Series comparison

-[Qemu-devel] [PULL 0/6] Net patches
+[PULL 00/13] Net patches
-The following changes since commit 2e02083438962d26ef9dcc7100f3b378104183db:
+The following changes since commit bdee969c0e65d4d509932b1d70e3a3b2ffbff6d5:
-  Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging (2017-11-17 19:08:07 +0000)
+  Merge remote-tracking branch 'remotes/bonzini-gitlab/tags/for-upstream' into staging (2021-03-19 18:01:17 +0000)
 are available in the git repository at:
   https://github.com/jasowang/qemu.git tags/net-pull-request
-for you to fetch changes up to c527e0afcd7d719abc3a5ca5e4c8ac2fe48b999f:
+for you to fetch changes up to c7274b5ef43614dd133daec1e2018f71d8744088:
-  hw/net/vmxnet3: Fix code to work on big endian hosts, too (2017-11-20 11:08:00 +0800)
+  net/eth: Add an assert() and invert if() statement to simplify code (2021-03-22 17:34:31 +0800)
 ----------------------------------------------------------------
 ----------------------------------------------------------------
-Ed Swierk (1):
+Bin Meng (4):
-      net: Transmit zero UDP checksum as 0xFFFF
+      net: eth: Add a helper to pad a short Ethernet frame
       net: Add a 'do_not_pad" to NetClientState
       net: Pad short frames to minimum size before sending from SLiRP/TAP
       hw/net: virtio-net: Initialize nc->do_not_pad to true
-Jason Wang (1):
+Lukas Straub (2):
-      Revert "Add new PCI ID for i82559a"
+      net/colo-compare.c: Fix memory leak for non-tcp packet
       net/colo-compare.c: Optimize removal of secondary packet
-Mao Zhongyi (1):
+Philippe Mathieu-Daudé (7):
-      colo-compare: fix the dangerous assignment
+      net/eth: Use correct in6_address offset in _eth_get_rss_ex_dst_addr()
       net/eth: Simplify _eth_get_rss_ex_dst_addr()
       net/eth: Better describe _eth_get_rss_ex_dst_addr's offset argument
       net/eth: Check size earlier in _eth_get_rss_ex_dst_addr()
       net/eth: Check iovec has enough data earlier
       net/eth: Read ip6_ext_hdr_routing buffer before accessing it
       net/eth: Add an assert() and invert if() statement to simplify code
-Stefan Weil (1):
+ MAINTAINERS                    |  1 +
-      MAINTAINERS: Add missing entry for eepro100 emulation
+ hw/net/virtio-net.c            |  4 +++
+ include/net/eth.h              | 17 ++++++++++++
-Thomas Huth (2):
+ include/net/net.h              |  1 +
-      hw/net/eepro100: Fix endianness problem on big endian hosts
+ net/colo-compare.c             |  3 ++-
-      hw/net/vmxnet3: Fix code to work on big endian hosts, too
+ net/eth.c                      | 61 +++++++++++++++++++++++++++---------------
+ net/slirp.c                    | 10 +++++++
- MAINTAINERS            |   5 ++
+ net/tap-win32.c                | 10 +++++++
- hw/net/e1000.c         |   2 +-
+ net/tap.c                      | 10 +++++++
- hw/net/eepro100.c      |  17 +---
+ tests/qtest/fuzz-e1000e-test.c | 53 ++++++++++++++++++++++++++++++++++++
- hw/net/net_rx_pkt.c    |   2 +-
+ tests/qtest/meson.build        |  1 +
- hw/net/net_tx_pkt.c    |   2 +-
+files changed, 148 insertions(+), 23 deletions(-)
- hw/net/vmware_utils.h  |   6 ++
+ create mode 100644 tests/qtest/fuzz-e1000e-test.c
  hw/net/vmxnet3.c       |  49 ++++++++---
  hw/net/vmxnet3.h       | 230 ++++++++++++++++++++++++++++++-------------------
  include/hw/compat.h    |   4 -
  include/hw/pci/pci.h   |   1 -
  include/net/checksum.h |   6 ++
  net/colo-compare.c     |   2 +-
  qemu-options.hx        |   2 +-
 files changed, 201 insertions(+), 127 deletions(-)

-New patch
+[PULL 01/13] net: eth: Add a helper to pad a short Ethernet frame
+From: Bin Meng <bmeng.cn@gmail.com>
+Add a helper to pad a short Ethernet frame to the minimum required
+length, which can be used by backends' code.
+Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ include/net/eth.h | 17 +++++++++++++++++
+ net/eth.c         | 17 +++++++++++++++++
+files changed, 34 insertions(+)
+diff --git a/include/net/eth.h b/include/net/eth.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/net/eth.h
++++ b/include/net/eth.h
+@@ -XXX,XX +XXX,XX @@
+ #define ETH_ALEN 6
+ #define ETH_HLEN 14
++#define ETH_ZLEN 60     /* Min. octets in frame without FCS */
+ struct eth_header {
+     uint8_t  h_dest[ETH_ALEN];   /* destination eth addr */
+@@ -XXX,XX +XXX,XX @@ bool
+ eth_parse_ipv6_hdr(const struct iovec *pkt, int pkt_frags,
+                    size_t ip6hdr_off, eth_ip6_hdr_info *info);
++/**
++ * eth_pad_short_frame - pad a short frame to the minimum Ethernet frame length
++ *
++ * If the Ethernet frame size is shorter than 60 bytes, it will be padded to
++ * 60 bytes at the address @padded_pkt.
++ *
++ * @padded_pkt: buffer address to hold the padded frame
++ * @padded_buflen: pointer holding length of @padded_pkt. If the frame is
++ *                 padded, the length will be updated to the padded one.
++ * @pkt: address to hold the original Ethernet frame
++ * @pkt_size: size of the original Ethernet frame
++ * @return true if the frame is padded, otherwise false
++ */
++bool eth_pad_short_frame(uint8_t *padded_pkt, size_t *padded_buflen,
++                         const void *pkt, size_t pkt_size);
++
+ #endif
+diff --git a/net/eth.c b/net/eth.c
+index XXXXXXX..XXXXXXX 100644
+--- a/net/eth.c
++++ b/net/eth.c
+@@ -XXX,XX +XXX,XX @@ bool eth_parse_ipv6_hdr(const struct iovec *pkt, int pkt_frags,
+     info->l4proto = ext_hdr.ip6r_nxt;
+     return true;
+ }
++
++bool eth_pad_short_frame(uint8_t *padded_pkt, size_t *padded_buflen,
++                         const void *pkt, size_t pkt_size)
++{
++    assert(padded_buflen && *padded_buflen >= ETH_ZLEN);
++
++    if (pkt_size >= ETH_ZLEN) {
++        return false;
++    }
++
++    /* pad to minimum Ethernet frame length */
++    memcpy(padded_pkt, pkt, pkt_size);
++    memset(&padded_pkt[pkt_size], 0, ETH_ZLEN - pkt_size);
++    *padded_buflen = ETH_ZLEN;
++
++    return true;
++}
+--
+.7.4

-[Qemu-devel] [PULL 2/6] Revert "Add new PCI ID for i82559a"
+[PULL 02/13] net: Add a 'do_not_pad" to NetClientState
-This reverts commit 5e89dc01133f8f5e621f6b66b356c6f37d31dafb since:
+From: Bin Meng <bmeng.cn@gmail.com>
-- we should use ID in the spec instead the one used by OEM
+This adds a flag in NetClientState, so that a net client can tell
-- in the future, we should allow changing id through either property
+its peer that the packets do not need to be padded to the minimum
-  or EEPROM file.
+size of an Ethernet frame (60 bytes) before sending to it.
-Cc: Stefan Weil <sw@weilnetz.de>
+Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
-Cc: Michael Nawrocki <michael.nawrocki@gtri.gatech.edu>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Cc: Peter Maydell <peter.maydell@linaro.org>
 Cc: Michael S. Tsirkin <mst@redhat.com>
 Reviewed-by: Stefan Weil <sw@weilnetz.de>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- hw/net/eepro100.c    | 13 -------------
+ include/net/net.h | 1 +
- include/hw/compat.h  |  4 ----
+file changed, 1 insertion(+)
  include/hw/pci/pci.h |  1 -
  qemu-options.hx      |  2 +-
 files changed, 1 insertion(+), 19 deletions(-)
-diff --git a/hw/net/eepro100.c b/hw/net/eepro100.c
+diff --git a/include/net/net.h b/include/net/net.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/eepro100.c
+--- a/include/net/net.h
-+++ b/hw/net/eepro100.c
++++ b/include/net/net.h
-@@ -XXX,XX +XXX,XX @@ typedef struct {
+@@ -XXX,XX +XXX,XX @@ struct NetClientState {
-     const char *name;
+     int vring_enable;
-     const char *desc;
+     int vnet_hdr_len;
-     uint16_t device_id;
+     bool is_netdev;
--    uint16_t alt_device_id;
++    bool do_not_pad; /* do not pad to the minimum ethernet frame length */
-     uint8_t revision;
+     QTAILQ_HEAD(, NetFilterState) filters;
      uint16_t subsystem_vendor_id;
      uint16_t subsystem_id;
@@ -XXX,XX +XXX,XX @@ typedef struct {
      /* Quasi static device properties (no need to save them). */
      uint16_t stats_size;
      bool has_extended_tcb_support;
 -    bool use_alt_device_id;
  } EEPRO100State;
  /* Word indices in EEPROM. */
@@ -XXX,XX +XXX,XX @@ static void e100_nic_realize(PCIDevice *pci_dev, Error **errp)
      TRACE(OTHER, logout("\n"));
 -    /* By default, the i82559a adapter uses the legacy PCI ID (for the
 -     * i82557). This allows the PCI ID to be changed to the alternate
 -     * i82559 ID if needed.
 -     */
 -    if (s->use_alt_device_id && strcmp(info->name, "i82559a") == 0) {
 -        pci_config_set_device_id(s->dev.config, info->alt_device_id);
 -    }
 -
      s->device = info->device;
      e100_pci_reset(s, &local_err);
@@ -XXX,XX +XXX,XX @@ static E100PCIDeviceInfo e100_devices[] = {
          .desc = "Intel i82559A Ethernet",
          .device = i82559A,
          .device_id = PCI_DEVICE_ID_INTEL_82557,
 -        .alt_device_id = PCI_DEVICE_ID_INTEL_82559,
          .revision = 0x06,
          .stats_size = 80,
          .has_extended_tcb_support = true,
@@ -XXX,XX +XXX,XX @@ static E100PCIDeviceInfo *eepro100_get_class(EEPRO100State *s)
  static Property e100_properties[] = {
      DEFINE_NIC_PROPERTIES(EEPRO100State, conf),
 -    DEFINE_PROP_BOOL("x-use-alt-device-id", EEPRO100State, use_alt_device_id,
 -                     true),
      DEFINE_PROP_END_OF_LIST(),
  };
-diff --git a/include/hw/compat.h b/include/hw/compat.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/compat.h
-+++ b/include/hw/compat.h
-@@ -XXX,XX +XXX,XX @@
-         .driver   = "virtio-tablet-device",\
-         .property = "wheel-axis",\
-         .value    = "false",\
--    },{\
--        .driver   = "i82559a",\
--        .property = "x-use-alt-device-id",\
--        .value    = "false",\
-     },
- #define HW_COMPAT_2_9 \
-diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/hw/pci/pci.h
-+++ b/include/hw/pci/pci.h
-@@ -XXX,XX +XXX,XX @@ extern bool pci_available;
- /* Intel (0x8086) */
- #define PCI_DEVICE_ID_INTEL_82551IT      0x1209
- #define PCI_DEVICE_ID_INTEL_82557        0x1229
--#define PCI_DEVICE_ID_INTEL_82559        0x1030
- #define PCI_DEVICE_ID_INTEL_82801IR      0x2922
- /* Red Hat / Qumranet (for QEMU) -- see pci-ids.txt */
-diff --git a/qemu-options.hx b/qemu-options.hx
-index XXXXXXX..XXXXXXX 100644
---- a/qemu-options.hx
-+++ b/qemu-options.hx
-@@ -XXX,XX +XXX,XX @@ that the card should have; this option currently only affects virtio cards; set
- @var{v} = 0 to disable MSI-X. If no @option{-net} option is specified, a single
- NIC is created.  QEMU can emulate several different models of network card.
- Valid values for @var{type} are
--@code{virtio}, @code{i82551}, @code{i82557b}, @code{i82559a}, @code{i82559er},
-+@code{virtio}, @code{i82551}, @code{i82557b}, @code{i82559er},
- @code{ne2k_pci}, @code{ne2k_isa}, @code{pcnet}, @code{rtl8139},
- @code{e1000}, @code{smc91c111}, @code{lance} and @code{mcf_fec}.
- Not all devices are supported on all targets.  Use @code{-net nic,model=help}
 --
 .7.4

-New patch
+[PULL 03/13] net: Pad short frames to minimum size before sending from SLiRP/TAP
+From: Bin Meng <bmeng.cn@gmail.com>
+The minimum Ethernet frame length is 60 bytes. For short frames with
+smaller length like ARP packets (only 42 bytes), on a real world NIC
+it can choose either padding its length to the minimum required 60
+bytes, or sending it out directly to the wire. Such behavior can be
+hardcoded or controled by a register bit. Similarly on the receive
+path, NICs can choose either dropping such short frames directly or
+handing them over to software to handle.
+On the other hand, for the network backends like SLiRP/TAP, they
+don't expose a way to control the short frame behavior. As of today
+they just send/receive data from/to the other end connected to them,
+which means any sized packet is acceptable. So they can send and
+receive short frames without any problem. It is observed that ARP
+packets sent from SLiRP/TAP are 42 bytes, and SLiRP/TAP just send
+these ARP packets to the other end which might be a NIC model that
+does not allow short frames to pass through.
+To provide better compatibility, for packets sent from QEMU network
+backends like SLiRP/TAP, we change to pad short frames before sending
+it out to the other end, if the other end does not forbid it via the
+nc->do_not_pad flag. This ensures a backend as an Ethernet sender
+does not violate the spec. But with this change, the behavior of
+dropping short frames from SLiRP/TAP interfaces in the NIC model
+cannot be emulated because it always receives a packet that is spec
+complaint. The capability of sending short frames from NIC models is
+still supported and short frames can still pass through SLiRP/TAP.
+This commit should be able to fix the issue as reported with some
+NIC models before, that ARP requests get dropped, preventing the
+guest from becoming visible on the network. It was workarounded in
+these NIC models on the receive path, that when a short frame is
+received, it is padded up to 60 bytes.
+The following 2 commits seem to be the one to workaround this issue
+in e1000 and vmxenet3 before, and should probably be reverted.
+  commit 78aeb23eded2 ("e1000: Pad short frames to minimum size (60 bytes)")
+  commit 40a87c6c9b11 ("vmxnet3: Pad short frames to minimum size (60 bytes)")
+Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ net/slirp.c     | 10 ++++++++++
+ net/tap-win32.c | 10 ++++++++++
+ net/tap.c       | 10 ++++++++++
+files changed, 30 insertions(+)
+diff --git a/net/slirp.c b/net/slirp.c
+index XXXXXXX..XXXXXXX 100644
+--- a/net/slirp.c
++++ b/net/slirp.c
+@@ -XXX,XX +XXX,XX @@
+ #include <pwd.h>
+ #include <sys/wait.h>
+ #endif
++#include "net/eth.h"
+ #include "net/net.h"
+ #include "clients.h"
+ #include "hub.h"
+@@ -XXX,XX +XXX,XX @@ static ssize_t net_slirp_send_packet(const void *pkt, size_t pkt_len,
+                                      void *opaque)
+ {
+     SlirpState *s = opaque;
++    uint8_t min_pkt[ETH_ZLEN];
++    size_t min_pktsz = sizeof(min_pkt);
++
++    if (!s->nc.peer->do_not_pad) {
++        if (eth_pad_short_frame(min_pkt, &min_pktsz, pkt, pkt_len)) {
++            pkt = min_pkt;
++            pkt_len = min_pktsz;
++        }
++    }
+     return qemu_send_packet(&s->nc, pkt, pkt_len);
+ }
+diff --git a/net/tap-win32.c b/net/tap-win32.c
+index XXXXXXX..XXXXXXX 100644
+--- a/net/tap-win32.c
++++ b/net/tap-win32.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu-common.h"
+ #include "clients.h"            /* net_init_tap */
++#include "net/eth.h"
+ #include "net/net.h"
+ #include "net/tap.h"            /* tap_has_ufo, ... */
+ #include "qemu/error-report.h"
+@@ -XXX,XX +XXX,XX @@ static void tap_win32_send(void *opaque)
+     uint8_t *buf;
+     int max_size = 4096;
+     int size;
++    uint8_t min_pkt[ETH_ZLEN];
++    size_t min_pktsz = sizeof(min_pkt);
+     size = tap_win32_read(s->handle, &buf, max_size);
+     if (size > 0) {
++        if (!s->nc.peer->do_not_pad) {
++            if (eth_pad_short_frame(min_pkt, &min_pktsz, buf, size)) {
++                buf = min_pkt;
++                size = min_pktsz;
++            }
++        }
++
+         qemu_send_packet(&s->nc, buf, size);
+         tap_win32_free_buffer(s->handle, buf);
+     }
+diff --git a/net/tap.c b/net/tap.c
+index XXXXXXX..XXXXXXX 100644
+--- a/net/tap.c
++++ b/net/tap.c
+@@ -XXX,XX +XXX,XX @@
+ #include <sys/socket.h>
+ #include <net/if.h>
++#include "net/eth.h"
+ #include "net/net.h"
+ #include "clients.h"
+ #include "monitor/monitor.h"
+@@ -XXX,XX +XXX,XX @@ static void tap_send(void *opaque)
+     while (true) {
+         uint8_t *buf = s->buf;
++        uint8_t min_pkt[ETH_ZLEN];
++        size_t min_pktsz = sizeof(min_pkt);
+         size = tap_read_packet(s->fd, s->buf, sizeof(s->buf));
+         if (size <= 0) {
+@@ -XXX,XX +XXX,XX @@ static void tap_send(void *opaque)
+             size -= s->host_vnet_hdr_len;
+         }
++        if (!s->nc.peer->do_not_pad) {
++            if (eth_pad_short_frame(min_pkt, &min_pktsz, buf, size)) {
++                buf = min_pkt;
++                size = min_pktsz;
++            }
++        }
++
+         size = qemu_send_packet_async(&s->nc, buf, size, tap_send_completed);
+         if (size == 0) {
+             tap_read_poll(s, false);
+--
+.7.4

