Series comparison

-[Qemu-devel] [PULL 0/4] Net patches
+[PULL 0/5] Net patches
-The following changes since commit 409c241f887a38bb7a2ac12e34d3a8d73922a9a5:
+The following changes since commit 23895cbd82be95428e90168b12e925d0d3ca2f06:
-  Merge remote-tracking branch 'remotes/kraxel/tags/ui-20180614-pull-request' into staging (2018-06-14 14:04:14 +0100)
+  Merge remote-tracking branch 'remotes/awilliam/tags/vfio-update-20201123.0' into staging (2020-11-23 18:51:13 +0000)
 are available in the git repository at:
   https://github.com/jasowang/qemu.git tags/net-pull-request
-for you to fetch changes up to c67daf4a24442d1bb404a11a6a54dc45ea10f234:
+for you to fetch changes up to 9925990d01a92564af55f6f69d0f5f59b47609b1:
-  vhost-user: delete net client if necessary (2018-06-15 10:39:53 +0800)
+  net: Use correct default-path macro for downscript (2020-11-24 10:40:17 +0800)
 ----------------------------------------------------------------
 ----------------------------------------------------------------
-Brijesh Singh (1):
+Keqian Zhu (1):
-      tap: set vhostfd passed from qemu cli to non-blocking
+      net: Use correct default-path macro for downscript
-Jan Kiszka (1):
+Paolo Bonzini (1):
-      e1000e: Do not auto-clear ICR bits which aren't set in EIAC
+      net: do not exit on "netdev_add help" monitor command
-Lin Ma (1):
+Prasad J Pandit (1):
-      net: Fix a potential segfault
+      hw/net/e1000e: advance desc_offset in case of null descriptor
-linzhecheng (1):
+Yuri Benditovich (1):
-      vhost-user: delete net client if necessary
+      net: purge queued rx packets on queue deletion
- hw/net/e1000e_core.c | 4 ----
+yuanjungong (1):
- net/net.c            | 4 +++-
+      tap: fix a memory leak
- net/tap.c            | 2 ++
- net/vhost-user.c     | 3 +++
+ hw/net/e1000e_core.c |  8 +++---
-files changed, 8 insertions(+), 5 deletions(-)
+ include/net/net.h    |  1 +
  monitor/hmp-cmds.c   |  6 ++++
  net/net.c            | 80 +++++++++++++++++++++++++++-------------------------
  net/tap.c            |  5 +++-
 files changed, 57 insertions(+), 43 deletions(-)

-[Qemu-devel] [PULL 3/4] e1000e: Do not auto-clear ICR bits which aren't set in EIAC
+[PULL 1/5] hw/net/e1000e: advance desc_offset in case of null descriptor
-From: Jan Kiszka <jan.kiszka@siemens.com>
+From: Prasad J Pandit <pjp@fedoraproject.org>
-The spec does not justify clearing of any E1000_ICR_OTHER_CAUSES when
+While receiving packets via e1000e_write_packet_to_guest() routine,
-E1000_ICR_OTHER is set in EIAC. In fact, removing this code fixes the
+'desc_offset' is advanced only when RX descriptor is processed. And
-issue the Linux driver runs into since 4aea7a5c5e94 ("e1000e: Avoid
+RX descriptor is not processed if it has NULL buffer address.
-receiver overrun interrupt bursts") and was worked around by
+This may lead to an infinite loop condition. Increament 'desc_offset'
-d0bd3af99 ("e1000e: Remove Other from EIAC").
+to process next descriptor in the ring to avoid infinite loop.
-Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
+Reported-by: Cheol-woo Myung <330cjfdn@gmail.com>
 Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- hw/net/e1000e_core.c | 4 ----
+ hw/net/e1000e_core.c | 8 ++++----
-file changed, 4 deletions(-)
+file changed, 4 insertions(+), 4 deletions(-)
 diff --git a/hw/net/e1000e_core.c b/hw/net/e1000e_core.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/net/e1000e_core.c
 +++ b/hw/net/e1000e_core.c
-@@ -XXX,XX +XXX,XX @@ e1000e_msix_notify_one(E1000ECore *core, uint32_t cause, uint32_t int_cfg)
+@@ -XXX,XX +XXX,XX @@ e1000e_write_packet_to_guest(E1000ECore *core, struct NetRxPkt *pkt,
+                           (const char *) &fcs_pad, e1000x_fcs_len(core->mac));
-     effective_eiac = core->mac[EIAC] & cause;
+                 }
+             }
--    if (effective_eiac == E1000_ICR_OTHER) {
+-            desc_offset += desc_size;
--        effective_eiac |= E1000_ICR_OTHER_CAUSES;
+-            if (desc_offset >= total_size) {
--    }
+-                is_last = true;
--
+-            }
-     core->mac[ICR] &= ~effective_eiac;
+         } else { /* as per intel docs; skip descriptors with null buf addr */
+             trace_e1000e_rx_null_descriptor();
-     if (!(core->mac[CTRL_EXT] & E1000_CTRL_EXT_IAME)) {
+         }
 +        desc_offset += desc_size;
 +        if (desc_offset >= total_size) {
 +            is_last = true;
 +        }
          e1000e_write_rx_descr(core, desc, is_last ? core->rx_pkt : NULL,
                             rss_info, do_ps ? ps_hdr_len : 0, &bastate.written);
 --
 .7.4

