) {
 -        return 0;
 -    }
 +    while (!g_queue_is_empty(&sendco->send_list)) {
 +        SendEntry *entry = g_queue_pop_tail(&sendco->send_list);
 +        uint32_t len = htonl(entry->size);
 -    if (notify_remote_frame) {
 -        ret = qemu_chr_fe_write_all(&s->chr_notify_dev,
 -                                    (uint8_t *)&len,
 -                                    sizeof(len));
 -    } else {
 -        ret = qemu_chr_fe_write_all(&s->chr_out, (uint8_t *)&len, sizeof(len));
 -    }
 +        ret = qemu_chr_fe_write_all(sendco->chr, (uint8_t *)&len, sizeof(len));
 -    if (ret != sizeof(len)) {
 -        goto err;
 -    }
 +        if (ret != sizeof(len)) {
 +            g_free(entry->buf);
 +            g_slice_free(SendEntry, entry);
 +            goto err;
 +        }
 -    if (s->vnet_hdr) {
 -        /*
 -         * We send vnet header len make other module(like filter-redirector)
 -         * know how to parse net packet correctly.
 -         */
 -        len = htonl(vnet_hdr_len);
 +        if (!sendco->notify_remote_frame && s->vnet_hdr) {
 +            /*
 +             * We send vnet header len make other module(like filter-redirector)
 +             * know how to parse net packet correctly.
 +             */
 +            len = htonl(entry->vnet_hdr_len);
 -        if (!notify_remote_frame) {
 -            ret = qemu_chr_fe_write_all(&s->chr_out,
 +            ret = qemu_chr_fe_write_all(sendco->chr,
                                          (uint8_t *)&len,
                                          sizeof(len));
 +
 +            if (ret != sizeof(len)) {
 +                g_free(entry->buf);
 +                g_slice_free(SendEntry, entry);
 +                goto err;
 +            }
          }
 -        if (ret != sizeof(len)) {
 +        ret = qemu_chr_fe_write_all(sendco->chr,
 +                                    (uint8_t *)entry->buf,
 +                                    entry->size);
 +
 +        if (ret != entry->size) {
 +            g_free(entry->buf);
 +            g_slice_free(SendEntry, entry);
              goto err;
          }
 +
 +        g_free(entry->buf);
 +        g_slice_free(SendEntry, entry);
      }
 +    sendco->ret = 0;
 +    goto out;
 +
 +err:
 +    while (!g_queue_is_empty(&sendco->send_list)) {
 +        SendEntry *entry = g_queue_pop_tail(&sendco->send_list);
 +        g_free(entry->buf);
 +        g_slice_free(SendEntry, entry);
 +    }
 +    sendco->ret = ret < 0 ? ret : -EIO;
 +out:
 +    sendco->co = NULL;
 +    sendco->done = true;
 +    aio_wait_kick();
 +}
 +
 +static int compare_chr_send(CompareState *s,
 +                            uint8_t *buf,
 +                            uint32_t size,
 +                            uint32_t vnet_hdr_len,
 +                            bool notify_remote_frame,
 +                            bool zero_copy)
 +{
 +    SendCo *sendco;
 +    SendEntry *entry;
 +
      if (notify_remote_frame) {
 -        ret = qemu_chr_fe_write_all(&s->chr_notify_dev,
 -                                    (uint8_t *)buf,
 -                                    size);
 +        sendco = &s->notify_sendco;
      } else {
--        pkt = packet_new(s->sec_rs.buf, s->sec_rs.packet_len);
+-        ret = qemu_chr_fe_write_all(&s->chr_out, (uint8_t *)buf, size);
-+        pkt = packet_new(s->sec_rs.buf,
++        sendco = &s->out_sendco;
-+                         s->sec_rs.packet_len,
+     }
-+                         s->sec_rs.vnet_hdr_len);
-     }
+-    if (ret != size) {
+-        goto err;
-     if (parse_packet_early(pkt)) {
++    if (!size) {
 +        return 0;
      }
 -    return 0;
 +    entry = g_slice_new(SendEntry);
 +    entry->size = size;
 +    entry->vnet_hdr_len = vnet_hdr_len;
 +    if (zero_copy) {
 +        entry->buf = buf;
 +    } else {
 +        entry->buf = g_malloc(size);
 +        memcpy(entry->buf, buf, size);
 +    }
 +    g_queue_push_head(&sendco->send_list, entry);
 +
 +    if (sendco->done) {
 +        sendco->co = qemu_coroutine_create(_compare_chr_send, sendco);
 +        sendco->done = false;
 +        qemu_coroutine_enter(sendco->co);
 +        if (sendco->done) {
 +            /* report early errors */
 +            return sendco->ret;
 +        }
 +    }
 -err:
 -    return ret < 0 ? ret : -EIO;
 +    /* assume success */
 +    return 0;
  }
  static int compare_chr_can_read(void *opaque)
@@ -XXX,XX +XXX,XX @@ static void compare_pri_rs_finalize(SocketReadState *pri_rs)
                           pri_rs->buf,
                           pri_rs->packet_len,
                           pri_rs->vnet_hdr_len,
 +                         false,
                           false);
      } else {
          /* compare packet in the specified connection */
@@ -XXX,XX +XXX,XX @@ static void compare_notify_rs_finalize(SocketReadState *notify_rs)
      if (packet_matches_str("COLO_USERSPACE_PROXY_INIT",
                             notify_rs->buf,
                             notify_rs->packet_len)) {
 -        ret = compare_chr_send(s, (uint8_t *)msg, strlen(msg), 0, true);
 +        ret = compare_chr_send(s, (uint8_t *)msg, strlen(msg), 0, true, false);
          if (ret < 0) {
              error_report("Notify Xen COLO-frame INIT failed");
          }
@@ -XXX,XX +XXX,XX @@ static void colo_compare_complete(UserCreatable *uc, Error **errp)
      QTAILQ_INSERT_TAIL(&net_compares, s, next);
 +    s->out_sendco.s = s;
 +    s->out_sendco.chr = &s->chr_out;
 +    s->out_sendco.notify_remote_frame = false;
 +    s->out_sendco.done = true;
 +    g_queue_init(&s->out_sendco.send_list);
 +
 +    if (s->notify_dev) {
 +        s->notify_sendco.s = s;
 +        s->notify_sendco.chr = &s->chr_notify_dev;
 +        s->notify_sendco.notify_remote_frame = true;
 +        s->notify_sendco.done = true;
 +        g_queue_init(&s->notify_sendco.send_list);
 +    }
 +
      g_queue_init(&s->conn_list);
      qemu_mutex_init(&event_mtx);
@@ -XXX,XX +XXX,XX @@ static void colo_flush_packets(void *opaque, void *user_data)
                           pkt->data,
                           pkt->size,
                           pkt->vnet_hdr_len,
 -                         false);
 -        packet_destroy(pkt, NULL);
 +                         false,
 +                         true);
 +        packet_destroy_partial(pkt, NULL);
      }
      while (!g_queue_is_empty(&conn->secondary_list)) {
          pkt = g_queue_pop_head(&conn->secondary_list);
@@ -XXX,XX +XXX,XX @@ static void colo_compare_finalize(Object *obj)
          }
      }
 +    AioContext *ctx = iothread_get_aio_context(s->iothread);
 +    aio_context_acquire(ctx);
 +    AIO_WAIT_WHILE(ctx, !s->out_sendco.done);
 +    if (s->notify_dev) {
 +        AIO_WAIT_WHILE(ctx, !s->notify_sendco.done);
 +    }
 +    aio_context_release(ctx);
 +
      /* Release all unhandled packets after compare thead exited */
      g_queue_foreach(&s->conn_list, colo_flush_packets, s);
 +    AIO_WAIT_WHILE(NULL, !s->out_sendco.done);
      g_queue_clear(&s->conn_list);
 +    g_queue_clear(&s->out_sendco.send_list);
 +    if (s->notify_dev) {
 +        g_queue_clear(&s->notify_sendco.send_list);
 +    }
      if (s->connection_track_table) {
          g_hash_table_destroy(s->connection_track_table);
 diff --git a/net/colo.c b/net/colo.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/colo.c
 +++ b/net/colo.c
-@@ -XXX,XX +XXX,XX @@ void connection_destroy(void *opaque)
+@@ -XXX,XX +XXX,XX @@ void packet_destroy(void *opaque, void *user_data)
-     g_slice_free(Connection, conn);
+     g_slice_free(Packet, pkt);
  }
--Packet *packet_new(const void *data, int size)
++void packet_destroy_partial(void *opaque, void *user_data)
-+Packet *packet_new(const void *data, int size, int vnet_hdr_len)
++{
- {
++    Packet *pkt = opaque;
-     Packet *pkt = g_slice_new(Packet);
++
++    g_slice_free(Packet, pkt);
-     pkt->data = g_memdup(data, size);
++}
-     pkt->size = size;
++
-     pkt->creation_ms = qemu_clock_get_ms(QEMU_CLOCK_HOST);
+ /*
-+    pkt->vnet_hdr_len = vnet_hdr_len;
+  * Clear hashtable, stop this hash growing really huge
+  */
      return pkt;
  }
 diff --git a/net/colo.h b/net/colo.h
 index XXXXXXX..XXXXXXX 100644
 --- a/net/colo.h
 +++ b/net/colo.h
-@@ -XXX,XX +XXX,XX @@ typedef struct Packet {
+@@ -XXX,XX +XXX,XX @@ bool connection_has_tracked(GHashTable *connection_track_table,
      int size;
      /* Time of packet creation, in wall clock ms */
      int64_t creation_ms;
 +    /* Get vnet_hdr_len from filter */
 +    uint32_t vnet_hdr_len;
  } Packet;
  typedef struct ConnectionKey {
@@ -XXX,XX +XXX,XX @@ Connection *connection_get(GHashTable *connection_track_table,
                             ConnectionKey *key,
                             GQueue *conn_list);
  void connection_hashtable_reset(GHashTable *connection_track_table);
--Packet *packet_new(const void *data, int size);
+ Packet *packet_new(const void *data, int size, int vnet_hdr_len);
 +Packet *packet_new(const void *data, int size, int vnet_hdr_len);
  void packet_destroy(void *opaque, void *user_data);
++void packet_destroy_partial(void *opaque, void *user_data);
- #endif /* QEMU_COLO_PROXY_H */
-diff --git a/net/filter-rewriter.c b/net/filter-rewriter.c
+ #endif /* NET_COLO_H */
 index XXXXXXX..XXXXXXX 100644
 --- a/net/filter-rewriter.c
 +++ b/net/filter-rewriter.c
@@ -XXX,XX +XXX,XX @@ static ssize_t colo_rewriter_receive_iov(NetFilterState *nf,
      char *buf = g_malloc0(size);
      iov_to_buf(iov, iovcnt, 0, buf, size);
 -    pkt = packet_new(buf, size);
 +    pkt = packet_new(buf, size, 0);
      g_free(buf);
      /*
 --
-.7.4
+.5.0

-[Qemu-devel] [PULL 09/14] net/colo.c: Add vnet packet parse feature in colo-proxy
+[PULL V2 27/33] net/colo-compare.c: Only hexdump packets if tracing is enabled
-From: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
+From: Lukas Straub <lukasstraub2@web.de>
-Make colo-compare and filter-rewriter can parse vnet packet.
+Else the log will be flooded if there is a lot of network
 traffic.
-Signed-off-by: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
+Signed-off-by: Lukas Straub <lukasstraub2@web.de>
 Reviewed-by: Zhang Chen <chen.zhang@intel.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Zhang Chen <chen.zhang@intel.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- net/colo.c | 6 +++---
+ net/colo-compare.c | 10 ++++++----
-file changed, 3 insertions(+), 3 deletions(-)
+file changed, 6 insertions(+), 4 deletions(-)
-diff --git a/net/colo.c b/net/colo.c
+diff --git a/net/colo-compare.c b/net/colo-compare.c
 index XXXXXXX..XXXXXXX 100644
---- a/net/colo.c
+--- a/net/colo-compare.c
-+++ b/net/colo.c
++++ b/net/colo-compare.c
-@@ -XXX,XX +XXX,XX @@ int parse_packet_early(Packet *pkt)
+@@ -XXX,XX +XXX,XX @@ sec:
- {
+         g_queue_push_head(&conn->primary_list, ppkt);
-     int network_length;
+         g_queue_push_head(&conn->secondary_list, spkt);
-     static const uint8_t vlan[] = {0x81, 0x00};
--    uint8_t *data = pkt->data;
+-        qemu_hexdump((char *)ppkt->data, stderr,
-+    uint8_t *data = pkt->data + pkt->vnet_hdr_len;
+-                     "colo-compare ppkt", ppkt->size);
-     uint16_t l3_proto;
+-        qemu_hexdump((char *)spkt->data, stderr,
-     ssize_t l2hdr_len = eth_get_l2_hdr_length(data);
+-                     "colo-compare spkt", spkt->size);
++        if (trace_event_get_state_backends(TRACE_COLO_COMPARE_MISCOMPARE)) {
--    if (pkt->size < ETH_HLEN) {
++            qemu_hexdump((char *)ppkt->data, stderr,
-+    if (pkt->size < ETH_HLEN + pkt->vnet_hdr_len) {
++                        "colo-compare ppkt", ppkt->size);
-         trace_colo_proxy_main("pkt->size < ETH_HLEN");
++            qemu_hexdump((char *)spkt->data, stderr,
-         return 1;
++                        "colo-compare spkt", spkt->size);
-     }
++        }
-@@ -XXX,XX +XXX,XX @@ int parse_packet_early(Packet *pkt)
-     }
+         colo_compare_inconsistency_notify(s);
      network_length = pkt->ip->ip_hl * 4;
 -    if (pkt->size < l2hdr_len + network_length) {
 +    if (pkt->size < l2hdr_len + network_length + pkt->vnet_hdr_len) {
          trace_colo_proxy_main("pkt->size < network_header + network_length");
          return 1;
      }
 --
-.7.4
+.5.0

-[Qemu-devel] [PULL 02/14] net/net.c: Add vnet_hdr support in SocketReadState
+[PULL V2 28/33] net/colo-compare.c: Check that colo-compare is active
-From: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
+From: Lukas Straub <lukasstraub2@web.de>
-We add a flag to decide whether net_fill_rstate() need read
+If the colo-compare object is removed before failover and a
-the vnet_hdr_len or not.
+checkpoint happens, qemu crashes because it tries to lock
 the destroyed event_mtx in colo_notify_compares_event.
-Signed-off-by: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
+Fix this by checking if everything is initialized by
-Suggested-by: Jason Wang <jasowang@redhat.com>
+introducing a new variable colo_compare_active which
 is protected by a new mutex colo_compare_mutex. The new mutex
 also protects against concurrent access of the net_compares
 list and makes sure that colo_notify_compares_event isn't
 active while we destroy event_mtx and event_complete_cond.
 With this it also is again possible to use colo without
 colo-compare (periodic mode) and to use multiple colo-compare
 for multiple network interfaces.
 Signed-off-by: Lukas Straub <lukasstraub2@web.de>
 Tested-by: Lukas Straub <lukasstraub2@web.de>
 Reviewed-by: Zhang Chen <chen.zhang@intel.com>
 Signed-off-by: Zhang Chen <chen.zhang@intel.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- include/net/net.h   |  9 +++++++--
+ net/colo-compare.c | 35 +++++++++++++++++++++++++++++------
- net/colo-compare.c  |  4 ++--
+file changed, 29 insertions(+), 6 deletions(-)
  net/filter-mirror.c |  2 +-
  net/net.c           | 36 ++++++++++++++++++++++++++++++++----
  net/socket.c        |  8 ++++----
 files changed, 46 insertions(+), 13 deletions(-)
-diff --git a/include/net/net.h b/include/net/net.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/net/net.h
-+++ b/include/net/net.h
-@@ -XXX,XX +XXX,XX @@ typedef struct NICState {
- } NICState;
- struct SocketReadState {
--    int state; /* 0 = getting length, 1 = getting data */
-+    /* 0 = getting length, 1 = getting vnet header length, 2 = getting data */
-+    int state;
-+    /* This flag decide whether to read the vnet_hdr_len field */
-+    bool vnet_hdr;
-     uint32_t index;
-     uint32_t packet_len;
-+    uint32_t vnet_hdr_len;
-     uint8_t buf[NET_BUFSIZE];
-     SocketReadStateFinalize *finalize;
- };
-@@ -XXX,XX +XXX,XX @@ ssize_t qemu_deliver_packet_iov(NetClientState *sender,
- void print_net_client(Monitor *mon, NetClientState *nc);
- void hmp_info_network(Monitor *mon, const QDict *qdict);
- void net_socket_rs_init(SocketReadState *rs,
--                        SocketReadStateFinalize *finalize);
-+                        SocketReadStateFinalize *finalize,
-+                        bool vnet_hdr);
- /* NIC info */
 diff --git a/net/colo-compare.c b/net/colo-compare.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/colo-compare.c
 +++ b/net/colo-compare.c
+@@ -XXX,XX +XXX,XX @@ static NotifierList colo_compare_notifiers =
+ #define REGULAR_PACKET_CHECK_MS 3000
+ #define DEFAULT_TIME_OUT_MS 3000
++static QemuMutex colo_compare_mutex;
++static bool colo_compare_active;
+ static QemuMutex event_mtx;
+ static QemuCond event_complete_cond;
+ static int event_unhandled_count;
+@@ -XXX,XX +XXX,XX @@ static void check_old_packet_regular(void *opaque)
+ void colo_notify_compares_event(void *opaque, int event, Error **errp)
+ {
+     CompareState *s;
++    qemu_mutex_lock(&colo_compare_mutex);
++
++    if (!colo_compare_active) {
++        qemu_mutex_unlock(&colo_compare_mutex);
++        return;
++    }
+     qemu_mutex_lock(&event_mtx);
+     QTAILQ_FOREACH(s, &net_compares, next) {
+@@ -XXX,XX +XXX,XX @@ void colo_notify_compares_event(void *opaque, int event, Error **errp)
+     }
+     qemu_mutex_unlock(&event_mtx);
++    qemu_mutex_unlock(&colo_compare_mutex);
+ }
+ static void colo_compare_timer_init(CompareState *s)
 @@ -XXX,XX +XXX,XX @@ static void colo_compare_complete(UserCreatable *uc, Error **errp)
-         return;
+                            s->vnet_hdr);
      }
--    net_socket_rs_init(&s->pri_rs, compare_pri_rs_finalize);
++    qemu_mutex_lock(&colo_compare_mutex);
--    net_socket_rs_init(&s->sec_rs, compare_sec_rs_finalize);
++    if (!colo_compare_active) {
-+    net_socket_rs_init(&s->pri_rs, compare_pri_rs_finalize, false);
++        qemu_mutex_init(&event_mtx);
-+    net_socket_rs_init(&s->sec_rs, compare_sec_rs_finalize, false);
++        qemu_cond_init(&event_complete_cond);
 +        colo_compare_active = true;
 +    }
      QTAILQ_INSERT_TAIL(&net_compares, s, next);
 +    qemu_mutex_unlock(&colo_compare_mutex);
      s->out_sendco.s = s;
      s->out_sendco.chr = &s->chr_out;
@@ -XXX,XX +XXX,XX @@ static void colo_compare_complete(UserCreatable *uc, Error **errp)
      g_queue_init(&s->conn_list);
-diff --git a/net/filter-mirror.c b/net/filter-mirror.c
+-    qemu_mutex_init(&event_mtx);
-index XXXXXXX..XXXXXXX 100644
+-    qemu_cond_init(&event_complete_cond);
---- a/net/filter-mirror.c
+-
-+++ b/net/filter-mirror.c
+     s->connection_track_table = g_hash_table_new_full(connection_key_hash,
-@@ -XXX,XX +XXX,XX @@ static void filter_redirector_setup(NetFilterState *nf, Error **errp)
+                                                       connection_key_equal,
                                                        g_free,
@@ -XXX,XX +XXX,XX @@ static void colo_compare_finalize(Object *obj)
      qemu_bh_delete(s->event_bh);
 +    qemu_mutex_lock(&colo_compare_mutex);
      QTAILQ_FOREACH(tmp, &net_compares, next) {
          if (tmp == s) {
              QTAILQ_REMOVE(&net_compares, s, next);
              break;
          }
      }
++    if (QTAILQ_EMPTY(&net_compares)) {
--    net_socket_rs_init(&s->rs, redirector_rs_finalize);
++        colo_compare_active = false;
-+    net_socket_rs_init(&s->rs, redirector_rs_finalize, false);
++        qemu_mutex_destroy(&event_mtx);
++        qemu_cond_destroy(&event_complete_cond);
-     if (s->indev) {
++    }
-         chr = qemu_chr_find(s->indev);
++    qemu_mutex_unlock(&colo_compare_mutex);
-diff --git a/net/net.c b/net/net.c
-index XXXXXXX..XXXXXXX 100644
+     AioContext *ctx = iothread_get_aio_context(s->iothread);
---- a/net/net.c
+     aio_context_acquire(ctx);
-+++ b/net/net.c
+@@ -XXX,XX +XXX,XX @@ static void colo_compare_finalize(Object *obj)
-@@ -XXX,XX +XXX,XX @@ QemuOptsList qemu_net_opts = {
+         object_unref(OBJECT(s->iothread));
- };
+     }
- void net_socket_rs_init(SocketReadState *rs,
+-    qemu_mutex_destroy(&event_mtx);
--                        SocketReadStateFinalize *finalize)
+-    qemu_cond_destroy(&event_complete_cond);
-+                        SocketReadStateFinalize *finalize,
+-
-+                        bool vnet_hdr)
+     g_free(s->pri_indev);
- {
+     g_free(s->sec_indev);
-     rs->state = 0;
+     g_free(s->outdev);
-+    rs->vnet_hdr = vnet_hdr;
+     g_free(s->notify_dev);
      rs->index = 0;
      rs->packet_len = 0;
 +    rs->vnet_hdr_len = 0;
      memset(rs->buf, 0, sizeof(rs->buf));
      rs->finalize = finalize;
  }
-@@ -XXX,XX +XXX,XX @@ int net_fill_rstate(SocketReadState *rs, const uint8_t *buf, int size)
-     unsigned int l;
++static void __attribute__((__constructor__)) colo_compare_init_globals(void)
++{
-     while (size > 0) {
++    colo_compare_active = false;
--        /* reassemble a packet from the network */
++    qemu_mutex_init(&colo_compare_mutex);
--        switch (rs->state) { /* 0 = getting length, 1 = getting data */
++}
-+        /* Reassemble a packet from the network.
++
-+         * 0 = getting length.
+ static const TypeInfo colo_compare_info = {
-+         * 1 = getting vnet header length.
+     .name = TYPE_COLO_COMPARE,
-+         * 2 = getting data.
+     .parent = TYPE_OBJECT,
 +         */
 +        switch (rs->state) {
          case 0:
              l = 4 - rs->index;
              if (l > size) {
@@ -XXX,XX +XXX,XX @@ int net_fill_rstate(SocketReadState *rs, const uint8_t *buf, int size)
                  /* got length */
                  rs->packet_len = ntohl(*(uint32_t *)rs->buf);
                  rs->index = 0;
 -                rs->state = 1;
 +                if (rs->vnet_hdr) {
 +                    rs->state = 1;
 +                } else {
 +                    rs->state = 2;
 +                    rs->vnet_hdr_len = 0;
 +                }
              }
              break;
          case 1:
 +            l = 4 - rs->index;
 +            if (l > size) {
 +                l = size;
 +            }
 +            memcpy(rs->buf + rs->index, buf, l);
 +            buf += l;
 +            size -= l;
 +            rs->index += l;
 +            if (rs->index == 4) {
 +                /* got vnet header length */
 +                rs->vnet_hdr_len = ntohl(*(uint32_t *)rs->buf);
 +                rs->index = 0;
 +                rs->state = 2;
 +            }
 +            break;
 +        case 2:
              l = rs->packet_len - rs->index;
              if (l > size) {
                  l = size;
 diff --git a/net/socket.c b/net/socket.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/socket.c
 +++ b/net/socket.c
@@ -XXX,XX +XXX,XX @@ static void net_socket_send(void *opaque)
          closesocket(s->fd);
          s->fd = -1;
 -        net_socket_rs_init(&s->rs, net_socket_rs_finalize);
 +        net_socket_rs_init(&s->rs, net_socket_rs_finalize, false);
          s->nc.link_down = true;
          memset(s->nc.info_str, 0, sizeof(s->nc.info_str));
@@ -XXX,XX +XXX,XX @@ static NetSocketState *net_socket_fd_init_dgram(NetClientState *peer,
      s->fd = fd;
      s->listen_fd = -1;
      s->send_fn = net_socket_send_dgram;
 -    net_socket_rs_init(&s->rs, net_socket_rs_finalize);
 +    net_socket_rs_init(&s->rs, net_socket_rs_finalize, false);
      net_socket_read_poll(s, true);
      /* mcast: save bound address as dst */
@@ -XXX,XX +XXX,XX @@ static NetSocketState *net_socket_fd_init_stream(NetClientState *peer,
      s->fd = fd;
      s->listen_fd = -1;
 -    net_socket_rs_init(&s->rs, net_socket_rs_finalize);
 +    net_socket_rs_init(&s->rs, net_socket_rs_finalize, false);
      /* Disable Nagle algorithm on TCP sockets to reduce latency */
      socket_set_nodelay(fd);
@@ -XXX,XX +XXX,XX @@ static int net_socket_listen_init(NetClientState *peer,
      s->fd = -1;
      s->listen_fd = fd;
      s->nc.link_down = true;
 -    net_socket_rs_init(&s->rs, net_socket_rs_finalize);
 +    net_socket_rs_init(&s->rs, net_socket_rs_finalize, false);
      qemu_set_fd_handler(s->listen_fd, net_socket_accept, NULL, s);
      return 0;
 --
-.7.4
+.5.0

-[Qemu-devel] [PULL 08/14] net/colo-compare.c: Make colo-compare support vnet_hdr_len
+[PULL V2 29/33] net/colo-compare.c: Correct ordering in complete and finalize
-From: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
+From: Lukas Straub <lukasstraub2@web.de>
-We add the vnet_hdr_support option for colo-compare, default is disabled.
+In colo_compare_complete, insert CompareState into net_compares
-If you use virtio-net-pci or other driver needs vnet_hdr, please enable it.
+only after everything has been initialized.
-You can use it for example:
+In colo_compare_finalize, remove CompareState from net_compares
--object colo-compare,id=comp0,primary_in=compare0-0,secondary_in=compare1,outdev=compare_out0,vnet_hdr_support
+before anything is deinitialized.
-COLO-compare can get vnet header length from filter,
+Signed-off-by: Lukas Straub <lukasstraub2@web.de>
-Add vnet_hdr_len to struct packet and output packet with
+Reviewed-by: Zhang Chen <chen.zhang@intel.com>
-the vnet_hdr_len.
+Signed-off-by: Zhang Chen <chen.zhang@intel.com>
 Signed-off-by: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- net/colo-compare.c | 60 +++++++++++++++++++++++++++++++++++++++++++++++-------
+ net/colo-compare.c | 45 +++++++++++++++++++++++----------------------
- qemu-options.hx    |  4 ++--
+file changed, 23 insertions(+), 22 deletions(-)
 files changed, 55 insertions(+), 9 deletions(-)
 diff --git a/net/colo-compare.c b/net/colo-compare.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/colo-compare.c
 +++ b/net/colo-compare.c
-@@ -XXX,XX +XXX,XX @@ typedef struct CompareState {
+@@ -XXX,XX +XXX,XX @@ static void colo_compare_complete(UserCreatable *uc, Error **errp)
-     CharBackend chr_out;
+                            s->vnet_hdr);
      SocketReadState pri_rs;
      SocketReadState sec_rs;
 +    bool vnet_hdr;
      /* connection list: the connections belonged to this NIC could be found
       * in this list.
@@ -XXX,XX +XXX,XX @@ enum {
  static int compare_chr_send(CompareState *s,
                              const uint8_t *buf,
 -                            uint32_t size);
 +                            uint32_t size,
 +                            uint32_t vnet_hdr_len);
  static gint seq_sorter(Packet *a, Packet *b, gpointer data)
  {
@@ -XXX,XX +XXX,XX @@ static void colo_compare_connection(void *opaque, void *user_data)
          }
          if (result) {
 -            ret = compare_chr_send(s, pkt->data, pkt->size);
 +            ret = compare_chr_send(s,
 +                                   pkt->data,
 +                                   pkt->size,
 +                                   pkt->vnet_hdr_len);
              if (ret < 0) {
                  error_report("colo_send_primary_packet failed");
              }
@@ -XXX,XX +XXX,XX @@ static void colo_compare_connection(void *opaque, void *user_data)
  static int compare_chr_send(CompareState *s,
                              const uint8_t *buf,
 -                            uint32_t size)
 +                            uint32_t size,
 +                            uint32_t vnet_hdr_len)
  {
      int ret = 0;
      uint32_t len = htonl(size);
@@ -XXX,XX +XXX,XX @@ static int compare_chr_send(CompareState *s,
          goto err;
      }
-+    if (s->vnet_hdr) {
+-    qemu_mutex_lock(&colo_compare_mutex);
-+        /*
+-    if (!colo_compare_active) {
-+         * We send vnet header len make other module(like filter-redirector)
+-        qemu_mutex_init(&event_mtx);
-+         * know how to parse net packet correctly.
+-        qemu_cond_init(&event_complete_cond);
-+         */
+-        colo_compare_active = true;
-+        len = htonl(vnet_hdr_len);
+-    }
-+        ret = qemu_chr_fe_write_all(&s->chr_out, (uint8_t *)&len, sizeof(len));
+-    QTAILQ_INSERT_TAIL(&net_compares, s, next);
-+        if (ret != sizeof(len)) {
+-    qemu_mutex_unlock(&colo_compare_mutex);
-+            goto err;
+-
-+        }
+     s->out_sendco.s = s;
      s->out_sendco.chr = &s->chr_out;
      s->out_sendco.notify_remote_frame = false;
@@ -XXX,XX +XXX,XX @@ static void colo_compare_complete(UserCreatable *uc, Error **errp)
                                                        connection_destroy);
      colo_compare_iothread(s);
 +
 +    qemu_mutex_lock(&colo_compare_mutex);
 +    if (!colo_compare_active) {
 +        qemu_mutex_init(&event_mtx);
 +        qemu_cond_init(&event_complete_cond);
 +        colo_compare_active = true;
 +    }
 +    QTAILQ_INSERT_TAIL(&net_compares, s, next);
 +    qemu_mutex_unlock(&colo_compare_mutex);
 +
      return;
  }
@@ -XXX,XX +XXX,XX @@ static void colo_compare_finalize(Object *obj)
      CompareState *s = COLO_COMPARE(obj);
      CompareState *tmp = NULL;
 -    qemu_chr_fe_deinit(&s->chr_pri_in, false);
 -    qemu_chr_fe_deinit(&s->chr_sec_in, false);
 -    qemu_chr_fe_deinit(&s->chr_out, false);
 -    if (s->notify_dev) {
 -        qemu_chr_fe_deinit(&s->chr_notify_dev, false);
 -    }
 -
 -    if (s->iothread) {
 -        colo_compare_timer_del(s);
 -    }
 -
 -    qemu_bh_delete(s->event_bh);
 -
      qemu_mutex_lock(&colo_compare_mutex);
      QTAILQ_FOREACH(tmp, &net_compares, next) {
          if (tmp == s) {
@@ -XXX,XX +XXX,XX @@ static void colo_compare_finalize(Object *obj)
      }
      qemu_mutex_unlock(&colo_compare_mutex);
 +    qemu_chr_fe_deinit(&s->chr_pri_in, false);
 +    qemu_chr_fe_deinit(&s->chr_sec_in, false);
 +    qemu_chr_fe_deinit(&s->chr_out, false);
 +    if (s->notify_dev) {
 +        qemu_chr_fe_deinit(&s->chr_notify_dev, false);
 +    }
 +
-     ret = qemu_chr_fe_write_all(&s->chr_out, (uint8_t *)buf, size);
++    if (s->iothread) {
-     if (ret != size) {
++        colo_compare_timer_del(s);
-         goto err;
++    }
@@ -XXX,XX +XXX,XX @@ static void compare_set_outdev(Object *obj, const char *value, Error **errp)
      s->outdev = g_strdup(value);
  }
 +static bool compare_get_vnet_hdr(Object *obj, Error **errp)
 +{
 +    CompareState *s = COLO_COMPARE(obj);
 +
-+    return s->vnet_hdr;
++    qemu_bh_delete(s->event_bh);
 +}
 +
-+static void compare_set_vnet_hdr(Object *obj,
+     AioContext *ctx = iothread_get_aio_context(s->iothread);
-+                                 bool value,
+     aio_context_acquire(ctx);
-+                                 Error **errp)
+     AIO_WAIT_WHILE(ctx, !s->out_sendco.done);
 +{
 +    CompareState *s = COLO_COMPARE(obj);
 +
 +    s->vnet_hdr = value;
 +}
 +
  static void compare_pri_rs_finalize(SocketReadState *pri_rs)
  {
      CompareState *s = container_of(pri_rs, CompareState, pri_rs);
      if (packet_enqueue(s, PRIMARY_IN)) {
          trace_colo_compare_main("primary: unsupported packet in");
 -        compare_chr_send(s, pri_rs->buf, pri_rs->packet_len);
 +        compare_chr_send(s,
 +                         pri_rs->buf,
 +                         pri_rs->packet_len,
 +                         pri_rs->vnet_hdr_len);
      } else {
          /* compare connection */
          g_queue_foreach(&s->conn_list, colo_compare_connection, s);
@@ -XXX,XX +XXX,XX @@ static void colo_compare_complete(UserCreatable *uc, Error **errp)
          return;
      }
 -    net_socket_rs_init(&s->pri_rs, compare_pri_rs_finalize, false);
 -    net_socket_rs_init(&s->sec_rs, compare_sec_rs_finalize, false);
 +    net_socket_rs_init(&s->pri_rs, compare_pri_rs_finalize, s->vnet_hdr);
 +    net_socket_rs_init(&s->sec_rs, compare_sec_rs_finalize, s->vnet_hdr);
      g_queue_init(&s->conn_list);
@@ -XXX,XX +XXX,XX @@ static void colo_flush_packets(void *opaque, void *user_data)
      while (!g_queue_is_empty(&conn->primary_list)) {
          pkt = g_queue_pop_head(&conn->primary_list);
 -        compare_chr_send(s, pkt->data, pkt->size);
 +        compare_chr_send(s,
 +                         pkt->data,
 +                         pkt->size,
 +                         pkt->vnet_hdr_len);
          packet_destroy(pkt, NULL);
      }
      while (!g_queue_is_empty(&conn->secondary_list)) {
@@ -XXX,XX +XXX,XX @@ static void colo_compare_class_init(ObjectClass *oc, void *data)
  static void colo_compare_init(Object *obj)
  {
 +    CompareState *s = COLO_COMPARE(obj);
 +
      object_property_add_str(obj, "primary_in",
                              compare_get_pri_indev, compare_set_pri_indev,
                              NULL);
@@ -XXX,XX +XXX,XX @@ static void colo_compare_init(Object *obj)
      object_property_add_str(obj, "outdev",
                              compare_get_outdev, compare_set_outdev,
                              NULL);
 +
 +    s->vnet_hdr = false;
 +    object_property_add_bool(obj, "vnet_hdr_support", compare_get_vnet_hdr,
 +                             compare_set_vnet_hdr, NULL);
  }
  static void colo_compare_finalize(Object *obj)
 diff --git a/qemu-options.hx b/qemu-options.hx
 index XXXXXXX..XXXXXXX 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
@@ -XXX,XX +XXX,XX @@ Dump the network traffic on netdev @var{dev} to the file specified by
  The file format is libpcap, so it can be analyzed with tools such as tcpdump
  or Wireshark.
 -@item -object colo-compare,id=@var{id},primary_in=@var{chardevid},secondary_in=@var{chardevid},
 -outdev=@var{chardevid}
 +@item -object colo-compare,id=@var{id},primary_in=@var{chardevid},secondary_in=@var{chardevid},outdev=@var{chardevid}[,vnet_hdr_support]
  Colo-compare gets packet from primary_in@var{chardevid} and secondary_in@var{chardevid}, than compare primary packet with
  secondary packet. If the packets are same, we will output primary
  packet to outdev@var{chardevid}, else we will notify colo-frame
  do checkpoint and send primary packet to outdev@var{chardevid}.
 +if it has the vnet_hdr_support flag, colo compare will send/recv packet with vnet_hdr_len.
  we must use it with the help of filter-mirror and filter-redirector.
 --
-.7.4
+.5.0