-New patch
+[PULL 04/13] hw/net: virtio-net: Initialize nc->do_not_pad to true
+From: Bin Meng <bmeng.cn@gmail.com>
+For virtio-net, there is no need to pad the Ethernet frame size to
+bytes before sending to it.
+Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ hw/net/virtio-net.c | 4 ++++
+file changed, 4 insertions(+)
+diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/virtio-net.c
++++ b/hw/net/virtio-net.c
+@@ -XXX,XX +XXX,XX @@ static void virtio_net_device_realize(DeviceState *dev, Error **errp)
+                               object_get_typename(OBJECT(dev)), dev->id, n);
+     }
++    for (i = 0; i < n->max_queues; i++) {
++        n->nic->ncs[i].do_not_pad = true;
++    }
++
+     peer_test_vnet_hdr(n);
+     if (peer_has_vnet_hdr(n)) {
+         for (i = 0; i < n->max_queues; i++) {
+--
+.7.4

-New patch
+[PULL 05/13] net/colo-compare.c: Fix memory leak for non-tcp packet
+From: Lukas Straub <lukasstraub2@web.de>
+Additional to removing the packet from the secondary queue,
+we also need to free it.
+Signed-off-by: Lukas Straub <lukasstraub2@web.de>
+Signed-off-by: Zhang Chen <chen.zhang@intel.com>
+Reviewed-by: Zhang Chen <chen.zhang@intel.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ net/colo-compare.c | 1 +
+file changed, 1 insertion(+)
+diff --git a/net/colo-compare.c b/net/colo-compare.c
+index XXXXXXX..XXXXXXX 100644
+--- a/net/colo-compare.c
++++ b/net/colo-compare.c
+@@ -XXX,XX +XXX,XX @@ static void colo_compare_packet(CompareState *s, Connection *conn,
+         if (result) {
+             colo_release_primary_pkt(s, pkt);
++            packet_destroy(result->data, NULL);
+             g_queue_remove(&conn->secondary_list, result->data);
+         } else {
+             /*
+--
+.7.4

-[Qemu-devel] [PULL 1/6] colo-compare: fix the dangerous assignment
+[PULL 06/13] net/colo-compare.c: Optimize removal of secondary packet
-From: Mao Zhongyi <maozy.fnst@cn.fujitsu.com>
+From: Lukas Straub <lukasstraub2@web.de>
-Cc: Peter Maydell <peter.maydell@linaro.org>
+g_queue_remove needs to look up the list entry first, but we
-Cc: Jason Wang <jasowang@redhat.com>
+already have it as result and can remove it directly with
-Cc: Zhang Chen <zhangckid@gmail.com>
+g_queue_delete_link.
-Cc: Li Zhijian <lizhijian@cn.fujitsu.com>
-Cc: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Lukas Straub <lukasstraub2@web.de>
-Fixes: 8ec14402029d783720f4312ed8a925548e1dad61
+Signed-off-by: Zhang Chen <chen.zhang@intel.com>
-Reported-by: Peter Maydell <peter.maydell@linaro.org>
+Reviewed-by: Zhang Chen <chen.zhang@intel.com>
 Reported-by: Paolo Bonzini <pbonzini@redhat.com>
 Signed-off-by: Mao Zhongyi <maozy.fnst@cn.fujitsu.com>
 Reviewed-by: Darren Kenny <darren.kenny@oracle.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
  net/colo-compare.c | 2 +-
 file changed, 1 insertion(+), 1 deletion(-)
 diff --git a/net/colo-compare.c b/net/colo-compare.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/colo-compare.c
 +++ b/net/colo-compare.c
-@@ -XXX,XX +XXX,XX @@ static int packet_enqueue(CompareState *s, int mode, Connection **con)
+@@ -XXX,XX +XXX,XX @@ static void colo_compare_packet(CompareState *s, Connection *conn,
-                          "drop packet");
+         if (result) {
-         }
+             colo_release_primary_pkt(s, pkt);
-     }
+             packet_destroy(result->data, NULL);
--    con = &conn;
+-            g_queue_remove(&conn->secondary_list, result->data);
-+    *con = conn;
++            g_queue_delete_link(&conn->secondary_list, result);
+         } else {
-     return 0;
+             /*
- }
+              * If one packet arrive late, the secondary_list or
 --
 .7.4

-New patch
+[PULL 07/13] net/eth: Use correct in6_address offset in _eth_get_rss_ex_dst_addr()
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
+The in6_address comes after the ip6_ext_hdr_routing header,
+not after the ip6_ext_hdr one. Fix the offset.
+Cc: qemu-stable@nongnu.org
+Reported-by: Stefano Garzarella <sgarzare@redhat.com>
+Fixes: eb700029c78 ("net_pkt: Extend packet abstraction as required by e1000e functionality")
+Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com>
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ net/eth.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/net/eth.c b/net/eth.c
+index XXXXXXX..XXXXXXX 100644
+--- a/net/eth.c
++++ b/net/eth.c
+@@ -XXX,XX +XXX,XX @@ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
+         }
+         bytes_read = iov_to_buf(pkt, pkt_frags,
+-                                rthdr_offset + sizeof(*ext_hdr),
++                                rthdr_offset + sizeof(*rthdr),
+                                 dst_addr, sizeof(*dst_addr));
+         return bytes_read == sizeof(*dst_addr);
+--
+.7.4

-New patch
+[PULL 08/13] net/eth: Simplify _eth_get_rss_ex_dst_addr()
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
+The length field is already contained in the ip6_ext_hdr structure.
+Check it direcly in eth_parse_ipv6_hdr() before calling
+_eth_get_rss_ex_dst_addr(), which gets a bit simplified.
+Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com>
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ net/eth.c | 14 +++++++-------
+file changed, 7 insertions(+), 7 deletions(-)
+diff --git a/net/eth.c b/net/eth.c
+index XXXXXXX..XXXXXXX 100644
+--- a/net/eth.c
++++ b/net/eth.c
+@@ -XXX,XX +XXX,XX @@ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
+ {
+     struct ip6_ext_hdr_routing *rthdr = (struct ip6_ext_hdr_routing *) ext_hdr;
+-    if ((rthdr->rtype == 2) &&
+-        (rthdr->len == sizeof(struct in6_address) / 8) &&
+-        (rthdr->segleft == 1)) {
++    if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) {
+         size_t input_size = iov_size(pkt, pkt_frags);
+         size_t bytes_read;
+@@ -XXX,XX +XXX,XX @@ bool eth_parse_ipv6_hdr(const struct iovec *pkt, int pkt_frags,
+         }
+         if (curr_ext_hdr_type == IP6_ROUTING) {
+-            info->rss_ex_dst_valid =
+-                _eth_get_rss_ex_dst_addr(pkt, pkt_frags,
+-                                         ip6hdr_off + info->full_hdr_len,
+-                                         &ext_hdr, &info->rss_ex_dst);
++            if (ext_hdr.ip6r_len == sizeof(struct in6_address) / 8) {
++                info->rss_ex_dst_valid =
++                    _eth_get_rss_ex_dst_addr(pkt, pkt_frags,
++                                             ip6hdr_off + info->full_hdr_len,
++                                             &ext_hdr, &info->rss_ex_dst);
++            }
+         } else if (curr_ext_hdr_type == IP6_DESTINATON) {
+             info->rss_ex_src_valid =
+                 _eth_get_rss_ex_src_addr(pkt, pkt_frags,
+--
+.7.4

