Series comparison

-[Qemu-devel] [PULL 0/6] Net patches
+[PULL 00/10] Net patches
-The following changes since commit e607bbee553cfe73072870cef458cfa4e78133e2:
+The following changes since commit f670b3eec7f5d1ed8c4573ef244e7b8c6b32001b:
-  Merge remote-tracking branch 'remotes/edgar/tags/edgar/xilinx-next-2018-01-26.for-upstream' into staging (2018-01-26 14:24:25 +0000)
+  Merge tag 'migration-20230213-pull-request' of https://gitlab.com/juan.quintela/qemu into staging (2023-02-13 11:54:05 +0000)
 are available in the git repository at:
   https://github.com/jasowang/qemu.git tags/net-pull-request
-for you to fetch changes up to bf4835a4d5338bb7424827715df22570a8adc67c:
+for you to fetch changes up to e4b953a26da11d214f91516cb9b0542eab5afaa0:
-  MAINTAINERS: update Dmitry Fleytman email (2018-01-29 16:05:38 +0800)
+  vdpa: fix VHOST_BACKEND_F_IOTLB_ASID flag check (2023-02-14 14:00:30 +0800)
 ----------------------------------------------------------------
 ----------------------------------------------------------------
-Mao Zhongyi (2):
+Christian Svensson (1):
-      colo: modified the payload compare function
+      net: Increase L2TPv3 buffer to fit jumboframes
       colo: compare the packet based on the tcp sequence number
-Philippe Mathieu-Daudé (1):
+Eugenio Pérez (1):
-      MAINTAINERS: update Dmitry Fleytman email
+      vdpa: fix VHOST_BACKEND_F_IOTLB_ASID flag check
 Fiona Ebner (1):
       hw/net/vmxnet3: allow VMXNET3_MAX_MTU itself as a value
 Joelle van Dyne (1):
       vmnet: stop recieving events when VM is stopped
 Laurent Vivier (1):
       net: stream: add a new option to automatically reconnect
 Qiang Liu (2):
       hw/net/lan9118: log [read|write]b when mode_16bit is enabled rather than abort
       hw/net/can/xlnx-zynqmp-can: fix assertion failures in transfer_fifo()
 Thomas Huth (3):
-      net: Allow hubports to connect to other netdevs
+      net: Move the code to collect available NIC models to a separate function
-      net: Allow netdevs to be used with 'hostfwd_add' and 'hostfwd_remove'
+      net: Restore printing of the help text with "-nic help"
-      qemu-doc: Get rid of "vlan=X" example in the documentation
+      net: Replace "Supported NIC models" with "Available NIC models"
- MAINTAINERS        |   8 +-
+ hw/net/can/xlnx-zynqmp-can.c |   9 +++-
- hmp-commands.hx    |   4 +-
+ hw/net/lan9118.c             |  17 ++++----
- net/colo-compare.c | 411 +++++++++++++++++++++++++++++++++--------------------
+ hw/net/vmxnet3.c             |   2 +-
- net/colo.c         |   9 ++
+ hw/pci/pci.c                 |  29 +------------
- net/colo.h         |  15 ++
+ include/net/net.h            |  14 ++++++
- net/hub.c          |  27 +++-
+ net/l2tpv3.c                 |   2 +-
- net/hub.h          |   3 +-
+ net/net.c                    |  50 +++++++++++++++++++--
- net/net.c          |   2 +-
+ net/stream.c                 |  53 ++++++++++++++++++++++-
- net/slirp.c        |  33 +++--
+ net/vhost-vdpa.c             |   2 +-
- net/trace-events   |   2 +-
+ net/vmnet-common.m           |  48 ++++++++++++++------
- qapi/net.json      |   4 +-
+ net/vmnet_int.h              |   2 +
- qemu-options.hx    |  12 +-
+ qapi/net.json                |   7 ++-
-files changed, 347 insertions(+), 183 deletions(-)
+ qemu-options.hx              |   6 +--
  tests/qtest/netdev-socket.c  | 101 +++++++++++++++++++++++++++++++++++++++++++
 files changed, 280 insertions(+), 62 deletions(-)

-[Qemu-devel] [PULL 4/6] net: Allow netdevs to be used with 'hostfwd_add' and 'hostfwd_remove'
+[PULL 01/10] net: Move the code to collect available NIC models to a separate function
 From: Thomas Huth <thuth@redhat.com>
-It does not make much sense to limit these commands to the legacy 'vlan'
+The code that collects the available NIC models is not really specific
-concept only, they should work with the modern netdevs, too. So now
+to PCI anymore and will be required in the next patch, too, so let's
-it is possible to use this command with one, two or three parameters.
+move this into a new separate function in net.c instead.
 With one parameter, the command installs a hostfwd rule on the default
 "user" network:
     hostfwd_add tcp:...
 With two parameters, the command installs a hostfwd rule on a netdev
 (that's the new way of using this command):
     hostfwd_add netdev_id tcp:...
 With three parameters, the command installs a rule on a 'vlan' (aka hub):
     hostfwd_add hub_id name tcp:...
 Same applies to the hostfwd_remove command now.
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- hmp-commands.hx |  4 ++--
+ hw/pci/pci.c      | 29 +----------------------------
- net/slirp.c     | 33 +++++++++++++++++++++++----------
+ include/net/net.h | 14 ++++++++++++++
-files changed, 25 insertions(+), 12 deletions(-)
+ net/net.c         | 34 ++++++++++++++++++++++++++++++++++
 files changed, 49 insertions(+), 28 deletions(-)
-diff --git a/hmp-commands.hx b/hmp-commands.hx
+diff --git a/hw/pci/pci.c b/hw/pci/pci.c
 index XXXXXXX..XXXXXXX 100644
---- a/hmp-commands.hx
+--- a/hw/pci/pci.c
-+++ b/hmp-commands.hx
++++ b/hw/pci/pci.c
-@@ -XXX,XX +XXX,XX @@ ETEXI
+@@ -XXX,XX +XXX,XX @@ PCIDevice *pci_nic_init_nofail(NICInfo *nd, PCIBus *rootbus,
-     {
+                                const char *default_devaddr)
-         .name       = "hostfwd_add",
+ {
-         .args_type  = "arg1:s,arg2:s?,arg3:s?",
+     const char *devaddr = nd->devaddr ? nd->devaddr : default_devaddr;
--        .params     = "[vlan_id name] [tcp|udp]:[hostaddr]:hostport-[guestaddr]:guestport",
+-    GSList *list;
-+        .params     = "[hub_id name]|[netdev_id] [tcp|udp]:[hostaddr]:hostport-[guestaddr]:guestport",
+     GPtrArray *pci_nic_models;
-         .help       = "redirect TCP or UDP connections from host to guest (requires -net user)",
+     PCIBus *bus;
-         .cmd        = hmp_hostfwd_add,
+     PCIDevice *pci_dev;
-     },
+@@ -XXX,XX +XXX,XX @@ PCIDevice *pci_nic_init_nofail(NICInfo *nd, PCIBus *rootbus,
-@@ -XXX,XX +XXX,XX @@ ETEXI
+         nd->model = g_strdup("virtio-net-pci");
-     {
+     }
-         .name       = "hostfwd_remove",
-         .args_type  = "arg1:s,arg2:s?,arg3:s?",
+-    list = object_class_get_list_sorted(TYPE_PCI_DEVICE, false);
--        .params     = "[vlan_id name] [tcp|udp]:[hostaddr]:hostport",
+-    pci_nic_models = g_ptr_array_new();
-+        .params     = "[hub_id name]|[netdev_id] [tcp|udp]:[hostaddr]:hostport",
+-    while (list) {
-         .help       = "remove host-to-guest TCP or UDP redirection",
+-        DeviceClass *dc = OBJECT_CLASS_CHECK(DeviceClass, list->data,
-         .cmd        = hmp_hostfwd_remove,
+-                                             TYPE_DEVICE);
-     },
+-        GSList *next;
-diff --git a/net/slirp.c b/net/slirp.c
+-        if (test_bit(DEVICE_CATEGORY_NETWORK, dc->categories) &&
 -            dc->user_creatable) {
 -            const char *name = object_class_get_name(list->data);
 -            /*
 -             * A network device might also be something else than a NIC, see
 -             * e.g. the "rocker" device. Thus we have to look for the "netdev"
 -             * property, too. Unfortunately, some devices like virtio-net only
 -             * create this property during instance_init, so we have to create
 -             * a temporary instance here to be able to check it.
 -             */
 -            Object *obj = object_new_with_class(OBJECT_CLASS(dc));
 -            if (object_property_find(obj, "netdev")) {
 -                g_ptr_array_add(pci_nic_models, (gpointer)name);
 -            }
 -            object_unref(obj);
 -        }
 -        next = list->next;
 -        g_slist_free_1(list);
 -        list = next;
 -    }
 -    g_ptr_array_add(pci_nic_models, NULL);
 +    pci_nic_models = qemu_get_nic_models(TYPE_PCI_DEVICE);
      if (qemu_show_nic_models(nd->model, (const char **)pci_nic_models->pdata)) {
          exit(0);
 diff --git a/include/net/net.h b/include/net/net.h
 index XXXXXXX..XXXXXXX 100644
---- a/net/slirp.c
+--- a/include/net/net.h
-+++ b/net/slirp.c
++++ b/include/net/net.h
-@@ -XXX,XX +XXX,XX @@ error:
+@@ -XXX,XX +XXX,XX @@ void net_socket_rs_init(SocketReadState *rs,
                          bool vnet_hdr);
  NetClientState *qemu_get_peer(NetClientState *nc, int queue_index);
 +/**
 + * qemu_get_nic_models:
 + * @device_type: Defines which devices should be taken into consideration
 + *               (e.g. TYPE_DEVICE for all devices, or TYPE_PCI_DEVICE for PCI)
 + *
 + * Get an array of pointers to names of NIC devices that are available in
 + * the QEMU binary. The array is terminated with a NULL pointer entry.
 + * The caller is responsible for freeing the memory when it is not required
 + * anymore, e.g. with g_ptr_array_free(..., true).
 + *
 + * Returns: Pointer to the array that contains the pointers to the names.
 + */
 +GPtrArray *qemu_get_nic_models(const char *device_type);
 +
  /* NIC info */
  #define MAX_NICS 8
 diff --git a/net/net.c b/net/net.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/net.c
 +++ b/net/net.c
@@ -XXX,XX +XXX,XX @@ static int nic_get_free_idx(void)
      return -1;
  }
--static SlirpState *slirp_lookup(Monitor *mon, const char *vlan,
++GPtrArray *qemu_get_nic_models(const char *device_type)
--                                const char *stack)
++{
-+static SlirpState *slirp_lookup(Monitor *mon, const char *hub_id,
++    GPtrArray *nic_models = g_ptr_array_new();
-+                                const char *name)
++    GSList *list = object_class_get_list_sorted(device_type, false);
 +
 +    while (list) {
 +        DeviceClass *dc = OBJECT_CLASS_CHECK(DeviceClass, list->data,
 +                                             TYPE_DEVICE);
 +        GSList *next;
 +        if (test_bit(DEVICE_CATEGORY_NETWORK, dc->categories) &&
 +            dc->user_creatable) {
 +            const char *name = object_class_get_name(list->data);
 +            /*
 +             * A network device might also be something else than a NIC, see
 +             * e.g. the "rocker" device. Thus we have to look for the "netdev"
 +             * property, too. Unfortunately, some devices like virtio-net only
 +             * create this property during instance_init, so we have to create
 +             * a temporary instance here to be able to check it.
 +             */
 +            Object *obj = object_new_with_class(OBJECT_CLASS(dc));
 +            if (object_property_find(obj, "netdev")) {
 +                g_ptr_array_add(nic_models, (gpointer)name);
 +            }
 +            object_unref(obj);
 +        }
 +        next = list->next;
 +        g_slist_free_1(list);
 +        list = next;
 +    }
 +    g_ptr_array_add(nic_models, NULL);
 +
 +    return nic_models;
 +}
 +
  int qemu_show_nic_models(const char *arg, const char *const *models)
  {
--
+     int i;
 -    if (vlan) {
 +    if (name) {
          NetClientState *nc;
 -        nc = net_hub_find_client_by_name(strtol(vlan, NULL, 0), stack);
 -        if (!nc) {
 -            monitor_printf(mon, "unrecognized (vlan-id, stackname) pair\n");
 -            return NULL;
 +        if (hub_id) {
 +            nc = net_hub_find_client_by_name(strtol(hub_id, NULL, 0), name);
 +            if (!nc) {
 +                monitor_printf(mon, "unrecognized (vlan-id, stackname) pair\n");
 +                return NULL;
 +            }
 +        } else {
 +            nc = qemu_find_netdev(name);
 +            if (!nc) {
 +                monitor_printf(mon, "unrecognized netdev id '%s'\n", name);
 +                return NULL;
 +            }
          }
          if (strcmp(nc->model, "user")) {
              monitor_printf(mon, "invalid device specified\n");
@@ -XXX,XX +XXX,XX @@ void hmp_hostfwd_remove(Monitor *mon, const QDict *qdict)
      const char *arg2 = qdict_get_try_str(qdict, "arg2");
      const char *arg3 = qdict_get_try_str(qdict, "arg3");
 -    if (arg2) {
 +    if (arg3) {
          s = slirp_lookup(mon, arg1, arg2);
          src_str = arg3;
 +    } else if (arg2) {
 +        s = slirp_lookup(mon, NULL, arg1);
 +        src_str = arg2;
      } else {
          s = slirp_lookup(mon, NULL, NULL);
          src_str = arg1;
@@ -XXX,XX +XXX,XX @@ void hmp_hostfwd_add(Monitor *mon, const QDict *qdict)
      const char *arg2 = qdict_get_try_str(qdict, "arg2");
      const char *arg3 = qdict_get_try_str(qdict, "arg3");
 -    if (arg2) {
 +    if (arg3) {
          s = slirp_lookup(mon, arg1, arg2);
          redir_str = arg3;
 +    } else if (arg2) {
 +        s = slirp_lookup(mon, NULL, arg1);
 +        redir_str = arg2;
      } else {
          s = slirp_lookup(mon, NULL, NULL);
          redir_str = arg1;
 --
 .7.4