-[Qemu-devel] [PULL 07/14] net/colo-compare.c: Introduce parameter for compare_chr_send()
+[PULL V2 30/33] colo-compare: Fix memory leak in packet_enqueue()
-From: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
+From: Derek Su <dereksu@qnap.com>
-This patch change the compare_chr_send() parameter from CharBackend to CompareState,
+The patch is to fix the "pkt" memory leak in packet_enqueue().
-we can get more information like vnet_hdr(We use it to support packet with vnet_header).
+The allocated "pkt" needs to be freed if the colo compare
 primary or secondary queue is too big.
-Signed-off-by: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
+Replace the error_report of full queue with a trace event.
 Signed-off-by: Derek Su <dereksu@qnap.com>
 Reviewed-by: Zhang Chen <chen.zhang@intel.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Zhang Chen <chen.zhang@intel.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- net/colo-compare.c | 14 +++++++-------
+ net/colo-compare.c | 23 +++++++++++++++--------
-file changed, 7 insertions(+), 7 deletions(-)
+ net/trace-events   |  1 +
 files changed, 16 insertions(+), 8 deletions(-)
 diff --git a/net/colo-compare.c b/net/colo-compare.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/colo-compare.c
 +++ b/net/colo-compare.c
 @@ -XXX,XX +XXX,XX @@ enum {
      SECONDARY_IN,
  };
--static int compare_chr_send(CharBackend *out,
++static const char *colo_mode[] = {
-+static int compare_chr_send(CompareState *s,
++    [PRIMARY_IN] = "primary",
-                             const uint8_t *buf,
++    [SECONDARY_IN] = "secondary",
-                             uint32_t size);
++};
-@@ -XXX,XX +XXX,XX @@ static void colo_compare_connection(void *opaque, void *user_data)
+ static int compare_chr_send(CompareState *s,
-         }
+                             uint8_t *buf,
+@@ -XXX,XX +XXX,XX @@ static int packet_enqueue(CompareState *s, int mode, Connection **con)
-         if (result) {
+     ConnectionKey key;
--            ret = compare_chr_send(&s->chr_out, pkt->data, pkt->size);
+     Packet *pkt = NULL;
-+            ret = compare_chr_send(s, pkt->data, pkt->size);
+     Connection *conn;
-             if (ret < 0) {
++    int ret;
-                 error_report("colo_send_primary_packet failed");
-             }
+     if (mode == PRIMARY_IN) {
-@@ -XXX,XX +XXX,XX @@ static void colo_compare_connection(void *opaque, void *user_data)
+         pkt = packet_new(s->pri_rs.buf,
@@ -XXX,XX +XXX,XX @@ static int packet_enqueue(CompareState *s, int mode, Connection **con)
      }
- }
+     if (mode == PRIMARY_IN) {
--static int compare_chr_send(CharBackend *out,
+-        if (!colo_insert_packet(&conn->primary_list, pkt, &conn->pack)) {
-+static int compare_chr_send(CompareState *s,
+-            error_report("colo compare primary queue size too big,"
-                             const uint8_t *buf,
+-                         "drop packet");
-                             uint32_t size)
+-        }
- {
++        ret = colo_insert_packet(&conn->primary_list, pkt, &conn->pack);
-@@ -XXX,XX +XXX,XX @@ static int compare_chr_send(CharBackend *out,
+     } else {
-         return 0;
+-        if (!colo_insert_packet(&conn->secondary_list, pkt, &conn->sack)) {
 -            error_report("colo compare secondary queue size too big,"
 -                         "drop packet");
 -        }
 +        ret = colo_insert_packet(&conn->secondary_list, pkt, &conn->sack);
      }
++
--    ret = qemu_chr_fe_write_all(out, (uint8_t *)&len, sizeof(len));
++    if (!ret) {
-+    ret = qemu_chr_fe_write_all(&s->chr_out, (uint8_t *)&len, sizeof(len));
++        trace_colo_compare_drop_packet(colo_mode[mode],
-     if (ret != sizeof(len)) {
++            "queue size too big, drop packet");
-         goto err;
++        packet_destroy(pkt, NULL);
-     }
++        pkt = NULL;
++    }
--    ret = qemu_chr_fe_write_all(out, (uint8_t *)buf, size);
++
-+    ret = qemu_chr_fe_write_all(&s->chr_out, (uint8_t *)buf, size);
+     *con = conn;
-     if (ret != size) {
-         goto err;
+     return 0;
-     }
+diff --git a/net/trace-events b/net/trace-events
-@@ -XXX,XX +XXX,XX @@ static void compare_pri_rs_finalize(SocketReadState *pri_rs)
+index XXXXXXX..XXXXXXX 100644
+--- a/net/trace-events
-     if (packet_enqueue(s, PRIMARY_IN)) {
++++ b/net/trace-events
-         trace_colo_compare_main("primary: unsupported packet in");
+@@ -XXX,XX +XXX,XX @@ colo_proxy_main(const char *chr) ": %s"
--        compare_chr_send(&s->chr_out, pri_rs->buf, pri_rs->packet_len);
-+        compare_chr_send(s, pri_rs->buf, pri_rs->packet_len);
+ # colo-compare.c
-     } else {
+ colo_compare_main(const char *chr) ": %s"
-         /* compare connection */
++colo_compare_drop_packet(const char *queue, const char *chr) ": %s: %s"
-         g_queue_foreach(&s->conn_list, colo_compare_connection, s);
+ colo_compare_udp_miscompare(const char *sta, int size) ": %s = %d"
-@@ -XXX,XX +XXX,XX @@ static void colo_flush_packets(void *opaque, void *user_data)
+ colo_compare_icmp_miscompare(const char *sta, int size) ": %s = %d"
+ colo_compare_ip_info(int psize, const char *sta, const char *stb, int ssize, const char *stc, const char *std) "ppkt size = %d, ip_src = %s, ip_dst = %s, spkt size = %d, ip_src = %s, ip_dst = %s"
      while (!g_queue_is_empty(&conn->primary_list)) {
          pkt = g_queue_pop_head(&conn->primary_list);
 -        compare_chr_send(&s->chr_out, pkt->data, pkt->size);
 +        compare_chr_send(s, pkt->data, pkt->size);
          packet_destroy(pkt, NULL);
      }
      while (!g_queue_is_empty(&conn->secondary_list)) {
 --
-.7.4
+.5.0

-[Qemu-devel] [PULL 12/14] docs/colo-proxy.txt: Update colo-proxy usage of net driver with vnet_header
+[PULL V2 31/33] hw/net/e1000e: Do not abort() on invalid PSRCTL register value
-From: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
+libFuzzer found using 'qemu-system-i386 -M q35':
 qemu: hardware error: e1000e: PSRCTL.BSIZE0 cannot be zero
 CPU #0:
 EAX=00000000 EBX=00000000 ECX=00000000 EDX=00000663
 ESI=00000000 EDI=00000000 EBP=00000000 ESP=00000000
 EIP=0000fff0 EFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
 ES =0000 00000000 0000ffff 00009300
 CS =f000 ffff0000 0000ffff 00009b00
 SS =0000 00000000 0000ffff 00009300
 DS =0000 00000000 0000ffff 00009300
 FS =0000 00000000 0000ffff 00009300
 GS =0000 00000000 0000ffff 00009300
 LDT=0000 00000000 0000ffff 00008200
 TR =0000 00000000 0000ffff 00008b00
 GDT=     00000000 0000ffff
 IDT=     00000000 0000ffff
 CR0=60000010 CR2=00000000 CR3=00000000 CR4=00000000
 DR0=00000000 DR1=00000000 DR2=00000000 DR3=00000000
 DR6=ffff0ff0 DR7=00000400
 EFER=0000000000000000
 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
 XMM00=00000000000000000000000000000000 XMM01=00000000000000000000000000000000
 XMM02=00000000000000000000000000000000 XMM03=00000000000000000000000000000000
 XMM04=00000000000000000000000000000000 XMM05=00000000000000000000000000000000
 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000
 ==1988== ERROR: libFuzzer: deadly signal
     #6 0x7fae4d3ea894 in __GI_abort (/lib64/libc.so.6+0x22894)
     #7 0x563f4cc59a1d in hw_error (qemu-fuzz-i386+0xe8ca1d)
     #8 0x563f4d7c93f2 in e1000e_set_psrctl (qemu-fuzz-i386+0x19fc3f2)
     #9 0x563f4d7b798f in e1000e_core_write (qemu-fuzz-i386+0x19ea98f)
     #10 0x563f4d7afc46 in e1000e_mmio_write (qemu-fuzz-i386+0x19e2c46)
     #11 0x563f4cc9a0a7 in memory_region_write_accessor (qemu-fuzz-i386+0xecd0a7)
     #12 0x563f4cc99c13 in access_with_adjusted_size (qemu-fuzz-i386+0xeccc13)
     #13 0x563f4cc987b4 in memory_region_dispatch_write (qemu-fuzz-i386+0xecb7b4)
 It simply sent the following 2 I/O command to the e1000e
 PCI BAR #2 I/O region:
   writew 0x0100 0x0c00 # RCTL =   E1000_RCTL_DTYP_MASK
   writeb 0x2170 0x00   # PSRCTL = 0
 static void
 e1000e_set_psrctl(E1000ECore *core, int index, uint32_t val)
 {
 if (core->mac[RCTL] & E1000_RCTL_DTYP_MASK) {
 if ((val & E1000_PSRCTL_BSIZE0_MASK) == 0) {
 hw_error("e1000e: PSRCTL.BSIZE0 cannot be zero");
 }
 Instead of calling hw_error() which abort the process (it is
 meant for CPU fatal error condition, not for device logging),
 log the invalid request with qemu_log_mask(LOG_GUEST_ERROR)
 and return, ignoring the request.
 Cc: qemu-stable@nongnu.org
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- docs/colo-proxy.txt | 26 ++++++++++++++++++++++++++
+ hw/net/e1000e_core.c | 10 +++++++---
-file changed, 26 insertions(+)
+file changed, 7 insertions(+), 3 deletions(-)
-diff --git a/docs/colo-proxy.txt b/docs/colo-proxy.txt
+diff --git a/hw/net/e1000e_core.c b/hw/net/e1000e_core.c
 index XXXXXXX..XXXXXXX 100644
---- a/docs/colo-proxy.txt
+--- a/hw/net/e1000e_core.c
-+++ b/docs/colo-proxy.txt
++++ b/hw/net/e1000e_core.c
-@@ -XXX,XX +XXX,XX @@ Secondary(ip:3.3.3.8):
+@@ -XXX,XX +XXX,XX @@
- -chardev socket,id=red1,host=3.3.3.3,port=9004
+ */
- -object filter-redirector,id=f1,netdev=hn0,queue=tx,indev=red0
- -object filter-redirector,id=f2,netdev=hn0,queue=rx,outdev=red1
+ #include "qemu/osdep.h"
-+-object filter-rewriter,id=f3,netdev=hn0,queue=all
++#include "qemu/log.h"
-+
+ #include "net/net.h"
-+If you want to use virtio-net-pci or other driver with vnet_header:
+ #include "net/tap.h"
-+
+-#include "hw/hw.h"
-+Primary(ip:3.3.3.3):
+ #include "hw/pci/msi.h"
-+-netdev tap,id=hn0,vhost=off,script=/etc/qemu-ifup,downscript=/etc/qemu-ifdown
+ #include "hw/pci/msix.h"
-+-device e1000,id=e0,netdev=hn0,mac=52:a4:00:12:78:66
+ #include "sysemu/runstate.h"
-+-chardev socket,id=mirror0,host=3.3.3.3,port=9003,server,nowait
+@@ -XXX,XX +XXX,XX @@ e1000e_set_psrctl(E1000ECore *core, int index, uint32_t val)
-+-chardev socket,id=compare1,host=3.3.3.3,port=9004,server,nowait
+     if (core->mac[RCTL] & E1000_RCTL_DTYP_MASK) {
-+-chardev socket,id=compare0,host=3.3.3.3,port=9001,server,nowait
-+-chardev socket,id=compare0-0,host=3.3.3.3,port=9001
+         if ((val & E1000_PSRCTL_BSIZE0_MASK) == 0) {
-+-chardev socket,id=compare_out,host=3.3.3.3,port=9005,server,nowait
+-            hw_error("e1000e: PSRCTL.BSIZE0 cannot be zero");
-+-chardev socket,id=compare_out0,host=3.3.3.3,port=9005
++            qemu_log_mask(LOG_GUEST_ERROR,
-+-object filter-mirror,id=m0,netdev=hn0,queue=tx,outdev=mirror0,vnet_hdr_support
++                          "e1000e: PSRCTL.BSIZE0 cannot be zero");
-+-object filter-redirector,netdev=hn0,id=redire0,queue=rx,indev=compare_out,vnet_hdr_support
++            return;
-+-object filter-redirector,netdev=hn0,id=redire1,queue=rx,outdev=compare0,vnet_hdr_support
+         }
-+-object colo-compare,id=comp0,primary_in=compare0-0,secondary_in=compare1,outdev=compare_out0,vnet_hdr_support
-+
+         if ((val & E1000_PSRCTL_BSIZE1_MASK) == 0) {
-+Secondary(ip:3.3.3.8):
+-            hw_error("e1000e: PSRCTL.BSIZE1 cannot be zero");
-+-netdev tap,id=hn0,vhost=off,script=/etc/qemu-ifup,down script=/etc/qemu-ifdown
++            qemu_log_mask(LOG_GUEST_ERROR,
-+-device e1000,netdev=hn0,mac=52:a4:00:12:78:66
++                          "e1000e: PSRCTL.BSIZE1 cannot be zero");
-+-chardev socket,id=red0,host=3.3.3.3,port=9003
++            return;
-+-chardev socket,id=red1,host=3.3.3.3,port=9004
+         }
-+-object filter-redirector,id=f1,netdev=hn0,queue=tx,indev=red0,vnet_hdr_support
+     }
-+-object filter-redirector,id=f2,netdev=hn0,queue=rx,outdev=red1,vnet_hdr_support
 +-object filter-rewriter,id=f3,netdev=hn0,queue=all,vnet_hdr_support
  Note:
    a.COLO-proxy must work with COLO-frame and Block-replication.
 --
-.7.4
+.5.0

-[Qemu-devel] [PULL 01/14] net: Add vnet_hdr_len arguments in NetClientState
+[PULL V2 32/33] net: Drop the legacy "name" parameter from the -net option
-From: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
+From: Thomas Huth <thuth@redhat.com>
-Add vnet_hdr_len arguments in NetClientState
+It's been deprecated since QEMU v3.1, so it's time to finally
-that make other module get real vnet_hdr_len easily.
+remove it. The "id" parameter can simply be used instead.
-Signed-off-by: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
+Reviewed-by: Eric Blake <eblake@redhat.com>
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- include/net/net.h | 1 +
+ docs/system/deprecated.rst | 15 +++++++++------
- net/net.c         | 1 +
+ net/net.c                  | 10 +---------
-files changed, 2 insertions(+)
+ qapi/net.json              |  3 ---
 files changed, 10 insertions(+), 18 deletions(-)
-diff --git a/include/net/net.h b/include/net/net.h
+diff --git a/docs/system/deprecated.rst b/docs/system/deprecated.rst
 index XXXXXXX..XXXXXXX 100644
---- a/include/net/net.h
+--- a/docs/system/deprecated.rst
-+++ b/include/net/net.h
++++ b/docs/system/deprecated.rst
-@@ -XXX,XX +XXX,XX @@ struct NetClientState {
+@@ -XXX,XX +XXX,XX @@ The 'file' driver for drives is no longer appropriate for character or host
-     unsigned int queue_index;
+ devices and will only accept regular files (S_IFREG). The correct driver
-     unsigned rxfilter_notify_enabled:1;
+ for these file types is 'host_cdrom' or 'host_device' as appropriate.
-     int vring_enable;
-+    int vnet_hdr_len;
+-``-net ...,name=``\ *name* (since 3.1)
-     QTAILQ_HEAD(NetFilterHead, NetFilterState) filters;
+-''''''''''''''''''''''''''''''''''''''
- };
+-
 -The ``name`` parameter of the ``-net`` option is a synonym
 -for the ``id`` parameter, which should now be used instead.
 -
  ``-smp`` (invalid topologies) (since 3.1)
  '''''''''''''''''''''''''''''''''''''''''
@@ -XXX,XX +XXX,XX @@ What follows is a record of recently removed, formerly deprecated
  features that serves as a record for users who have encountered
  trouble after a recent upgrade.
 +System emulator command line arguments
 +--------------------------------------
 +
 +``-net ...,name=``\ *name* (removed in 5.1)
 +'''''''''''''''''''''''''''''''''''''''''''
 +
 +The ``name`` parameter of the ``-net`` option was a synonym
 +for the ``id`` parameter, which should now be used instead.
 +
  QEMU Machine Protocol (QMP) commands
  ------------------------------------
 diff --git a/net/net.c b/net/net.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/net.c
 +++ b/net/net.c
-@@ -XXX,XX +XXX,XX @@ void qemu_set_vnet_hdr_len(NetClientState *nc, int len)
+@@ -XXX,XX +XXX,XX @@ static int net_client_init1(const void *object, bool is_netdev, Error **errp)
-         return;
+ {
      Netdev legacy = {0};
      const Netdev *netdev;
 -    const char *name;
      NetClientState *peer = NULL;
      if (is_netdev) {
          netdev = object;
 -        name = netdev->id;
          if (netdev->type == NET_CLIENT_DRIVER_NIC ||
              !net_client_init_fun[netdev->type]) {
@@ -XXX,XX +XXX,XX @@ static int net_client_init1(const void *object, bool is_netdev, Error **errp)
          const NetLegacyOptions *opts = net->opts;
          legacy.id = net->id;
          netdev = &legacy;
 -        /* missing optional values have been initialized to "all bits zero" */
 -        name = net->has_id ? net->id : net->name;
 -
 -        if (net->has_name) {
 -            warn_report("The 'name' parameter is deprecated, use 'id' instead");
 -        }
          /* Map the old options to the new flat type */
          switch (opts->type) {
@@ -XXX,XX +XXX,XX @@ static int net_client_init1(const void *object, bool is_netdev, Error **errp)
          }
      }
-+    nc->vnet_hdr_len = len;
+-    if (net_client_init_fun[netdev->type](netdev, name, peer, errp) < 0) {
-     nc->info->set_vnet_hdr_len(nc, len);
++    if (net_client_init_fun[netdev->type](netdev, netdev->id, peer, errp) < 0) {
- }
+         /* FIXME drop when all init functions store an Error */
+         if (errp && !*errp) {
              error_setg(errp, QERR_DEVICE_INIT_FAILED,
 diff --git a/qapi/net.json b/qapi/net.json
 index XXXXXXX..XXXXXXX 100644
 --- a/qapi/net.json
 +++ b/qapi/net.json
@@ -XXX,XX +XXX,XX @@
  #
  # @id: identifier for monitor commands
  #
 -# @name: identifier for monitor commands, ignored if @id is present
 -#
  # @opts: device type specific properties (legacy)
  #
  # Since: 1.2
@@ -XXX,XX +XXX,XX @@
  { 'struct': 'NetLegacy',
    'data': {
      '*id':   'str',
 -    '*name': 'str',
      'opts':  'NetLegacyOptions' } }
  ##
 --
-.7.4
+.5.0

-New patch
+[PULL V2 33/33] net: Drop the NetLegacy structure, always use Netdev instead
+From: Thomas Huth <thuth@redhat.com>
 Now that the "name" parameter is gone, there is hardly any difference
 between NetLegacy and Netdev anymore, so we can drop NetLegacy and always
 use Netdev to simplify the code quite a bit.
 The only two differences that were really left between Netdev and NetLegacy:
 ) NetLegacy does not allow a "hubport" type. We can continue to block
    this with a simple check in net_client_init1() for this type.
 ) The "id" parameter was optional in NetLegacy (and an internal id
    was chosen via assign_name() during initialization), but it is mandatory
    for Netdev. To avoid that the visitor code bails out here, we have to
    add an internal id to the QemuOpts already earlier now.
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 Reviewed-by: Eric Blake <eblake@redhat.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
  net/net.c     | 77 ++++++++++-------------------------------------------------
  qapi/net.json | 46 -----------------------------------
 files changed, 13 insertions(+), 110 deletions(-)
 diff --git a/net/net.c b/net/net.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/net.c
 +++ b/net/net.c
@@ -XXX,XX +XXX,XX @@ static int (* const net_client_init_fun[NET_CLIENT_DRIVER__MAX])(
  };
 -static int net_client_init1(const void *object, bool is_netdev, Error **errp)
 +static int net_client_init1(const Netdev *netdev, bool is_netdev, Error **errp)
  {
 -    Netdev legacy = {0};
 -    const Netdev *netdev;
      NetClientState *peer = NULL;
      if (is_netdev) {
 -        netdev = object;
 -
          if (netdev->type == NET_CLIENT_DRIVER_NIC ||
              !net_client_init_fun[netdev->type]) {
              error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "type",
@@ -XXX,XX +XXX,XX @@ static int net_client_init1(const void *object, bool is_netdev, Error **errp)
              return -1;
          }
      } else {
 -        const NetLegacy *net = object;
 -        const NetLegacyOptions *opts = net->opts;
 -        legacy.id = net->id;
 -        netdev = &legacy;
 -
 -        /* Map the old options to the new flat type */
 -        switch (opts->type) {
 -        case NET_LEGACY_OPTIONS_TYPE_NONE:
 +        if (netdev->type == NET_CLIENT_DRIVER_NONE) {
              return 0; /* nothing to do */
 -        case NET_LEGACY_OPTIONS_TYPE_NIC:
 -            legacy.type = NET_CLIENT_DRIVER_NIC;
 -            legacy.u.nic = opts->u.nic;
 -            break;
 -        case NET_LEGACY_OPTIONS_TYPE_USER:
 -            legacy.type = NET_CLIENT_DRIVER_USER;
 -            legacy.u.user = opts->u.user;
 -            break;
 -        case NET_LEGACY_OPTIONS_TYPE_TAP:
 -            legacy.type = NET_CLIENT_DRIVER_TAP;
 -            legacy.u.tap = opts->u.tap;
 -            break;
 -        case NET_LEGACY_OPTIONS_TYPE_L2TPV3:
 -            legacy.type = NET_CLIENT_DRIVER_L2TPV3;
 -            legacy.u.l2tpv3 = opts->u.l2tpv3;
 -            break;
 -        case NET_LEGACY_OPTIONS_TYPE_SOCKET:
 -            legacy.type = NET_CLIENT_DRIVER_SOCKET;
 -            legacy.u.socket = opts->u.socket;
 -            break;
 -        case NET_LEGACY_OPTIONS_TYPE_VDE:
 -            legacy.type = NET_CLIENT_DRIVER_VDE;
 -            legacy.u.vde = opts->u.vde;
 -            break;
 -        case NET_LEGACY_OPTIONS_TYPE_BRIDGE:
 -            legacy.type = NET_CLIENT_DRIVER_BRIDGE;
 -            legacy.u.bridge = opts->u.bridge;
 -            break;
 -        case NET_LEGACY_OPTIONS_TYPE_NETMAP:
 -            legacy.type = NET_CLIENT_DRIVER_NETMAP;
 -            legacy.u.netmap = opts->u.netmap;
 -            break;
 -        case NET_LEGACY_OPTIONS_TYPE_VHOST_USER:
 -            legacy.type = NET_CLIENT_DRIVER_VHOST_USER;
 -            legacy.u.vhost_user = opts->u.vhost_user;
 -            break;
 -        default:
 -            abort();
          }
 -
 -        if (!net_client_init_fun[netdev->type]) {
 +        if (netdev->type == NET_CLIENT_DRIVER_HUBPORT ||
 +            !net_client_init_fun[netdev->type]) {
              error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "type",
                         "a net backend type (maybe it is not compiled "
                         "into this binary)");
@@ -XXX,XX +XXX,XX @@ static int net_client_init1(const void *object, bool is_netdev, Error **errp)
          /* Do not add to a hub if it's a nic with a netdev= parameter. */
          if (netdev->type != NET_CLIENT_DRIVER_NIC ||
 -            !opts->u.nic.has_netdev) {
 +            !netdev->u.nic.has_netdev) {
              peer = net_hub_add_port(0, NULL, NULL);
          }
      }
@@ -XXX,XX +XXX,XX @@ static void show_netdevs(void)
  static int net_client_init(QemuOpts *opts, bool is_netdev, Error **errp)
  {
      gchar **substrings = NULL;
 -    void *object = NULL;
 +    Netdev *object = NULL;
      Error *err = NULL;
      int ret = -1;
      Visitor *v = opts_visitor_new(opts);
@@ -XXX,XX +XXX,XX @@ static int net_client_init(QemuOpts *opts, bool is_netdev, Error **errp)
          }
      }
 -    if (is_netdev) {
 -        visit_type_Netdev(v, NULL, (Netdev **)&object, &err);
 -    } else {
 -        visit_type_NetLegacy(v, NULL, (NetLegacy **)&object, &err);
 +    /* Create an ID for -net if the user did not specify one */
 +    if (!is_netdev && !qemu_opts_id(opts)) {
 +        static int idx;
 +        qemu_opts_set_id(opts, g_strdup_printf("__org.qemu.net%i", idx++));
      }
 +    visit_type_Netdev(v, NULL, &object, &err);
 +
      if (!err) {
          ret = net_client_init1(object, is_netdev, &err);
      }
 -    if (is_netdev) {
 -        qapi_free_Netdev(object);
 -    } else {
 -        qapi_free_NetLegacy(object);
 -    }
 +    qapi_free_Netdev(object);
  out:
      error_propagate(errp, err);
 diff --git a/qapi/net.json b/qapi/net.json
 index XXXXXXX..XXXXXXX 100644
 --- a/qapi/net.json
 +++ b/qapi/net.json
@@ -XXX,XX +XXX,XX @@
      'vhost-user': 'NetdevVhostUserOptions' } }
  ##
 -# @NetLegacy:
 -#
 -# Captures the configuration of a network device; legacy.
 -#
 -# @id: identifier for monitor commands
 -#
 -# @opts: device type specific properties (legacy)
 -#
 -# Since: 1.2
 -##
 -{ 'struct': 'NetLegacy',
 -  'data': {
 -    '*id':   'str',
 -    'opts':  'NetLegacyOptions' } }
 -
 -##
 -# @NetLegacyOptionsType:
 -#
 -# Since: 1.2
 -##
 -{ 'enum': 'NetLegacyOptionsType',
 -  'data': ['none', 'nic', 'user', 'tap', 'l2tpv3', 'socket', 'vde',
 -           'bridge', 'netmap', 'vhost-user'] }
 -
 -##
 -# @NetLegacyOptions:
 -#
 -# Like Netdev, but for use only by the legacy command line options
 -#
 -# Since: 1.2
 -##
 -{ 'union': 'NetLegacyOptions',
 -  'base': { 'type': 'NetLegacyOptionsType' },
 -  'discriminator': 'type',
 -  'data': {
 -    'nic':      'NetLegacyNicOptions',
 -    'user':     'NetdevUserOptions',
 -    'tap':      'NetdevTapOptions',
 -    'l2tpv3':   'NetdevL2TPv3Options',
 -    'socket':   'NetdevSocketOptions',
 -    'vde':      'NetdevVdeOptions',
 -    'bridge':   'NetdevBridgeOptions',
 -    'netmap':   'NetdevNetmapOptions',
 -    'vhost-user': 'NetdevVhostUserOptions' } }
 -
 -##
  # @NetFilterDirection:
  #
  # Indicates whether a netfilter is attached to a netdev's transmit queue or
 --
 .5.0

The following changes since commit 6632f6ff96f0537fc34cdc00c760656fc62e23c5:

Merge remote-tracking branch 'remotes/famz/tags/block-and-testing-pull-request' into staging (2017-07-17 11:46:36 +0100)

are available in the git repository at:

https://github.com/jasowang/qemu.git tags/net-pull-request

for you to fetch changes up to 189ae6bb5ce1f5a322f8691d00fe942ba43dd601:

virtio-net: fix offload ctrl endian (2017-07-17 20:13:56 +0800)

----------------------------------------------------------------

- fix virtio-net ctrl offload endian
- vnet header support for variou COLO netfilters and compare thread

----------------------------------------------------------------
Jason Wang (1):
      virtio-net: fix offload ctrl endian

Michal Privoznik (1):
      virtion-net: Prefer is_power_of_2()

Zhang Chen (12):
      net: Add vnet_hdr_len arguments in NetClientState
      net/net.c: Add vnet_hdr support in SocketReadState
      net/filter-mirror.c: Introduce parameter for filter_send()
      net/filter-mirror.c: Make filter mirror support vnet support.
      net/filter-mirror.c: Add new option to enable vnet support for filter-redirector
      net/colo.c: Make vnet_hdr_len as packet property
      net/colo-compare.c: Introduce parameter for compare_chr_send()
      net/colo-compare.c: Make colo-compare support vnet_hdr_len
      net/colo.c: Add vnet packet parse feature in colo-proxy
      net/colo-compare.c: Add vnet packet's tcp/udp/icmp compare
      net/filter-rewriter.c: Make filter-rewriter support vnet_hdr_len
      docs/colo-proxy.txt: Update colo-proxy usage of net driver with vnet_header

From: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>

We add a flag to decide whether net_fill_rstate() need read
the vnet_hdr_len or not.

