Series comparison

-[PULL 00/13] Net patches
+[PULL 0/5] Net patches
-The following changes since commit cfe68ae025f704f336d7dd3d1903ce37b445831d:
+The following changes since commit d9a4282c4b690e45d25c2b933f318bb41eeb271d:
-  Merge remote-tracking branch 'remotes/vivier2/tags/linux-user-for-5.0-pull-request' into staging (2020-03-26 20:55:54 +0000)
+  Merge tag 'pull-tcg-20250308' of https://gitlab.com/rth7680/qemu into staging (2025-03-09 11:45:00 +0800)
-are available in the git repository at:
+are available in the Git repository at:
   https://github.com/jasowang/qemu.git tags/net-pull-request
-for you to fetch changes up to f3b364f4f77fcb24cec468f518bf5e093dc27cb7:
+for you to fetch changes up to ac2ff9b840ce82cc7d5fd9ce4fd3019a434d7dc9:
-  hw/net/allwinner-sun8i-emac.c: Fix REG_ADDR_HIGH/LOW reads (2020-03-27 18:59:47 +0800)
+  tap-linux: Open ipvtap and macvtap (2025-03-10 17:07:16 +0800)
 ----------------------------------------------------------------
+-----BEGIN PGP SIGNATURE-----
+iQEzBAABCAAdFiEEIV1G9IJGaJ7HfzVi7wSWWzmNYhEFAmfO1zkACgkQ7wSWWzmN
+YhET+wf+PkaGeFTNUrOtWpl35fSMKlmOVbb1fkPfuhVBmeY2Vh1EIN3OjqnzdV0F
+wxpuk+wwmFiuV1n6RNuMHQ0nz1mhgsSlZh93N5rArC/PUr3iViaT0cb82RjwxhaI
+RODBhhy7V9WxEhT9hR8sCP2ky2mrKgcYbjiIEw+IvFZOVQa58rMr2h/cbAb/iH4l
+T9Wba03JBqOS6qgzSFZOMxvqnYdVjhqXN8M6W9ngRJOjPEAkTB6Evwep6anRjcM
+mCUOgkf2sgQwKve8pYAeTMkzXFctvTc/qCU4ZbN8XcoKVVxe2jllGQqdOpMskPEf
+slOuINeW5M0K5gyjsb/huqcOTfDI2A==
+=/Y0+
+-----END PGP SIGNATURE-----
 ----------------------------------------------------------------
-Andrew Melnychenko (1):
+Akihiko Odaki (3):
-      Fixed integer overflow in e1000e
+      util/iov: Do not assert offset is in iov
       Revert "hw/net/net_tx_pkt: Fix overrun in update_sctp_checksum()"
       tap-linux: Open ipvtap and macvtap
-Peter Maydell (2):
+Eugenio Pérez (2):
-      hw/net/i82596.c: Avoid reading off end of buffer in i82596_receive()
+      net: parameterize the removing client from nc list
-      hw/net/allwinner-sun8i-emac.c: Fix REG_ADDR_HIGH/LOW reads
+      net: move backend cleanup to NIC cleanup
-Philippe Mathieu-Daudé (7):
+ hw/net/net_tx_pkt.c |  4 ----
-      hw/net/i82596: Correct command bitmask (CID 1419392)
+ include/qemu/iov.h  |  5 +++--
-      hw/net/e1000e_core: Let e1000e_can_receive() return a boolean
+ net/net.c           | 44 ++++++++++++++++++++++++++++++++++----------
-      hw/net/smc91c111: Let smc91c111_can_receive() return a boolean
+ net/tap-linux.c     | 17 ++++++++++++++---
-      hw/net/rtl8139: Simplify if/else statement
+ net/vhost-vdpa.c    |  8 --------
-      hw/net/rtl8139: Update coding style to make checkpatch.pl happy
+ util/iov.c          |  5 -----
-      hw/net: Make NetCanReceive() return a boolean
+files changed, 51 insertions(+), 32 deletions(-)
       hw/net/can: Make CanBusClientInfo::can_receive() return a boolean
 Prasad J Pandit (1):
       net: tulip: check frame size and r/w data length
 Zhang Chen (2):
       net/colo-compare.c: Expose "compare_timeout" to users
       net/colo-compare.c: Expose "expired_scan_cycle" to users
  hw/net/allwinner-sun8i-emac.c | 12 ++----
  hw/net/allwinner_emac.c       |  2 +-
  hw/net/cadence_gem.c          |  8 ++--
  hw/net/can/can_sja1000.c      |  8 ++--
  hw/net/can/can_sja1000.h      |  2 +-
  hw/net/dp8393x.c              |  8 ++--
  hw/net/e1000.c                |  2 +-
  hw/net/e1000e.c               |  4 +-
  hw/net/e1000e_core.c          |  2 +-
  hw/net/e1000e_core.h          |  2 +-
  hw/net/ftgmac100.c            |  6 +--
  hw/net/i82596.c               | 66 ++++++++++++++++++++----------
  hw/net/i82596.h               |  2 +-
  hw/net/imx_fec.c              |  2 +-
  hw/net/opencores_eth.c        |  5 +--
  hw/net/rtl8139.c              | 22 +++++-----
  hw/net/smc91c111.c            | 10 ++---
  hw/net/spapr_llan.c           |  4 +-
  hw/net/sungem.c               |  6 +--
  hw/net/sunhme.c               |  4 +-
  hw/net/tulip.c                | 36 ++++++++++++----
  hw/net/virtio-net.c           | 10 ++---
  hw/net/xilinx_ethlite.c       |  2 +-
  include/net/can_emu.h         |  2 +-
  include/net/net.h             |  2 +-
  net/can/can_socketcan.c       |  4 +-
  net/colo-compare.c            | 95 ++++++++++++++++++++++++++++++++++++++++---
  net/filter-buffer.c           |  2 +-
  net/hub.c                     |  6 +--
  qemu-options.hx               | 10 +++--
 files changed, 235 insertions(+), 111 deletions(-)

-[PULL 01/13] hw/net/i82596: Correct command bitmask (CID 1419392)
+Deleted patch
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-The command is 32-bit, but we are loading the 16 upper bits with
-the 'get_uint16(s->scb + 2)' call.
-Once shifted by 16, the command bits match the status bits:
-- Command
-  Bit 31 ACK-CX   Acknowledges that the CU completed an Action Command.
-  Bit 30 ACK-FR   Acknowledges that the RU received a frame.
-  Bit 29 ACK-CNA  Acknowledges that the Command Unit became not active.
-  Bit 28 ACK-RNR  Acknowledges that the Receive Unit became not ready.
-- Status
-  Bit 15 CX       The CU finished executing a command with its I(interrupt) bit set.
-  Bit 14 FR       The RU finished receiving a frame.
-  Bit 13 CNA      The Command Unit left the Active state.
-  Bit 12 RNR      The Receive Unit left the Ready state.
-Add the SCB_COMMAND_ACK_MASK definition to simplify the code.
-This fixes Coverity 1419392 (CONSTANT_EXPRESSION_RESULT):
-  /hw/net/i82596.c: 352 in examine_scb()
-cuc = (command >> 8) & 0x7;
-ruc = (command >> 4) & 0x7;
-DBG(printf("MAIN COMMAND %04x  cuc %02x ruc %02x\n", command, cuc, ruc));
-/* and clear the scb command word */
-set_uint16(s->scb + 2, 0);
-  >>>     CID 1419392:    (CONSTANT_EXPRESSION_RESULT)
-  >>>     "command & (2147483648UL /* 1UL << 31 */)" is always 0 regardless of the values of its operands. This occurs as the logical operand of "if".
-if (command & BIT(31))      /* ACK-CX */
-s->scb_status &= ~SCB_STATUS_CX;
-  >>>     CID 1419392:    (CONSTANT_EXPRESSION_RESULT)
-  >>>     "command & (1073741824UL /* 1UL << 30 */)" is always 0 regardless of the values of its operands. This occurs as the logical operand of "if".
-if (command & BIT(30))      /*ACK-FR */
-s->scb_status &= ~SCB_STATUS_FR;
-  >>>     CID 1419392:    (CONSTANT_EXPRESSION_RESULT)
-  >>>     "command & (536870912UL /* 1UL << 29 */)" is always 0 regardless of the values of its operands. This occurs as the logical operand of "if".
-if (command & BIT(29))      /*ACK-CNA */
-s->scb_status &= ~SCB_STATUS_CNA;
-  >>>     CID 1419392:    (CONSTANT_EXPRESSION_RESULT)
-  >>>     "command & (268435456UL /* 1UL << 28 */)" is always 0 regardless of the values of its operands. This occurs as the logical operand of "if".
-if (command & BIT(28))      /*ACK-RNR */
-s->scb_status &= ~SCB_STATUS_RNR;
-Fixes: Covertiy CID 1419392 (commit 376b851909)
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Jason Wang <jasowang@redhat.com>
----
- hw/net/i82596.c | 12 ++++--------
-file changed, 4 insertions(+), 8 deletions(-)
-diff --git a/hw/net/i82596.c b/hw/net/i82596.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/i82596.c
-+++ b/hw/net/i82596.c
-@@ -XXX,XX +XXX,XX @@
- #define SCB_STATUS_CNA  0x2000 /* CU left active state */
- #define SCB_STATUS_RNR  0x1000 /* RU left active state */
-+#define SCB_COMMAND_ACK_MASK \
-+        (SCB_STATUS_CX | SCB_STATUS_FR | SCB_STATUS_CNA | SCB_STATUS_RNR)
-+
- #define CU_IDLE         0
- #define CU_SUSPENDED    1
- #define CU_ACTIVE       2
-@@ -XXX,XX +XXX,XX @@ static void examine_scb(I82596State *s)
-     /* and clear the scb command word */
-     set_uint16(s->scb + 2, 0);
--    if (command & BIT(31))      /* ACK-CX */
--        s->scb_status &= ~SCB_STATUS_CX;
--    if (command & BIT(30))      /*ACK-FR */
--        s->scb_status &= ~SCB_STATUS_FR;
--    if (command & BIT(29))      /*ACK-CNA */
--        s->scb_status &= ~SCB_STATUS_CNA;
--    if (command & BIT(28))      /*ACK-RNR */
--        s->scb_status &= ~SCB_STATUS_RNR;
-+    s->scb_status &= ~(command & SCB_COMMAND_ACK_MASK);
-     switch (cuc) {
-     case 0:     /* no change */
---
-.5.0