-[Qemu-devel] [PULL 2/6] colo: compare the packet based on the tcp sequence number
+[PULL 02/10] net: Restore printing of the help text with "-nic help"
-From: Mao Zhongyi <maozy.fnst@cn.fujitsu.com>
+From: Thomas Huth <thuth@redhat.com>
-Packet size some time different or when network is busy.
+Running QEMU with "-nic help" used to work in QEMU 5.2 and earlier versions
-Based on same payload size, but TCP protocol can not
+(it showed the available netdev backends), but this feature got broken during
-guarantee send the same one packet in the same way,
+some refactoring in version 6.0. Let's restore the old behavior, and while
 we're at it, let's also print the available NIC models here now since this
 option can be used to configure both, netdev backend and model in one go.
-like that:
+Fixes: ad6f932fe8 ("net: do not exit on "netdev_add help" monitor command")
-We send this payload:
+Signed-off-by: Thomas Huth <thuth@redhat.com>
 ------------------------------
 | header |1|2|3|4|5|6|7|8|9|0|
 ------------------------------
 primary:
 ppkt1:
 ----------------
 | header |1|2|3|
 ----------------
 ppkt2:
 ------------------------
 | header |4|5|6|7|8|9|0|
 ------------------------
 secondary:
 spkt1:
 ------------------------------
 | header |1|2|3|4|5|6|7|8|9|0|
 ------------------------------
 In the original method, ppkt1 and ppkt2 are different in size and
 spkt1, so they can't compare and trigger the checkpoint.
 I have tested FTP get 200M and 1G file many times, I found that
 the performance was less than 1% of the native.
 Now I reconstructed the comparison of TCP packets based on the
 TCP sequence number. first of all, ppkt1 and spkt1 have the same
 starting sequence number, so they can compare, even though their
 length is different. And then ppkt1 with a smaller payload length
 is used as the comparison length, if the payload is same, send
 out the ppkt1 and record the offset(the length of ppkt1 payload)
 in spkt1. The next comparison, ppkt2 and spkt1 can be compared
 from the recorded position of spkt1.
 like that:
 ----------------
 | header |1|2|3| ppkt1
 ---------|-----|
          |     |
 ---------v-----v--------------
 | header |1|2|3|4|5|6|7|8|9|0| spkt1
 ---------------|\------------|
                | \offset     |
       ---------v-------------v
       | header |4|5|6|7|8|9|0| ppkt2
       ------------------------
 In this way, the performance can reach native 20% in my multiple
 tests.
 Cc: Zhang Chen <zhangckid@gmail.com>
 Cc: Li Zhijian <lizhijian@cn.fujitsu.com>
 Cc: Jason Wang <jasowang@redhat.com>
 Signed-off-by: Mao Zhongyi <maozy.fnst@cn.fujitsu.com>
 Signed-off-by: Li Zhijian <lizhijian@cn.fujitsu.com>
 Signed-off-by: Zhang Chen <zhangckid@gmail.com>
 Reviewed-by: Zhang Chen <zhangckid@gmail.com>
 Tested-by: Zhang Chen <zhangckid@gmail.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- net/colo-compare.c | 343 +++++++++++++++++++++++++++++++++++------------------
+ net/net.c | 14 ++++++++++++--
- net/colo.c         |   9 ++
+file changed, 12 insertions(+), 2 deletions(-)
  net/colo.h         |  15 +++
  net/trace-events   |   2 +-
 files changed, 250 insertions(+), 119 deletions(-)
-diff --git a/net/colo-compare.c b/net/colo-compare.c
+diff --git a/net/net.c b/net/net.c
 index XXXXXXX..XXXXXXX 100644
---- a/net/colo-compare.c
+--- a/net/net.c
-+++ b/net/colo-compare.c
++++ b/net/net.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static int net_param_nic(void *dummy, QemuOpts *opts, Error **errp)
- #define COMPARE_READ_LEN_MAX NET_BUFSIZE
+     const char *type;
- #define MAX_QUEUE_SIZE 1024
+     type = qemu_opt_get(opts, "type");
-+#define COLO_COMPARE_FREE_PRIMARY     0x01
+-    if (type && g_str_equal(type, "none")) {
-+#define COLO_COMPARE_FREE_SECONDARY   0x02
+-        return 0;    /* Nothing to do, default_net is cleared in vl.c */
-+
++    if (type) {
- /* TODO: Should be configurable */
++        if (g_str_equal(type, "none")) {
- #define REGULAR_PACKET_CHECK_MS 3000
++            return 0;    /* Nothing to do, default_net is cleared in vl.c */
@@ -XXX,XX +XXX,XX @@ static gint seq_sorter(Packet *a, Packet *b, gpointer data)
      return ntohl(atcp->th_seq) - ntohl(btcp->th_seq);
  }
 +static void fill_pkt_tcp_info(void *data, uint32_t *max_ack)
 +{
 +    Packet *pkt = data;
 +    struct tcphdr *tcphd;
 +
 +    tcphd = (struct tcphdr *)pkt->transport_header;
 +
 +    pkt->tcp_seq = ntohl(tcphd->th_seq);
 +    pkt->tcp_ack = ntohl(tcphd->th_ack);
 +    *max_ack = *max_ack > pkt->tcp_ack ? *max_ack : pkt->tcp_ack;
 +    pkt->header_size = pkt->transport_header - (uint8_t *)pkt->data
 +                       + (tcphd->th_off << 2) - pkt->vnet_hdr_len;
 +    pkt->payload_size = pkt->size - pkt->header_size;
 +    pkt->seq_end = pkt->tcp_seq + pkt->payload_size;
 +    pkt->flags = tcphd->th_flags;
 +}
 +
  /*
   * Return 1 on success, if return 0 means the
   * packet will be dropped
   */
 -static int colo_insert_packet(GQueue *queue, Packet *pkt)
 +static int colo_insert_packet(GQueue *queue, Packet *pkt, uint32_t *max_ack)
  {
      if (g_queue_get_length(queue) <= MAX_QUEUE_SIZE) {
          if (pkt->ip->ip_p == IPPROTO_TCP) {
 +            fill_pkt_tcp_info(pkt, max_ack);
              g_queue_insert_sorted(queue,
                                    pkt,
                                    (GCompareDataFunc)seq_sorter,
@@ -XXX,XX +XXX,XX @@ static int packet_enqueue(CompareState *s, int mode, Connection **con)
      }
      if (mode == PRIMARY_IN) {
 -        if (!colo_insert_packet(&conn->primary_list, pkt)) {
 +        if (!colo_insert_packet(&conn->primary_list, pkt, &conn->pack)) {
              error_report("colo compare primary queue size too big,"
                           "drop packet");
          }
      } else {
 -        if (!colo_insert_packet(&conn->secondary_list, pkt)) {
 +        if (!colo_insert_packet(&conn->secondary_list, pkt, &conn->sack)) {
              error_report("colo compare secondary queue size too big,"
                           "drop packet");
          }
@@ -XXX,XX +XXX,XX @@ static int packet_enqueue(CompareState *s, int mode, Connection **con)
      return 0;
  }
 +static inline bool after(uint32_t seq1, uint32_t seq2)
 +{
 +        return (int32_t)(seq1 - seq2) > 0;
 +}
 +
 +static void colo_release_primary_pkt(CompareState *s, Packet *pkt)
 +{
 +    int ret;
 +    ret = compare_chr_send(s,
 +                           pkt->data,
 +                           pkt->size,
 +                           pkt->vnet_hdr_len);
 +    if (ret < 0) {
 +        error_report("colo send primary packet failed");
 +    }
 +    trace_colo_compare_main("packet same and release packet");
 +    packet_destroy(pkt, NULL);
 +}
 +
  /*
   * The IP packets sent by primary and secondary
   * will be compared in here
@@ -XXX,XX +XXX,XX @@ static int colo_compare_packet_payload(Packet *ppkt,
  }
  /*
 - * Called from the compare thread on the primary
 - * for compare tcp packet
 - * compare_tcp copied from Dr. David Alan Gilbert's branch
 - */
 -static int colo_packet_compare_tcp(Packet *spkt, Packet *ppkt)
 + * return true means that the payload is consist and
 + * need to make the next comparison, false means do
 + * the checkpoint
 +*/
 +static bool colo_mark_tcp_pkt(Packet *ppkt, Packet *spkt,
 +                              int8_t *mark, uint32_t max_ack)
  {
 -    struct tcphdr *ptcp, *stcp;
 -    int res;
 +    *mark = 0;
 +
 +    if (ppkt->tcp_seq == spkt->tcp_seq && ppkt->seq_end == spkt->seq_end) {
 +        if (colo_compare_packet_payload(ppkt, spkt,
 +                                        ppkt->header_size, spkt->header_size,
 +                                        ppkt->payload_size)) {
 +            *mark = COLO_COMPARE_FREE_SECONDARY | COLO_COMPARE_FREE_PRIMARY;
 +            return true;
 +        }
-+    }
++        if (is_help_option(type)) {
-+    if (ppkt->tcp_seq == spkt->tcp_seq && ppkt->seq_end == spkt->seq_end) {
++            GPtrArray *nic_models = qemu_get_nic_models(TYPE_DEVICE);
-+        if (colo_compare_packet_payload(ppkt, spkt,
++            show_netdevs();
-+                                        ppkt->header_size, spkt->header_size,
++            printf("\n");
-+                                        ppkt->payload_size)) {
++            qemu_show_nic_models(type, (const char **)nic_models->pdata);
-+            *mark = COLO_COMPARE_FREE_SECONDARY | COLO_COMPARE_FREE_PRIMARY;
++            g_ptr_array_free(nic_models, true);
-+            return true;
++            exit(0);
 +        }
 +    }
 +
 +    /* one part of secondary packet payload still need to be compared */
 +    if (!after(ppkt->seq_end, spkt->seq_end)) {
 +        if (colo_compare_packet_payload(ppkt, spkt,
 +                                        ppkt->header_size + ppkt->offset,
 +                                        spkt->header_size + spkt->offset,
 +                                        ppkt->payload_size - ppkt->offset)) {
 +            if (!after(ppkt->tcp_ack, max_ack)) {
 +                *mark = COLO_COMPARE_FREE_PRIMARY;
 +                spkt->offset += ppkt->payload_size - ppkt->offset;
 +                return true;
 +            } else {
 +                /* secondary guest hasn't ack the data, don't send
 +                 * out this packet
 +                 */
 +                return false;
 +            }
 +        }
 +    } else {
 +        /* primary packet is longer than secondary packet, compare
 +         * the same part and mark the primary packet offset
 +         */
 +        if (colo_compare_packet_payload(ppkt, spkt,
 +                                        ppkt->header_size + ppkt->offset,
 +                                        spkt->header_size + spkt->offset,
 +                                        spkt->payload_size - spkt->offset)) {
 +            *mark = COLO_COMPARE_FREE_SECONDARY;
 +            ppkt->offset += spkt->payload_size - spkt->offset;
 +            return true;
 +        }
 +    }
 -    trace_colo_compare_main("compare tcp");
 +    return false;
 +}
 -    ptcp = (struct tcphdr *)ppkt->transport_header;
 -    stcp = (struct tcphdr *)spkt->transport_header;
 +static void colo_compare_tcp(CompareState *s, Connection *conn)
 +{
 +    Packet *ppkt = NULL, *spkt = NULL;
 +    int8_t mark;
      /*
 -     * The 'identification' field in the IP header is *very* random
 -     * it almost never matches.  Fudge this by ignoring differences in
 -     * unfragmented packets; they'll normally sort themselves out if different
 -     * anyway, and it should recover at the TCP level.
 -     * An alternative would be to get both the primary and secondary to rewrite
 -     * somehow; but that would need some sync traffic to sync the state
 -     */
 -    if (ntohs(ppkt->ip->ip_off) & IP_DF) {
 -        spkt->ip->ip_id = ppkt->ip->ip_id;
 -        /* and the sum will be different if the IDs were different */
 -        spkt->ip->ip_sum = ppkt->ip->ip_sum;
 +     * If ppkt and spkt have the same payload, but ppkt's ACK
 +     * is greater than spkt's ACK, in this case we can not
 +     * send the ppkt because it will cause the secondary guest
 +     * to miss sending some data in the next. Therefore, we
 +     * record the maximum ACK in the current queue at both
 +     * primary side and secondary side. Only when the ack is
 +     * less than the smaller of the two maximum ack, then we
 +     * can ensure that the packet's payload is acknowledged by
 +     * primary and secondary.
 +    */
 +    uint32_t min_ack = conn->pack > conn->sack ? conn->sack : conn->pack;
 +
 +pri:
 +    if (g_queue_is_empty(&conn->primary_list)) {
 +        return;
      }
 +    ppkt = g_queue_pop_head(&conn->primary_list);
 +sec:
 +    if (g_queue_is_empty(&conn->secondary_list)) {
 +        g_queue_push_head(&conn->primary_list, ppkt);
 +        return;
 +    }
 +    spkt = g_queue_pop_head(&conn->secondary_list);
 -    /*
 -     * Check tcp header length for tcp option field.
 -     * th_off > 5 means this tcp packet have options field.
 -     * The tcp options maybe always different.
 -     * for example:
 -     * From RFC 7323.
 -     * TCP Timestamps option (TSopt):
 -     * Kind: 8
 -     *
 -     * Length: 10 bytes
 -     *
 -     *    +-------+-------+---------------------+---------------------+
 -     *    |Kind=8 |  10   |   TS Value (TSval)  |TS Echo Reply (TSecr)|
 -     *    +-------+-------+---------------------+---------------------+
 -     *       1       1              4                     4
 -     *
 -     * In this case the primary guest's timestamp always different with
 -     * the secondary guest's timestamp. COLO just focus on payload,
 -     * so we just need skip this field.
 -     */
 +    if (ppkt->tcp_seq == ppkt->seq_end) {
 +        colo_release_primary_pkt(s, ppkt);
 +        ppkt = NULL;
 +    }
 -    ptrdiff_t ptcp_offset, stcp_offset;
 +    if (ppkt && conn->compare_seq && !after(ppkt->seq_end, conn->compare_seq)) {
 +        trace_colo_compare_main("pri: this packet has compared");
 +        colo_release_primary_pkt(s, ppkt);
 +        ppkt = NULL;
 +    }
 -    ptcp_offset = ppkt->transport_header - (uint8_t *)ppkt->data
 -                  + (ptcp->th_off << 2) - ppkt->vnet_hdr_len;
 -    stcp_offset = spkt->transport_header - (uint8_t *)spkt->data
 -                  + (stcp->th_off << 2) - spkt->vnet_hdr_len;
 -    if (ppkt->size - ptcp_offset == spkt->size - stcp_offset) {
 -        res = colo_compare_packet_payload(ppkt, spkt,
 -                                          ptcp_offset, stcp_offset,
 -                                          ppkt->size - ptcp_offset);
 +    if (spkt->tcp_seq == spkt->seq_end) {
 +        packet_destroy(spkt, NULL);
 +        if (!ppkt) {
 +            goto pri;
 +        } else {
 +            goto sec;
 +        }
      } else {
 -        trace_colo_compare_main("TCP: payload size of packets are different");
 -        res = -1;
 +        if (conn->compare_seq && !after(spkt->seq_end, conn->compare_seq)) {
 +            trace_colo_compare_main("sec: this packet has compared");
 +            packet_destroy(spkt, NULL);
 +            if (!ppkt) {
 +                goto pri;
 +            } else {
 +                goto sec;
 +            }
 +        }
 +        if (!ppkt) {
 +            g_queue_push_head(&conn->secondary_list, spkt);
 +            goto pri;
 +        }
      }
--    if (res != 0 &&
+     idx = nic_get_free_idx();
 -        trace_event_get_state_backends(TRACE_COLO_COMPARE_MISCOMPARE)) {
 -        char pri_ip_src[20], pri_ip_dst[20], sec_ip_src[20], sec_ip_dst[20];
 -
 -        strcpy(pri_ip_src, inet_ntoa(ppkt->ip->ip_src));
 -        strcpy(pri_ip_dst, inet_ntoa(ppkt->ip->ip_dst));
 -        strcpy(sec_ip_src, inet_ntoa(spkt->ip->ip_src));
 -        strcpy(sec_ip_dst, inet_ntoa(spkt->ip->ip_dst));
 -
 -        trace_colo_compare_ip_info(ppkt->size, pri_ip_src,
 -                                   pri_ip_dst, spkt->size,
 -                                   sec_ip_src, sec_ip_dst);
 -
 -        trace_colo_compare_tcp_info("pri tcp packet",
 -                                    ntohl(ptcp->th_seq),
 -                                    ntohl(ptcp->th_ack),
 -                                    res, ptcp->th_flags,
 -                                    ppkt->size);
 -
 -        trace_colo_compare_tcp_info("sec tcp packet",
 -                                    ntohl(stcp->th_seq),
 -                                    ntohl(stcp->th_ack),
 -                                    res, stcp->th_flags,
 -                                    spkt->size);
 +    if (colo_mark_tcp_pkt(ppkt, spkt, &mark, min_ack)) {
 +        trace_colo_compare_tcp_info("pri",
 +                                    ppkt->tcp_seq, ppkt->tcp_ack,
 +                                    ppkt->header_size, ppkt->payload_size,
 +                                    ppkt->offset, ppkt->flags);
 +
 +        trace_colo_compare_tcp_info("sec",
 +                                    spkt->tcp_seq, spkt->tcp_ack,
 +                                    spkt->header_size, spkt->payload_size,
 +                                    spkt->offset, spkt->flags);
 +
 +        if (mark == COLO_COMPARE_FREE_PRIMARY) {
 +            conn->compare_seq = ppkt->seq_end;
 +            colo_release_primary_pkt(s, ppkt);
 +            g_queue_push_head(&conn->secondary_list, spkt);
 +            goto pri;
 +        }
 +        if (mark == COLO_COMPARE_FREE_SECONDARY) {
 +            conn->compare_seq = spkt->seq_end;
 +            packet_destroy(spkt, NULL);
 +            goto sec;
 +        }
 +        if (mark == (COLO_COMPARE_FREE_PRIMARY | COLO_COMPARE_FREE_SECONDARY)) {
 +            conn->compare_seq = ppkt->seq_end;
 +            colo_release_primary_pkt(s, ppkt);
 +            packet_destroy(spkt, NULL);
 +            goto pri;
 +        }
 +    } else {
 +        g_queue_push_head(&conn->primary_list, ppkt);
 +        g_queue_push_head(&conn->secondary_list, spkt);
          qemu_hexdump((char *)ppkt->data, stderr,
                       "colo-compare ppkt", ppkt->size);
          qemu_hexdump((char *)spkt->data, stderr,
                       "colo-compare spkt", spkt->size);
 -    }
 -    return res;
 +        /*
 +         * colo_compare_inconsistent_notify();
 +         * TODO: notice to checkpoint();
 +         */
 +    }
  }
 +
  /*
   * Called from the compare thread on the primary
   * for compare udp packet
@@ -XXX,XX +XXX,XX @@ static void colo_old_packet_check(void *opaque)
                          (GCompareFunc)colo_old_packet_check_one_conn);
  }
 -/*
 - * Called from the compare thread on the primary
 - * for compare packet with secondary list of the
 - * specified connection when a new packet was
 - * queued to it.
 - */
 -static void colo_compare_connection(void *opaque, void *user_data)
 +static void colo_compare_packet(CompareState *s, Connection *conn,
 +                                int (*HandlePacket)(Packet *spkt,
 +                                Packet *ppkt))
  {
 -    CompareState *s = user_data;
 -    Connection *conn = opaque;
      Packet *pkt = NULL;
      GList *result = NULL;
 -    int ret;
      while (!g_queue_is_empty(&conn->primary_list) &&
             !g_queue_is_empty(&conn->secondary_list)) {
          pkt = g_queue_pop_head(&conn->primary_list);
 -        switch (conn->ip_proto) {
 -        case IPPROTO_TCP:
 -            result = g_queue_find_custom(&conn->secondary_list,
 -                     pkt, (GCompareFunc)colo_packet_compare_tcp);
 -            break;
 -        case IPPROTO_UDP:
 -            result = g_queue_find_custom(&conn->secondary_list,
 -                     pkt, (GCompareFunc)colo_packet_compare_udp);
 -            break;
 -        case IPPROTO_ICMP:
 -            result = g_queue_find_custom(&conn->secondary_list,
 -                     pkt, (GCompareFunc)colo_packet_compare_icmp);
 -            break;
 -        default:
 -            result = g_queue_find_custom(&conn->secondary_list,
 -                     pkt, (GCompareFunc)colo_packet_compare_other);
 -            break;
 -        }
 +        result = g_queue_find_custom(&conn->secondary_list,
 +                 pkt, (GCompareFunc)HandlePacket);
          if (result) {
 -            ret = compare_chr_send(s,
 -                                   pkt->data,
 -                                   pkt->size,
 -                                   pkt->vnet_hdr_len);
 -            if (ret < 0) {
 -                error_report("colo_send_primary_packet failed");
 -            }
 -            trace_colo_compare_main("packet same and release packet");
 +            colo_release_primary_pkt(s, pkt);
              g_queue_remove(&conn->secondary_list, result->data);
 -            packet_destroy(pkt, NULL);
          } else {
              /*
               * If one packet arrive late, the secondary_list or
@@ -XXX,XX +XXX,XX @@ static void colo_compare_connection(void *opaque, void *user_data)
      }
  }
 +/*
 + * Called from the compare thread on the primary
 + * for compare packet with secondary list of the
 + * specified connection when a new packet was
 + * queued to it.
 + */
 +static void colo_compare_connection(void *opaque, void *user_data)
 +{
 +    CompareState *s = user_data;
 +    Connection *conn = opaque;
 +
 +    switch (conn->ip_proto) {
 +    case IPPROTO_TCP:
 +        colo_compare_tcp(s, conn);
 +        break;
 +    case IPPROTO_UDP:
 +        colo_compare_packet(s, conn, colo_packet_compare_udp);
 +        break;
 +    case IPPROTO_ICMP:
 +        colo_compare_packet(s, conn, colo_packet_compare_icmp);
 +        break;
 +    default:
 +        colo_compare_packet(s, conn, colo_packet_compare_other);
 +        break;
 +    }
 +}
 +
  static int compare_chr_send(CompareState *s,
                              const uint8_t *buf,
                              uint32_t size,
 diff --git a/net/colo.c b/net/colo.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/colo.c
 +++ b/net/colo.c
@@ -XXX,XX +XXX,XX @@ Connection *connection_new(ConnectionKey *key)
      conn->processing = false;
      conn->offset = 0;
      conn->syn_flag = 0;
 +    conn->pack = 0;
 +    conn->sack = 0;
      g_queue_init(&conn->primary_list);
      g_queue_init(&conn->secondary_list);
@@ -XXX,XX +XXX,XX @@ Packet *packet_new(const void *data, int size, int vnet_hdr_len)
      pkt->size = size;
      pkt->creation_ms = qemu_clock_get_ms(QEMU_CLOCK_HOST);
      pkt->vnet_hdr_len = vnet_hdr_len;
 +    pkt->tcp_seq = 0;
 +    pkt->tcp_ack = 0;
 +    pkt->seq_end = 0;
 +    pkt->header_size = 0;
 +    pkt->payload_size = 0;
 +    pkt->offset = 0;
 +    pkt->flags = 0;
      return pkt;
  }
 diff --git a/net/colo.h b/net/colo.h
 index XXXXXXX..XXXXXXX 100644
 --- a/net/colo.h
 +++ b/net/colo.h
@@ -XXX,XX +XXX,XX @@ typedef struct Packet {
      int64_t creation_ms;
      /* Get vnet_hdr_len from filter */
      uint32_t vnet_hdr_len;
 +    uint32_t tcp_seq; /* sequence number */
 +    uint32_t tcp_ack; /* acknowledgement number */
 +    /* the sequence number of the last byte of the packet */
 +    uint32_t seq_end;
 +    uint8_t header_size;  /* the header length */
 +    uint16_t payload_size; /* the payload length */
 +    /* record the payload offset(the length that has been compared) */
 +    uint16_t offset;
 +    uint8_t flags; /* Flags(aka Control bits) */
  } Packet;
  typedef struct ConnectionKey {
@@ -XXX,XX +XXX,XX @@ typedef struct Connection {
      /* flag to enqueue unprocessed_connections */
      bool processing;
      uint8_t ip_proto;
 +    /* record the sequence number that has been compared */
 +    uint32_t compare_seq;
 +    /* the maximum of acknowledgement number in primary_list queue */
 +    uint32_t pack;
 +    /* the maximum of acknowledgement number in secondary_list queue */
 +    uint32_t sack;
      /* offset = secondary_seq - primary_seq */
      tcp_seq  offset;
      /*
 diff --git a/net/trace-events b/net/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/net/trace-events
 +++ b/net/trace-events
@@ -XXX,XX +XXX,XX @@ colo_compare_icmp_miscompare(const char *sta, int size) ": %s = %d"
  colo_compare_ip_info(int psize, const char *sta, const char *stb, int ssize, const char *stc, const char *std) "ppkt size = %d, ip_src = %s, ip_dst = %s, spkt size = %d, ip_src = %s, ip_dst = %s"
  colo_old_packet_check_found(int64_t old_time) "%" PRId64
  colo_compare_miscompare(void) ""
 -colo_compare_tcp_info(const char *pkt, uint32_t seq, uint32_t ack, int res, uint32_t flag, int size) "side: %s seq/ack= %u/%u res= %d flags= 0x%x pkt_size: %d\n"
 +colo_compare_tcp_info(const char *pkt, uint32_t seq, uint32_t ack, int hdlen, int pdlen, int offset, int flags) "%s: seq/ack= %u/%u hdlen= %d pdlen= %d offset= %d flags=%d\n"
  # net/filter-rewriter.c
  colo_filter_rewriter_debug(void) ""
 --
 .7.4

-[Qemu-devel] [PULL 5/6] qemu-doc: Get rid of "vlan=X" example in the documentation
+[PULL 03/10] net: Replace "Supported NIC models" with "Available NIC models"
 From: Thomas Huth <thuth@redhat.com>
-The vlan concept is marked as deprecated, so we should not use
+Just because a NIC model is compiled into the QEMU binary does not
-this for examples in the documentation anymore.
+necessary mean that it can be used with each and every machine.
 So let's rather talk about "available" models instead of "supported"
 models, just to avoid confusion.
+Reviewed-by: Claudio Fontana <cfontana@suse.de>
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- qemu-options.hx | 4 ++--
+ net/net.c | 2 +-
-file changed, 2 insertions(+), 2 deletions(-)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/qemu-options.hx b/qemu-options.hx
+diff --git a/net/net.c b/net/net.c
 index XXXXXXX..XXXXXXX 100644
---- a/qemu-options.hx
+--- a/net/net.c
-+++ b/qemu-options.hx
++++ b/net/net.c
-@@ -XXX,XX +XXX,XX @@ qemu-system-i386 linux.img -net nic -net tap
+@@ -XXX,XX +XXX,XX @@ int qemu_show_nic_models(const char *arg, const char *const *models)
- #launch a QEMU instance with two NICs, each one connected
+         return 0;
- #to a TAP device
+     }
- qemu-system-i386 linux.img \
--                 -net nic,vlan=0 -net tap,vlan=0,ifname=tap0 \
+-    printf("Supported NIC models:\n");
--                 -net nic,vlan=1 -net tap,vlan=1,ifname=tap1
++    printf("Available NIC models:\n");
-+        -netdev tap,id=nd0,ifname=tap0 -device e1000,netdev=nd0 \
+     for (i = 0 ; models[i]; i++) {
-+        -netdev tap,id=nd1,ifname=tap1 -device rtl8139,netdev=nd1
+         printf("%s\n", models[i]);
- @end example
+     }
  @example
 --
 .7.4