-[Qemu-devel] [PULL 2/4] net: Fix a potential segfault
+[PULL 2/5] net: do not exit on "netdev_add help" monitor command
-From: Lin Ma <lma@suse.com>
+From: Paolo Bonzini <pbonzini@redhat.com>
-If user forgets to provide any backend types for '-netdev' in qemu CLI,
+"netdev_add help" is causing QEMU to exit because the code that
-It triggers seg fault.
+invokes show_netdevs is shared between CLI and HMP processing.
 Move the check to the callers so that exit(0) remains only
 in the CLI flow.
-e.g.
+"netdev_add help" is not fixed by this patch; that is left for
 later work.
-Expected:
+Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
 $ qemu -netdev id=net0
 qemu-system-x86_64: Parameter 'type' is missing
 Actual:
 $ qemu -netdev id=net0
 Segmentation fault (core dumped)
 Fixes: 547203ead4327 ("net: List available netdevs with "-netdev help")
 Reviewed-by: Thomas Huth <thuth@redhat.com>
 Cc: qemu-stable@nongnu.org
 Signed-off-by: Lin Ma <lma@suse.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- net/net.c | 4 +++-
+ include/net/net.h  |  1 +
-file changed, 3 insertions(+), 1 deletion(-)
+ monitor/hmp-cmds.c |  6 +++++
  net/net.c          | 68 +++++++++++++++++++++++++++---------------------------
 files changed, 41 insertions(+), 34 deletions(-)
+diff --git a/include/net/net.h b/include/net/net.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/net/net.h
++++ b/include/net/net.h
+@@ -XXX,XX +XXX,XX @@ extern const char *host_net_devices[];
+ /* from net.c */
+ int net_client_parse(QemuOptsList *opts_list, const char *str);
++void show_netdevs(void);
+ int net_init_clients(Error **errp);
+ void net_check_clients(void);
+ void net_cleanup(void);
+diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
+index XXXXXXX..XXXXXXX 100644
+--- a/monitor/hmp-cmds.c
++++ b/monitor/hmp-cmds.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/option.h"
+ #include "qemu/timer.h"
+ #include "qemu/sockets.h"
++#include "qemu/help_option.h"
+ #include "monitor/monitor-internal.h"
+ #include "qapi/error.h"
+ #include "qapi/clone-visitor.h"
+@@ -XXX,XX +XXX,XX @@ void hmp_netdev_add(Monitor *mon, const QDict *qdict)
+ {
+     Error *err = NULL;
+     QemuOpts *opts;
++    const char *type = qdict_get_try_str(qdict, "type");
++    if (type && is_help_option(type)) {
++        show_netdevs();
++        return;
++    }
+     opts = qemu_opts_from_qdict(qemu_find_opts("netdev"), qdict, &err);
+     if (err) {
+         goto out;
 diff --git a/net/net.c b/net/net.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/net.c
 +++ b/net/net.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/config-file.h"
+ #include "qemu/ctype.h"
+ #include "qemu/iov.h"
++#include "qemu/qemu-print.h"
+ #include "qemu/main-loop.h"
+ #include "qemu/option.h"
+ #include "qapi/error.h"
+@@ -XXX,XX +XXX,XX @@ static int net_client_init1(const Netdev *netdev, bool is_netdev, Error **errp)
+     return 0;
+ }
+-static void show_netdevs(void)
++void show_netdevs(void)
+ {
+     int idx;
+     const char *available_netdevs[] = {
+@@ -XXX,XX +XXX,XX @@ static void show_netdevs(void)
+ #endif
+     };
+-    printf("Available netdev backend types:\n");
++    qemu_printf("Available netdev backend types:\n");
+     for (idx = 0; idx < ARRAY_SIZE(available_netdevs); idx++) {
+-        puts(available_netdevs[idx]);
++        qemu_printf("%s\n", available_netdevs[idx]);
+     }
+ }
 @@ -XXX,XX +XXX,XX @@ static int net_client_init(QemuOpts *opts, bool is_netdev, Error **errp)
      int ret = -1;
      Visitor *v = opts_visitor_new(opts);
--    if (is_netdev && is_help_option(qemu_opt_get(opts, "type"))) {
+-    const char *type = qemu_opt_get(opts, "type");
 -
 -    if (is_netdev && type && is_help_option(type)) {
 -        show_netdevs();
 -        exit(0);
 -    } else {
 -        /* Parse convenience option format ip6-net=fec0::0[/64] */
 -        const char *ip6_net = qemu_opt_get(opts, "ipv6-net");
 +    /* Parse convenience option format ip6-net=fec0::0[/64] */
 +    const char *ip6_net = qemu_opt_get(opts, "ipv6-net");
 -        if (ip6_net) {
 -            char *prefix_addr;
 -            unsigned long prefix_len = 64; /* Default 64bit prefix length. */
 +    if (ip6_net) {
 +        char *prefix_addr;
 +        unsigned long prefix_len = 64; /* Default 64bit prefix length. */
 -            substrings = g_strsplit(ip6_net, "/", 2);
 -            if (!substrings || !substrings[0]) {
 -                error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "ipv6-net",
 -                           "a valid IPv6 prefix");
 -                goto out;
 -            }
 +        substrings = g_strsplit(ip6_net, "/", 2);
 +        if (!substrings || !substrings[0]) {
 +            error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "ipv6-net",
 +                       "a valid IPv6 prefix");
 +            goto out;
 +        }
 -            prefix_addr = substrings[0];
 +        prefix_addr = substrings[0];
 -            /* Handle user-specified prefix length. */
 -            if (substrings[1] &&
 -                qemu_strtoul(substrings[1], NULL, 10, &prefix_len))
 -            {
 -                error_setg(errp, QERR_INVALID_PARAMETER_VALUE,
 -                           "ipv6-prefixlen", "a number");
 -                goto out;
 -            }
 -
 -            qemu_opt_set(opts, "ipv6-prefix", prefix_addr, &error_abort);
 -            qemu_opt_set_number(opts, "ipv6-prefixlen", prefix_len,
 -                                &error_abort);
 -            qemu_opt_unset(opts, "ipv6-net");
 +        /* Handle user-specified prefix length. */
 +        if (substrings[1] &&
 +            qemu_strtoul(substrings[1], NULL, 10, &prefix_len))
 +        {
 +            error_setg(errp, QERR_INVALID_PARAMETER_VALUE,
 +                       "ipv6-prefixlen", "a number");
 +            goto out;
          }
 +
 +        qemu_opt_set(opts, "ipv6-prefix", prefix_addr, &error_abort);
 +        qemu_opt_set_number(opts, "ipv6-prefixlen", prefix_len,
 +                            &error_abort);
 +        qemu_opt_unset(opts, "ipv6-net");
      }
      /* Create an ID for -net if the user did not specify one */
@@ -XXX,XX +XXX,XX @@ static int net_init_client(void *dummy, QemuOpts *opts, Error **errp)
  static int net_init_netdev(void *dummy, QemuOpts *opts, Error **errp)
  {
 +    const char *type = qemu_opt_get(opts, "type");
 +
-+    if (is_netdev && type && is_help_option(type)) {
++    if (type && is_help_option(type)) {
-         show_netdevs();
++        show_netdevs();
-         exit(0);
++        exit(0);
-     } else {
++    }
      return net_client_init(opts, true, errp);
  }
 --
 .7.4