-[Qemu-devel] [PULL 6/6] hw/net/vmxnet3: Fix code to work on big endian hosts, too
+[PULL 09/13] net/eth: Better describe _eth_get_rss_ex_dst_addr's offset argument
-From: Thomas Huth <thuth@redhat.com>
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
-Since commit ab06ec43577177a442e8 we test the vmxnet3 device in the
+The 'offset' argument represents the offset to the ip6_ext_hdr
-pxe-tester, too (when running "make check SPEED=slow"). This now
+header, rename it as 'ext_hdr_offset'.
 revealed that the code is not working there if the host is a big
 endian machine (for example ppc64 or s390x) - "make check SPEED=slow"
 is now failing on such hosts.
-The vmxnet3 code lacks endianness conversions in a couple of places.
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
-Interestingly, the bitfields in the structs in vmxnet3.h already tried to
+Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com>
-take care of the *bit* endianness of the C compilers - but the code missed
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 to change the *byte* endianness when reading or writing the corresponding
 structs. So the bitfields are now wrapped into unions which allow to change
 the byte endianness during runtime with the non-bitfield member of the union.
 With these changes, "make check SPEED=slow" now properly works on big endian
 hosts, too.
 Reported-by: David Gibson <dgibson@redhat.com>
 Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: David Gibson <dgibson@redhat.com>
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- hw/net/vmware_utils.h |   6 ++
+ net/eth.c | 6 +++---
- hw/net/vmxnet3.c      |  46 +++++++---
+file changed, 3 insertions(+), 3 deletions(-)
  hw/net/vmxnet3.h      | 230 ++++++++++++++++++++++++++++++--------------------
 files changed, 181 insertions(+), 101 deletions(-)
-diff --git a/hw/net/vmware_utils.h b/hw/net/vmware_utils.h
+diff --git a/net/eth.c b/net/eth.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/vmware_utils.h
+--- a/net/eth.c
-+++ b/hw/net/vmware_utils.h
++++ b/net/eth.c
-@@ -XXX,XX +XXX,XX @@ vmw_shmem_ld16(PCIDevice *d, hwaddr addr)
+@@ -XXX,XX +XXX,XX @@ eth_is_ip6_extension_header_type(uint8_t hdr_type)
  static bool
  _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
 -                        size_t rthdr_offset,
 +                        size_t ext_hdr_offset,
                          struct ip6_ext_hdr *ext_hdr,
                          struct in6_address *dst_addr)
  {
-     uint16_t res;
+@@ -XXX,XX +XXX,XX @@ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
-     pci_dma_read(d, addr, &res, 2);
+         size_t input_size = iov_size(pkt, pkt_frags);
-+    res = le16_to_cpu(res);
+         size_t bytes_read;
-     VMW_SHPRN("SHMEM load16: %" PRIx64 " (value 0x%X)", addr, res);
-     return res;
+-        if (input_size < rthdr_offset + sizeof(*ext_hdr)) {
- }
++        if (input_size < ext_hdr_offset + sizeof(*ext_hdr)) {
-@@ -XXX,XX +XXX,XX @@ static inline void
+             return false;
  vmw_shmem_st16(PCIDevice *d, hwaddr addr, uint16_t value)
  {
      VMW_SHPRN("SHMEM store16: %" PRIx64 " (value 0x%X)", addr, value);
 +    value = cpu_to_le16(value);
      pci_dma_write(d, addr, &value, 2);
  }
@@ -XXX,XX +XXX,XX @@ vmw_shmem_ld32(PCIDevice *d, hwaddr addr)
  {
      uint32_t res;
      pci_dma_read(d, addr, &res, 4);
 +    res = le32_to_cpu(res);
      VMW_SHPRN("SHMEM load32: %" PRIx64 " (value 0x%X)", addr, res);
      return res;
  }
@@ -XXX,XX +XXX,XX @@ static inline void
  vmw_shmem_st32(PCIDevice *d, hwaddr addr, uint32_t value)
  {
      VMW_SHPRN("SHMEM store32: %" PRIx64 " (value 0x%X)", addr, value);
 +    value = cpu_to_le32(value);
      pci_dma_write(d, addr, &value, 4);
  }
@@ -XXX,XX +XXX,XX @@ vmw_shmem_ld64(PCIDevice *d, hwaddr addr)
  {
      uint64_t res;
      pci_dma_read(d, addr, &res, 8);
 +    res = le64_to_cpu(res);
      VMW_SHPRN("SHMEM load64: %" PRIx64 " (value %" PRIx64 ")", addr, res);
      return res;
  }
@@ -XXX,XX +XXX,XX @@ static inline void
  vmw_shmem_st64(PCIDevice *d, hwaddr addr, uint64_t value)
  {
      VMW_SHPRN("SHMEM store64: %" PRIx64 " (value %" PRIx64 ")", addr, value);
 +    value = cpu_to_le64(value);
      pci_dma_write(d, addr, &value, 8);
  }
 diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/net/vmxnet3.c
 +++ b/hw/net/vmxnet3.c
@@ -XXX,XX +XXX,XX @@ vmxnet3_dump_tx_descr(struct Vmxnet3_TxDesc *descr)
                "addr %" PRIx64 ", len: %d, gen: %d, rsvd: %d, "
                "dtype: %d, ext1: %d, msscof: %d, hlen: %d, om: %d, "
                "eop: %d, cq: %d, ext2: %d, ti: %d, tci: %d",
 -              le64_to_cpu(descr->addr), descr->len, descr->gen, descr->rsvd,
 +              descr->addr, descr->len, descr->gen, descr->rsvd,
                descr->dtype, descr->ext1, descr->msscof, descr->hlen, descr->om,
                descr->eop, descr->cq, descr->ext2, descr->ti, descr->tci);
  }
@@ -XXX,XX +XXX,XX @@ vmxnet3_dump_rx_descr(struct Vmxnet3_RxDesc *descr)
  {
      VMW_PKPRN("RX DESCR: addr %" PRIx64 ", len: %d, gen: %d, rsvd: %d, "
                "dtype: %d, ext1: %d, btype: %d",
 -              le64_to_cpu(descr->addr), descr->len, descr->gen,
 +              descr->addr, descr->len, descr->gen,
                descr->rsvd, descr->dtype, descr->ext1, descr->btype);
  }
@@ -XXX,XX +XXX,XX @@ static void vmxnet3_complete_packet(VMXNET3State *s, int qidx, uint32_t tx_ridx)
      memset(&txcq_descr, 0, sizeof(txcq_descr));
      txcq_descr.txdIdx = tx_ridx;
      txcq_descr.gen = vmxnet3_ring_curr_gen(&s->txq_descr[qidx].comp_ring);
 -
 +    txcq_descr.val1 = cpu_to_le32(txcq_descr.val1);
 +    txcq_descr.val2 = cpu_to_le32(txcq_descr.val2);
      vmxnet3_ring_write_curr_cell(d, &s->txq_descr[qidx].comp_ring, &txcq_descr);
      /* Flush changes in TX descriptor before changing the counter value */
@@ -XXX,XX +XXX,XX @@ vmxnet3_on_rx_done_update_stats(VMXNET3State *s,
      }
  }
 +static inline void
 +vmxnet3_ring_read_curr_txdesc(PCIDevice *pcidev, Vmxnet3Ring *ring,
 +                              struct Vmxnet3_TxDesc *txd)
 +{
 +    vmxnet3_ring_read_curr_cell(pcidev, ring, txd);
 +    txd->addr = le64_to_cpu(txd->addr);
 +    txd->val1 = le32_to_cpu(txd->val1);
 +    txd->val2 = le32_to_cpu(txd->val2);
 +}
 +
  static inline bool
  vmxnet3_pop_next_tx_descr(VMXNET3State *s,
                            int qidx,
@@ -XXX,XX +XXX,XX @@ vmxnet3_pop_next_tx_descr(VMXNET3State *s,
      Vmxnet3Ring *ring = &s->txq_descr[qidx].tx_ring;
      PCIDevice *d = PCI_DEVICE(s);
 -    vmxnet3_ring_read_curr_cell(d, ring, txd);
 +    vmxnet3_ring_read_curr_txdesc(d, ring, txd);
      if (txd->gen == vmxnet3_ring_curr_gen(ring)) {
          /* Only read after generation field verification */
          smp_rmb();
          /* Re-read to be sure we got the latest version */
 -        vmxnet3_ring_read_curr_cell(d, ring, txd);
 +        vmxnet3_ring_read_curr_txdesc(d, ring, txd);
          VMXNET3_RING_DUMP(VMW_RIPRN, "TX", qidx, ring);
          *descr_idx = vmxnet3_ring_curr_cell_idx(ring);
          vmxnet3_inc_tx_consumption_counter(s, qidx);
@@ -XXX,XX +XXX,XX @@ static void vmxnet3_process_tx_queue(VMXNET3State *s, int qidx)
          if (!s->skip_current_tx_pkt) {
              data_len = (txd.len > 0) ? txd.len : VMXNET3_MAX_TX_BUF_SIZE;
 -            data_pa = le64_to_cpu(txd.addr);
 +            data_pa = txd.addr;
              if (!net_tx_pkt_add_raw_fragment(s->tx_pkt,
                                                  data_pa,
@@ -XXX,XX +XXX,XX @@ vmxnet3_read_next_rx_descr(VMXNET3State *s, int qidx, int ridx,
      Vmxnet3Ring *ring = &s->rxq_descr[qidx].rx_ring[ridx];
      *didx = vmxnet3_ring_curr_cell_idx(ring);
      vmxnet3_ring_read_curr_cell(d, ring, dbuf);
 +    dbuf->addr = le64_to_cpu(dbuf->addr);
 +    dbuf->val1 = le32_to_cpu(dbuf->val1);
 +    dbuf->ext1 = le32_to_cpu(dbuf->ext1);
  }
  static inline uint8_t
@@ -XXX,XX +XXX,XX @@ vmxnet3_pop_rxc_descr(VMXNET3State *s, int qidx, uint32_t *descr_gen)
      pci_dma_read(PCI_DEVICE(s),
                   daddr, &rxcd, sizeof(struct Vmxnet3_RxCompDesc));
 +    rxcd.val1 = le32_to_cpu(rxcd.val1);
 +    rxcd.val2 = le32_to_cpu(rxcd.val2);
 +    rxcd.val3 = le32_to_cpu(rxcd.val3);
      ring_gen = vmxnet3_ring_curr_gen(&s->rxq_descr[qidx].comp_ring);
      if (rxcd.gen != ring_gen) {
@@ -XXX,XX +XXX,XX @@ vmxnet3_pci_dma_writev(PCIDevice *pci_dev,
      }
  }
 +static void
 +vmxnet3_pci_dma_write_rxcd(PCIDevice *pcidev, dma_addr_t pa,
 +                           struct Vmxnet3_RxCompDesc *rxcd)
 +{
 +    rxcd->val1 = cpu_to_le32(rxcd->val1);
 +    rxcd->val2 = cpu_to_le32(rxcd->val2);
 +    rxcd->val3 = cpu_to_le32(rxcd->val3);
 +    pci_dma_write(pcidev, pa, rxcd, sizeof(*rxcd));
 +}
 +
  static bool
  vmxnet3_indicate_packet(VMXNET3State *s)
  {
@@ -XXX,XX +XXX,XX @@ vmxnet3_indicate_packet(VMXNET3State *s)
          }
-         chunk_size = MIN(bytes_left, rxd.len);
+         bytes_read = iov_to_buf(pkt, pkt_frags,
--        vmxnet3_pci_dma_writev(d, data, bytes_copied,
+-                                rthdr_offset + sizeof(*rthdr),
--                               le64_to_cpu(rxd.addr), chunk_size);
++                                ext_hdr_offset + sizeof(*rthdr),
-+        vmxnet3_pci_dma_writev(d, data, bytes_copied, rxd.addr, chunk_size);
+                                 dst_addr, sizeof(*dst_addr));
-         bytes_copied += chunk_size;
-         bytes_left -= chunk_size;
+         return bytes_read == sizeof(*dst_addr);
          vmxnet3_dump_rx_descr(&rxd);
          if (ready_rxcd_pa != 0) {
 -            pci_dma_write(d, ready_rxcd_pa, &rxcd, sizeof(rxcd));
 +            vmxnet3_pci_dma_write_rxcd(d, ready_rxcd_pa, &rxcd);
          }
          memset(&rxcd, 0, sizeof(struct Vmxnet3_RxCompDesc));
@@ -XXX,XX +XXX,XX @@ vmxnet3_indicate_packet(VMXNET3State *s)
          rxcd.eop = 1;
          rxcd.err = (bytes_left != 0);
 -        pci_dma_write(d, ready_rxcd_pa, &rxcd, sizeof(rxcd));
 +        vmxnet3_pci_dma_write_rxcd(d, ready_rxcd_pa, &rxcd);
          /* Flush RX descriptor changes */
          smp_wmb();
 diff --git a/hw/net/vmxnet3.h b/hw/net/vmxnet3.h
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/net/vmxnet3.h
 +++ b/hw/net/vmxnet3.h
@@ -XXX,XX +XXX,XX @@ enum {
  struct Vmxnet3_TxDesc {
      __le64 addr;
 +    union {
 +        struct {
  #ifdef __BIG_ENDIAN_BITFIELD
 -    u32 msscof:14;  /* MSS, checksum offset, flags */
 -    u32 ext1:1;
 -    u32 dtype:1;    /* descriptor type */
 -    u32 rsvd:1;
 -    u32 gen:1;      /* generation bit */
 -    u32 len:14;
 +            u32 msscof:14;  /* MSS, checksum offset, flags */
 +            u32 ext1:1;
 +            u32 dtype:1;    /* descriptor type */
 +            u32 rsvd:1;
 +            u32 gen:1;      /* generation bit */
 +            u32 len:14;
  #else
 -    u32 len:14;
 -    u32 gen:1;      /* generation bit */
 -    u32 rsvd:1;
 -    u32 dtype:1;    /* descriptor type */
 -    u32 ext1:1;
 -    u32 msscof:14;  /* MSS, checksum offset, flags */
 +            u32 len:14;
 +            u32 gen:1;      /* generation bit */
 +            u32 rsvd:1;
 +            u32 dtype:1;    /* descriptor type */
 +            u32 ext1:1;
 +            u32 msscof:14;  /* MSS, checksum offset, flags */
  #endif  /* __BIG_ENDIAN_BITFIELD */
 -
 +        };
 +        u32 val1;
 +    };
 +
 +    union {
 +        struct {
  #ifdef __BIG_ENDIAN_BITFIELD
 -    u32 tci:16;     /* Tag to Insert */
 -    u32 ti:1;       /* VLAN Tag Insertion */
 -    u32 ext2:1;
 -    u32 cq:1;       /* completion request */
 -    u32 eop:1;      /* End Of Packet */
 -    u32 om:2;       /* offload mode */
 -    u32 hlen:10;    /* header len */
 +            u32 tci:16;     /* Tag to Insert */
 +            u32 ti:1;       /* VLAN Tag Insertion */
 +            u32 ext2:1;
 +            u32 cq:1;       /* completion request */
 +            u32 eop:1;      /* End Of Packet */
 +            u32 om:2;       /* offload mode */
 +            u32 hlen:10;    /* header len */
  #else
 -    u32 hlen:10;    /* header len */
 -    u32 om:2;       /* offload mode */
 -    u32 eop:1;      /* End Of Packet */
 -    u32 cq:1;       /* completion request */
 -    u32 ext2:1;
 -    u32 ti:1;       /* VLAN Tag Insertion */
 -    u32 tci:16;     /* Tag to Insert */
 +            u32 hlen:10;    /* header len */
 +            u32 om:2;       /* offload mode */
 +            u32 eop:1;      /* End Of Packet */
 +            u32 cq:1;       /* completion request */
 +            u32 ext2:1;
 +            u32 ti:1;       /* VLAN Tag Insertion */
 +            u32 tci:16;     /* Tag to Insert */
  #endif  /* __BIG_ENDIAN_BITFIELD */
 +        };
 +        u32 val2;
 +    };
  };
  /* TxDesc.OM values */
@@ -XXX,XX +XXX,XX @@ struct Vmxnet3_TxDataDesc {
  #define VMXNET3_TCD_GEN_DWORD_SHIFT    3
  struct Vmxnet3_TxCompDesc {
 -    u32        txdIdx:12;    /* Index of the EOP TxDesc */
 -    u32        ext1:20;
 -
 +    union {
 +        struct {
 +#ifdef __BIG_ENDIAN_BITFIELD
 +            u32 ext1:20;
 +            u32 txdIdx:12;    /* Index of the EOP TxDesc */
 +#else
 +            u32 txdIdx:12;    /* Index of the EOP TxDesc */
 +            u32 ext1:20;
 +#endif
 +        };
 +        u32 val1;
 +    };
      __le32        ext2;
      __le32        ext3;
 -    u32        rsvd:24;
 -    u32        type:7;       /* completion type */
 -    u32        gen:1;        /* generation bit */
 +    union {
 +        struct {
 +#ifdef __BIG_ENDIAN_BITFIELD
 +            u32 gen:1;        /* generation bit */
 +            u32 type:7;       /* completion type */
 +            u32 rsvd:24;
 +#else
 +            u32 rsvd:24;
 +            u32 type:7;       /* completion type */
 +            u32 gen:1;        /* generation bit */
 +#endif
 +        };
 +        u32 val2;
 +    };
  };
  struct Vmxnet3_RxDesc {
      __le64        addr;
 -
 +    union {
 +        struct {
  #ifdef __BIG_ENDIAN_BITFIELD
 -    u32        gen:1;        /* Generation bit */
 -    u32        rsvd:15;
 -    u32        dtype:1;      /* Descriptor type */
 -    u32        btype:1;      /* Buffer Type */
 -    u32        len:14;
 +            u32 gen:1;        /* Generation bit */
 +            u32 rsvd:15;
 +            u32 dtype:1;      /* Descriptor type */
 +            u32 btype:1;      /* Buffer Type */
 +            u32 len:14;
  #else
 -    u32        len:14;
 -    u32        btype:1;      /* Buffer Type */
 -    u32        dtype:1;      /* Descriptor type */
 -    u32        rsvd:15;
 -    u32        gen:1;        /* Generation bit */
 +            u32 len:14;
 +            u32 btype:1;      /* Buffer Type */
 +            u32 dtype:1;      /* Descriptor type */
 +            u32 rsvd:15;
 +            u32 gen:1;        /* Generation bit */
  #endif
 +        };
 +        u32 val1;
 +    };
      u32        ext1;
  };
@@ -XXX,XX +XXX,XX @@ struct Vmxnet3_RxDesc {
  #define VMXNET3_RXD_GEN_SHIFT    31
  struct Vmxnet3_RxCompDesc {
 +    union {
 +        struct {
  #ifdef __BIG_ENDIAN_BITFIELD
 -    u32        ext2:1;
 -    u32        cnc:1;        /* Checksum Not Calculated */
 -    u32        rssType:4;    /* RSS hash type used */
 -    u32        rqID:10;      /* rx queue/ring ID */
 -    u32        sop:1;        /* Start of Packet */
 -    u32        eop:1;        /* End of Packet */
 -    u32        ext1:2;
 -    u32        rxdIdx:12;    /* Index of the RxDesc */
 +            u32 ext2:1;
 +            u32 cnc:1;        /* Checksum Not Calculated */
 +            u32 rssType:4;    /* RSS hash type used */
 +            u32 rqID:10;      /* rx queue/ring ID */
 +            u32 sop:1;        /* Start of Packet */
 +            u32 eop:1;        /* End of Packet */
 +            u32 ext1:2;
 +            u32 rxdIdx:12;    /* Index of the RxDesc */
  #else
 -    u32        rxdIdx:12;    /* Index of the RxDesc */
 -    u32        ext1:2;
 -    u32        eop:1;        /* End of Packet */
 -    u32        sop:1;        /* Start of Packet */
 -    u32        rqID:10;      /* rx queue/ring ID */
 -    u32        rssType:4;    /* RSS hash type used */
 -    u32        cnc:1;        /* Checksum Not Calculated */
 -    u32        ext2:1;
 +            u32 rxdIdx:12;    /* Index of the RxDesc */
 +            u32 ext1:2;
 +            u32 eop:1;        /* End of Packet */
 +            u32 sop:1;        /* Start of Packet */
 +            u32 rqID:10;      /* rx queue/ring ID */
 +            u32 rssType:4;    /* RSS hash type used */
 +            u32 cnc:1;        /* Checksum Not Calculated */
 +            u32 ext2:1;
  #endif  /* __BIG_ENDIAN_BITFIELD */
 +        };
 +        u32 val1;
 +    };
      __le32        rssHash;      /* RSS hash value */
 +    union {
 +        struct {
  #ifdef __BIG_ENDIAN_BITFIELD
 -    u32        tci:16;       /* Tag stripped */
 -    u32        ts:1;         /* Tag is stripped */
 -    u32        err:1;        /* Error */
 -    u32        len:14;       /* data length */
 +            u32 tci:16;       /* Tag stripped */
 +            u32 ts:1;         /* Tag is stripped */
 +            u32 err:1;        /* Error */
 +            u32 len:14;       /* data length */
  #else
 -    u32        len:14;       /* data length */
 -    u32        err:1;        /* Error */
 -    u32        ts:1;         /* Tag is stripped */
 -    u32        tci:16;       /* Tag stripped */
 +            u32 len:14;       /* data length */
 +            u32 err:1;        /* Error */
 +            u32 ts:1;         /* Tag is stripped */
 +            u32 tci:16;       /* Tag stripped */
  #endif  /* __BIG_ENDIAN_BITFIELD */
 +        };
 +        u32 val2;
 +    };
 -
 +    union {
 +        struct {
  #ifdef __BIG_ENDIAN_BITFIELD
 -    u32        gen:1;        /* generation bit */
 -    u32        type:7;       /* completion type */
 -    u32        fcs:1;        /* Frame CRC correct */
 -    u32        frg:1;        /* IP Fragment */
 -    u32        v4:1;         /* IPv4 */
 -    u32        v6:1;         /* IPv6 */
 -    u32        ipc:1;        /* IP Checksum Correct */
 -    u32        tcp:1;        /* TCP packet */
 -    u32        udp:1;        /* UDP packet */
 -    u32        tuc:1;        /* TCP/UDP Checksum Correct */
 -    u32        csum:16;
 +            u32 gen:1;        /* generation bit */
 +            u32 type:7;       /* completion type */
 +            u32 fcs:1;        /* Frame CRC correct */
 +            u32 frg:1;        /* IP Fragment */
 +            u32 v4:1;         /* IPv4 */
 +            u32 v6:1;         /* IPv6 */
 +            u32 ipc:1;        /* IP Checksum Correct */
 +            u32 tcp:1;        /* TCP packet */
 +            u32 udp:1;        /* UDP packet */
 +            u32 tuc:1;        /* TCP/UDP Checksum Correct */
 +            u32 csum:16;
  #else
 -    u32        csum:16;
 -    u32        tuc:1;        /* TCP/UDP Checksum Correct */
 -    u32        udp:1;        /* UDP packet */
 -    u32        tcp:1;        /* TCP packet */
 -    u32        ipc:1;        /* IP Checksum Correct */
 -    u32        v6:1;         /* IPv6 */
 -    u32        v4:1;         /* IPv4 */
 -    u32        frg:1;        /* IP Fragment */
 -    u32        fcs:1;        /* Frame CRC correct */
 -    u32        type:7;       /* completion type */
 -    u32        gen:1;        /* generation bit */
 +            u32 csum:16;
 +            u32 tuc:1;        /* TCP/UDP Checksum Correct */
 +            u32 udp:1;        /* UDP packet */
 +            u32 tcp:1;        /* TCP packet */
 +            u32 ipc:1;        /* IP Checksum Correct */
 +            u32 v6:1;         /* IPv6 */
 +            u32 v4:1;         /* IPv4 */
 +            u32 frg:1;        /* IP Fragment */
 +            u32 fcs:1;        /* Frame CRC correct */
 +            u32 type:7;       /* completion type */
 +            u32 gen:1;        /* generation bit */
  #endif  /* __BIG_ENDIAN_BITFIELD */
 +        };
 +        u32 val3;
 +    };
  };
  /* fields in RxCompDesc we access via Vmxnet3_GenericDesc.dword[3] */
 --
 .7.4