-[Qemu-devel] [PULL 1/6] colo: modified the payload compare function
+[PULL 04/10] hw/net/lan9118: log [read|write]b when mode_16bit is enabled rather than abort
-From: Mao Zhongyi <maozy.fnst@cn.fujitsu.com>
+From: Qiang Liu <cyruscyliu@gmail.com>
-Modified the function colo_packet_compare_common to prepare for the
+This patch replaces hw_error to guest error log for [read|write]b
-tcp packet comparison in the next patch.
+accesses when mode_16bit is enabled. This avoids aborting qemu.
-Cc: Zhang Chen <zhangckid@gmail.com>
+Fixes: 1248f8d4cbc3 ("hw/lan9118: Add basic 16-bit mode support.")
-Cc: Li Zhijian <lizhijian@cn.fujitsu.com>
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1433
-Cc: Jason Wang <jasowang@redhat.com>
+Reported-by: Qiang Liu <cyruscyliu@gmail.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-Signed-off-by: Mao Zhongyi <maozy.fnst@cn.fujitsu.com>
+Signed-off-by: Qiang Liu <cyruscyliu@gmail.com>
-Signed-off-by: Li Zhijian <lizhijian@cn.fujitsu.com>
+Suggested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Zhang Chen <zhangckid@gmail.com>
 Reviewed-by: Zhang Chen <zhangckid@gmail.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- net/colo-compare.c | 88 +++++++++++++++++++++++++++---------------------------
+ hw/net/lan9118.c | 17 ++++++++---------
-file changed, 44 insertions(+), 44 deletions(-)
+file changed, 8 insertions(+), 9 deletions(-)
-diff --git a/net/colo-compare.c b/net/colo-compare.c
+diff --git a/hw/net/lan9118.c b/hw/net/lan9118.c
 index XXXXXXX..XXXXXXX 100644
---- a/net/colo-compare.c
+--- a/hw/net/lan9118.c
-+++ b/net/colo-compare.c
++++ b/hw/net/lan9118.c
-@@ -XXX,XX +XXX,XX @@ static int packet_enqueue(CompareState *s, int mode, Connection **con)
+@@ -XXX,XX +XXX,XX @@
-  * return:    0  means packet same
+ #include "migration/vmstate.h"
-  *            > 0 || < 0 means packet different
+ #include "net/net.h"
-  */
+ #include "net/eth.h"
--static int colo_packet_compare_common(Packet *ppkt,
+-#include "hw/hw.h"
--                                      Packet *spkt,
+ #include "hw/irq.h"
--                                      int poffset,
+ #include "hw/net/lan9118.h"
--                                      int soffset)
+ #include "hw/ptimer.h"
-+static int colo_compare_packet_payload(Packet *ppkt,
+@@ -XXX,XX +XXX,XX @@
-+                                       Packet *spkt,
+ #ifdef DEBUG_LAN9118
-+                                       uint16_t poffset,
+ #define DPRINTF(fmt, ...) \
-+                                       uint16_t soffset,
+ do { printf("lan9118: " fmt , ## __VA_ARGS__); } while (0)
-+                                       uint16_t len)
+-#define BADF(fmt, ...) \
-+
+-do { hw_error("lan9118: error: " fmt , ## __VA_ARGS__);} while (0)
- {
+ #else
-     if (trace_event_get_state_backends(TRACE_COLO_COMPARE_MISCOMPARE)) {
+ #define DPRINTF(fmt, ...) do {} while(0)
-         char pri_ip_src[20], pri_ip_dst[20], sec_ip_src[20], sec_ip_dst[20];
+-#define BADF(fmt, ...) \
-@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_common(Packet *ppkt,
+-do { fprintf(stderr, "lan9118: error: " fmt , ## __VA_ARGS__);} while (0)
-                                    sec_ip_src, sec_ip_dst);
+ #endif
  /* The tx and rx fifo ports are a range of aliased 32-bit registers */
@@ -XXX,XX +XXX,XX @@ static uint32_t do_phy_read(lan9118_state *s, int reg)
      case 30: /* Interrupt mask */
          return s->phy_int_mask;
      default:
 -        BADF("PHY read reg %d\n", reg);
 +        qemu_log_mask(LOG_GUEST_ERROR,
 +                      "do_phy_read: PHY read reg %d\n", reg);
          return 0;
      }
--    poffset = ppkt->vnet_hdr_len + poffset;
--    soffset = ppkt->vnet_hdr_len + soffset;
--
--    if (ppkt->size - poffset == spkt->size - soffset) {
--        return memcmp(ppkt->data + poffset,
--                      spkt->data + soffset,
--                      spkt->size - soffset);
--    } else {
--        trace_colo_compare_main("Net packet size are not the same");
--        return -1;
--    }
-+    return memcmp(ppkt->data + poffset, spkt->data + soffset, len);
  }
+@@ -XXX,XX +XXX,XX @@ static void do_phy_write(lan9118_state *s, int reg, uint32_t val)
- /*
+         phy_update_irq(s);
-@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_tcp(Packet *spkt, Packet *ppkt)
+         break;
-      * the secondary guest's timestamp. COLO just focus on payload,
+     default:
-      * so we just need skip this field.
+-        BADF("PHY write reg %d = 0x%04x\n", reg, val);
-      */
++        qemu_log_mask(LOG_GUEST_ERROR,
--    if (ptcp->th_off > 5) {
++                      "do_phy_write: PHY write reg %d = 0x%04x\n", reg, val);
 -        ptrdiff_t ptcp_offset, stcp_offset;
 -        ptcp_offset = ppkt->transport_header - (uint8_t *)ppkt->data
 -                      + (ptcp->th_off * 4) - ppkt->vnet_hdr_len;
 -        stcp_offset = spkt->transport_header - (uint8_t *)spkt->data
 -                      + (stcp->th_off * 4) - spkt->vnet_hdr_len;
 +    ptrdiff_t ptcp_offset, stcp_offset;
 -        /*
 -         * When network is busy, some tcp options(like sack) will unpredictable
 -         * occur in primary side or secondary side. it will make packet size
 -         * not same, but the two packet's payload is identical. colo just
 -         * care about packet payload, so we skip the option field.
 -         */
 -        res = colo_packet_compare_common(ppkt, spkt, ptcp_offset, stcp_offset);
 -    } else if (ptcp->th_sum == stcp->th_sum) {
 -        res = colo_packet_compare_common(ppkt, spkt, ETH_HLEN, ETH_HLEN);
 +    ptcp_offset = ppkt->transport_header - (uint8_t *)ppkt->data
 +                  + (ptcp->th_off << 2) - ppkt->vnet_hdr_len;
 +    stcp_offset = spkt->transport_header - (uint8_t *)spkt->data
 +                  + (stcp->th_off << 2) - spkt->vnet_hdr_len;
 +    if (ppkt->size - ptcp_offset == spkt->size - stcp_offset) {
 +        res = colo_compare_packet_payload(ppkt, spkt,
 +                                          ptcp_offset, stcp_offset,
 +                                          ppkt->size - ptcp_offset);
      } else {
 +        trace_colo_compare_main("TCP: payload size of packets are different");
          res = -1;
      }
+ }
-@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_tcp(Packet *spkt, Packet *ppkt)
-  */
+@@ -XXX,XX +XXX,XX @@ static void lan9118_16bit_mode_write(void *opaque, hwaddr offset,
- static int colo_packet_compare_udp(Packet *spkt, Packet *ppkt)
+         return;
  {
 -    int ret;
 -    int network_header_length = ppkt->ip->ip_hl * 4;
 +    uint16_t network_header_length = ppkt->ip->ip_hl << 2;
 +    uint16_t offset = network_header_length + ETH_HLEN + ppkt->vnet_hdr_len;
      trace_colo_compare_main("compare udp");
@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_udp(Packet *spkt, Packet *ppkt)
       * other field like TOS,TTL,IP Checksum. we only need to compare
       * the ip payload here.
       */
 -    ret = colo_packet_compare_common(ppkt, spkt,
 -                                     network_header_length + ETH_HLEN,
 -                                     network_header_length + ETH_HLEN);
 -
 -    if (ret) {
 +    if (ppkt->size != spkt->size) {
 +        trace_colo_compare_main("UDP: payload size of packets are different");
 +        return -1;
 +    }
 +    if (colo_compare_packet_payload(ppkt, spkt, offset, offset,
 +                                    ppkt->size - offset)) {
          trace_colo_compare_udp_miscompare("primary pkt size", ppkt->size);
          trace_colo_compare_udp_miscompare("Secondary pkt size", spkt->size);
          if (trace_event_get_state_backends(TRACE_COLO_COMPARE_MISCOMPARE)) {
@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_udp(Packet *spkt, Packet *ppkt)
              qemu_hexdump((char *)spkt->data, stderr, "colo-compare sec pkt",
                           spkt->size);
          }
 +        return -1;
 +    } else {
 +        return 0;
      }
--
--    return ret;
+-    hw_error("lan9118_write: Bad size 0x%x\n", size);
 +    qemu_log_mask(LOG_GUEST_ERROR,
 +                  "lan9118_16bit_mode_write: Bad size 0x%x\n", size);
  }
- /*
+ static uint64_t lan9118_readl(void *opaque, hwaddr offset,
-@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_udp(Packet *spkt, Packet *ppkt)
+@@ -XXX,XX +XXX,XX @@ static uint64_t lan9118_16bit_mode_read(void *opaque, hwaddr offset,
-  */
+         return lan9118_readl(opaque, offset, size);
  static int colo_packet_compare_icmp(Packet *spkt, Packet *ppkt)
  {
 -    int network_header_length = ppkt->ip->ip_hl * 4;
 +    uint16_t network_header_length = ppkt->ip->ip_hl << 2;
 +    uint16_t offset = network_header_length + ETH_HLEN + ppkt->vnet_hdr_len;
      trace_colo_compare_main("compare icmp");
@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_icmp(Packet *spkt, Packet *ppkt)
       * other field like TOS,TTL,IP Checksum. we only need to compare
       * the ip payload here.
       */
 -    if (colo_packet_compare_common(ppkt, spkt,
 -                                   network_header_length + ETH_HLEN,
 -                                   network_header_length + ETH_HLEN)) {
 +    if (ppkt->size != spkt->size) {
 +        trace_colo_compare_main("ICMP: payload size of packets are different");
 +        return -1;
 +    }
 +    if (colo_compare_packet_payload(ppkt, spkt, offset, offset,
 +                                    ppkt->size - offset)) {
          trace_colo_compare_icmp_miscompare("primary pkt size",
                                             ppkt->size);
          trace_colo_compare_icmp_miscompare("Secondary pkt size",
@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_icmp(Packet *spkt, Packet *ppkt)
   */
  static int colo_packet_compare_other(Packet *spkt, Packet *ppkt)
  {
 +    uint16_t offset = ppkt->vnet_hdr_len;
 +
      trace_colo_compare_main("compare other");
      if (trace_event_get_state_backends(TRACE_COLO_COMPARE_MISCOMPARE)) {
          char pri_ip_src[20], pri_ip_dst[20], sec_ip_src[20], sec_ip_dst[20];
@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_other(Packet *spkt, Packet *ppkt)
                                     sec_ip_src, sec_ip_dst);
      }
--    return colo_packet_compare_common(ppkt, spkt, 0, 0);
+-    hw_error("lan9118_read: Bad size 0x%x\n", size);
-+    if (ppkt->size != spkt->size) {
++    qemu_log_mask(LOG_GUEST_ERROR,
-+        trace_colo_compare_main("Other: payload size of packets are different");
++                  "lan9118_16bit_mode_read: Bad size 0x%x\n", size);
-+        return -1;
+     return 0;
 +    }
 +    return colo_compare_packet_payload(ppkt, spkt, offset, offset,
 +                                       ppkt->size - offset);
  }
- static int colo_old_packet_check_one(Packet *pkt, int64_t *check_time)
 --
 .7.4

-New patch
+[PULL 05/10] hw/net/vmxnet3: allow VMXNET3_MAX_MTU itself as a value
+From: Fiona Ebner <f.ebner@proxmox.com>
+Currently, VMXNET3_MAX_MTU itself (being 9000) is not considered a
+valid value for the MTU, but a guest running ESXi 7.0 might try to
+set it and fail the assert [0].
+In the Linux kernel, dev->max_mtu itself is a valid value for the MTU
+and for the vmxnet3 driver it's 9000, so a guest running Linux will
+also fail the assert when trying to set an MTU of 9000.
+VMXNET3_MAX_MTU and s->mtu don't seem to be used in relation to buffer
+allocations/accesses, so allowing the upper limit itself as a value
+should be fine.
+[0]: https://forum.proxmox.com/threads/114011/
+Fixes: d05dcd94ae ("net: vmxnet3: validate configuration values during activate (CVE-2021-20203)")
+Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ hw/net/vmxnet3.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/vmxnet3.c
++++ b/hw/net/vmxnet3.c
+@@ -XXX,XX +XXX,XX @@ static void vmxnet3_activate_device(VMXNET3State *s)
+     vmxnet3_setup_rx_filtering(s);
+     /* Cache fields from shared memory */
+     s->mtu = VMXNET3_READ_DRV_SHARED32(d, s->drv_shmem, devRead.misc.mtu);
+-    assert(VMXNET3_MIN_MTU <= s->mtu && s->mtu < VMXNET3_MAX_MTU);
++    assert(VMXNET3_MIN_MTU <= s->mtu && s->mtu <= VMXNET3_MAX_MTU);
+     VMW_CFPRN("MTU is %u", s->mtu);
+     s->max_rx_frags =
+--
+.7.4

-New patch
+[PULL 06/10] net: Increase L2TPv3 buffer to fit jumboframes
+From: Christian Svensson <blue@cmd.nu>
+Increase the allocated buffer size to fit larger packets.
+Given that jumboframes can commonly be up to 9000 bytes the closest suitable
+value seems to be 16 KiB.
+Tested by running qemu towards a Linux L2TPv3 endpoint and pushing
+jumboframe traffic through the interfaces.
+Signed-off-by: Christian Svensson <blue@cmd.nu>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ net/l2tpv3.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/net/l2tpv3.c b/net/l2tpv3.c
+index XXXXXXX..XXXXXXX 100644
+--- a/net/l2tpv3.c
++++ b/net/l2tpv3.c
+@@ -XXX,XX +XXX,XX @@
+  */
+ #define BUFFER_ALIGN sysconf(_SC_PAGESIZE)
+-#define BUFFER_SIZE 2048
++#define BUFFER_SIZE 16384
+ #define IOVSIZE 2
+ #define MAX_L2TPV3_MSGCNT 64
+ #define MAX_L2TPV3_IOVCNT (MAX_L2TPV3_MSGCNT * IOVSIZE)
+--
+.7.4

-New patch
+[PULL 07/10] vmnet: stop recieving events when VM is stopped
+From: Joelle van Dyne <j@getutm.app>
+When the VM is stopped using the HMP command "stop", soon the handler will
+stop reading from the vmnet interface. This causes a flood of
+`VMNET_INTERFACE_PACKETS_AVAILABLE` events to arrive and puts the host CPU
+at 100%. We fix this by removing the event handler from vmnet when the VM
+is no longer in a running state and restore it when we return to a running
+state.
+Signed-off-by: Joelle van Dyne <j@getutm.app>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ net/vmnet-common.m | 48 +++++++++++++++++++++++++++++++++++-------------
+ net/vmnet_int.h    |  2 ++
+files changed, 37 insertions(+), 13 deletions(-)
+diff --git a/net/vmnet-common.m b/net/vmnet-common.m
+index XXXXXXX..XXXXXXX 100644
+--- a/net/vmnet-common.m
++++ b/net/vmnet-common.m
+@@ -XXX,XX +XXX,XX @@
+ #include "clients.h"
+ #include "qemu/error-report.h"
+ #include "qapi/error.h"
++#include "sysemu/runstate.h"
+ #include <vmnet/vmnet.h>
+ #include <dispatch/dispatch.h>
+@@ -XXX,XX +XXX,XX @@ static void vmnet_bufs_init(VmnetState *s)
+     }
+ }
++/**
++ * Called on state change to un-register/re-register handlers
++ */
++static void vmnet_vm_state_change_cb(void *opaque, bool running, RunState state)
++{
++    VmnetState *s = opaque;
++
++    if (running) {
++        vmnet_interface_set_event_callback(
++            s->vmnet_if,
++            VMNET_INTERFACE_PACKETS_AVAILABLE,
++            s->if_queue,
++            ^(interface_event_t event_id, xpc_object_t event) {
++                assert(event_id == VMNET_INTERFACE_PACKETS_AVAILABLE);
++                /*
++                 * This function is being called from a non qemu thread, so
++                 * we only schedule a BH, and do the rest of the io completion
++                 * handling from vmnet_send_bh() which runs in a qemu context.
++                 */
++                qemu_bh_schedule(s->send_bh);
++            });
++    } else {
++        vmnet_interface_set_event_callback(
++            s->vmnet_if,
++            VMNET_INTERFACE_PACKETS_AVAILABLE,
++            NULL,
++            NULL);
++    }
++}
+ int vmnet_if_create(NetClientState *nc,
+                     xpc_object_t if_desc,
+@@ -XXX,XX +XXX,XX @@ int vmnet_if_create(NetClientState *nc,
+     s->packets_send_current_pos = 0;
+     s->packets_send_end_pos = 0;
+-    vmnet_interface_set_event_callback(
+-        s->vmnet_if,
+-        VMNET_INTERFACE_PACKETS_AVAILABLE,
+-        s->if_queue,
+-        ^(interface_event_t event_id, xpc_object_t event) {
+-            assert(event_id == VMNET_INTERFACE_PACKETS_AVAILABLE);
+-            /*
+-             * This function is being called from a non qemu thread, so
+-             * we only schedule a BH, and do the rest of the io completion
+-             * handling from vmnet_send_bh() which runs in a qemu context.
+-             */
+-            qemu_bh_schedule(s->send_bh);
+-        });
++    vmnet_vm_state_change_cb(s, 1, RUN_STATE_RUNNING);
++
++    s->change = qemu_add_vm_change_state_handler(vmnet_vm_state_change_cb, s);
+     return 0;
+ }
+@@ -XXX,XX +XXX,XX @@ void vmnet_cleanup_common(NetClientState *nc)
+         return;
+     }
++    vmnet_vm_state_change_cb(s, 0, RUN_STATE_SHUTDOWN);
++    qemu_del_vm_change_state_handler(s->change);
+     if_stopped_sem = dispatch_semaphore_create(0);
+     vmnet_stop_interface(
+         s->vmnet_if,
+diff --git a/net/vmnet_int.h b/net/vmnet_int.h
+index XXXXXXX..XXXXXXX 100644
+--- a/net/vmnet_int.h
++++ b/net/vmnet_int.h
+@@ -XXX,XX +XXX,XX @@ typedef struct VmnetState {
+     int packets_send_end_pos;
+     struct iovec iov_buf[VMNET_PACKETS_LIMIT];
++
++    VMChangeStateEntry *change;
+ } VmnetState;
+ const char *vmnet_status_map_str(vmnet_return_t status);
+--
+.7.4

-New patch
+[PULL 08/10] hw/net/can/xlnx-zynqmp-can: fix assertion failures in transfer_fifo()
+From: Qiang Liu <cyruscyliu@gmail.com>
+Check fifos before poping data from and pushing data into it.
+Fixes: 98e5d7a2b726 ("hw/net/can: Introduce Xilinx ZynqMP CAN controller")
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1425
+Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1427
+Reported-by: Qiang Liu <cyruscyliu@gmail.com>
+Signed-off-by: Qiang Liu <cyruscyliu@gmail.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ hw/net/can/xlnx-zynqmp-can.c | 9 ++++++++-
+file changed, 8 insertions(+), 1 deletion(-)
+diff --git a/hw/net/can/xlnx-zynqmp-can.c b/hw/net/can/xlnx-zynqmp-can.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/can/xlnx-zynqmp-can.c
++++ b/hw/net/can/xlnx-zynqmp-can.c
+@@ -XXX,XX +XXX,XX @@ static void transfer_fifo(XlnxZynqMPCANState *s, Fifo32 *fifo)
+     }
+     while (!fifo32_is_empty(fifo)) {
++        if (fifo32_num_used(fifo) < (4 * CAN_FRAME_SIZE)) {
++            g_autofree char *path = object_get_canonical_path(OBJECT(s));
++            qemu_log_mask(LOG_GUEST_ERROR, "%s: data left in the fifo is not"
++                          " enough for transfer.\n", path);
++            break;
++        }
+         for (i = 0; i < CAN_FRAME_SIZE; i++) {
+             data[i] = fifo32_pop(fifo);
+         }
+@@ -XXX,XX +XXX,XX @@ static void transfer_fifo(XlnxZynqMPCANState *s, Fifo32 *fifo)
+              * acknowledged. The XlnxZynqMPCAN core receives any message
+              * that it transmits.
+              */
+-            if (fifo32_is_full(&s->rx_fifo)) {
++            if (fifo32_is_full(&s->rx_fifo) ||
++                    (fifo32_num_free(&s->rx_fifo) < (4 * CAN_FRAME_SIZE))) {
+                 ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, RXOFLW, 1);
+             } else {
+                 for (i = 0; i < CAN_FRAME_SIZE; i++) {
+--
+.7.4