-[Qemu-devel] [PULL 4/4] vhost-user: delete net client if necessary
+[PULL 3/5] net: purge queued rx packets on queue deletion
-From: linzhecheng <linzhecheng@huawei.com>
+From: Yuri Benditovich <yuri.benditovich@daynix.com>
-As qemu_new_net_client create new ncs but error happens later,
+https://bugzilla.redhat.com/show_bug.cgi?id=1829272
-ncs will be left in global net_clients list and we can't use them any
+When deleting queue pair, purge pending RX packets if any.
-more, so we need to cleanup them.
+Example of problematic flow:
 . Bring up q35 VM with tap (vhost off) and virtio-net or e1000e
 . Run ping flood to the VM NIC ( 1 ms interval)
 . Hot unplug the NIC device (device_del)
    During unplug process one or more packets come, the NIC
    can't receive, tap disables read_poll
 . Hot plug the device (device_add) with the same netdev
 The tap stays with read_poll disabled and does not receive
 any packets anymore (tap_send never triggered)
-Cc: qemu-stable@nongnu.org
+Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
 Signed-off-by: linzhecheng <linzhecheng@huawei.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- net/vhost-user.c | 3 +++
+ net/net.c | 12 ++++++++----
-file changed, 3 insertions(+)
+file changed, 8 insertions(+), 4 deletions(-)
-diff --git a/net/vhost-user.c b/net/vhost-user.c
+diff --git a/net/net.c b/net/net.c
 index XXXXXXX..XXXXXXX 100644
---- a/net/vhost-user.c
+--- a/net/net.c
-+++ b/net/vhost-user.c
++++ b/net/net.c
-@@ -XXX,XX +XXX,XX @@ err:
+@@ -XXX,XX +XXX,XX @@ void qemu_del_nic(NICState *nic)
-             s->vhost_user = NULL;
      qemu_macaddr_set_free(&nic->conf->macaddr);
 -    /* If this is a peer NIC and peer has already been deleted, free it now. */
 -    if (nic->peer_deleted) {
 -        for (i = 0; i < queues; i++) {
 -            qemu_free_net_client(qemu_get_subqueue(nic, i)->peer);
 +    for (i = 0; i < queues; i++) {
 +        NetClientState *nc = qemu_get_subqueue(nic, i);
 +        /* If this is a peer NIC and peer has already been deleted, free it now. */
 +        if (nic->peer_deleted) {
 +            qemu_free_net_client(nc->peer);
 +        } else if (nc->peer) {
 +            /* if there are RX packets pending, complete them */
 +            qemu_purge_queued_packets(nc->peer);
          }
      }
-+    if (nc0) {
 +        qemu_del_net_client(nc0);
 +    }
      return -1;
  }
 --
 .7.4