-[PULL 02/13] hw/net/i82596.c: Avoid reading off end of buffer in i82596_receive()
+Deleted patch
-From: Peter Maydell <peter.maydell@linaro.org>
-The i82596_receive() function attempts to pass the guest a buffer
-which is effectively the concatenation of the data it is passed and a
-byte CRC value.  However, rather than implementing this as "write
-the data; then write the CRC" it instead bumps the length value of
-the data by 4, and writes 4 extra bytes from beyond the end of the
-buffer, which it then overwrites with the CRC.  It also assumed that
-we could always fit all four bytes of the CRC into the final receive
-buffer, which might not be true if the CRC needs to be split over two
-receive buffers.
-Calculate separately how many bytes we need to transfer into the
-guest's receive buffer from the source buffer, and how many we need
-to transfer from the CRC work.
-We add a count 'bufsz' of the number of bytes left in the source
-buffer, which we use purely to assert() that we don't overrun.
-Spotted by Coverity (CID 1419396) for the specific case when we end
-up using a local array as the source buffer.
-Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
-Signed-off-by: Jason Wang <jasowang@redhat.com>
----
- hw/net/i82596.c | 44 +++++++++++++++++++++++++++++++++++---------
-file changed, 35 insertions(+), 9 deletions(-)
-diff --git a/hw/net/i82596.c b/hw/net/i82596.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/i82596.c
-+++ b/hw/net/i82596.c
-@@ -XXX,XX +XXX,XX @@ ssize_t i82596_receive(NetClientState *nc, const uint8_t *buf, size_t sz)
-     uint32_t rfd_p;
-     uint32_t rbd;
-     uint16_t is_broadcast = 0;
--    size_t len = sz;
-+    size_t len = sz; /* length of data for guest (including CRC) */
-+    size_t bufsz = sz; /* length of data in buf */
-     uint32_t crc;
-     uint8_t *crc_ptr;
-     uint8_t buf1[MIN_BUF_SIZE + VLAN_HLEN];
-@@ -XXX,XX +XXX,XX @@ ssize_t i82596_receive(NetClientState *nc, const uint8_t *buf, size_t sz)
-         if (len < MIN_BUF_SIZE) {
-             len = MIN_BUF_SIZE;
-         }
-+        bufsz = len;
-     }
-     /* Calculate the ethernet checksum (4 bytes) */
-@@ -XXX,XX +XXX,XX @@ ssize_t i82596_receive(NetClientState *nc, const uint8_t *buf, size_t sz)
-         while (len) {
-             uint16_t buffer_size, num;
-             uint32_t rba;
-+            size_t bufcount, crccount;
-             /* printf("Receive: rbd is %08x\n", rbd); */
-             buffer_size = get_uint16(rbd + 12);
-@@ -XXX,XX +XXX,XX @@ ssize_t i82596_receive(NetClientState *nc, const uint8_t *buf, size_t sz)
-             }
-             rba = get_uint32(rbd + 8);
-             /* printf("rba is 0x%x\n", rba); */
--            address_space_write(&address_space_memory, rba,
--                                MEMTXATTRS_UNSPECIFIED, buf, num);
--            rba += num;
--            buf += num;
--            len -= num;
--            if (len == 0) { /* copy crc */
--                address_space_write(&address_space_memory, rba - 4,
--                                    MEMTXATTRS_UNSPECIFIED, crc_ptr, 4);
-+            /*
-+             * Calculate how many bytes we want from buf[] and how many
-+             * from the CRC.
-+             */
-+            if ((len - num) >= 4) {
-+                /* The whole guest buffer, we haven't hit the CRC yet */
-+                bufcount = num;
-+            } else {
-+                /* All that's left of buf[] */
-+                bufcount = len - 4;
-+            }
-+            crccount = num - bufcount;
-+
-+            if (bufcount > 0) {
-+                /* Still some of the actual data buffer to transfer */
-+                bufsz -= bufcount;
-+                assert(bufsz >= 0);
-+                address_space_write(&address_space_memory, rba,
-+                                    MEMTXATTRS_UNSPECIFIED, buf, bufcount);
-+                rba += bufcount;
-+                buf += bufcount;
-+                len -= bufcount;
-+            }
-+
-+            /* Write as much of the CRC as fits */
-+            if (crccount > 0) {
-+                address_space_write(&address_space_memory, rba,
-+                                    MEMTXATTRS_UNSPECIFIED, crc_ptr, crccount);
-+                rba += crccount;
-+                crc_ptr += crccount;
-+                len -= crccount;
-             }
-             num |= 0x4000; /* set F BIT */
---
-.5.0

-[PULL 03/13] Fixed integer overflow in e1000e
+Deleted patch
-From: Andrew Melnychenko <andrew@daynix.com>
-Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1737400
-Fixed setting max_queue_num if there are no peers in
-NICConf. qemu_new_nic() creates NICState with 1 NetClientState(index
-) without peers, set max_queue_num to 0 - It prevents undefined
-behavior and possible crashes, especially during pcie hotplug.
-Fixes: 6f3fbe4ed06 ("net: Introduce e1000e device emulation")
-Signed-off-by: Andrew Melnychenko <andrew@daynix.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Dmitry Fleytman <dmitry.fleytman@gmail.com>
-Signed-off-by: Jason Wang <jasowang@redhat.com>
----
- hw/net/e1000e.c | 2 +-
-file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/net/e1000e.c b/hw/net/e1000e.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/e1000e.c
-+++ b/hw/net/e1000e.c
-@@ -XXX,XX +XXX,XX @@ e1000e_init_net_peer(E1000EState *s, PCIDevice *pci_dev, uint8_t *macaddr)
-     s->nic = qemu_new_nic(&net_e1000e_info, &s->conf,
-         object_get_typename(OBJECT(s)), dev->id, s);
--    s->core.max_queue_num = s->conf.peers.queues - 1;
-+    s->core.max_queue_num = s->conf.peers.queues ? s->conf.peers.queues - 1 : 0;
-     trace_e1000e_mac_set_permanent(MAC_ARG(macaddr));
-     memcpy(s->core.permanent_mac, macaddr, sizeof(s->core.permanent_mac));
---
-.5.0

-[PULL 04/13] hw/net/e1000e_core: Let e1000e_can_receive() return a boolean
+Deleted patch
-From: Philippe Mathieu-Daudé <philmd@redhat.com>
-The e1000e_can_receive() function simply returns a boolean value.
-Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
-Signed-off-by: Jason Wang <jasowang@redhat.com>
----
- hw/net/e1000e_core.c | 2 +-
- hw/net/e1000e_core.h | 2 +-
-files changed, 2 insertions(+), 2 deletions(-)
-diff --git a/hw/net/e1000e_core.c b/hw/net/e1000e_core.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/e1000e_core.c
-+++ b/hw/net/e1000e_core.c
-@@ -XXX,XX +XXX,XX @@ e1000e_start_recv(E1000ECore *core)
-     }
- }
--int
-+bool
- e1000e_can_receive(E1000ECore *core)
- {
-     int i;
-diff --git a/hw/net/e1000e_core.h b/hw/net/e1000e_core.h
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/e1000e_core.h
-+++ b/hw/net/e1000e_core.h
-@@ -XXX,XX +XXX,XX @@ e1000e_core_set_link_status(E1000ECore *core);
- void
- e1000e_core_pci_uninit(E1000ECore *core);
--int
-+bool
- e1000e_can_receive(E1000ECore *core);
- ssize_t
---
-.5.0

-[PULL 05/13] hw/net/smc91c111: Let smc91c111_can_receive() return a boolean
+Deleted patch
-From: Philippe Mathieu-Daudé <philmd@redhat.com>
-The smc91c111_can_receive() function simply returns a boolean value.
-Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
-Signed-off-by: Jason Wang <jasowang@redhat.com>
----
- hw/net/smc91c111.c | 8 ++++----
-file changed, 4 insertions(+), 4 deletions(-)
-diff --git a/hw/net/smc91c111.c b/hw/net/smc91c111.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/smc91c111.c
-+++ b/hw/net/smc91c111.c
-@@ -XXX,XX +XXX,XX @@ static void smc91c111_update(smc91c111_state *s)
-     qemu_set_irq(s->irq, level);
- }
--static int smc91c111_can_receive(smc91c111_state *s)
-+static bool smc91c111_can_receive(smc91c111_state *s)
- {
-     if ((s->rcr & RCR_RXEN) == 0 || (s->rcr & RCR_SOFT_RST)) {
--        return 1;
-+        return true;
-     }
-     if (s->allocated == (1 << NUM_PACKETS) - 1 ||
-         s->rx_fifo_len == NUM_PACKETS) {
--        return 0;
-+        return false;
-     }
--    return 1;
-+    return true;
- }
- static inline void smc91c111_flush_queued_packets(smc91c111_state *s)
---
-.5.0