-[Qemu-devel] [PULL 3/6] net: Allow hubports to connect to other netdevs
+[PULL 09/10] net: stream: add a new option to automatically reconnect
-From: Thomas Huth <thuth@redhat.com>
+From: Laurent Vivier <lvivier@redhat.com>
-QEMU can emulate hubs to connect NICs and netdevs. This is currently
+In stream mode, if the server shuts down there is currently
-primarily used for the mis-named 'vlan' feature of the networking
+no way to reconnect the client to a new server without removing
-subsystem. Now the 'vlan' feature has been marked as deprecated, since
+the NIC device and the netdev backend (or to reboot).
-its name is rather confusing and the users often rather mis-configure
-their network when trying to use it. But while the 'vlan' parameter
+This patch introduces a reconnect option that specifies a delay
-should be removed at one point in time, the basic idea of emulating
+to try to reconnect with the same parameters.
-a hub in QEMU is still good: It's useful for bundling up the output of
-multiple NICs into one single l2tp netdev for example.
+Add a new test in qtest to test the reconnect option and the
+connect/disconnect events.
-Now to be able to use the hubport feature without 'vlan's, there is one
-missing piece: The possibility to connect a hubport to a netdev, too.
+Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 This patch adds this possibility by introducing a new "netdev=..."
 parameter to the hubports.
 To bundle up the output of multiple NICs into one socket netdev, you can
 now run QEMU with these parameters for example:
 qemu-system-ppc64 ... -netdev socket,id=s1,connect=:11122 \
     -netdev hubport,hubid=1,id=h1,netdev=s1 \
     -netdev hubport,hubid=1,id=h2 -device e1000,netdev=h2 \
     -netdev hubport,hubid=1,id=h3 -device virtio-net-pci,netdev=h3
 For using the socket netdev, you have got to start another QEMU as the
 receiving side first, for example with network dumping enabled:
 qemu-system-x86_64 -M isapc -netdev socket,id=s0,listen=:11122 \
     -device ne2k_isa,netdev=s0 \
     -object filter-dump,id=f1,netdev=s0,file=/tmp/dump.dat
 After the ppc64 guest tried to boot from both NICs, you can see in the
 dump file (using Wireshark, for example), that the output of both NICs
 (the e1000 and the virtio-net-pci) has been successfully transfered
 via the socket netdev in this case.
 Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- net/hub.c       | 27 +++++++++++++++++++++------
+ net/stream.c                |  53 ++++++++++++++++++++++-
- net/hub.h       |  3 ++-
+ qapi/net.json               |   7 ++-
- net/net.c       |  2 +-
+ qemu-options.hx             |   6 +--
- qapi/net.json   |  4 +++-
+ tests/qtest/netdev-socket.c | 101 ++++++++++++++++++++++++++++++++++++++++++++
- qemu-options.hx |  8 +++++---
+files changed, 162 insertions(+), 5 deletions(-)
-files changed, 32 insertions(+), 12 deletions(-)
+diff --git a/net/stream.c b/net/stream.c
 diff --git a/net/hub.c b/net/hub.c
 index XXXXXXX..XXXXXXX 100644
---- a/net/hub.c
+--- a/net/stream.c
-+++ b/net/hub.c
++++ b/net/stream.c
 @@ -XXX,XX +XXX,XX @@
-  */
+ #include "io/channel-socket.h"
+ #include "io/net-listener.h"
- #include "qemu/osdep.h"
+ #include "qapi/qapi-events-net.h"
-+#include "qapi/error.h"
++#include "qapi/qapi-visit-sockets.h"
- #include "monitor/monitor.h"
++#include "qapi/clone-visitor.h"
- #include "net/net.h"
- #include "clients.h"
+ typedef struct NetStreamState {
-@@ -XXX,XX +XXX,XX @@ static NetClientInfo net_hub_port_info = {
+     NetClientState nc;
-     .cleanup = net_hub_port_cleanup,
+@@ -XXX,XX +XXX,XX @@ typedef struct NetStreamState {
- };
+     guint ioc_write_tag;
+     SocketReadState rs;
--static NetHubPort *net_hub_port_new(NetHub *hub, const char *name)
+     unsigned int send_index;      /* number of bytes sent*/
-+static NetHubPort *net_hub_port_new(NetHub *hub, const char *name,
++    uint32_t reconnect;
-+                                    NetClientState *hubpeer)
++    guint timer_tag;
 +    SocketAddress *addr;
  } NetStreamState;
  static void net_stream_listen(QIONetListener *listener,
                                QIOChannelSocket *cioc,
                                void *opaque);
 +static void net_stream_arm_reconnect(NetStreamState *s);
  static gboolean net_stream_writable(QIOChannel *ioc,
                                      GIOCondition condition,
@@ -XXX,XX +XXX,XX @@ static gboolean net_stream_send(QIOChannel *ioc,
          qemu_set_info_str(&s->nc, "%s", "");
          qapi_event_send_netdev_stream_disconnected(s->nc.name);
 +        net_stream_arm_reconnect(s);
          return G_SOURCE_REMOVE;
      }
@@ -XXX,XX +XXX,XX @@ static gboolean net_stream_send(QIOChannel *ioc,
  static void net_stream_cleanup(NetClientState *nc)
  {
-     NetClientState *nc;
+     NetStreamState *s = DO_UPCAST(NetStreamState, nc, nc);
-     NetHubPort *port;
++    if (s->timer_tag) {
-@@ -XXX,XX +XXX,XX @@ static NetHubPort *net_hub_port_new(NetHub *hub, const char *name)
++        g_source_remove(s->timer_tag);
-         name = default_name;
++        s->timer_tag = 0;
 +    }
 +    if (s->addr) {
 +        qapi_free_SocketAddress(s->addr);
 +        s->addr = NULL;
 +    }
      if (s->ioc) {
          if (QIO_CHANNEL_SOCKET(s->ioc)->fd != -1) {
              if (s->ioc_read_tag) {
@@ -XXX,XX +XXX,XX @@ static void net_stream_client_connected(QIOTask *task, gpointer opaque)
  error:
      object_unref(OBJECT(s->ioc));
      s->ioc = NULL;
 +    net_stream_arm_reconnect(s);
 +}
 +
 +static gboolean net_stream_reconnect(gpointer data)
 +{
 +    NetStreamState *s = data;
 +    QIOChannelSocket *sioc;
 +
 +    s->timer_tag = 0;
 +
 +    sioc = qio_channel_socket_new();
 +    s->ioc = QIO_CHANNEL(sioc);
 +    qio_channel_socket_connect_async(sioc, s->addr,
 +                                     net_stream_client_connected, s,
 +                                     NULL, NULL);
 +    return G_SOURCE_REMOVE;
 +}
 +
 +static void net_stream_arm_reconnect(NetStreamState *s)
 +{
 +    if (s->reconnect && s->timer_tag == 0) {
 +        s->timer_tag = g_timeout_add_seconds(s->reconnect,
 +                                             net_stream_reconnect, s);
 +    }
  }
  static int net_stream_client_init(NetClientState *peer,
                                    const char *model,
                                    const char *name,
                                    SocketAddress *addr,
 +                                  uint32_t reconnect,
                                    Error **errp)
  {
      NetStreamState *s;
@@ -XXX,XX +XXX,XX @@ static int net_stream_client_init(NetClientState *peer,
      s->ioc = QIO_CHANNEL(sioc);
      s->nc.link_down = true;
 +    s->reconnect = reconnect;
 +    if (reconnect) {
 +        s->addr = QAPI_CLONE(SocketAddress, addr);
 +    }
      qio_channel_socket_connect_async(sioc, addr,
                                       net_stream_client_connected, s,
                                       NULL, NULL);
@@ -XXX,XX +XXX,XX @@ int net_init_stream(const Netdev *netdev, const char *name,
      sock = &netdev->u.stream;
      if (!sock->has_server || !sock->server) {
 -        return net_stream_client_init(peer, "stream", name, sock->addr, errp);
 +        return net_stream_client_init(peer, "stream", name, sock->addr,
 +                                      sock->has_reconnect ? sock->reconnect : 0,
 +                                      errp);
 +    }
 +    if (sock->has_reconnect) {
 +        error_setg(errp, "'reconnect' option is incompatible with "
 +                         "socket in server mode");
 +        return -1;
      }
+     return net_stream_server_init(peer, "stream", name, sock->addr, errp);
 -    nc = qemu_new_net_client(&net_hub_port_info, NULL, "hub", name);
 +    nc = qemu_new_net_client(&net_hub_port_info, hubpeer, "hub", name);
      port = DO_UPCAST(NetHubPort, nc, nc);
      port->id = id;
      port->hub = hub;
@@ -XXX,XX +XXX,XX @@ static NetHubPort *net_hub_port_new(NetHub *hub, const char *name)
  /**
   * Create a port on a given hub
 + * @hub_id: Number of the hub
   * @name: Net client name or NULL for default name.
 + * @hubpeer: Peer to use (if "netdev=id" has been specified)
   *
   * If there is no existing hub with the given id then a new hub is created.
   */
 -NetClientState *net_hub_add_port(int hub_id, const char *name)
 +NetClientState *net_hub_add_port(int hub_id, const char *name,
 +                                 NetClientState *hubpeer)
  {
      NetHub *hub;
      NetHubPort *port;
@@ -XXX,XX +XXX,XX @@ NetClientState *net_hub_add_port(int hub_id, const char *name)
          hub = net_hub_new(hub_id);
      }
 -    port = net_hub_port_new(hub, name);
 +    port = net_hub_port_new(hub, name, hubpeer);
      return &port->nc;
  }
-@@ -XXX,XX +XXX,XX @@ NetClientState *net_hub_port_find(int hub_id)
-         }
-     }
--    nc = net_hub_add_port(hub_id, NULL);
-+    nc = net_hub_add_port(hub_id, NULL, NULL);
-     return nc;
- }
-@@ -XXX,XX +XXX,XX @@ int net_init_hubport(const Netdev *netdev, const char *name,
-                      NetClientState *peer, Error **errp)
- {
-     const NetdevHubPortOptions *hubport;
-+    NetClientState *hubpeer = NULL;
-     assert(netdev->type == NET_CLIENT_DRIVER_HUBPORT);
-     assert(!peer);
-     hubport = &netdev->u.hubport;
--    net_hub_add_port(hubport->hubid, name);
-+    if (hubport->has_netdev) {
-+        hubpeer = qemu_find_netdev(hubport->netdev);
-+        if (!hubpeer) {
-+            error_setg(errp, "netdev '%s' not found", hubport->netdev);
-+            return -1;
-+        }
-+    }
-+
-+    net_hub_add_port(hubport->hubid, name, hubpeer);
-+
-     return 0;
- }
-diff --git a/net/hub.h b/net/hub.h
-index XXXXXXX..XXXXXXX 100644
---- a/net/hub.h
-+++ b/net/hub.h
-@@ -XXX,XX +XXX,XX @@
- #include "qemu-common.h"
--NetClientState *net_hub_add_port(int hub_id, const char *name);
-+NetClientState *net_hub_add_port(int hub_id, const char *name,
-+                                 NetClientState *hubpeer);
- NetClientState *net_hub_find_client_by_name(int hub_id, const char *name);
- void net_hub_info(Monitor *mon);
- void net_hub_check_clients(void);
-diff --git a/net/net.c b/net/net.c
-index XXXXXXX..XXXXXXX 100644
---- a/net/net.c
-+++ b/net/net.c
-@@ -XXX,XX +XXX,XX @@ static int net_client_init1(const void *object, bool is_netdev, Error **errp)
-         /* Do not add to a vlan if it's a nic with a netdev= parameter. */
-         if (netdev->type != NET_CLIENT_DRIVER_NIC ||
-             !opts->u.nic.has_netdev) {
--            peer = net_hub_add_port(net->has_vlan ? net->vlan : 0, NULL);
-+            peer = net_hub_add_port(net->has_vlan ? net->vlan : 0, NULL, NULL);
-         }
-         if (net->has_vlan && !vlan_warned) {
 diff --git a/qapi/net.json b/qapi/net.json
 index XXXXXXX..XXXXXXX 100644
 --- a/qapi/net.json
 +++ b/qapi/net.json
 @@ -XXX,XX +XXX,XX @@
- # Connect two or more net clients through a software hub.
+ # @addr: socket address to listen on (server=true)
  #        or connect to (server=false)
  # @server: create server socket (default: false)
 +# @reconnect: For a client socket, if a socket is disconnected,
 +#             then attempt a reconnect after the given number of seconds.
 +#             Setting this to zero disables this function. (default: 0)
 +#             (since 8.0)
  #
- # @hubid: hub identifier number
+ # Only SocketAddress types 'unix', 'inet' and 'fd' are supported.
 +# @netdev: used to connect hub to a netdev instead of a device (since 2.12)
  #
- # Since: 1.2
+@@ -XXX,XX +XXX,XX @@
  { 'struct': 'NetdevStreamOptions',
    'data': {
      'addr':   'SocketAddress',
 -    '*server': 'bool' } }
 +    '*server': 'bool',
 +    '*reconnect': 'uint32' } }
  ##
- { 'struct': 'NetdevHubPortOptions',
+ # @NetdevDgramOptions:
    'data': {
 -    'hubid':     'int32' } }
 +    'hubid':     'int32',
 +    '*netdev':    'str' } }
  ##
  # @NetdevNetmapOptions:
 diff --git a/qemu-options.hx b/qemu-options.hx
 index XXXXXXX..XXXXXXX 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
 @@ -XXX,XX +XXX,XX @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev,
+     "-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]\n"
+     "                configure a network backend to connect to another network\n"
+     "                using an UDP tunnel\n"
+-    "-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off]\n"
+-    "-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off]\n"
+-    "-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor\n"
++    "-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]\n"
++    "-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]\n"
++    "-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]\n"
+     "                configure a network backend to connect to another network\n"
+     "                using a socket connection in stream mode.\n"
+     "-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]\n"
+diff --git a/tests/qtest/netdev-socket.c b/tests/qtest/netdev-socket.c
+index XXXXXXX..XXXXXXX 100644
+--- a/tests/qtest/netdev-socket.c
++++ b/tests/qtest/netdev-socket.c
+@@ -XXX,XX +XXX,XX @@
+ #include <glib/gstdio.h>
+ #include "../unit/socket-helpers.h"
+ #include "libqtest.h"
++#include "qapi/qmp/qstring.h"
++#include "qemu/sockets.h"
++#include "qapi/qobject-input-visitor.h"
++#include "qapi/qapi-visit-sockets.h"
+ #define CONNECTION_TIMEOUT    60
+@@ -XXX,XX +XXX,XX @@ static void test_stream_inet_ipv4(void)
+     qtest_quit(qts0);
+ }
++static void wait_stream_connected(QTestState *qts, const char *id,
++                                  SocketAddress **addr)
++{
++    QDict *resp, *data;
++    QString *qstr;
++    QObject *obj;
++    Visitor *v = NULL;
++
++    resp = qtest_qmp_eventwait_ref(qts, "NETDEV_STREAM_CONNECTED");
++    g_assert_nonnull(resp);
++    data = qdict_get_qdict(resp, "data");
++    g_assert_nonnull(data);
++
++    qstr = qobject_to(QString, qdict_get(data, "netdev-id"));
++    g_assert_nonnull(data);
++
++    g_assert(!strcmp(qstring_get_str(qstr), id));
++
++    obj = qdict_get(data, "addr");
++
++    v = qobject_input_visitor_new(obj);
++    visit_type_SocketAddress(v, NULL, addr, NULL);
++    visit_free(v);
++    qobject_unref(resp);
++}
++
++static void wait_stream_disconnected(QTestState *qts, const char *id)
++{
++    QDict *resp, *data;
++    QString *qstr;
++
++    resp = qtest_qmp_eventwait_ref(qts, "NETDEV_STREAM_DISCONNECTED");
++    g_assert_nonnull(resp);
++    data = qdict_get_qdict(resp, "data");
++    g_assert_nonnull(data);
++
++    qstr = qobject_to(QString, qdict_get(data, "netdev-id"));
++    g_assert_nonnull(data);
++
++    g_assert(!strcmp(qstring_get_str(qstr), id));
++    qobject_unref(resp);
++}
++
++static void test_stream_inet_reconnect(void)
++{
++    QTestState *qts0, *qts1;
++    int port;
++    SocketAddress *addr;
++
++    port = inet_get_free_port(false);
++    qts0 = qtest_initf("-nodefaults -M none "
++                       "-netdev stream,id=st0,server=true,addr.type=inet,"
++                       "addr.ipv4=on,addr.ipv6=off,"
++                       "addr.host=127.0.0.1,addr.port=%d", port);
++
++    EXPECT_STATE(qts0, "st0: index=0,type=stream,\r\n", 0);
++
++    qts1 = qtest_initf("-nodefaults -M none "
++                       "-netdev stream,server=false,id=st0,addr.type=inet,"
++                       "addr.ipv4=on,addr.ipv6=off,reconnect=1,"
++                       "addr.host=127.0.0.1,addr.port=%d", port);
++
++    wait_stream_connected(qts0, "st0", &addr);
++    g_assert_cmpint(addr->type, ==, SOCKET_ADDRESS_TYPE_INET);
++    g_assert_cmpstr(addr->u.inet.host, ==, "127.0.0.1");
++    qapi_free_SocketAddress(addr);
++
++    /* kill server */
++    qtest_quit(qts0);
++
++    /* check client has been disconnected */
++    wait_stream_disconnected(qts1, "st0");
++
++    /* restart server */
++    qts0 = qtest_initf("-nodefaults -M none "
++                       "-netdev stream,id=st0,server=true,addr.type=inet,"
++                       "addr.ipv4=on,addr.ipv6=off,"
++                       "addr.host=127.0.0.1,addr.port=%d", port);
++
++    /* wait connection events*/
++    wait_stream_connected(qts0, "st0", &addr);
++    g_assert_cmpint(addr->type, ==, SOCKET_ADDRESS_TYPE_INET);
++    g_assert_cmpstr(addr->u.inet.host, ==, "127.0.0.1");
++    qapi_free_SocketAddress(addr);
++
++    wait_stream_connected(qts1, "st0", &addr);
++    g_assert_cmpint(addr->type, ==, SOCKET_ADDRESS_TYPE_INET);
++    g_assert_cmpstr(addr->u.inet.host, ==, "127.0.0.1");
++    g_assert_cmpint(atoi(addr->u.inet.port), ==, port);
++    qapi_free_SocketAddress(addr);
++
++    qtest_quit(qts1);
++    qtest_quit(qts0);
++}
++
+ static void test_stream_inet_ipv6(void)
+ {
+     QTestState *qts0, *qts1;
+@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
+ #ifndef _WIN32
+         qtest_add_func("/netdev/dgram/mcast", test_dgram_mcast);
  #endif
-     "-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]\n"
++        qtest_add_func("/netdev/stream/inet/reconnect",
-     "                configure a vhost-user network, backed by a chardev 'dev'\n"
++                       test_stream_inet_reconnect);
--    "-netdev hubport,id=str,hubid=n\n"
+     }
-+    "-netdev hubport,id=str,hubid=n[,netdev=nd]\n"
+     if (has_ipv6) {
-     "                configure a hub port on QEMU VLAN 'n'\n", QEMU_ARCH_ALL)
+         qtest_add_func("/netdev/stream/inet/ipv6", test_stream_inet_ipv6);
  DEF("net", HAS_ARG, QEMU_OPTION_net,
      "-net nic[,vlan=n][,netdev=nd][,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]\n"
@@ -XXX,XX +XXX,XX @@ vde_switch -F -sock /tmp/myswitch
  qemu-system-i386 linux.img -net nic -net vde,sock=/tmp/myswitch
  @end example
 -@item -netdev hubport,id=@var{id},hubid=@var{hubid}
 +@item -netdev hubport,id=@var{id},hubid=@var{hubid}[,netdev=@var{nd}]
  Create a hub port on QEMU "vlan" @var{hubid}.
  The hubport netdev lets you connect a NIC to a QEMU "vlan" instead of a single
  netdev.  @code{-net} and @code{-device} with parameter @option{vlan} create the
 -required hub automatically.
 +required hub automatically. Alternatively, you can also connect the hubport
 +to another netdev with ID @var{nd} by using the @option{netdev=@var{nd}}
 +option.
  @item -netdev vhost-user,chardev=@var{id}[,vhostforce=on|off][,queues=n]
 --
 .7.4

