The following changes since commit 2a95551e8b1456aa53ce54fac573df18809340a6:

Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20200330' into staging (2020-03-31 11:20:21 +0100)

for you to fetch changes up to 1153cf9f5b67fad41ca6f8571e9a26e2c7c70759:

qtest: add tulip test case (2020-03-31 21:14:35 +0800)

Andrew Melnychenko (1):

Fixed integer overflow in e1000e

Li Qiang (1):

qtest: add tulip test case

Peter Maydell (2):

hw/net/i82596.c: Avoid reading off end of buffer in i82596_receive()

hw/net/allwinner-sun8i-emac.c: Fix REG_ADDR_HIGH/LOW reads

Philippe Mathieu-Daudé (7):

hw/net/i82596: Correct command bitmask (CID 1419392)

hw/net/e1000e_core: Let e1000e_can_receive() return a boolean

hw/net/smc91c111: Let smc91c111_can_receive() return a boolean

hw/net/rtl8139: Simplify if/else statement

hw/net/rtl8139: Update coding style to make checkpatch.pl happy

hw/net: Make NetCanReceive() return a boolean

hw/net/can: Make CanBusClientInfo::can_receive() return a boolean

Prasad J Pandit (1):

net: tulip: check frame size and r/w data length

Zhang Chen (2):

net/colo-compare.c: Expose "compare_timeout" to users

net/colo-compare.c: Expose "expired_scan_cycle" to users

hw/net/allwinner-sun8i-emac.c | 14 +++----

hw/net/allwinner_emac.c | 2 +-

hw/net/cadence_gem.c | 8 ++--

hw/net/can/can_sja1000.c | 8 ++--

hw/net/can/can_sja1000.h | 2 +-

hw/net/dp8393x.c | 8 ++--

hw/net/e1000.c | 2 +-

hw/net/e1000e.c | 4 +-

hw/net/e1000e_core.c | 2 +-

hw/net/e1000e_core.h | 2 +-

hw/net/ftgmac100.c | 6 +--

hw/net/i82596.c | 66 ++++++++++++++++++++----------

hw/net/i82596.h | 2 +-

hw/net/imx_fec.c | 2 +-

hw/net/opencores_eth.c | 5 +--

hw/net/rtl8139.c | 22 +++++-----

hw/net/smc91c111.c | 10 ++---

hw/net/spapr_llan.c | 4 +-

hw/net/sungem.c | 6 +--

hw/net/sunhme.c | 4 +-

hw/net/tulip.c | 36 ++++++++++++----

hw/net/virtio-net.c | 10 ++---

hw/net/xilinx_ethlite.c | 2 +-

include/net/can_emu.h | 2 +-

include/net/net.h | 2 +-

net/can/can_socketcan.c | 4 +-

net/colo-compare.c | 95 ++++++++++++++++++++++++++++++++++++++++---

net/filter-buffer.c | 2 +-

net/hub.c | 6 +--

qemu-options.hx | 10 +++--

tests/qtest/Makefile.include | 1 +

tests/qtest/tulip-test.c | 91 +++++++++++++++++++++++++++++++++++++++++

32 files changed, 328 insertions(+), 112 deletions(-)

create mode 100644 tests/qtest/tulip-test.c

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The command is 32-bit, but we are loading the 16 upper bits with

the 'get_uint16(s->scb + 2)' call.

Once shifted by 16, the command bits match the status bits:

- Command

Bit 31 ACK-CX Acknowledges that the CU completed an Action Command.

Bit 30 ACK-FR Acknowledges that the RU received a frame.

Bit 29 ACK-CNA Acknowledges that the Command Unit became not active.

Bit 28 ACK-RNR Acknowledges that the Receive Unit became not ready.

- Status

Bit 15 CX The CU finished executing a command with its I(interrupt) bit set.

Bit 14 FR The RU finished receiving a frame.

Bit 13 CNA The Command Unit left the Active state.

Bit 12 RNR The Receive Unit left the Ready state.

Add the SCB_COMMAND_ACK_MASK definition to simplify the code.

This fixes Coverity 1419392 (CONSTANT_EXPRESSION_RESULT):

/hw/net/i82596.c: 352 in examine_scb()

346 cuc = (command >> 8) & 0x7;

347 ruc = (command >> 4) & 0x7;

348 DBG(printf("MAIN COMMAND %04x cuc %02x ruc %02x\n", command, cuc, ruc));

349 /* and clear the scb command word */

350 set_uint16(s->scb + 2, 0);

351

>>> CID 1419392: (CONSTANT_EXPRESSION_RESULT)

>>> "command & (2147483648UL /* 1UL << 31 */)" is always 0 regardless of the values of its operands. This occurs as the logical operand of "if".