-[PULL 06/13] hw/net/rtl8139: Simplify if/else statement
+Deleted patch
-From: Philippe Mathieu-Daudé <philmd@redhat.com>
-Rewrite:
-      if (E) {
-          return A;
-      } else {
-          return B;
-      }
-      /* EOF */
-  }
-as:
-      if (E) {
-          return A;
-      }
-      return B;
-  }
-Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
-Signed-off-by: Jason Wang <jasowang@redhat.com>
----
- hw/net/rtl8139.c | 8 ++++----
-file changed, 4 insertions(+), 4 deletions(-)
-diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/rtl8139.c
-+++ b/hw/net/rtl8139.c
-@@ -XXX,XX +XXX,XX @@ static int rtl8139_can_receive(NetClientState *nc)
-         /* ??? Flow control not implemented in c+ mode.
-            This is a hack to work around slirp deficiencies anyway.  */
-         return 1;
--    } else {
--        avail = MOD2(s->RxBufferSize + s->RxBufPtr - s->RxBufAddr,
--                     s->RxBufferSize);
--        return (avail == 0 || avail >= 1514 || (s->IntrMask & RxOverflow));
-     }
-+
-+    avail = MOD2(s->RxBufferSize + s->RxBufPtr - s->RxBufAddr,
-+                 s->RxBufferSize);
-+    return avail == 0 || avail >= 1514 || (s->IntrMask & RxOverflow);
- }
- static ssize_t rtl8139_do_receive(NetClientState *nc, const uint8_t *buf, size_t size_, int do_interrupt)
---
-.5.0

-[PULL 07/13] hw/net/rtl8139: Update coding style to make checkpatch.pl happy
+Deleted patch
-From: Philippe Mathieu-Daudé <philmd@redhat.com>
-We will modify this code in the next commit. Clean it up
-first to avoid checkpatch.pl errors.
-Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
-Signed-off-by: Jason Wang <jasowang@redhat.com>
----
- hw/net/rtl8139.c | 10 ++++++----
-file changed, 6 insertions(+), 4 deletions(-)
-diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/rtl8139.c
-+++ b/hw/net/rtl8139.c
-@@ -XXX,XX +XXX,XX @@ static int rtl8139_can_receive(NetClientState *nc)
-     int avail;
-     /* Receive (drop) packets if card is disabled.  */
--    if (!s->clock_enabled)
--      return 1;
--    if (!rtl8139_receiver_enabled(s))
--      return 1;
-+    if (!s->clock_enabled) {
-+        return 1;
-+    }
-+    if (!rtl8139_receiver_enabled(s)) {
-+        return 1;
-+    }
-     if (rtl8139_cp_receiver_enabled(s) && rtl8139_cp_rx_valid(s)) {
-         /* ??? Flow control not implemented in c+ mode.
---
-.5.0