-[Qemu-devel] [PULL 1/4] tap: set vhostfd passed from qemu cli to non-blocking
+[PULL 4/5] tap: fix a memory leak
-From: Brijesh Singh <brijesh.singh@amd.com>
+From: yuanjungong <ruc_gongyuanjun@163.com>
-A guest boot hangs while probing the network interface when
+Close fd before returning.
 iommu_platform=on is used.
-The following qemu cli hangs without this patch:
+Buglink: https://bugs.launchpad.net/qemu/+bug/1904486
-# $QEMU \
+Signed-off-by: yuanjungong <ruc_gongyuanjun@163.com>
-  -netdev tap,fd=3,id=hostnet0,vhost=on,vhostfd=4 3<>/dev/tap67 4<>/dev/host-net \
+Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
   -device virtio-net-pci,netdev=hostnet0,id=net0,iommu_platform=on,disable-legacy=on \
   ...
 Commit: c471ad0e9bd46 (vhost_net: device IOTLB support) took care of
 setting vhostfd to non-blocking when QEMU opens /dev/host-net but if
 the fd is passed from qemu cli then we need to ensure that fd is set
 to non-blocking.
 Fixes: c471ad0e9bd46 ("vhost_net: device IOTLB support")
 Cc: qemu-stable@nongnu.org
 Cc: Michael S. Tsirkin <mst@redhat.com>
 Cc: Jason Wang <jasowang@redhat.com>
 Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
  net/tap.c | 2 ++
 file changed, 2 insertions(+)
 diff --git a/net/tap.c b/net/tap.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/tap.c
 +++ b/net/tap.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ int net_init_tap(const Netdev *netdev, const char *name,
- #include "qemu-common.h"
+         if (ret < 0) {
- #include "qemu/cutils.h"
+             error_setg_errno(errp, -ret, "%s: Can't use file descriptor %d",
- #include "qemu/error-report.h"
+                              name, fd);
-+#include "qemu/sockets.h"
++            close(fd);
+             return -1;
- #include "net/tap.h"
+         }
-@@ -XXX,XX +XXX,XX @@ static void net_init_tap_one(const NetdevTapOptions *tap, NetClientState *peer,
+@@ -XXX,XX +XXX,XX @@ int net_init_tap(const Netdev *netdev, const char *name,
-                 }
+                          vhostfdname, vnet_hdr, fd, &err);
-                 return;
+         if (err) {
-             }
+             error_propagate(errp, err);
-+            qemu_set_nonblock(vhostfd);
++            close(fd);
-         } else {
+             return -1;
-             vhostfd = open("/dev/vhost-net", O_RDWR);
+         }
-             if (vhostfd < 0) {
+     } else if (tap->has_fds) {
 --
 .7.4