352 if (command & BIT(31)) /* ACK-CX */

353 s->scb_status &= ~SCB_STATUS_CX;

>>> CID 1419392: (CONSTANT_EXPRESSION_RESULT)

>>> "command & (1073741824UL /* 1UL << 30 */)" is always 0 regardless of the values of its operands. This occurs as the logical operand of "if".

354 if (command & BIT(30)) /*ACK-FR */

355 s->scb_status &= ~SCB_STATUS_FR;

>>> CID 1419392: (CONSTANT_EXPRESSION_RESULT)

>>> "command & (536870912UL /* 1UL << 29 */)" is always 0 regardless of the values of its operands. This occurs as the logical operand of "if".

356 if (command & BIT(29)) /*ACK-CNA */

357 s->scb_status &= ~SCB_STATUS_CNA;

>>> CID 1419392: (CONSTANT_EXPRESSION_RESULT)

>>> "command & (268435456UL /* 1UL << 28 */)" is always 0 regardless of the values of its operands. This occurs as the logical operand of "if".

358 if (command & BIT(28)) /*ACK-RNR */

359 s->scb_status &= ~SCB_STATUS_RNR;

Fixes: Covertiy CID 1419392 (commit 376b851909)

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>

Reviewed-by: Peter Maydell <peter.maydell@linaro.org>

hw/net/i82596.c | 12 ++++--------

1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/hw/net/i82596.c b/hw/net/i82596.c

--- a/hw/net/i82596.c

+++ b/hw/net/i82596.c

@@ -XXX,XX +XXX,XX @@

#define SCB_STATUS_CNA 0x2000 /* CU left active state */

#define SCB_STATUS_RNR 0x1000 /* RU left active state */

+#define SCB_COMMAND_ACK_MASK \

+ (SCB_STATUS_CX | SCB_STATUS_FR | SCB_STATUS_CNA | SCB_STATUS_RNR)

+

#define CU_IDLE 0

#define CU_SUSPENDED 1

#define CU_ACTIVE 2

@@ -XXX,XX +XXX,XX @@ static void examine_scb(I82596State *s)

/* and clear the scb command word */

set_uint16(s->scb + 2, 0);

- if (command & BIT(31)) /* ACK-CX */

- s->scb_status &= ~SCB_STATUS_CX;

- if (command & BIT(30)) /*ACK-FR */

- s->scb_status &= ~SCB_STATUS_FR;

- if (command & BIT(29)) /*ACK-CNA */

- s->scb_status &= ~SCB_STATUS_CNA;

- if (command & BIT(28)) /*ACK-RNR */

- s->scb_status &= ~SCB_STATUS_RNR;

+ s->scb_status &= ~(command & SCB_COMMAND_ACK_MASK);

switch (cuc) {

case 0: /* no change */

2.5.0

From: Peter Maydell <peter.maydell@linaro.org>

The i82596_receive() function attempts to pass the guest a buffer

which is effectively the concatenation of the data it is passed and a

4 byte CRC value. However, rather than implementing this as "write

the data; then write the CRC" it instead bumps the length value of

the data by 4, and writes 4 extra bytes from beyond the end of the

buffer, which it then overwrites with the CRC. It also assumed that

we could always fit all four bytes of the CRC into the final receive

buffer, which might not be true if the CRC needs to be split over two

receive buffers.

Calculate separately how many bytes we need to transfer into the

guest's receive buffer from the source buffer, and how many we need

to transfer from the CRC work.

We add a count 'bufsz' of the number of bytes left in the source

buffer, which we use purely to assert() that we don't overrun.