-[PULL 08/13] hw/net: Make NetCanReceive() return a boolean
+Deleted patch
-From: Philippe Mathieu-Daudé <philmd@redhat.com>
-The NetCanReceive handler return whether the device can or
-can not receive new packets. Make it obvious by returning
-a boolean type.
-Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Acked-by: David Gibson <david@gibson.dropbear.id.au>
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
-Signed-off-by: Jason Wang <jasowang@redhat.com>
----
- hw/net/allwinner_emac.c |  2 +-
- hw/net/cadence_gem.c    |  8 ++++----
- hw/net/dp8393x.c        |  8 +++-----
- hw/net/e1000.c          |  2 +-
- hw/net/e1000e.c         |  2 +-
- hw/net/ftgmac100.c      |  6 +++---
- hw/net/i82596.c         | 10 +++++-----
- hw/net/i82596.h         |  2 +-
- hw/net/imx_fec.c        |  2 +-
- hw/net/opencores_eth.c  |  5 ++---
- hw/net/rtl8139.c        |  8 ++++----
- hw/net/smc91c111.c      |  2 +-
- hw/net/spapr_llan.c     |  4 ++--
- hw/net/sungem.c         |  6 +++---
- hw/net/sunhme.c         |  4 ++--
- hw/net/virtio-net.c     | 10 +++++-----
- hw/net/xilinx_ethlite.c |  2 +-
- include/net/net.h       |  2 +-
- net/filter-buffer.c     |  2 +-
- net/hub.c               |  6 +++---
-files changed, 45 insertions(+), 48 deletions(-)
-diff --git a/hw/net/allwinner_emac.c b/hw/net/allwinner_emac.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/allwinner_emac.c
-+++ b/hw/net/allwinner_emac.c
-@@ -XXX,XX +XXX,XX @@ static uint32_t fifo8_pop_word(Fifo8 *fifo)
-     return ret;
- }
--static int aw_emac_can_receive(NetClientState *nc)
-+static bool aw_emac_can_receive(NetClientState *nc)
- {
-     AwEmacState *s = qemu_get_nic_opaque(nc);
-diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/cadence_gem.c
-+++ b/hw/net/cadence_gem.c
-@@ -XXX,XX +XXX,XX @@ static void phy_update_link(CadenceGEMState *s)
-     }
- }
--static int gem_can_receive(NetClientState *nc)
-+static bool gem_can_receive(NetClientState *nc)
- {
-     CadenceGEMState *s;
-     int i;
-@@ -XXX,XX +XXX,XX @@ static int gem_can_receive(NetClientState *nc)
-             s->can_rx_state = 1;
-             DB_PRINT("can't receive - no enable\n");
-         }
--        return 0;
-+        return false;
-     }
-     for (i = 0; i < s->num_priority_queues; i++) {
-@@ -XXX,XX +XXX,XX @@ static int gem_can_receive(NetClientState *nc)
-             s->can_rx_state = 2;
-             DB_PRINT("can't receive - all the buffer descriptors are busy\n");
-         }
--        return 0;
-+        return false;
-     }
-     if (s->can_rx_state != 0) {
-         s->can_rx_state = 0;
-         DB_PRINT("can receive\n");
-     }
--    return 1;
-+    return true;
- }
- /*
-diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/dp8393x.c
-+++ b/hw/net/dp8393x.c
-@@ -XXX,XX +XXX,XX @@ static void dp8393x_do_stop_timer(dp8393xState *s)
-     dp8393x_update_wt_regs(s);
- }
--static int dp8393x_can_receive(NetClientState *nc);
-+static bool dp8393x_can_receive(NetClientState *nc);
- static void dp8393x_do_receiver_enable(dp8393xState *s)
- {
-@@ -XXX,XX +XXX,XX @@ static void dp8393x_watchdog(void *opaque)
-     dp8393x_update_irq(s);
- }
--static int dp8393x_can_receive(NetClientState *nc)
-+static bool dp8393x_can_receive(NetClientState *nc)
- {
-     dp8393xState *s = qemu_get_nic_opaque(nc);
--    if (!(s->regs[SONIC_CR] & SONIC_CR_RXEN))
--        return 0;
--    return 1;
-+    return !!(s->regs[SONIC_CR] & SONIC_CR_RXEN);
- }
- static int dp8393x_receive_filter(dp8393xState *s, const uint8_t * buf,
-diff --git a/hw/net/e1000.c b/hw/net/e1000.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/e1000.c
-+++ b/hw/net/e1000.c
-@@ -XXX,XX +XXX,XX @@ static bool e1000_has_rxbufs(E1000State *s, size_t total_size)
-     return total_size <= bufs * s->rxbuf_size;
- }
--static int
-+static bool
- e1000_can_receive(NetClientState *nc)
- {
-     E1000State *s = qemu_get_nic_opaque(nc);
-diff --git a/hw/net/e1000e.c b/hw/net/e1000e.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/e1000e.c
-+++ b/hw/net/e1000e.c
-@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps io_ops = {
-     },
- };
--static int
-+static bool
- e1000e_nc_can_receive(NetClientState *nc)
- {
-     E1000EState *s = qemu_get_nic_opaque(nc);
-diff --git a/hw/net/ftgmac100.c b/hw/net/ftgmac100.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/ftgmac100.c
-+++ b/hw/net/ftgmac100.c
-@@ -XXX,XX +XXX,XX @@ static void ftgmac100_do_tx(FTGMAC100State *s, uint32_t tx_ring,
-     ftgmac100_update_irq(s);
- }
--static int ftgmac100_can_receive(NetClientState *nc)
-+static bool ftgmac100_can_receive(NetClientState *nc)
- {
-     FTGMAC100State *s = FTGMAC100(qemu_get_nic_opaque(nc));
-     FTGMAC100Desc bd;
-     if ((s->maccr & (FTGMAC100_MACCR_RXDMA_EN | FTGMAC100_MACCR_RXMAC_EN))
-          != (FTGMAC100_MACCR_RXDMA_EN | FTGMAC100_MACCR_RXMAC_EN)) {
--        return 0;
-+        return false;
-     }
-     if (ftgmac100_read_bd(&bd, s->rx_descriptor)) {
--        return 0;
-+        return false;
-     }
-     return !(bd.des0 & FTGMAC100_RXDES0_RXPKT_RDY);
- }
-diff --git a/hw/net/i82596.c b/hw/net/i82596.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/i82596.c
-+++ b/hw/net/i82596.c
-@@ -XXX,XX +XXX,XX @@ void i82596_h_reset(void *opaque)
-     i82596_s_reset(s);
- }
--int i82596_can_receive(NetClientState *nc)
-+bool i82596_can_receive(NetClientState *nc)
- {
-     I82596State *s = qemu_get_nic_opaque(nc);
-     if (s->rx_status == RX_SUSPENDED) {
--        return 0;
-+        return false;
-     }
-     if (!s->lnkst) {
--        return 0;
-+        return false;
-     }
-     if (USE_TIMER && !timer_pending(s->flush_queue_timer)) {
--        return 1;
-+        return true;
-     }
--    return 1;
-+    return true;
- }
- #define MIN_BUF_SIZE 60
-diff --git a/hw/net/i82596.h b/hw/net/i82596.h
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/i82596.h
-+++ b/hw/net/i82596.h
-@@ -XXX,XX +XXX,XX @@ void i82596_ioport_writel(void *opaque, uint32_t addr, uint32_t val);
- uint32_t i82596_ioport_readl(void *opaque, uint32_t addr);
- uint32_t i82596_bcr_readw(I82596State *s, uint32_t rap);
- ssize_t i82596_receive(NetClientState *nc, const uint8_t *buf, size_t size_);
--int i82596_can_receive(NetClientState *nc);
-+bool i82596_can_receive(NetClientState *nc);
- void i82596_set_link_status(NetClientState *nc);
- void i82596_common_init(DeviceState *dev, I82596State *s, NetClientInfo *info);
- extern const VMStateDescription vmstate_i82596;
-diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/imx_fec.c
-+++ b/hw/net/imx_fec.c
-@@ -XXX,XX +XXX,XX @@ static void imx_eth_write(void *opaque, hwaddr offset, uint64_t value,
-     imx_eth_update(s);
- }
--static int imx_eth_can_receive(NetClientState *nc)
-+static bool imx_eth_can_receive(NetClientState *nc)
- {
-     IMXFECState *s = IMX_FEC(qemu_get_nic_opaque(nc));
-diff --git a/hw/net/opencores_eth.c b/hw/net/opencores_eth.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/opencores_eth.c
-+++ b/hw/net/opencores_eth.c
-@@ -XXX,XX +XXX,XX @@ static void open_eth_reset(void *opaque)
-     open_eth_set_link_status(qemu_get_queue(s->nic));
- }
--static int open_eth_can_receive(NetClientState *nc)
-+static bool open_eth_can_receive(NetClientState *nc)
- {
-     OpenEthState *s = qemu_get_nic_opaque(nc);
--    return GET_REGBIT(s, MODER, RXEN) &&
--        (s->regs[TX_BD_NUM] < 0x80);
-+    return GET_REGBIT(s, MODER, RXEN) && (s->regs[TX_BD_NUM] < 0x80);
- }
- static ssize_t open_eth_receive(NetClientState *nc,
-diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/rtl8139.c
-+++ b/hw/net/rtl8139.c
-@@ -XXX,XX +XXX,XX @@ static bool rtl8139_cp_rx_valid(RTL8139State *s)
-     return !(s->RxRingAddrLO == 0 && s->RxRingAddrHI == 0);
- }
--static int rtl8139_can_receive(NetClientState *nc)
-+static bool rtl8139_can_receive(NetClientState *nc)
- {
-     RTL8139State *s = qemu_get_nic_opaque(nc);
-     int avail;
-     /* Receive (drop) packets if card is disabled.  */
-     if (!s->clock_enabled) {
--        return 1;
-+        return true;
-     }
-     if (!rtl8139_receiver_enabled(s)) {
--        return 1;
-+        return true;
-     }
-     if (rtl8139_cp_receiver_enabled(s) && rtl8139_cp_rx_valid(s)) {
-         /* ??? Flow control not implemented in c+ mode.
-            This is a hack to work around slirp deficiencies anyway.  */
--        return 1;
-+        return true;
-     }
-     avail = MOD2(s->RxBufferSize + s->RxBufPtr - s->RxBufAddr,
-diff --git a/hw/net/smc91c111.c b/hw/net/smc91c111.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/smc91c111.c
-+++ b/hw/net/smc91c111.c
-@@ -XXX,XX +XXX,XX @@ static void smc91c111_writefn(void *opaque, hwaddr addr,
-     }
- }
--static int smc91c111_can_receive_nc(NetClientState *nc)
-+static bool smc91c111_can_receive_nc(NetClientState *nc)
- {
-     smc91c111_state *s = qemu_get_nic_opaque(nc);
-diff --git a/hw/net/spapr_llan.c b/hw/net/spapr_llan.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/spapr_llan.c
-+++ b/hw/net/spapr_llan.c
-@@ -XXX,XX +XXX,XX @@ typedef struct SpaprVioVlan {
-     RxBufPool *rx_pool[RX_MAX_POOLS];  /* Receive buffer descriptor pools */
- } SpaprVioVlan;
--static int spapr_vlan_can_receive(NetClientState *nc)
-+static bool spapr_vlan_can_receive(NetClientState *nc)
- {
-     SpaprVioVlan *dev = qemu_get_nic_opaque(nc);
--    return (dev->isopen && dev->rx_bufs > 0);
-+    return dev->isopen && dev->rx_bufs > 0;
- }
- /**
-diff --git a/hw/net/sungem.c b/hw/net/sungem.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/sungem.c
-+++ b/hw/net/sungem.c
-@@ -XXX,XX +XXX,XX @@ static bool sungem_rx_full(SunGEMState *s, uint32_t kick, uint32_t done)
-     return kick == ((done + 1) & s->rx_mask);
- }
--static int sungem_can_receive(NetClientState *nc)
-+static bool sungem_can_receive(NetClientState *nc)
- {
-     SunGEMState *s = qemu_get_nic_opaque(nc);
-     uint32_t kick, done, rxdma_cfg, rxmac_cfg;
-@@ -XXX,XX +XXX,XX @@ static int sungem_can_receive(NetClientState *nc)
-     /* If MAC disabled, can't receive */
-     if ((rxmac_cfg & MAC_RXCFG_ENAB) == 0) {
-         trace_sungem_rx_mac_disabled();
--        return 0;
-+        return false;
-     }
-     if ((rxdma_cfg & RXDMA_CFG_ENABLE) == 0) {
-         trace_sungem_rx_txdma_disabled();
--        return 0;
-+        return false;
-     }
-     /* Check RX availability */
-diff --git a/hw/net/sunhme.c b/hw/net/sunhme.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/sunhme.c
-+++ b/hw/net/sunhme.c
-@@ -XXX,XX +XXX,XX @@ static void sunhme_transmit(SunHMEState *s)
-     sunhme_update_irq(s);
- }
--static int sunhme_can_receive(NetClientState *nc)
-+static bool sunhme_can_receive(NetClientState *nc)
- {
-     SunHMEState *s = qemu_get_nic_opaque(nc);
--    return s->macregs[HME_MACI_RXCFG >> 2] & HME_MAC_RXCFG_ENABLE;
-+    return !!(s->macregs[HME_MACI_RXCFG >> 2] & HME_MAC_RXCFG_ENABLE);
- }
- static void sunhme_link_status_changed(NetClientState *nc)
-diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/virtio-net.c
-+++ b/hw/net/virtio-net.c
-@@ -XXX,XX +XXX,XX @@ static void virtio_net_handle_rx(VirtIODevice *vdev, VirtQueue *vq)
-     qemu_flush_queued_packets(qemu_get_subqueue(n->nic, queue_index));
- }
--static int virtio_net_can_receive(NetClientState *nc)
-+static bool virtio_net_can_receive(NetClientState *nc)
- {
-     VirtIONet *n = qemu_get_nic_opaque(nc);
-     VirtIODevice *vdev = VIRTIO_DEVICE(n);
-     VirtIONetQueue *q = virtio_net_get_subqueue(nc);
-     if (!vdev->vm_running) {
--        return 0;
-+        return false;
-     }
-     if (nc->queue_index >= n->curr_queues) {
--        return 0;
-+        return false;
-     }
-     if (!virtio_queue_ready(q->rx_vq) ||
-         !(vdev->status & VIRTIO_CONFIG_S_DRIVER_OK)) {
--        return 0;
-+        return false;
-     }
--    return 1;
-+    return true;
- }
- static int virtio_net_has_buffers(VirtIONetQueue *q, int bufsize)
-diff --git a/hw/net/xilinx_ethlite.c b/hw/net/xilinx_ethlite.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/xilinx_ethlite.c
-+++ b/hw/net/xilinx_ethlite.c
-@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps eth_ops = {
-     }
- };
--static int eth_can_rx(NetClientState *nc)
-+static bool eth_can_rx(NetClientState *nc)
- {
-     struct xlx_ethlite *s = qemu_get_nic_opaque(nc);
-     unsigned int rxbase = s->rxbuf * (0x800 / 4);
-diff --git a/include/net/net.h b/include/net/net.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/net/net.h
-+++ b/include/net/net.h
-@@ -XXX,XX +XXX,XX @@ typedef struct NICConf {
- /* Net clients */
- typedef void (NetPoll)(NetClientState *, bool enable);
--typedef int (NetCanReceive)(NetClientState *);
-+typedef bool (NetCanReceive)(NetClientState *);
- typedef ssize_t (NetReceive)(NetClientState *, const uint8_t *, size_t);
- typedef ssize_t (NetReceiveIOV)(NetClientState *, const struct iovec *, int);
- typedef void (NetCleanup) (NetClientState *);
-diff --git a/net/filter-buffer.c b/net/filter-buffer.c
-index XXXXXXX..XXXXXXX 100644
---- a/net/filter-buffer.c
-+++ b/net/filter-buffer.c
-@@ -XXX,XX +XXX,XX @@ static ssize_t filter_buffer_receive_iov(NetFilterState *nf,
-      * the filter can still accept packets until its internal queue is full.
-      * For example:
-      *   For some reason, receiver could not receive more packets
--     * (.can_receive() returns zero). Without a filter, at most one packet
-+     * (.can_receive() returns false). Without a filter, at most one packet
-      * will be queued in incoming queue and sender's poll will be disabled
-      * unit its sent_cb() was called. With a filter, it will keep receiving
-      * the packets without caring about the receiver. This is suboptimal.
-diff --git a/net/hub.c b/net/hub.c
-index XXXXXXX..XXXXXXX 100644
---- a/net/hub.c
-+++ b/net/hub.c
-@@ -XXX,XX +XXX,XX @@ static NetHub *net_hub_new(int id)
-     return hub;
- }
--static int net_hub_port_can_receive(NetClientState *nc)
-+static bool net_hub_port_can_receive(NetClientState *nc)
- {
-     NetHubPort *port;
-     NetHubPort *src_port = DO_UPCAST(NetHubPort, nc, nc);
-@@ -XXX,XX +XXX,XX @@ static int net_hub_port_can_receive(NetClientState *nc)
-         }
-         if (qemu_can_send_packet(&port->nc)) {
--            return 1;
-+            return true;
-         }
-     }
--    return 0;
-+    return false;
- }
- static ssize_t net_hub_port_receive(NetClientState *nc,
---
-.5.0