-New patch
+[PULL 5/5] net: Use correct default-path macro for downscript
+From: Keqian Zhu <zhukeqian1@huawei.com>
+Fixes: 63c4db4c2e6d (net: relocate paths to helpers and scripts)
+Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ net/tap.c | 3 ++-
+file changed, 2 insertions(+), 1 deletion(-)
+diff --git a/net/tap.c b/net/tap.c
+index XXXXXXX..XXXXXXX 100644
+--- a/net/tap.c
++++ b/net/tap.c
+@@ -XXX,XX +XXX,XX @@ free_fail:
+             script = default_script = get_relocated_path(DEFAULT_NETWORK_SCRIPT);
+         }
+         if (!downscript) {
+-            downscript = default_downscript = get_relocated_path(DEFAULT_NETWORK_SCRIPT);
++            downscript = default_downscript =
++                                 get_relocated_path(DEFAULT_NETWORK_DOWN_SCRIPT);
+         }
+         if (tap->has_ifname) {
+--
+.7.4

The following changes since commit 409c241f887a38bb7a2ac12e34d3a8d73922a9a5:

Merge remote-tracking branch 'remotes/kraxel/tags/ui-20180614-pull-request' into staging (2018-06-14 14:04:14 +0100)

are available in the git repository at:

https://github.com/jasowang/qemu.git tags/net-pull-request

for you to fetch changes up to c67daf4a24442d1bb404a11a6a54dc45ea10f234:

vhost-user: delete net client if necessary (2018-06-15 10:39:53 +0800)

----------------------------------------------------------------

----------------------------------------------------------------
Brijesh Singh (1):
      tap: set vhostfd passed from qemu cli to non-blocking

Jan Kiszka (1):
      e1000e: Do not auto-clear ICR bits which aren't set in EIAC

Lin Ma (1):
      net: Fix a potential segfault

linzhecheng (1):
      vhost-user: delete net client if necessary

hw/net/e1000e_core.c | 4 ----
 net/net.c            | 4 +++-
 net/tap.c            | 2 ++
 net/vhost-user.c     | 3 +++
 4 files changed, 8 insertions(+), 5 deletions(-)

From: Brijesh Singh <brijesh.singh@amd.com>

A guest boot hangs while probing the network interface when
iommu_platform=on is used.

The following qemu cli hangs without this patch:

# $QEMU \
  -netdev tap,fd=3,id=hostnet0,vhost=on,vhostfd=4 3<>/dev/tap67 4<>/dev/host-net \
  -device virtio-net-pci,netdev=hostnet0,id=net0,iommu_platform=on,disable-legacy=on \
  ...

Commit: c471ad0e9bd46 (vhost_net: device IOTLB support) took care of
setting vhostfd to non-blocking when QEMU opens /dev/host-net but if
the fd is passed from qemu cli then we need to ensure that fd is set
to non-blocking.

Fixes: c471ad0e9bd46 ("vhost_net: device IOTLB support")
Cc: qemu-stable@nongnu.org
Cc: Michael S. Tsirkin <mst@redhat.com>
Cc: Jason Wang <jasowang@redhat.com>
Signed-off-by: Brijesh Singh <brijesh.singh@amd.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/tap.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/tap.c b/net/tap.c
index XXXXXXX..XXXXXXX 100644
--- a/net/tap.c
+++ b/net/tap.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu-common.h"
 #include "qemu/cutils.h"
 #include "qemu/error-report.h"
+#include "qemu/sockets.h"
 
 #include "net/tap.h"
 
@@ -XXX,XX +XXX,XX @@ static void net_init_tap_one(const NetdevTapOptions *tap, NetClientState *peer,
                 }
                 return;
             }
+            qemu_set_nonblock(vhostfd);
         } else {
             vhostfd = open("/dev/vhost-net", O_RDWR);
             if (vhostfd < 0) {
-- 
2.7.4

From: Lin Ma <lma@suse.com>

If user forgets to provide any backend types for '-netdev' in qemu CLI,
It triggers seg fault.

e.g.