Signed-off-by: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
Suggested-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 include/net/net.h   |  9 +++++++--
 net/colo-compare.c  |  4 ++--
 net/filter-mirror.c |  2 +-
 net/net.c           | 36 ++++++++++++++++++++++++++++++++----
 net/socket.c        |  8 ++++----
 5 files changed, 46 insertions(+), 13 deletions(-)

diff --git a/include/net/net.h b/include/net/net.h
index XXXXXXX..XXXXXXX 100644
--- a/include/net/net.h
+++ b/include/net/net.h
@@ -XXX,XX +XXX,XX @@ typedef struct NICState {
 } NICState;
 
 struct SocketReadState {
-    int state; /* 0 = getting length, 1 = getting data */
+    /* 0 = getting length, 1 = getting vnet header length, 2 = getting data */
+    int state;
+    /* This flag decide whether to read the vnet_hdr_len field */
+    bool vnet_hdr;
     uint32_t index;
     uint32_t packet_len;
+    uint32_t vnet_hdr_len;
     uint8_t buf[NET_BUFSIZE];
     SocketReadStateFinalize *finalize;
 };
@@ -XXX,XX +XXX,XX @@ ssize_t qemu_deliver_packet_iov(NetClientState *sender,
 void print_net_client(Monitor *mon, NetClientState *nc);
 void hmp_info_network(Monitor *mon, const QDict *qdict);
 void net_socket_rs_init(SocketReadState *rs,
-                        SocketReadStateFinalize *finalize);
+                        SocketReadStateFinalize *finalize,
+                        bool vnet_hdr);
 
 /* NIC info */
 
diff --git a/net/colo-compare.c b/net/colo-compare.c
index XXXXXXX..XXXXXXX 100644
--- a/net/colo-compare.c
+++ b/net/colo-compare.c
@@ -XXX,XX +XXX,XX @@ static void colo_compare_complete(UserCreatable *uc, Error **errp)
         return;
     }
 
-    net_socket_rs_init(&s->pri_rs, compare_pri_rs_finalize);
-    net_socket_rs_init(&s->sec_rs, compare_sec_rs_finalize);
+    net_socket_rs_init(&s->pri_rs, compare_pri_rs_finalize, false);
+    net_socket_rs_init(&s->sec_rs, compare_sec_rs_finalize, false);
 
     g_queue_init(&s->conn_list);
 
diff --git a/net/filter-mirror.c b/net/filter-mirror.c
index XXXXXXX..XXXXXXX 100644
--- a/net/filter-mirror.c
+++ b/net/filter-mirror.c
@@ -XXX,XX +XXX,XX @@ static void filter_redirector_setup(NetFilterState *nf, Error **errp)
         }
     }
 
-    net_socket_rs_init(&s->rs, redirector_rs_finalize);
+    net_socket_rs_init(&s->rs, redirector_rs_finalize, false);
 
     if (s->indev) {
         chr = qemu_chr_find(s->indev);
diff --git a/net/net.c b/net/net.c
index XXXXXXX..XXXXXXX 100644
--- a/net/net.c
+++ b/net/net.c
@@ -XXX,XX +XXX,XX @@ QemuOptsList qemu_net_opts = {
 };
 
 void net_socket_rs_init(SocketReadState *rs,
-                        SocketReadStateFinalize *finalize)
+                        SocketReadStateFinalize *finalize,
+                        bool vnet_hdr)
 {
     rs->state = 0;
+    rs->vnet_hdr = vnet_hdr;
     rs->index = 0;
     rs->packet_len = 0;
+    rs->vnet_hdr_len = 0;
     memset(rs->buf, 0, sizeof(rs->buf));
     rs->finalize = finalize;
 }
@@ -XXX,XX +XXX,XX @@ int net_fill_rstate(SocketReadState *rs, const uint8_t *buf, int size)
     unsigned int l;
 
     while (size > 0) {
-        /* reassemble a packet from the network */
-        switch (rs->state) { /* 0 = getting length, 1 = getting data */
+        /* Reassemble a packet from the network.
+         * 0 = getting length.
+         * 1 = getting vnet header length.
+         * 2 = getting data.
+         */
+        switch (rs->state) {
         case 0:
             l = 4 - rs->index;
             if (l > size) {
@@ -XXX,XX +XXX,XX @@ int net_fill_rstate(SocketReadState *rs, const uint8_t *buf, int size)
                 /* got length */
                 rs->packet_len = ntohl(*(uint32_t *)rs->buf);
                 rs->index = 0;
-                rs->state = 1;
+                if (rs->vnet_hdr) {
+                    rs->state = 1;
+                } else {
+                    rs->state = 2;
+                    rs->vnet_hdr_len = 0;
+                }
             }
             break;
         case 1:
+            l = 4 - rs->index;
+            if (l > size) {
+                l = size;
+            }
+            memcpy(rs->buf + rs->index, buf, l);
+            buf += l;
+            size -= l;
+            rs->index += l;
+            if (rs->index == 4) {
+                /* got vnet header length */
+                rs->vnet_hdr_len = ntohl(*(uint32_t *)rs->buf);
+                rs->index = 0;
+                rs->state = 2;
+            }
+            break;
+        case 2:
             l = rs->packet_len - rs->index;
             if (l > size) {
                 l = size;
diff --git a/net/socket.c b/net/socket.c
index XXXXXXX..XXXXXXX 100644
--- a/net/socket.c
+++ b/net/socket.c
@@ -XXX,XX +XXX,XX @@ static void net_socket_send(void *opaque)
         closesocket(s->fd);
 
         s->fd = -1;
-        net_socket_rs_init(&s->rs, net_socket_rs_finalize);
+        net_socket_rs_init(&s->rs, net_socket_rs_finalize, false);
         s->nc.link_down = true;
         memset(s->nc.info_str, 0, sizeof(s->nc.info_str));
 
@@ -XXX,XX +XXX,XX @@ static NetSocketState *net_socket_fd_init_dgram(NetClientState *peer,
     s->fd = fd;
     s->listen_fd = -1;
     s->send_fn = net_socket_send_dgram;
-    net_socket_rs_init(&s->rs, net_socket_rs_finalize);
+    net_socket_rs_init(&s->rs, net_socket_rs_finalize, false);
     net_socket_read_poll(s, true);
 
     /* mcast: save bound address as dst */
@@ -XXX,XX +XXX,XX @@ static NetSocketState *net_socket_fd_init_stream(NetClientState *peer,
 
     s->fd = fd;
     s->listen_fd = -1;
-    net_socket_rs_init(&s->rs, net_socket_rs_finalize);
+    net_socket_rs_init(&s->rs, net_socket_rs_finalize, false);
 
     /* Disable Nagle algorithm on TCP sockets to reduce latency */
     socket_set_nodelay(fd);
@@ -XXX,XX +XXX,XX @@ static int net_socket_listen_init(NetClientState *peer,
     s->fd = -1;
     s->listen_fd = fd;
     s->nc.link_down = true;
-    net_socket_rs_init(&s->rs, net_socket_rs_finalize);
+    net_socket_rs_init(&s->rs, net_socket_rs_finalize, false);
 
     qemu_set_fd_handler(s->listen_fd, net_socket_accept, NULL, s);
     return 0;
-- 
2.7.4

From: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>

This patch change the filter_send() parameter from CharBackend to MirrorState,
we can get more information like vnet_hdr(We use it to support packet with vnet_header).

Signed-off-by: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/filter-mirror.c | 10 +++++-----
 1 file changed, 5 insertions(+), 5 deletions(-)

diff --git a/net/filter-mirror.c b/net/filter-mirror.c
index XXXXXXX..XXXXXXX 100644
--- a/net/filter-mirror.c
+++ b/net/filter-mirror.c
@@ -XXX,XX +XXX,XX @@ typedef struct MirrorState {
     SocketReadState rs;
 } MirrorState;
 
-static int filter_send(CharBackend *chr_out,
+static int filter_send(MirrorState *s,
                        const struct iovec *iov,
                        int iovcnt)
 {
@@ -XXX,XX +XXX,XX @@ static int filter_send(CharBackend *chr_out,
     }
 
     len = htonl(size);
-    ret = qemu_chr_fe_write_all(chr_out, (uint8_t *)&len, sizeof(len));
+    ret = qemu_chr_fe_write_all(&s->chr_out, (uint8_t *)&len, sizeof(len));
     if (ret != sizeof(len)) {
         goto err;
     }
 
     buf = g_malloc(size);
     iov_to_buf(iov, iovcnt, 0, buf, size);
-    ret = qemu_chr_fe_write_all(chr_out, (uint8_t *)buf, size);
+    ret = qemu_chr_fe_write_all(&s->chr_out, (uint8_t *)buf, size);
     g_free(buf);
     if (ret != size) {
         goto err;
@@ -XXX,XX +XXX,XX @@ static ssize_t filter_mirror_receive_iov(NetFilterState *nf,
     MirrorState *s = FILTER_MIRROR(nf);
     int ret;
 
-    ret = filter_send(&s->chr_out, iov, iovcnt);
+    ret = filter_send(s, iov, iovcnt);
     if (ret) {
         error_report("filter mirror send failed(%s)", strerror(-ret));
     }
@@ -XXX,XX +XXX,XX @@ static ssize_t filter_redirector_receive_iov(NetFilterState *nf,
     int ret;
 
     if (qemu_chr_fe_backend_connected(&s->chr_out)) {
-        ret = filter_send(&s->chr_out, iov, iovcnt);
+        ret = filter_send(s, iov, iovcnt);
         if (ret) {
             error_report("filter redirector send failed(%s)", strerror(-ret));
         }
-- 
2.7.4

From: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>

We add the vnet_hdr_support option for filter-mirror, default is disabled.
If you use virtio-net-pci or other driver needs vnet_hdr, please enable it.
You can use it for example:
-object filter-mirror,id=m0,netdev=hn0,queue=tx,outdev=mirror0,vnet_hdr_support

If it has vnet_hdr_support flag, we will change the sending packet format from
struct {int size; const uint8_t buf[];} to {int size; int vnet_hdr_len; const uint8_t buf[];}.
make other module(like colo-compare) know how to parse net packet correctly.

Signed-off-by: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/filter-mirror.c | 42 +++++++++++++++++++++++++++++++++++++++++-
 qemu-options.hx     |  5 ++---
 2 files changed, 43 insertions(+), 4 deletions(-)

diff --git a/net/filter-mirror.c b/net/filter-mirror.c
index XXXXXXX..XXXXXXX 100644
--- a/net/filter-mirror.c
+++ b/net/filter-mirror.c
@@ -XXX,XX +XXX,XX @@ typedef struct MirrorState {
     CharBackend chr_in;
     CharBackend chr_out;
     SocketReadState rs;
+    bool vnet_hdr;
 } MirrorState;
 
 static int filter_send(MirrorState *s,
                        const struct iovec *iov,
                        int iovcnt)
 {
+    NetFilterState *nf = NETFILTER(s);
     int ret = 0;
     ssize_t size = 0;
     uint32_t len = 0;
@@ -XXX,XX +XXX,XX @@ static int filter_send(MirrorState *s,
         goto err;
     }
 
+    if (s->vnet_hdr) {
+        /*
+         * If vnet_hdr = on, we send vnet header len to make other
+         * module(like colo-compare) know how to parse net
+         * packet correctly.
+         */
+        ssize_t vnet_hdr_len;
+
+        vnet_hdr_len = nf->netdev->vnet_hdr_len;
+
+        len = htonl(vnet_hdr_len);
+        ret = qemu_chr_fe_write_all(&s->chr_out, (uint8_t *)&len, sizeof(len));
+        if (ret != sizeof(len)) {
+            goto err;
+        }
+    }
+
     buf = g_malloc(size);
     iov_to_buf(iov, iovcnt, 0, buf, size);
     ret = qemu_chr_fe_write_all(&s->chr_out, (uint8_t *)buf, size);
@@ -XXX,XX +XXX,XX @@ static void filter_redirector_setup(NetFilterState *nf, Error **errp)
         }
     }
 
-    net_socket_rs_init(&s->rs, redirector_rs_finalize, false);
+    net_socket_rs_init(&s->rs, redirector_rs_finalize, s->vnet_hdr);
 
     if (s->indev) {
         chr = qemu_chr_find(s->indev);
@@ -XXX,XX +XXX,XX @@ static void filter_mirror_set_outdev(Object *obj,
     }
 }
 
+static bool filter_mirror_get_vnet_hdr(Object *obj, Error **errp)
+{
+    MirrorState *s = FILTER_MIRROR(obj);
+
+    return s->vnet_hdr;
+}
+
+static void filter_mirror_set_vnet_hdr(Object *obj, bool value, Error **errp)
+{
+    MirrorState *s = FILTER_MIRROR(obj);
+
+    s->vnet_hdr = value;
+}
+
 static char *filter_redirector_get_outdev(Object *obj, Error **errp)
 {
     MirrorState *s = FILTER_REDIRECTOR(obj);
@@ -XXX,XX +XXX,XX @@ static void filter_redirector_set_outdev(Object *obj,
 
 static void filter_mirror_init(Object *obj)
 {
+    MirrorState *s = FILTER_MIRROR(obj);
+
     object_property_add_str(obj, "outdev", filter_mirror_get_outdev,
                             filter_mirror_set_outdev, NULL);
+
+    s->vnet_hdr = false;
+    object_property_add_bool(obj, "vnet_hdr_support",
+                             filter_mirror_get_vnet_hdr,
+                             filter_mirror_set_vnet_hdr, NULL);
 }
 
 static void filter_redirector_init(Object *obj)
diff --git a/qemu-options.hx b/qemu-options.hx
index XXXXXXX..XXXXXXX 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -XXX,XX +XXX,XX @@ queue @var{all|rx|tx} is an option that can be applied to any netfilter.
 @option{tx}: the filter is attached to the transmit queue of the netdev,
              where it will receive packets sent by the netdev.
 
-@item -object filter-mirror,id=@var{id},netdev=@var{netdevid},outdev=@var{chardevid}[,queue=@var{all|rx|tx}]
+@item -object filter-mirror,id=@var{id},netdev=@var{netdevid},outdev=@var{chardevid},queue=@var{all|rx|tx}[,vnet_hdr_support]
 
-filter-mirror on netdev @var{netdevid},mirror net packet to chardev
-@var{chardevid}
+filter-mirror on netdev @var{netdevid},mirror net packet to chardev@var{chardevid}, if it has the vnet_hdr_support flag, filter-mirror will mirror packet with vnet_hdr_len.
 
 @item -object filter-redirector,id=@var{id},netdev=@var{netdevid},indev=@var{chardevid},
 outdev=@var{chardevid}[,queue=@var{all|rx|tx}]
-- 
2.7.4

From: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>

We add the vnet_hdr_support option for filter-redirector, default is disabled.
If you use virtio-net-pci net driver or other driver needs vnet_hdr, please enable it.
Because colo-compare or other modules needs the vnet_hdr_len to parse
packet, we add this new option send the len to others.
You can use it for example:
-object filter-redirector,id=r0,netdev=hn0,queue=tx,outdev=red0,vnet_hdr_support

Signed-off-by: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/filter-mirror.c | 23 +++++++++++++++++++++++
 qemu-options.hx     |  6 +++---
 2 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/net/filter-mirror.c b/net/filter-mirror.c
index XXXXXXX..XXXXXXX 100644
--- a/net/filter-mirror.c
+++ b/net/filter-mirror.c
@@ -XXX,XX +XXX,XX @@ static void filter_redirector_set_outdev(Object *obj,
     s->outdev = g_strdup(value);
 }
 
+static bool filter_redirector_get_vnet_hdr(Object *obj, Error **errp)
+{
+    MirrorState *s = FILTER_REDIRECTOR(obj);
+
+    return s->vnet_hdr;
+}
+
+static void filter_redirector_set_vnet_hdr(Object *obj,
+                                           bool value,
+                                           Error **errp)
+{
+    MirrorState *s = FILTER_REDIRECTOR(obj);
+
+    s->vnet_hdr = value;
+}
+
 static void filter_mirror_init(Object *obj)
 {
     MirrorState *s = FILTER_MIRROR(obj);
@@ -XXX,XX +XXX,XX @@ static void filter_mirror_init(Object *obj)
 
 static void filter_redirector_init(Object *obj)
 {
+    MirrorState *s = FILTER_REDIRECTOR(obj);
+
     object_property_add_str(obj, "indev", filter_redirector_get_indev,
                             filter_redirector_set_indev, NULL);
     object_property_add_str(obj, "outdev", filter_redirector_get_outdev,
                             filter_redirector_set_outdev, NULL);
+
+    s->vnet_hdr = false;
+    object_property_add_bool(obj, "vnet_hdr_support",
+                             filter_redirector_get_vnet_hdr,
+                             filter_redirector_set_vnet_hdr, NULL);
 }
 
 static void filter_mirror_fini(Object *obj)
diff --git a/qemu-options.hx b/qemu-options.hx
index XXXXXXX..XXXXXXX 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -XXX,XX +XXX,XX @@ queue @var{all|rx|tx} is an option that can be applied to any netfilter.
 
 filter-mirror on netdev @var{netdevid},mirror net packet to chardev@var{chardevid}, if it has the vnet_hdr_support flag, filter-mirror will mirror packet with vnet_hdr_len.
 
-@item -object filter-redirector,id=@var{id},netdev=@var{netdevid},indev=@var{chardevid},
-outdev=@var{chardevid}[,queue=@var{all|rx|tx}]
+@item -object filter-redirector,id=@var{id},netdev=@var{netdevid},indev=@var{chardevid},outdev=@var{chardevid},queue=@var{all|rx|tx}[,vnet_hdr_support]
 
 filter-redirector on netdev @var{netdevid},redirect filter's net packet to chardev
-@var{chardevid},and redirect indev's packet to filter.
+@var{chardevid},and redirect indev's packet to filter.if it has the vnet_hdr_support flag,
+filter-redirector will redirect packet with vnet_hdr_len.
 Create a filter-redirector we need to differ outdev id from indev id, id can not
 be the same. we can just use indev or outdev, but at least one of indev or outdev
 need to be specified.
-- 
2.7.4

From: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>

We can use this property flush and send packet with vnet_hdr_len.

Signed-off-by: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/colo-compare.c    | 8 ++++++--
 net/colo.c            | 3 ++-
 net/colo.h            | 4 +++-
 net/filter-rewriter.c | 2 +-
 4 files changed, 12 insertions(+), 5 deletions(-)

diff --git a/net/colo-compare.c b/net/colo-compare.c
index XXXXXXX..XXXXXXX 100644
--- a/net/colo-compare.c
+++ b/net/colo-compare.c
@@ -XXX,XX +XXX,XX @@ static int packet_enqueue(CompareState *s, int mode)
     Connection *conn;
 
     if (mode == PRIMARY_IN) {
-        pkt = packet_new(s->pri_rs.buf, s->pri_rs.packet_len);
+        pkt = packet_new(s->pri_rs.buf,
+                         s->pri_rs.packet_len,
+                         s->pri_rs.vnet_hdr_len);
     } else {
-        pkt = packet_new(s->sec_rs.buf, s->sec_rs.packet_len);
+        pkt = packet_new(s->sec_rs.buf,
+                         s->sec_rs.packet_len,
+                         s->sec_rs.vnet_hdr_len);
     }
 
     if (parse_packet_early(pkt)) {
diff --git a/net/colo.c b/net/colo.c
index XXXXXXX..XXXXXXX 100644
--- a/net/colo.c
+++ b/net/colo.c
@@ -XXX,XX +XXX,XX @@ void connection_destroy(void *opaque)
     g_slice_free(Connection, conn);
 }
 
-Packet *packet_new(const void *data, int size)
+Packet *packet_new(const void *data, int size, int vnet_hdr_len)
 {
     Packet *pkt = g_slice_new(Packet);
 
     pkt->data = g_memdup(data, size);
     pkt->size = size;
     pkt->creation_ms = qemu_clock_get_ms(QEMU_CLOCK_HOST);
+    pkt->vnet_hdr_len = vnet_hdr_len;
 
     return pkt;
 }
diff --git a/net/colo.h b/net/colo.h
index XXXXXXX..XXXXXXX 100644
--- a/net/colo.h
+++ b/net/colo.h
@@ -XXX,XX +XXX,XX @@ typedef struct Packet {
     int size;
     /* Time of packet creation, in wall clock ms */
     int64_t creation_ms;
+    /* Get vnet_hdr_len from filter */
+    uint32_t vnet_hdr_len;
 } Packet;
 
 typedef struct ConnectionKey {
@@ -XXX,XX +XXX,XX @@ Connection *connection_get(GHashTable *connection_track_table,
                            ConnectionKey *key,
                            GQueue *conn_list);
 void connection_hashtable_reset(GHashTable *connection_track_table);
-Packet *packet_new(const void *data, int size);
+Packet *packet_new(const void *data, int size, int vnet_hdr_len);
 void packet_destroy(void *opaque, void *user_data);
 
 #endif /* QEMU_COLO_PROXY_H */
diff --git a/net/filter-rewriter.c b/net/filter-rewriter.c
index XXXXXXX..XXXXXXX 100644
--- a/net/filter-rewriter.c
+++ b/net/filter-rewriter.c
@@ -XXX,XX +XXX,XX @@ static ssize_t colo_rewriter_receive_iov(NetFilterState *nf,
     char *buf = g_malloc0(size);
 
     iov_to_buf(iov, iovcnt, 0, buf, size);
-    pkt = packet_new(buf, size);
+    pkt = packet_new(buf, size, 0);
     g_free(buf);
 
     /*
-- 
2.7.4

From: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>

This patch change the compare_chr_send() parameter from CharBackend to CompareState,
we can get more information like vnet_hdr(We use it to support packet with vnet_header).

Signed-off-by: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/colo-compare.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/net/colo-compare.c b/net/colo-compare.c
index XXXXXXX..XXXXXXX 100644
--- a/net/colo-compare.c
+++ b/net/colo-compare.c
@@ -XXX,XX +XXX,XX @@ enum {
     SECONDARY_IN,
 };
 
-static int compare_chr_send(CharBackend *out,
+static int compare_chr_send(CompareState *s,
                             const uint8_t *buf,
                             uint32_t size);
 
@@ -XXX,XX +XXX,XX @@ static void colo_compare_connection(void *opaque, void *user_data)
         }
 
         if (result) {
-            ret = compare_chr_send(&s->chr_out, pkt->data, pkt->size);
+            ret = compare_chr_send(s, pkt->data, pkt->size);
             if (ret < 0) {
                 error_report("colo_send_primary_packet failed");
             }
@@ -XXX,XX +XXX,XX @@ static void colo_compare_connection(void *opaque, void *user_data)
     }
 }
 
-static int compare_chr_send(CharBackend *out,
+static int compare_chr_send(CompareState *s,
                             const uint8_t *buf,
                             uint32_t size)
 {
@@ -XXX,XX +XXX,XX @@ static int compare_chr_send(CharBackend *out,
         return 0;
     }
 
-    ret = qemu_chr_fe_write_all(out, (uint8_t *)&len, sizeof(len));
+    ret = qemu_chr_fe_write_all(&s->chr_out, (uint8_t *)&len, sizeof(len));
     if (ret != sizeof(len)) {
         goto err;
     }
 
-    ret = qemu_chr_fe_write_all(out, (uint8_t *)buf, size);
+    ret = qemu_chr_fe_write_all(&s->chr_out, (uint8_t *)buf, size);
     if (ret != size) {
         goto err;
     }
@@ -XXX,XX +XXX,XX @@ static void compare_pri_rs_finalize(SocketReadState *pri_rs)
 
     if (packet_enqueue(s, PRIMARY_IN)) {
         trace_colo_compare_main("primary: unsupported packet in");
-        compare_chr_send(&s->chr_out, pri_rs->buf, pri_rs->packet_len);
+        compare_chr_send(s, pri_rs->buf, pri_rs->packet_len);
     } else {
         /* compare connection */
         g_queue_foreach(&s->conn_list, colo_compare_connection, s);
@@ -XXX,XX +XXX,XX @@ static void colo_flush_packets(void *opaque, void *user_data)
 
     while (!g_queue_is_empty(&conn->primary_list)) {
         pkt = g_queue_pop_head(&conn->primary_list);
-        compare_chr_send(&s->chr_out, pkt->data, pkt->size);
+        compare_chr_send(s, pkt->data, pkt->size);
         packet_destroy(pkt, NULL);
     }
     while (!g_queue_is_empty(&conn->secondary_list)) {
-- 
2.7.4

From: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>

We add the vnet_hdr_support option for colo-compare, default is disabled.
If you use virtio-net-pci or other driver needs vnet_hdr, please enable it.
You can use it for example:
-object colo-compare,id=comp0,primary_in=compare0-0,secondary_in=compare1,outdev=compare_out0,vnet_hdr_support

COLO-compare can get vnet header length from filter,
Add vnet_hdr_len to struct packet and output packet with
the vnet_hdr_len.

Signed-off-by: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/colo-compare.c | 60 +++++++++++++++++++++++++++++++++++++++++++++++-------
 qemu-options.hx    |  4 ++--
 2 files changed, 55 insertions(+), 9 deletions(-)

diff --git a/net/colo-compare.c b/net/colo-compare.c
index XXXXXXX..XXXXXXX 100644
--- a/net/colo-compare.c
+++ b/net/colo-compare.c
@@ -XXX,XX +XXX,XX @@ typedef struct CompareState {
     CharBackend chr_out;
     SocketReadState pri_rs;
     SocketReadState sec_rs;
+    bool vnet_hdr;
 
     /* connection list: the connections belonged to this NIC could be found
      * in this list.
@@ -XXX,XX +XXX,XX @@ enum {
 
 static int compare_chr_send(CompareState *s,
                             const uint8_t *buf,
-                            uint32_t size);
+                            uint32_t size,
+                            uint32_t vnet_hdr_len);
 
 static gint seq_sorter(Packet *a, Packet *b, gpointer data)
 {
@@ -XXX,XX +XXX,XX @@ static void colo_compare_connection(void *opaque, void *user_data)
         }
 
         if (result) {
-            ret = compare_chr_send(s, pkt->data, pkt->size);
+            ret = compare_chr_send(s,
+                                   pkt->data,
+                                   pkt->size,
+                                   pkt->vnet_hdr_len);
             if (ret < 0) {
                 error_report("colo_send_primary_packet failed");
             }
@@ -XXX,XX +XXX,XX @@ static void colo_compare_connection(void *opaque, void *user_data)
 
 static int compare_chr_send(CompareState *s,
                             const uint8_t *buf,
-                            uint32_t size)
+                            uint32_t size,
+                            uint32_t vnet_hdr_len)
 {
     int ret = 0;
     uint32_t len = htonl(size);
@@ -XXX,XX +XXX,XX @@ static int compare_chr_send(CompareState *s,
         goto err;
     }
 
+    if (s->vnet_hdr) {
+        /*
+         * We send vnet header len make other module(like filter-redirector)
+         * know how to parse net packet correctly.
+         */
+        len = htonl(vnet_hdr_len);
+        ret = qemu_chr_fe_write_all(&s->chr_out, (uint8_t *)&len, sizeof(len));
+        if (ret != sizeof(len)) {
+            goto err;
+        }
+    }
+
     ret = qemu_chr_fe_write_all(&s->chr_out, (uint8_t *)buf, size);
     if (ret != size) {
         goto err;
@@ -XXX,XX +XXX,XX @@ static void compare_set_outdev(Object *obj, const char *value, Error **errp)
     s->outdev = g_strdup(value);
 }
 
+static bool compare_get_vnet_hdr(Object *obj, Error **errp)
+{
+    CompareState *s = COLO_COMPARE(obj);
+
+    return s->vnet_hdr;
+}
+
+static void compare_set_vnet_hdr(Object *obj,
+                                 bool value,
+                                 Error **errp)
+{
+    CompareState *s = COLO_COMPARE(obj);
+
+    s->vnet_hdr = value;
+}
+
 static void compare_pri_rs_finalize(SocketReadState *pri_rs)
 {
     CompareState *s = container_of(pri_rs, CompareState, pri_rs);
 
     if (packet_enqueue(s, PRIMARY_IN)) {
         trace_colo_compare_main("primary: unsupported packet in");
-        compare_chr_send(s, pri_rs->buf, pri_rs->packet_len);
+        compare_chr_send(s,
+                         pri_rs->buf,
+                         pri_rs->packet_len,
+                         pri_rs->vnet_hdr_len);
     } else {
         /* compare connection */
         g_queue_foreach(&s->conn_list, colo_compare_connection, s);
@@ -XXX,XX +XXX,XX @@ static void colo_compare_complete(UserCreatable *uc, Error **errp)
         return;
     }
 
-    net_socket_rs_init(&s->pri_rs, compare_pri_rs_finalize, false);
-    net_socket_rs_init(&s->sec_rs, compare_sec_rs_finalize, false);
+    net_socket_rs_init(&s->pri_rs, compare_pri_rs_finalize, s->vnet_hdr);
+    net_socket_rs_init(&s->sec_rs, compare_sec_rs_finalize, s->vnet_hdr);
 
     g_queue_init(&s->conn_list);
 
@@ -XXX,XX +XXX,XX @@ static void colo_flush_packets(void *opaque, void *user_data)
 
     while (!g_queue_is_empty(&conn->primary_list)) {
         pkt = g_queue_pop_head(&conn->primary_list);
-        compare_chr_send(s, pkt->data, pkt->size);
+        compare_chr_send(s,
+                         pkt->data,
+                         pkt->size,
+                         pkt->vnet_hdr_len);
         packet_destroy(pkt, NULL);
     }
     while (!g_queue_is_empty(&conn->secondary_list)) {
@@ -XXX,XX +XXX,XX @@ static void colo_compare_class_init(ObjectClass *oc, void *data)
 
 static void colo_compare_init(Object *obj)
 {
+    CompareState *s = COLO_COMPARE(obj);
+
     object_property_add_str(obj, "primary_in",
                             compare_get_pri_indev, compare_set_pri_indev,
                             NULL);
@@ -XXX,XX +XXX,XX @@ static void colo_compare_init(Object *obj)
     object_property_add_str(obj, "outdev",
                             compare_get_outdev, compare_set_outdev,
                             NULL);
+
+    s->vnet_hdr = false;
+    object_property_add_bool(obj, "vnet_hdr_support", compare_get_vnet_hdr,
+                             compare_set_vnet_hdr, NULL);
 }
 
 static void colo_compare_finalize(Object *obj)
diff --git a/qemu-options.hx b/qemu-options.hx
index XXXXXXX..XXXXXXX 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -XXX,XX +XXX,XX @@ Dump the network traffic on netdev @var{dev} to the file specified by
 The file format is libpcap, so it can be analyzed with tools such as tcpdump
 or Wireshark.
 