-New patch
+[PULL 10/13] net/eth: Check size earlier in _eth_get_rss_ex_dst_addr()
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
+Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ net/eth.c | 14 ++++++--------
+file changed, 6 insertions(+), 8 deletions(-)
+diff --git a/net/eth.c b/net/eth.c
+index XXXXXXX..XXXXXXX 100644
+--- a/net/eth.c
++++ b/net/eth.c
+@@ -XXX,XX +XXX,XX @@ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
+                         struct in6_address *dst_addr)
+ {
+     struct ip6_ext_hdr_routing *rthdr = (struct ip6_ext_hdr_routing *) ext_hdr;
++    size_t input_size = iov_size(pkt, pkt_frags);
++    size_t bytes_read;
+-    if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) {
+-
+-        size_t input_size = iov_size(pkt, pkt_frags);
+-        size_t bytes_read;
+-
+-        if (input_size < ext_hdr_offset + sizeof(*ext_hdr)) {
+-            return false;
+-        }
++    if (input_size < ext_hdr_offset + sizeof(*ext_hdr)) {
++        return false;
++    }
++    if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) {
+         bytes_read = iov_to_buf(pkt, pkt_frags,
+                                 ext_hdr_offset + sizeof(*rthdr),
+                                 dst_addr, sizeof(*dst_addr));
+--
+.7.4

-[Qemu-devel] [PULL 3/6] hw/net/eepro100: Fix endianness problem on big endian hosts
+[PULL 11/13] net/eth: Check iovec has enough data earlier
-From: Thomas Huth <thuth@redhat.com>
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
-Since commit 1865e288a823c764cd4344d ("Fix eepro100 simple transmission
+We want to check fields from ip6_ext_hdr_routing structure
-mode"), the test/pxe-test is broken for the eepro100 device on big
+and if correct read the full in6_address. Let's directly check
-endian hosts. However, it seems like that commit did not introduce the
+if our iovec contains enough data for everything, else return
-problem, but just uncovered it: The EEPRO100State->tx.tbd_array_addr and
+early.
 EEPRO100State->tx.tcb_bytes fields are already in host byte order, since
 they have already been byte-swapped in the read_cb() function.
 Thus byte-swapping them in tx_command() again results in the wrong
 endianness. Removing the byte-swapping here fixes the pxe-test.
-Signed-off-by: Thomas Huth <thuth@redhat.com>
+Suggested-by: Stefano Garzarella <sgarzare@redhat.com>
 Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com>
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- hw/net/eepro100.c | 4 ++--
+ net/eth.c | 2 +-
-file changed, 2 insertions(+), 2 deletions(-)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/net/eepro100.c b/hw/net/eepro100.c
+diff --git a/net/eth.c b/net/eth.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/eepro100.c
+--- a/net/eth.c
-+++ b/hw/net/eepro100.c
++++ b/net/eth.c
-@@ -XXX,XX +XXX,XX @@ static void read_cb(EEPRO100State *s)
+@@ -XXX,XX +XXX,XX @@ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
+     size_t input_size = iov_size(pkt, pkt_frags);
- static void tx_command(EEPRO100State *s)
+     size_t bytes_read;
- {
--    uint32_t tbd_array = le32_to_cpu(s->tx.tbd_array_addr);
+-    if (input_size < ext_hdr_offset + sizeof(*ext_hdr)) {
--    uint16_t tcb_bytes = (le16_to_cpu(s->tx.tcb_bytes) & 0x3fff);
++    if (input_size < ext_hdr_offset + sizeof(*rthdr) + sizeof(*dst_addr)) {
-+    uint32_t tbd_array = s->tx.tbd_array_addr;
+         return false;
-+    uint16_t tcb_bytes = s->tx.tcb_bytes & 0x3fff;
+     }
-     /* Sends larger than MAX_ETH_FRAME_SIZE are allowed, up to 2600 bytes. */
      uint8_t buf[2600];
      uint16_t size = 0;
 --
 .7.4

-[Qemu-devel] [PULL 4/6] MAINTAINERS: Add missing entry for eepro100 emulation
+[PULL 12/13] net/eth: Read ip6_ext_hdr_routing buffer before accessing it
-From: Stefan Weil <sw@weilnetz.de>
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
-Signed-off-by: Stefan Weil <sw@weilnetz.de>
+We can't know the caller read enough data in the memory pointed
 by ext_hdr to cast it as a ip6_ext_hdr_routing.
 Declare rt_hdr on the stack and fill it again from the iovec.
 Since we already checked there is enough data in the iovec buffer,
 simply add an assert() call to consume the bytes_read variable.
 This fix a 2 bytes buffer overrun in eth_parse_ipv6_hdr() reported
 by QEMU fuzzer:
   $ cat << EOF | ./qemu-system-i386 -M pc-q35-5.0 \
     -accel qtest -monitor none \
     -serial none -nographic -qtest stdio
   outl 0xcf8 0x80001010
   outl 0xcfc 0xe1020000
   outl 0xcf8 0x80001004
   outw 0xcfc 0x7
   write 0x25 0x1 0x86
   write 0x26 0x1 0xdd
   write 0x4f 0x1 0x2b
   write 0xe1020030 0x4 0x190002e1
   write 0xe102003a 0x2 0x0807
   write 0xe1020048 0x4 0x12077cdd
   write 0xe1020400 0x4 0xba077cdd
   write 0xe1020420 0x4 0x190002e1
   write 0xe1020428 0x4 0x3509d807
   write 0xe1020438 0x1 0xe2
   EOF
   =================================================================
   ==2859770==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffdef904902 at pc 0x561ceefa78de bp 0x7ffdef904820 sp 0x7ffdef904818
   READ of size 1 at 0x7ffdef904902 thread T0
       #0 0x561ceefa78dd in _eth_get_rss_ex_dst_addr net/eth.c:410:17
       #1 0x561ceefa41fb in eth_parse_ipv6_hdr net/eth.c:532:17
       #2 0x561cef7de639 in net_tx_pkt_parse_headers hw/net/net_tx_pkt.c:228:14
       #3 0x561cef7dbef4 in net_tx_pkt_parse hw/net/net_tx_pkt.c:273:9
       #4 0x561ceec29f22 in e1000e_process_tx_desc hw/net/e1000e_core.c:730:29
       #5 0x561ceec28eac in e1000e_start_xmit hw/net/e1000e_core.c:927:9
       #6 0x561ceec1baab in e1000e_set_tdt hw/net/e1000e_core.c:2444:9
       #7 0x561ceebf300e in e1000e_core_write hw/net/e1000e_core.c:3256:9
       #8 0x561cef3cd4cd in e1000e_mmio_write hw/net/e1000e.c:110:5
   Address 0x7ffdef904902 is located in stack of thread T0 at offset 34 in frame
       #0 0x561ceefa320f in eth_parse_ipv6_hdr net/eth.c:486
     This frame has 1 object(s):
       [32, 34) 'ext_hdr' (line 487) <== Memory access at offset 34 overflows this variable
   HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
         (longjmp and C++ exceptions *are* supported)
   SUMMARY: AddressSanitizer: stack-buffer-overflow net/eth.c:410:17 in _eth_get_rss_ex_dst_addr
   Shadow bytes around the buggy address:
 x10003df188d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 x10003df188e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 x10003df188f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 x10003df18900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 x10003df18910: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
   =>0x10003df18920:[02]f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
 x10003df18930: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 x10003df18940: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 x10003df18950: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 x10003df18960: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
 x10003df18970: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
   Shadow byte legend (one shadow byte represents 8 application bytes):
     Addressable:           00
     Partially addressable: 01 02 03 04 05 06 07
     Stack left redzone:      f1
     Stack right redzone:     f3
   ==2859770==ABORTING
 Add the corresponding qtest case with the fuzzer reproducer.
 FWIW GCC 11 similarly reported:
   net/eth.c: In function 'eth_parse_ipv6_hdr':
   net/eth.c:410:15: error: array subscript 'struct ip6_ext_hdr_routing[0]' is partly outside array bounds of 'struct ip6_ext_hdr[1]' [-Werror=array-bounds]
 |     if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) {
         |          ~~~~~^~~~~~~
   net/eth.c:485:24: note: while referencing 'ext_hdr'
 |     struct ip6_ext_hdr ext_hdr;
         |                        ^~~~~~~
   net/eth.c:410:38: error: array subscript 'struct ip6_ext_hdr_routing[0]' is partly outside array bounds of 'struct ip6_ext_hdr[1]' [-Werror=array-bounds]
 |     if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) {
         |                                 ~~~~~^~~~~~~~~
   net/eth.c:485:24: note: while referencing 'ext_hdr'
 |     struct ip6_ext_hdr ext_hdr;
         |                        ^~~~~~~
 Cc: qemu-stable@nongnu.org
 Buglink: https://bugs.launchpad.net/qemu/+bug/1879531
 Reported-by: Alexander Bulekov <alxndr@bu.edu>
 Reported-by: Miroslav Rezanina <mrezanin@redhat.com>
 Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
 Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com>
 Fixes: eb700029c78 ("net_pkt: Extend packet abstraction as required by e1000e functionality")
 Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- MAINTAINERS | 5 +++++
+ MAINTAINERS                    |  1 +
-file changed, 5 insertions(+)
+ net/eth.c                      | 13 +++++++----
  tests/qtest/fuzz-e1000e-test.c | 53 ++++++++++++++++++++++++++++++++++++++++++
  tests/qtest/meson.build        |  1 +
 files changed, 63 insertions(+), 5 deletions(-)
  create mode 100644 tests/qtest/fuzz-e1000e-test.c
 diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
 --- a/MAINTAINERS
 +++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ M: Dmitry Fleytman <dmitry@daynix.com>
+@@ -XXX,XX +XXX,XX @@ e1000e
  M: Dmitry Fleytman <dmitry.fleytman@gmail.com>
  S: Maintained
  F: hw/net/e1000e*
++F: tests/qtest/fuzz-e1000e-test.c
-+eepro100
-+M: Stefan Weil <sw@weilnetz.de>
+ eepro100
-+S: Maintained
+ M: Stefan Weil <sw@weilnetz.de>
-+F: hw/net/eepro100.c
+diff --git a/net/eth.c b/net/eth.c
-+
+index XXXXXXX..XXXXXXX 100644
- Generic Loader
+--- a/net/eth.c
- M: Alistair Francis <alistair.francis@xilinx.com>
++++ b/net/eth.c
- S: Maintained
+@@ -XXX,XX +XXX,XX @@ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
                          struct ip6_ext_hdr *ext_hdr,
                          struct in6_address *dst_addr)
  {
 -    struct ip6_ext_hdr_routing *rthdr = (struct ip6_ext_hdr_routing *) ext_hdr;
 +    struct ip6_ext_hdr_routing rt_hdr;
      size_t input_size = iov_size(pkt, pkt_frags);
      size_t bytes_read;
 -    if (input_size < ext_hdr_offset + sizeof(*rthdr) + sizeof(*dst_addr)) {
 +    if (input_size < ext_hdr_offset + sizeof(rt_hdr) + sizeof(*dst_addr)) {
          return false;
      }
 -    if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) {
 -        bytes_read = iov_to_buf(pkt, pkt_frags,
 -                                ext_hdr_offset + sizeof(*rthdr),
 +    bytes_read = iov_to_buf(pkt, pkt_frags, ext_hdr_offset,
 +                            &rt_hdr, sizeof(rt_hdr));
 +    assert(bytes_read == sizeof(rt_hdr));
 +
 +    if ((rt_hdr.rtype == 2) && (rt_hdr.segleft == 1)) {
 +        bytes_read = iov_to_buf(pkt, pkt_frags, ext_hdr_offset + sizeof(rt_hdr),
                                  dst_addr, sizeof(*dst_addr));
          return bytes_read == sizeof(*dst_addr);
 diff --git a/tests/qtest/fuzz-e1000e-test.c b/tests/qtest/fuzz-e1000e-test.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tests/qtest/fuzz-e1000e-test.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * QTest testcase for e1000e device generated by fuzzer
 + *
 + * Copyright (c) 2021 Red Hat, Inc.
 + *
 + * SPDX-License-Identifier: GPL-2.0-or-later
 + */
 +
 +#include "qemu/osdep.h"
 +
 +#include "libqos/libqtest.h"
 +
 +/*
 + * https://bugs.launchpad.net/qemu/+bug/1879531
 + */
 +static void test_lp1879531_eth_get_rss_ex_dst_addr(void)
 +{
 +    QTestState *s;
 +
 +    s = qtest_init("-nographic -monitor none -serial none -M pc-q35-5.0");
 +
 +    qtest_outl(s, 0xcf8, 0x80001010);
 +    qtest_outl(s, 0xcfc, 0xe1020000);
 +    qtest_outl(s, 0xcf8, 0x80001004);
 +    qtest_outw(s, 0xcfc, 0x7);
 +    qtest_writeb(s, 0x25, 0x86);
 +    qtest_writeb(s, 0x26, 0xdd);
 +    qtest_writeb(s, 0x4f, 0x2b);
 +
 +    qtest_writel(s, 0xe1020030, 0x190002e1);
 +    qtest_writew(s, 0xe102003a, 0x0807);
 +    qtest_writel(s, 0xe1020048, 0x12077cdd);
 +    qtest_writel(s, 0xe1020400, 0xba077cdd);
 +    qtest_writel(s, 0xe1020420, 0x190002e1);
 +    qtest_writel(s, 0xe1020428, 0x3509d807);
 +    qtest_writeb(s, 0xe1020438, 0xe2);
 +    qtest_writeb(s, 0x4f, 0x2b);
 +    qtest_quit(s);
 +}
 +
 +int main(int argc, char **argv)
 +{
 +    const char *arch = qtest_get_arch();
 +
 +    g_test_init(&argc, &argv, NULL);
 +
 +    if (strcmp(arch, "i386") == 0 || strcmp(arch, "x86_64") == 0) {
 +        qtest_add_func("fuzz/test_lp1879531_eth_get_rss_ex_dst_addr",
 +                       test_lp1879531_eth_get_rss_ex_dst_addr);
 +    }
 +
 +    return g_test_run();
 +}
 diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/tests/qtest/meson.build
 +++ b/tests/qtest/meson.build
@@ -XXX,XX +XXX,XX @@ qtests_i386 = \
    (config_all_devices.has_key('CONFIG_TPM_TIS_ISA') ? ['tpm-tis-test'] : []) +              \
    (config_all_devices.has_key('CONFIG_TPM_TIS_ISA') ? ['tpm-tis-swtpm-test'] : []) +        \
    (config_all_devices.has_key('CONFIG_RTL8139_PCI') ? ['rtl8139-test'] : []) +              \
 +  (config_all_devices.has_key('CONFIG_E1000E_PCI_EXPRESS') ? ['fuzz-e1000e-test'] : []) +   \
    qtests_pci +                                                                              \
    ['fdc-test',
     'ide-test',
 --
 .7.4