Expected:
$ qemu -netdev id=net0
qemu-system-x86_64: Parameter 'type' is missing

Actual:
$ qemu -netdev id=net0
Segmentation fault (core dumped)

Fixes: 547203ead4327 ("net: List available netdevs with "-netdev help")
Reviewed-by: Thomas Huth <thuth@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Lin Ma <lma@suse.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/net.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/net/net.c b/net/net.c
index XXXXXXX..XXXXXXX 100644
--- a/net/net.c
+++ b/net/net.c
@@ -XXX,XX +XXX,XX @@ static int net_client_init(QemuOpts *opts, bool is_netdev, Error **errp)
     int ret = -1;
     Visitor *v = opts_visitor_new(opts);
 
-    if (is_netdev && is_help_option(qemu_opt_get(opts, "type"))) {
+    const char *type = qemu_opt_get(opts, "type");
+
+    if (is_netdev && type && is_help_option(type)) {
         show_netdevs();
         exit(0);
     } else {
-- 
2.7.4

From: Jan Kiszka <jan.kiszka@siemens.com>

The spec does not justify clearing of any E1000_ICR_OTHER_CAUSES when
E1000_ICR_OTHER is set in EIAC. In fact, removing this code fixes the
issue the Linux driver runs into since 4aea7a5c5e94 ("e1000e: Avoid
receiver overrun interrupt bursts") and was worked around by
745d0bd3af99 ("e1000e: Remove Other from EIAC").

Signed-off-by: Jan Kiszka <jan.kiszka@siemens.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/e1000e_core.c | 4 ----
 1 file changed, 4 deletions(-)

diff --git a/hw/net/e1000e_core.c b/hw/net/e1000e_core.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/e1000e_core.c
+++ b/hw/net/e1000e_core.c
@@ -XXX,XX +XXX,XX @@ e1000e_msix_notify_one(E1000ECore *core, uint32_t cause, uint32_t int_cfg)
 
     effective_eiac = core->mac[EIAC] & cause;
 
-    if (effective_eiac == E1000_ICR_OTHER) {
-        effective_eiac |= E1000_ICR_OTHER_CAUSES;
-    }
-
     core->mac[ICR] &= ~effective_eiac;
 
     if (!(core->mac[CTRL_EXT] & E1000_CTRL_EXT_IAME)) {
-- 
2.7.4

The following changes since commit 23895cbd82be95428e90168b12e925d0d3ca2f06:

Merge remote-tracking branch 'remotes/awilliam/tags/vfio-update-20201123.0' into staging (2020-11-23 18:51:13 +0000)

are available in the git repository at:

https://github.com/jasowang/qemu.git tags/net-pull-request

for you to fetch changes up to 9925990d01a92564af55f6f69d0f5f59b47609b1:

net: Use correct default-path macro for downscript (2020-11-24 10:40:17 +0800)

----------------------------------------------------------------

----------------------------------------------------------------
Keqian Zhu (1):
      net: Use correct default-path macro for downscript

Paolo Bonzini (1):
      net: do not exit on "netdev_add help" monitor command

Prasad J Pandit (1):
      hw/net/e1000e: advance desc_offset in case of null descriptor

Yuri Benditovich (1):
      net: purge queued rx packets on queue deletion

yuanjungong (1):
      tap: fix a memory leak

From: Prasad J Pandit <pjp@fedoraproject.org>

While receiving packets via e1000e_write_packet_to_guest() routine,
'desc_offset' is advanced only when RX descriptor is processed. And
RX descriptor is not processed if it has NULL buffer address.
This may lead to an infinite loop condition. Increament 'desc_offset'
to process next descriptor in the ring to avoid infinite loop.

Reported-by: Cheol-woo Myung <330cjfdn@gmail.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/e1000e_core.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/net/e1000e_core.c b/hw/net/e1000e_core.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/e1000e_core.c
+++ b/hw/net/e1000e_core.c
@@ -XXX,XX +XXX,XX @@ e1000e_write_packet_to_guest(E1000ECore *core, struct NetRxPkt *pkt,
                           (const char *) &fcs_pad, e1000x_fcs_len(core->mac));
                 }
             }
-            desc_offset += desc_size;
-            if (desc_offset >= total_size) {
-                is_last = true;
-            }
         } else { /* as per intel docs; skip descriptors with null buf addr */
             trace_e1000e_rx_null_descriptor();
         }
+        desc_offset += desc_size;
+        if (desc_offset >= total_size) {
+            is_last = true;
+        }
 
         e1000e_write_rx_descr(core, desc, is_last ? core->rx_pkt : NULL,
                            rss_info, do_ps ? ps_hdr_len : 0, &bastate.written);
-- 
2.7.4

From: Paolo Bonzini <pbonzini@redhat.com>

"netdev_add help" is causing QEMU to exit because the code that
invokes show_netdevs is shared between CLI and HMP processing.
Move the check to the callers so that exit(0) remains only
in the CLI flow.