Spotted by Coverity (CID 1419396) for the specific case when we end

up using a local array as the source buffer.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>

hw/net/i82596.c | 44 +++++++++++++++++++++++++++++++++++---------

1 file changed, 35 insertions(+), 9 deletions(-)

diff --git a/hw/net/i82596.c b/hw/net/i82596.c

--- a/hw/net/i82596.c

+++ b/hw/net/i82596.c

@@ -XXX,XX +XXX,XX @@ ssize_t i82596_receive(NetClientState *nc, const uint8_t *buf, size_t sz)

uint32_t rfd_p;

uint32_t rbd;

uint16_t is_broadcast = 0;

- size_t len = sz;

+ size_t len = sz; /* length of data for guest (including CRC) */

+ size_t bufsz = sz; /* length of data in buf */

uint32_t crc;

uint8_t *crc_ptr;

uint8_t buf1[MIN_BUF_SIZE + VLAN_HLEN];

@@ -XXX,XX +XXX,XX @@ ssize_t i82596_receive(NetClientState *nc, const uint8_t *buf, size_t sz)

if (len < MIN_BUF_SIZE) {

len = MIN_BUF_SIZE;

/* Calculate the ethernet checksum (4 bytes) */

@@ -XXX,XX +XXX,XX @@ ssize_t i82596_receive(NetClientState *nc, const uint8_t *buf, size_t sz)

while (len) {

uint16_t buffer_size, num;

uint32_t rba;

+ size_t bufcount, crccount;

/* printf("Receive: rbd is %08x\n", rbd); */

buffer_size = get_uint16(rbd + 12);

@@ -XXX,XX +XXX,XX @@ ssize_t i82596_receive(NetClientState *nc, const uint8_t *buf, size_t sz)

}

rba = get_uint32(rbd + 8);

/* printf("rba is 0x%x\n", rba); */

- address_space_write(&address_space_memory, rba,

- MEMTXATTRS_UNSPECIFIED, buf, num);

- rba += num;

- buf += num;

- len -= num;

- if (len == 0) { /* copy crc */

- address_space_write(&address_space_memory, rba - 4,

- MEMTXATTRS_UNSPECIFIED, crc_ptr, 4);

+ /*

+ * Calculate how many bytes we want from buf[] and how many

+ * from the CRC.

+ */

+ if ((len - num) >= 4) {

+ /* The whole guest buffer, we haven't hit the CRC yet */

+ bufcount = num;

+ } else {

+ /* All that's left of buf[] */

+ bufcount = len - 4;

+ }

+ crccount = num - bufcount;

+

+ if (bufcount > 0) {

+ /* Still some of the actual data buffer to transfer */

+ assert(bufsz >= bufcount);

+ bufsz -= bufcount;

+ address_space_write(&address_space_memory, rba,

+ MEMTXATTRS_UNSPECIFIED, buf, bufcount);

+ rba += bufcount;

+ buf += bufcount;

+ len -= bufcount;

+ }

+

+ /* Write as much of the CRC as fits */

+ if (crccount > 0) {

+ address_space_write(&address_space_memory, rba,

+ MEMTXATTRS_UNSPECIFIED, crc_ptr, crccount);

+ rba += crccount;

+ crc_ptr += crccount;

+ len -= crccount;

}

num |= 0x4000; /* set F BIT */

2.5.0

From: Andrew Melnychenko <andrew@daynix.com>

Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1737400

Fixed setting max_queue_num if there are no peers in

NICConf. qemu_new_nic() creates NICState with 1 NetClientState(index

0) without peers, set max_queue_num to 0 - It prevents undefined

behavior and possible crashes, especially during pcie hotplug.

Fixes: 6f3fbe4ed06 ("net: Introduce e1000e device emulation")

Signed-off-by: Andrew Melnychenko <andrew@daynix.com>

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Reviewed-by: Dmitry Fleytman <dmitry.fleytman@gmail.com>

hw/net/e1000e.c | 2 +-

diff --git a/hw/net/e1000e.c b/hw/net/e1000e.c

--- a/hw/net/e1000e.c

+++ b/hw/net/e1000e.c

@@ -XXX,XX +XXX,XX @@ e1000e_init_net_peer(E1000EState *s, PCIDevice *pci_dev, uint8_t *macaddr)

s->nic = qemu_new_nic(&net_e1000e_info, &s->conf,

object_get_typename(OBJECT(s)), dev->id, s);

- s->core.max_queue_num = s->conf.peers.queues - 1;

+ s->core.max_queue_num = s->conf.peers.queues ? s->conf.peers.queues - 1 : 0;

trace_e1000e_mac_set_permanent(MAC_ARG(macaddr));

memcpy(s->core.permanent_mac, macaddr, sizeof(s->core.permanent_mac));

2.5.0

From: Philippe Mathieu-Daudé <philmd@redhat.com>

The e1000e_can_receive() function simply returns a boolean value.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>

hw/net/e1000e_core.c | 2 +-

hw/net/e1000e_core.h | 2 +-

2 files changed, 2 insertions(+), 2 deletions(-)