-[Qemu-devel] [PULL 5/6] net: Transmit zero UDP checksum as 0xFFFF
+[PULL 13/13] net/eth: Add an assert() and invert if() statement to simplify code
-From: Ed Swierk <eswierk@skyportsystems.com>
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
-The checksum algorithm used by IPv4, TCP and UDP allows a zero value
+To simplify the function body, invert the if() statement, returning
-to be represented by either 0x0000 and 0xFFFF. But per RFC 768, a zero
+earlier.
-UDP checksum must be transmitted as 0xFFFF because 0x0000 is a special
+Since we already checked there is enough data in the iovec buffer,
-value meaning no checksum.
+simply add an assert() call to consume the bytes_read variable.
-Substitute 0xFFFF whenever a checksum is computed as zero when
+Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
-modifying a UDP datagram header. Doing this on IPv4 and TCP checksums
+Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com>
-is unnecessary but legal. Add a wrapper for net_checksum_finish() that
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 makes the substitution.
 (We can't just change net_checksum_finish(), as that function is also
 used by receivers to verify checksums, and in that case the expected
 value is always 0x0000.)
 Signed-off-by: Ed Swierk <eswierk@skyportsystems.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- hw/net/e1000.c         | 2 +-
+ net/eth.c | 13 ++++++-------
- hw/net/net_rx_pkt.c    | 2 +-
+file changed, 6 insertions(+), 7 deletions(-)
  hw/net/net_tx_pkt.c    | 2 +-
  hw/net/vmxnet3.c       | 3 ++-
  include/net/checksum.h | 6 ++++++
 files changed, 11 insertions(+), 4 deletions(-)
-diff --git a/hw/net/e1000.c b/hw/net/e1000.c
+diff --git a/net/eth.c b/net/eth.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/e1000.c
+--- a/net/eth.c
-+++ b/hw/net/e1000.c
++++ b/net/eth.c
-@@ -XXX,XX +XXX,XX @@ putsum(uint8_t *data, uint32_t n, uint32_t sloc, uint32_t css, uint32_t cse)
+@@ -XXX,XX +XXX,XX @@ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
-         n = cse + 1;
+     bytes_read = iov_to_buf(pkt, pkt_frags, ext_hdr_offset,
-     if (sloc < n-1) {
+                             &rt_hdr, sizeof(rt_hdr));
-         sum = net_checksum_add(n-css, data+css);
+     assert(bytes_read == sizeof(rt_hdr));
--        stw_be_p(data + sloc, net_checksum_finish(sum));
+-
-+        stw_be_p(data + sloc, net_checksum_finish_nozero(sum));
+-    if ((rt_hdr.rtype == 2) && (rt_hdr.segleft == 1)) {
 -        bytes_read = iov_to_buf(pkt, pkt_frags, ext_hdr_offset + sizeof(rt_hdr),
 -                                dst_addr, sizeof(*dst_addr));
 -
 -        return bytes_read == sizeof(*dst_addr);
 +    if ((rt_hdr.rtype != 2) || (rt_hdr.segleft != 1)) {
 +        return false;
      }
++    bytes_read = iov_to_buf(pkt, pkt_frags, ext_hdr_offset + sizeof(rt_hdr),
++                            dst_addr, sizeof(*dst_addr));
++    assert(bytes_read == sizeof(*dst_addr));
+-    return false;
++    return true;
  }
-diff --git a/hw/net/net_rx_pkt.c b/hw/net/net_rx_pkt.c
+ static bool
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/net/net_rx_pkt.c
 +++ b/hw/net/net_rx_pkt.c
@@ -XXX,XX +XXX,XX @@ _net_rx_pkt_calc_l4_csum(struct NetRxPkt *pkt)
      cntr += net_checksum_add_iov(pkt->vec, pkt->vec_len,
                                   pkt->l4hdr_off, csl, cso);
 -    csum = net_checksum_finish(cntr);
 +    csum = net_checksum_finish_nozero(cntr);
      trace_net_rx_pkt_l4_csum_calc_csum(pkt->l4hdr_off, csl, cntr, csum);
 diff --git a/hw/net/net_tx_pkt.c b/hw/net/net_tx_pkt.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/net/net_tx_pkt.c
 +++ b/hw/net/net_tx_pkt.c
@@ -XXX,XX +XXX,XX @@ static void net_tx_pkt_do_sw_csum(struct NetTxPkt *pkt)
          net_checksum_add_iov(iov, iov_len, pkt->virt_hdr.csum_start, csl, cso);
      /* Put the checksum obtained into the packet */
 -    csum = cpu_to_be16(net_checksum_finish(csum_cntr));
 +    csum = cpu_to_be16(net_checksum_finish_nozero(csum_cntr));
      iov_from_buf(iov, iov_len, csum_offset, &csum, sizeof csum);
  }
 diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/net/vmxnet3.c
 +++ b/hw/net/vmxnet3.c
@@ -XXX,XX +XXX,XX @@ static void vmxnet3_rx_need_csum_calculate(struct NetRxPkt *pkt,
      data = (uint8_t *)pkt_data + vhdr->csum_start;
      len = pkt_len - vhdr->csum_start;
      /* Put the checksum obtained into the packet */
 -    stw_be_p(data + vhdr->csum_offset, net_raw_checksum(data, len));
 +    stw_be_p(data + vhdr->csum_offset,
 +             net_checksum_finish_nozero(net_checksum_add(len, data)));
      vhdr->flags &= ~VIRTIO_NET_HDR_F_NEEDS_CSUM;
      vhdr->flags |= VIRTIO_NET_HDR_F_DATA_VALID;
 diff --git a/include/net/checksum.h b/include/net/checksum.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/net/checksum.h
 +++ b/include/net/checksum.h
@@ -XXX,XX +XXX,XX @@ net_checksum_add(int len, uint8_t *buf)
  }
  static inline uint16_t
 +net_checksum_finish_nozero(uint32_t sum)
 +{
 +    return net_checksum_finish(sum) ?: 0xFFFF;
 +}
 +
 +static inline uint16_t
  net_raw_checksum(uint8_t *data, int length)
  {
      return net_checksum_finish(net_checksum_add(length, data));
 --
 .7.4

The following changes since commit 2e02083438962d26ef9dcc7100f3b378104183db:

Merge remote-tracking branch 'remotes/kevin/tags/for-upstream' into staging (2017-11-17 19:08:07 +0000)

are available in the git repository at:

https://github.com/jasowang/qemu.git tags/net-pull-request

for you to fetch changes up to c527e0afcd7d719abc3a5ca5e4c8ac2fe48b999f:

hw/net/vmxnet3: Fix code to work on big endian hosts, too (2017-11-20 11:08:00 +0800)

----------------------------------------------------------------

----------------------------------------------------------------
Ed Swierk (1):
      net: Transmit zero UDP checksum as 0xFFFF

Jason Wang (1):
      Revert "Add new PCI ID for i82559a"

Mao Zhongyi (1):
      colo-compare: fix the dangerous assignment

Stefan Weil (1):
      MAINTAINERS: Add missing entry for eepro100 emulation

Thomas Huth (2):
      hw/net/eepro100: Fix endianness problem on big endian hosts
      hw/net/vmxnet3: Fix code to work on big endian hosts, too

This reverts commit 5e89dc01133f8f5e621f6b66b356c6f37d31dafb since:

- we should use ID in the spec instead the one used by OEM
- in the future, we should allow changing id through either property
  or EEPROM file.

Cc: Stefan Weil <sw@weilnetz.de>
Cc: Michael Nawrocki <michael.nawrocki@gtri.gatech.edu>
Cc: Peter Maydell <peter.maydell@linaro.org>
Cc: Michael S. Tsirkin <mst@redhat.com>
Reviewed-by: Stefan Weil <sw@weilnetz.de>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/eepro100.c    | 13 -------------
 include/hw/compat.h  |  4 ----
 include/hw/pci/pci.h |  1 -
 qemu-options.hx      |  2 +-
 4 files changed, 1 insertion(+), 19 deletions(-)

diff --git a/hw/net/eepro100.c b/hw/net/eepro100.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/eepro100.c
+++ b/hw/net/eepro100.c
@@ -XXX,XX +XXX,XX @@ typedef struct {
     const char *name;
     const char *desc;
     uint16_t device_id;
-    uint16_t alt_device_id;
     uint8_t revision;
     uint16_t subsystem_vendor_id;
     uint16_t subsystem_id;
@@ -XXX,XX +XXX,XX @@ typedef struct {
     /* Quasi static device properties (no need to save them). */
     uint16_t stats_size;
     bool has_extended_tcb_support;
-    bool use_alt_device_id;
 } EEPRO100State;
 
 /* Word indices in EEPROM. */
@@ -XXX,XX +XXX,XX @@ static void e100_nic_realize(PCIDevice *pci_dev, Error **errp)
 
     TRACE(OTHER, logout("\n"));
 
-    /* By default, the i82559a adapter uses the legacy PCI ID (for the
-     * i82557). This allows the PCI ID to be changed to the alternate
-     * i82559 ID if needed.
-     */
-    if (s->use_alt_device_id && strcmp(info->name, "i82559a") == 0) {
-        pci_config_set_device_id(s->dev.config, info->alt_device_id);
-    }
-
     s->device = info->device;
 
     e100_pci_reset(s, &local_err);
@@ -XXX,XX +XXX,XX @@ static E100PCIDeviceInfo e100_devices[] = {
         .desc = "Intel i82559A Ethernet",
         .device = i82559A,
         .device_id = PCI_DEVICE_ID_INTEL_82557,
-        .alt_device_id = PCI_DEVICE_ID_INTEL_82559,
         .revision = 0x06,
         .stats_size = 80,
         .has_extended_tcb_support = true,
@@ -XXX,XX +XXX,XX @@ static E100PCIDeviceInfo *eepro100_get_class(EEPRO100State *s)
 
 static Property e100_properties[] = {
     DEFINE_NIC_PROPERTIES(EEPRO100State, conf),
-    DEFINE_PROP_BOOL("x-use-alt-device-id", EEPRO100State, use_alt_device_id,
-                     true),
     DEFINE_PROP_END_OF_LIST(),
 };
 
diff --git a/include/hw/compat.h b/include/hw/compat.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/compat.h
+++ b/include/hw/compat.h
@@ -XXX,XX +XXX,XX @@
         .driver   = "virtio-tablet-device",\
         .property = "wheel-axis",\
         .value    = "false",\
-    },{\
-        .driver   = "i82559a",\
-        .property = "x-use-alt-device-id",\
-        .value    = "false",\
     },
 
 #define HW_COMPAT_2_9 \
diff --git a/include/hw/pci/pci.h b/include/hw/pci/pci.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/pci/pci.h
+++ b/include/hw/pci/pci.h
@@ -XXX,XX +XXX,XX @@ extern bool pci_available;
 /* Intel (0x8086) */
 #define PCI_DEVICE_ID_INTEL_82551IT      0x1209
 #define PCI_DEVICE_ID_INTEL_82557        0x1229
-#define PCI_DEVICE_ID_INTEL_82559        0x1030
 #define PCI_DEVICE_ID_INTEL_82801IR      0x2922
 
 /* Red Hat / Qumranet (for QEMU) -- see pci-ids.txt */
diff --git a/qemu-options.hx b/qemu-options.hx
index XXXXXXX..XXXXXXX 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -XXX,XX +XXX,XX @@ that the card should have; this option currently only affects virtio cards; set
 @var{v} = 0 to disable MSI-X. If no @option{-net} option is specified, a single
 NIC is created.  QEMU can emulate several different models of network card.
 Valid values for @var{type} are
-@code{virtio}, @code{i82551}, @code{i82557b}, @code{i82559a}, @code{i82559er},
+@code{virtio}, @code{i82551}, @code{i82557b}, @code{i82559er},
 @code{ne2k_pci}, @code{ne2k_isa}, @code{pcnet}, @code{rtl8139},
 @code{e1000}, @code{smc91c111}, @code{lance} and @code{mcf_fec}.
 Not all devices are supported on all targets.  Use @code{-net nic,model=help}
-- 
2.7.4

From: Thomas Huth <thuth@redhat.com>

Since commit 1865e288a823c764cd4344d ("Fix eepro100 simple transmission
mode"), the test/pxe-test is broken for the eepro100 device on big
endian hosts. However, it seems like that commit did not introduce the
problem, but just uncovered it: The EEPRO100State->tx.tbd_array_addr and
EEPRO100State->tx.tcb_bytes fields are already in host byte order, since
they have already been byte-swapped in the read_cb() function.
Thus byte-swapping them in tx_command() again results in the wrong
endianness. Removing the byte-swapping here fixes the pxe-test.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/eepro100.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/net/eepro100.c b/hw/net/eepro100.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/eepro100.c
+++ b/hw/net/eepro100.c
@@ -XXX,XX +XXX,XX @@ static void read_cb(EEPRO100State *s)
 
 static void tx_command(EEPRO100State *s)
 {
-    uint32_t tbd_array = le32_to_cpu(s->tx.tbd_array_addr);
-    uint16_t tcb_bytes = (le16_to_cpu(s->tx.tcb_bytes) & 0x3fff);
+    uint32_t tbd_array = s->tx.tbd_array_addr;
+    uint16_t tcb_bytes = s->tx.tcb_bytes & 0x3fff;
     /* Sends larger than MAX_ETH_FRAME_SIZE are allowed, up to 2600 bytes. */
     uint8_t buf[2600];
     uint16_t size = 0;
-- 
2.7.4

From: Ed Swierk <eswierk@skyportsystems.com>

The checksum algorithm used by IPv4, TCP and UDP allows a zero value
to be represented by either 0x0000 and 0xFFFF. But per RFC 768, a zero
UDP checksum must be transmitted as 0xFFFF because 0x0000 is a special
value meaning no checksum.

Substitute 0xFFFF whenever a checksum is computed as zero when
modifying a UDP datagram header. Doing this on IPv4 and TCP checksums
is unnecessary but legal. Add a wrapper for net_checksum_finish() that
makes the substitution.

(We can't just change net_checksum_finish(), as that function is also
used by receivers to verify checksums, and in that case the expected
value is always 0x0000.)

Signed-off-by: Ed Swierk <eswierk@skyportsystems.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/e1000.c         | 2 +-
 hw/net/net_rx_pkt.c    | 2 +-
 hw/net/net_tx_pkt.c    | 2 +-
 hw/net/vmxnet3.c       | 3 ++-
 include/net/checksum.h | 6 ++++++
 5 files changed, 11 insertions(+), 4 deletions(-)

diff --git a/hw/net/e1000.c b/hw/net/e1000.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/e1000.c
+++ b/hw/net/e1000.c
@@ -XXX,XX +XXX,XX @@ putsum(uint8_t *data, uint32_t n, uint32_t sloc, uint32_t css, uint32_t cse)
         n = cse + 1;
     if (sloc < n-1) {
         sum = net_checksum_add(n-css, data+css);
-        stw_be_p(data + sloc, net_checksum_finish(sum));
+        stw_be_p(data + sloc, net_checksum_finish_nozero(sum));
     }
 }
 
diff --git a/hw/net/net_rx_pkt.c b/hw/net/net_rx_pkt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/net_rx_pkt.c
+++ b/hw/net/net_rx_pkt.c
@@ -XXX,XX +XXX,XX @@ _net_rx_pkt_calc_l4_csum(struct NetRxPkt *pkt)
     cntr += net_checksum_add_iov(pkt->vec, pkt->vec_len,
                                  pkt->l4hdr_off, csl, cso);
 
-    csum = net_checksum_finish(cntr);
+    csum = net_checksum_finish_nozero(cntr);
 
     trace_net_rx_pkt_l4_csum_calc_csum(pkt->l4hdr_off, csl, cntr, csum);
 
diff --git a/hw/net/net_tx_pkt.c b/hw/net/net_tx_pkt.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/net_tx_pkt.c
+++ b/hw/net/net_tx_pkt.c
@@ -XXX,XX +XXX,XX @@ static void net_tx_pkt_do_sw_csum(struct NetTxPkt *pkt)
         net_checksum_add_iov(iov, iov_len, pkt->virt_hdr.csum_start, csl, cso);
 
     /* Put the checksum obtained into the packet */
-    csum = cpu_to_be16(net_checksum_finish(csum_cntr));
+    csum = cpu_to_be16(net_checksum_finish_nozero(csum_cntr));
     iov_from_buf(iov, iov_len, csum_offset, &csum, sizeof csum);
 }
 
diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/vmxnet3.c
+++ b/hw/net/vmxnet3.c
@@ -XXX,XX +XXX,XX @@ static void vmxnet3_rx_need_csum_calculate(struct NetRxPkt *pkt,
     data = (uint8_t *)pkt_data + vhdr->csum_start;
     len = pkt_len - vhdr->csum_start;
     /* Put the checksum obtained into the packet */
-    stw_be_p(data + vhdr->csum_offset, net_raw_checksum(data, len));
+    stw_be_p(data + vhdr->csum_offset,
+             net_checksum_finish_nozero(net_checksum_add(len, data)));
 
     vhdr->flags &= ~VIRTIO_NET_HDR_F_NEEDS_CSUM;
     vhdr->flags |= VIRTIO_NET_HDR_F_DATA_VALID;
diff --git a/include/net/checksum.h b/include/net/checksum.h
index XXXXXXX..XXXXXXX 100644
--- a/include/net/checksum.h
+++ b/include/net/checksum.h
@@ -XXX,XX +XXX,XX @@ net_checksum_add(int len, uint8_t *buf)
 }
 
 static inline uint16_t
+net_checksum_finish_nozero(uint32_t sum)
+{
+    return net_checksum_finish(sum) ?: 0xFFFF;
+}
+
+static inline uint16_t
 net_raw_checksum(uint8_t *data, int length)
 {
     return net_checksum_finish(net_checksum_add(length, data));
-- 
2.7.4

From: Thomas Huth <thuth@redhat.com>

Since commit ab06ec43577177a442e8 we test the vmxnet3 device in the
pxe-tester, too (when running "make check SPEED=slow"). This now
revealed that the code is not working there if the host is a big
endian machine (for example ppc64 or s390x) - "make check SPEED=slow"
is now failing on such hosts.