-@item -object colo-compare,id=@var{id},primary_in=@var{chardevid},secondary_in=@var{chardevid},
-outdev=@var{chardevid}
+@item -object colo-compare,id=@var{id},primary_in=@var{chardevid},secondary_in=@var{chardevid},outdev=@var{chardevid}[,vnet_hdr_support]
 
 Colo-compare gets packet from primary_in@var{chardevid} and secondary_in@var{chardevid}, than compare primary packet with
 secondary packet. If the packets are same, we will output primary
 packet to outdev@var{chardevid}, else we will notify colo-frame
 do checkpoint and send primary packet to outdev@var{chardevid}.
+if it has the vnet_hdr_support flag, colo compare will send/recv packet with vnet_hdr_len.
 
 we must use it with the help of filter-mirror and filter-redirector.
 
-- 
2.7.4

From: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>

Make colo-compare and filter-rewriter can parse vnet packet.

Signed-off-by: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/colo.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/colo.c b/net/colo.c
index XXXXXXX..XXXXXXX 100644
--- a/net/colo.c
+++ b/net/colo.c
@@ -XXX,XX +XXX,XX @@ int parse_packet_early(Packet *pkt)
 {
     int network_length;
     static const uint8_t vlan[] = {0x81, 0x00};
-    uint8_t *data = pkt->data;
+    uint8_t *data = pkt->data + pkt->vnet_hdr_len;
     uint16_t l3_proto;
     ssize_t l2hdr_len = eth_get_l2_hdr_length(data);
 
-    if (pkt->size < ETH_HLEN) {
+    if (pkt->size < ETH_HLEN + pkt->vnet_hdr_len) {
         trace_colo_proxy_main("pkt->size < ETH_HLEN");
         return 1;
     }
@@ -XXX,XX +XXX,XX @@ int parse_packet_early(Packet *pkt)
     }
 
     network_length = pkt->ip->ip_hl * 4;
-    if (pkt->size < l2hdr_len + network_length) {
+    if (pkt->size < l2hdr_len + network_length + pkt->vnet_hdr_len) {
         trace_colo_proxy_main("pkt->size < network_header + network_length");
         return 1;
     }
-- 
2.7.4

From: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>

COLO-Proxy just focus on packet payload, so we skip vnet header.

Signed-off-by: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/colo-compare.c | 8 ++++++--
 1 file changed, 6 insertions(+), 2 deletions(-)

diff --git a/net/colo-compare.c b/net/colo-compare.c
index XXXXXXX..XXXXXXX 100644
--- a/net/colo-compare.c
+++ b/net/colo-compare.c
@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_common(Packet *ppkt, Packet *spkt, int offset)
                                    sec_ip_src, sec_ip_dst);
     }
 
+    offset = ppkt->vnet_hdr_len + offset;
+
     if (ppkt->size == spkt->size) {
-        return memcmp(ppkt->data + offset, spkt->data + offset,
+        return memcmp(ppkt->data + offset,
+                      spkt->data + offset,
                       spkt->size - offset);
     } else {
         trace_colo_compare_main("Net packet size are not the same");
@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_tcp(Packet *spkt, Packet *ppkt)
      */
     if (ptcp->th_off > 5) {
         ptrdiff_t tcp_offset;
+
         tcp_offset = ppkt->transport_header - (uint8_t *)ppkt->data
-                     + (ptcp->th_off * 4);
+                     + (ptcp->th_off * 4) - ppkt->vnet_hdr_len;
         res = colo_packet_compare_common(ppkt, spkt, tcp_offset);
     } else if (ptcp->th_sum == stcp->th_sum) {
         res = colo_packet_compare_common(ppkt, spkt, ETH_HLEN);
-- 
2.7.4

From: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>

We add the vnet_hdr_support option for filter-rewriter, default is disabled.
If you use virtio-net-pci or other driver needs vnet_hdr, please enable it.
You can use it for example:
-object filter-rewriter,id=rew0,netdev=hn0,queue=all,vnet_hdr_support

We get the vnet_hdr_len from NetClientState that make us
parse net packet correctly.

Signed-off-by: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/filter-rewriter.c | 37 ++++++++++++++++++++++++++++++++++++-
 qemu-options.hx       |  4 ++--
 2 files changed, 38 insertions(+), 3 deletions(-)

diff --git a/net/filter-rewriter.c b/net/filter-rewriter.c
index XXXXXXX..XXXXXXX 100644
--- a/net/filter-rewriter.c
+++ b/net/filter-rewriter.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "qapi/error.h"
 #include "qapi/qmp/qerror.h"
+#include "qemu/error-report.h"
 #include "qapi-visit.h"
 #include "qom/object.h"
 #include "qemu/main-loop.h"
@@ -XXX,XX +XXX,XX @@ typedef struct RewriterState {
     NetQueue *incoming_queue;
     /* hashtable to save connection */
     GHashTable *connection_track_table;
+    bool vnet_hdr;
 } RewriterState;
 
 static void filter_rewriter_flush(NetFilterState *nf)
@@ -XXX,XX +XXX,XX @@ static ssize_t colo_rewriter_receive_iov(NetFilterState *nf,
     ConnectionKey key;
     Packet *pkt;
     ssize_t size = iov_size(iov, iovcnt);
+    ssize_t vnet_hdr_len = 0;
     char *buf = g_malloc0(size);
 
     iov_to_buf(iov, iovcnt, 0, buf, size);
-    pkt = packet_new(buf, size, 0);
+
+    if (s->vnet_hdr) {
+        vnet_hdr_len = nf->netdev->vnet_hdr_len;
+    }
+
+    pkt = packet_new(buf, size, vnet_hdr_len);
     g_free(buf);
 
     /*
@@ -XXX,XX +XXX,XX @@ static void colo_rewriter_setup(NetFilterState *nf, Error **errp)
     s->incoming_queue = qemu_new_net_queue(qemu_netfilter_pass_to_next, nf);
 }
 
+static bool filter_rewriter_get_vnet_hdr(Object *obj, Error **errp)
+{
+    RewriterState *s = FILTER_COLO_REWRITER(obj);
+
+    return s->vnet_hdr;
+}
+
+static void filter_rewriter_set_vnet_hdr(Object *obj,
+                                         bool value,
+                                         Error **errp)
+{
+    RewriterState *s = FILTER_COLO_REWRITER(obj);
+
+    s->vnet_hdr = value;
+}
+
+static void filter_rewriter_init(Object *obj)
+{
+    RewriterState *s = FILTER_COLO_REWRITER(obj);
+
+    s->vnet_hdr = false;
+    object_property_add_bool(obj, "vnet_hdr_support",
+                             filter_rewriter_get_vnet_hdr,
+                             filter_rewriter_set_vnet_hdr, NULL);
+}
+
 static void colo_rewriter_class_init(ObjectClass *oc, void *data)
 {
     NetFilterClass *nfc = NETFILTER_CLASS(oc);
@@ -XXX,XX +XXX,XX @@ static const TypeInfo colo_rewriter_info = {
     .name = TYPE_FILTER_REWRITER,
     .parent = TYPE_NETFILTER,
     .class_init = colo_rewriter_class_init,
+    .instance_init = filter_rewriter_init,
     .instance_size = sizeof(RewriterState),
 };
 
diff --git a/qemu-options.hx b/qemu-options.hx
index XXXXXXX..XXXXXXX 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -XXX,XX +XXX,XX @@ Create a filter-redirector we need to differ outdev id from indev id, id can not
 be the same. we can just use indev or outdev, but at least one of indev or outdev
 need to be specified.
 
-@item -object filter-rewriter,id=@var{id},netdev=@var{netdevid}[,queue=@var{all|rx|tx}]
+@item -object filter-rewriter,id=@var{id},netdev=@var{netdevid},queue=@var{all|rx|tx},[vnet_hdr_support]
 
 Filter-rewriter is a part of COLO project.It will rewrite tcp packet to
 secondary from primary to keep secondary tcp connection,and rewrite
 tcp packet to primary from secondary make tcp packet can be handled by
-client.
+client.if it has the vnet_hdr_support flag, we can parse packet with vnet header.
 
 usage:
 colo secondary:
-- 
2.7.4

From: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>

Signed-off-by: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 docs/colo-proxy.txt | 26 ++++++++++++++++++++++++++
 1 file changed, 26 insertions(+)

diff --git a/docs/colo-proxy.txt b/docs/colo-proxy.txt
index XXXXXXX..XXXXXXX 100644
--- a/docs/colo-proxy.txt
+++ b/docs/colo-proxy.txt
@@ -XXX,XX +XXX,XX @@ Secondary(ip:3.3.3.8):
 -chardev socket,id=red1,host=3.3.3.3,port=9004
 -object filter-redirector,id=f1,netdev=hn0,queue=tx,indev=red0
 -object filter-redirector,id=f2,netdev=hn0,queue=rx,outdev=red1
+-object filter-rewriter,id=f3,netdev=hn0,queue=all
+
+If you want to use virtio-net-pci or other driver with vnet_header:
+
+Primary(ip:3.3.3.3):
+-netdev tap,id=hn0,vhost=off,script=/etc/qemu-ifup,downscript=/etc/qemu-ifdown
+-device e1000,id=e0,netdev=hn0,mac=52:a4:00:12:78:66
+-chardev socket,id=mirror0,host=3.3.3.3,port=9003,server,nowait
+-chardev socket,id=compare1,host=3.3.3.3,port=9004,server,nowait
+-chardev socket,id=compare0,host=3.3.3.3,port=9001,server,nowait
+-chardev socket,id=compare0-0,host=3.3.3.3,port=9001
+-chardev socket,id=compare_out,host=3.3.3.3,port=9005,server,nowait
+-chardev socket,id=compare_out0,host=3.3.3.3,port=9005
+-object filter-mirror,id=m0,netdev=hn0,queue=tx,outdev=mirror0,vnet_hdr_support
+-object filter-redirector,netdev=hn0,id=redire0,queue=rx,indev=compare_out,vnet_hdr_support
+-object filter-redirector,netdev=hn0,id=redire1,queue=rx,outdev=compare0,vnet_hdr_support
+-object colo-compare,id=comp0,primary_in=compare0-0,secondary_in=compare1,outdev=compare_out0,vnet_hdr_support
+
+Secondary(ip:3.3.3.8):
+-netdev tap,id=hn0,vhost=off,script=/etc/qemu-ifup,down script=/etc/qemu-ifdown
+-device e1000,netdev=hn0,mac=52:a4:00:12:78:66
+-chardev socket,id=red0,host=3.3.3.3,port=9003
+-chardev socket,id=red1,host=3.3.3.3,port=9004
+-object filter-redirector,id=f1,netdev=hn0,queue=tx,indev=red0,vnet_hdr_support
+-object filter-redirector,id=f2,netdev=hn0,queue=rx,outdev=red1,vnet_hdr_support
+-object filter-rewriter,id=f3,netdev=hn0,queue=all,vnet_hdr_support
 
 Note:
   a.COLO-proxy must work with COLO-frame and Block-replication.
-- 
2.7.4

From: Michal Privoznik <mprivozn@redhat.com>

We have a function that checks if given number is power of two.
We should prefer it instead of expanding the check on our own.

Signed-off-by: Michal Privoznik <mprivozn@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/virtio-net.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -XXX,XX +XXX,XX @@ static void virtio_net_device_realize(DeviceState *dev, Error **errp)
      */
     if (n->net_conf.rx_queue_size < VIRTIO_NET_RX_QUEUE_MIN_SIZE ||
         n->net_conf.rx_queue_size > VIRTQUEUE_MAX_SIZE ||
-        (n->net_conf.rx_queue_size & (n->net_conf.rx_queue_size - 1))) {
+        !is_power_of_2(n->net_conf.rx_queue_size)) {
         error_setg(errp, "Invalid rx_queue_size (= %" PRIu16 "), "
                    "must be a power of 2 between %d and %d.",
                    n->net_conf.rx_queue_size, VIRTIO_NET_RX_QUEUE_MIN_SIZE,
-- 
2.7.4

The following changes since commit 3f429a3400822141651486193d6af625eeab05a5:

Merge remote-tracking branch 'remotes/kraxel/tags/microvm-20200617-pull-request' into staging (2020-06-18 11:23:15 +0100)

are available in the git repository at:

https://github.com/jasowang/qemu.git tags/net-pull-request

for you to fetch changes up to 71830d8430e65dd20aec4765d87e60336148e1a6:

net: Drop the NetLegacy structure, always use Netdev instead (2020-06-18 21:05:52 +0800)

----------------------------------------------------------------

Changes from V1:
- Fix build failure for virtio-net

----------------------------------------------------------------
Derek Su (1):
      colo-compare: Fix memory leak in packet_enqueue()

Helge Deller (1):
      Fix tulip breakage

Jason Wang (1):
      net: use peer when purging queue in qemu_flush_or_purge_queue_packets()

Lukas Straub (6):
      net/colo-compare.c: Create event_bh with the right AioContext
      chardev/char.c: Use qemu_co_sleep_ns if in coroutine
      net/colo-compare.c: Fix deadlock in compare_chr_send
      net/colo-compare.c: Only hexdump packets if tracing is enabled
      net/colo-compare.c: Check that colo-compare is active
      net/colo-compare.c: Correct ordering in complete and finalize

Philippe Mathieu-Daudé (3):
      hw/net/tulip: Fix 'Descriptor Error' definition
      hw/net/tulip: Log descriptor overflows
      hw/net/e1000e: Do not abort() on invalid PSRCTL register value

Sai Pavan Boddu (11):
      net: cadence_gem: Fix debug statements
      net: cadence_gem: Fix the queue address update during wrap around
      net: cadence_gem: Fix irq update w.r.t queue
      net: cadence_gem: Define access permission for interrupt registers
      net: cadence_gem: Set ISR according to queue in use
      net: cadence_gem: Move tx/rx packet buffert to CadenceGEMState
      net: cadence_gem: Fix up code style
      net: cadence_gem: Add support for jumbo frames
      net: cadnece_gem: Update irq_read_clear field of designcfg_debug1 reg
      net: cadence_gem: Update the reset value for interrupt mask register
      net: cadence_gem: TX_LAST bit should be set by guest

Thomas Huth (2):
      net: Drop the legacy "name" parameter from the -net option
      net: Drop the NetLegacy structure, always use Netdev instead

Tong Ho (1):
      net: cadence_gem: Fix RX address filtering

Yuri Benditovich (7):
      virtio-net: implement RSS configuration command
      virtio-net: implement RX RSS processing
      tap: allow extended virtio header with hash info
      virtio-net: reference implementation of hash report
      vmstate.h: provide VMSTATE_VARRAY_UINT16_ALLOC macro
      virtio-net: add migration support for RSS and hash report
      virtio-net: align RSC fields with updated virtio-net header

From: Yuri Benditovich <yuri.benditovich@daynix.com>

Optionally report RSS feature.
Handle RSS configuration command and keep RSS parameters
in virtio-net device context.

Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/trace-events            |   3 +
 hw/net/virtio-net.c            | 167 ++++++++++++++++++++++++++++++++++++++---
 include/hw/virtio/virtio-net.h |  13 ++++
 3 files changed, 174 insertions(+), 9 deletions(-)

diff --git a/hw/net/trace-events b/hw/net/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/trace-events
+++ b/hw/net/trace-events
@@ -XXX,XX +XXX,XX @@ virtio_net_announce_notify(void) ""
 virtio_net_announce_timer(int round) "%d"
 virtio_net_handle_announce(int round) "%d"
 virtio_net_post_load_device(void)
+virtio_net_rss_disable(void)
+virtio_net_rss_error(const char *msg, uint32_t value) "%s, value 0x%08x"
+virtio_net_rss_enable(uint32_t p1, uint16_t p2, uint8_t p3) "hashes 0x%x, table of %d, key of %d"
 
 # tulip.c
 tulip_reg_write(uint64_t addr, const char *name, int size, uint64_t val) "addr 0x%02"PRIx64" (%s) size %d value 0x%08"PRIx64
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -XXX,XX +XXX,XX @@
    tso/gso/gro 'off'. */
 #define VIRTIO_NET_RSC_DEFAULT_INTERVAL 300000
 
+#define VIRTIO_NET_RSS_SUPPORTED_HASHES (VIRTIO_NET_RSS_HASH_TYPE_IPv4 | \
+                                         VIRTIO_NET_RSS_HASH_TYPE_TCPv4 | \
+                                         VIRTIO_NET_RSS_HASH_TYPE_UDPv4 | \
+                                         VIRTIO_NET_RSS_HASH_TYPE_IPv6 | \
+                                         VIRTIO_NET_RSS_HASH_TYPE_TCPv6 | \
+                                         VIRTIO_NET_RSS_HASH_TYPE_UDPv6 | \
+                                         VIRTIO_NET_RSS_HASH_TYPE_IP_EX | \
+                                         VIRTIO_NET_RSS_HASH_TYPE_TCP_EX | \
+                                         VIRTIO_NET_RSS_HASH_TYPE_UDP_EX)
+
 /* temporary until standard header include it */
 #if !defined(VIRTIO_NET_HDR_F_RSC_INFO)
 
@@ -XXX,XX +XXX,XX @@ static VirtIOFeature feature_sizes[] = {
      .end = endof(struct virtio_net_config, mtu)},
     {.flags = 1ULL << VIRTIO_NET_F_SPEED_DUPLEX,
      .end = endof(struct virtio_net_config, duplex)},
+    {.flags = 1ULL << VIRTIO_NET_F_RSS,
+     .end = endof(struct virtio_net_config, supported_hash_types)},
     {}
 };
 
@@ -XXX,XX +XXX,XX @@ static void virtio_net_get_config(VirtIODevice *vdev, uint8_t *config)
     memcpy(netcfg.mac, n->mac, ETH_ALEN);
     virtio_stl_p(vdev, &netcfg.speed, n->net_conf.speed);
     netcfg.duplex = n->net_conf.duplex;
+    netcfg.rss_max_key_size = VIRTIO_NET_RSS_MAX_KEY_SIZE;
+    virtio_stw_p(vdev, &netcfg.rss_max_indirection_table_length,
+                 VIRTIO_NET_RSS_MAX_TABLE_LEN);
+    virtio_stl_p(vdev, &netcfg.supported_hash_types,
+                 VIRTIO_NET_RSS_SUPPORTED_HASHES);
     memcpy(config, &netcfg, n->config_size);
 }
 
@@ -XXX,XX +XXX,XX @@ static uint64_t virtio_net_get_features(VirtIODevice *vdev, uint64_t features,
         return features;
     }
 
+    virtio_clear_feature(&features, VIRTIO_NET_F_RSS);
     features = vhost_net_get_features(get_vhost_net(nc->peer), features);
     vdev->backend_features = features;
 
@@ -XXX,XX +XXX,XX @@ static void virtio_net_set_features(VirtIODevice *vdev, uint64_t features)
     }
 
     virtio_net_set_multiqueue(n,
+                              virtio_has_feature(features, VIRTIO_NET_F_RSS) ||
                               virtio_has_feature(features, VIRTIO_NET_F_MQ));
 
     virtio_net_set_mrg_rx_bufs(n,
@@ -XXX,XX +XXX,XX @@ static int virtio_net_handle_announce(VirtIONet *n, uint8_t cmd,
     }
 }
 
+static void virtio_net_disable_rss(VirtIONet *n)
+{
+    if (n->rss_data.enabled) {
+        trace_virtio_net_rss_disable();
+    }
+    n->rss_data.enabled = false;
+}
+
+static uint16_t virtio_net_handle_rss(VirtIONet *n,
+                                      struct iovec *iov, unsigned int iov_cnt)
+{
+    VirtIODevice *vdev = VIRTIO_DEVICE(n);
+    struct virtio_net_rss_config cfg;
+    size_t s, offset = 0, size_get;
+    uint16_t queues, i;
+    struct {
+        uint16_t us;
+        uint8_t b;
+    } QEMU_PACKED temp;
+    const char *err_msg = "";
+    uint32_t err_value = 0;
+
+    if (!virtio_vdev_has_feature(vdev, VIRTIO_NET_F_RSS)) {
+        err_msg = "RSS is not negotiated";
+        goto error;
+    }
+    size_get = offsetof(struct virtio_net_rss_config, indirection_table);
+    s = iov_to_buf(iov, iov_cnt, offset, &cfg, size_get);
+    if (s != size_get) {
+        err_msg = "Short command buffer";
+        err_value = (uint32_t)s;
+        goto error;
+    }
+    n->rss_data.hash_types = virtio_ldl_p(vdev, &cfg.hash_types);
+    n->rss_data.indirections_len =
+        virtio_lduw_p(vdev, &cfg.indirection_table_mask);
+    n->rss_data.indirections_len++;
+    if (!is_power_of_2(n->rss_data.indirections_len)) {
+        err_msg = "Invalid size of indirection table";
+        err_value = n->rss_data.indirections_len;
+        goto error;
+    }
+    if (n->rss_data.indirections_len > VIRTIO_NET_RSS_MAX_TABLE_LEN) {
+        err_msg = "Too large indirection table";
+        err_value = n->rss_data.indirections_len;
+        goto error;
+    }
+    n->rss_data.default_queue =
+        virtio_lduw_p(vdev, &cfg.unclassified_queue);
+    if (n->rss_data.default_queue >= n->max_queues) {
+        err_msg = "Invalid default queue";
+        err_value = n->rss_data.default_queue;
+        goto error;
+    }
+    offset += size_get;
+    size_get = sizeof(uint16_t) * n->rss_data.indirections_len;
+    g_free(n->rss_data.indirections_table);
+    n->rss_data.indirections_table = g_malloc(size_get);
+    if (!n->rss_data.indirections_table) {
+        err_msg = "Can't allocate indirections table";
+        err_value = n->rss_data.indirections_len;
+        goto error;
+    }
+    s = iov_to_buf(iov, iov_cnt, offset,
+                   n->rss_data.indirections_table, size_get);
+    if (s != size_get) {
+        err_msg = "Short indirection table buffer";
+        err_value = (uint32_t)s;
+        goto error;
+    }
+    for (i = 0; i < n->rss_data.indirections_len; ++i) {
+        uint16_t val = n->rss_data.indirections_table[i];
+        n->rss_data.indirections_table[i] = virtio_lduw_p(vdev, &val);
+    }
+    offset += size_get;
+    size_get = sizeof(temp);
+    s = iov_to_buf(iov, iov_cnt, offset, &temp, size_get);
+    if (s != size_get) {
+        err_msg = "Can't get queues";
+        err_value = (uint32_t)s;
+        goto error;
+    }
+    queues = virtio_lduw_p(vdev, &temp.us);
+    if (queues == 0 || queues > n->max_queues) {
+        err_msg = "Invalid number of queues";
+        err_value = queues;
+        goto error;
+    }
+    if (temp.b > VIRTIO_NET_RSS_MAX_KEY_SIZE) {
+        err_msg = "Invalid key size";
+        err_value = temp.b;
+        goto error;
+    }
+    if (!temp.b && n->rss_data.hash_types) {
+        err_msg = "No key provided";
+        err_value = 0;
+        goto error;
+    }
+    if (!temp.b && !n->rss_data.hash_types) {
+        virtio_net_disable_rss(n);
+        return queues;
+    }
+    offset += size_get;
+    size_get = temp.b;
+    s = iov_to_buf(iov, iov_cnt, offset, n->rss_data.key, size_get);
+    if (s != size_get) {
+        err_msg = "Can get key buffer";
+        err_value = (uint32_t)s;
+        goto error;
+    }
+    n->rss_data.enabled = true;
+    trace_virtio_net_rss_enable(n->rss_data.hash_types,
+                                n->rss_data.indirections_len,
+                                temp.b);
+    return queues;
+error:
+    trace_virtio_net_rss_error(err_msg, err_value);
+    virtio_net_disable_rss(n);
+    return 0;
+}
+
 static int virtio_net_handle_mq(VirtIONet *n, uint8_t cmd,
                                 struct iovec *iov, unsigned int iov_cnt)
 {
     VirtIODevice *vdev = VIRTIO_DEVICE(n);
-    struct virtio_net_ctrl_mq mq;
-    size_t s;
     uint16_t queues;
 
-    s = iov_to_buf(iov, iov_cnt, 0, &mq, sizeof(mq));
-    if (s != sizeof(mq)) {
-        return VIRTIO_NET_ERR;
-    }
+    virtio_net_disable_rss(n);
+    if (cmd == VIRTIO_NET_CTRL_MQ_RSS_CONFIG) {
+        queues = virtio_net_handle_rss(n, iov, iov_cnt);
+    } else if (cmd == VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET) {
+        struct virtio_net_ctrl_mq mq;
+        size_t s;
+        if (!virtio_vdev_has_feature(vdev, VIRTIO_NET_F_MQ)) {
+            return VIRTIO_NET_ERR;
+        }
+        s = iov_to_buf(iov, iov_cnt, 0, &mq, sizeof(mq));
+        if (s != sizeof(mq)) {
+            return VIRTIO_NET_ERR;
+        }
+        queues = virtio_lduw_p(vdev, &mq.virtqueue_pairs);
 
-    if (cmd != VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET) {
+    } else {
         return VIRTIO_NET_ERR;
     }
 
-    queues = virtio_lduw_p(vdev, &mq.virtqueue_pairs);
-
     if (queues < VIRTIO_NET_CTRL_MQ_VQ_PAIRS_MIN ||
         queues > VIRTIO_NET_CTRL_MQ_VQ_PAIRS_MAX ||
         queues > n->max_queues ||
@@ -XXX,XX +XXX,XX @@ static void virtio_net_device_unrealize(DeviceState *dev)
     g_free(n->vqs);
     qemu_del_nic(n->nic);
     virtio_net_rsc_cleanup(n);
+    g_free(n->rss_data.indirections_table);
     virtio_cleanup(vdev);
 }
 
@@ -XXX,XX +XXX,XX @@ static Property virtio_net_properties[] = {
     DEFINE_PROP_BIT64("ctrl_guest_offloads", VirtIONet, host_features,
                     VIRTIO_NET_F_CTRL_GUEST_OFFLOADS, true),
     DEFINE_PROP_BIT64("mq", VirtIONet, host_features, VIRTIO_NET_F_MQ, false),
+    DEFINE_PROP_BIT64("rss", VirtIONet, host_features,
+                    VIRTIO_NET_F_RSS, false),
     DEFINE_PROP_BIT64("guest_rsc_ext", VirtIONet, host_features,
                     VIRTIO_NET_F_RSC_EXT, false),
     DEFINE_PROP_UINT32("rsc_interval", VirtIONet, rsc_timeout,
diff --git a/include/hw/virtio/virtio-net.h b/include/hw/virtio/virtio-net.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/virtio/virtio-net.h
+++ b/include/hw/virtio/virtio-net.h
@@ -XXX,XX +XXX,XX @@ typedef struct VirtioNetRscChain {
 /* Maximum packet size we can receive from tap device: header + 64k */
 #define VIRTIO_NET_MAX_BUFSIZE (sizeof(struct virtio_net_hdr) + (64 * KiB))
 
+#define VIRTIO_NET_RSS_MAX_KEY_SIZE     40
+#define VIRTIO_NET_RSS_MAX_TABLE_LEN    128
+
+typedef struct VirtioNetRssData {
+    bool    enabled;
+    uint32_t hash_types;
+    uint8_t key[VIRTIO_NET_RSS_MAX_KEY_SIZE];
+    uint16_t indirections_len;
+    uint16_t *indirections_table;
+    uint16_t default_queue;
+} VirtioNetRssData;
+
 typedef struct VirtIONetQueue {
     VirtQueue *rx_vq;
     VirtQueue *tx_vq;
@@ -XXX,XX +XXX,XX @@ struct VirtIONet {
     bool failover;
     DeviceListener primary_listener;
     Notifier migration_state;
+    VirtioNetRssData rss_data;
 };
 
 void virtio_net_set_netclient_name(VirtIONet *n, const char *name,
-- 
2.5.0

From: Yuri Benditovich <yuri.benditovich@daynix.com>

If VIRTIO_NET_F_RSS negotiated and RSS is enabled, process
incoming packets, calculate packet's hash and place the
packet into respective RX virtqueue.

Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/Makefile.objs           |  1 +
 hw/net/virtio-net.c            | 88 +++++++++++++++++++++++++++++++++++++++++-
 include/hw/virtio/virtio-net.h |  1 +
 3 files changed, 88 insertions(+), 2 deletions(-)

diff --git a/hw/net/Makefile.objs b/hw/net/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/Makefile.objs
+++ b/hw/net/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_MILKYMIST) += milkymist-minimac2.o
 obj-$(CONFIG_PSERIES) += spapr_llan.o
 obj-$(CONFIG_XILINX_ETHLITE) += xilinx_ethlite.o
 
+common-obj-$(CONFIG_VIRTIO_NET) += net_rx_pkt.o
 obj-$(CONFIG_VIRTIO_NET) += virtio-net.o
 common-obj-$(call land,$(CONFIG_VIRTIO_NET),$(CONFIG_VHOST_NET)) += vhost_net.o
 common-obj-$(call lnot,$(call land,$(CONFIG_VIRTIO_NET),$(CONFIG_VHOST_NET))) += vhost_net-stub.o
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -XXX,XX +XXX,XX @@
 #include "trace.h"
 #include "monitor/qdev.h"
 #include "hw/pci/pci.h"
+#include "net_rx_pkt.h"
 
 #define VIRTIO_NET_VM_VERSION    11
 
@@ -XXX,XX +XXX,XX @@ static int receive_filter(VirtIONet *n, const uint8_t *buf, int size)
     return 0;
 }
 
+static uint8_t virtio_net_get_hash_type(bool isip4,
+                                        bool isip6,
+                                        bool isudp,
+                                        bool istcp,
+                                        uint32_t types)
+{
+    if (isip4) {
+        if (istcp && (types & VIRTIO_NET_RSS_HASH_TYPE_TCPv4)) {
+            return NetPktRssIpV4Tcp;
+        }
+        if (isudp && (types & VIRTIO_NET_RSS_HASH_TYPE_UDPv4)) {
+            return NetPktRssIpV4Udp;
+        }
+        if (types & VIRTIO_NET_RSS_HASH_TYPE_IPv4) {
+            return NetPktRssIpV4;
+        }
+    } else if (isip6) {
+        uint32_t mask = VIRTIO_NET_RSS_HASH_TYPE_TCP_EX |
+                        VIRTIO_NET_RSS_HASH_TYPE_TCPv6;
+
+        if (istcp && (types & mask)) {
+            return (types & VIRTIO_NET_RSS_HASH_TYPE_TCP_EX) ?
+                NetPktRssIpV6TcpEx : NetPktRssIpV6Tcp;
+        }
+        mask = VIRTIO_NET_RSS_HASH_TYPE_UDP_EX | VIRTIO_NET_RSS_HASH_TYPE_UDPv6;
+        if (isudp && (types & mask)) {
+            return (types & VIRTIO_NET_RSS_HASH_TYPE_UDP_EX) ?
+                NetPktRssIpV6UdpEx : NetPktRssIpV6Udp;
+        }
+        mask = VIRTIO_NET_RSS_HASH_TYPE_IP_EX | VIRTIO_NET_RSS_HASH_TYPE_IPv6;
+        if (types & mask) {
+            return (types & VIRTIO_NET_RSS_HASH_TYPE_IP_EX) ?
+                NetPktRssIpV6Ex : NetPktRssIpV6;
+        }
+    }
+    return 0xff;
+}
+
+static int virtio_net_process_rss(NetClientState *nc, const uint8_t *buf,
+                                  size_t size)
+{
+    VirtIONet *n = qemu_get_nic_opaque(nc);
+    unsigned int index = nc->queue_index, new_index;
+    struct NetRxPkt *pkt = n->rx_pkt;
+    uint8_t net_hash_type;
+    uint32_t hash;
+    bool isip4, isip6, isudp, istcp;
+
+    net_rx_pkt_set_protocols(pkt, buf + n->host_hdr_len,
+                             size - n->host_hdr_len);
+    net_rx_pkt_get_protocols(pkt, &isip4, &isip6, &isudp, &istcp);
+    if (isip4 && (net_rx_pkt_get_ip4_info(pkt)->fragment)) {
+        istcp = isudp = false;
+    }
+    if (isip6 && (net_rx_pkt_get_ip6_info(pkt)->fragment)) {
+        istcp = isudp = false;
+    }
+    net_hash_type = virtio_net_get_hash_type(isip4, isip6, isudp, istcp,
+                                             n->rss_data.hash_types);
+    if (net_hash_type > NetPktRssIpV6UdpEx) {
+        return n->rss_data.default_queue;
+    }
+
+    hash = net_rx_pkt_calc_rss_hash(pkt, net_hash_type, n->rss_data.key);
+    new_index = hash & (n->rss_data.indirections_len - 1);
+    new_index = n->rss_data.indirections_table[new_index];
+    if (index == new_index) {
+        return -1;
+    }
+    return new_index;
+}
+
 static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
-                                      size_t size)
+                                      size_t size, bool no_rss)
 {
     VirtIONet *n = qemu_get_nic_opaque(nc);
     VirtIONetQueue *q = virtio_net_get_subqueue(nc);
@@ -XXX,XX +XXX,XX @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
         return -1;
     }
 
+    if (!no_rss && n->rss_data.enabled) {
+        int index = virtio_net_process_rss(nc, buf, size);
+        if (index >= 0) {
+            NetClientState *nc2 = qemu_get_subqueue(n->nic, index);
+            return virtio_net_receive_rcu(nc2, buf, size, true);
+        }
+    }
+
     /* hdr_len refers to the header we supply to the guest */
     if (!virtio_net_has_buffers(q, size + n->guest_hdr_len - n->host_hdr_len)) {
         return 0;
@@ -XXX,XX +XXX,XX @@ static ssize_t virtio_net_do_receive(NetClientState *nc, const uint8_t *buf,
 {
     RCU_READ_LOCK_GUARD();
 
-    return virtio_net_receive_rcu(nc, buf, size);
+    return virtio_net_receive_rcu(nc, buf, size, false);
 }
 
 static void virtio_net_rsc_extract_unit4(VirtioNetRscChain *chain,
@@ -XXX,XX +XXX,XX @@ static void virtio_net_device_realize(DeviceState *dev, Error **errp)
 
     QTAILQ_INIT(&n->rsc_chains);
     n->qdev = dev;
+
+    net_rx_pkt_init(&n->rx_pkt, false);
 }
 
 static void virtio_net_device_unrealize(DeviceState *dev)
@@ -XXX,XX +XXX,XX @@ static void virtio_net_device_unrealize(DeviceState *dev)
     qemu_del_nic(n->nic);
     virtio_net_rsc_cleanup(n);
     g_free(n->rss_data.indirections_table);
+    net_rx_pkt_uninit(n->rx_pkt);
     virtio_cleanup(vdev);
 }
 
diff --git a/include/hw/virtio/virtio-net.h b/include/hw/virtio/virtio-net.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/virtio/virtio-net.h
+++ b/include/hw/virtio/virtio-net.h
@@ -XXX,XX +XXX,XX @@ struct VirtIONet {
     DeviceListener primary_listener;
     Notifier migration_state;
     VirtioNetRssData rss_data;
+    struct NetRxPkt *rx_pkt;
 };
 
 void virtio_net_set_netclient_name(VirtIONet *n, const char *name,
-- 
2.5.0

From: Yuri Benditovich <yuri.benditovich@daynix.com>

Suggest VIRTIO_NET_F_HASH_REPORT if specified in device
parameters.
If the VIRTIO_NET_F_HASH_REPORT is set,
the device extends configuration space. If the feature
is negotiated, the packet layout is extended to
accomodate the hash information. In this case deliver
packet's hash value and report type in virtio header
extension.
Use for configuration the same procedure as already
used for RSS. We add two fields in rss_data that
controls what the device does with the calculated hash
if rss_data.enabled is set. If field 'populate' is set
the hash is set in the packet, if field 'redirect' is
set the hash is used to decide the queue to place the
packet to.

Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/virtio-net.c            | 99 +++++++++++++++++++++++++++++++++---------
 include/hw/virtio/virtio-net.h |  2 +
 2 files changed, 81 insertions(+), 20 deletions(-)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -XXX,XX +XXX,XX @@ static VirtIOFeature feature_sizes[] = {
      .end = endof(struct virtio_net_config, mtu)},
     {.flags = 1ULL << VIRTIO_NET_F_SPEED_DUPLEX,
      .end = endof(struct virtio_net_config, duplex)},
-    {.flags = 1ULL << VIRTIO_NET_F_RSS,
+    {.flags = (1ULL << VIRTIO_NET_F_RSS) | (1ULL << VIRTIO_NET_F_HASH_REPORT),
      .end = endof(struct virtio_net_config, supported_hash_types)},
     {}
 };
@@ -XXX,XX +XXX,XX @@ static void virtio_net_get_config(VirtIODevice *vdev, uint8_t *config)
     netcfg.duplex = n->net_conf.duplex;
     netcfg.rss_max_key_size = VIRTIO_NET_RSS_MAX_KEY_SIZE;
     virtio_stw_p(vdev, &netcfg.rss_max_indirection_table_length,
-                 VIRTIO_NET_RSS_MAX_TABLE_LEN);
+                 virtio_host_has_feature(vdev, VIRTIO_NET_F_RSS) ?
+                 VIRTIO_NET_RSS_MAX_TABLE_LEN : 1);
     virtio_stl_p(vdev, &netcfg.supported_hash_types,
                  VIRTIO_NET_RSS_SUPPORTED_HASHES);
     memcpy(config, &netcfg, n->config_size);
@@ -XXX,XX +XXX,XX @@ static int peer_has_ufo(VirtIONet *n)
 }
 
 static void virtio_net_set_mrg_rx_bufs(VirtIONet *n, int mergeable_rx_bufs,
-                                       int version_1)
+                                       int version_1, int hash_report)
 {
     int i;
     NetClientState *nc;
@@ -XXX,XX +XXX,XX @@ static void virtio_net_set_mrg_rx_bufs(VirtIONet *n, int mergeable_rx_bufs,
     n->mergeable_rx_bufs = mergeable_rx_bufs;
 
     if (version_1) {
-        n->guest_hdr_len = sizeof(struct virtio_net_hdr_mrg_rxbuf);
+        n->guest_hdr_len = hash_report ?
+            sizeof(struct virtio_net_hdr_v1_hash) :
+            sizeof(struct virtio_net_hdr_mrg_rxbuf);
+        n->rss_data.populate_hash = !!hash_report;
     } else {
         n->guest_hdr_len = n->mergeable_rx_bufs ?
             sizeof(struct virtio_net_hdr_mrg_rxbuf) :
@@ -XXX,XX +XXX,XX @@ static uint64_t virtio_net_get_features(VirtIODevice *vdev, uint64_t features,
         virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_TSO4);
         virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_TSO6);
         virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_ECN);
+
+        virtio_clear_feature(&features, VIRTIO_NET_F_HASH_REPORT);
     }
 
     if (!peer_has_vnet_hdr(n) || !peer_has_ufo(n)) {
@@ -XXX,XX +XXX,XX @@ static uint64_t virtio_net_get_features(VirtIODevice *vdev, uint64_t features,
     }
 
     virtio_clear_feature(&features, VIRTIO_NET_F_RSS);
+    virtio_clear_feature(&features, VIRTIO_NET_F_HASH_REPORT);
     features = vhost_net_get_features(get_vhost_net(nc->peer), features);
     vdev->backend_features = features;
 
@@ -XXX,XX +XXX,XX @@ static void virtio_net_set_features(VirtIODevice *vdev, uint64_t features)
                                virtio_has_feature(features,
                                                   VIRTIO_NET_F_MRG_RXBUF),
                                virtio_has_feature(features,
-                                                  VIRTIO_F_VERSION_1));
+                                                  VIRTIO_F_VERSION_1),
+                               virtio_has_feature(features,
+                                                  VIRTIO_NET_F_HASH_REPORT));
 
     n->rsc4_enabled = virtio_has_feature(features, VIRTIO_NET_F_RSC_EXT) &&
         virtio_has_feature(features, VIRTIO_NET_F_GUEST_TSO4);
     n->rsc6_enabled = virtio_has_feature(features, VIRTIO_NET_F_RSC_EXT) &&
         virtio_has_feature(features, VIRTIO_NET_F_GUEST_TSO6);
+    n->rss_data.redirect = virtio_has_feature(features, VIRTIO_NET_F_RSS);
 
     if (n->has_vnet_hdr) {
         n->curr_guest_offloads =
@@ -XXX,XX +XXX,XX @@ static void virtio_net_disable_rss(VirtIONet *n)
 }
 
 static uint16_t virtio_net_handle_rss(VirtIONet *n,
-                                      struct iovec *iov, unsigned int iov_cnt)
+                                      struct iovec *iov,
+                                      unsigned int iov_cnt,
+                                      bool do_rss)
 {
     VirtIODevice *vdev = VIRTIO_DEVICE(n);
     struct virtio_net_rss_config cfg;
@@ -XXX,XX +XXX,XX @@ static uint16_t virtio_net_handle_rss(VirtIONet *n,
     const char *err_msg = "";
     uint32_t err_value = 0;
 
-    if (!virtio_vdev_has_feature(vdev, VIRTIO_NET_F_RSS)) {
+    if (do_rss && !virtio_vdev_has_feature(vdev, VIRTIO_NET_F_RSS)) {
         err_msg = "RSS is not negotiated";
         goto error;
     }
+    if (!do_rss && !virtio_vdev_has_feature(vdev, VIRTIO_NET_F_HASH_REPORT)) {
+        err_msg = "Hash report is not negotiated";
+        goto error;
+    }
     size_get = offsetof(struct virtio_net_rss_config, indirection_table);
     s = iov_to_buf(iov, iov_cnt, offset, &cfg, size_get);
     if (s != size_get) {
@@ -XXX,XX +XXX,XX @@ static uint16_t virtio_net_handle_rss(VirtIONet *n,
     n->rss_data.indirections_len =
         virtio_lduw_p(vdev, &cfg.indirection_table_mask);
     n->rss_data.indirections_len++;
+    if (!do_rss) {
+        n->rss_data.indirections_len = 1;
+    }
     if (!is_power_of_2(n->rss_data.indirections_len)) {
         err_msg = "Invalid size of indirection table";
         err_value = n->rss_data.indirections_len;
@@ -XXX,XX +XXX,XX @@ static uint16_t virtio_net_handle_rss(VirtIONet *n,
         err_value = n->rss_data.indirections_len;
         goto error;
     }
-    n->rss_data.default_queue =
-        virtio_lduw_p(vdev, &cfg.unclassified_queue);
+    n->rss_data.default_queue = do_rss ?
+        virtio_lduw_p(vdev, &cfg.unclassified_queue) : 0;
     if (n->rss_data.default_queue >= n->max_queues) {
         err_msg = "Invalid default queue";
         err_value = n->rss_data.default_queue;
@@ -XXX,XX +XXX,XX @@ static uint16_t virtio_net_handle_rss(VirtIONet *n,
         err_value = (uint32_t)s;
         goto error;
     }
-    queues = virtio_lduw_p(vdev, &temp.us);
+    queues = do_rss ? virtio_lduw_p(vdev, &temp.us) : n->curr_queues;
     if (queues == 0 || queues > n->max_queues) {
         err_msg = "Invalid number of queues";
         err_value = queues;
@@ -XXX,XX +XXX,XX @@ static int virtio_net_handle_mq(VirtIONet *n, uint8_t cmd,
     uint16_t queues;
 
     virtio_net_disable_rss(n);
+    if (cmd == VIRTIO_NET_CTRL_MQ_HASH_CONFIG) {
+        queues = virtio_net_handle_rss(n, iov, iov_cnt, false);
+        return queues ? VIRTIO_NET_OK : VIRTIO_NET_ERR;
+    }
     if (cmd == VIRTIO_NET_CTRL_MQ_RSS_CONFIG) {
-        queues = virtio_net_handle_rss(n, iov, iov_cnt);
+        queues = virtio_net_handle_rss(n, iov, iov_cnt, true);
     } else if (cmd == VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET) {
         struct virtio_net_ctrl_mq mq;
         size_t s;
@@ -XXX,XX +XXX,XX @@ static uint8_t virtio_net_get_hash_type(bool isip4,
     return 0xff;
 }
 
+static void virtio_set_packet_hash(const uint8_t *buf, uint8_t report,
+                                   uint32_t hash)
+{
+    struct virtio_net_hdr_v1_hash *hdr = (void *)buf;
+    hdr->hash_value = hash;
+    hdr->hash_report = report;
+}
+
 static int virtio_net_process_rss(NetClientState *nc, const uint8_t *buf,
                                   size_t size)
 {
     VirtIONet *n = qemu_get_nic_opaque(nc);
-    unsigned int index = nc->queue_index, new_index;
+    unsigned int index = nc->queue_index, new_index = index;
     struct NetRxPkt *pkt = n->rx_pkt;
     uint8_t net_hash_type;
     uint32_t hash;
     bool isip4, isip6, isudp, istcp;
+    static const uint8_t reports[NetPktRssIpV6UdpEx + 1] = {
+        VIRTIO_NET_HASH_REPORT_IPv4,
+        VIRTIO_NET_HASH_REPORT_TCPv4,
+        VIRTIO_NET_HASH_REPORT_TCPv6,
+        VIRTIO_NET_HASH_REPORT_IPv6,
+        VIRTIO_NET_HASH_REPORT_IPv6_EX,
+        VIRTIO_NET_HASH_REPORT_TCPv6_EX,
+        VIRTIO_NET_HASH_REPORT_UDPv4,
+        VIRTIO_NET_HASH_REPORT_UDPv6,
+        VIRTIO_NET_HASH_REPORT_UDPv6_EX
+    };
 
     net_rx_pkt_set_protocols(pkt, buf + n->host_hdr_len,
                              size - n->host_hdr_len);
@@ -XXX,XX +XXX,XX @@ static int virtio_net_process_rss(NetClientState *nc, const uint8_t *buf,
     net_hash_type = virtio_net_get_hash_type(isip4, isip6, isudp, istcp,
                                              n->rss_data.hash_types);
     if (net_hash_type > NetPktRssIpV6UdpEx) {
-        return n->rss_data.default_queue;
+        if (n->rss_data.populate_hash) {
+            virtio_set_packet_hash(buf, VIRTIO_NET_HASH_REPORT_NONE, 0);
+        }
+        return n->rss_data.redirect ? n->rss_data.default_queue : -1;
     }
 
     hash = net_rx_pkt_calc_rss_hash(pkt, net_hash_type, n->rss_data.key);
-    new_index = hash & (n->rss_data.indirections_len - 1);
-    new_index = n->rss_data.indirections_table[new_index];
-    if (index == new_index) {
-        return -1;
+
+    if (n->rss_data.populate_hash) {
+        virtio_set_packet_hash(buf, reports[net_hash_type], hash);
     }
-    return new_index;
+
+    if (n->rss_data.redirect) {
+        new_index = hash & (n->rss_data.indirections_len - 1);
+        new_index = n->rss_data.indirections_table[new_index];
+    }
+
+    return (index == new_index) ? -1 : new_index;
 }
 
 static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
@@ -XXX,XX +XXX,XX @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
             }
 
             receive_header(n, sg, elem->in_num, buf, size);
+            if (n->rss_data.populate_hash) {
+                offset = sizeof(mhdr);
+                iov_from_buf(sg, elem->in_num, offset,
+                             buf + offset, n->host_hdr_len - sizeof(mhdr));
+            }
             offset = n->host_hdr_len;
             total += n->guest_hdr_len;
             guest_offset = n->guest_hdr_len;
@@ -XXX,XX +XXX,XX @@ static int virtio_net_post_load_device(void *opaque, int version_id)
     trace_virtio_net_post_load_device();
     virtio_net_set_mrg_rx_bufs(n, n->mergeable_rx_bufs,
                                virtio_vdev_has_feature(vdev,
-                                                       VIRTIO_F_VERSION_1));
+                                                       VIRTIO_F_VERSION_1),
+                               virtio_vdev_has_feature(vdev,
+                                                       VIRTIO_NET_F_HASH_REPORT));
 
     /* MAC_TABLE_ENTRIES may be different from the saved image */
     if (n->mac_table.in_use > MAC_TABLE_ENTRIES) {
@@ -XXX,XX +XXX,XX @@ static void virtio_net_device_realize(DeviceState *dev, Error **errp)
 
     n->vqs[0].tx_waiting = 0;
     n->tx_burst = n->net_conf.txburst;
-    virtio_net_set_mrg_rx_bufs(n, 0, 0);
+    virtio_net_set_mrg_rx_bufs(n, 0, 0, 0);
     n->promisc = 1; /* for compatibility */
 
     n->mac_table.macs = g_malloc0(MAC_TABLE_ENTRIES * ETH_ALEN);
@@ -XXX,XX +XXX,XX @@ static Property virtio_net_properties[] = {
     DEFINE_PROP_BIT64("mq", VirtIONet, host_features, VIRTIO_NET_F_MQ, false),
     DEFINE_PROP_BIT64("rss", VirtIONet, host_features,
                     VIRTIO_NET_F_RSS, false),
+    DEFINE_PROP_BIT64("hash", VirtIONet, host_features,
+                    VIRTIO_NET_F_HASH_REPORT, false),
     DEFINE_PROP_BIT64("guest_rsc_ext", VirtIONet, host_features,
                     VIRTIO_NET_F_RSC_EXT, false),
     DEFINE_PROP_UINT32("rsc_interval", VirtIONet, rsc_timeout,
diff --git a/include/hw/virtio/virtio-net.h b/include/hw/virtio/virtio-net.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/virtio/virtio-net.h
+++ b/include/hw/virtio/virtio-net.h
@@ -XXX,XX +XXX,XX @@ typedef struct VirtioNetRscChain {
 
 typedef struct VirtioNetRssData {
     bool    enabled;
+    bool    redirect;
+    bool    populate_hash;
     uint32_t hash_types;
     uint8_t key[VIRTIO_NET_RSS_MAX_KEY_SIZE];
     uint16_t indirections_len;
-- 
2.5.0

From: Yuri Benditovich <yuri.benditovich@daynix.com>

Similar to VMSTATE_VARRAY_UINT32_ALLOC, but the size is
16-bit field.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 include/migration/vmstate.h | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h
index XXXXXXX..XXXXXXX 100644
--- a/include/migration/vmstate.h
+++ b/include/migration/vmstate.h
@@ -XXX,XX +XXX,XX @@ extern const VMStateInfo vmstate_info_qlist;
     .offset     = vmstate_offset_pointer(_state, _field, _type),     \
 }
 
+#define VMSTATE_VARRAY_UINT16_ALLOC(_field, _state, _field_num, _version, _info, _type) {\
+    .name       = (stringify(_field)),                               \
+    .version_id = (_version),                                        \
+    .num_offset = vmstate_offset_value(_state, _field_num, uint16_t),\
+    .info       = &(_info),                                          \
+    .size       = sizeof(_type),                                     \
+    .flags      = VMS_VARRAY_UINT16 | VMS_POINTER | VMS_ALLOC,       \
+    .offset     = vmstate_offset_pointer(_state, _field, _type),     \
+}
+
 #define VMSTATE_VARRAY_UINT16_UNSAFE(_field, _state, _field_num, _version, _info, _type) {\
     .name       = (stringify(_field)),                               \
     .version_id = (_version),                                        \
-- 
2.5.0

From: Yuri Benditovich <yuri.benditovich@daynix.com>

Save and restore RSS/hash report configuration.

Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/virtio-net.c | 37 +++++++++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -XXX,XX +XXX,XX @@ static int virtio_net_post_load_device(void *opaque, int version_id)
         }
     }
 
+    if (n->rss_data.enabled) {
+        trace_virtio_net_rss_enable(n->rss_data.hash_types,
+                                    n->rss_data.indirections_len,
+                                    sizeof(n->rss_data.key));
+    } else {
+        trace_virtio_net_rss_disable();
+    }
     return 0;
 }
 
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_virtio_net_has_vnet = {
     },
 };
 
+static bool virtio_net_rss_needed(void *opaque)
+{
+    return VIRTIO_NET(opaque)->rss_data.enabled;
+}
+
+static const VMStateDescription vmstate_virtio_net_rss = {
+    .name      = "virtio-net-device/rss",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .needed = virtio_net_rss_needed,
+    .fields = (VMStateField[]) {
+        VMSTATE_BOOL(rss_data.enabled, VirtIONet),
+        VMSTATE_BOOL(rss_data.redirect, VirtIONet),
+        VMSTATE_BOOL(rss_data.populate_hash, VirtIONet),
+        VMSTATE_UINT32(rss_data.hash_types, VirtIONet),
+        VMSTATE_UINT16(rss_data.indirections_len, VirtIONet),
+        VMSTATE_UINT16(rss_data.default_queue, VirtIONet),
+        VMSTATE_UINT8_ARRAY(rss_data.key, VirtIONet,
+                            VIRTIO_NET_RSS_MAX_KEY_SIZE),
+        VMSTATE_VARRAY_UINT16_ALLOC(rss_data.indirections_table, VirtIONet,
+                                    rss_data.indirections_len, 0,
+                                    vmstate_info_uint16, uint16_t),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
 static const VMStateDescription vmstate_virtio_net_device = {
     .name = "virtio-net-device",
     .version_id = VIRTIO_NET_VM_VERSION,
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_virtio_net_device = {
                             has_ctrl_guest_offloads),
         VMSTATE_END_OF_LIST()
    },
+    .subsections = (const VMStateDescription * []) {
+        &vmstate_virtio_net_rss,
+        NULL
+    }
 };
 
 static NetClientInfo net_virtio_info = {
-- 
2.5.0

From: Yuri Benditovich <yuri.benditovich@daynix.com>

Removal of duplicated RSC definitions. Changing names of the
fields to ones defined in the Linux header.

Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/virtio-net.c | 28 ++++------------------------
 1 file changed, 4 insertions(+), 24 deletions(-)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -XXX,XX +XXX,XX @@
                                          VIRTIO_NET_RSS_HASH_TYPE_TCP_EX | \
                                          VIRTIO_NET_RSS_HASH_TYPE_UDP_EX)
 
-/* temporary until standard header include it */
-#if !defined(VIRTIO_NET_HDR_F_RSC_INFO)
-
-#define VIRTIO_NET_HDR_F_RSC_INFO  4 /* rsc_ext data in csum_ fields */
-#define VIRTIO_NET_F_RSC_EXT       61
-
-#endif
-
-static inline __virtio16 *virtio_net_rsc_ext_num_packets(
-    struct virtio_net_hdr *hdr)
-{
-    return &hdr->csum_start;
-}
-
-static inline __virtio16 *virtio_net_rsc_ext_num_dupacks(
-    struct virtio_net_hdr *hdr)
-{
-    return &hdr->csum_offset;
-}
-
 static VirtIOFeature feature_sizes[] = {
     {.flags = 1ULL << VIRTIO_NET_F_MAC,
      .end = endof(struct virtio_net_config, mac)},
@@ -XXX,XX +XXX,XX @@ static size_t virtio_net_rsc_drain_seg(VirtioNetRscChain *chain,
                                        VirtioNetRscSeg *seg)
 {
     int ret;
-    struct virtio_net_hdr *h;
+    struct virtio_net_hdr_v1 *h;
 
-    h = (struct virtio_net_hdr *)seg->buf;
+    h = (struct virtio_net_hdr_v1 *)seg->buf;
     h->flags = 0;
     h->gso_type = VIRTIO_NET_HDR_GSO_NONE;
 
     if (seg->is_coalesced) {
-        *virtio_net_rsc_ext_num_packets(h) = seg->packets;
-        *virtio_net_rsc_ext_num_dupacks(h) = seg->dup_ack;
+        h->rsc.segments = seg->packets;
+        h->rsc.dup_acks = seg->dup_ack;
         h->flags = VIRTIO_NET_HDR_F_RSC_INFO;
         if (chain->proto == ETH_P_IP) {
             h->gso_type = VIRTIO_NET_HDR_GSO_TCPV4;
-- 
2.5.0

From: Helge Deller <deller@gmx.de>

The tulip network driver in a qemu-system-hppa emulation is broken in
the sense that bigger network packages aren't received any longer and
thus even running e.g. "apt update" inside the VM fails.

The breakage was introduced by commit 8ffb7265af ("check frame size and
r/w data length") which added checks to prevent accesses outside of the
rx/tx buffers.

But the new checks were implemented wrong. The variable rx_frame_len
counts backwards, from rx_frame_size down to zero, and the variable len
is never bigger than rx_frame_len, so accesses just can't happen and the
checks are unnecessary.
On the contrary the checks now prevented bigger packages to be moved
into the rx buffers.

This patch reverts the wrong checks and were sucessfully tested with a
qemu-system-hppa emulation.

Fixes: 8ffb7265af ("check frame size and r/w data length")
Buglink: https://bugs.launchpad.net/bugs/1874539
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/tulip.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/hw/net/tulip.c b/hw/net/tulip.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/tulip.c
+++ b/hw/net/tulip.c
@@ -XXX,XX +XXX,XX @@ static void tulip_copy_rx_bytes(TULIPState *s, struct tulip_descriptor *desc)
             len = s->rx_frame_len;
         }
 
-        if (s->rx_frame_len + len > sizeof(s->rx_frame)) {
-            return;
-        }
         pci_dma_write(&s->dev, desc->buf_addr1, s->rx_frame +
             (s->rx_frame_size - s->rx_frame_len), len);
         s->rx_frame_len -= len;
@@ -XXX,XX +XXX,XX @@ static void tulip_copy_rx_bytes(TULIPState *s, struct tulip_descriptor *desc)
             len = s->rx_frame_len;
         }
 
-        if (s->rx_frame_len + len > sizeof(s->rx_frame)) {
-            return;
-        }
         pci_dma_write(&s->dev, desc->buf_addr2, s->rx_frame +
             (s->rx_frame_size - s->rx_frame_len), len);
         s->rx_frame_len -= len;
-- 
2.5.0

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Log with GUEST_ERROR what the guest is doing wrong.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/tulip.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/hw/net/tulip.c b/hw/net/tulip.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/tulip.c
+++ b/hw/net/tulip.c
@@ -XXX,XX +XXX,XX @@ static int tulip_copy_tx_buffers(TULIPState *s, struct tulip_descriptor *desc)
     int len2 = (desc->control >> TDES1_BUF2_SIZE_SHIFT) & TDES1_BUF2_SIZE_MASK;
 
     if (s->tx_frame_len + len1 > sizeof(s->tx_frame)) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: descriptor overflow (ofs: %u, len:%d, size:%zu)\n",
+                      __func__, s->tx_frame_len, len1, sizeof(s->tx_frame));
         return -1;
     }
     if (len1) {
@@ -XXX,XX +XXX,XX @@ static int tulip_copy_tx_buffers(TULIPState *s, struct tulip_descriptor *desc)
     }
 
     if (s->tx_frame_len + len2 > sizeof(s->tx_frame)) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: descriptor overflow (ofs: %u, len:%d, size:%zu)\n",
+                      __func__, s->tx_frame_len, len2, sizeof(s->tx_frame));
         return -1;
     }
     if (len2) {
-- 
2.5.0

From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>

Enabling debug breaks the build, Fix them and make debug statements
always compilable. Fix few statements to use sized integer casting.

Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/cadence_gem.c | 27 +++++++++++++--------------
 1 file changed, 13 insertions(+), 14 deletions(-)

diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/dma.h"
 #include "net/checksum.h"
 
-#ifdef CADENCE_GEM_ERR_DEBUG
-#define DB_PRINT(...) do { \
-    fprintf(stderr,  ": %s: ", __func__); \
-    fprintf(stderr, ## __VA_ARGS__); \
-    } while (0)
-#else
-    #define DB_PRINT(...)
-#endif
+#define CADENCE_GEM_ERR_DEBUG 0
+#define DB_PRINT(...) do {\
+    if (CADENCE_GEM_ERR_DEBUG) {   \
+        qemu_log(": %s: ", __func__); \
+        qemu_log(__VA_ARGS__); \
+    } \
+} while (0)
 
 #define GEM_NWCTRL        (0x00000000/4) /* Network Control reg */
 #define GEM_NWCFG         (0x00000004/4) /* Network Config reg */
@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
         size += 4;
     }
 
-    DB_PRINT("config bufsize: %d packet size: %ld\n", rxbufsize, size);
+    DB_PRINT("config bufsize: %u packet size: %zd\n", rxbufsize, size);
 
     /* Find which queue we are targeting */
     q = get_queue_from_screen(s, rxbuf_ptr, rxbufsize);
@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
             return -1;
         }
 
-        DB_PRINT("copy %u bytes to 0x%" PRIx64 "\n",
-                 MIN(bytes_to_copy, rxbufsize),
-                 rx_desc_get_buffer(s, s->rx_desc[q]));
+        DB_PRINT("copy %" PRIu32 " bytes to 0x%" PRIx64 "\n",
+                MIN(bytes_to_copy, rxbufsize),
+                rx_desc_get_buffer(s, s->rx_desc[q]));
 
         /* Copy packet data to emulated DMA buffer */
         address_space_write(&s->dma_as, rx_desc_get_buffer(s, s->rx_desc[q]) +
@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
              */
             if ((tx_desc_get_buffer(s, desc) == 0) ||
                 (tx_desc_get_length(desc) == 0)) {
-                DB_PRINT("Invalid TX descriptor @ 0x%x\n",
-                         (unsigned)packet_desc_addr);
+                DB_PRINT("Invalid TX descriptor @ 0x%" HWADDR_PRIx "\n",
+                         packet_desc_addr);
                 break;
             }
 
-- 
2.5.0

From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>

During wrap around and reset, queues are pointing to initial base
address of queue 0, irrespective of what queue we are dealing with.
Fix it by assigning proper base address every time.

Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/cadence_gem.c | 37 +++++++++++++++++++++++++++++++++----
 1 file changed, 33 insertions(+), 4 deletions(-)

diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -XXX,XX +XXX,XX @@ static int get_queue_from_screen(CadenceGEMState *s, uint8_t *rxbuf_ptr,
     return 0;
 }
 
+static uint32_t gem_get_queue_base_addr(CadenceGEMState *s, bool tx, int q)
+{
+    uint32_t base_addr = 0;
+
+    switch (q) {
+    case 0:
+        base_addr = s->regs[tx ? GEM_TXQBASE : GEM_RXQBASE];
+        break;
+    case 1 ... (MAX_PRIORITY_QUEUES - 1):
+        base_addr = s->regs[(tx ? GEM_TRANSMIT_Q1_PTR :
+                                 GEM_RECEIVE_Q1_PTR) + q - 1];
+        break;
+    default:
+        g_assert_not_reached();
+    };
+
+    return base_addr;
+}
+
+static inline uint32_t gem_get_tx_queue_base_addr(CadenceGEMState *s, int q)
+{
+    return gem_get_queue_base_addr(s, true, q);
+}
+
+static inline uint32_t gem_get_rx_queue_base_addr(CadenceGEMState *s, int q)
+{
+    return gem_get_queue_base_addr(s, false, q);
+}
+
 static hwaddr gem_get_desc_addr(CadenceGEMState *s, bool tx, int q)
 {
     hwaddr desc_addr = 0;
@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
         /* Next descriptor */
         if (rx_desc_get_wrap(s->rx_desc[q])) {
             DB_PRINT("wrapping RX descriptor list\n");
-            s->rx_desc_addr[q] = s->regs[GEM_RXQBASE];
+            s->rx_desc_addr[q] = gem_get_rx_queue_base_addr(s, q);
         } else {
             DB_PRINT("incrementing RX descriptor list\n");
             s->rx_desc_addr[q] += 4 * gem_get_desc_len(s, true);
@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
                                     sizeof(desc_first));
                 /* Advance the hardware current descriptor past this packet */
                 if (tx_desc_get_wrap(desc)) {
-                    s->tx_desc_addr[q] = s->regs[GEM_TXQBASE];
+                    s->tx_desc_addr[q] = gem_get_tx_queue_base_addr(s, q);
                 } else {
                     s->tx_desc_addr[q] = packet_desc_addr +
                                          4 * gem_get_desc_len(s, false);
@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
                 } else {
                     packet_desc_addr = 0;
                 }
-                packet_desc_addr |= s->regs[GEM_TXQBASE];
+                packet_desc_addr |= gem_get_tx_queue_base_addr(s, q);
             } else {
                 packet_desc_addr += 4 * gem_get_desc_len(s, false);
             }
@@ -XXX,XX +XXX,XX @@ static void gem_write(void *opaque, hwaddr offset, uint64_t val,
         if (!(val & GEM_NWCTRL_TXENA)) {
             /* Reset to start of Q when transmit disabled. */
             for (i = 0; i < s->num_priority_queues; i++) {
-                s->tx_desc_addr[i] = s->regs[GEM_TXQBASE];
+                s->tx_desc_addr[i] = gem_get_tx_queue_base_addr(s, i);
             }
         }
         if (gem_can_receive(qemu_get_queue(s->nic))) {
-- 
2.5.0

From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>

Set irq's specific to a queue, present implementation is setting q1 irq
based on q0 status.

Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/cadence_gem.c | 25 +++----------------------
 1 file changed, 3 insertions(+), 22 deletions(-)

diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -XXX,XX +XXX,XX @@ static void gem_update_int_status(CadenceGEMState *s)
 {
     int i;
 
-    if (!s->regs[GEM_ISR]) {
-        /* ISR isn't set, clear all the interrupts */
-        for (i = 0; i < s->num_priority_queues; ++i) {
-            qemu_set_irq(s->irq[i], 0);
-        }
-        return;
-    }
+    qemu_set_irq(s->irq[0], !!s->regs[GEM_ISR]);
 
-    /* If we get here we know s->regs[GEM_ISR] is set, so we don't need to
-     * check it again.
-     */
-    if (s->num_priority_queues == 1) {
-        /* No priority queues, just trigger the interrupt */
-        DB_PRINT("asserting int.\n");
-        qemu_set_irq(s->irq[0], 1);
-        return;
-    }
-
-    for (i = 0; i < s->num_priority_queues; ++i) {
-        if (s->regs[GEM_INT_Q1_STATUS + i]) {
-            DB_PRINT("asserting int. (q=%d)\n", i);
-            qemu_set_irq(s->irq[i], 1);
-        }
+    for (i = 1; i < s->num_priority_queues; ++i) {
+        qemu_set_irq(s->irq[i], !!s->regs[GEM_INT_Q1_STATUS + i - 1]);
     }
 }
 
-- 
2.5.0

From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>

Q1 to Q7 ISR's are clear-on-read, IER/IDR registers
are write-only, mask reg are read-only.

Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/cadence_gem.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -XXX,XX +XXX,XX @@ static const uint8_t broadcast_addr[] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
  */
 static void gem_init_register_masks(CadenceGEMState *s)
 {
+    unsigned int i;
     /* Mask of register bits which are read only */
     memset(&s->regs_ro[0], 0, sizeof(s->regs_ro));
     s->regs_ro[GEM_NWCTRL]   = 0xFFF80000;
@@ -XXX,XX +XXX,XX @@ static void gem_init_register_masks(CadenceGEMState *s)
     s->regs_ro[GEM_ISR]      = 0xFFFFFFFF;
     s->regs_ro[GEM_IMR]      = 0xFFFFFFFF;
     s->regs_ro[GEM_MODID]    = 0xFFFFFFFF;
+    for (i = 0; i < s->num_priority_queues; i++) {
+        s->regs_ro[GEM_INT_Q1_STATUS + i] = 0xFFFFFFFF;
+        s->regs_ro[GEM_INT_Q1_ENABLE + i] = 0xFFFFF319;
+        s->regs_ro[GEM_INT_Q1_DISABLE + i] = 0xFFFFF319;
+        s->regs_ro[GEM_INT_Q1_MASK + i] = 0xFFFFFFFF;
+    }
 
     /* Mask of register bits which are clear on read */
     memset(&s->regs_rtc[0], 0, sizeof(s->regs_rtc));
     s->regs_rtc[GEM_ISR]      = 0xFFFFFFFF;
+    for (i = 0; i < s->num_priority_queues; i++) {
+        s->regs_rtc[GEM_INT_Q1_STATUS + i] = 0x00000CE6;
+    }
 
     /* Mask of register bits which are write 1 to clear */
     memset(&s->regs_w1c[0], 0, sizeof(s->regs_w1c));
@@ -XXX,XX +XXX,XX @@ static void gem_init_register_masks(CadenceGEMState *s)
     s->regs_wo[GEM_NWCTRL]   = 0x00073E60;
     s->regs_wo[GEM_IER]      = 0x07FFFFFF;
     s->regs_wo[GEM_IDR]      = 0x07FFFFFF;
+    for (i = 0; i < s->num_priority_queues; i++) {
+        s->regs_wo[GEM_INT_Q1_ENABLE + i] = 0x00000CE6;
+        s->regs_wo[GEM_INT_Q1_DISABLE + i] = 0x00000CE6;
+    }
 }
 
 /*
-- 
2.5.0

From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>

Set ISR according to queue in use, added interrupt support for
all queues.

Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/cadence_gem.c | 27 +++++++++++++++++----------
 1 file changed, 17 insertions(+), 10 deletions(-)

diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -XXX,XX +XXX,XX @@ static inline void rx_desc_set_sar(uint32_t *desc, int sar_idx)
 /* The broadcast MAC address: 0xFFFFFFFFFFFF */
 static const uint8_t broadcast_addr[] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
 
+static void gem_set_isr(CadenceGEMState *s, int q, uint32_t flag)
+{
+    if (q == 0) {
+        s->regs[GEM_ISR] |= flag & ~(s->regs[GEM_IMR]);
+    } else {
+        s->regs[GEM_INT_Q1_STATUS + q - 1] |= flag &
+                                      ~(s->regs[GEM_INT_Q1_MASK + q - 1]);
+    }
+}
+
 /*
  * gem_init_register_masks:
  * One time initialization.
@@ -XXX,XX +XXX,XX @@ static void gem_get_rx_desc(CadenceGEMState *s, int q)
     if (rx_desc_get_ownership(s->rx_desc[q]) == 1) {
         DB_PRINT("descriptor 0x%" HWADDR_PRIx " owned by sw.\n", desc_addr);
         s->regs[GEM_RXSTATUS] |= GEM_RXSTATUS_NOBUF;
-        s->regs[GEM_ISR] |= GEM_INT_RXUSED & ~(s->regs[GEM_IMR]);
+        gem_set_isr(s, q, GEM_INT_RXUSED);
         /* Handle interrupt consequences */
         gem_update_int_status(s);
     }
@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
     gem_receive_updatestats(s, buf, size);
 
     s->regs[GEM_RXSTATUS] |= GEM_RXSTATUS_FRMRCVD;
-    s->regs[GEM_ISR] |= GEM_INT_RXCMPL & ~(s->regs[GEM_IMR]);
+    gem_set_isr(s, q, GEM_INT_RXCMPL);
 
     /* Handle interrupt consequences */
     gem_update_int_status(s);
@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
                 DB_PRINT("TX descriptor next: 0x%08x\n", s->tx_desc_addr[q]);
 
                 s->regs[GEM_TXSTATUS] |= GEM_TXSTATUS_TXCMPL;
-                s->regs[GEM_ISR] |= GEM_INT_TXCMPL & ~(s->regs[GEM_IMR]);
-
-                /* Update queue interrupt status */
-                if (s->num_priority_queues > 1) {
-                    s->regs[GEM_INT_Q1_STATUS + q] |=
-                            GEM_INT_TXCMPL & ~(s->regs[GEM_INT_Q1_MASK + q]);
-                }
+                gem_set_isr(s, q, GEM_INT_TXCMPL);
 
                 /* Handle interrupt consequences */
                 gem_update_int_status(s);
@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
 
         if (tx_desc_get_used(desc)) {
             s->regs[GEM_TXSTATUS] |= GEM_TXSTATUS_USED;
-            s->regs[GEM_ISR] |= GEM_INT_TXUSED & ~(s->regs[GEM_IMR]);
+            /* IRQ TXUSED is defined only for queue 0 */
+            if (q == 0) {
+                gem_set_isr(s, 0, GEM_INT_TXUSED);
+            }
             gem_update_int_status(s);
         }
     }
-- 
2.5.0

From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>

Moving this buffers to CadenceGEMState, as their size will be increased
more when JUMBO frames support is added.

Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/cadence_gem.c         | 38 +++++++++++++++++---------------------
 include/hw/net/cadence_gem.h |  4 ++++
 2 files changed, 21 insertions(+), 21 deletions(-)

diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -XXX,XX +XXX,XX @@ static void gem_get_rx_desc(CadenceGEMState *s, int q)
  */
 static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
 {
-    CadenceGEMState *s;
+    CadenceGEMState *s = qemu_get_nic_opaque(nc);
     unsigned   rxbufsize, bytes_to_copy;
     unsigned   rxbuf_offset;
-    uint8_t    rxbuf[2048];
     uint8_t   *rxbuf_ptr;
     bool first_desc = true;
     int maf;
     int q = 0;
 
-    s = qemu_get_nic_opaque(nc);
-
     /* Is this destination MAC address "for us" ? */
     maf = gem_mac_address_filter(s, buf);
     if (maf == GEM_RX_REJECT) {
@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
     } else {
         unsigned crc_val;
 
-        if (size > sizeof(rxbuf) - sizeof(crc_val)) {
-            size = sizeof(rxbuf) - sizeof(crc_val);
+        if (size > MAX_FRAME_SIZE - sizeof(crc_val)) {
+            size = MAX_FRAME_SIZE - sizeof(crc_val);
         }
         bytes_to_copy = size;
         /* The application wants the FCS field, which QEMU does not provide.
          * We must try and calculate one.
          */
 
-        memcpy(rxbuf, buf, size);
-        memset(rxbuf + size, 0, sizeof(rxbuf) - size);
-        rxbuf_ptr = rxbuf;
-        crc_val = cpu_to_le32(crc32(0, rxbuf, MAX(size, 60)));
-        memcpy(rxbuf + size, &crc_val, sizeof(crc_val));
+        memcpy(s->rx_packet, buf, size);
+        memset(s->rx_packet + size, 0, MAX_FRAME_SIZE - size);
+        rxbuf_ptr = s->rx_packet;
+        crc_val = cpu_to_le32(crc32(0, s->rx_packet, MAX(size, 60)));
+        memcpy(s->rx_packet + size, &crc_val, sizeof(crc_val));
 
         bytes_to_copy += 4;
         size += 4;
@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
 {
     uint32_t desc[DESC_MAX_NUM_WORDS];
     hwaddr packet_desc_addr;
-    uint8_t     tx_packet[2048];
     uint8_t     *p;
     unsigned    total_bytes;
     int q = 0;
@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
      * Packets scattered across multiple descriptors are gathered to this
      * one contiguous buffer first.
      */
-    p = tx_packet;
+    p = s->tx_packet;
     total_bytes = 0;
 
     for (q = s->num_priority_queues - 1; q >= 0; q--) {
@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
                 break;
             }
 
-            if (tx_desc_get_length(desc) > sizeof(tx_packet) -
-                                               (p - tx_packet)) {
+            if (tx_desc_get_length(desc) > MAX_FRAME_SIZE -
+                                               (p - s->tx_packet)) {
                 DB_PRINT("TX descriptor @ 0x%" HWADDR_PRIx \
                          " too large: size 0x%x space 0x%zx\n",
                          packet_desc_addr, tx_desc_get_length(desc),
-                         sizeof(tx_packet) - (p - tx_packet));
+                         MAX_FRAME_SIZE - (p - s->tx_packet));
                 break;
             }
 
@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
 
                 /* Is checksum offload enabled? */
                 if (s->regs[GEM_DMACFG] & GEM_DMACFG_TXCSUM_OFFL) {
-                    net_checksum_calculate(tx_packet, total_bytes);
+                    net_checksum_calculate(s->tx_packet, total_bytes);
                 }
 
                 /* Update MAC statistics */
-                gem_transmit_updatestats(s, tx_packet, total_bytes);
+                gem_transmit_updatestats(s, s->tx_packet, total_bytes);
 
                 /* Send the packet somewhere */
                 if (s->phy_loop || (s->regs[GEM_NWCTRL] &
                                     GEM_NWCTRL_LOCALLOOP)) {
-                    gem_receive(qemu_get_queue(s->nic), tx_packet,
+                    gem_receive(qemu_get_queue(s->nic), s->tx_packet,
                                 total_bytes);
                 } else {
-                    qemu_send_packet(qemu_get_queue(s->nic), tx_packet,
+                    qemu_send_packet(qemu_get_queue(s->nic), s->tx_packet,
                                      total_bytes);
                 }
 
                 /* Prepare for next packet */
-                p = tx_packet;
+                p = s->tx_packet;
                 total_bytes = 0;
             }
 
diff --git a/include/hw/net/cadence_gem.h b/include/hw/net/cadence_gem.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/net/cadence_gem.h
+++ b/include/hw/net/cadence_gem.h
@@ -XXX,XX +XXX,XX @@
 #define MAX_TYPE1_SCREENERS             16
 #define MAX_TYPE2_SCREENERS             16
 
+#define MAX_FRAME_SIZE 2048
+
 typedef struct CadenceGEMState {
     /*< private >*/
     SysBusDevice parent_obj;
@@ -XXX,XX +XXX,XX @@ typedef struct CadenceGEMState {
 
     uint8_t can_rx_state; /* Debug only */
 
+    uint8_t tx_packet[MAX_FRAME_SIZE];
+    uint8_t rx_packet[MAX_FRAME_SIZE];
     uint32_t rx_desc[MAX_PRIORITY_QUEUES][DESC_MAX_NUM_WORDS];
 
     bool sar_active[4];
-- 
2.5.0

From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>

Fix the code style for register definitions.

Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/cadence_gem.c | 204 ++++++++++++++++++++++++++-------------------------
 1 file changed, 103 insertions(+), 101 deletions(-)

diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -XXX,XX +XXX,XX @@
     } \
 } while (0)
 
-#define GEM_NWCTRL        (0x00000000/4) /* Network Control reg */
-#define GEM_NWCFG         (0x00000004/4) /* Network Config reg */
-#define GEM_NWSTATUS      (0x00000008/4) /* Network Status reg */
-#define GEM_USERIO        (0x0000000C/4) /* User IO reg */
-#define GEM_DMACFG        (0x00000010/4) /* DMA Control reg */
-#define GEM_TXSTATUS      (0x00000014/4) /* TX Status reg */
-#define GEM_RXQBASE       (0x00000018/4) /* RX Q Base address reg */
-#define GEM_TXQBASE       (0x0000001C/4) /* TX Q Base address reg */
-#define GEM_RXSTATUS      (0x00000020/4) /* RX Status reg */
-#define GEM_ISR           (0x00000024/4) /* Interrupt Status reg */
-#define GEM_IER           (0x00000028/4) /* Interrupt Enable reg */
-#define GEM_IDR           (0x0000002C/4) /* Interrupt Disable reg */
-#define GEM_IMR           (0x00000030/4) /* Interrupt Mask reg */
-#define GEM_PHYMNTNC      (0x00000034/4) /* Phy Maintenance reg */
-#define GEM_RXPAUSE       (0x00000038/4) /* RX Pause Time reg */
-#define GEM_TXPAUSE       (0x0000003C/4) /* TX Pause Time reg */
-#define GEM_TXPARTIALSF   (0x00000040/4) /* TX Partial Store and Forward */
-#define GEM_RXPARTIALSF   (0x00000044/4) /* RX Partial Store and Forward */
-#define GEM_HASHLO        (0x00000080/4) /* Hash Low address reg */
-#define GEM_HASHHI        (0x00000084/4) /* Hash High address reg */
-#define GEM_SPADDR1LO     (0x00000088/4) /* Specific addr 1 low reg */
-#define GEM_SPADDR1HI     (0x0000008C/4) /* Specific addr 1 high reg */
-#define GEM_SPADDR2LO     (0x00000090/4) /* Specific addr 2 low reg */
-#define GEM_SPADDR2HI     (0x00000094/4) /* Specific addr 2 high reg */
-#define GEM_SPADDR3LO     (0x00000098/4) /* Specific addr 3 low reg */
-#define GEM_SPADDR3HI     (0x0000009C/4) /* Specific addr 3 high reg */
-#define GEM_SPADDR4LO     (0x000000A0/4) /* Specific addr 4 low reg */
-#define GEM_SPADDR4HI     (0x000000A4/4) /* Specific addr 4 high reg */
-#define GEM_TIDMATCH1     (0x000000A8/4) /* Type ID1 Match reg */
-#define GEM_TIDMATCH2     (0x000000AC/4) /* Type ID2 Match reg */
-#define GEM_TIDMATCH3     (0x000000B0/4) /* Type ID3 Match reg */
-#define GEM_TIDMATCH4     (0x000000B4/4) /* Type ID4 Match reg */
-#define GEM_WOLAN         (0x000000B8/4) /* Wake on LAN reg */
-#define GEM_IPGSTRETCH    (0x000000BC/4) /* IPG Stretch reg */
-#define GEM_SVLAN         (0x000000C0/4) /* Stacked VLAN reg */
-#define GEM_MODID         (0x000000FC/4) /* Module ID reg */
-#define GEM_OCTTXLO       (0x00000100/4) /* Octects transmitted Low reg */
-#define GEM_OCTTXHI       (0x00000104/4) /* Octects transmitted High reg */
-#define GEM_TXCNT         (0x00000108/4) /* Error-free Frames transmitted */
-#define GEM_TXBCNT        (0x0000010C/4) /* Error-free Broadcast Frames */
-#define GEM_TXMCNT        (0x00000110/4) /* Error-free Multicast Frame */
-#define GEM_TXPAUSECNT    (0x00000114/4) /* Pause Frames Transmitted */
-#define GEM_TX64CNT       (0x00000118/4) /* Error-free 64 TX */
-#define GEM_TX65CNT       (0x0000011C/4) /* Error-free 65-127 TX */
-#define GEM_TX128CNT      (0x00000120/4) /* Error-free 128-255 TX */
-#define GEM_TX256CNT      (0x00000124/4) /* Error-free 256-511 */
-#define GEM_TX512CNT      (0x00000128/4) /* Error-free 512-1023 TX */
-#define GEM_TX1024CNT     (0x0000012C/4) /* Error-free 1024-1518 TX */
-#define GEM_TX1519CNT     (0x00000130/4) /* Error-free larger than 1519 TX */
-#define GEM_TXURUNCNT     (0x00000134/4) /* TX under run error counter */
-#define GEM_SINGLECOLLCNT (0x00000138/4) /* Single Collision Frames */
-#define GEM_MULTCOLLCNT   (0x0000013C/4) /* Multiple Collision Frames */
-#define GEM_EXCESSCOLLCNT (0x00000140/4) /* Excessive Collision Frames */
-#define GEM_LATECOLLCNT   (0x00000144/4) /* Late Collision Frames */
-#define GEM_DEFERTXCNT    (0x00000148/4) /* Deferred Transmission Frames */
-#define GEM_CSENSECNT     (0x0000014C/4) /* Carrier Sense Error Counter */
-#define GEM_OCTRXLO       (0x00000150/4) /* Octects Received register Low */
-#define GEM_OCTRXHI       (0x00000154/4) /* Octects Received register High */
-#define GEM_RXCNT         (0x00000158/4) /* Error-free Frames Received */
-#define GEM_RXBROADCNT    (0x0000015C/4) /* Error-free Broadcast Frames RX */
-#define GEM_RXMULTICNT    (0x00000160/4) /* Error-free Multicast Frames RX */
-#define GEM_RXPAUSECNT    (0x00000164/4) /* Pause Frames Received Counter */
-#define GEM_RX64CNT       (0x00000168/4) /* Error-free 64 byte Frames RX */
-#define GEM_RX65CNT       (0x0000016C/4) /* Error-free 65-127B Frames RX */
-#define GEM_RX128CNT      (0x00000170/4) /* Error-free 128-255B Frames RX */
-#define GEM_RX256CNT      (0x00000174/4) /* Error-free 256-512B Frames RX */
-#define GEM_RX512CNT      (0x00000178/4) /* Error-free 512-1023B Frames RX */
-#define GEM_RX1024CNT     (0x0000017C/4) /* Error-free 1024-1518B Frames RX */
-#define GEM_RX1519CNT     (0x00000180/4) /* Error-free 1519-max Frames RX */
-#define GEM_RXUNDERCNT    (0x00000184/4) /* Undersize Frames Received */
-#define GEM_RXOVERCNT     (0x00000188/4) /* Oversize Frames Received */
-#define GEM_RXJABCNT      (0x0000018C/4) /* Jabbers Received Counter */
-#define GEM_RXFCSCNT      (0x00000190/4) /* Frame Check seq. Error Counter */
-#define GEM_RXLENERRCNT   (0x00000194/4) /* Length Field Error Counter */
-#define GEM_RXSYMERRCNT   (0x00000198/4) /* Symbol Error Counter */
-#define GEM_RXALIGNERRCNT (0x0000019C/4) /* Alignment Error Counter */
-#define GEM_RXRSCERRCNT   (0x000001A0/4) /* Receive Resource Error Counter */
-#define GEM_RXORUNCNT     (0x000001A4/4) /* Receive Overrun Counter */
-#define GEM_RXIPCSERRCNT  (0x000001A8/4) /* IP header Checksum Error Counter */
-#define GEM_RXTCPCCNT     (0x000001AC/4) /* TCP Checksum Error Counter */
-#define GEM_RXUDPCCNT     (0x000001B0/4) /* UDP Checksum Error Counter */
-
-#define GEM_1588S         (0x000001D0/4) /* 1588 Timer Seconds */
-#define GEM_1588NS        (0x000001D4/4) /* 1588 Timer Nanoseconds */
-#define GEM_1588ADJ       (0x000001D8/4) /* 1588 Timer Adjust */
-#define GEM_1588INC       (0x000001DC/4) /* 1588 Timer Increment */
-#define GEM_PTPETXS       (0x000001E0/4) /* PTP Event Frame Transmitted (s) */
-#define GEM_PTPETXNS      (0x000001E4/4) /* PTP Event Frame Transmitted (ns) */
-#define GEM_PTPERXS       (0x000001E8/4) /* PTP Event Frame Received (s) */
-#define GEM_PTPERXNS      (0x000001EC/4) /* PTP Event Frame Received (ns) */
-#define GEM_PTPPTXS       (0x000001E0/4) /* PTP Peer Frame Transmitted (s) */
-#define GEM_PTPPTXNS      (0x000001E4/4) /* PTP Peer Frame Transmitted (ns) */
-#define GEM_PTPPRXS       (0x000001E8/4) /* PTP Peer Frame Received (s) */
-#define GEM_PTPPRXNS      (0x000001EC/4) /* PTP Peer Frame Received (ns) */
+#define GEM_NWCTRL        (0x00000000 / 4) /* Network Control reg */
+#define GEM_NWCFG         (0x00000004 / 4) /* Network Config reg */
+#define GEM_NWSTATUS      (0x00000008 / 4) /* Network Status reg */
+#define GEM_USERIO        (0x0000000C / 4) /* User IO reg */
+#define GEM_DMACFG        (0x00000010 / 4) /* DMA Control reg */
+#define GEM_TXSTATUS      (0x00000014 / 4) /* TX Status reg */
+#define GEM_RXQBASE       (0x00000018 / 4) /* RX Q Base address reg */
+#define GEM_TXQBASE       (0x0000001C / 4) /* TX Q Base address reg */
+#define GEM_RXSTATUS      (0x00000020 / 4) /* RX Status reg */
+#define GEM_ISR           (0x00000024 / 4) /* Interrupt Status reg */
+#define GEM_IER           (0x00000028 / 4) /* Interrupt Enable reg */
+#define GEM_IDR           (0x0000002C / 4) /* Interrupt Disable reg */
+#define GEM_IMR           (0x00000030 / 4) /* Interrupt Mask reg */
+#define GEM_PHYMNTNC      (0x00000034 / 4) /* Phy Maintenance reg */
+#define GEM_RXPAUSE       (0x00000038 / 4) /* RX Pause Time reg */
+#define GEM_TXPAUSE       (0x0000003C / 4) /* TX Pause Time reg */
+#define GEM_TXPARTIALSF   (0x00000040 / 4) /* TX Partial Store and Forward */
+#define GEM_RXPARTIALSF   (0x00000044 / 4) /* RX Partial Store and Forward */
+#define GEM_HASHLO        (0x00000080 / 4) /* Hash Low address reg */
+#define GEM_HASHHI        (0x00000084 / 4) /* Hash High address reg */
+#define GEM_SPADDR1LO     (0x00000088 / 4) /* Specific addr 1 low reg */
+#define GEM_SPADDR1HI     (0x0000008C / 4) /* Specific addr 1 high reg */
+#define GEM_SPADDR2LO     (0x00000090 / 4) /* Specific addr 2 low reg */
+#define GEM_SPADDR2HI     (0x00000094 / 4) /* Specific addr 2 high reg */
+#define GEM_SPADDR3LO     (0x00000098 / 4) /* Specific addr 3 low reg */
+#define GEM_SPADDR3HI     (0x0000009C / 4) /* Specific addr 3 high reg */
+#define GEM_SPADDR4LO     (0x000000A0 / 4) /* Specific addr 4 low reg */
+#define GEM_SPADDR4HI     (0x000000A4 / 4) /* Specific addr 4 high reg */
+#define GEM_TIDMATCH1     (0x000000A8 / 4) /* Type ID1 Match reg */
+#define GEM_TIDMATCH2     (0x000000AC / 4) /* Type ID2 Match reg */
+#define GEM_TIDMATCH3     (0x000000B0 / 4) /* Type ID3 Match reg */
+#define GEM_TIDMATCH4     (0x000000B4 / 4) /* Type ID4 Match reg */
+#define GEM_WOLAN         (0x000000B8 / 4) /* Wake on LAN reg */
+#define GEM_IPGSTRETCH    (0x000000BC / 4) /* IPG Stretch reg */
+#define GEM_SVLAN         (0x000000C0 / 4) /* Stacked VLAN reg */
+#define GEM_MODID         (0x000000FC / 4) /* Module ID reg */
+#define GEM_OCTTXLO       (0x00000100 / 4) /* Octects transmitted Low reg */
+#define GEM_OCTTXHI       (0x00000104 / 4) /* Octects transmitted High reg */
+#define GEM_TXCNT         (0x00000108 / 4) /* Error-free Frames transmitted */
+#define GEM_TXBCNT        (0x0000010C / 4) /* Error-free Broadcast Frames */
+#define GEM_TXMCNT        (0x00000110 / 4) /* Error-free Multicast Frame */
+#define GEM_TXPAUSECNT    (0x00000114 / 4) /* Pause Frames Transmitted */
+#define GEM_TX64CNT       (0x00000118 / 4) /* Error-free 64 TX */
+#define GEM_TX65CNT       (0x0000011C / 4) /* Error-free 65-127 TX */
+#define GEM_TX128CNT      (0x00000120 / 4) /* Error-free 128-255 TX */
+#define GEM_TX256CNT      (0x00000124 / 4) /* Error-free 256-511 */
+#define GEM_TX512CNT      (0x00000128 / 4) /* Error-free 512-1023 TX */
+#define GEM_TX1024CNT     (0x0000012C / 4) /* Error-free 1024-1518 TX */
+#define GEM_TX1519CNT     (0x00000130 / 4) /* Error-free larger than 1519 TX */
+#define GEM_TXURUNCNT     (0x00000134 / 4) /* TX under run error counter */
+#define GEM_SINGLECOLLCNT (0x00000138 / 4) /* Single Collision Frames */
+#define GEM_MULTCOLLCNT   (0x0000013C / 4) /* Multiple Collision Frames */
+#define GEM_EXCESSCOLLCNT (0x00000140 / 4) /* Excessive Collision Frames */
+#define GEM_LATECOLLCNT   (0x00000144 / 4) /* Late Collision Frames */
+#define GEM_DEFERTXCNT    (0x00000148 / 4) /* Deferred Transmission Frames */
+#define GEM_CSENSECNT     (0x0000014C / 4) /* Carrier Sense Error Counter */
+#define GEM_OCTRXLO       (0x00000150 / 4) /* Octects Received register Low */
+#define GEM_OCTRXHI       (0x00000154 / 4) /* Octects Received register High */
+#define GEM_RXCNT         (0x00000158 / 4) /* Error-free Frames Received */
+#define GEM_RXBROADCNT    (0x0000015C / 4) /* Error-free Broadcast Frames RX */
+#define GEM_RXMULTICNT    (0x00000160 / 4) /* Error-free Multicast Frames RX */
+#define GEM_RXPAUSECNT    (0x00000164 / 4) /* Pause Frames Received Counter */
+#define GEM_RX64CNT       (0x00000168 / 4) /* Error-free 64 byte Frames RX */
+#define GEM_RX65CNT       (0x0000016C / 4) /* Error-free 65-127B Frames RX */
+#define GEM_RX128CNT      (0x00000170 / 4) /* Error-free 128-255B Frames RX */
+#define GEM_RX256CNT      (0x00000174 / 4) /* Error-free 256-512B Frames RX */
+#define GEM_RX512CNT      (0x00000178 / 4) /* Error-free 512-1023B Frames RX */
+#define GEM_RX1024CNT     (0x0000017C / 4) /* Error-free 1024-1518B Frames RX */
+#define GEM_RX1519CNT     (0x00000180 / 4) /* Error-free 1519-max Frames RX */
+#define GEM_RXUNDERCNT    (0x00000184 / 4) /* Undersize Frames Received */
+#define GEM_RXOVERCNT     (0x00000188 / 4) /* Oversize Frames Received */
+#define GEM_RXJABCNT      (0x0000018C / 4) /* Jabbers Received Counter */
+#define GEM_RXFCSCNT      (0x00000190 / 4) /* Frame Check seq. Error Counter */
+#define GEM_RXLENERRCNT   (0x00000194 / 4) /* Length Field Error Counter */
+#define GEM_RXSYMERRCNT   (0x00000198 / 4) /* Symbol Error Counter */
+#define GEM_RXALIGNERRCNT (0x0000019C / 4) /* Alignment Error Counter */
+#define GEM_RXRSCERRCNT   (0x000001A0 / 4) /* Receive Resource Error Counter */
+#define GEM_RXORUNCNT     (0x000001A4 / 4) /* Receive Overrun Counter */
+#define GEM_RXIPCSERRCNT  (0x000001A8 / 4) /* IP header Checksum Err Counter */
+#define GEM_RXTCPCCNT     (0x000001AC / 4) /* TCP Checksum Error Counter */
+#define GEM_RXUDPCCNT     (0x000001B0 / 4) /* UDP Checksum Error Counter */
+
+#define GEM_1588S         (0x000001D0 / 4) /* 1588 Timer Seconds */
+#define GEM_1588NS        (0x000001D4 / 4) /* 1588 Timer Nanoseconds */
+#define GEM_1588ADJ       (0x000001D8 / 4) /* 1588 Timer Adjust */
+#define GEM_1588INC       (0x000001DC / 4) /* 1588 Timer Increment */
+#define GEM_PTPETXS       (0x000001E0 / 4) /* PTP Event Frame Transmitted (s) */
+#define GEM_PTPETXNS      (0x000001E4 / 4) /*
+                                            * PTP Event Frame Transmitted (ns)
+                                            */
+#define GEM_PTPERXS       (0x000001E8 / 4) /* PTP Event Frame Received (s) */
+#define GEM_PTPERXNS      (0x000001EC / 4) /* PTP Event Frame Received (ns) */
+#define GEM_PTPPTXS       (0x000001E0 / 4) /* PTP Peer Frame Transmitted (s) */
+#define GEM_PTPPTXNS      (0x000001E4 / 4) /* PTP Peer Frame Transmitted (ns) */
+#define GEM_PTPPRXS       (0x000001E8 / 4) /* PTP Peer Frame Received (s) */
+#define GEM_PTPPRXNS      (0x000001EC / 4) /* PTP Peer Frame Received (ns) */
 
 /* Design Configuration Registers */
-#define GEM_DESCONF       (0x00000280/4)
-#define GEM_DESCONF2      (0x00000284/4)
-#define GEM_DESCONF3      (0x00000288/4)
-#define GEM_DESCONF4      (0x0000028C/4)
-#define GEM_DESCONF5      (0x00000290/4)
-#define GEM_DESCONF6      (0x00000294/4)
+#define GEM_DESCONF       (0x00000280 / 4)
+#define GEM_DESCONF2      (0x00000284 / 4)
+#define GEM_DESCONF3      (0x00000288 / 4)
+#define GEM_DESCONF4      (0x0000028C / 4)
+#define GEM_DESCONF5      (0x00000290 / 4)
+#define GEM_DESCONF6      (0x00000294 / 4)
 #define GEM_DESCONF6_64B_MASK (1U << 23)
-#define GEM_DESCONF7      (0x00000298/4)
+#define GEM_DESCONF7      (0x00000298 / 4)
 
 #define GEM_INT_Q1_STATUS               (0x00000400 / 4)
 #define GEM_INT_Q1_MASK                 (0x00000640 / 4)
-- 
2.5.0

From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>

Add a property "jumbo-max-len", which sets default value of jumbo frames
up to 16,383 bytes. Add Frame length checks for standard and jumbo
frames.

Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/cadence_gem.c         | 51 +++++++++++++++++++++++++++++++++++++++-----
 include/hw/net/cadence_gem.h |  4 +++-
 2 files changed, 49 insertions(+), 6 deletions(-)

diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -XXX,XX +XXX,XX @@
 #define GEM_TXPAUSE       (0x0000003C / 4) /* TX Pause Time reg */
 #define GEM_TXPARTIALSF   (0x00000040 / 4) /* TX Partial Store and Forward */
 #define GEM_RXPARTIALSF   (0x00000044 / 4) /* RX Partial Store and Forward */
+#define GEM_JUMBO_MAX_LEN (0x00000048 / 4) /* Max Jumbo Frame Size */
 #define GEM_HASHLO        (0x00000080 / 4) /* Hash Low address reg */
 #define GEM_HASHHI        (0x00000084 / 4) /* Hash High address reg */
 #define GEM_SPADDR1LO     (0x00000088 / 4) /* Specific addr 1 low reg */
@@ -XXX,XX +XXX,XX @@
 #define GEM_NWCFG_LERR_DISC    0x00010000 /* Discard RX frames with len err */
 #define GEM_NWCFG_BUFF_OFST_M  0x0000C000 /* Receive buffer offset mask */
 #define GEM_NWCFG_BUFF_OFST_S  14         /* Receive buffer offset shift */
+#define GEM_NWCFG_RCV_1538     0x00000100 /* Receive 1538 bytes frame */
 #define GEM_NWCFG_UCAST_HASH   0x00000080 /* accept unicast if hash match */
 #define GEM_NWCFG_MCAST_HASH   0x00000040 /* accept multicast if hash match */
 #define GEM_NWCFG_BCAST_REJ    0x00000020 /* Reject broadcast packets */
 #define GEM_NWCFG_PROMISC      0x00000010 /* Accept all packets */
+#define GEM_NWCFG_JUMBO_FRAME  0x00000008 /* Jumbo Frames enable */
 
 #define GEM_DMACFG_ADDR_64B    (1U << 30)
 #define GEM_DMACFG_TX_BD_EXT   (1U << 29)
@@ -XXX,XX +XXX,XX @@
 
 /* GEM_ISR GEM_IER GEM_IDR GEM_IMR */
 #define GEM_INT_TXCMPL        0x00000080 /* Transmit Complete */
+#define GEM_INT_AMBA_ERR      0x00000040
 #define GEM_INT_TXUSED         0x00000008
 #define GEM_INT_RXUSED         0x00000004
 #define GEM_INT_RXCMPL        0x00000002
@@ -XXX,XX +XXX,XX @@ static inline void rx_desc_set_sar(uint32_t *desc, int sar_idx)
 /* The broadcast MAC address: 0xFFFFFFFFFFFF */
 static const uint8_t broadcast_addr[] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
 
+static uint32_t gem_get_max_buf_len(CadenceGEMState *s, bool tx)
+{
+    uint32_t size;
+    if (s->regs[GEM_NWCFG] & GEM_NWCFG_JUMBO_FRAME) {
+        size = s->regs[GEM_JUMBO_MAX_LEN];
+        if (size > s->jumbo_max_len) {
+            size = s->jumbo_max_len;
+            qemu_log_mask(LOG_GUEST_ERROR, "GEM_JUMBO_MAX_LEN reg cannot be"
+                " greater than 0x%" PRIx32 "\n", s->jumbo_max_len);
+        }
+    } else if (tx) {
+        size = 1518;
+    } else {
+        size = s->regs[GEM_NWCFG] & GEM_NWCFG_RCV_1538 ? 1538 : 1518;
+    }
+    return size;
+}
+
 static void gem_set_isr(CadenceGEMState *s, int q, uint32_t flag)
 {
     if (q == 0) {
@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
     /* Find which queue we are targeting */
     q = get_queue_from_screen(s, rxbuf_ptr, rxbufsize);
 
+    if (size > gem_get_max_buf_len(s, false)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "rx frame too long\n");
+        gem_set_isr(s, q, GEM_INT_AMBA_ERR);
+        return -1;
+    }
+
     while (bytes_to_copy) {
         hwaddr desc_addr;
 
@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
                 break;
             }
 
-            if (tx_desc_get_length(desc) > MAX_FRAME_SIZE -
+            if (tx_desc_get_length(desc) > gem_get_max_buf_len(s, true) -
                                                (p - s->tx_packet)) {
-                DB_PRINT("TX descriptor @ 0x%" HWADDR_PRIx \
-                         " too large: size 0x%x space 0x%zx\n",
+                qemu_log_mask(LOG_GUEST_ERROR, "TX descriptor @ 0x%" \
+                         HWADDR_PRIx " too large: size 0x%x space 0x%zx\n",
                          packet_desc_addr, tx_desc_get_length(desc),
-                         MAX_FRAME_SIZE - (p - s->tx_packet));
+                         gem_get_max_buf_len(s, true) - (p - s->tx_packet));
+                gem_set_isr(s, q, GEM_INT_AMBA_ERR);
                 break;
             }
 
@@ -XXX,XX +XXX,XX @@ static void gem_reset(DeviceState *d)
     s->regs[GEM_RXPARTIALSF] = 0x000003ff;
     s->regs[GEM_MODID] = s->revision;
     s->regs[GEM_DESCONF] = 0x02500111;
-    s->regs[GEM_DESCONF2] = 0x2ab13fff;
+    s->regs[GEM_DESCONF2] = 0x2ab10000 | s->jumbo_max_len;
     s->regs[GEM_DESCONF5] = 0x002f2045;
     s->regs[GEM_DESCONF6] = GEM_DESCONF6_64B_MASK;
+    s->regs[GEM_JUMBO_MAX_LEN] = s->jumbo_max_len;
 
     if (s->num_priority_queues > 1) {
         queues_mask = MAKE_64BIT_MASK(1, s->num_priority_queues - 1);
@@ -XXX,XX +XXX,XX @@ static void gem_write(void *opaque, hwaddr offset, uint64_t val,
         s->regs[GEM_IMR] &= ~val;
         gem_update_int_status(s);
         break;
+    case GEM_JUMBO_MAX_LEN:
+        s->regs[GEM_JUMBO_MAX_LEN] = val & MAX_JUMBO_FRAME_SIZE_MASK;
+        break;
     case GEM_INT_Q1_ENABLE ... GEM_INT_Q7_ENABLE:
         s->regs[GEM_INT_Q1_MASK + offset - GEM_INT_Q1_ENABLE] &= ~val;
         gem_update_int_status(s);
@@ -XXX,XX +XXX,XX @@ static void gem_realize(DeviceState *dev, Error **errp)
 
     s->nic = qemu_new_nic(&net_gem_info, &s->conf,
                           object_get_typename(OBJECT(dev)), dev->id, s);
+
+    if (s->jumbo_max_len > MAX_FRAME_SIZE) {
+        error_setg(errp, "jumbo-max-len is greater than %d",
+                  MAX_FRAME_SIZE);
+        return;
+    }
 }
 
 static void gem_init(Object *obj)
@@ -XXX,XX +XXX,XX @@ static Property gem_properties[] = {
                       num_type1_screeners, 4),
     DEFINE_PROP_UINT8("num-type2-screeners", CadenceGEMState,
                       num_type2_screeners, 4),
+    DEFINE_PROP_UINT16("jumbo-max-len", CadenceGEMState,
+                       jumbo_max_len, 10240),
     DEFINE_PROP_END_OF_LIST(),
 };
 
diff --git a/include/hw/net/cadence_gem.h b/include/hw/net/cadence_gem.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/net/cadence_gem.h
+++ b/include/hw/net/cadence_gem.h
@@ -XXX,XX +XXX,XX @@
 #define MAX_TYPE1_SCREENERS             16
 #define MAX_TYPE2_SCREENERS             16
 
-#define MAX_FRAME_SIZE 2048
+#define MAX_JUMBO_FRAME_SIZE_MASK 0x3FFF
+#define MAX_FRAME_SIZE MAX_JUMBO_FRAME_SIZE_MASK
 
 typedef struct CadenceGEMState {
     /*< private >*/
@@ -XXX,XX +XXX,XX @@ typedef struct CadenceGEMState {
     uint8_t num_type1_screeners;
     uint8_t num_type2_screeners;
     uint32_t revision;
+    uint16_t jumbo_max_len;
 
     /* GEM registers backing store */
     uint32_t regs[CADENCE_GEM_MAXREG];
-- 
2.5.0

From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>

TX_LAST bit should not be set by hardware, its set by guest to inform
the last bd of the frame.

Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/cadence_gem.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -XXX,XX +XXX,XX @@ static inline unsigned tx_desc_get_last(uint32_t *desc)
     return (desc[1] & DESC_1_TX_LAST) ? 1 : 0;
 }
 
-static inline void tx_desc_set_last(uint32_t *desc)
-{
-    desc[1] |= DESC_1_TX_LAST;
-}
-
 static inline unsigned tx_desc_get_length(uint32_t *desc)
 {
     return desc[1] & DESC_1_LENGTH;
@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
 
             /* read next descriptor */
             if (tx_desc_get_wrap(desc)) {
-                tx_desc_set_last(desc);
 
                 if (s->regs[GEM_DMACFG] & GEM_DMACFG_ADDR_64B) {
                     packet_desc_addr = s->regs[GEM_TBQPH];
-- 
2.5.0

From: Tong Ho <tong.ho@xilinx.com>

Two defects are fixed:

1/ Detection of multicast frames
2/ Treating drop of mis-addressed frames as non-error

Signed-off-by: Tong Ho <tong.ho@xilinx.com>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/cadence_gem.c | 26 +++++++++++---------------
 1 file changed, 11 insertions(+), 15 deletions(-)

diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/module.h"
 #include "sysemu/dma.h"
 #include "net/checksum.h"
+#include "net/eth.h"
 
 #define CADENCE_GEM_ERR_DEBUG 0
 #define DB_PRINT(...) do {\
@@ -XXX,XX +XXX,XX @@ static unsigned calc_mac_hash(const uint8_t *mac)
 static int gem_mac_address_filter(CadenceGEMState *s, const uint8_t *packet)
 {
     uint8_t *gem_spaddr;
-    int i;
+    int i, is_mc;
 
     /* Promiscuous mode? */
     if (s->regs[GEM_NWCFG] & GEM_NWCFG_PROMISC) {
@@ -XXX,XX +XXX,XX @@ static int gem_mac_address_filter(CadenceGEMState *s, const uint8_t *packet)
     }
 
     /* Accept packets -w- hash match? */
-    if ((packet[0] == 0x01 && (s->regs[GEM_NWCFG] & GEM_NWCFG_MCAST_HASH)) ||
-        (packet[0] != 0x01 && (s->regs[GEM_NWCFG] & GEM_NWCFG_UCAST_HASH))) {
+    is_mc = is_multicast_ether_addr(packet);
+    if ((is_mc && (s->regs[GEM_NWCFG] & GEM_NWCFG_MCAST_HASH)) ||
+        (!is_mc && (s->regs[GEM_NWCFG] & GEM_NWCFG_UCAST_HASH))) {
+        uint64_t buckets;
         unsigned hash_index;
 
         hash_index = calc_mac_hash(packet);
-        if (hash_index < 32) {
-            if (s->regs[GEM_HASHLO] & (1<<hash_index)) {
-                return packet[0] == 0x01 ? GEM_RX_MULTICAST_HASH_ACCEPT :
-                                           GEM_RX_UNICAST_HASH_ACCEPT;
-            }
-        } else {
-            hash_index -= 32;
-            if (s->regs[GEM_HASHHI] & (1<<hash_index)) {
-                return packet[0] == 0x01 ? GEM_RX_MULTICAST_HASH_ACCEPT :
-                                           GEM_RX_UNICAST_HASH_ACCEPT;
-            }
+        buckets = ((uint64_t)s->regs[GEM_HASHHI] << 32) | s->regs[GEM_HASHLO];
+        if ((buckets >> hash_index) & 1) {
+            return is_mc ? GEM_RX_MULTICAST_HASH_ACCEPT
+                         : GEM_RX_UNICAST_HASH_ACCEPT;
         }
     }
 
@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
     /* Is this destination MAC address "for us" ? */
     maf = gem_mac_address_filter(s, buf);
     if (maf == GEM_RX_REJECT) {
-        return -1;
+        return size;  /* no, drop siliently b/c it's not an error */
     }
 
     /* Discard packets with receive length error enabled ? */
-- 
2.5.0

The sender of packet will be checked in the qemu_net_queue_purge() but
we use NetClientState not its peer when trying to purge the incoming
queue in qemu_flush_or_purge_packets(). This will trigger the assert
in virtio_net_reset since we can't pass the sender check:

hw/net/virtio-net.c:533: void virtio_net_reset(VirtIODevice *): Assertion
`!virtio_net_get_subqueue(nc)->async_tx.elem' failed.
#9 0x55a33fa31b78 in virtio_net_reset hw/net/virtio-net.c:533:13
#10 0x55a33fc88412 in virtio_reset hw/virtio/virtio.c:1919:9
#11 0x55a341d82764 in virtio_bus_reset hw/virtio/virtio-bus.c:95:9
#12 0x55a341dba2de in virtio_pci_reset hw/virtio/virtio-pci.c:1824:5
#13 0x55a341db3e02 in virtio_pci_common_write hw/virtio/virtio-pci.c:1252:13
#14 0x55a33f62117b in memory_region_write_accessor memory.c:496:5
#15 0x55a33f6205e4 in access_with_adjusted_size memory.c:557:18
#16 0x55a33f61e177 in memory_region_dispatch_write memory.c:1488:16

Reproducer:
https://www.mail-archive.com/qemu-devel@nongnu.org/msg701914.html

Fix by using the peer.

Reported-by: "Alexander Bulekov" <alxndr@bu.edu>
Acked-by: Alexander Bulekov <alxndr@bu.edu>
Fixes: ca77d85e1dbf9 ("net: complete all queued packets on VM stop")
Cc: qemu-stable@nongnu.org
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/net.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/net.c b/net/net.c
index XXXXXXX..XXXXXXX 100644
--- a/net/net.c
+++ b/net/net.c
@@ -XXX,XX +XXX,XX @@ void qemu_flush_or_purge_queued_packets(NetClientState *nc, bool purge)
         qemu_notify_event();
     } else if (purge) {
         /* Unable to empty the queue, purge remaining packets */
-        qemu_net_queue_purge(nc->incoming_queue, nc);
+        qemu_net_queue_purge(nc->incoming_queue, nc->peer);
     }
 }
 
-- 
2.5.0

From: Lukas Straub <lukasstraub2@web.de>

qemu_bh_new will set the bh to be executed in the main
loop. This causes crashes as colo_compare_handle_event assumes
that it has exclusive access the queues, which are also
concurrently accessed in the iothread.

Create the bh with the AioContext of the iothread to fulfill
these assumptions and fix the crashes. This is safe, because
the bh already takes the appropriate locks.

Signed-off-by: Lukas Straub <lukasstraub2@web.de>
Reviewed-by: Zhang Chen <chen.zhang@intel.com>
Reviewed-by: Derek Su <dereksu@qnap.com>
Tested-by: Derek Su <dereksu@qnap.com>
Signed-off-by: Zhang Chen <chen.zhang@intel.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/colo-compare.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/colo-compare.c b/net/colo-compare.c
index XXXXXXX..XXXXXXX 100644
--- a/net/colo-compare.c
+++ b/net/colo-compare.c
@@ -XXX,XX +XXX,XX @@ static void colo_compare_handle_event(void *opaque)
 
 static void colo_compare_iothread(CompareState *s)
 {
+    AioContext *ctx = iothread_get_aio_context(s->iothread);
     object_ref(OBJECT(s->iothread));
     s->worker_context = iothread_get_g_main_context(s->iothread);
 
@@ -XXX,XX +XXX,XX @@ static void colo_compare_iothread(CompareState *s)
     }
 
     colo_compare_timer_init(s);
-    s->event_bh = qemu_bh_new(colo_compare_handle_event, s);
+    s->event_bh = aio_bh_new(ctx, colo_compare_handle_event, s);
 }
 
 static char *compare_get_pri_indev(Object *obj, Error **errp)
-- 
2.5.0

From: Lukas Straub <lukasstraub2@web.de>

To be able to convert compare_chr_send to a coroutine in the
next commit, use qemu_co_sleep_ns if in coroutine.

Signed-off-by: Lukas Straub <lukasstraub2@web.de>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Zhang Chen <chen.zhang@intel.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Zhang Chen <chen.zhang@intel.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 chardev/char.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/chardev/char.c b/chardev/char.c
index XXXXXXX..XXXXXXX 100644
--- a/chardev/char.c
+++ b/chardev/char.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/module.h"
 #include "qemu/option.h"
 #include "qemu/id.h"
+#include "qemu/coroutine.h"
 
 #include "chardev/char-mux.h"
 
@@ -XXX,XX +XXX,XX @@ static int qemu_chr_write_buffer(Chardev *s,
     retry:
         res = cc->chr_write(s, buf + *offset, len - *offset);
         if (res < 0 && errno == EAGAIN && write_all) {
-            g_usleep(100);
+            if (qemu_in_coroutine()) {
+                qemu_co_sleep_ns(QEMU_CLOCK_REALTIME, 100000);
+            } else {
+                g_usleep(100);
+            }
             goto retry;
         }
 
-- 
2.5.0

From: Lukas Straub <lukasstraub2@web.de>

The chr_out chardev is connected to a filter-redirector
running in the main loop. qemu_chr_fe_write_all might block
here in compare_chr_send if the (socket-)buffer is full.
If another filter-redirector in the main loop want's to
send data to chr_pri_in it might also block if the buffer
is full. This leads to a deadlock because both event loops
get blocked.

Fix this by converting compare_chr_send to a coroutine and
putting the packets in a send queue.

Signed-off-by: Lukas Straub <lukasstraub2@web.de>
Reviewed-by: Zhang Chen <chen.zhang@intel.com>
Tested-by: Zhang Chen <chen.zhang@intel.com>
Signed-off-by: Zhang Chen <chen.zhang@intel.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/colo-compare.c | 193 ++++++++++++++++++++++++++++++++++++++++-------------
 net/colo.c         |   7 ++
 net/colo.h         |   1 +
 3 files changed, 156 insertions(+), 45 deletions(-)

diff --git a/net/colo-compare.c b/net/colo-compare.c
index XXXXXXX..XXXXXXX 100644
--- a/net/colo-compare.c
+++ b/net/colo-compare.c
@@ -XXX,XX +XXX,XX @@
 #include "migration/migration.h"
 #include "util.h"
 
+#include "block/aio-wait.h"
+#include "qemu/coroutine.h"
+
 #define TYPE_COLO_COMPARE "colo-compare"
 #define COLO_COMPARE(obj) \
     OBJECT_CHECK(CompareState, (obj), TYPE_COLO_COMPARE)
@@ -XXX,XX +XXX,XX @@ static int event_unhandled_count;
  *                    |packet  |  |packet  +    |packet  | |packet  +
  *                    +--------+  +--------+    +--------+ +--------+
  */
+
+typedef struct SendCo {
+    Coroutine *co;
+    struct CompareState *s;
+    CharBackend *chr;
+    GQueue send_list;
+    bool notify_remote_frame;
+    bool done;
+    int ret;
+} SendCo;
+
+typedef struct SendEntry {
+    uint32_t size;
+    uint32_t vnet_hdr_len;
+    uint8_t *buf;
+} SendEntry;
+
 typedef struct CompareState {
     Object parent;
 
@@ -XXX,XX +XXX,XX @@ typedef struct CompareState {
     SocketReadState pri_rs;
     SocketReadState sec_rs;
     SocketReadState notify_rs;
+    SendCo out_sendco;
+    SendCo notify_sendco;
     bool vnet_hdr;
     uint32_t compare_timeout;
     uint32_t expired_scan_cycle;
@@ -XXX,XX +XXX,XX @@ enum {
 
 
 static int compare_chr_send(CompareState *s,
-                            const uint8_t *buf,
+                            uint8_t *buf,
                             uint32_t size,
                             uint32_t vnet_hdr_len,
-                            bool notify_remote_frame);
+                            bool notify_remote_frame,
+                            bool zero_copy);
 
 static bool packet_matches_str(const char *str,
                                const uint8_t *buf,
@@ -XXX,XX +XXX,XX @@ static void notify_remote_frame(CompareState *s)
     char msg[] = "DO_CHECKPOINT";
     int ret = 0;
 
-    ret = compare_chr_send(s, (uint8_t *)msg, strlen(msg), 0, true);
+    ret = compare_chr_send(s, (uint8_t *)msg, strlen(msg), 0, true, false);
     if (ret < 0) {
         error_report("Notify Xen COLO-frame failed");
     }
@@ -XXX,XX +XXX,XX @@ static void colo_release_primary_pkt(CompareState *s, Packet *pkt)
                            pkt->data,
                            pkt->size,
                            pkt->vnet_hdr_len,
-                           false);
+                           false,
+                           true);
     if (ret < 0) {
         error_report("colo send primary packet failed");
     }
     trace_colo_compare_main("packet same and release packet");
-    packet_destroy(pkt, NULL);
+    packet_destroy_partial(pkt, NULL);
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ static void colo_compare_connection(void *opaque, void *user_data)
     }
 }
 
-static int compare_chr_send(CompareState *s,
-                            const uint8_t *buf,
-                            uint32_t size,
-                            uint32_t vnet_hdr_len,
-                            bool notify_remote_frame)
+static void coroutine_fn _compare_chr_send(void *opaque)
 {
+    SendCo *sendco = opaque;
+    CompareState *s = sendco->s;
     int ret = 0;
-    uint32_t len = htonl(size);
 
-    if (!size) {
-        return 0;
-    }
+    while (!g_queue_is_empty(&sendco->send_list)) {
+        SendEntry *entry = g_queue_pop_tail(&sendco->send_list);
+        uint32_t len = htonl(entry->size);
 
-    if (notify_remote_frame) {
-        ret = qemu_chr_fe_write_all(&s->chr_notify_dev,
-                                    (uint8_t *)&len,
-                                    sizeof(len));
-    } else {
-        ret = qemu_chr_fe_write_all(&s->chr_out, (uint8_t *)&len, sizeof(len));
-    }
+        ret = qemu_chr_fe_write_all(sendco->chr, (uint8_t *)&len, sizeof(len));
 
-    if (ret != sizeof(len)) {
-        goto err;
-    }
+        if (ret != sizeof(len)) {
+            g_free(entry->buf);
+            g_slice_free(SendEntry, entry);
+            goto err;
+        }
 
-    if (s->vnet_hdr) {
-        /*
-         * We send vnet header len make other module(like filter-redirector)
-         * know how to parse net packet correctly.
-         */
-        len = htonl(vnet_hdr_len);
+        if (!sendco->notify_remote_frame && s->vnet_hdr) {
+            /*
+             * We send vnet header len make other module(like filter-redirector)
+             * know how to parse net packet correctly.
+             */
+            len = htonl(entry->vnet_hdr_len);
 
-        if (!notify_remote_frame) {
-            ret = qemu_chr_fe_write_all(&s->chr_out,
+            ret = qemu_chr_fe_write_all(sendco->chr,
                                         (uint8_t *)&len,
                                         sizeof(len));
+
+            if (ret != sizeof(len)) {
+                g_free(entry->buf);
+                g_slice_free(SendEntry, entry);
+                goto err;
+            }
         }
 
-        if (ret != sizeof(len)) {
+        ret = qemu_chr_fe_write_all(sendco->chr,
+                                    (uint8_t *)entry->buf,
+                                    entry->size);
+
+        if (ret != entry->size) {
+            g_free(entry->buf);
+            g_slice_free(SendEntry, entry);
             goto err;
         }
+
+        g_free(entry->buf);
+        g_slice_free(SendEntry, entry);
     }
 
+    sendco->ret = 0;
+    goto out;
+
+err:
+    while (!g_queue_is_empty(&sendco->send_list)) {
+        SendEntry *entry = g_queue_pop_tail(&sendco->send_list);
+        g_free(entry->buf);
+        g_slice_free(SendEntry, entry);
+    }
+    sendco->ret = ret < 0 ? ret : -EIO;
+out:
+    sendco->co = NULL;
+    sendco->done = true;
+    aio_wait_kick();
+}
+
+static int compare_chr_send(CompareState *s,
+                            uint8_t *buf,
+                            uint32_t size,
+                            uint32_t vnet_hdr_len,
+                            bool notify_remote_frame,
+                            bool zero_copy)
+{
+    SendCo *sendco;
+    SendEntry *entry;
+
     if (notify_remote_frame) {
-        ret = qemu_chr_fe_write_all(&s->chr_notify_dev,
-                                    (uint8_t *)buf,
-                                    size);
+        sendco = &s->notify_sendco;
     } else {
-        ret = qemu_chr_fe_write_all(&s->chr_out, (uint8_t *)buf, size);
+        sendco = &s->out_sendco;
     }
 
-    if (ret != size) {
-        goto err;
+    if (!size) {
+        return 0;
     }
 
-    return 0;
+    entry = g_slice_new(SendEntry);
+    entry->size = size;
+    entry->vnet_hdr_len = vnet_hdr_len;
+    if (zero_copy) {
+        entry->buf = buf;
+    } else {
+        entry->buf = g_malloc(size);
+        memcpy(entry->buf, buf, size);
+    }
+    g_queue_push_head(&sendco->send_list, entry);
+
+    if (sendco->done) {
+        sendco->co = qemu_coroutine_create(_compare_chr_send, sendco);
+        sendco->done = false;
+        qemu_coroutine_enter(sendco->co);
+        if (sendco->done) {
+            /* report early errors */
+            return sendco->ret;
+        }
+    }
 
-err:
-    return ret < 0 ? ret : -EIO;
+    /* assume success */
+    return 0;
 }
 
 static int compare_chr_can_read(void *opaque)
@@ -XXX,XX +XXX,XX @@ static void compare_pri_rs_finalize(SocketReadState *pri_rs)
                          pri_rs->buf,
                          pri_rs->packet_len,
                          pri_rs->vnet_hdr_len,
+                         false,
                          false);
     } else {
         /* compare packet in the specified connection */
@@ -XXX,XX +XXX,XX @@ static void compare_notify_rs_finalize(SocketReadState *notify_rs)
     if (packet_matches_str("COLO_USERSPACE_PROXY_INIT",
                            notify_rs->buf,
                            notify_rs->packet_len)) {
-        ret = compare_chr_send(s, (uint8_t *)msg, strlen(msg), 0, true);
+        ret = compare_chr_send(s, (uint8_t *)msg, strlen(msg), 0, true, false);
         if (ret < 0) {
             error_report("Notify Xen COLO-frame INIT failed");
         }
@@ -XXX,XX +XXX,XX @@ static void colo_compare_complete(UserCreatable *uc, Error **errp)
 
     QTAILQ_INSERT_TAIL(&net_compares, s, next);
 
+    s->out_sendco.s = s;
+    s->out_sendco.chr = &s->chr_out;
+    s->out_sendco.notify_remote_frame = false;
+    s->out_sendco.done = true;
+    g_queue_init(&s->out_sendco.send_list);
+
+    if (s->notify_dev) {
+        s->notify_sendco.s = s;
+        s->notify_sendco.chr = &s->chr_notify_dev;
+        s->notify_sendco.notify_remote_frame = true;
+        s->notify_sendco.done = true;
+        g_queue_init(&s->notify_sendco.send_list);
+    }
+
     g_queue_init(&s->conn_list);
 
     qemu_mutex_init(&event_mtx);
@@ -XXX,XX +XXX,XX @@ static void colo_flush_packets(void *opaque, void *user_data)
                          pkt->data,
                          pkt->size,
                          pkt->vnet_hdr_len,
-                         false);
-        packet_destroy(pkt, NULL);
+                         false,
+                         true);
+        packet_destroy_partial(pkt, NULL);
     }
     while (!g_queue_is_empty(&conn->secondary_list)) {
         pkt = g_queue_pop_head(&conn->secondary_list);
@@ -XXX,XX +XXX,XX @@ static void colo_compare_finalize(Object *obj)
         }
     }
 
+    AioContext *ctx = iothread_get_aio_context(s->iothread);
+    aio_context_acquire(ctx);
+    AIO_WAIT_WHILE(ctx, !s->out_sendco.done);
+    if (s->notify_dev) {
+        AIO_WAIT_WHILE(ctx, !s->notify_sendco.done);
+    }
+    aio_context_release(ctx);
+
     /* Release all unhandled packets after compare thead exited */
     g_queue_foreach(&s->conn_list, colo_flush_packets, s);
+    AIO_WAIT_WHILE(NULL, !s->out_sendco.done);
 
     g_queue_clear(&s->conn_list);
+    g_queue_clear(&s->out_sendco.send_list);
+    if (s->notify_dev) {
+        g_queue_clear(&s->notify_sendco.send_list);
+    }
 
     if (s->connection_track_table) {
         g_hash_table_destroy(s->connection_track_table);
diff --git a/net/colo.c b/net/colo.c
index XXXXXXX..XXXXXXX 100644
--- a/net/colo.c
+++ b/net/colo.c
@@ -XXX,XX +XXX,XX @@ void packet_destroy(void *opaque, void *user_data)
     g_slice_free(Packet, pkt);
 }
 
+void packet_destroy_partial(void *opaque, void *user_data)
+{
+    Packet *pkt = opaque;
+
+    g_slice_free(Packet, pkt);
+}
+
 /*
  * Clear hashtable, stop this hash growing really huge
  */
diff --git a/net/colo.h b/net/colo.h
index XXXXXXX..XXXXXXX 100644
--- a/net/colo.h
+++ b/net/colo.h
@@ -XXX,XX +XXX,XX @@ bool connection_has_tracked(GHashTable *connection_track_table,
 void connection_hashtable_reset(GHashTable *connection_track_table);
 Packet *packet_new(const void *data, int size, int vnet_hdr_len);
 void packet_destroy(void *opaque, void *user_data);
+void packet_destroy_partial(void *opaque, void *user_data);
 
 #endif /* NET_COLO_H */
-- 
2.5.0

From: Lukas Straub <lukasstraub2@web.de>

Else the log will be flooded if there is a lot of network
traffic.