@@ -XXX,XX +XXX,XX @@ e1000e_start_recv(E1000ECore *core)

}

}

-int

+bool

e1000e_can_receive(E1000ECore *core)

{

int i;

diff --git a/hw/net/e1000e_core.h b/hw/net/e1000e_core.h

--- a/hw/net/e1000e_core.h

+++ b/hw/net/e1000e_core.h

@@ -XXX,XX +XXX,XX @@ e1000e_core_set_link_status(E1000ECore *core);

void

e1000e_core_pci_uninit(E1000ECore *core);

-int

+bool

e1000e_can_receive(E1000ECore *core);

ssize_t

2.5.0

From: Philippe Mathieu-Daudé <philmd@redhat.com>

The smc91c111_can_receive() function simply returns a boolean value.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Reviewed-by: Cédric Le Goater <clg@kaod.org>

hw/net/smc91c111.c | 8 ++++----

1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/net/smc91c111.c b/hw/net/smc91c111.c

--- a/hw/net/smc91c111.c

+++ b/hw/net/smc91c111.c

@@ -XXX,XX +XXX,XX @@ static void smc91c111_update(smc91c111_state *s)

qemu_set_irq(s->irq, level);

}

-static int smc91c111_can_receive(smc91c111_state *s)

+static bool smc91c111_can_receive(smc91c111_state *s)

if ((s->rcr & RCR_RXEN) == 0 || (s->rcr & RCR_SOFT_RST)) {

- return 1;

+ return true;

if (s->allocated == (1 << NUM_PACKETS) - 1 ||

s->rx_fifo_len == NUM_PACKETS) {

- return 0;

+ return false;

- return 1;

+ return true;

static inline void smc91c111_flush_queued_packets(smc91c111_state *s)

2.5.0

From: Philippe Mathieu-Daudé <philmd@redhat.com>

Rewrite:

if (E) {

return A;

} else {

return B;

}

/* EOF */

}

as:

if (E) {

return A;

}

return B;

}

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Reviewed-by: Cédric Le Goater <clg@kaod.org>

hw/net/rtl8139.c | 8 ++++----

1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c

--- a/hw/net/rtl8139.c

+++ b/hw/net/rtl8139.c

@@ -XXX,XX +XXX,XX @@ static int rtl8139_can_receive(NetClientState *nc)

/* ??? Flow control not implemented in c+ mode.

This is a hack to work around slirp deficiencies anyway. */

return 1;

- } else {

- avail = MOD2(s->RxBufferSize + s->RxBufPtr - s->RxBufAddr,

- s->RxBufferSize);

- return (avail == 0 || avail >= 1514 || (s->IntrMask & RxOverflow));

}

+

+ avail = MOD2(s->RxBufferSize + s->RxBufPtr - s->RxBufAddr,

+ s->RxBufferSize);

+ return avail == 0 || avail >= 1514 || (s->IntrMask & RxOverflow);

static ssize_t rtl8139_do_receive(NetClientState *nc, const uint8_t *buf, size_t size_, int do_interrupt)

2.5.0

From: Philippe Mathieu-Daudé <philmd@redhat.com>

We will modify this code in the next commit. Clean it up

first to avoid checkpatch.pl errors.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Reviewed-by: Cédric Le Goater <clg@kaod.org>

hw/net/rtl8139.c | 10 ++++++----

1 file changed, 6 insertions(+), 4 deletions(-)

@@ -XXX,XX +XXX,XX @@ static int rtl8139_can_receive(NetClientState *nc)

int avail;

/* Receive (drop) packets if card is disabled. */

- if (!s->clock_enabled)

- return 1;

- if (!rtl8139_receiver_enabled(s))

- return 1;

+ if (!s->clock_enabled) {

+ return 1;

+ }

+ if (!rtl8139_receiver_enabled(s)) {

+ return 1;

+ }

if (rtl8139_cp_receiver_enabled(s) && rtl8139_cp_rx_valid(s)) {

/* ??? Flow control not implemented in c+ mode.