-[Qemu-devel] [PULL 6/6] MAINTAINERS: update Dmitry Fleytman email
+[PULL 10/10] vdpa: fix VHOST_BACKEND_F_IOTLB_ASID flag check
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Eugenio Pérez <eperezma@redhat.com>
-gently asked by his automatic reply :)
+VHOST_BACKEND_F_IOTLB_ASID is the feature bit, not the bitmask. Since
 the device under test also provided VHOST_BACKEND_F_IOTLB_MSG_V2 and
 VHOST_BACKEND_F_IOTLB_BATCH, this went unnoticed.
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Fixes: c1a1008685 ("vdpa: always start CVQ in SVQ mode if possible")
 Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Acked-by: Jason Wang <jasowang@redhat.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- MAINTAINERS | 8 ++++----
+ net/vhost-vdpa.c | 2 +-
-file changed, 4 insertions(+), 4 deletions(-)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/MAINTAINERS b/MAINTAINERS
+diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
 index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
+--- a/net/vhost-vdpa.c
-+++ b/MAINTAINERS
++++ b/net/vhost-vdpa.c
-@@ -XXX,XX +XXX,XX @@ F: hw/scsi/mfi.h
+@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_net_cvq_start(NetClientState *nc)
- F: tests/megasas-test.c
+             g_strerror(errno), errno);
+         return -1;
- Network packet abstractions
+     }
--M: Dmitry Fleytman <dmitry@daynix.com>
+-    if (!(backend_features & VHOST_BACKEND_F_IOTLB_ASID) ||
-+M: Dmitry Fleytman <dmitry.fleytman@gmail.com>
++    if (!(backend_features & BIT_ULL(VHOST_BACKEND_F_IOTLB_ASID)) ||
- S: Maintained
+         !vhost_vdpa_net_valid_svq_features(v->dev->features, NULL)) {
- F: include/net/eth.h
+         return 0;
- F: net/eth.c
+     }
@@ -XXX,XX +XXX,XX @@ F: hw/net/net_rx_pkt*
  F: hw/net/net_tx_pkt*
  Vmware
 -M: Dmitry Fleytman <dmitry@daynix.com>
 +M: Dmitry Fleytman <dmitry.fleytman@gmail.com>
  S: Maintained
  F: hw/net/vmxnet*
  F: hw/scsi/vmw_pvscsi*
@@ -XXX,XX +XXX,XX @@ F: hw/mem/nvdimm.c
  F: include/hw/mem/nvdimm.h
  e1000x
 -M: Dmitry Fleytman <dmitry@daynix.com>
 +M: Dmitry Fleytman <dmitry.fleytman@gmail.com>
  S: Maintained
  F: hw/net/e1000x*
  e1000e
 -M: Dmitry Fleytman <dmitry@daynix.com>
 +M: Dmitry Fleytman <dmitry.fleytman@gmail.com>
  S: Maintained
  F: hw/net/e1000e*
 --
 .7.4

The following changes since commit e607bbee553cfe73072870cef458cfa4e78133e2:

Merge remote-tracking branch 'remotes/edgar/tags/edgar/xilinx-next-2018-01-26.for-upstream' into staging (2018-01-26 14:24:25 +0000)

are available in the git repository at:

https://github.com/jasowang/qemu.git tags/net-pull-request

for you to fetch changes up to bf4835a4d5338bb7424827715df22570a8adc67c:

MAINTAINERS: update Dmitry Fleytman email (2018-01-29 16:05:38 +0800)

----------------------------------------------------------------

----------------------------------------------------------------
Mao Zhongyi (2):
      colo: modified the payload compare function
      colo: compare the packet based on the tcp sequence number

Philippe Mathieu-Daudé (1):
      MAINTAINERS: update Dmitry Fleytman email

Thomas Huth (3):
      net: Allow hubports to connect to other netdevs
      net: Allow netdevs to be used with 'hostfwd_add' and 'hostfwd_remove'
      qemu-doc: Get rid of "vlan=X" example in the documentation

From: Mao Zhongyi <maozy.fnst@cn.fujitsu.com>

Modified the function colo_packet_compare_common to prepare for the
tcp packet comparison in the next patch.

Cc: Zhang Chen <zhangckid@gmail.com>
Cc: Li Zhijian <lizhijian@cn.fujitsu.com>
Cc: Jason Wang <jasowang@redhat.com>

Signed-off-by: Mao Zhongyi <maozy.fnst@cn.fujitsu.com>
Signed-off-by: Li Zhijian <lizhijian@cn.fujitsu.com>
Signed-off-by: Zhang Chen <zhangckid@gmail.com>
Reviewed-by: Zhang Chen <zhangckid@gmail.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/colo-compare.c | 88 +++++++++++++++++++++++++++---------------------------
 1 file changed, 44 insertions(+), 44 deletions(-)

diff --git a/net/colo-compare.c b/net/colo-compare.c
index XXXXXXX..XXXXXXX 100644
--- a/net/colo-compare.c
+++ b/net/colo-compare.c
@@ -XXX,XX +XXX,XX @@ static int packet_enqueue(CompareState *s, int mode, Connection **con)
  * return:    0  means packet same
  *            > 0 || < 0 means packet different
  */
-static int colo_packet_compare_common(Packet *ppkt,
-                                      Packet *spkt,
-                                      int poffset,
-                                      int soffset)
+static int colo_compare_packet_payload(Packet *ppkt,
+                                       Packet *spkt,
+                                       uint16_t poffset,
+                                       uint16_t soffset,
+                                       uint16_t len)
+
 {
     if (trace_event_get_state_backends(TRACE_COLO_COMPARE_MISCOMPARE)) {
         char pri_ip_src[20], pri_ip_dst[20], sec_ip_src[20], sec_ip_dst[20];
@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_common(Packet *ppkt,
                                    sec_ip_src, sec_ip_dst);
     }
 
-    poffset = ppkt->vnet_hdr_len + poffset;
-    soffset = ppkt->vnet_hdr_len + soffset;
-
-    if (ppkt->size - poffset == spkt->size - soffset) {
-        return memcmp(ppkt->data + poffset,
-                      spkt->data + soffset,
-                      spkt->size - soffset);
-    } else {
-        trace_colo_compare_main("Net packet size are not the same");
-        return -1;
-    }
+    return memcmp(ppkt->data + poffset, spkt->data + soffset, len);
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_tcp(Packet *spkt, Packet *ppkt)
      * the secondary guest's timestamp. COLO just focus on payload,
      * so we just need skip this field.
      */
-    if (ptcp->th_off > 5) {
-        ptrdiff_t ptcp_offset, stcp_offset;
 
-        ptcp_offset = ppkt->transport_header - (uint8_t *)ppkt->data
-                      + (ptcp->th_off * 4) - ppkt->vnet_hdr_len;
-        stcp_offset = spkt->transport_header - (uint8_t *)spkt->data
-                      + (stcp->th_off * 4) - spkt->vnet_hdr_len;
+    ptrdiff_t ptcp_offset, stcp_offset;
 
-        /*
-         * When network is busy, some tcp options(like sack) will unpredictable
-         * occur in primary side or secondary side. it will make packet size
-         * not same, but the two packet's payload is identical. colo just
-         * care about packet payload, so we skip the option field.
-         */
-        res = colo_packet_compare_common(ppkt, spkt, ptcp_offset, stcp_offset);
-    } else if (ptcp->th_sum == stcp->th_sum) {
-        res = colo_packet_compare_common(ppkt, spkt, ETH_HLEN, ETH_HLEN);
+    ptcp_offset = ppkt->transport_header - (uint8_t *)ppkt->data
+                  + (ptcp->th_off << 2) - ppkt->vnet_hdr_len;
+    stcp_offset = spkt->transport_header - (uint8_t *)spkt->data
+                  + (stcp->th_off << 2) - spkt->vnet_hdr_len;
+    if (ppkt->size - ptcp_offset == spkt->size - stcp_offset) {
+        res = colo_compare_packet_payload(ppkt, spkt,
+                                          ptcp_offset, stcp_offset,
+                                          ppkt->size - ptcp_offset);
     } else {
+        trace_colo_compare_main("TCP: payload size of packets are different");
         res = -1;
     }
 
@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_tcp(Packet *spkt, Packet *ppkt)
  */
 static int colo_packet_compare_udp(Packet *spkt, Packet *ppkt)
 {
-    int ret;
-    int network_header_length = ppkt->ip->ip_hl * 4;
+    uint16_t network_header_length = ppkt->ip->ip_hl << 2;
+    uint16_t offset = network_header_length + ETH_HLEN + ppkt->vnet_hdr_len;
 
     trace_colo_compare_main("compare udp");
 
@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_udp(Packet *spkt, Packet *ppkt)
      * other field like TOS,TTL,IP Checksum. we only need to compare
      * the ip payload here.
      */
-    ret = colo_packet_compare_common(ppkt, spkt,
-                                     network_header_length + ETH_HLEN,
-                                     network_header_length + ETH_HLEN);
-
-    if (ret) {
+    if (ppkt->size != spkt->size) {
+        trace_colo_compare_main("UDP: payload size of packets are different");
+        return -1;
+    }
+    if (colo_compare_packet_payload(ppkt, spkt, offset, offset,
+                                    ppkt->size - offset)) {
         trace_colo_compare_udp_miscompare("primary pkt size", ppkt->size);
         trace_colo_compare_udp_miscompare("Secondary pkt size", spkt->size);
         if (trace_event_get_state_backends(TRACE_COLO_COMPARE_MISCOMPARE)) {
@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_udp(Packet *spkt, Packet *ppkt)
             qemu_hexdump((char *)spkt->data, stderr, "colo-compare sec pkt",
                          spkt->size);
         }
+        return -1;
+    } else {
+        return 0;
     }
-
-    return ret;
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_udp(Packet *spkt, Packet *ppkt)
  */
 static int colo_packet_compare_icmp(Packet *spkt, Packet *ppkt)
 {
-    int network_header_length = ppkt->ip->ip_hl * 4;
+    uint16_t network_header_length = ppkt->ip->ip_hl << 2;
+    uint16_t offset = network_header_length + ETH_HLEN + ppkt->vnet_hdr_len;
 
     trace_colo_compare_main("compare icmp");
 
@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_icmp(Packet *spkt, Packet *ppkt)
      * other field like TOS,TTL,IP Checksum. we only need to compare
      * the ip payload here.
      */
-    if (colo_packet_compare_common(ppkt, spkt,
-                                   network_header_length + ETH_HLEN,
-                                   network_header_length + ETH_HLEN)) {
+    if (ppkt->size != spkt->size) {
+        trace_colo_compare_main("ICMP: payload size of packets are different");
+        return -1;
+    }
+    if (colo_compare_packet_payload(ppkt, spkt, offset, offset,
+                                    ppkt->size - offset)) {
         trace_colo_compare_icmp_miscompare("primary pkt size",
                                            ppkt->size);
         trace_colo_compare_icmp_miscompare("Secondary pkt size",
@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_icmp(Packet *spkt, Packet *ppkt)
  */
 static int colo_packet_compare_other(Packet *spkt, Packet *ppkt)
 {
+    uint16_t offset = ppkt->vnet_hdr_len;
+
     trace_colo_compare_main("compare other");
     if (trace_event_get_state_backends(TRACE_COLO_COMPARE_MISCOMPARE)) {
         char pri_ip_src[20], pri_ip_dst[20], sec_ip_src[20], sec_ip_dst[20];
@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_other(Packet *spkt, Packet *ppkt)
                                    sec_ip_src, sec_ip_dst);
     }
 
-    return colo_packet_compare_common(ppkt, spkt, 0, 0);
+    if (ppkt->size != spkt->size) {
+        trace_colo_compare_main("Other: payload size of packets are different");
+        return -1;
+    }
+    return colo_compare_packet_payload(ppkt, spkt, offset, offset,
+                                       ppkt->size - offset);
 }
 
 static int colo_old_packet_check_one(Packet *pkt, int64_t *check_time)
-- 
2.7.4

From: Mao Zhongyi <maozy.fnst@cn.fujitsu.com>

Packet size some time different or when network is busy.
Based on same payload size, but TCP protocol can not
guarantee send the same one packet in the same way,

like that:
We send this payload:
------------------------------
| header |1|2|3|4|5|6|7|8|9|0|
------------------------------

primary:
ppkt1:
----------------
| header |1|2|3|
----------------
ppkt2:
------------------------
| header |4|5|6|7|8|9|0|
------------------------

secondary:
spkt1:
------------------------------
| header |1|2|3|4|5|6|7|8|9|0|
------------------------------

In the original method, ppkt1 and ppkt2 are different in size and
spkt1, so they can't compare and trigger the checkpoint.

I have tested FTP get 200M and 1G file many times, I found that
the performance was less than 1% of the native.

Now I reconstructed the comparison of TCP packets based on the
TCP sequence number. first of all, ppkt1 and spkt1 have the same
starting sequence number, so they can compare, even though their
length is different. And then ppkt1 with a smaller payload length
is used as the comparison length, if the payload is same, send
out the ppkt1 and record the offset(the length of ppkt1 payload)
in spkt1. The next comparison, ppkt2 and spkt1 can be compared
from the recorded position of spkt1.

like that:
----------------
| header |1|2|3| ppkt1
---------|-----|
         |     |
---------v-----v--------------
| header |1|2|3|4|5|6|7|8|9|0| spkt1
---------------|\------------|
               | \offset     |
      ---------v-------------v
      | header |4|5|6|7|8|9|0| ppkt2
      ------------------------

In this way, the performance can reach native 20% in my multiple
tests.

Cc: Zhang Chen <zhangckid@gmail.com>
Cc: Li Zhijian <lizhijian@cn.fujitsu.com>
Cc: Jason Wang <jasowang@redhat.com>

Signed-off-by: Mao Zhongyi <maozy.fnst@cn.fujitsu.com>
Signed-off-by: Li Zhijian <lizhijian@cn.fujitsu.com>
Signed-off-by: Zhang Chen <zhangckid@gmail.com>
Reviewed-by: Zhang Chen <zhangckid@gmail.com>
Tested-by: Zhang Chen <zhangckid@gmail.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/colo-compare.c | 343 +++++++++++++++++++++++++++++++++++------------------
 net/colo.c         |   9 ++
 net/colo.h         |  15 +++
 net/trace-events   |   2 +-
 4 files changed, 250 insertions(+), 119 deletions(-)

diff --git a/net/colo-compare.c b/net/colo-compare.c
index XXXXXXX..XXXXXXX 100644
--- a/net/colo-compare.c
+++ b/net/colo-compare.c
@@ -XXX,XX +XXX,XX @@
 #define COMPARE_READ_LEN_MAX NET_BUFSIZE
 #define MAX_QUEUE_SIZE 1024
 
+#define COLO_COMPARE_FREE_PRIMARY     0x01
+#define COLO_COMPARE_FREE_SECONDARY   0x02
+
 /* TODO: Should be configurable */
 #define REGULAR_PACKET_CHECK_MS 3000
 
@@ -XXX,XX +XXX,XX @@ static gint seq_sorter(Packet *a, Packet *b, gpointer data)
     return ntohl(atcp->th_seq) - ntohl(btcp->th_seq);
 }
 
+static void fill_pkt_tcp_info(void *data, uint32_t *max_ack)
+{
+    Packet *pkt = data;
+    struct tcphdr *tcphd;
+
+    tcphd = (struct tcphdr *)pkt->transport_header;
+
+    pkt->tcp_seq = ntohl(tcphd->th_seq);
+    pkt->tcp_ack = ntohl(tcphd->th_ack);
+    *max_ack = *max_ack > pkt->tcp_ack ? *max_ack : pkt->tcp_ack;
+    pkt->header_size = pkt->transport_header - (uint8_t *)pkt->data
+                       + (tcphd->th_off << 2) - pkt->vnet_hdr_len;
+    pkt->payload_size = pkt->size - pkt->header_size;
+    pkt->seq_end = pkt->tcp_seq + pkt->payload_size;
+    pkt->flags = tcphd->th_flags;
+}
+
 /*
  * Return 1 on success, if return 0 means the
  * packet will be dropped
  */
-static int colo_insert_packet(GQueue *queue, Packet *pkt)
+static int colo_insert_packet(GQueue *queue, Packet *pkt, uint32_t *max_ack)
 {
     if (g_queue_get_length(queue) <= MAX_QUEUE_SIZE) {
         if (pkt->ip->ip_p == IPPROTO_TCP) {
+            fill_pkt_tcp_info(pkt, max_ack);
             g_queue_insert_sorted(queue,
                                   pkt,
                                   (GCompareDataFunc)seq_sorter,
@@ -XXX,XX +XXX,XX @@ static int packet_enqueue(CompareState *s, int mode, Connection **con)
     }
 
     if (mode == PRIMARY_IN) {
-        if (!colo_insert_packet(&conn->primary_list, pkt)) {
+        if (!colo_insert_packet(&conn->primary_list, pkt, &conn->pack)) {
             error_report("colo compare primary queue size too big,"
                          "drop packet");
         }
     } else {
-        if (!colo_insert_packet(&conn->secondary_list, pkt)) {
+        if (!colo_insert_packet(&conn->secondary_list, pkt, &conn->sack)) {
             error_report("colo compare secondary queue size too big,"
                          "drop packet");
         }
@@ -XXX,XX +XXX,XX @@ static int packet_enqueue(CompareState *s, int mode, Connection **con)
     return 0;
 }
 
+static inline bool after(uint32_t seq1, uint32_t seq2)
+{
+        return (int32_t)(seq1 - seq2) > 0;
+}
+
+static void colo_release_primary_pkt(CompareState *s, Packet *pkt)
+{
+    int ret;
+    ret = compare_chr_send(s,
+                           pkt->data,
+                           pkt->size,
+                           pkt->vnet_hdr_len);
+    if (ret < 0) {
+        error_report("colo send primary packet failed");
+    }
+    trace_colo_compare_main("packet same and release packet");
+    packet_destroy(pkt, NULL);
+}
+
 /*
  * The IP packets sent by primary and secondary
  * will be compared in here
@@ -XXX,XX +XXX,XX @@ static int colo_compare_packet_payload(Packet *ppkt,
 }
 
 /*
- * Called from the compare thread on the primary
- * for compare tcp packet
- * compare_tcp copied from Dr. David Alan Gilbert's branch
- */
-static int colo_packet_compare_tcp(Packet *spkt, Packet *ppkt)
+ * return true means that the payload is consist and
+ * need to make the next comparison, false means do
+ * the checkpoint
+*/
+static bool colo_mark_tcp_pkt(Packet *ppkt, Packet *spkt,
+                              int8_t *mark, uint32_t max_ack)
 {
-    struct tcphdr *ptcp, *stcp;
-    int res;
+    *mark = 0;
+
+    if (ppkt->tcp_seq == spkt->tcp_seq && ppkt->seq_end == spkt->seq_end) {
+        if (colo_compare_packet_payload(ppkt, spkt,
+                                        ppkt->header_size, spkt->header_size,
+                                        ppkt->payload_size)) {
+            *mark = COLO_COMPARE_FREE_SECONDARY | COLO_COMPARE_FREE_PRIMARY;
+            return true;
+        }
+    }
+    if (ppkt->tcp_seq == spkt->tcp_seq && ppkt->seq_end == spkt->seq_end) {
+        if (colo_compare_packet_payload(ppkt, spkt,
+                                        ppkt->header_size, spkt->header_size,
+                                        ppkt->payload_size)) {
+            *mark = COLO_COMPARE_FREE_SECONDARY | COLO_COMPARE_FREE_PRIMARY;
+            return true;
+        }
+    }
+
+    /* one part of secondary packet payload still need to be compared */
+    if (!after(ppkt->seq_end, spkt->seq_end)) {
+        if (colo_compare_packet_payload(ppkt, spkt,
+                                        ppkt->header_size + ppkt->offset,
+                                        spkt->header_size + spkt->offset,
+                                        ppkt->payload_size - ppkt->offset)) {
+            if (!after(ppkt->tcp_ack, max_ack)) {
+                *mark = COLO_COMPARE_FREE_PRIMARY;
+                spkt->offset += ppkt->payload_size - ppkt->offset;
+                return true;
+            } else {
+                /* secondary guest hasn't ack the data, don't send
+                 * out this packet
+                 */
+                return false;
+            }
+        }
+    } else {
+        /* primary packet is longer than secondary packet, compare
+         * the same part and mark the primary packet offset
+         */
+        if (colo_compare_packet_payload(ppkt, spkt,
+                                        ppkt->header_size + ppkt->offset,
+                                        spkt->header_size + spkt->offset,
+                                        spkt->payload_size - spkt->offset)) {
+            *mark = COLO_COMPARE_FREE_SECONDARY;
+            ppkt->offset += spkt->payload_size - spkt->offset;
+            return true;
+        }
+    }
 