-[PULL 12/13] net: tulip: check frame size and r/w data length
+[PULL 1/5] net: parameterize the removing client from nc list
-From: Prasad J Pandit <pjp@fedoraproject.org>
+From: Eugenio Pérez <eperezma@redhat.com>
-Tulip network driver while copying tx/rx buffers does not check
+This change is used in later commits so we can avoid the removal of the
-frame size against r/w data length. This may lead to OOB buffer
+netclient if it is delayed.
 access. Add check to avoid it.
-Limit iterations over descriptors to avoid potential infinite
+No functional change intended.
 loop issue in tulip_xmit_list_update.
-Reported-by: Li Qiang <pangpei.lq@antfin.com>
+Reviewed-by: Si-Wei Liu <si-wei.liu@oracle.com>
-Reported-by: Ziming Zhang <ezrakiez@gmail.com>
+Acked-by: Jason Wang <jasowang@redhat.com>
-Reported-by: Jason Wang <jasowang@redhat.com>
+Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
 Tested-by: Li Qiang <liq3ea@gmail.com>
 Reviewed-by: Li Qiang <liq3ea@gmail.com>
 Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- hw/net/tulip.c | 36 +++++++++++++++++++++++++++---------
+ net/net.c | 13 ++++++++-----
-file changed, 27 insertions(+), 9 deletions(-)
+file changed, 8 insertions(+), 5 deletions(-)
-diff --git a/hw/net/tulip.c b/hw/net/tulip.c
+diff --git a/net/net.c b/net/net.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/tulip.c
+--- a/net/net.c
-+++ b/hw/net/tulip.c
++++ b/net/net.c
-@@ -XXX,XX +XXX,XX @@ static void tulip_copy_rx_bytes(TULIPState *s, struct tulip_descriptor *desc)
+@@ -XXX,XX +XXX,XX @@ NetClientState *qemu_get_peer(NetClientState *nc, int queue_index)
-         } else {
+     return ncs->peer;
-             len = s->rx_frame_len;
+ }
 -static void qemu_cleanup_net_client(NetClientState *nc)
 +static void qemu_cleanup_net_client(NetClientState *nc,
 +                                    bool remove_from_net_clients)
  {
 -    QTAILQ_REMOVE(&net_clients, nc, next);
 +    if (remove_from_net_clients) {
 +        QTAILQ_REMOVE(&net_clients, nc, next);
 +    }
      if (nc->info->cleanup) {
          nc->info->cleanup(nc);
@@ -XXX,XX +XXX,XX @@ void qemu_del_net_client(NetClientState *nc)
          }
-+
-+        if (s->rx_frame_len + len > sizeof(s->rx_frame)) {
+         for (i = 0; i < queues; i++) {
-+            return;
+-            qemu_cleanup_net_client(ncs[i]);
-+        }
++            qemu_cleanup_net_client(ncs[i], true);
          pci_dma_write(&s->dev, desc->buf_addr1, s->rx_frame +
              (s->rx_frame_size - s->rx_frame_len), len);
          s->rx_frame_len -= len;
@@ -XXX,XX +XXX,XX @@ static void tulip_copy_rx_bytes(TULIPState *s, struct tulip_descriptor *desc)
          } else {
              len = s->rx_frame_len;
          }
-+
-+        if (s->rx_frame_len + len > sizeof(s->rx_frame)) {
+         return;
 +            return;
 +        }
          pci_dma_write(&s->dev, desc->buf_addr2, s->rx_frame +
              (s->rx_frame_size - s->rx_frame_len), len);
          s->rx_frame_len -= len;
@@ -XXX,XX +XXX,XX @@ static ssize_t tulip_receive(TULIPState *s, const uint8_t *buf, size_t size)
      trace_tulip_receive(buf, size);
 -    if (size < 14 || size > 2048 || s->rx_frame_len || tulip_rx_stopped(s)) {
 +    if (size < 14 || size > sizeof(s->rx_frame) - 4
 +        || s->rx_frame_len || tulip_rx_stopped(s)) {
          return 0;
      }
-@@ -XXX,XX +XXX,XX @@ static ssize_t tulip_receive_nc(NetClientState *nc,
+     for (i = 0; i < queues; i++) {
-     return tulip_receive(qemu_get_nic_opaque(nc), buf, size);
+-        qemu_cleanup_net_client(ncs[i]);
- }
++        qemu_cleanup_net_client(ncs[i], true);
+         qemu_free_net_client(ncs[i]);
 -
  static NetClientInfo net_tulip_info = {
      .type = NET_CLIENT_DRIVER_NIC,
      .size = sizeof(NICState),
@@ -XXX,XX +XXX,XX @@ static void tulip_tx(TULIPState *s, struct tulip_descriptor *desc)
          if ((s->csr[6] >> CSR6_OM_SHIFT) & CSR6_OM_MASK) {
              /* Internal or external Loopback */
              tulip_receive(s, s->tx_frame, s->tx_frame_len);
 -        } else {
 +        } else if (s->tx_frame_len <= sizeof(s->tx_frame)) {
              qemu_send_packet(qemu_get_queue(s->nic),
                  s->tx_frame, s->tx_frame_len);
          }
@@ -XXX,XX +XXX,XX @@ static void tulip_tx(TULIPState *s, struct tulip_descriptor *desc)
      }
  }
+@@ -XXX,XX +XXX,XX @@ void qemu_del_nic(NICState *nic)
--static void tulip_copy_tx_buffers(TULIPState *s, struct tulip_descriptor *desc)
+     for (i = queues - 1; i >= 0; i--) {
-+static int tulip_copy_tx_buffers(TULIPState *s, struct tulip_descriptor *desc)
+         NetClientState *nc = qemu_get_subqueue(nic, i);
- {
-     int len1 = (desc->control >> TDES1_BUF1_SIZE_SHIFT) & TDES1_BUF1_SIZE_MASK;
+-        qemu_cleanup_net_client(nc);
-     int len2 = (desc->control >> TDES1_BUF2_SIZE_SHIFT) & TDES1_BUF2_SIZE_MASK;
++        qemu_cleanup_net_client(nc, true);
+         qemu_free_net_client(nc);
 +    if (s->tx_frame_len + len1 > sizeof(s->tx_frame)) {
 +        return -1;
 +    }
      if (len1) {
          pci_dma_read(&s->dev, desc->buf_addr1,
              s->tx_frame + s->tx_frame_len, len1);
          s->tx_frame_len += len1;
      }
-+    if (s->tx_frame_len + len2 > sizeof(s->tx_frame)) {
-+        return -1;
-+    }
-     if (len2) {
-         pci_dma_read(&s->dev, desc->buf_addr2,
-             s->tx_frame + s->tx_frame_len, len2);
-         s->tx_frame_len += len2;
-     }
-     desc->status = (len1 + len2) ? 0 : 0x7fffffff;
-+
-+    return 0;
- }
- static void tulip_setup_filter_addr(TULIPState *s, uint8_t *buf, int n)
-@@ -XXX,XX +XXX,XX @@ static uint32_t tulip_ts(TULIPState *s)
- static void tulip_xmit_list_update(TULIPState *s)
- {
-+#define TULIP_DESC_MAX 128
-+    uint8_t i = 0;
-     struct tulip_descriptor desc;
-     if (tulip_ts(s) != CSR5_TS_SUSPENDED) {
-         return;
-     }
--    for (;;) {
-+    for (i = 0; i < TULIP_DESC_MAX; i++) {
-         tulip_desc_read(s, s->current_tx_desc, &desc);
-         tulip_dump_tx_descriptor(s, &desc);
-@@ -XXX,XX +XXX,XX @@ static void tulip_xmit_list_update(TULIPState *s)
-                 s->tx_frame_len = 0;
-             }
--            tulip_copy_tx_buffers(s, &desc);
--
--            if (desc.control & TDES1_LS) {
--                tulip_tx(s, &desc);
-+            if (!tulip_copy_tx_buffers(s, &desc)) {
-+                if (desc.control & TDES1_LS) {
-+                    tulip_tx(s, &desc);
-+                }
-             }
-         }
-         tulip_desc_write(s, s->current_tx_desc, &desc);
 --
-.5.0
+.42.0