2.5.0

From: Philippe Mathieu-Daudé <philmd@redhat.com>

The NetCanReceive handler return whether the device can or

can not receive new packets. Make it obvious by returning

a boolean type.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>

Acked-by: David Gibson <david@gibson.dropbear.id.au>

Reviewed-by: Alistair Francis <alistair.francis@wdc.com>

Reviewed-by: Cédric Le Goater <clg@kaod.org>

hw/net/allwinner_emac.c | 2 +-

hw/net/cadence_gem.c | 8 ++++----

hw/net/dp8393x.c | 8 +++-----

hw/net/e1000.c | 2 +-

hw/net/e1000e.c | 2 +-

hw/net/ftgmac100.c | 6 +++---

hw/net/i82596.c | 10 +++++-----

hw/net/i82596.h | 2 +-

hw/net/imx_fec.c | 2 +-

hw/net/opencores_eth.c | 5 ++---

hw/net/rtl8139.c | 8 ++++----

hw/net/smc91c111.c | 2 +-

hw/net/spapr_llan.c | 4 ++--

hw/net/sungem.c | 6 +++---

hw/net/sunhme.c | 4 ++--

hw/net/virtio-net.c | 10 +++++-----

hw/net/xilinx_ethlite.c | 2 +-

include/net/net.h | 2 +-

net/filter-buffer.c | 2 +-

net/hub.c | 6 +++---

20 files changed, 45 insertions(+), 48 deletions(-)

diff --git a/hw/net/allwinner_emac.c b/hw/net/allwinner_emac.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/net/allwinner_emac.c

+++ b/hw/net/allwinner_emac.c

@@ -XXX,XX +XXX,XX @@ static uint32_t fifo8_pop_word(Fifo8 *fifo)

return ret;

}

-static int aw_emac_can_receive(NetClientState *nc)

+static bool aw_emac_can_receive(NetClientState *nc)

{

AwEmacState *s = qemu_get_nic_opaque(nc);

diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/net/cadence_gem.c

+++ b/hw/net/cadence_gem.c

@@ -XXX,XX +XXX,XX @@ static void phy_update_link(CadenceGEMState *s)

}

}

-static int gem_can_receive(NetClientState *nc)

+static bool gem_can_receive(NetClientState *nc)

{

CadenceGEMState *s;

int i;

@@ -XXX,XX +XXX,XX @@ static int gem_can_receive(NetClientState *nc)

s->can_rx_state = 1;

DB_PRINT("can't receive - no enable\n");

}

- return 0;

+ return false;

}

for (i = 0; i < s->num_priority_queues; i++) {

@@ -XXX,XX +XXX,XX @@ static int gem_can_receive(NetClientState *nc)

s->can_rx_state = 2;

DB_PRINT("can't receive - all the buffer descriptors are busy\n");

}

- return 0;

+ return false;

}

if (s->can_rx_state != 0) {

s->can_rx_state = 0;

DB_PRINT("can receive\n");

}

- return 1;

+ return true;

}

/*

diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/net/dp8393x.c

+++ b/hw/net/dp8393x.c

@@ -XXX,XX +XXX,XX @@ static void dp8393x_do_stop_timer(dp8393xState *s)

dp8393x_update_wt_regs(s);

}

-static int dp8393x_can_receive(NetClientState *nc);

+static bool dp8393x_can_receive(NetClientState *nc);

static void dp8393x_do_receiver_enable(dp8393xState *s)

{

@@ -XXX,XX +XXX,XX @@ static void dp8393x_watchdog(void *opaque)

dp8393x_update_irq(s);

}

-static int dp8393x_can_receive(NetClientState *nc)

+static bool dp8393x_can_receive(NetClientState *nc)

{

dp8393xState *s = qemu_get_nic_opaque(nc);

- if (!(s->regs[SONIC_CR] & SONIC_CR_RXEN))

- return 0;

- return 1;

+ return !!(s->regs[SONIC_CR] & SONIC_CR_RXEN);

}

static int dp8393x_receive_filter(dp8393xState *s, const uint8_t * buf,

diff --git a/hw/net/e1000.c b/hw/net/e1000.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/net/e1000.c

+++ b/hw/net/e1000.c

@@ -XXX,XX +XXX,XX @@ static bool e1000_has_rxbufs(E1000State *s, size_t total_size)

return total_size <= bufs * s->rxbuf_size;

}

-static int

+static bool

e1000_can_receive(NetClientState *nc)

{

E1000State *s = qemu_get_nic_opaque(nc);

diff --git a/hw/net/e1000e.c b/hw/net/e1000e.c

index XXXXXXX..XXXXXXX 100644

--- a/hw/net/e1000e.c

+++ b/hw/net/e1000e.c

@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps io_ops = {

},