The vmxnet3 code lacks endianness conversions in a couple of places.
Interestingly, the bitfields in the structs in vmxnet3.h already tried to
take care of the *bit* endianness of the C compilers - but the code missed
to change the *byte* endianness when reading or writing the corresponding
structs. So the bitfields are now wrapped into unions which allow to change
the byte endianness during runtime with the non-bitfield member of the union.
With these changes, "make check SPEED=slow" now properly works on big endian
hosts, too.

Reported-by: David Gibson <dgibson@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: David Gibson <dgibson@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/vmware_utils.h |   6 ++
 hw/net/vmxnet3.c      |  46 +++++++---
 hw/net/vmxnet3.h      | 230 ++++++++++++++++++++++++++++++--------------------
 3 files changed, 181 insertions(+), 101 deletions(-)

diff --git a/hw/net/vmware_utils.h b/hw/net/vmware_utils.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/vmware_utils.h
+++ b/hw/net/vmware_utils.h
@@ -XXX,XX +XXX,XX @@ vmw_shmem_ld16(PCIDevice *d, hwaddr addr)
 {
     uint16_t res;
     pci_dma_read(d, addr, &res, 2);
+    res = le16_to_cpu(res);
     VMW_SHPRN("SHMEM load16: %" PRIx64 " (value 0x%X)", addr, res);
     return res;
 }
@@ -XXX,XX +XXX,XX @@ static inline void
 vmw_shmem_st16(PCIDevice *d, hwaddr addr, uint16_t value)
 {
     VMW_SHPRN("SHMEM store16: %" PRIx64 " (value 0x%X)", addr, value);
+    value = cpu_to_le16(value);
     pci_dma_write(d, addr, &value, 2);
 }
 
@@ -XXX,XX +XXX,XX @@ vmw_shmem_ld32(PCIDevice *d, hwaddr addr)
 {
     uint32_t res;
     pci_dma_read(d, addr, &res, 4);
+    res = le32_to_cpu(res);
     VMW_SHPRN("SHMEM load32: %" PRIx64 " (value 0x%X)", addr, res);
     return res;
 }
@@ -XXX,XX +XXX,XX @@ static inline void
 vmw_shmem_st32(PCIDevice *d, hwaddr addr, uint32_t value)
 {
     VMW_SHPRN("SHMEM store32: %" PRIx64 " (value 0x%X)", addr, value);
+    value = cpu_to_le32(value);
     pci_dma_write(d, addr, &value, 4);
 }
 
@@ -XXX,XX +XXX,XX @@ vmw_shmem_ld64(PCIDevice *d, hwaddr addr)
 {
     uint64_t res;
     pci_dma_read(d, addr, &res, 8);
+    res = le64_to_cpu(res);
     VMW_SHPRN("SHMEM load64: %" PRIx64 " (value %" PRIx64 ")", addr, res);
     return res;
 }
@@ -XXX,XX +XXX,XX @@ static inline void
 vmw_shmem_st64(PCIDevice *d, hwaddr addr, uint64_t value)
 {
     VMW_SHPRN("SHMEM store64: %" PRIx64 " (value %" PRIx64 ")", addr, value);
+    value = cpu_to_le64(value);
     pci_dma_write(d, addr, &value, 8);
 }
 
diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/vmxnet3.c
+++ b/hw/net/vmxnet3.c
@@ -XXX,XX +XXX,XX @@ vmxnet3_dump_tx_descr(struct Vmxnet3_TxDesc *descr)
               "addr %" PRIx64 ", len: %d, gen: %d, rsvd: %d, "
               "dtype: %d, ext1: %d, msscof: %d, hlen: %d, om: %d, "
               "eop: %d, cq: %d, ext2: %d, ti: %d, tci: %d",
-              le64_to_cpu(descr->addr), descr->len, descr->gen, descr->rsvd,
+              descr->addr, descr->len, descr->gen, descr->rsvd,
               descr->dtype, descr->ext1, descr->msscof, descr->hlen, descr->om,
               descr->eop, descr->cq, descr->ext2, descr->ti, descr->tci);
 }
@@ -XXX,XX +XXX,XX @@ vmxnet3_dump_rx_descr(struct Vmxnet3_RxDesc *descr)
 {
     VMW_PKPRN("RX DESCR: addr %" PRIx64 ", len: %d, gen: %d, rsvd: %d, "
               "dtype: %d, ext1: %d, btype: %d",
-              le64_to_cpu(descr->addr), descr->len, descr->gen,
+              descr->addr, descr->len, descr->gen,
               descr->rsvd, descr->dtype, descr->ext1, descr->btype);
 }
 
@@ -XXX,XX +XXX,XX @@ static void vmxnet3_complete_packet(VMXNET3State *s, int qidx, uint32_t tx_ridx)
     memset(&txcq_descr, 0, sizeof(txcq_descr));
     txcq_descr.txdIdx = tx_ridx;
     txcq_descr.gen = vmxnet3_ring_curr_gen(&s->txq_descr[qidx].comp_ring);
-
+    txcq_descr.val1 = cpu_to_le32(txcq_descr.val1);
+    txcq_descr.val2 = cpu_to_le32(txcq_descr.val2);
     vmxnet3_ring_write_curr_cell(d, &s->txq_descr[qidx].comp_ring, &txcq_descr);
 
     /* Flush changes in TX descriptor before changing the counter value */
@@ -XXX,XX +XXX,XX @@ vmxnet3_on_rx_done_update_stats(VMXNET3State *s,
     }
 }
 
+static inline void
+vmxnet3_ring_read_curr_txdesc(PCIDevice *pcidev, Vmxnet3Ring *ring,
+                              struct Vmxnet3_TxDesc *txd)
+{
+    vmxnet3_ring_read_curr_cell(pcidev, ring, txd);
+    txd->addr = le64_to_cpu(txd->addr);
+    txd->val1 = le32_to_cpu(txd->val1);
+    txd->val2 = le32_to_cpu(txd->val2);
+}
+
 static inline bool
 vmxnet3_pop_next_tx_descr(VMXNET3State *s,
                           int qidx,
@@ -XXX,XX +XXX,XX @@ vmxnet3_pop_next_tx_descr(VMXNET3State *s,
     Vmxnet3Ring *ring = &s->txq_descr[qidx].tx_ring;
     PCIDevice *d = PCI_DEVICE(s);
 
-    vmxnet3_ring_read_curr_cell(d, ring, txd);
+    vmxnet3_ring_read_curr_txdesc(d, ring, txd);
     if (txd->gen == vmxnet3_ring_curr_gen(ring)) {
         /* Only read after generation field verification */
         smp_rmb();
         /* Re-read to be sure we got the latest version */
-        vmxnet3_ring_read_curr_cell(d, ring, txd);
+        vmxnet3_ring_read_curr_txdesc(d, ring, txd);
         VMXNET3_RING_DUMP(VMW_RIPRN, "TX", qidx, ring);
         *descr_idx = vmxnet3_ring_curr_cell_idx(ring);
         vmxnet3_inc_tx_consumption_counter(s, qidx);
@@ -XXX,XX +XXX,XX @@ static void vmxnet3_process_tx_queue(VMXNET3State *s, int qidx)
 
         if (!s->skip_current_tx_pkt) {
             data_len = (txd.len > 0) ? txd.len : VMXNET3_MAX_TX_BUF_SIZE;
-            data_pa = le64_to_cpu(txd.addr);
+            data_pa = txd.addr;
 
             if (!net_tx_pkt_add_raw_fragment(s->tx_pkt,
                                                 data_pa,
@@ -XXX,XX +XXX,XX @@ vmxnet3_read_next_rx_descr(VMXNET3State *s, int qidx, int ridx,
     Vmxnet3Ring *ring = &s->rxq_descr[qidx].rx_ring[ridx];
     *didx = vmxnet3_ring_curr_cell_idx(ring);
     vmxnet3_ring_read_curr_cell(d, ring, dbuf);
+    dbuf->addr = le64_to_cpu(dbuf->addr);
+    dbuf->val1 = le32_to_cpu(dbuf->val1);
+    dbuf->ext1 = le32_to_cpu(dbuf->ext1);
 }
 
 static inline uint8_t
@@ -XXX,XX +XXX,XX @@ vmxnet3_pop_rxc_descr(VMXNET3State *s, int qidx, uint32_t *descr_gen)
 
     pci_dma_read(PCI_DEVICE(s),
                  daddr, &rxcd, sizeof(struct Vmxnet3_RxCompDesc));
+    rxcd.val1 = le32_to_cpu(rxcd.val1);
+    rxcd.val2 = le32_to_cpu(rxcd.val2);
+    rxcd.val3 = le32_to_cpu(rxcd.val3);
     ring_gen = vmxnet3_ring_curr_gen(&s->rxq_descr[qidx].comp_ring);
 
     if (rxcd.gen != ring_gen) {
@@ -XXX,XX +XXX,XX @@ vmxnet3_pci_dma_writev(PCIDevice *pci_dev,
     }
 }
 
+static void
+vmxnet3_pci_dma_write_rxcd(PCIDevice *pcidev, dma_addr_t pa,
+                           struct Vmxnet3_RxCompDesc *rxcd)
+{
+    rxcd->val1 = cpu_to_le32(rxcd->val1);
+    rxcd->val2 = cpu_to_le32(rxcd->val2);
+    rxcd->val3 = cpu_to_le32(rxcd->val3);
+    pci_dma_write(pcidev, pa, rxcd, sizeof(*rxcd));
+}
+
 static bool
 vmxnet3_indicate_packet(VMXNET3State *s)
 {
@@ -XXX,XX +XXX,XX @@ vmxnet3_indicate_packet(VMXNET3State *s)
         }
 
         chunk_size = MIN(bytes_left, rxd.len);
-        vmxnet3_pci_dma_writev(d, data, bytes_copied,
-                               le64_to_cpu(rxd.addr), chunk_size);
+        vmxnet3_pci_dma_writev(d, data, bytes_copied, rxd.addr, chunk_size);
         bytes_copied += chunk_size;
         bytes_left -= chunk_size;
 
         vmxnet3_dump_rx_descr(&rxd);
 
         if (ready_rxcd_pa != 0) {
-            pci_dma_write(d, ready_rxcd_pa, &rxcd, sizeof(rxcd));
+            vmxnet3_pci_dma_write_rxcd(d, ready_rxcd_pa, &rxcd);
         }
 
         memset(&rxcd, 0, sizeof(struct Vmxnet3_RxCompDesc));
@@ -XXX,XX +XXX,XX @@ vmxnet3_indicate_packet(VMXNET3State *s)
         rxcd.eop = 1;
         rxcd.err = (bytes_left != 0);
 
-        pci_dma_write(d, ready_rxcd_pa, &rxcd, sizeof(rxcd));
+        vmxnet3_pci_dma_write_rxcd(d, ready_rxcd_pa, &rxcd);
 
         /* Flush RX descriptor changes */
         smp_wmb();
diff --git a/hw/net/vmxnet3.h b/hw/net/vmxnet3.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/vmxnet3.h
+++ b/hw/net/vmxnet3.h
@@ -XXX,XX +XXX,XX @@ enum {
 struct Vmxnet3_TxDesc {
     __le64 addr;
 
+    union {
+        struct {
 #ifdef __BIG_ENDIAN_BITFIELD
-    u32 msscof:14;  /* MSS, checksum offset, flags */
-    u32 ext1:1;
-    u32 dtype:1;    /* descriptor type */
-    u32 rsvd:1;
-    u32 gen:1;      /* generation bit */
-    u32 len:14;
+            u32 msscof:14;  /* MSS, checksum offset, flags */
+            u32 ext1:1;
+            u32 dtype:1;    /* descriptor type */
+            u32 rsvd:1;
+            u32 gen:1;      /* generation bit */
+            u32 len:14;
 #else
-    u32 len:14;
-    u32 gen:1;      /* generation bit */
-    u32 rsvd:1;
-    u32 dtype:1;    /* descriptor type */
-    u32 ext1:1;
-    u32 msscof:14;  /* MSS, checksum offset, flags */
+            u32 len:14;
+            u32 gen:1;      /* generation bit */
+            u32 rsvd:1;
+            u32 dtype:1;    /* descriptor type */
+            u32 ext1:1;
+            u32 msscof:14;  /* MSS, checksum offset, flags */
 #endif  /* __BIG_ENDIAN_BITFIELD */
-
+        };
+        u32 val1;
+    };
+    
+    union {
+        struct {
 #ifdef __BIG_ENDIAN_BITFIELD
-    u32 tci:16;     /* Tag to Insert */
-    u32 ti:1;       /* VLAN Tag Insertion */
-    u32 ext2:1;
-    u32 cq:1;       /* completion request */
-    u32 eop:1;      /* End Of Packet */
-    u32 om:2;       /* offload mode */
-    u32 hlen:10;    /* header len */
+            u32 tci:16;     /* Tag to Insert */
+            u32 ti:1;       /* VLAN Tag Insertion */
+            u32 ext2:1;
+            u32 cq:1;       /* completion request */
+            u32 eop:1;      /* End Of Packet */
+            u32 om:2;       /* offload mode */
+            u32 hlen:10;    /* header len */
 #else
-    u32 hlen:10;    /* header len */
-    u32 om:2;       /* offload mode */
-    u32 eop:1;      /* End Of Packet */
-    u32 cq:1;       /* completion request */
-    u32 ext2:1;
-    u32 ti:1;       /* VLAN Tag Insertion */
-    u32 tci:16;     /* Tag to Insert */
+            u32 hlen:10;    /* header len */
+            u32 om:2;       /* offload mode */
+            u32 eop:1;      /* End Of Packet */
+            u32 cq:1;       /* completion request */
+            u32 ext2:1;
+            u32 ti:1;       /* VLAN Tag Insertion */
+            u32 tci:16;     /* Tag to Insert */
 #endif  /* __BIG_ENDIAN_BITFIELD */
+        };
+        u32 val2;
+    };
 };
 
 /* TxDesc.OM values */
@@ -XXX,XX +XXX,XX @@ struct Vmxnet3_TxDataDesc {
 #define VMXNET3_TCD_GEN_DWORD_SHIFT    3
 
 struct Vmxnet3_TxCompDesc {
-    u32        txdIdx:12;    /* Index of the EOP TxDesc */
-    u32        ext1:20;
-
+    union {
+        struct {
+#ifdef __BIG_ENDIAN_BITFIELD
+            u32 ext1:20;
+            u32 txdIdx:12;    /* Index of the EOP TxDesc */
+#else
+            u32 txdIdx:12;    /* Index of the EOP TxDesc */
+            u32 ext1:20;
+#endif
+        };
+        u32 val1;
+    };
     __le32        ext2;
     __le32        ext3;
 
-    u32        rsvd:24;
-    u32        type:7;       /* completion type */
-    u32        gen:1;        /* generation bit */
+    union {
+        struct {
+#ifdef __BIG_ENDIAN_BITFIELD
+            u32 gen:1;        /* generation bit */
+            u32 type:7;       /* completion type */
+            u32 rsvd:24;
+#else
+            u32 rsvd:24;
+            u32 type:7;       /* completion type */
+            u32 gen:1;        /* generation bit */
+#endif
+        };
+        u32 val2;
+    };
 };
 
 struct Vmxnet3_RxDesc {
     __le64        addr;
-
+    union {
+        struct {
 #ifdef __BIG_ENDIAN_BITFIELD
-    u32        gen:1;        /* Generation bit */
-    u32        rsvd:15;
-    u32        dtype:1;      /* Descriptor type */
-    u32        btype:1;      /* Buffer Type */
-    u32        len:14;
+            u32 gen:1;        /* Generation bit */
+            u32 rsvd:15;
+            u32 dtype:1;      /* Descriptor type */
+            u32 btype:1;      /* Buffer Type */
+            u32 len:14;
 #else
-    u32        len:14;
-    u32        btype:1;      /* Buffer Type */
-    u32        dtype:1;      /* Descriptor type */
-    u32        rsvd:15;
-    u32        gen:1;        /* Generation bit */
+            u32 len:14;
+            u32 btype:1;      /* Buffer Type */
+            u32 dtype:1;      /* Descriptor type */
+            u32 rsvd:15;
+            u32 gen:1;        /* Generation bit */
 #endif
+        };
+        u32 val1;
+    };
     u32        ext1;
 };
 