-    trace_colo_compare_main("compare tcp");
+    return false;
+}
 
-    ptcp = (struct tcphdr *)ppkt->transport_header;
-    stcp = (struct tcphdr *)spkt->transport_header;
+static void colo_compare_tcp(CompareState *s, Connection *conn)
+{
+    Packet *ppkt = NULL, *spkt = NULL;
+    int8_t mark;
 
     /*
-     * The 'identification' field in the IP header is *very* random
-     * it almost never matches.  Fudge this by ignoring differences in
-     * unfragmented packets; they'll normally sort themselves out if different
-     * anyway, and it should recover at the TCP level.
-     * An alternative would be to get both the primary and secondary to rewrite
-     * somehow; but that would need some sync traffic to sync the state
-     */
-    if (ntohs(ppkt->ip->ip_off) & IP_DF) {
-        spkt->ip->ip_id = ppkt->ip->ip_id;
-        /* and the sum will be different if the IDs were different */
-        spkt->ip->ip_sum = ppkt->ip->ip_sum;
+     * If ppkt and spkt have the same payload, but ppkt's ACK
+     * is greater than spkt's ACK, in this case we can not
+     * send the ppkt because it will cause the secondary guest
+     * to miss sending some data in the next. Therefore, we
+     * record the maximum ACK in the current queue at both
+     * primary side and secondary side. Only when the ack is
+     * less than the smaller of the two maximum ack, then we
+     * can ensure that the packet's payload is acknowledged by
+     * primary and secondary.
+    */
+    uint32_t min_ack = conn->pack > conn->sack ? conn->sack : conn->pack;
+
+pri:
+    if (g_queue_is_empty(&conn->primary_list)) {
+        return;
     }
+    ppkt = g_queue_pop_head(&conn->primary_list);
+sec:
+    if (g_queue_is_empty(&conn->secondary_list)) {
+        g_queue_push_head(&conn->primary_list, ppkt);
+        return;
+    }
+    spkt = g_queue_pop_head(&conn->secondary_list);
 
-    /*
-     * Check tcp header length for tcp option field.
-     * th_off > 5 means this tcp packet have options field.
-     * The tcp options maybe always different.
-     * for example:
-     * From RFC 7323.
-     * TCP Timestamps option (TSopt):
-     * Kind: 8
-     *
-     * Length: 10 bytes
-     *
-     *    +-------+-------+---------------------+---------------------+
-     *    |Kind=8 |  10   |   TS Value (TSval)  |TS Echo Reply (TSecr)|
-     *    +-------+-------+---------------------+---------------------+
-     *       1       1              4                     4
-     *
-     * In this case the primary guest's timestamp always different with
-     * the secondary guest's timestamp. COLO just focus on payload,
-     * so we just need skip this field.
-     */
+    if (ppkt->tcp_seq == ppkt->seq_end) {
+        colo_release_primary_pkt(s, ppkt);
+        ppkt = NULL;
+    }
 
-    ptrdiff_t ptcp_offset, stcp_offset;
+    if (ppkt && conn->compare_seq && !after(ppkt->seq_end, conn->compare_seq)) {
+        trace_colo_compare_main("pri: this packet has compared");
+        colo_release_primary_pkt(s, ppkt);
+        ppkt = NULL;
+    }
 
-    ptcp_offset = ppkt->transport_header - (uint8_t *)ppkt->data
-                  + (ptcp->th_off << 2) - ppkt->vnet_hdr_len;
-    stcp_offset = spkt->transport_header - (uint8_t *)spkt->data
-                  + (stcp->th_off << 2) - spkt->vnet_hdr_len;
-    if (ppkt->size - ptcp_offset == spkt->size - stcp_offset) {
-        res = colo_compare_packet_payload(ppkt, spkt,
-                                          ptcp_offset, stcp_offset,
-                                          ppkt->size - ptcp_offset);
+    if (spkt->tcp_seq == spkt->seq_end) {
+        packet_destroy(spkt, NULL);
+        if (!ppkt) {
+            goto pri;
+        } else {
+            goto sec;
+        }
     } else {
-        trace_colo_compare_main("TCP: payload size of packets are different");
-        res = -1;
+        if (conn->compare_seq && !after(spkt->seq_end, conn->compare_seq)) {
+            trace_colo_compare_main("sec: this packet has compared");
+            packet_destroy(spkt, NULL);
+            if (!ppkt) {
+                goto pri;
+            } else {
+                goto sec;
+            }
+        }
+        if (!ppkt) {
+            g_queue_push_head(&conn->secondary_list, spkt);
+            goto pri;
+        }
     }
 
-    if (res != 0 &&
-        trace_event_get_state_backends(TRACE_COLO_COMPARE_MISCOMPARE)) {
-        char pri_ip_src[20], pri_ip_dst[20], sec_ip_src[20], sec_ip_dst[20];
-
-        strcpy(pri_ip_src, inet_ntoa(ppkt->ip->ip_src));
-        strcpy(pri_ip_dst, inet_ntoa(ppkt->ip->ip_dst));
-        strcpy(sec_ip_src, inet_ntoa(spkt->ip->ip_src));
-        strcpy(sec_ip_dst, inet_ntoa(spkt->ip->ip_dst));
-
-        trace_colo_compare_ip_info(ppkt->size, pri_ip_src,
-                                   pri_ip_dst, spkt->size,
-                                   sec_ip_src, sec_ip_dst);
-
-        trace_colo_compare_tcp_info("pri tcp packet",
-                                    ntohl(ptcp->th_seq),
-                                    ntohl(ptcp->th_ack),
-                                    res, ptcp->th_flags,
-                                    ppkt->size);
-
-        trace_colo_compare_tcp_info("sec tcp packet",
-                                    ntohl(stcp->th_seq),
-                                    ntohl(stcp->th_ack),
-                                    res, stcp->th_flags,
-                                    spkt->size);
+    if (colo_mark_tcp_pkt(ppkt, spkt, &mark, min_ack)) {
+        trace_colo_compare_tcp_info("pri",
+                                    ppkt->tcp_seq, ppkt->tcp_ack,
+                                    ppkt->header_size, ppkt->payload_size,
+                                    ppkt->offset, ppkt->flags);
+
+        trace_colo_compare_tcp_info("sec",
+                                    spkt->tcp_seq, spkt->tcp_ack,
+                                    spkt->header_size, spkt->payload_size,
+                                    spkt->offset, spkt->flags);
+
+        if (mark == COLO_COMPARE_FREE_PRIMARY) {
+            conn->compare_seq = ppkt->seq_end;
+            colo_release_primary_pkt(s, ppkt);
+            g_queue_push_head(&conn->secondary_list, spkt);
+            goto pri;
+        }
+        if (mark == COLO_COMPARE_FREE_SECONDARY) {
+            conn->compare_seq = spkt->seq_end;
+            packet_destroy(spkt, NULL);
+            goto sec;
+        }
+        if (mark == (COLO_COMPARE_FREE_PRIMARY | COLO_COMPARE_FREE_SECONDARY)) {
+            conn->compare_seq = ppkt->seq_end;
+            colo_release_primary_pkt(s, ppkt);
+            packet_destroy(spkt, NULL);
+            goto pri;
+        }
+    } else {
+        g_queue_push_head(&conn->primary_list, ppkt);
+        g_queue_push_head(&conn->secondary_list, spkt);
 
         qemu_hexdump((char *)ppkt->data, stderr,
                      "colo-compare ppkt", ppkt->size);
         qemu_hexdump((char *)spkt->data, stderr,
                      "colo-compare spkt", spkt->size);
-    }
 
-    return res;
+        /*
+         * colo_compare_inconsistent_notify();
+         * TODO: notice to checkpoint();
+         */
+    }
 }
 
+
 /*
  * Called from the compare thread on the primary
  * for compare udp packet
@@ -XXX,XX +XXX,XX @@ static void colo_old_packet_check(void *opaque)
                         (GCompareFunc)colo_old_packet_check_one_conn);
 }
 
-/*
- * Called from the compare thread on the primary
- * for compare packet with secondary list of the
- * specified connection when a new packet was
- * queued to it.
- */
-static void colo_compare_connection(void *opaque, void *user_data)
+static void colo_compare_packet(CompareState *s, Connection *conn,
+                                int (*HandlePacket)(Packet *spkt,
+                                Packet *ppkt))
 {
-    CompareState *s = user_data;
-    Connection *conn = opaque;
     Packet *pkt = NULL;
     GList *result = NULL;
-    int ret;
 
     while (!g_queue_is_empty(&conn->primary_list) &&
            !g_queue_is_empty(&conn->secondary_list)) {
         pkt = g_queue_pop_head(&conn->primary_list);
-        switch (conn->ip_proto) {
-        case IPPROTO_TCP:
-            result = g_queue_find_custom(&conn->secondary_list,
-                     pkt, (GCompareFunc)colo_packet_compare_tcp);
-            break;
-        case IPPROTO_UDP:
-            result = g_queue_find_custom(&conn->secondary_list,
-                     pkt, (GCompareFunc)colo_packet_compare_udp);
-            break;
-        case IPPROTO_ICMP:
-            result = g_queue_find_custom(&conn->secondary_list,
-                     pkt, (GCompareFunc)colo_packet_compare_icmp);
-            break;
-        default:
-            result = g_queue_find_custom(&conn->secondary_list,
-                     pkt, (GCompareFunc)colo_packet_compare_other);
-            break;
-        }
+        result = g_queue_find_custom(&conn->secondary_list,
+                 pkt, (GCompareFunc)HandlePacket);
 
         if (result) {
-            ret = compare_chr_send(s,
-                                   pkt->data,
-                                   pkt->size,
-                                   pkt->vnet_hdr_len);
-            if (ret < 0) {
-                error_report("colo_send_primary_packet failed");
-            }
-            trace_colo_compare_main("packet same and release packet");
+            colo_release_primary_pkt(s, pkt);
             g_queue_remove(&conn->secondary_list, result->data);
-            packet_destroy(pkt, NULL);
         } else {
             /*
              * If one packet arrive late, the secondary_list or
@@ -XXX,XX +XXX,XX @@ static void colo_compare_connection(void *opaque, void *user_data)
     }
 }
 
+/*
+ * Called from the compare thread on the primary
+ * for compare packet with secondary list of the
+ * specified connection when a new packet was
+ * queued to it.
+ */
+static void colo_compare_connection(void *opaque, void *user_data)
+{
+    CompareState *s = user_data;
+    Connection *conn = opaque;
+
+    switch (conn->ip_proto) {
+    case IPPROTO_TCP:
+        colo_compare_tcp(s, conn);
+        break;
+    case IPPROTO_UDP:
+        colo_compare_packet(s, conn, colo_packet_compare_udp);
+        break;
+    case IPPROTO_ICMP:
+        colo_compare_packet(s, conn, colo_packet_compare_icmp);
+        break;
+    default:
+        colo_compare_packet(s, conn, colo_packet_compare_other);
+        break;
+    }
+}
+
 static int compare_chr_send(CompareState *s,
                             const uint8_t *buf,
                             uint32_t size,
diff --git a/net/colo.c b/net/colo.c
index XXXXXXX..XXXXXXX 100644
--- a/net/colo.c
+++ b/net/colo.c
@@ -XXX,XX +XXX,XX @@ Connection *connection_new(ConnectionKey *key)
     conn->processing = false;
     conn->offset = 0;
     conn->syn_flag = 0;
+    conn->pack = 0;
+    conn->sack = 0;
     g_queue_init(&conn->primary_list);
     g_queue_init(&conn->secondary_list);
 
@@ -XXX,XX +XXX,XX @@ Packet *packet_new(const void *data, int size, int vnet_hdr_len)
     pkt->size = size;
     pkt->creation_ms = qemu_clock_get_ms(QEMU_CLOCK_HOST);
     pkt->vnet_hdr_len = vnet_hdr_len;
+    pkt->tcp_seq = 0;
+    pkt->tcp_ack = 0;
+    pkt->seq_end = 0;
+    pkt->header_size = 0;
+    pkt->payload_size = 0;
+    pkt->offset = 0;
+    pkt->flags = 0;
 
     return pkt;
 }
diff --git a/net/colo.h b/net/colo.h
index XXXXXXX..XXXXXXX 100644
--- a/net/colo.h
+++ b/net/colo.h
@@ -XXX,XX +XXX,XX @@ typedef struct Packet {
     int64_t creation_ms;
     /* Get vnet_hdr_len from filter */
     uint32_t vnet_hdr_len;
+    uint32_t tcp_seq; /* sequence number */
+    uint32_t tcp_ack; /* acknowledgement number */
+    /* the sequence number of the last byte of the packet */
+    uint32_t seq_end;
+    uint8_t header_size;  /* the header length */
+    uint16_t payload_size; /* the payload length */
+    /* record the payload offset(the length that has been compared) */
+    uint16_t offset;
+    uint8_t flags; /* Flags(aka Control bits) */
 } Packet;
 
 typedef struct ConnectionKey {
@@ -XXX,XX +XXX,XX @@ typedef struct Connection {
     /* flag to enqueue unprocessed_connections */
     bool processing;
     uint8_t ip_proto;
+    /* record the sequence number that has been compared */
+    uint32_t compare_seq;
+    /* the maximum of acknowledgement number in primary_list queue */
+    uint32_t pack;
+    /* the maximum of acknowledgement number in secondary_list queue */
+    uint32_t sack;
     /* offset = secondary_seq - primary_seq */
     tcp_seq  offset;
     /*
diff --git a/net/trace-events b/net/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/net/trace-events
+++ b/net/trace-events
@@ -XXX,XX +XXX,XX @@ colo_compare_icmp_miscompare(const char *sta, int size) ": %s = %d"
 colo_compare_ip_info(int psize, const char *sta, const char *stb, int ssize, const char *stc, const char *std) "ppkt size = %d, ip_src = %s, ip_dst = %s, spkt size = %d, ip_src = %s, ip_dst = %s"
 colo_old_packet_check_found(int64_t old_time) "%" PRId64
 colo_compare_miscompare(void) ""
-colo_compare_tcp_info(const char *pkt, uint32_t seq, uint32_t ack, int res, uint32_t flag, int size) "side: %s seq/ack= %u/%u res= %d flags= 0x%x pkt_size: %d\n"
+colo_compare_tcp_info(const char *pkt, uint32_t seq, uint32_t ack, int hdlen, int pdlen, int offset, int flags) "%s: seq/ack= %u/%u hdlen= %d pdlen= %d offset= %d flags=%d\n"
 
 # net/filter-rewriter.c
 colo_filter_rewriter_debug(void) ""
-- 
2.7.4

From: Thomas Huth <thuth@redhat.com>

QEMU can emulate hubs to connect NICs and netdevs. This is currently
primarily used for the mis-named 'vlan' feature of the networking
subsystem. Now the 'vlan' feature has been marked as deprecated, since
its name is rather confusing and the users often rather mis-configure
their network when trying to use it. But while the 'vlan' parameter
should be removed at one point in time, the basic idea of emulating
a hub in QEMU is still good: It's useful for bundling up the output of
multiple NICs into one single l2tp netdev for example.

Now to be able to use the hubport feature without 'vlan's, there is one
missing piece: The possibility to connect a hubport to a netdev, too.
This patch adds this possibility by introducing a new "netdev=..."
parameter to the hubports.

To bundle up the output of multiple NICs into one socket netdev, you can
now run QEMU with these parameters for example:

qemu-system-ppc64 ... -netdev socket,id=s1,connect=:11122 \
    -netdev hubport,hubid=1,id=h1,netdev=s1 \
    -netdev hubport,hubid=1,id=h2 -device e1000,netdev=h2 \
    -netdev hubport,hubid=1,id=h3 -device virtio-net-pci,netdev=h3

For using the socket netdev, you have got to start another QEMU as the
receiving side first, for example with network dumping enabled:

qemu-system-x86_64 -M isapc -netdev socket,id=s0,listen=:11122 \
    -device ne2k_isa,netdev=s0 \
    -object filter-dump,id=f1,netdev=s0,file=/tmp/dump.dat

After the ppc64 guest tried to boot from both NICs, you can see in the
dump file (using Wireshark, for example), that the output of both NICs
(the e1000 and the virtio-net-pci) has been successfully transfered
via the socket netdev in this case.

Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/hub.c       | 27 +++++++++++++++++++++------
 net/hub.h       |  3 ++-
 net/net.c       |  2 +-
 qapi/net.json   |  4 +++-
 qemu-options.hx |  8 +++++---
 5 files changed, 32 insertions(+), 12 deletions(-)

diff --git a/net/hub.c b/net/hub.c
index XXXXXXX..XXXXXXX 100644
--- a/net/hub.c
+++ b/net/hub.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
+#include "qapi/error.h"
 #include "monitor/monitor.h"
 #include "net/net.h"
 #include "clients.h"
@@ -XXX,XX +XXX,XX @@ static NetClientInfo net_hub_port_info = {
     .cleanup = net_hub_port_cleanup,
 };
 
-static NetHubPort *net_hub_port_new(NetHub *hub, const char *name)
+static NetHubPort *net_hub_port_new(NetHub *hub, const char *name,
+                                    NetClientState *hubpeer)
 {
     NetClientState *nc;
     NetHubPort *port;
@@ -XXX,XX +XXX,XX @@ static NetHubPort *net_hub_port_new(NetHub *hub, const char *name)
         name = default_name;
     }
 
-    nc = qemu_new_net_client(&net_hub_port_info, NULL, "hub", name);
+    nc = qemu_new_net_client(&net_hub_port_info, hubpeer, "hub", name);
     port = DO_UPCAST(NetHubPort, nc, nc);
     port->id = id;
     port->hub = hub;
@@ -XXX,XX +XXX,XX @@ static NetHubPort *net_hub_port_new(NetHub *hub, const char *name)
 
 /**
  * Create a port on a given hub
+ * @hub_id: Number of the hub
  * @name: Net client name or NULL for default name.
+ * @hubpeer: Peer to use (if "netdev=id" has been specified)
  *
  * If there is no existing hub with the given id then a new hub is created.
  */
-NetClientState *net_hub_add_port(int hub_id, const char *name)
+NetClientState *net_hub_add_port(int hub_id, const char *name,
+                                 NetClientState *hubpeer)
 {
     NetHub *hub;
     NetHubPort *port;
@@ -XXX,XX +XXX,XX @@ NetClientState *net_hub_add_port(int hub_id, const char *name)
         hub = net_hub_new(hub_id);
     }
 
-    port = net_hub_port_new(hub, name);
+    port = net_hub_port_new(hub, name, hubpeer);
     return &port->nc;
 }
 
@@ -XXX,XX +XXX,XX @@ NetClientState *net_hub_port_find(int hub_id)
         }
     }
 
-    nc = net_hub_add_port(hub_id, NULL);
+    nc = net_hub_add_port(hub_id, NULL, NULL);
     return nc;
 }
 
@@ -XXX,XX +XXX,XX @@ int net_init_hubport(const Netdev *netdev, const char *name,
                      NetClientState *peer, Error **errp)
 {
     const NetdevHubPortOptions *hubport;
+    NetClientState *hubpeer = NULL;
 
     assert(netdev->type == NET_CLIENT_DRIVER_HUBPORT);
     assert(!peer);
     hubport = &netdev->u.hubport;
 
-    net_hub_add_port(hubport->hubid, name);
+    if (hubport->has_netdev) {
+        hubpeer = qemu_find_netdev(hubport->netdev);
+        if (!hubpeer) {
+            error_setg(errp, "netdev '%s' not found", hubport->netdev);
+            return -1;
+        }
+    }
+
+    net_hub_add_port(hubport->hubid, name, hubpeer);
+
     return 0;
 }
 
diff --git a/net/hub.h b/net/hub.h
index XXXXXXX..XXXXXXX 100644
--- a/net/hub.h
+++ b/net/hub.h
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu-common.h"
 
-NetClientState *net_hub_add_port(int hub_id, const char *name);
+NetClientState *net_hub_add_port(int hub_id, const char *name,
+                                 NetClientState *hubpeer);
 NetClientState *net_hub_find_client_by_name(int hub_id, const char *name);
 void net_hub_info(Monitor *mon);
 void net_hub_check_clients(void);
diff --git a/net/net.c b/net/net.c
index XXXXXXX..XXXXXXX 100644
--- a/net/net.c
+++ b/net/net.c
@@ -XXX,XX +XXX,XX @@ static int net_client_init1(const void *object, bool is_netdev, Error **errp)
         /* Do not add to a vlan if it's a nic with a netdev= parameter. */
         if (netdev->type != NET_CLIENT_DRIVER_NIC ||
             !opts->u.nic.has_netdev) {
-            peer = net_hub_add_port(net->has_vlan ? net->vlan : 0, NULL);
+            peer = net_hub_add_port(net->has_vlan ? net->vlan : 0, NULL, NULL);
         }
 
         if (net->has_vlan && !vlan_warned) {
diff --git a/qapi/net.json b/qapi/net.json
index XXXXXXX..XXXXXXX 100644
--- a/qapi/net.json
+++ b/qapi/net.json
@@ -XXX,XX +XXX,XX @@
 # Connect two or more net clients through a software hub.
 #
 # @hubid: hub identifier number
+# @netdev: used to connect hub to a netdev instead of a device (since 2.12)
 #
 # Since: 1.2
 ##
 { 'struct': 'NetdevHubPortOptions',
   'data': {
-    'hubid':     'int32' } }
+    'hubid':     'int32',
+    '*netdev':    'str' } }
 
 ##
 # @NetdevNetmapOptions:
diff --git a/qemu-options.hx b/qemu-options.hx
index XXXXXXX..XXXXXXX 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -XXX,XX +XXX,XX @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev,
 #endif
     "-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]\n"
     "                configure a vhost-user network, backed by a chardev 'dev'\n"
-    "-netdev hubport,id=str,hubid=n\n"
+    "-netdev hubport,id=str,hubid=n[,netdev=nd]\n"
     "                configure a hub port on QEMU VLAN 'n'\n", QEMU_ARCH_ALL)
 DEF("net", HAS_ARG, QEMU_OPTION_net,
     "-net nic[,vlan=n][,netdev=nd][,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]\n"
@@ -XXX,XX +XXX,XX @@ vde_switch -F -sock /tmp/myswitch
 qemu-system-i386 linux.img -net nic -net vde,sock=/tmp/myswitch
 @end example
 
-@item -netdev hubport,id=@var{id},hubid=@var{hubid}
+@item -netdev hubport,id=@var{id},hubid=@var{hubid}[,netdev=@var{nd}]
 
 Create a hub port on QEMU "vlan" @var{hubid}.
 