"netdev_add help" is not fixed by this patch; that is left for
later work.

Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 include/net/net.h  |  1 +
 monitor/hmp-cmds.c |  6 +++++
 net/net.c          | 68 +++++++++++++++++++++++++++---------------------------
 3 files changed, 41 insertions(+), 34 deletions(-)

diff --git a/include/net/net.h b/include/net/net.h
index XXXXXXX..XXXXXXX 100644
--- a/include/net/net.h
+++ b/include/net/net.h
@@ -XXX,XX +XXX,XX @@ extern const char *host_net_devices[];
 
 /* from net.c */
 int net_client_parse(QemuOptsList *opts_list, const char *str);
+void show_netdevs(void);
 int net_init_clients(Error **errp);
 void net_check_clients(void);
 void net_cleanup(void);
diff --git a/monitor/hmp-cmds.c b/monitor/hmp-cmds.c
index XXXXXXX..XXXXXXX 100644
--- a/monitor/hmp-cmds.c
+++ b/monitor/hmp-cmds.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/option.h"
 #include "qemu/timer.h"
 #include "qemu/sockets.h"
+#include "qemu/help_option.h"
 #include "monitor/monitor-internal.h"
 #include "qapi/error.h"
 #include "qapi/clone-visitor.h"
@@ -XXX,XX +XXX,XX @@ void hmp_netdev_add(Monitor *mon, const QDict *qdict)
 {
     Error *err = NULL;
     QemuOpts *opts;
+    const char *type = qdict_get_try_str(qdict, "type");
 
+    if (type && is_help_option(type)) {
+        show_netdevs();
+        return;
+    }
     opts = qemu_opts_from_qdict(qemu_find_opts("netdev"), qdict, &err);
     if (err) {
         goto out;
diff --git a/net/net.c b/net/net.c
index XXXXXXX..XXXXXXX 100644
--- a/net/net.c
+++ b/net/net.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/config-file.h"
 #include "qemu/ctype.h"
 #include "qemu/iov.h"
+#include "qemu/qemu-print.h"
 #include "qemu/main-loop.h"
 #include "qemu/option.h"
 #include "qapi/error.h"
@@ -XXX,XX +XXX,XX @@ static int net_client_init1(const Netdev *netdev, bool is_netdev, Error **errp)
     return 0;
 }
 
-static void show_netdevs(void)
+void show_netdevs(void)
 {
     int idx;
     const char *available_netdevs[] = {
@@ -XXX,XX +XXX,XX @@ static void show_netdevs(void)
 #endif
     };
 
-    printf("Available netdev backend types:\n");
+    qemu_printf("Available netdev backend types:\n");
     for (idx = 0; idx < ARRAY_SIZE(available_netdevs); idx++) {
-        puts(available_netdevs[idx]);
+        qemu_printf("%s\n", available_netdevs[idx]);
     }
 }
 
@@ -XXX,XX +XXX,XX @@ static int net_client_init(QemuOpts *opts, bool is_netdev, Error **errp)
     int ret = -1;
     Visitor *v = opts_visitor_new(opts);
 
-    const char *type = qemu_opt_get(opts, "type");
-
-    if (is_netdev && type && is_help_option(type)) {
-        show_netdevs();
-        exit(0);
-    } else {
-        /* Parse convenience option format ip6-net=fec0::0[/64] */
-        const char *ip6_net = qemu_opt_get(opts, "ipv6-net");
+    /* Parse convenience option format ip6-net=fec0::0[/64] */
+    const char *ip6_net = qemu_opt_get(opts, "ipv6-net");
 
-        if (ip6_net) {
-            char *prefix_addr;
-            unsigned long prefix_len = 64; /* Default 64bit prefix length. */
+    if (ip6_net) {
+        char *prefix_addr;
+        unsigned long prefix_len = 64; /* Default 64bit prefix length. */
 
-            substrings = g_strsplit(ip6_net, "/", 2);
-            if (!substrings || !substrings[0]) {
-                error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "ipv6-net",
-                           "a valid IPv6 prefix");
-                goto out;
-            }
+        substrings = g_strsplit(ip6_net, "/", 2);
+        if (!substrings || !substrings[0]) {
+            error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "ipv6-net",
+                       "a valid IPv6 prefix");
+            goto out;
+        }
 