@@ -XXX,XX +XXX,XX @@ struct Vmxnet3_RxDesc {
 #define VMXNET3_RXD_GEN_SHIFT    31
 
 struct Vmxnet3_RxCompDesc {
+    union {
+        struct {
 #ifdef __BIG_ENDIAN_BITFIELD
-    u32        ext2:1;
-    u32        cnc:1;        /* Checksum Not Calculated */
-    u32        rssType:4;    /* RSS hash type used */
-    u32        rqID:10;      /* rx queue/ring ID */
-    u32        sop:1;        /* Start of Packet */
-    u32        eop:1;        /* End of Packet */
-    u32        ext1:2;
-    u32        rxdIdx:12;    /* Index of the RxDesc */
+            u32 ext2:1;
+            u32 cnc:1;        /* Checksum Not Calculated */
+            u32 rssType:4;    /* RSS hash type used */
+            u32 rqID:10;      /* rx queue/ring ID */
+            u32 sop:1;        /* Start of Packet */
+            u32 eop:1;        /* End of Packet */
+            u32 ext1:2;
+            u32 rxdIdx:12;    /* Index of the RxDesc */
 #else
-    u32        rxdIdx:12;    /* Index of the RxDesc */
-    u32        ext1:2;
-    u32        eop:1;        /* End of Packet */
-    u32        sop:1;        /* Start of Packet */
-    u32        rqID:10;      /* rx queue/ring ID */
-    u32        rssType:4;    /* RSS hash type used */
-    u32        cnc:1;        /* Checksum Not Calculated */
-    u32        ext2:1;
+            u32 rxdIdx:12;    /* Index of the RxDesc */
+            u32 ext1:2;
+            u32 eop:1;        /* End of Packet */
+            u32 sop:1;        /* Start of Packet */
+            u32 rqID:10;      /* rx queue/ring ID */
+            u32 rssType:4;    /* RSS hash type used */
+            u32 cnc:1;        /* Checksum Not Calculated */
+            u32 ext2:1;
 #endif  /* __BIG_ENDIAN_BITFIELD */
+        };
+        u32 val1;
+    };
 
     __le32        rssHash;      /* RSS hash value */
 
+    union {
+        struct {
 #ifdef __BIG_ENDIAN_BITFIELD
-    u32        tci:16;       /* Tag stripped */
-    u32        ts:1;         /* Tag is stripped */
-    u32        err:1;        /* Error */
-    u32        len:14;       /* data length */
+            u32 tci:16;       /* Tag stripped */
+            u32 ts:1;         /* Tag is stripped */
+            u32 err:1;        /* Error */
+            u32 len:14;       /* data length */
 #else
-    u32        len:14;       /* data length */
-    u32        err:1;        /* Error */
-    u32        ts:1;         /* Tag is stripped */
-    u32        tci:16;       /* Tag stripped */
+            u32 len:14;       /* data length */
+            u32 err:1;        /* Error */
+            u32 ts:1;         /* Tag is stripped */
+            u32 tci:16;       /* Tag stripped */
 #endif  /* __BIG_ENDIAN_BITFIELD */
+        };
+        u32 val2;
+    };
 
-
+    union {
+        struct {
 #ifdef __BIG_ENDIAN_BITFIELD
-    u32        gen:1;        /* generation bit */
-    u32        type:7;       /* completion type */
-    u32        fcs:1;        /* Frame CRC correct */
-    u32        frg:1;        /* IP Fragment */
-    u32        v4:1;         /* IPv4 */
-    u32        v6:1;         /* IPv6 */
-    u32        ipc:1;        /* IP Checksum Correct */
-    u32        tcp:1;        /* TCP packet */
-    u32        udp:1;        /* UDP packet */
-    u32        tuc:1;        /* TCP/UDP Checksum Correct */
-    u32        csum:16;
+            u32 gen:1;        /* generation bit */
+            u32 type:7;       /* completion type */
+            u32 fcs:1;        /* Frame CRC correct */
+            u32 frg:1;        /* IP Fragment */
+            u32 v4:1;         /* IPv4 */
+            u32 v6:1;         /* IPv6 */
+            u32 ipc:1;        /* IP Checksum Correct */
+            u32 tcp:1;        /* TCP packet */
+            u32 udp:1;        /* UDP packet */
+            u32 tuc:1;        /* TCP/UDP Checksum Correct */
+            u32 csum:16;
 #else
-    u32        csum:16;
-    u32        tuc:1;        /* TCP/UDP Checksum Correct */
-    u32        udp:1;        /* UDP packet */
-    u32        tcp:1;        /* TCP packet */
-    u32        ipc:1;        /* IP Checksum Correct */
-    u32        v6:1;         /* IPv6 */
-    u32        v4:1;         /* IPv4 */
-    u32        frg:1;        /* IP Fragment */
-    u32        fcs:1;        /* Frame CRC correct */
-    u32        type:7;       /* completion type */
-    u32        gen:1;        /* generation bit */
+            u32 csum:16;
+            u32 tuc:1;        /* TCP/UDP Checksum Correct */
+            u32 udp:1;        /* UDP packet */
+            u32 tcp:1;        /* TCP packet */
+            u32 ipc:1;        /* IP Checksum Correct */
+            u32 v6:1;         /* IPv6 */
+            u32 v4:1;         /* IPv4 */
+            u32 frg:1;        /* IP Fragment */
+            u32 fcs:1;        /* Frame CRC correct */
+            u32 type:7;       /* completion type */
+            u32 gen:1;        /* generation bit */
 #endif  /* __BIG_ENDIAN_BITFIELD */
+        };
+        u32 val3;
+    };
 };
 
 /* fields in RxCompDesc we access via Vmxnet3_GenericDesc.dword[3] */
-- 
2.7.4

The following changes since commit bdee969c0e65d4d509932b1d70e3a3b2ffbff6d5:

Merge remote-tracking branch 'remotes/bonzini-gitlab/tags/for-upstream' into staging (2021-03-19 18:01:17 +0000)

are available in the git repository at:

https://github.com/jasowang/qemu.git tags/net-pull-request

for you to fetch changes up to c7274b5ef43614dd133daec1e2018f71d8744088:

net/eth: Add an assert() and invert if() statement to simplify code (2021-03-22 17:34:31 +0800)

----------------------------------------------------------------

----------------------------------------------------------------
Bin Meng (4):
      net: eth: Add a helper to pad a short Ethernet frame
      net: Add a 'do_not_pad" to NetClientState
      net: Pad short frames to minimum size before sending from SLiRP/TAP
      hw/net: virtio-net: Initialize nc->do_not_pad to true

Lukas Straub (2):
      net/colo-compare.c: Fix memory leak for non-tcp packet
      net/colo-compare.c: Optimize removal of secondary packet

Philippe Mathieu-Daudé (7):
      net/eth: Use correct in6_address offset in _eth_get_rss_ex_dst_addr()
      net/eth: Simplify _eth_get_rss_ex_dst_addr()
      net/eth: Better describe _eth_get_rss_ex_dst_addr's offset argument
      net/eth: Check size earlier in _eth_get_rss_ex_dst_addr()
      net/eth: Check iovec has enough data earlier
      net/eth: Read ip6_ext_hdr_routing buffer before accessing it
      net/eth: Add an assert() and invert if() statement to simplify code

From: Bin Meng <bmeng.cn@gmail.com>

Add a helper to pad a short Ethernet frame to the minimum required
length, which can be used by backends' code.

Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 include/net/eth.h | 17 +++++++++++++++++
 net/eth.c         | 17 +++++++++++++++++
 2 files changed, 34 insertions(+)

diff --git a/include/net/eth.h b/include/net/eth.h
index XXXXXXX..XXXXXXX 100644
--- a/include/net/eth.h
+++ b/include/net/eth.h
@@ -XXX,XX +XXX,XX @@
 
 #define ETH_ALEN 6
 #define ETH_HLEN 14
+#define ETH_ZLEN 60     /* Min. octets in frame without FCS */
 
 struct eth_header {
     uint8_t  h_dest[ETH_ALEN];   /* destination eth addr */
@@ -XXX,XX +XXX,XX @@ bool
 eth_parse_ipv6_hdr(const struct iovec *pkt, int pkt_frags,
                    size_t ip6hdr_off, eth_ip6_hdr_info *info);
 
+/**
+ * eth_pad_short_frame - pad a short frame to the minimum Ethernet frame length
+ *
+ * If the Ethernet frame size is shorter than 60 bytes, it will be padded to
+ * 60 bytes at the address @padded_pkt.
+ *
+ * @padded_pkt: buffer address to hold the padded frame
+ * @padded_buflen: pointer holding length of @padded_pkt. If the frame is
+ *                 padded, the length will be updated to the padded one.
+ * @pkt: address to hold the original Ethernet frame
+ * @pkt_size: size of the original Ethernet frame
+ * @return true if the frame is padded, otherwise false
+ */
+bool eth_pad_short_frame(uint8_t *padded_pkt, size_t *padded_buflen,
+                         const void *pkt, size_t pkt_size);
+
 #endif
diff --git a/net/eth.c b/net/eth.c
index XXXXXXX..XXXXXXX 100644
--- a/net/eth.c
+++ b/net/eth.c
@@ -XXX,XX +XXX,XX @@ bool eth_parse_ipv6_hdr(const struct iovec *pkt, int pkt_frags,
     info->l4proto = ext_hdr.ip6r_nxt;
     return true;
 }
+
+bool eth_pad_short_frame(uint8_t *padded_pkt, size_t *padded_buflen,
+                         const void *pkt, size_t pkt_size)
+{
+    assert(padded_buflen && *padded_buflen >= ETH_ZLEN);
+
+    if (pkt_size >= ETH_ZLEN) {
+        return false;
+    }
+
+    /* pad to minimum Ethernet frame length */
+    memcpy(padded_pkt, pkt, pkt_size);
+    memset(&padded_pkt[pkt_size], 0, ETH_ZLEN - pkt_size);
+    *padded_buflen = ETH_ZLEN;
+
+    return true;
+}
-- 
2.7.4

From: Bin Meng <bmeng.cn@gmail.com>

The minimum Ethernet frame length is 60 bytes. For short frames with
smaller length like ARP packets (only 42 bytes), on a real world NIC
it can choose either padding its length to the minimum required 60
bytes, or sending it out directly to the wire. Such behavior can be
hardcoded or controled by a register bit. Similarly on the receive
path, NICs can choose either dropping such short frames directly or
handing them over to software to handle.

On the other hand, for the network backends like SLiRP/TAP, they
don't expose a way to control the short frame behavior. As of today
they just send/receive data from/to the other end connected to them,
which means any sized packet is acceptable. So they can send and
receive short frames without any problem. It is observed that ARP
packets sent from SLiRP/TAP are 42 bytes, and SLiRP/TAP just send
these ARP packets to the other end which might be a NIC model that
does not allow short frames to pass through.

To provide better compatibility, for packets sent from QEMU network
backends like SLiRP/TAP, we change to pad short frames before sending
it out to the other end, if the other end does not forbid it via the
nc->do_not_pad flag. This ensures a backend as an Ethernet sender
does not violate the spec. But with this change, the behavior of
dropping short frames from SLiRP/TAP interfaces in the NIC model
cannot be emulated because it always receives a packet that is spec
complaint. The capability of sending short frames from NIC models is
still supported and short frames can still pass through SLiRP/TAP.

This commit should be able to fix the issue as reported with some
NIC models before, that ARP requests get dropped, preventing the
guest from becoming visible on the network. It was workarounded in
these NIC models on the receive path, that when a short frame is
received, it is padded up to 60 bytes.

The following 2 commits seem to be the one to workaround this issue
in e1000 and vmxenet3 before, and should probably be reverted.

commit 78aeb23eded2 ("e1000: Pad short frames to minimum size (60 bytes)")
  commit 40a87c6c9b11 ("vmxnet3: Pad short frames to minimum size (60 bytes)")

Signed-off-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/slirp.c     | 10 ++++++++++
 net/tap-win32.c | 10 ++++++++++
 net/tap.c       | 10 ++++++++++
 3 files changed, 30 insertions(+)

diff --git a/net/slirp.c b/net/slirp.c
index XXXXXXX..XXXXXXX 100644
--- a/net/slirp.c
+++ b/net/slirp.c
@@ -XXX,XX +XXX,XX @@
 #include <pwd.h>
 #include <sys/wait.h>
 #endif
+#include "net/eth.h"
 #include "net/net.h"
 #include "clients.h"
 #include "hub.h"
@@ -XXX,XX +XXX,XX @@ static ssize_t net_slirp_send_packet(const void *pkt, size_t pkt_len,
                                      void *opaque)
 {
     SlirpState *s = opaque;
+    uint8_t min_pkt[ETH_ZLEN];
+    size_t min_pktsz = sizeof(min_pkt);
+
+    if (!s->nc.peer->do_not_pad) {
+        if (eth_pad_short_frame(min_pkt, &min_pktsz, pkt, pkt_len)) {
+            pkt = min_pkt;
+            pkt_len = min_pktsz;
+        }
+    }
 
     return qemu_send_packet(&s->nc, pkt, pkt_len);
 }
diff --git a/net/tap-win32.c b/net/tap-win32.c
index XXXXXXX..XXXXXXX 100644
--- a/net/tap-win32.c
+++ b/net/tap-win32.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu-common.h"
 #include "clients.h"            /* net_init_tap */
+#include "net/eth.h"
 #include "net/net.h"
 #include "net/tap.h"            /* tap_has_ufo, ... */
 #include "qemu/error-report.h"
@@ -XXX,XX +XXX,XX @@ static void tap_win32_send(void *opaque)
     uint8_t *buf;
     int max_size = 4096;
     int size;
+    uint8_t min_pkt[ETH_ZLEN];
+    size_t min_pktsz = sizeof(min_pkt);
 
     size = tap_win32_read(s->handle, &buf, max_size);
     if (size > 0) {
+        if (!s->nc.peer->do_not_pad) {
+            if (eth_pad_short_frame(min_pkt, &min_pktsz, buf, size)) {
+                buf = min_pkt;
+                size = min_pktsz;
+            }
+        }
+
         qemu_send_packet(&s->nc, buf, size);
         tap_win32_free_buffer(s->handle, buf);
     }
diff --git a/net/tap.c b/net/tap.c
index XXXXXXX..XXXXXXX 100644
--- a/net/tap.c
+++ b/net/tap.c
@@ -XXX,XX +XXX,XX @@
 #include <sys/socket.h>
 #include <net/if.h>
 
+#include "net/eth.h"
 #include "net/net.h"
 #include "clients.h"
 #include "monitor/monitor.h"
@@ -XXX,XX +XXX,XX @@ static void tap_send(void *opaque)
 
     while (true) {
         uint8_t *buf = s->buf;
+        uint8_t min_pkt[ETH_ZLEN];
+        size_t min_pktsz = sizeof(min_pkt);
 
         size = tap_read_packet(s->fd, s->buf, sizeof(s->buf));
         if (size <= 0) {
@@ -XXX,XX +XXX,XX @@ static void tap_send(void *opaque)
             size -= s->host_vnet_hdr_len;
         }
 
+        if (!s->nc.peer->do_not_pad) {
+            if (eth_pad_short_frame(min_pkt, &min_pktsz, buf, size)) {
+                buf = min_pkt;
+                size = min_pktsz;
+            }
+        }
+
         size = qemu_send_packet_async(&s->nc, buf, size, tap_send_completed);
         if (size == 0) {
             tap_read_poll(s, false);
-- 
2.7.4

From: Lukas Straub <lukasstraub2@web.de>

g_queue_remove needs to look up the list entry first, but we
already have it as result and can remove it directly with
g_queue_delete_link.

Signed-off-by: Lukas Straub <lukasstraub2@web.de>
Signed-off-by: Zhang Chen <chen.zhang@intel.com>
Reviewed-by: Zhang Chen <chen.zhang@intel.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/colo-compare.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/colo-compare.c b/net/colo-compare.c
index XXXXXXX..XXXXXXX 100644
--- a/net/colo-compare.c
+++ b/net/colo-compare.c
@@ -XXX,XX +XXX,XX @@ static void colo_compare_packet(CompareState *s, Connection *conn,
         if (result) {
             colo_release_primary_pkt(s, pkt);
             packet_destroy(result->data, NULL);
-            g_queue_remove(&conn->secondary_list, result->data);
+            g_queue_delete_link(&conn->secondary_list, result);
         } else {
             /*
              * If one packet arrive late, the secondary_list or
-- 
2.7.4

From: Philippe Mathieu-Daudé <philmd@redhat.com>

The in6_address comes after the ip6_ext_hdr_routing header,
not after the ip6_ext_hdr one. Fix the offset.

Cc: qemu-stable@nongnu.org
Reported-by: Stefano Garzarella <sgarzare@redhat.com>
Fixes: eb700029c78 ("net_pkt: Extend packet abstraction as required by e1000e functionality")
Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/eth.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/eth.c b/net/eth.c
index XXXXXXX..XXXXXXX 100644
--- a/net/eth.c
+++ b/net/eth.c
@@ -XXX,XX +XXX,XX @@ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
         }
 
         bytes_read = iov_to_buf(pkt, pkt_frags,
-                                rthdr_offset + sizeof(*ext_hdr),
+                                rthdr_offset + sizeof(*rthdr),
                                 dst_addr, sizeof(*dst_addr));
 
         return bytes_read == sizeof(*dst_addr);
-- 
2.7.4

From: Philippe Mathieu-Daudé <philmd@redhat.com>

The length field is already contained in the ip6_ext_hdr structure.
Check it direcly in eth_parse_ipv6_hdr() before calling
_eth_get_rss_ex_dst_addr(), which gets a bit simplified.

Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/eth.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/net/eth.c b/net/eth.c
index XXXXXXX..XXXXXXX 100644
--- a/net/eth.c
+++ b/net/eth.c
@@ -XXX,XX +XXX,XX @@ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
 {
     struct ip6_ext_hdr_routing *rthdr = (struct ip6_ext_hdr_routing *) ext_hdr;
 
-    if ((rthdr->rtype == 2) &&
-        (rthdr->len == sizeof(struct in6_address) / 8) &&
-        (rthdr->segleft == 1)) {
+    if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) {
 
         size_t input_size = iov_size(pkt, pkt_frags);
         size_t bytes_read;
@@ -XXX,XX +XXX,XX @@ bool eth_parse_ipv6_hdr(const struct iovec *pkt, int pkt_frags,
         }
 
         if (curr_ext_hdr_type == IP6_ROUTING) {
-            info->rss_ex_dst_valid =
-                _eth_get_rss_ex_dst_addr(pkt, pkt_frags,
-                                         ip6hdr_off + info->full_hdr_len,
-                                         &ext_hdr, &info->rss_ex_dst);
+            if (ext_hdr.ip6r_len == sizeof(struct in6_address) / 8) {
+                info->rss_ex_dst_valid =
+                    _eth_get_rss_ex_dst_addr(pkt, pkt_frags,
+                                             ip6hdr_off + info->full_hdr_len,
+                                             &ext_hdr, &info->rss_ex_dst);
+            }
         } else if (curr_ext_hdr_type == IP6_DESTINATON) {
             info->rss_ex_src_valid =
                 _eth_get_rss_ex_src_addr(pkt, pkt_frags,
-- 
2.7.4

From: Philippe Mathieu-Daudé <philmd@redhat.com>

The 'offset' argument represents the offset to the ip6_ext_hdr
header, rename it as 'ext_hdr_offset'.

Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/eth.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/eth.c b/net/eth.c
index XXXXXXX..XXXXXXX 100644
--- a/net/eth.c
+++ b/net/eth.c
@@ -XXX,XX +XXX,XX @@ eth_is_ip6_extension_header_type(uint8_t hdr_type)
 
 static bool
 _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
-                        size_t rthdr_offset,
+                        size_t ext_hdr_offset,
                         struct ip6_ext_hdr *ext_hdr,
                         struct in6_address *dst_addr)
 {
@@ -XXX,XX +XXX,XX @@ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
         size_t input_size = iov_size(pkt, pkt_frags);
         size_t bytes_read;
 
-        if (input_size < rthdr_offset + sizeof(*ext_hdr)) {
+        if (input_size < ext_hdr_offset + sizeof(*ext_hdr)) {
             return false;
         }
 
         bytes_read = iov_to_buf(pkt, pkt_frags,
-                                rthdr_offset + sizeof(*rthdr),
+                                ext_hdr_offset + sizeof(*rthdr),
                                 dst_addr, sizeof(*dst_addr));
 
         return bytes_read == sizeof(*dst_addr);
-- 
2.7.4

From: Philippe Mathieu-Daudé <philmd@redhat.com>

Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/eth.c | 14 ++++++--------
 1 file changed, 6 insertions(+), 8 deletions(-)

diff --git a/net/eth.c b/net/eth.c
index XXXXXXX..XXXXXXX 100644
--- a/net/eth.c
+++ b/net/eth.c
@@ -XXX,XX +XXX,XX @@ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
                         struct in6_address *dst_addr)
 {
     struct ip6_ext_hdr_routing *rthdr = (struct ip6_ext_hdr_routing *) ext_hdr;
+    size_t input_size = iov_size(pkt, pkt_frags);
+    size_t bytes_read;
 
-    if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) {
-
-        size_t input_size = iov_size(pkt, pkt_frags);
-        size_t bytes_read;
-
-        if (input_size < ext_hdr_offset + sizeof(*ext_hdr)) {
-            return false;
-        }
+    if (input_size < ext_hdr_offset + sizeof(*ext_hdr)) {
+        return false;
+    }
 
+    if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) {
         bytes_read = iov_to_buf(pkt, pkt_frags,
                                 ext_hdr_offset + sizeof(*rthdr),
                                 dst_addr, sizeof(*dst_addr));
-- 
2.7.4

From: Philippe Mathieu-Daudé <philmd@redhat.com>

We can't know the caller read enough data in the memory pointed
by ext_hdr to cast it as a ip6_ext_hdr_routing.
Declare rt_hdr on the stack and fill it again from the iovec.

Since we already checked there is enough data in the iovec buffer,
simply add an assert() call to consume the bytes_read variable.

This fix a 2 bytes buffer overrun in eth_parse_ipv6_hdr() reported
by QEMU fuzzer:

$ cat << EOF | ./qemu-system-i386 -M pc-q35-5.0 \
    -accel qtest -monitor none \
    -serial none -nographic -qtest stdio
  outl 0xcf8 0x80001010
  outl 0xcfc 0xe1020000
  outl 0xcf8 0x80001004
  outw 0xcfc 0x7
  write 0x25 0x1 0x86
  write 0x26 0x1 0xdd
  write 0x4f 0x1 0x2b
  write 0xe1020030 0x4 0x190002e1
  write 0xe102003a 0x2 0x0807
  write 0xe1020048 0x4 0x12077cdd
  write 0xe1020400 0x4 0xba077cdd
  write 0xe1020420 0x4 0x190002e1
  write 0xe1020428 0x4 0x3509d807
  write 0xe1020438 0x1 0xe2
  EOF
  =================================================================
  ==2859770==ERROR: AddressSanitizer: stack-buffer-overflow on address 0x7ffdef904902 at pc 0x561ceefa78de bp 0x7ffdef904820 sp 0x7ffdef904818
  READ of size 1 at 0x7ffdef904902 thread T0
      #0 0x561ceefa78dd in _eth_get_rss_ex_dst_addr net/eth.c:410:17
      #1 0x561ceefa41fb in eth_parse_ipv6_hdr net/eth.c:532:17
      #2 0x561cef7de639 in net_tx_pkt_parse_headers hw/net/net_tx_pkt.c:228:14
      #3 0x561cef7dbef4 in net_tx_pkt_parse hw/net/net_tx_pkt.c:273:9
      #4 0x561ceec29f22 in e1000e_process_tx_desc hw/net/e1000e_core.c:730:29
      #5 0x561ceec28eac in e1000e_start_xmit hw/net/e1000e_core.c:927:9
      #6 0x561ceec1baab in e1000e_set_tdt hw/net/e1000e_core.c:2444:9
      #7 0x561ceebf300e in e1000e_core_write hw/net/e1000e_core.c:3256:9
      #8 0x561cef3cd4cd in e1000e_mmio_write hw/net/e1000e.c:110:5

Address 0x7ffdef904902 is located in stack of thread T0 at offset 34 in frame
      #0 0x561ceefa320f in eth_parse_ipv6_hdr net/eth.c:486

This frame has 1 object(s):
      [32, 34) 'ext_hdr' (line 487) <== Memory access at offset 34 overflows this variable
  HINT: this may be a false positive if your program uses some custom stack unwind mechanism, swapcontext or vfork
        (longjmp and C++ exceptions *are* supported)
  SUMMARY: AddressSanitizer: stack-buffer-overflow net/eth.c:410:17 in _eth_get_rss_ex_dst_addr
  Shadow bytes around the buggy address:
    0x10003df188d0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df188e0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df188f0: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18900: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18910: 00 00 00 00 00 00 00 00 00 00 00 00 f1 f1 f1 f1
  =>0x10003df18920:[02]f3 f3 f3 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18930: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18940: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18950: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18960: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
    0x10003df18970: 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00 00
  Shadow byte legend (one shadow byte represents 8 application bytes):
    Addressable:           00
    Partially addressable: 01 02 03 04 05 06 07
    Stack left redzone:      f1
    Stack right redzone:     f3
  ==2859770==ABORTING

Add the corresponding qtest case with the fuzzer reproducer.

FWIW GCC 11 similarly reported:

net/eth.c: In function 'eth_parse_ipv6_hdr':
  net/eth.c:410:15: error: array subscript 'struct ip6_ext_hdr_routing[0]' is partly outside array bounds of 'struct ip6_ext_hdr[1]' [-Werror=array-bounds]
    410 |     if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) {
        |          ~~~~~^~~~~~~
  net/eth.c:485:24: note: while referencing 'ext_hdr'
    485 |     struct ip6_ext_hdr ext_hdr;
        |                        ^~~~~~~
  net/eth.c:410:38: error: array subscript 'struct ip6_ext_hdr_routing[0]' is partly outside array bounds of 'struct ip6_ext_hdr[1]' [-Werror=array-bounds]
    410 |     if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) {
        |                                 ~~~~~^~~~~~~~~
  net/eth.c:485:24: note: while referencing 'ext_hdr'
    485 |     struct ip6_ext_hdr ext_hdr;
        |                        ^~~~~~~

Cc: qemu-stable@nongnu.org
Buglink: https://bugs.launchpad.net/qemu/+bug/1879531
Reported-by: Alexander Bulekov <alxndr@bu.edu>
Reported-by: Miroslav Rezanina <mrezanin@redhat.com>
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com>
Fixes: eb700029c78 ("net_pkt: Extend packet abstraction as required by e1000e functionality")
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 MAINTAINERS                    |  1 +
 net/eth.c                      | 13 +++++++----
 tests/qtest/fuzz-e1000e-test.c | 53 ++++++++++++++++++++++++++++++++++++++++++
 tests/qtest/meson.build        |  1 +
 4 files changed, 63 insertions(+), 5 deletions(-)
 create mode 100644 tests/qtest/fuzz-e1000e-test.c

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ e1000e
 M: Dmitry Fleytman <dmitry.fleytman@gmail.com>
 S: Maintained
 F: hw/net/e1000e*
+F: tests/qtest/fuzz-e1000e-test.c
 
 eepro100
 M: Stefan Weil <sw@weilnetz.de>
diff --git a/net/eth.c b/net/eth.c
index XXXXXXX..XXXXXXX 100644
--- a/net/eth.c
+++ b/net/eth.c
@@ -XXX,XX +XXX,XX @@ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
                         struct ip6_ext_hdr *ext_hdr,
                         struct in6_address *dst_addr)
 {
-    struct ip6_ext_hdr_routing *rthdr = (struct ip6_ext_hdr_routing *) ext_hdr;
+    struct ip6_ext_hdr_routing rt_hdr;
     size_t input_size = iov_size(pkt, pkt_frags);
     size_t bytes_read;
 
-    if (input_size < ext_hdr_offset + sizeof(*rthdr) + sizeof(*dst_addr)) {
+    if (input_size < ext_hdr_offset + sizeof(rt_hdr) + sizeof(*dst_addr)) {
         return false;
     }
 
-    if ((rthdr->rtype == 2) && (rthdr->segleft == 1)) {
-        bytes_read = iov_to_buf(pkt, pkt_frags,
-                                ext_hdr_offset + sizeof(*rthdr),
+    bytes_read = iov_to_buf(pkt, pkt_frags, ext_hdr_offset,
+                            &rt_hdr, sizeof(rt_hdr));
+    assert(bytes_read == sizeof(rt_hdr));
+
+    if ((rt_hdr.rtype == 2) && (rt_hdr.segleft == 1)) {
+        bytes_read = iov_to_buf(pkt, pkt_frags, ext_hdr_offset + sizeof(rt_hdr),
                                 dst_addr, sizeof(*dst_addr));
 
         return bytes_read == sizeof(*dst_addr);
diff --git a/tests/qtest/fuzz-e1000e-test.c b/tests/qtest/fuzz-e1000e-test.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tests/qtest/fuzz-e1000e-test.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QTest testcase for e1000e device generated by fuzzer
+ *
+ * Copyright (c) 2021 Red Hat, Inc.
+ *
+ * SPDX-License-Identifier: GPL-2.0-or-later
+ */
+
+#include "qemu/osdep.h"
+
+#include "libqos/libqtest.h"
+
+/*
+ * https://bugs.launchpad.net/qemu/+bug/1879531
+ */
+static void test_lp1879531_eth_get_rss_ex_dst_addr(void)
+{
+    QTestState *s;
+
+    s = qtest_init("-nographic -monitor none -serial none -M pc-q35-5.0");
+
+    qtest_outl(s, 0xcf8, 0x80001010);
+    qtest_outl(s, 0xcfc, 0xe1020000);
+    qtest_outl(s, 0xcf8, 0x80001004);
+    qtest_outw(s, 0xcfc, 0x7);
+    qtest_writeb(s, 0x25, 0x86);
+    qtest_writeb(s, 0x26, 0xdd);
+    qtest_writeb(s, 0x4f, 0x2b);
+
+    qtest_writel(s, 0xe1020030, 0x190002e1);
+    qtest_writew(s, 0xe102003a, 0x0807);
+    qtest_writel(s, 0xe1020048, 0x12077cdd);
+    qtest_writel(s, 0xe1020400, 0xba077cdd);
+    qtest_writel(s, 0xe1020420, 0x190002e1);
+    qtest_writel(s, 0xe1020428, 0x3509d807);
+    qtest_writeb(s, 0xe1020438, 0xe2);
+    qtest_writeb(s, 0x4f, 0x2b);
+    qtest_quit(s);
+}
+
+int main(int argc, char **argv)
+{
+    const char *arch = qtest_get_arch();
+
+    g_test_init(&argc, &argv, NULL);
+
+    if (strcmp(arch, "i386") == 0 || strcmp(arch, "x86_64") == 0) {
+        qtest_add_func("fuzz/test_lp1879531_eth_get_rss_ex_dst_addr",
+                       test_lp1879531_eth_get_rss_ex_dst_addr);
+    }
+
+    return g_test_run();
+}
diff --git a/tests/qtest/meson.build b/tests/qtest/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/meson.build
+++ b/tests/qtest/meson.build
@@ -XXX,XX +XXX,XX @@ qtests_i386 = \
   (config_all_devices.has_key('CONFIG_TPM_TIS_ISA') ? ['tpm-tis-test'] : []) +              \
   (config_all_devices.has_key('CONFIG_TPM_TIS_ISA') ? ['tpm-tis-swtpm-test'] : []) +        \
   (config_all_devices.has_key('CONFIG_RTL8139_PCI') ? ['rtl8139-test'] : []) +              \
+  (config_all_devices.has_key('CONFIG_E1000E_PCI_EXPRESS') ? ['fuzz-e1000e-test'] : []) +   \
   qtests_pci +                                                                              \
   ['fdc-test',
    'ide-test',
-- 
2.7.4

From: Philippe Mathieu-Daudé <philmd@redhat.com>

To simplify the function body, invert the if() statement, returning
earlier.
Since we already checked there is enough data in the iovec buffer,
simply add an assert() call to consume the bytes_read variable.

Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Miroslav Rezanina <mrezanin@redhat.com>
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/eth.c | 13 ++++++-------
 1 file changed, 6 insertions(+), 7 deletions(-)

diff --git a/net/eth.c b/net/eth.c
index XXXXXXX..XXXXXXX 100644
--- a/net/eth.c
+++ b/net/eth.c
@@ -XXX,XX +XXX,XX @@ _eth_get_rss_ex_dst_addr(const struct iovec *pkt, int pkt_frags,
     bytes_read = iov_to_buf(pkt, pkt_frags, ext_hdr_offset,
                             &rt_hdr, sizeof(rt_hdr));
     assert(bytes_read == sizeof(rt_hdr));
-
-    if ((rt_hdr.rtype == 2) && (rt_hdr.segleft == 1)) {
-        bytes_read = iov_to_buf(pkt, pkt_frags, ext_hdr_offset + sizeof(rt_hdr),
-                                dst_addr, sizeof(*dst_addr));
-
-        return bytes_read == sizeof(*dst_addr);
+    if ((rt_hdr.rtype != 2) || (rt_hdr.segleft != 1)) {
+        return false;
     }
+    bytes_read = iov_to_buf(pkt, pkt_frags, ext_hdr_offset + sizeof(rt_hdr),
+                            dst_addr, sizeof(*dst_addr));
+    assert(bytes_read == sizeof(*dst_addr));
 
-    return false;
+    return true;
 }
 
 static bool
-- 
2.7.4