 The hubport netdev lets you connect a NIC to a QEMU "vlan" instead of a single
 netdev.  @code{-net} and @code{-device} with parameter @option{vlan} create the
-required hub automatically.
+required hub automatically. Alternatively, you can also connect the hubport
+to another netdev with ID @var{nd} by using the @option{netdev=@var{nd}}
+option.
 
 @item -netdev vhost-user,chardev=@var{id}[,vhostforce=on|off][,queues=n]
 
-- 
2.7.4

From: Thomas Huth <thuth@redhat.com>

It does not make much sense to limit these commands to the legacy 'vlan'
concept only, they should work with the modern netdevs, too. So now
it is possible to use this command with one, two or three parameters.

With one parameter, the command installs a hostfwd rule on the default
"user" network:
    hostfwd_add tcp:...

With two parameters, the command installs a hostfwd rule on a netdev
(that's the new way of using this command):
    hostfwd_add netdev_id tcp:...

With three parameters, the command installs a rule on a 'vlan' (aka hub):
    hostfwd_add hub_id name tcp:...

Same applies to the hostfwd_remove command now.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hmp-commands.hx |  4 ++--
 net/slirp.c     | 33 +++++++++++++++++++++++----------
 2 files changed, 25 insertions(+), 12 deletions(-)

diff --git a/hmp-commands.hx b/hmp-commands.hx
index XXXXXXX..XXXXXXX 100644
--- a/hmp-commands.hx
+++ b/hmp-commands.hx
@@ -XXX,XX +XXX,XX @@ ETEXI
     {
         .name       = "hostfwd_add",
         .args_type  = "arg1:s,arg2:s?,arg3:s?",
-        .params     = "[vlan_id name] [tcp|udp]:[hostaddr]:hostport-[guestaddr]:guestport",
+        .params     = "[hub_id name]|[netdev_id] [tcp|udp]:[hostaddr]:hostport-[guestaddr]:guestport",
         .help       = "redirect TCP or UDP connections from host to guest (requires -net user)",
         .cmd        = hmp_hostfwd_add,
     },
@@ -XXX,XX +XXX,XX @@ ETEXI
     {
         .name       = "hostfwd_remove",
         .args_type  = "arg1:s,arg2:s?,arg3:s?",
-        .params     = "[vlan_id name] [tcp|udp]:[hostaddr]:hostport",
+        .params     = "[hub_id name]|[netdev_id] [tcp|udp]:[hostaddr]:hostport",
         .help       = "remove host-to-guest TCP or UDP redirection",
         .cmd        = hmp_hostfwd_remove,
     },
diff --git a/net/slirp.c b/net/slirp.c
index XXXXXXX..XXXXXXX 100644
--- a/net/slirp.c
+++ b/net/slirp.c
@@ -XXX,XX +XXX,XX @@ error:
     return -1;
 }
 
-static SlirpState *slirp_lookup(Monitor *mon, const char *vlan,
-                                const char *stack)
+static SlirpState *slirp_lookup(Monitor *mon, const char *hub_id,
+                                const char *name)
 {
-
-    if (vlan) {
+    if (name) {
         NetClientState *nc;
-        nc = net_hub_find_client_by_name(strtol(vlan, NULL, 0), stack);
-        if (!nc) {
-            monitor_printf(mon, "unrecognized (vlan-id, stackname) pair\n");
-            return NULL;
+        if (hub_id) {
+            nc = net_hub_find_client_by_name(strtol(hub_id, NULL, 0), name);
+            if (!nc) {
+                monitor_printf(mon, "unrecognized (vlan-id, stackname) pair\n");
+                return NULL;
+            }
+        } else {
+            nc = qemu_find_netdev(name);
+            if (!nc) {
+                monitor_printf(mon, "unrecognized netdev id '%s'\n", name);
+                return NULL;
+            }
         }
         if (strcmp(nc->model, "user")) {
             monitor_printf(mon, "invalid device specified\n");
@@ -XXX,XX +XXX,XX @@ void hmp_hostfwd_remove(Monitor *mon, const QDict *qdict)
     const char *arg2 = qdict_get_try_str(qdict, "arg2");
     const char *arg3 = qdict_get_try_str(qdict, "arg3");
 
-    if (arg2) {
+    if (arg3) {
         s = slirp_lookup(mon, arg1, arg2);
         src_str = arg3;
+    } else if (arg2) {
+        s = slirp_lookup(mon, NULL, arg1);
+        src_str = arg2;
     } else {
         s = slirp_lookup(mon, NULL, NULL);
         src_str = arg1;
@@ -XXX,XX +XXX,XX @@ void hmp_hostfwd_add(Monitor *mon, const QDict *qdict)
     const char *arg2 = qdict_get_try_str(qdict, "arg2");
     const char *arg3 = qdict_get_try_str(qdict, "arg3");
 
-    if (arg2) {
+    if (arg3) {
         s = slirp_lookup(mon, arg1, arg2);
         redir_str = arg3;
+    } else if (arg2) {
+        s = slirp_lookup(mon, NULL, arg1);
+        redir_str = arg2;
     } else {
         s = slirp_lookup(mon, NULL, NULL);
         redir_str = arg1;
-- 
2.7.4

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

gently asked by his automatic reply :)

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 MAINTAINERS | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: hw/scsi/mfi.h
 F: tests/megasas-test.c
 
 Network packet abstractions
-M: Dmitry Fleytman <dmitry@daynix.com>
+M: Dmitry Fleytman <dmitry.fleytman@gmail.com>
 S: Maintained
 F: include/net/eth.h
 F: net/eth.c
@@ -XXX,XX +XXX,XX @@ F: hw/net/net_rx_pkt*
 F: hw/net/net_tx_pkt*
 
 Vmware
-M: Dmitry Fleytman <dmitry@daynix.com>
+M: Dmitry Fleytman <dmitry.fleytman@gmail.com>
 S: Maintained
 F: hw/net/vmxnet*
 F: hw/scsi/vmw_pvscsi*
@@ -XXX,XX +XXX,XX @@ F: hw/mem/nvdimm.c
 F: include/hw/mem/nvdimm.h
 
 e1000x
-M: Dmitry Fleytman <dmitry@daynix.com>
+M: Dmitry Fleytman <dmitry.fleytman@gmail.com>
 S: Maintained
 F: hw/net/e1000x*
 
 e1000e
-M: Dmitry Fleytman <dmitry@daynix.com>
+M: Dmitry Fleytman <dmitry.fleytman@gmail.com>
 S: Maintained
 F: hw/net/e1000e*
 
-- 
2.7.4

The following changes since commit f670b3eec7f5d1ed8c4573ef244e7b8c6b32001b:

Merge tag 'migration-20230213-pull-request' of https://gitlab.com/juan.quintela/qemu into staging (2023-02-13 11:54:05 +0000)

are available in the git repository at:

https://github.com/jasowang/qemu.git tags/net-pull-request

for you to fetch changes up to e4b953a26da11d214f91516cb9b0542eab5afaa0:

vdpa: fix VHOST_BACKEND_F_IOTLB_ASID flag check (2023-02-14 14:00:30 +0800)

----------------------------------------------------------------

----------------------------------------------------------------
Christian Svensson (1):
      net: Increase L2TPv3 buffer to fit jumboframes

Eugenio Pérez (1):
      vdpa: fix VHOST_BACKEND_F_IOTLB_ASID flag check

Fiona Ebner (1):
      hw/net/vmxnet3: allow VMXNET3_MAX_MTU itself as a value

Joelle van Dyne (1):
      vmnet: stop recieving events when VM is stopped

Laurent Vivier (1):
      net: stream: add a new option to automatically reconnect

Qiang Liu (2):
      hw/net/lan9118: log [read|write]b when mode_16bit is enabled rather than abort
      hw/net/can/xlnx-zynqmp-can: fix assertion failures in transfer_fifo()

Thomas Huth (3):
      net: Move the code to collect available NIC models to a separate function
      net: Restore printing of the help text with "-nic help"
      net: Replace "Supported NIC models" with "Available NIC models"

From: Thomas Huth <thuth@redhat.com>

The code that collects the available NIC models is not really specific
to PCI anymore and will be required in the next patch, too, so let's
move this into a new separate function in net.c instead.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/pci/pci.c      | 29 +----------------------------
 include/net/net.h | 14 ++++++++++++++
 net/net.c         | 34 ++++++++++++++++++++++++++++++++++
 3 files changed, 49 insertions(+), 28 deletions(-)

diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -XXX,XX +XXX,XX @@ PCIDevice *pci_nic_init_nofail(NICInfo *nd, PCIBus *rootbus,
                                const char *default_devaddr)
 {
     const char *devaddr = nd->devaddr ? nd->devaddr : default_devaddr;
-    GSList *list;
     GPtrArray *pci_nic_models;
     PCIBus *bus;
     PCIDevice *pci_dev;
@@ -XXX,XX +XXX,XX @@ PCIDevice *pci_nic_init_nofail(NICInfo *nd, PCIBus *rootbus,
         nd->model = g_strdup("virtio-net-pci");
     }
 
-    list = object_class_get_list_sorted(TYPE_PCI_DEVICE, false);
-    pci_nic_models = g_ptr_array_new();
-    while (list) {
-        DeviceClass *dc = OBJECT_CLASS_CHECK(DeviceClass, list->data,
-                                             TYPE_DEVICE);
-        GSList *next;
-        if (test_bit(DEVICE_CATEGORY_NETWORK, dc->categories) &&
-            dc->user_creatable) {
-            const char *name = object_class_get_name(list->data);
-            /*
-             * A network device might also be something else than a NIC, see
-             * e.g. the "rocker" device. Thus we have to look for the "netdev"
-             * property, too. Unfortunately, some devices like virtio-net only
-             * create this property during instance_init, so we have to create
-             * a temporary instance here to be able to check it.
-             */
-            Object *obj = object_new_with_class(OBJECT_CLASS(dc));
-            if (object_property_find(obj, "netdev")) {
-                g_ptr_array_add(pci_nic_models, (gpointer)name);
-            }
-            object_unref(obj);
-        }
-        next = list->next;
-        g_slist_free_1(list);
-        list = next;
-    }
-    g_ptr_array_add(pci_nic_models, NULL);
+    pci_nic_models = qemu_get_nic_models(TYPE_PCI_DEVICE);
 
     if (qemu_show_nic_models(nd->model, (const char **)pci_nic_models->pdata)) {
         exit(0);
diff --git a/include/net/net.h b/include/net/net.h
index XXXXXXX..XXXXXXX 100644
--- a/include/net/net.h
+++ b/include/net/net.h
@@ -XXX,XX +XXX,XX @@ void net_socket_rs_init(SocketReadState *rs,
                         bool vnet_hdr);
 NetClientState *qemu_get_peer(NetClientState *nc, int queue_index);
 
+/**
+ * qemu_get_nic_models:
+ * @device_type: Defines which devices should be taken into consideration
+ *               (e.g. TYPE_DEVICE for all devices, or TYPE_PCI_DEVICE for PCI)
+ *
+ * Get an array of pointers to names of NIC devices that are available in
+ * the QEMU binary. The array is terminated with a NULL pointer entry.
+ * The caller is responsible for freeing the memory when it is not required
+ * anymore, e.g. with g_ptr_array_free(..., true).
+ *
+ * Returns: Pointer to the array that contains the pointers to the names.
+ */
+GPtrArray *qemu_get_nic_models(const char *device_type);
+
 /* NIC info */
 
 #define MAX_NICS 8
diff --git a/net/net.c b/net/net.c
index XXXXXXX..XXXXXXX 100644
--- a/net/net.c
+++ b/net/net.c
@@ -XXX,XX +XXX,XX @@ static int nic_get_free_idx(void)
     return -1;
 }
 
+GPtrArray *qemu_get_nic_models(const char *device_type)
+{
+    GPtrArray *nic_models = g_ptr_array_new();
+    GSList *list = object_class_get_list_sorted(device_type, false);
+
+    while (list) {
+        DeviceClass *dc = OBJECT_CLASS_CHECK(DeviceClass, list->data,
+                                             TYPE_DEVICE);
+        GSList *next;
+        if (test_bit(DEVICE_CATEGORY_NETWORK, dc->categories) &&
+            dc->user_creatable) {
+            const char *name = object_class_get_name(list->data);
+            /*
+             * A network device might also be something else than a NIC, see
+             * e.g. the "rocker" device. Thus we have to look for the "netdev"
+             * property, too. Unfortunately, some devices like virtio-net only
+             * create this property during instance_init, so we have to create
+             * a temporary instance here to be able to check it.
+             */
+            Object *obj = object_new_with_class(OBJECT_CLASS(dc));
+            if (object_property_find(obj, "netdev")) {
+                g_ptr_array_add(nic_models, (gpointer)name);
+            }
+            object_unref(obj);
+        }
+        next = list->next;
+        g_slist_free_1(list);
+        list = next;
+    }
+    g_ptr_array_add(nic_models, NULL);
+
+    return nic_models;
+}
+
 int qemu_show_nic_models(const char *arg, const char *const *models)
 {
     int i;
-- 
2.7.4

From: Thomas Huth <thuth@redhat.com>

Running QEMU with "-nic help" used to work in QEMU 5.2 and earlier versions
(it showed the available netdev backends), but this feature got broken during
some refactoring in version 6.0. Let's restore the old behavior, and while
we're at it, let's also print the available NIC models here now since this
option can be used to configure both, netdev backend and model in one go.

Fixes: ad6f932fe8 ("net: do not exit on "netdev_add help" monitor command")
Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/net.c | 14 ++++++++++++--
 1 file changed, 12 insertions(+), 2 deletions(-)

diff --git a/net/net.c b/net/net.c
index XXXXXXX..XXXXXXX 100644
--- a/net/net.c
+++ b/net/net.c
@@ -XXX,XX +XXX,XX @@ static int net_param_nic(void *dummy, QemuOpts *opts, Error **errp)
     const char *type;
 
     type = qemu_opt_get(opts, "type");
-    if (type && g_str_equal(type, "none")) {
-        return 0;    /* Nothing to do, default_net is cleared in vl.c */
+    if (type) {
+        if (g_str_equal(type, "none")) {
+            return 0;    /* Nothing to do, default_net is cleared in vl.c */
+        }
+        if (is_help_option(type)) {
+            GPtrArray *nic_models = qemu_get_nic_models(TYPE_DEVICE);
+            show_netdevs();
+            printf("\n");
+            qemu_show_nic_models(type, (const char **)nic_models->pdata);
+            g_ptr_array_free(nic_models, true);
+            exit(0);
+        }
     }
 
     idx = nic_get_free_idx();
-- 
2.7.4

From: Qiang Liu <cyruscyliu@gmail.com>

This patch replaces hw_error to guest error log for [read|write]b
accesses when mode_16bit is enabled. This avoids aborting qemu.

Fixes: 1248f8d4cbc3 ("hw/lan9118: Add basic 16-bit mode support.")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1433
Reported-by: Qiang Liu <cyruscyliu@gmail.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Qiang Liu <cyruscyliu@gmail.com>
Suggested-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/lan9118.c | 17 ++++++++---------
 1 file changed, 8 insertions(+), 9 deletions(-)

diff --git a/hw/net/lan9118.c b/hw/net/lan9118.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/lan9118.c
+++ b/hw/net/lan9118.c
@@ -XXX,XX +XXX,XX @@
 #include "migration/vmstate.h"
 #include "net/net.h"
 #include "net/eth.h"
-#include "hw/hw.h"
 #include "hw/irq.h"
 #include "hw/net/lan9118.h"
 #include "hw/ptimer.h"
@@ -XXX,XX +XXX,XX @@
 #ifdef DEBUG_LAN9118
 #define DPRINTF(fmt, ...) \
 do { printf("lan9118: " fmt , ## __VA_ARGS__); } while (0)
-#define BADF(fmt, ...) \
-do { hw_error("lan9118: error: " fmt , ## __VA_ARGS__);} while (0)
 #else
 #define DPRINTF(fmt, ...) do {} while(0)
-#define BADF(fmt, ...) \
-do { fprintf(stderr, "lan9118: error: " fmt , ## __VA_ARGS__);} while (0)
 #endif
 
 /* The tx and rx fifo ports are a range of aliased 32-bit registers */
@@ -XXX,XX +XXX,XX @@ static uint32_t do_phy_read(lan9118_state *s, int reg)
     case 30: /* Interrupt mask */
         return s->phy_int_mask;
     default:
-        BADF("PHY read reg %d\n", reg);
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "do_phy_read: PHY read reg %d\n", reg);
         return 0;
     }
 }
@@ -XXX,XX +XXX,XX @@ static void do_phy_write(lan9118_state *s, int reg, uint32_t val)
         phy_update_irq(s);
         break;
     default:
-        BADF("PHY write reg %d = 0x%04x\n", reg, val);
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "do_phy_write: PHY write reg %d = 0x%04x\n", reg, val);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static void lan9118_16bit_mode_write(void *opaque, hwaddr offset,
         return;
     }
 
-    hw_error("lan9118_write: Bad size 0x%x\n", size);
+    qemu_log_mask(LOG_GUEST_ERROR,
+                  "lan9118_16bit_mode_write: Bad size 0x%x\n", size);
 }
 
 static uint64_t lan9118_readl(void *opaque, hwaddr offset,
@@ -XXX,XX +XXX,XX @@ static uint64_t lan9118_16bit_mode_read(void *opaque, hwaddr offset,
         return lan9118_readl(opaque, offset, size);
     }
 
-    hw_error("lan9118_read: Bad size 0x%x\n", size);
+    qemu_log_mask(LOG_GUEST_ERROR,
+                  "lan9118_16bit_mode_read: Bad size 0x%x\n", size);
     return 0;
 }
 
-- 
2.7.4

From: Fiona Ebner <f.ebner@proxmox.com>

Currently, VMXNET3_MAX_MTU itself (being 9000) is not considered a
valid value for the MTU, but a guest running ESXi 7.0 might try to
set it and fail the assert [0].

In the Linux kernel, dev->max_mtu itself is a valid value for the MTU
and for the vmxnet3 driver it's 9000, so a guest running Linux will
also fail the assert when trying to set an MTU of 9000.

VMXNET3_MAX_MTU and s->mtu don't seem to be used in relation to buffer
allocations/accesses, so allowing the upper limit itself as a value
should be fine.