Signed-off-by: Lukas Straub <lukasstraub2@web.de>
Reviewed-by: Zhang Chen <chen.zhang@intel.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Zhang Chen <chen.zhang@intel.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/colo-compare.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/net/colo-compare.c b/net/colo-compare.c
index XXXXXXX..XXXXXXX 100644
--- a/net/colo-compare.c
+++ b/net/colo-compare.c
@@ -XXX,XX +XXX,XX @@ sec:
         g_queue_push_head(&conn->primary_list, ppkt);
         g_queue_push_head(&conn->secondary_list, spkt);
 
-        qemu_hexdump((char *)ppkt->data, stderr,
-                     "colo-compare ppkt", ppkt->size);
-        qemu_hexdump((char *)spkt->data, stderr,
-                     "colo-compare spkt", spkt->size);
+        if (trace_event_get_state_backends(TRACE_COLO_COMPARE_MISCOMPARE)) {
+            qemu_hexdump((char *)ppkt->data, stderr,
+                        "colo-compare ppkt", ppkt->size);
+            qemu_hexdump((char *)spkt->data, stderr,
+                        "colo-compare spkt", spkt->size);
+        }
 
         colo_compare_inconsistency_notify(s);
     }
-- 
2.5.0

From: Lukas Straub <lukasstraub2@web.de>

If the colo-compare object is removed before failover and a
checkpoint happens, qemu crashes because it tries to lock
the destroyed event_mtx in colo_notify_compares_event.

Fix this by checking if everything is initialized by
introducing a new variable colo_compare_active which
is protected by a new mutex colo_compare_mutex. The new mutex
also protects against concurrent access of the net_compares
list and makes sure that colo_notify_compares_event isn't
active while we destroy event_mtx and event_complete_cond.

With this it also is again possible to use colo without
colo-compare (periodic mode) and to use multiple colo-compare
for multiple network interfaces.

Signed-off-by: Lukas Straub <lukasstraub2@web.de>
Tested-by: Lukas Straub <lukasstraub2@web.de>
Reviewed-by: Zhang Chen <chen.zhang@intel.com>
Signed-off-by: Zhang Chen <chen.zhang@intel.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/colo-compare.c | 35 +++++++++++++++++++++++++++++------
 1 file changed, 29 insertions(+), 6 deletions(-)

diff --git a/net/colo-compare.c b/net/colo-compare.c
index XXXXXXX..XXXXXXX 100644
--- a/net/colo-compare.c
+++ b/net/colo-compare.c
@@ -XXX,XX +XXX,XX @@ static NotifierList colo_compare_notifiers =
 #define REGULAR_PACKET_CHECK_MS 3000
 #define DEFAULT_TIME_OUT_MS 3000
 
+static QemuMutex colo_compare_mutex;
+static bool colo_compare_active;
 static QemuMutex event_mtx;
 static QemuCond event_complete_cond;
 static int event_unhandled_count;
@@ -XXX,XX +XXX,XX @@ static void check_old_packet_regular(void *opaque)
 void colo_notify_compares_event(void *opaque, int event, Error **errp)
 {
     CompareState *s;
+    qemu_mutex_lock(&colo_compare_mutex);
+
+    if (!colo_compare_active) {
+        qemu_mutex_unlock(&colo_compare_mutex);
+        return;
+    }
 
     qemu_mutex_lock(&event_mtx);
     QTAILQ_FOREACH(s, &net_compares, next) {
@@ -XXX,XX +XXX,XX @@ void colo_notify_compares_event(void *opaque, int event, Error **errp)
     }
 
     qemu_mutex_unlock(&event_mtx);
+    qemu_mutex_unlock(&colo_compare_mutex);
 }
 
 static void colo_compare_timer_init(CompareState *s)
@@ -XXX,XX +XXX,XX @@ static void colo_compare_complete(UserCreatable *uc, Error **errp)
                            s->vnet_hdr);
     }
 
+    qemu_mutex_lock(&colo_compare_mutex);
+    if (!colo_compare_active) {
+        qemu_mutex_init(&event_mtx);
+        qemu_cond_init(&event_complete_cond);
+        colo_compare_active = true;
+    }
     QTAILQ_INSERT_TAIL(&net_compares, s, next);
+    qemu_mutex_unlock(&colo_compare_mutex);
 
     s->out_sendco.s = s;
     s->out_sendco.chr = &s->chr_out;
@@ -XXX,XX +XXX,XX @@ static void colo_compare_complete(UserCreatable *uc, Error **errp)
 
     g_queue_init(&s->conn_list);
 
-    qemu_mutex_init(&event_mtx);
-    qemu_cond_init(&event_complete_cond);
-
     s->connection_track_table = g_hash_table_new_full(connection_key_hash,
                                                       connection_key_equal,
                                                       g_free,
@@ -XXX,XX +XXX,XX @@ static void colo_compare_finalize(Object *obj)
 
     qemu_bh_delete(s->event_bh);
 
+    qemu_mutex_lock(&colo_compare_mutex);
     QTAILQ_FOREACH(tmp, &net_compares, next) {
         if (tmp == s) {
             QTAILQ_REMOVE(&net_compares, s, next);
             break;
         }
     }
+    if (QTAILQ_EMPTY(&net_compares)) {
+        colo_compare_active = false;
+        qemu_mutex_destroy(&event_mtx);
+        qemu_cond_destroy(&event_complete_cond);
+    }
+    qemu_mutex_unlock(&colo_compare_mutex);
 
     AioContext *ctx = iothread_get_aio_context(s->iothread);
     aio_context_acquire(ctx);
@@ -XXX,XX +XXX,XX @@ static void colo_compare_finalize(Object *obj)
         object_unref(OBJECT(s->iothread));
     }
 
-    qemu_mutex_destroy(&event_mtx);
-    qemu_cond_destroy(&event_complete_cond);
-
     g_free(s->pri_indev);
     g_free(s->sec_indev);
     g_free(s->outdev);
     g_free(s->notify_dev);
 }
 
+static void __attribute__((__constructor__)) colo_compare_init_globals(void)
+{
+    colo_compare_active = false;
+    qemu_mutex_init(&colo_compare_mutex);
+}
+
 static const TypeInfo colo_compare_info = {
     .name = TYPE_COLO_COMPARE,
     .parent = TYPE_OBJECT,
-- 
2.5.0

From: Lukas Straub <lukasstraub2@web.de>

In colo_compare_complete, insert CompareState into net_compares
only after everything has been initialized.
In colo_compare_finalize, remove CompareState from net_compares
before anything is deinitialized.

Signed-off-by: Lukas Straub <lukasstraub2@web.de>
Reviewed-by: Zhang Chen <chen.zhang@intel.com>
Signed-off-by: Zhang Chen <chen.zhang@intel.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/colo-compare.c | 45 +++++++++++++++++++++++----------------------
 1 file changed, 23 insertions(+), 22 deletions(-)

diff --git a/net/colo-compare.c b/net/colo-compare.c
index XXXXXXX..XXXXXXX 100644
--- a/net/colo-compare.c
+++ b/net/colo-compare.c
@@ -XXX,XX +XXX,XX @@ static void colo_compare_complete(UserCreatable *uc, Error **errp)
                            s->vnet_hdr);
     }
 
-    qemu_mutex_lock(&colo_compare_mutex);
-    if (!colo_compare_active) {
-        qemu_mutex_init(&event_mtx);
-        qemu_cond_init(&event_complete_cond);
-        colo_compare_active = true;
-    }
-    QTAILQ_INSERT_TAIL(&net_compares, s, next);
-    qemu_mutex_unlock(&colo_compare_mutex);
-
     s->out_sendco.s = s;
     s->out_sendco.chr = &s->chr_out;
     s->out_sendco.notify_remote_frame = false;
@@ -XXX,XX +XXX,XX @@ static void colo_compare_complete(UserCreatable *uc, Error **errp)
                                                       connection_destroy);
 
     colo_compare_iothread(s);
+
+    qemu_mutex_lock(&colo_compare_mutex);
+    if (!colo_compare_active) {
+        qemu_mutex_init(&event_mtx);
+        qemu_cond_init(&event_complete_cond);
+        colo_compare_active = true;
+    }
+    QTAILQ_INSERT_TAIL(&net_compares, s, next);
+    qemu_mutex_unlock(&colo_compare_mutex);
+
     return;
 }
 
@@ -XXX,XX +XXX,XX @@ static void colo_compare_finalize(Object *obj)
     CompareState *s = COLO_COMPARE(obj);
     CompareState *tmp = NULL;
 
-    qemu_chr_fe_deinit(&s->chr_pri_in, false);
-    qemu_chr_fe_deinit(&s->chr_sec_in, false);
-    qemu_chr_fe_deinit(&s->chr_out, false);
-    if (s->notify_dev) {
-        qemu_chr_fe_deinit(&s->chr_notify_dev, false);
-    }
-
-    if (s->iothread) {
-        colo_compare_timer_del(s);
-    }
-
-    qemu_bh_delete(s->event_bh);
-
     qemu_mutex_lock(&colo_compare_mutex);
     QTAILQ_FOREACH(tmp, &net_compares, next) {
         if (tmp == s) {
@@ -XXX,XX +XXX,XX @@ static void colo_compare_finalize(Object *obj)
     }
     qemu_mutex_unlock(&colo_compare_mutex);
 
+    qemu_chr_fe_deinit(&s->chr_pri_in, false);
+    qemu_chr_fe_deinit(&s->chr_sec_in, false);
+    qemu_chr_fe_deinit(&s->chr_out, false);
+    if (s->notify_dev) {
+        qemu_chr_fe_deinit(&s->chr_notify_dev, false);
+    }
+
+    if (s->iothread) {
+        colo_compare_timer_del(s);
+    }
+
+    qemu_bh_delete(s->event_bh);
+
     AioContext *ctx = iothread_get_aio_context(s->iothread);
     aio_context_acquire(ctx);
     AIO_WAIT_WHILE(ctx, !s->out_sendco.done);
-- 
2.5.0

From: Derek Su <dereksu@qnap.com>

The patch is to fix the "pkt" memory leak in packet_enqueue().
The allocated "pkt" needs to be freed if the colo compare
primary or secondary queue is too big.

Replace the error_report of full queue with a trace event.

Signed-off-by: Derek Su <dereksu@qnap.com>
Reviewed-by: Zhang Chen <chen.zhang@intel.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Zhang Chen <chen.zhang@intel.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/colo-compare.c | 23 +++++++++++++++--------
 net/trace-events   |  1 +
 2 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/net/colo-compare.c b/net/colo-compare.c
index XXXXXXX..XXXXXXX 100644
--- a/net/colo-compare.c
+++ b/net/colo-compare.c
@@ -XXX,XX +XXX,XX @@ enum {
     SECONDARY_IN,
 };
 
+static const char *colo_mode[] = {
+    [PRIMARY_IN] = "primary",
+    [SECONDARY_IN] = "secondary",
+};
 
 static int compare_chr_send(CompareState *s,
                             uint8_t *buf,
@@ -XXX,XX +XXX,XX @@ static int packet_enqueue(CompareState *s, int mode, Connection **con)
     ConnectionKey key;
     Packet *pkt = NULL;
     Connection *conn;
+    int ret;
 
     if (mode == PRIMARY_IN) {
         pkt = packet_new(s->pri_rs.buf,
@@ -XXX,XX +XXX,XX @@ static int packet_enqueue(CompareState *s, int mode, Connection **con)
     }
 
     if (mode == PRIMARY_IN) {
-        if (!colo_insert_packet(&conn->primary_list, pkt, &conn->pack)) {
-            error_report("colo compare primary queue size too big,"
-                         "drop packet");
-        }
+        ret = colo_insert_packet(&conn->primary_list, pkt, &conn->pack);
     } else {
-        if (!colo_insert_packet(&conn->secondary_list, pkt, &conn->sack)) {
-            error_report("colo compare secondary queue size too big,"
-                         "drop packet");
-        }
+        ret = colo_insert_packet(&conn->secondary_list, pkt, &conn->sack);
     }
+
+    if (!ret) {
+        trace_colo_compare_drop_packet(colo_mode[mode],
+            "queue size too big, drop packet");
+        packet_destroy(pkt, NULL);
+        pkt = NULL;
+    }
+
     *con = conn;
 
     return 0;
diff --git a/net/trace-events b/net/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/net/trace-events
+++ b/net/trace-events
@@ -XXX,XX +XXX,XX @@ colo_proxy_main(const char *chr) ": %s"
 
 # colo-compare.c
 colo_compare_main(const char *chr) ": %s"
+colo_compare_drop_packet(const char *queue, const char *chr) ": %s: %s"
 colo_compare_udp_miscompare(const char *sta, int size) ": %s = %d"
 colo_compare_icmp_miscompare(const char *sta, int size) ": %s = %d"
 colo_compare_ip_info(int psize, const char *sta, const char *stb, int ssize, const char *stc, const char *std) "ppkt size = %d, ip_src = %s, ip_dst = %s, spkt size = %d, ip_src = %s, ip_dst = %s"
-- 
2.5.0

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

libFuzzer found using 'qemu-system-i386 -M q35':

qemu: hardware error: e1000e: PSRCTL.BSIZE0 cannot be zero
CPU #0:
EAX=00000000 EBX=00000000 ECX=00000000 EDX=00000663
ESI=00000000 EDI=00000000 EBP=00000000 ESP=00000000
EIP=0000fff0 EFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 00000000 0000ffff 00009300
CS =f000 ffff0000 0000ffff 00009b00
SS =0000 00000000 0000ffff 00009300
DS =0000 00000000 0000ffff 00009300
FS =0000 00000000 0000ffff 00009300
GS =0000 00000000 0000ffff 00009300
LDT=0000 00000000 0000ffff 00008200
TR =0000 00000000 0000ffff 00008b00
GDT=     00000000 0000ffff
IDT=     00000000 0000ffff
CR0=60000010 CR2=00000000 CR3=00000000 CR4=00000000
DR0=00000000 DR1=00000000 DR2=00000000 DR3=00000000
DR6=ffff0ff0 DR7=00000400
EFER=0000000000000000
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00000000000000000000000000000000 XMM01=00000000000000000000000000000000
XMM02=00000000000000000000000000000000 XMM03=00000000000000000000000000000000
XMM04=00000000000000000000000000000000 XMM05=00000000000000000000000000000000
XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000
==1988== ERROR: libFuzzer: deadly signal
    #6 0x7fae4d3ea894 in __GI_abort (/lib64/libc.so.6+0x22894)
    #7 0x563f4cc59a1d in hw_error (qemu-fuzz-i386+0xe8ca1d)
    #8 0x563f4d7c93f2 in e1000e_set_psrctl (qemu-fuzz-i386+0x19fc3f2)
    #9 0x563f4d7b798f in e1000e_core_write (qemu-fuzz-i386+0x19ea98f)
    #10 0x563f4d7afc46 in e1000e_mmio_write (qemu-fuzz-i386+0x19e2c46)
    #11 0x563f4cc9a0a7 in memory_region_write_accessor (qemu-fuzz-i386+0xecd0a7)
    #12 0x563f4cc99c13 in access_with_adjusted_size (qemu-fuzz-i386+0xeccc13)
    #13 0x563f4cc987b4 in memory_region_dispatch_write (qemu-fuzz-i386+0xecb7b4)

It simply sent the following 2 I/O command to the e1000e
PCI BAR #2 I/O region:

writew 0x0100 0x0c00 # RCTL =   E1000_RCTL_DTYP_MASK
  writeb 0x2170 0x00   # PSRCTL = 0

2813 static void
2814 e1000e_set_psrctl(E1000ECore *core, int index, uint32_t val)
2815 {
2816     if (core->mac[RCTL] & E1000_RCTL_DTYP_MASK) {
2817
2818         if ((val & E1000_PSRCTL_BSIZE0_MASK) == 0) {
2819             hw_error("e1000e: PSRCTL.BSIZE0 cannot be zero");
2820         }

Instead of calling hw_error() which abort the process (it is
meant for CPU fatal error condition, not for device logging),
log the invalid request with qemu_log_mask(LOG_GUEST_ERROR)
and return, ignoring the request.

Cc: qemu-stable@nongnu.org
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/e1000e_core.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/hw/net/e1000e_core.c b/hw/net/e1000e_core.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/e1000e_core.c
+++ b/hw/net/e1000e_core.c
@@ -XXX,XX +XXX,XX @@
 */
 
 #include "qemu/osdep.h"
+#include "qemu/log.h"
 #include "net/net.h"
 #include "net/tap.h"
-#include "hw/hw.h"
 #include "hw/pci/msi.h"
 #include "hw/pci/msix.h"
 #include "sysemu/runstate.h"
@@ -XXX,XX +XXX,XX @@ e1000e_set_psrctl(E1000ECore *core, int index, uint32_t val)
     if (core->mac[RCTL] & E1000_RCTL_DTYP_MASK) {
 
         if ((val & E1000_PSRCTL_BSIZE0_MASK) == 0) {
-            hw_error("e1000e: PSRCTL.BSIZE0 cannot be zero");
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "e1000e: PSRCTL.BSIZE0 cannot be zero");
+            return;
         }
 
         if ((val & E1000_PSRCTL_BSIZE1_MASK) == 0) {
-            hw_error("e1000e: PSRCTL.BSIZE1 cannot be zero");
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "e1000e: PSRCTL.BSIZE1 cannot be zero");
+            return;
         }
     }
 
-- 
2.5.0

From: Thomas Huth <thuth@redhat.com>

It's been deprecated since QEMU v3.1, so it's time to finally
remove it. The "id" parameter can simply be used instead.

Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 docs/system/deprecated.rst | 15 +++++++++------
 net/net.c                  | 10 +---------
 qapi/net.json              |  3 ---
 3 files changed, 10 insertions(+), 18 deletions(-)

diff --git a/docs/system/deprecated.rst b/docs/system/deprecated.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/deprecated.rst
+++ b/docs/system/deprecated.rst
@@ -XXX,XX +XXX,XX @@ The 'file' driver for drives is no longer appropriate for character or host
 devices and will only accept regular files (S_IFREG). The correct driver
 for these file types is 'host_cdrom' or 'host_device' as appropriate.
 
-``-net ...,name=``\ *name* (since 3.1)
-''''''''''''''''''''''''''''''''''''''
-
-The ``name`` parameter of the ``-net`` option is a synonym
-for the ``id`` parameter, which should now be used instead.
-
 ``-smp`` (invalid topologies) (since 3.1)
 '''''''''''''''''''''''''''''''''''''''''
 
@@ -XXX,XX +XXX,XX @@ What follows is a record of recently removed, formerly deprecated
 features that serves as a record for users who have encountered
 trouble after a recent upgrade.
 
+System emulator command line arguments
+--------------------------------------
+
+``-net ...,name=``\ *name* (removed in 5.1)
+'''''''''''''''''''''''''''''''''''''''''''
+
+The ``name`` parameter of the ``-net`` option was a synonym
+for the ``id`` parameter, which should now be used instead.
+
 QEMU Machine Protocol (QMP) commands
 ------------------------------------
 
diff --git a/net/net.c b/net/net.c
index XXXXXXX..XXXXXXX 100644
--- a/net/net.c
+++ b/net/net.c
@@ -XXX,XX +XXX,XX @@ static int net_client_init1(const void *object, bool is_netdev, Error **errp)
 {
     Netdev legacy = {0};
     const Netdev *netdev;
-    const char *name;
     NetClientState *peer = NULL;
 
     if (is_netdev) {
         netdev = object;
-        name = netdev->id;
 
         if (netdev->type == NET_CLIENT_DRIVER_NIC ||
             !net_client_init_fun[netdev->type]) {
@@ -XXX,XX +XXX,XX @@ static int net_client_init1(const void *object, bool is_netdev, Error **errp)
         const NetLegacyOptions *opts = net->opts;
         legacy.id = net->id;
         netdev = &legacy;
-        /* missing optional values have been initialized to "all bits zero" */
-        name = net->has_id ? net->id : net->name;
-
-        if (net->has_name) {
-            warn_report("The 'name' parameter is deprecated, use 'id' instead");
-        }
 
         /* Map the old options to the new flat type */
         switch (opts->type) {
@@ -XXX,XX +XXX,XX @@ static int net_client_init1(const void *object, bool is_netdev, Error **errp)
         }
     }
 
-    if (net_client_init_fun[netdev->type](netdev, name, peer, errp) < 0) {
+    if (net_client_init_fun[netdev->type](netdev, netdev->id, peer, errp) < 0) {
         /* FIXME drop when all init functions store an Error */
         if (errp && !*errp) {
             error_setg(errp, QERR_DEVICE_INIT_FAILED,
diff --git a/qapi/net.json b/qapi/net.json
index XXXXXXX..XXXXXXX 100644
--- a/qapi/net.json
+++ b/qapi/net.json
@@ -XXX,XX +XXX,XX @@
 #
 # @id: identifier for monitor commands
 #
-# @name: identifier for monitor commands, ignored if @id is present
-#
 # @opts: device type specific properties (legacy)
 #
 # Since: 1.2
@@ -XXX,XX +XXX,XX @@
 { 'struct': 'NetLegacy',
   'data': {
     '*id':   'str',
-    '*name': 'str',
     'opts':  'NetLegacyOptions' } }
 
 ##
-- 
2.5.0

From: Thomas Huth <thuth@redhat.com>

Now that the "name" parameter is gone, there is hardly any difference
between NetLegacy and Netdev anymore, so we can drop NetLegacy and always
use Netdev to simplify the code quite a bit.

The only two differences that were really left between Netdev and NetLegacy:

1) NetLegacy does not allow a "hubport" type. We can continue to block
   this with a simple check in net_client_init1() for this type.

2) The "id" parameter was optional in NetLegacy (and an internal id
   was chosen via assign_name() during initialization), but it is mandatory
   for Netdev. To avoid that the visitor code bails out here, we have to
   add an internal id to the QemuOpts already earlier now.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/net.c     | 77 ++++++++++-------------------------------------------------
 qapi/net.json | 46 -----------------------------------
 2 files changed, 13 insertions(+), 110 deletions(-)

diff --git a/net/net.c b/net/net.c
index XXXXXXX..XXXXXXX 100644
--- a/net/net.c
+++ b/net/net.c
@@ -XXX,XX +XXX,XX @@ static int (* const net_client_init_fun[NET_CLIENT_DRIVER__MAX])(
 };
 
 
-static int net_client_init1(const void *object, bool is_netdev, Error **errp)
+static int net_client_init1(const Netdev *netdev, bool is_netdev, Error **errp)
 {
-    Netdev legacy = {0};
-    const Netdev *netdev;
     NetClientState *peer = NULL;
 
     if (is_netdev) {
-        netdev = object;
-
         if (netdev->type == NET_CLIENT_DRIVER_NIC ||
             !net_client_init_fun[netdev->type]) {
             error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "type",
@@ -XXX,XX +XXX,XX @@ static int net_client_init1(const void *object, bool is_netdev, Error **errp)
             return -1;
         }
     } else {
-        const NetLegacy *net = object;
-        const NetLegacyOptions *opts = net->opts;
-        legacy.id = net->id;
-        netdev = &legacy;
-
-        /* Map the old options to the new flat type */
-        switch (opts->type) {
-        case NET_LEGACY_OPTIONS_TYPE_NONE:
+        if (netdev->type == NET_CLIENT_DRIVER_NONE) {
             return 0; /* nothing to do */
-        case NET_LEGACY_OPTIONS_TYPE_NIC:
-            legacy.type = NET_CLIENT_DRIVER_NIC;
-            legacy.u.nic = opts->u.nic;
-            break;
-        case NET_LEGACY_OPTIONS_TYPE_USER:
-            legacy.type = NET_CLIENT_DRIVER_USER;
-            legacy.u.user = opts->u.user;
-            break;
-        case NET_LEGACY_OPTIONS_TYPE_TAP:
-            legacy.type = NET_CLIENT_DRIVER_TAP;
-            legacy.u.tap = opts->u.tap;
-            break;
-        case NET_LEGACY_OPTIONS_TYPE_L2TPV3:
-            legacy.type = NET_CLIENT_DRIVER_L2TPV3;
-            legacy.u.l2tpv3 = opts->u.l2tpv3;
-            break;
-        case NET_LEGACY_OPTIONS_TYPE_SOCKET:
-            legacy.type = NET_CLIENT_DRIVER_SOCKET;
-            legacy.u.socket = opts->u.socket;
-            break;
-        case NET_LEGACY_OPTIONS_TYPE_VDE:
-            legacy.type = NET_CLIENT_DRIVER_VDE;
-            legacy.u.vde = opts->u.vde;
-            break;
-        case NET_LEGACY_OPTIONS_TYPE_BRIDGE:
-            legacy.type = NET_CLIENT_DRIVER_BRIDGE;
-            legacy.u.bridge = opts->u.bridge;
-            break;
-        case NET_LEGACY_OPTIONS_TYPE_NETMAP:
-            legacy.type = NET_CLIENT_DRIVER_NETMAP;
-            legacy.u.netmap = opts->u.netmap;
-            break;
-        case NET_LEGACY_OPTIONS_TYPE_VHOST_USER:
-            legacy.type = NET_CLIENT_DRIVER_VHOST_USER;
-            legacy.u.vhost_user = opts->u.vhost_user;
-            break;
-        default:
-            abort();
         }
-
-        if (!net_client_init_fun[netdev->type]) {
+        if (netdev->type == NET_CLIENT_DRIVER_HUBPORT ||
+            !net_client_init_fun[netdev->type]) {
             error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "type",
                        "a net backend type (maybe it is not compiled "
                        "into this binary)");
@@ -XXX,XX +XXX,XX @@ static int net_client_init1(const void *object, bool is_netdev, Error **errp)
 
         /* Do not add to a hub if it's a nic with a netdev= parameter. */
         if (netdev->type != NET_CLIENT_DRIVER_NIC ||
-            !opts->u.nic.has_netdev) {
+            !netdev->u.nic.has_netdev) {
             peer = net_hub_add_port(0, NULL, NULL);
         }
     }
@@ -XXX,XX +XXX,XX @@ static void show_netdevs(void)
 static int net_client_init(QemuOpts *opts, bool is_netdev, Error **errp)
 {
     gchar **substrings = NULL;
-    void *object = NULL;
+    Netdev *object = NULL;
     Error *err = NULL;
     int ret = -1;
     Visitor *v = opts_visitor_new(opts);
@@ -XXX,XX +XXX,XX @@ static int net_client_init(QemuOpts *opts, bool is_netdev, Error **errp)
         }
     }
 
-    if (is_netdev) {
-        visit_type_Netdev(v, NULL, (Netdev **)&object, &err);
-    } else {
-        visit_type_NetLegacy(v, NULL, (NetLegacy **)&object, &err);
+    /* Create an ID for -net if the user did not specify one */
+    if (!is_netdev && !qemu_opts_id(opts)) {
+        static int idx;
+        qemu_opts_set_id(opts, g_strdup_printf("__org.qemu.net%i", idx++));
     }
 
+    visit_type_Netdev(v, NULL, &object, &err);
+
     if (!err) {
         ret = net_client_init1(object, is_netdev, &err);
     }
 
-    if (is_netdev) {
-        qapi_free_Netdev(object);
-    } else {
-        qapi_free_NetLegacy(object);
-    }
+    qapi_free_Netdev(object);
 
 out:
     error_propagate(errp, err);
diff --git a/qapi/net.json b/qapi/net.json
index XXXXXXX..XXXXXXX 100644
--- a/qapi/net.json
+++ b/qapi/net.json
@@ -XXX,XX +XXX,XX @@
     'vhost-user': 'NetdevVhostUserOptions' } }
 
 ##
-# @NetLegacy:
-#
-# Captures the configuration of a network device; legacy.
-#
-# @id: identifier for monitor commands
-#
-# @opts: device type specific properties (legacy)
-#
-# Since: 1.2
-##
-{ 'struct': 'NetLegacy',
-  'data': {
-    '*id':   'str',
-    'opts':  'NetLegacyOptions' } }
-
-##
-# @NetLegacyOptionsType:
-#
-# Since: 1.2
-##
-{ 'enum': 'NetLegacyOptionsType',
-  'data': ['none', 'nic', 'user', 'tap', 'l2tpv3', 'socket', 'vde',
-           'bridge', 'netmap', 'vhost-user'] }
-
-##
-# @NetLegacyOptions:
-#
-# Like Netdev, but for use only by the legacy command line options
-#
-# Since: 1.2
-##
-{ 'union': 'NetLegacyOptions',
-  'base': { 'type': 'NetLegacyOptionsType' },
-  'discriminator': 'type',
-  'data': {
-    'nic':      'NetLegacyNicOptions',
-    'user':     'NetdevUserOptions',
-    'tap':      'NetdevTapOptions',
-    'l2tpv3':   'NetdevL2TPv3Options',
-    'socket':   'NetdevSocketOptions',
-    'vde':      'NetdevVdeOptions',
-    'bridge':   'NetdevBridgeOptions',
-    'netmap':   'NetdevNetmapOptions',
-    'vhost-user': 'NetdevVhostUserOptions' } }
-
-##
 # @NetFilterDirection:
 #
 # Indicates whether a netfilter is attached to a netdev's transmit queue or
-- 
2.5.0