-[PULL 10/13] net/colo-compare.c: Expose "compare_timeout" to users
+[PULL 2/5] net: move backend cleanup to NIC cleanup
-From: Zhang Chen <chen.zhang@intel.com>
+From: Eugenio Pérez <eperezma@redhat.com>
-The "compare_timeout" determines the maximum time to hold the primary net packet.
+Commit a0d7215e33 ("vhost-vdpa: do not cleanup the vdpa/vhost-net
-This patch expose the "compare_timeout", make user have ability to
+structures if peer nic is present") effectively delayed the backend
-adjest the value according to application scenarios.
+cleanup, allowing the frontend or the guest to access it resources as
 long as the frontend is still visible to the guest.
-QMP command demo:
+However it does not clean up the resources until the qemu process is
-    { "execute": "qom-get",
+over.  This causes an effective leak if the device is deleted with
-         "arguments": { "path": "/objects/comp0",
+device_del, as there is no way to close the vdpa device.  This makes
-                        "property": "compare_timeout" } }
+impossible to re-add that device to this or other QEMU instances until
 the first instance of QEMU is finished.
-    { "execute": "qom-set",
+Move the cleanup from qemu_cleanup to the NIC deletion and to
-         "arguments": { "path": "/objects/comp0",
+net_cleanup.
                         "property": "compare_timeout",
                         "value": 5000} }
-Signed-off-by: Zhang Chen <chen.zhang@intel.com>
+Fixes: a0d7215e33 ("vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present")
 Reported-by: Lei Yang <leiyang@redhat.com>
 Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
 Signed-off-by: Jonah Palmer <jonah.palmer@oracle.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- net/colo-compare.c | 47 +++++++++++++++++++++++++++++++++++++++++++++--
+ net/net.c        | 33 +++++++++++++++++++++++++++------
- qemu-options.hx    |  8 +++++---
+ net/vhost-vdpa.c |  8 --------
-files changed, 50 insertions(+), 5 deletions(-)
+files changed, 27 insertions(+), 14 deletions(-)
-diff --git a/net/colo-compare.c b/net/colo-compare.c
+diff --git a/net/net.c b/net/net.c
 index XXXXXXX..XXXXXXX 100644
---- a/net/colo-compare.c
+--- a/net/net.c
-+++ b/net/colo-compare.c
++++ b/net/net.c
-@@ -XXX,XX +XXX,XX @@ static NotifierList colo_compare_notifiers =
+@@ -XXX,XX +XXX,XX @@ void qemu_del_net_client(NetClientState *nc)
+         object_unparent(OBJECT(nf));
- /* TODO: Should be configurable */
+     }
- #define REGULAR_PACKET_CHECK_MS 3000
-+#define DEFAULT_TIME_OUT_MS 3000
+-    /* If there is a peer NIC, delete and cleanup client, but do not free. */
++    /*
- static QemuMutex event_mtx;
++     * If there is a peer NIC, transfer ownership to it.  Delete the client
- static QemuCond event_complete_cond;
++     * from net_client list but do not cleanup nor free.  This way NIC can
-@@ -XXX,XX +XXX,XX @@ typedef struct CompareState {
++     * still access to members of the backend.
-     SocketReadState sec_rs;
++     *
-     SocketReadState notify_rs;
++     * The cleanup and free will be done when the NIC is free.
-     bool vnet_hdr;
++     */
-+    uint32_t compare_timeout;
+     if (nc->peer && nc->peer->info->type == NET_CLIENT_DRIVER_NIC) {
+         NICState *nic = qemu_get_nic(nc->peer);
-     /*
+         if (nic->peer_deleted) {
-      * Record the connection that through the NIC
+@@ -XXX,XX +XXX,XX @@ void qemu_del_net_client(NetClientState *nc)
-@@ -XXX,XX +XXX,XX @@ static int colo_old_packet_check_one_conn(Connection *conn,
-                                           CompareState *s)
+         for (i = 0; i < queues; i++) {
- {
+             ncs[i]->peer->link_down = true;
-     GList *result = NULL;
++            QTAILQ_REMOVE(&net_clients, ncs[i], next);
--    int64_t check_time = REGULAR_PACKET_CHECK_MS;
+         }
-     result = g_queue_find_custom(&conn->primary_list,
+         if (nc->peer->info->link_status_changed) {
--                                 &check_time,
+             nc->peer->info->link_status_changed(nc->peer);
-+                                 &s->compare_timeout,
+         }
-                                  (GCompareFunc)colo_old_packet_check_one);
+-        for (i = 0; i < queues; i++) {
-     if (result) {
+-            qemu_cleanup_net_client(ncs[i], true);
-@@ -XXX,XX +XXX,XX @@ static void compare_set_notify_dev(Object *obj, const char *value, Error **errp)
+-        }
-     s->notify_dev = g_strdup(value);
+-
  }
 +static void compare_get_timeout(Object *obj, Visitor *v,
 +                                const char *name, void *opaque,
 +                                Error **errp)
 +{
 +    CompareState *s = COLO_COMPARE(obj);
 +    uint32_t value = s->compare_timeout;
 +
 +    visit_type_uint32(v, name, &value, errp);
 +}
 +
 +static void compare_set_timeout(Object *obj, Visitor *v,
 +                                const char *name, void *opaque,
 +                                Error **errp)
 +{
 +    CompareState *s = COLO_COMPARE(obj);
 +    Error *local_err = NULL;
 +    uint32_t value;
 +
 +    visit_type_uint32(v, name, &value, &local_err);
 +    if (local_err) {
 +        goto out;
 +    }
 +    if (!value) {
 +        error_setg(&local_err, "Property '%s.%s' requires a positive value",
 +                   object_get_typename(obj), name);
 +        goto out;
 +    }
 +    s->compare_timeout = value;
 +
 +out:
 +    error_propagate(errp, local_err);
 +}
 +
  static void compare_pri_rs_finalize(SocketReadState *pri_rs)
  {
      CompareState *s = container_of(pri_rs, CompareState, pri_rs);
@@ -XXX,XX +XXX,XX @@ static void colo_compare_complete(UserCreatable *uc, Error **errp)
          return;
      }
-+    if (!s->compare_timeout) {
+@@ -XXX,XX +XXX,XX @@ void qemu_del_nic(NICState *nic)
-+        /* Set default value to 3000 MS */
-+        s->compare_timeout = DEFAULT_TIME_OUT_MS;
+     for (i = 0; i < queues; i++) {
-+    }
+         NetClientState *nc = qemu_get_subqueue(nic, i);
 -        /* If this is a peer NIC and peer has already been deleted, free it now. */
 +        /*
 +         * If this is a peer NIC and peer has already been deleted, clean it up
 +         * and free it now.
 +         */
          if (nic->peer_deleted) {
 +            qemu_cleanup_net_client(nc->peer, false);
              qemu_free_net_client(nc->peer);
          } else if (nc->peer) {
              /* if there are RX packets pending, complete them */
@@ -XXX,XX +XXX,XX @@ void net_cleanup(void)
       * of the latest NET_CLIENT_DRIVER_NIC, and operate on *p as we walk
       * the list.
       *
 +     * However, the NIC may have peers that trust to be clean beyond this
 +     * point.  For example, if they have been removed with device_del.
 +     *
       * The 'nc' variable isn't part of the list traversal; it's purely
       * for convenience as too much '(*p)->' has a tendency to make the
       * readers' eyes bleed.
@@ -XXX,XX +XXX,XX @@ void net_cleanup(void)
      while (*p) {
          nc = *p;
          if (nc->info->type == NET_CLIENT_DRIVER_NIC) {
 +            NICState *nic = qemu_get_nic(nc);
 +
-     if (find_and_check_chardev(&chr, s->pri_indev, errp) ||
++            if (nic->peer_deleted) {
-         !qemu_chr_fe_init(&s->chr_pri_in, chr, errp)) {
++                int queues = MAX(nic->conf->peers.queues, 1);
          return;
@@ -XXX,XX +XXX,XX @@ static void colo_compare_init(Object *obj)
                              compare_get_notify_dev, compare_set_notify_dev,
                              NULL);
 +    object_property_add(obj, "compare_timeout", "uint32",
 +                        compare_get_timeout,
 +                        compare_set_timeout, NULL, NULL, NULL);
 +
-     s->vnet_hdr = false;
++                for (int i = 0; i < queues; i++) {
-     object_property_add_bool(obj, "vnet_hdr_support", compare_get_vnet_hdr,
++                    nc = qemu_get_subqueue(nic, i);
-                              compare_set_vnet_hdr, NULL);
++                    qemu_cleanup_net_client(nc->peer, false);
-diff --git a/qemu-options.hx b/qemu-options.hx
++                }
 +            }
 +
              /* Skip NET_CLIENT_DRIVER_NIC entries */
              p = &QTAILQ_NEXT(nc, next);
          } else {
 diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
 index XXXXXXX..XXXXXXX 100644
---- a/qemu-options.hx
+--- a/net/vhost-vdpa.c
-+++ b/qemu-options.hx
++++ b/net/vhost-vdpa.c
-@@ -XXX,XX +XXX,XX @@ SRST
+@@ -XXX,XX +XXX,XX @@ static void vhost_vdpa_cleanup(NetClientState *nc)
-         stored. The file format is libpcap, so it can be analyzed with
+ {
-         tools such as tcpdump or Wireshark.
+     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
--    ``-object colo-compare,id=id,primary_in=chardevid,secondary_in=chardevid,outdev=chardevid,iothread=id[,vnet_hdr_support][,notify_dev=id]``
+-    /*
-+    ``-object colo-compare,id=id,primary_in=chardevid,secondary_in=chardevid,outdev=chardevid,iothread=id[,vnet_hdr_support][,notify_dev=id][,compare_timeout=@var{ms}]``
+-     * If a peer NIC is attached, do not cleanup anything.
-         Colo-compare gets packet from primary\_inchardevid and
+-     * Cleanup will happen as a part of qemu_cleanup() -> net_cleanup()
-         secondary\_inchardevid, than compare primary packet with
+-     * when the guest is shutting down.
-         secondary packet. If the packets are same, we will output
+-     */
-@@ -XXX,XX +XXX,XX @@ SRST
+-    if (nc->peer && nc->peer->info->type == NET_CLIENT_DRIVER_NIC) {
-         outdevchardevid. In order to improve efficiency, we need to put
+-        return;
-         the task of comparison in another thread. If it has the
+-    }
-         vnet\_hdr\_support flag, colo compare will send/recv packet with
+     munmap(s->cvq_cmd_out_buffer, vhost_vdpa_net_cvq_cmd_page_len());
--        vnet\_hdr\_len. If you want to use Xen COLO, will need the
+     munmap(s->status, vhost_vdpa_net_cvq_cmd_page_len());
--        notify\_dev to notify Xen colo-frame to do checkpoint.
+     if (s->vhost_net) {
 +        vnet\_hdr\_len. Then compare\_timeout=@var{ms} determines the
 +        maximum delay colo-compare wait for the packet.
 +        If you want to use Xen COLO, will need the notify\_dev to
 +        notify Xen colo-frame to do checkpoint.
          we must use it with the help of filter-mirror and
          filter-redirector.
 --
-.5.0
+.42.0