[0]: https://forum.proxmox.com/threads/114011/

Fixes: d05dcd94ae ("net: vmxnet3: validate configuration values during activate (CVE-2021-20203)")
Signed-off-by: Fiona Ebner <f.ebner@proxmox.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/vmxnet3.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/vmxnet3.c
+++ b/hw/net/vmxnet3.c
@@ -XXX,XX +XXX,XX @@ static void vmxnet3_activate_device(VMXNET3State *s)
     vmxnet3_setup_rx_filtering(s);
     /* Cache fields from shared memory */
     s->mtu = VMXNET3_READ_DRV_SHARED32(d, s->drv_shmem, devRead.misc.mtu);
-    assert(VMXNET3_MIN_MTU <= s->mtu && s->mtu < VMXNET3_MAX_MTU);
+    assert(VMXNET3_MIN_MTU <= s->mtu && s->mtu <= VMXNET3_MAX_MTU);
     VMW_CFPRN("MTU is %u", s->mtu);
 
     s->max_rx_frags =
-- 
2.7.4

From: Joelle van Dyne <j@getutm.app>

When the VM is stopped using the HMP command "stop", soon the handler will
stop reading from the vmnet interface. This causes a flood of
`VMNET_INTERFACE_PACKETS_AVAILABLE` events to arrive and puts the host CPU
at 100%. We fix this by removing the event handler from vmnet when the VM
is no longer in a running state and restore it when we return to a running
state.

Signed-off-by: Joelle van Dyne <j@getutm.app>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/vmnet-common.m | 48 +++++++++++++++++++++++++++++++++++-------------
 net/vmnet_int.h    |  2 ++
 2 files changed, 37 insertions(+), 13 deletions(-)

diff --git a/net/vmnet-common.m b/net/vmnet-common.m
index XXXXXXX..XXXXXXX 100644
--- a/net/vmnet-common.m
+++ b/net/vmnet-common.m
@@ -XXX,XX +XXX,XX @@
 #include "clients.h"
 #include "qemu/error-report.h"
 #include "qapi/error.h"
+#include "sysemu/runstate.h"
 
 #include <vmnet/vmnet.h>
 #include <dispatch/dispatch.h>
@@ -XXX,XX +XXX,XX @@ static void vmnet_bufs_init(VmnetState *s)
     }
 }
 
+/**
+ * Called on state change to un-register/re-register handlers
+ */
+static void vmnet_vm_state_change_cb(void *opaque, bool running, RunState state)
+{
+    VmnetState *s = opaque;
+
+    if (running) {
+        vmnet_interface_set_event_callback(
+            s->vmnet_if,
+            VMNET_INTERFACE_PACKETS_AVAILABLE,
+            s->if_queue,
+            ^(interface_event_t event_id, xpc_object_t event) {
+                assert(event_id == VMNET_INTERFACE_PACKETS_AVAILABLE);
+                /*
+                 * This function is being called from a non qemu thread, so
+                 * we only schedule a BH, and do the rest of the io completion
+                 * handling from vmnet_send_bh() which runs in a qemu context.
+                 */
+                qemu_bh_schedule(s->send_bh);
+            });
+    } else {
+        vmnet_interface_set_event_callback(
+            s->vmnet_if,
+            VMNET_INTERFACE_PACKETS_AVAILABLE,
+            NULL,
+            NULL);
+    }
+}
 
 int vmnet_if_create(NetClientState *nc,
                     xpc_object_t if_desc,
@@ -XXX,XX +XXX,XX @@ int vmnet_if_create(NetClientState *nc,
     s->packets_send_current_pos = 0;
     s->packets_send_end_pos = 0;
 
-    vmnet_interface_set_event_callback(
-        s->vmnet_if,
-        VMNET_INTERFACE_PACKETS_AVAILABLE,
-        s->if_queue,
-        ^(interface_event_t event_id, xpc_object_t event) {
-            assert(event_id == VMNET_INTERFACE_PACKETS_AVAILABLE);
-            /*
-             * This function is being called from a non qemu thread, so
-             * we only schedule a BH, and do the rest of the io completion
-             * handling from vmnet_send_bh() which runs in a qemu context.
-             */
-            qemu_bh_schedule(s->send_bh);
-        });
+    vmnet_vm_state_change_cb(s, 1, RUN_STATE_RUNNING);
+
+    s->change = qemu_add_vm_change_state_handler(vmnet_vm_state_change_cb, s);
 
     return 0;
 }
@@ -XXX,XX +XXX,XX @@ void vmnet_cleanup_common(NetClientState *nc)
         return;
     }
 
+    vmnet_vm_state_change_cb(s, 0, RUN_STATE_SHUTDOWN);
+    qemu_del_vm_change_state_handler(s->change);
     if_stopped_sem = dispatch_semaphore_create(0);
     vmnet_stop_interface(
         s->vmnet_if,
diff --git a/net/vmnet_int.h b/net/vmnet_int.h
index XXXXXXX..XXXXXXX 100644
--- a/net/vmnet_int.h
+++ b/net/vmnet_int.h
@@ -XXX,XX +XXX,XX @@ typedef struct VmnetState {
     int packets_send_end_pos;
 
     struct iovec iov_buf[VMNET_PACKETS_LIMIT];
+
+    VMChangeStateEntry *change;
 } VmnetState;
 
 const char *vmnet_status_map_str(vmnet_return_t status);
-- 
2.7.4

From: Qiang Liu <cyruscyliu@gmail.com>

Check fifos before poping data from and pushing data into it.

Fixes: 98e5d7a2b726 ("hw/net/can: Introduce Xilinx ZynqMP CAN controller")
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1425
Resolves: https://gitlab.com/qemu-project/qemu/-/issues/1427
Reported-by: Qiang Liu <cyruscyliu@gmail.com>
Signed-off-by: Qiang Liu <cyruscyliu@gmail.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/can/xlnx-zynqmp-can.c | 9 ++++++++-
 1 file changed, 8 insertions(+), 1 deletion(-)

diff --git a/hw/net/can/xlnx-zynqmp-can.c b/hw/net/can/xlnx-zynqmp-can.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/can/xlnx-zynqmp-can.c
+++ b/hw/net/can/xlnx-zynqmp-can.c
@@ -XXX,XX +XXX,XX @@ static void transfer_fifo(XlnxZynqMPCANState *s, Fifo32 *fifo)
     }
 
     while (!fifo32_is_empty(fifo)) {
+        if (fifo32_num_used(fifo) < (4 * CAN_FRAME_SIZE)) {
+            g_autofree char *path = object_get_canonical_path(OBJECT(s));
+            qemu_log_mask(LOG_GUEST_ERROR, "%s: data left in the fifo is not"
+                          " enough for transfer.\n", path);
+            break;
+        }
         for (i = 0; i < CAN_FRAME_SIZE; i++) {
             data[i] = fifo32_pop(fifo);
         }
@@ -XXX,XX +XXX,XX @@ static void transfer_fifo(XlnxZynqMPCANState *s, Fifo32 *fifo)
              * acknowledged. The XlnxZynqMPCAN core receives any message
              * that it transmits.
              */
-            if (fifo32_is_full(&s->rx_fifo)) {
+            if (fifo32_is_full(&s->rx_fifo) ||
+                    (fifo32_num_free(&s->rx_fifo) < (4 * CAN_FRAME_SIZE))) {
                 ARRAY_FIELD_DP32(s->regs, INTERRUPT_STATUS_REGISTER, RXOFLW, 1);
             } else {
                 for (i = 0; i < CAN_FRAME_SIZE; i++) {
-- 
2.7.4

From: Laurent Vivier <lvivier@redhat.com>

In stream mode, if the server shuts down there is currently
no way to reconnect the client to a new server without removing
the NIC device and the netdev backend (or to reboot).

This patch introduces a reconnect option that specifies a delay
to try to reconnect with the same parameters.

Add a new test in qtest to test the reconnect option and the
connect/disconnect events.

Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/stream.c                |  53 ++++++++++++++++++++++-
 qapi/net.json               |   7 ++-
 qemu-options.hx             |   6 +--
 tests/qtest/netdev-socket.c | 101 ++++++++++++++++++++++++++++++++++++++++++++
 4 files changed, 162 insertions(+), 5 deletions(-)

diff --git a/net/stream.c b/net/stream.c
index XXXXXXX..XXXXXXX 100644
--- a/net/stream.c
+++ b/net/stream.c
@@ -XXX,XX +XXX,XX @@
 #include "io/channel-socket.h"
 #include "io/net-listener.h"
 #include "qapi/qapi-events-net.h"
+#include "qapi/qapi-visit-sockets.h"
+#include "qapi/clone-visitor.h"
 
 typedef struct NetStreamState {
     NetClientState nc;
@@ -XXX,XX +XXX,XX @@ typedef struct NetStreamState {
     guint ioc_write_tag;
     SocketReadState rs;
     unsigned int send_index;      /* number of bytes sent*/
+    uint32_t reconnect;
+    guint timer_tag;
+    SocketAddress *addr;
 } NetStreamState;
 
 static void net_stream_listen(QIONetListener *listener,
                               QIOChannelSocket *cioc,
                               void *opaque);
+static void net_stream_arm_reconnect(NetStreamState *s);
 
 static gboolean net_stream_writable(QIOChannel *ioc,
                                     GIOCondition condition,
@@ -XXX,XX +XXX,XX @@ static gboolean net_stream_send(QIOChannel *ioc,
         qemu_set_info_str(&s->nc, "%s", "");
 
         qapi_event_send_netdev_stream_disconnected(s->nc.name);
+        net_stream_arm_reconnect(s);
 
         return G_SOURCE_REMOVE;
     }
@@ -XXX,XX +XXX,XX @@ static gboolean net_stream_send(QIOChannel *ioc,
 static void net_stream_cleanup(NetClientState *nc)
 {
     NetStreamState *s = DO_UPCAST(NetStreamState, nc, nc);
+    if (s->timer_tag) {
+        g_source_remove(s->timer_tag);
+        s->timer_tag = 0;
+    }
+    if (s->addr) {
+        qapi_free_SocketAddress(s->addr);
+        s->addr = NULL;
+    }
     if (s->ioc) {
         if (QIO_CHANNEL_SOCKET(s->ioc)->fd != -1) {
             if (s->ioc_read_tag) {
@@ -XXX,XX +XXX,XX @@ static void net_stream_client_connected(QIOTask *task, gpointer opaque)
 error:
     object_unref(OBJECT(s->ioc));
     s->ioc = NULL;
+    net_stream_arm_reconnect(s);
+}
+
+static gboolean net_stream_reconnect(gpointer data)
+{
+    NetStreamState *s = data;
+    QIOChannelSocket *sioc;
+
+    s->timer_tag = 0;
+
+    sioc = qio_channel_socket_new();
+    s->ioc = QIO_CHANNEL(sioc);
+    qio_channel_socket_connect_async(sioc, s->addr,
+                                     net_stream_client_connected, s,
+                                     NULL, NULL);
+    return G_SOURCE_REMOVE;
+}
+
+static void net_stream_arm_reconnect(NetStreamState *s)
+{
+    if (s->reconnect && s->timer_tag == 0) {
+        s->timer_tag = g_timeout_add_seconds(s->reconnect,
+                                             net_stream_reconnect, s);
+    }
 }
 
 static int net_stream_client_init(NetClientState *peer,
                                   const char *model,
                                   const char *name,
                                   SocketAddress *addr,
+                                  uint32_t reconnect,
                                   Error **errp)
 {
     NetStreamState *s;
@@ -XXX,XX +XXX,XX @@ static int net_stream_client_init(NetClientState *peer,
     s->ioc = QIO_CHANNEL(sioc);
     s->nc.link_down = true;
 
+    s->reconnect = reconnect;
+    if (reconnect) {
+        s->addr = QAPI_CLONE(SocketAddress, addr);
+    }
     qio_channel_socket_connect_async(sioc, addr,
                                      net_stream_client_connected, s,
                                      NULL, NULL);
@@ -XXX,XX +XXX,XX @@ int net_init_stream(const Netdev *netdev, const char *name,
     sock = &netdev->u.stream;
 
     if (!sock->has_server || !sock->server) {
-        return net_stream_client_init(peer, "stream", name, sock->addr, errp);
+        return net_stream_client_init(peer, "stream", name, sock->addr,
+                                      sock->has_reconnect ? sock->reconnect : 0,
+                                      errp);
+    }
+    if (sock->has_reconnect) {
+        error_setg(errp, "'reconnect' option is incompatible with "
+                         "socket in server mode");
+        return -1;
     }
     return net_stream_server_init(peer, "stream", name, sock->addr, errp);
 }
diff --git a/qapi/net.json b/qapi/net.json
index XXXXXXX..XXXXXXX 100644
--- a/qapi/net.json
+++ b/qapi/net.json
@@ -XXX,XX +XXX,XX @@
 # @addr: socket address to listen on (server=true)
 #        or connect to (server=false)
 # @server: create server socket (default: false)
+# @reconnect: For a client socket, if a socket is disconnected,
+#             then attempt a reconnect after the given number of seconds.
+#             Setting this to zero disables this function. (default: 0)
+#             (since 8.0)
 #
 # Only SocketAddress types 'unix', 'inet' and 'fd' are supported.
 #
@@ -XXX,XX +XXX,XX @@
 { 'struct': 'NetdevStreamOptions',
   'data': {
     'addr':   'SocketAddress',
-    '*server': 'bool' } }
+    '*server': 'bool',
+    '*reconnect': 'uint32' } }
 
 ##
 # @NetdevDgramOptions:
diff --git a/qemu-options.hx b/qemu-options.hx
index XXXXXXX..XXXXXXX 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -XXX,XX +XXX,XX @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev,
     "-netdev socket,id=str[,fd=h][,udp=host:port][,localaddr=host:port]\n"
     "                configure a network backend to connect to another network\n"
     "                using an UDP tunnel\n"
-    "-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off]\n"
-    "-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off]\n"
-    "-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor\n"
+    "-netdev stream,id=str[,server=on|off],addr.type=inet,addr.host=host,addr.port=port[,to=maxport][,numeric=on|off][,keep-alive=on|off][,mptcp=on|off][,addr.ipv4=on|off][,addr.ipv6=on|off][,reconnect=seconds]\n"
+    "-netdev stream,id=str[,server=on|off],addr.type=unix,addr.path=path[,abstract=on|off][,tight=on|off][,reconnect=seconds]\n"
+    "-netdev stream,id=str[,server=on|off],addr.type=fd,addr.str=file-descriptor[,reconnect=seconds]\n"
     "                configure a network backend to connect to another network\n"
     "                using a socket connection in stream mode.\n"
     "-netdev dgram,id=str,remote.type=inet,remote.host=maddr,remote.port=port[,local.type=inet,local.host=addr]\n"
diff --git a/tests/qtest/netdev-socket.c b/tests/qtest/netdev-socket.c
index XXXXXXX..XXXXXXX 100644
--- a/tests/qtest/netdev-socket.c
+++ b/tests/qtest/netdev-socket.c
@@ -XXX,XX +XXX,XX @@
 #include <glib/gstdio.h>
 #include "../unit/socket-helpers.h"
 #include "libqtest.h"
+#include "qapi/qmp/qstring.h"
+#include "qemu/sockets.h"
+#include "qapi/qobject-input-visitor.h"
+#include "qapi/qapi-visit-sockets.h"
 
 #define CONNECTION_TIMEOUT    60
 
@@ -XXX,XX +XXX,XX @@ static void test_stream_inet_ipv4(void)
     qtest_quit(qts0);
 }
 
+static void wait_stream_connected(QTestState *qts, const char *id,
+                                  SocketAddress **addr)
+{
+    QDict *resp, *data;
+    QString *qstr;
+    QObject *obj;
+    Visitor *v = NULL;
+
+    resp = qtest_qmp_eventwait_ref(qts, "NETDEV_STREAM_CONNECTED");
+    g_assert_nonnull(resp);
+    data = qdict_get_qdict(resp, "data");
+    g_assert_nonnull(data);
+
+    qstr = qobject_to(QString, qdict_get(data, "netdev-id"));
+    g_assert_nonnull(data);
+
+    g_assert(!strcmp(qstring_get_str(qstr), id));
+
+    obj = qdict_get(data, "addr");
+
+    v = qobject_input_visitor_new(obj);
+    visit_type_SocketAddress(v, NULL, addr, NULL);
+    visit_free(v);
+    qobject_unref(resp);
+}
+
+static void wait_stream_disconnected(QTestState *qts, const char *id)
+{
+    QDict *resp, *data;
+    QString *qstr;
+
+    resp = qtest_qmp_eventwait_ref(qts, "NETDEV_STREAM_DISCONNECTED");
+    g_assert_nonnull(resp);
+    data = qdict_get_qdict(resp, "data");
+    g_assert_nonnull(data);
+
+    qstr = qobject_to(QString, qdict_get(data, "netdev-id"));
+    g_assert_nonnull(data);
+
+    g_assert(!strcmp(qstring_get_str(qstr), id));
+    qobject_unref(resp);
+}
+
+static void test_stream_inet_reconnect(void)
+{
+    QTestState *qts0, *qts1;
+    int port;
+    SocketAddress *addr;
+
+    port = inet_get_free_port(false);
+    qts0 = qtest_initf("-nodefaults -M none "
+                       "-netdev stream,id=st0,server=true,addr.type=inet,"
+                       "addr.ipv4=on,addr.ipv6=off,"
+                       "addr.host=127.0.0.1,addr.port=%d", port);
+
+    EXPECT_STATE(qts0, "st0: index=0,type=stream,\r\n", 0);
+
+    qts1 = qtest_initf("-nodefaults -M none "
+                       "-netdev stream,server=false,id=st0,addr.type=inet,"
+                       "addr.ipv4=on,addr.ipv6=off,reconnect=1,"
+                       "addr.host=127.0.0.1,addr.port=%d", port);
+
+    wait_stream_connected(qts0, "st0", &addr);
+    g_assert_cmpint(addr->type, ==, SOCKET_ADDRESS_TYPE_INET);
+    g_assert_cmpstr(addr->u.inet.host, ==, "127.0.0.1");
+    qapi_free_SocketAddress(addr);
+
+    /* kill server */
+    qtest_quit(qts0);
+
+    /* check client has been disconnected */
+    wait_stream_disconnected(qts1, "st0");
+
+    /* restart server */
+    qts0 = qtest_initf("-nodefaults -M none "
+                       "-netdev stream,id=st0,server=true,addr.type=inet,"
+                       "addr.ipv4=on,addr.ipv6=off,"
+                       "addr.host=127.0.0.1,addr.port=%d", port);
+
+    /* wait connection events*/
+    wait_stream_connected(qts0, "st0", &addr);
+    g_assert_cmpint(addr->type, ==, SOCKET_ADDRESS_TYPE_INET);
+    g_assert_cmpstr(addr->u.inet.host, ==, "127.0.0.1");
+    qapi_free_SocketAddress(addr);
+
+    wait_stream_connected(qts1, "st0", &addr);
+    g_assert_cmpint(addr->type, ==, SOCKET_ADDRESS_TYPE_INET);
+    g_assert_cmpstr(addr->u.inet.host, ==, "127.0.0.1");
+    g_assert_cmpint(atoi(addr->u.inet.port), ==, port);
+    qapi_free_SocketAddress(addr);
+
+    qtest_quit(qts1);
+    qtest_quit(qts0);
+}
+
 static void test_stream_inet_ipv6(void)
 {
     QTestState *qts0, *qts1;
@@ -XXX,XX +XXX,XX @@ int main(int argc, char **argv)
 #ifndef _WIN32
         qtest_add_func("/netdev/dgram/mcast", test_dgram_mcast);
 #endif
+        qtest_add_func("/netdev/stream/inet/reconnect",
+                       test_stream_inet_reconnect);
     }
     if (has_ipv6) {
         qtest_add_func("/netdev/stream/inet/ipv6", test_stream_inet_ipv6);
-- 
2.7.4

From: Eugenio Pérez <eperezma@redhat.com>

VHOST_BACKEND_F_IOTLB_ASID is the feature bit, not the bitmask. Since
the device under test also provided VHOST_BACKEND_F_IOTLB_MSG_V2 and
VHOST_BACKEND_F_IOTLB_BATCH, this went unnoticed.

Fixes: c1a1008685 ("vdpa: always start CVQ in SVQ mode if possible")
Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/vhost-vdpa.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index XXXXXXX..XXXXXXX 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -XXX,XX +XXX,XX @@ static int vhost_vdpa_net_cvq_start(NetClientState *nc)
             g_strerror(errno), errno);
         return -1;
     }
-    if (!(backend_features & VHOST_BACKEND_F_IOTLB_ASID) ||
+    if (!(backend_features & BIT_ULL(VHOST_BACKEND_F_IOTLB_ASID)) ||
         !vhost_vdpa_net_valid_svq_features(v->dev->features, NULL)) {
         return 0;
     }
-- 
2.7.4