-            prefix_addr = substrings[0];
+        prefix_addr = substrings[0];
 
-            /* Handle user-specified prefix length. */
-            if (substrings[1] &&
-                qemu_strtoul(substrings[1], NULL, 10, &prefix_len))
-            {
-                error_setg(errp, QERR_INVALID_PARAMETER_VALUE,
-                           "ipv6-prefixlen", "a number");
-                goto out;
-            }
-
-            qemu_opt_set(opts, "ipv6-prefix", prefix_addr, &error_abort);
-            qemu_opt_set_number(opts, "ipv6-prefixlen", prefix_len,
-                                &error_abort);
-            qemu_opt_unset(opts, "ipv6-net");
+        /* Handle user-specified prefix length. */
+        if (substrings[1] &&
+            qemu_strtoul(substrings[1], NULL, 10, &prefix_len))
+        {
+            error_setg(errp, QERR_INVALID_PARAMETER_VALUE,
+                       "ipv6-prefixlen", "a number");
+            goto out;
         }
+
+        qemu_opt_set(opts, "ipv6-prefix", prefix_addr, &error_abort);
+        qemu_opt_set_number(opts, "ipv6-prefixlen", prefix_len,
+                            &error_abort);
+        qemu_opt_unset(opts, "ipv6-net");
     }
 
     /* Create an ID for -net if the user did not specify one */
@@ -XXX,XX +XXX,XX @@ static int net_init_client(void *dummy, QemuOpts *opts, Error **errp)
 
 static int net_init_netdev(void *dummy, QemuOpts *opts, Error **errp)
 {
+    const char *type = qemu_opt_get(opts, "type");
+
+    if (type && is_help_option(type)) {
+        show_netdevs();
+        exit(0);
+    }
     return net_client_init(opts, true, errp);
 }
 
-- 
2.7.4

From: Yuri Benditovich <yuri.benditovich@daynix.com>

https://bugzilla.redhat.com/show_bug.cgi?id=1829272
When deleting queue pair, purge pending RX packets if any.
Example of problematic flow:
1. Bring up q35 VM with tap (vhost off) and virtio-net or e1000e
2. Run ping flood to the VM NIC ( 1 ms interval)
3. Hot unplug the NIC device (device_del)
   During unplug process one or more packets come, the NIC
   can't receive, tap disables read_poll
4. Hot plug the device (device_add) with the same netdev
The tap stays with read_poll disabled and does not receive
any packets anymore (tap_send never triggered)

Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/net.c | 12 ++++++++----
 1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/net/net.c b/net/net.c
index XXXXXXX..XXXXXXX 100644
--- a/net/net.c
+++ b/net/net.c
@@ -XXX,XX +XXX,XX @@ void qemu_del_nic(NICState *nic)
 
     qemu_macaddr_set_free(&nic->conf->macaddr);
 
-    /* If this is a peer NIC and peer has already been deleted, free it now. */
-    if (nic->peer_deleted) {
-        for (i = 0; i < queues; i++) {
-            qemu_free_net_client(qemu_get_subqueue(nic, i)->peer);
+    for (i = 0; i < queues; i++) {
+        NetClientState *nc = qemu_get_subqueue(nic, i);
+        /* If this is a peer NIC and peer has already been deleted, free it now. */
+        if (nic->peer_deleted) {
+            qemu_free_net_client(nc->peer);
+        } else if (nc->peer) {
+            /* if there are RX packets pending, complete them */
+            qemu_purge_queued_packets(nc->peer);
         }
     }
 
-- 
2.7.4

From: yuanjungong <ruc_gongyuanjun@163.com>

Close fd before returning.

Buglink: https://bugs.launchpad.net/qemu/+bug/1904486

Signed-off-by: yuanjungong <ruc_gongyuanjun@163.com>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/tap.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/net/tap.c b/net/tap.c
index XXXXXXX..XXXXXXX 100644
--- a/net/tap.c
+++ b/net/tap.c
@@ -XXX,XX +XXX,XX @@ int net_init_tap(const Netdev *netdev, const char *name,
         if (ret < 0) {
             error_setg_errno(errp, -ret, "%s: Can't use file descriptor %d",
                              name, fd);
+            close(fd);
             return -1;
         }
 
@@ -XXX,XX +XXX,XX @@ int net_init_tap(const Netdev *netdev, const char *name,
                          vhostfdname, vnet_hdr, fd, &err);
         if (err) {
             error_propagate(errp, err);
+            close(fd);
             return -1;
         }
     } else if (tap->has_fds) {
-- 
2.7.4