-[PULL 09/13] hw/net/can: Make CanBusClientInfo::can_receive() return a boolean
+[PULL 3/5] util/iov: Do not assert offset is in iov
-From: Philippe Mathieu-Daudé <philmd@redhat.com>
+From: Akihiko Odaki <akihiko.odaki@daynix.com>
-The CanBusClientInfo::can_receive handler return whether the
+iov_from_buf(), iov_to_buf(), iov_memset(), and iov_copy() asserts
-device can or can not receive new frames. Make it obvious by
+that the given offset fits in the iov while tolerating the specified
-returning a boolean type.
+number of bytes to operate with to be greater than the size of iov.
 This is inconsistent so remove the assertions.
-Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Asserting the offset fits in the iov makes sense if it is expected that
-Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+there are other operations that process the content before the offset
-Reviewed-by: Cédric Le Goater <clg@kaod.org>
+and the content is processed in order. Under this expectation, the
 offset should point to the end of bytes that are previously processed
 and fit in the iov. However, this expectation depends on the details of
 the caller, and did not hold true at least one case and required code to
 check iov_size(), which is added with commit 83ddb3dbba2e
 ("hw/net/net_tx_pkt: Fix overrun in update_sctp_checksum()").
 Adding such a check is inefficient and error-prone. These functions
 already tolerate the specified number of bytes to operate with to be
 greater than the size of iov to avoid such checks so remove the
 assertions to tolerate invalid offset as well. They return the number of
 bytes they operated with so their callers can still check the returned
 value to ensure there are sufficient space at the given offset.
 Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- hw/net/can/can_sja1000.c | 8 ++++----
+ include/qemu/iov.h | 5 +++--
- hw/net/can/can_sja1000.h | 2 +-
+ util/iov.c         | 5 -----
- include/net/can_emu.h    | 2 +-
+files changed, 3 insertions(+), 7 deletions(-)
  net/can/can_socketcan.c  | 4 ++--
 files changed, 8 insertions(+), 8 deletions(-)
-diff --git a/hw/net/can/can_sja1000.c b/hw/net/can/can_sja1000.c
+diff --git a/include/qemu/iov.h b/include/qemu/iov.h
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/can/can_sja1000.c
+--- a/include/qemu/iov.h
-+++ b/hw/net/can/can_sja1000.c
++++ b/include/qemu/iov.h
-@@ -XXX,XX +XXX,XX @@ uint64_t can_sja_mem_read(CanSJA1000State *s, hwaddr addr, unsigned size)
+@@ -XXX,XX +XXX,XX @@ size_t iov_size(const struct iovec *iov, const unsigned int iov_cnt);
-     return temp;
+  * only part of data will be copied, up to the end of the iovec.
- }
+  * Number of bytes actually copied will be returned, which is
+  *  min(bytes, iov_size(iov)-offset)
--int can_sja_can_receive(CanBusClientState *client)
+- * `Offset' must point to the inside of iovec.
-+bool can_sja_can_receive(CanBusClientState *client)
++ * Returns 0 when `offset' points to the outside of iovec.
- {
+  */
-     CanSJA1000State *s = container_of(client, CanSJA1000State, bus_client);
+ size_t iov_from_buf_full(const struct iovec *iov, unsigned int iov_cnt,
+                          size_t offset, const void *buf, size_t bytes);
-     if (s->clock & 0x80) { /* PeliCAN Mode */
+@@ -XXX,XX +XXX,XX @@ iov_to_buf(const struct iovec *iov, const unsigned int iov_cnt,
-         if (s->mode & 0x01) { /* reset mode. */
+ /**
--            return 0;
+  * Set data bytes pointed out by iovec `iov' of size `iov_cnt' elements,
-+            return false;
+  * starting at byte offset `start', to value `fillc', repeating it
-         }
+- * `bytes' number of times.  `Offset' must point to the inside of iovec.
-     } else { /* BasicCAN mode */
++ * `bytes' number of times.
-         if (s->control & 0x01) {
+  * If `bytes' is large enough, only last bytes portion of iovec,
--            return 0;
+  * up to the end of it, will be filled with the specified value.
-+            return false;
+  * Function return actual number of bytes processed, which is
   * min(size, iov_size(iov) - offset).
 + * Returns 0 when `offset' points to the outside of iovec.
   */
  size_t iov_memset(const struct iovec *iov, const unsigned int iov_cnt,
                    size_t offset, int fillc, size_t bytes);
 diff --git a/util/iov.c b/util/iov.c
 index XXXXXXX..XXXXXXX 100644
 --- a/util/iov.c
 +++ b/util/iov.c
@@ -XXX,XX +XXX,XX @@ size_t iov_from_buf_full(const struct iovec *iov, unsigned int iov_cnt,
              offset -= iov[i].iov_len;
          }
      }
+-    assert(offset == 0);
--    return 1; /* always return 1, when operation mode */
+     return done;
 +    return true; /* always return true, when operation mode */
  }
- ssize_t can_sja_receive(CanBusClientState *client, const qemu_can_frame *frames,
+@@ -XXX,XX +XXX,XX @@ size_t iov_to_buf_full(const struct iovec *iov, const unsigned int iov_cnt,
-diff --git a/hw/net/can/can_sja1000.h b/hw/net/can/can_sja1000.h
+             offset -= iov[i].iov_len;
-index XXXXXXX..XXXXXXX 100644
+         }
 --- a/hw/net/can/can_sja1000.h
 +++ b/hw/net/can/can_sja1000.h
@@ -XXX,XX +XXX,XX @@ void can_sja_disconnect(CanSJA1000State *s);
  int can_sja_init(CanSJA1000State *s, qemu_irq irq);
 -int can_sja_can_receive(CanBusClientState *client);
 +bool can_sja_can_receive(CanBusClientState *client);
  ssize_t can_sja_receive(CanBusClientState *client,
                          const qemu_can_frame *frames, size_t frames_cnt);
 diff --git a/include/net/can_emu.h b/include/net/can_emu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/net/can_emu.h
 +++ b/include/net/can_emu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CanBusClientState CanBusClientState;
  typedef struct CanBusState CanBusState;
  typedef struct CanBusClientInfo {
 -    int (*can_receive)(CanBusClientState *);
 +    bool (*can_receive)(CanBusClientState *);
      ssize_t (*receive)(CanBusClientState *,
          const struct qemu_can_frame *frames, size_t frames_cnt);
  } CanBusClientInfo;
 diff --git a/net/can/can_socketcan.c b/net/can/can_socketcan.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/can/can_socketcan.c
 +++ b/net/can/can_socketcan.c
@@ -XXX,XX +XXX,XX @@ static void can_host_socketcan_read(void *opaque)
      }
+-    assert(offset == 0);
+     return done;
  }
--static int can_host_socketcan_can_receive(CanBusClientState *client)
+@@ -XXX,XX +XXX,XX @@ size_t iov_memset(const struct iovec *iov, const unsigned int iov_cnt,
-+static bool can_host_socketcan_can_receive(CanBusClientState *client)
+             offset -= iov[i].iov_len;
- {
+         }
--    return 1;
+     }
-+    return true;
+-    assert(offset == 0);
      return done;
  }
- static ssize_t can_host_socketcan_receive(CanBusClientState *client,
+@@ -XXX,XX +XXX,XX @@ unsigned iov_copy(struct iovec *dst_iov, unsigned int dst_iov_cnt,
          bytes -= len;
          offset = 0;
      }
 -    assert(offset == 0);
      return j;
  }
@@ -XXX,XX +XXX,XX @@ size_t qemu_iovec_concat_iov(QEMUIOVector *dst,
              soffset -= src_iov[i].iov_len;
          }
      }
 -    assert(soffset == 0); /* offset beyond end of src */
      return done;
  }
 --
-.5.0
+.42.0

-[PULL 13/13] hw/net/allwinner-sun8i-emac.c: Fix REG_ADDR_HIGH/LOW reads
+[PULL 4/5] Revert "hw/net/net_tx_pkt: Fix overrun in update_sctp_checksum()"
-From: Peter Maydell <peter.maydell@linaro.org>
+From: Akihiko Odaki <akihiko.odaki@daynix.com>
-Coverity points out (CID 1421926) that the read code for
+This reverts commit 83ddb3dbba2ee0f1767442ae6ee665058aeb1093.
 REG_ADDR_HIGH reads off the end of the buffer, because it does a
 -bit read from byte 4 of a 6-byte buffer.
-The code also has an endianness issue for both REG_ADDR_HIGH and
+The added check is no longer necessary due to a change of
-REG_ADDR_LOW, because it will do the wrong thing on a big-endian
+iov_from_buf().
 host.
-Rewrite the read code to use ldl_le_p() and lduw_le_p() to fix this;
+Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
-the write code is not incorrect, but for consistency we make it use
+Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
 stl_le_p() and stw_le_p().
 Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
 Tested-by: Niek Linnenbank <nieklinnenbank@gmail.com>
 Reviewed-by: Niek Linnenbank <nieklinnenbank@gmail.com>
 Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- hw/net/allwinner-sun8i-emac.c | 12 ++++--------
+ hw/net/net_tx_pkt.c | 4 ----
-file changed, 4 insertions(+), 8 deletions(-)
+file changed, 4 deletions(-)
-diff --git a/hw/net/allwinner-sun8i-emac.c b/hw/net/allwinner-sun8i-emac.c
+diff --git a/hw/net/net_tx_pkt.c b/hw/net/net_tx_pkt.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/allwinner-sun8i-emac.c
+--- a/hw/net/net_tx_pkt.c
-+++ b/hw/net/allwinner-sun8i-emac.c
++++ b/hw/net/net_tx_pkt.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t allwinner_sun8i_emac_read(void *opaque, hwaddr offset,
+@@ -XXX,XX +XXX,XX @@ bool net_tx_pkt_update_sctp_checksum(struct NetTxPkt *pkt)
-         value = s->mii_data;
+     uint32_t csum = 0;
-         break;
+     struct iovec *pl_start_frag = pkt->vec + NET_TX_PKT_PL_START_FRAG;
-     case REG_ADDR_HIGH:         /* MAC Address High */
--        value = *(((uint32_t *) (s->conf.macaddr.a)) + 1);
+-    if (iov_size(pl_start_frag, pkt->payload_frags) < 8 + sizeof(csum)) {
-+        value = lduw_le_p(s->conf.macaddr.a + 4);
+-        return false;
-         break;
+-    }
-     case REG_ADDR_LOW:          /* MAC Address Low */
+-
--        value = *(uint32_t *) (s->conf.macaddr.a);
+     if (iov_from_buf(pl_start_frag, pkt->payload_frags, 8, &csum, sizeof(csum)) < sizeof(csum)) {
-+        value = ldl_le_p(s->conf.macaddr.a);
+         return false;
-         break;
+     }
      case REG_TX_DMA_STA:        /* Transmit DMA Status */
          break;
@@ -XXX,XX +XXX,XX @@ static void allwinner_sun8i_emac_write(void *opaque, hwaddr offset,
          s->mii_data = value;
          break;
      case REG_ADDR_HIGH:         /* MAC Address High */
 -        s->conf.macaddr.a[4] = (value & 0xff);
 -        s->conf.macaddr.a[5] = (value & 0xff00) >> 8;
 +        stw_le_p(s->conf.macaddr.a + 4, value);
          break;
      case REG_ADDR_LOW:          /* MAC Address Low */
 -        s->conf.macaddr.a[0] = (value & 0xff);
 -        s->conf.macaddr.a[1] = (value & 0xff00) >> 8;
 -        s->conf.macaddr.a[2] = (value & 0xff0000) >> 16;
 -        s->conf.macaddr.a[3] = (value & 0xff000000) >> 24;
 +        stl_le_p(s->conf.macaddr.a, value);
          break;
      case REG_TX_DMA_STA:        /* Transmit DMA Status */
      case REG_TX_CUR_DESC:       /* Transmit Current Descriptor */
 --
-.5.0
+.42.0

-[PULL 11/13] net/colo-compare.c: Expose "expired_scan_cycle" to users
+[PULL 5/5] tap-linux: Open ipvtap and macvtap
-From: Zhang Chen <chen.zhang@intel.com>
+From: Akihiko Odaki <akihiko.odaki@daynix.com>
-The "expired_scan_cycle" determines period of scanning expired
+ipvtap and macvtap create a file for each interface unlike tuntap, which
-primary node net packets.
+creates one file shared by all interfaces. Try to open a file dedicated
 to the interface first for ipvtap and macvtap.
-Signed-off-by: Zhang Chen <chen.zhang@intel.com>
+Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- net/colo-compare.c | 48 +++++++++++++++++++++++++++++++++++++++++++++---
+ net/tap-linux.c | 17 ++++++++++++++---
- qemu-options.hx    |  4 +++-
+file changed, 14 insertions(+), 3 deletions(-)
 files changed, 48 insertions(+), 4 deletions(-)
-diff --git a/net/colo-compare.c b/net/colo-compare.c
+diff --git a/net/tap-linux.c b/net/tap-linux.c
 index XXXXXXX..XXXXXXX 100644
---- a/net/colo-compare.c
+--- a/net/tap-linux.c
-+++ b/net/colo-compare.c
++++ b/net/tap-linux.c
-@@ -XXX,XX +XXX,XX @@ static NotifierList colo_compare_notifiers =
+@@ -XXX,XX +XXX,XX @@ int tap_open(char *ifname, int ifname_size, int *vnet_hdr,
- #define COLO_COMPARE_FREE_PRIMARY     0x01
+     int len = sizeof(struct virtio_net_hdr);
- #define COLO_COMPARE_FREE_SECONDARY   0x02
+     unsigned int features;
--/* TODO: Should be configurable */
+-    fd = RETRY_ON_EINTR(open(PATH_NET_TUN, O_RDWR));
  #define REGULAR_PACKET_CHECK_MS 3000
  #define DEFAULT_TIME_OUT_MS 3000
@@ -XXX,XX +XXX,XX @@ typedef struct CompareState {
      SocketReadState notify_rs;
      bool vnet_hdr;
      uint32_t compare_timeout;
 +    uint32_t expired_scan_cycle;
      /*
       * Record the connection that through the NIC
@@ -XXX,XX +XXX,XX @@ static void check_old_packet_regular(void *opaque)
      /* if have old packet we will notify checkpoint */
      colo_old_packet_check(s);
      timer_mod(s->packet_check_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) +
 -                REGULAR_PACKET_CHECK_MS);
 +              s->expired_scan_cycle);
  }
  /* Public API, Used for COLO frame to notify compare event */
@@ -XXX,XX +XXX,XX @@ static void colo_compare_timer_init(CompareState *s)
                                  SCALE_MS, check_old_packet_regular,
                                  s);
      timer_mod(s->packet_check_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) +
 -                    REGULAR_PACKET_CHECK_MS);
 +              s->expired_scan_cycle);
  }
  static void colo_compare_timer_del(CompareState *s)
@@ -XXX,XX +XXX,XX @@ out:
      error_propagate(errp, local_err);
  }
 +static void compare_get_expired_scan_cycle(Object *obj, Visitor *v,
 +                                           const char *name, void *opaque,
 +                                           Error **errp)
 +{
 +    CompareState *s = COLO_COMPARE(obj);
 +    uint32_t value = s->expired_scan_cycle;
 +
-+    visit_type_uint32(v, name, &value, errp);
++    ret = if_nametoindex(ifname);
-+}
++    if (ret) {
-+
++        g_autofree char *file = g_strdup_printf("/dev/tap%d", ret);
-+static void compare_set_expired_scan_cycle(Object *obj, Visitor *v,
++        fd = open(file, O_RDWR);
-+                                           const char *name, void *opaque,
++    } else {
-+                                           Error **errp)
++        fd = -1;
 +{
 +    CompareState *s = COLO_COMPARE(obj);
 +    Error *local_err = NULL;
 +    uint32_t value;
 +
 +    visit_type_uint32(v, name, &value, &local_err);
 +    if (local_err) {
 +        goto out;
 +    }
 +    if (!value) {
 +        error_setg(&local_err, "Property '%s.%s' requires a positive value",
 +                   object_get_typename(obj), name);
 +        goto out;
 +    }
 +    s->expired_scan_cycle = value;
 +
 +out:
 +    error_propagate(errp, local_err);
 +}
 +
  static void compare_pri_rs_finalize(SocketReadState *pri_rs)
  {
      CompareState *s = container_of(pri_rs, CompareState, pri_rs);
@@ -XXX,XX +XXX,XX @@ static void colo_compare_complete(UserCreatable *uc, Error **errp)
          s->compare_timeout = DEFAULT_TIME_OUT_MS;
      }
 +    if (!s->expired_scan_cycle) {
 +        /* Set default value to 3000 MS */
 +        s->expired_scan_cycle = REGULAR_PACKET_CHECK_MS;
 +    }
 +
-     if (find_and_check_chardev(&chr, s->pri_indev, errp) ||
+     if (fd < 0) {
-         !qemu_chr_fe_init(&s->chr_pri_in, chr, errp)) {
+-        error_setg_errno(errp, errno, "could not open %s", PATH_NET_TUN);
-         return;
+-        return -1;
-@@ -XXX,XX +XXX,XX @@ static void colo_compare_init(Object *obj)
++        fd = RETRY_ON_EINTR(open(PATH_NET_TUN, O_RDWR));
-                         compare_get_timeout,
++        if (fd < 0) {
-                         compare_set_timeout, NULL, NULL, NULL);
++            error_setg_errno(errp, errno, "could not open %s", PATH_NET_TUN);
++            return -1;
-+    object_property_add(obj, "expired_scan_cycle", "uint32",
++        }
-+                        compare_get_expired_scan_cycle,
+     }
-+                        compare_set_expired_scan_cycle, NULL, NULL, NULL);
+     memset(&ifr, 0, sizeof(ifr));
-+
+     ifr.ifr_flags = IFF_TAP | IFF_NO_PI;
      s->vnet_hdr = false;
      object_property_add_bool(obj, "vnet_hdr_support", compare_get_vnet_hdr,
                               compare_set_vnet_hdr, NULL);
 diff --git a/qemu-options.hx b/qemu-options.hx
 index XXXXXXX..XXXXXXX 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
@@ -XXX,XX +XXX,XX @@ SRST
          stored. The file format is libpcap, so it can be analyzed with
          tools such as tcpdump or Wireshark.
 -    ``-object colo-compare,id=id,primary_in=chardevid,secondary_in=chardevid,outdev=chardevid,iothread=id[,vnet_hdr_support][,notify_dev=id][,compare_timeout=@var{ms}]``
 +    ``-object colo-compare,id=id,primary_in=chardevid,secondary_in=chardevid,outdev=chardevid,iothread=id[,vnet_hdr_support][,notify_dev=id][,compare_timeout=@var{ms}][,expired_scan_cycle=@var{ms}``
          Colo-compare gets packet from primary\_inchardevid and
          secondary\_inchardevid, than compare primary packet with
          secondary packet. If the packets are same, we will output
@@ -XXX,XX +XXX,XX @@ SRST
          vnet\_hdr\_support flag, colo compare will send/recv packet with
          vnet\_hdr\_len. Then compare\_timeout=@var{ms} determines the
          maximum delay colo-compare wait for the packet.
 +        The expired\_scan\_cycle=@var{ms} to set the period of scanning
 +        expired primary node network packets.
          If you want to use Xen COLO, will need the notify\_dev to
          notify Xen colo-frame to do checkpoint.
 --
-.5.0
+.42.0

The following changes since commit cfe68ae025f704f336d7dd3d1903ce37b445831d:

Merge remote-tracking branch 'remotes/vivier2/tags/linux-user-for-5.0-pull-request' into staging (2020-03-26 20:55:54 +0000)

are available in the git repository at:

https://github.com/jasowang/qemu.git tags/net-pull-request

for you to fetch changes up to f3b364f4f77fcb24cec468f518bf5e093dc27cb7:

hw/net/allwinner-sun8i-emac.c: Fix REG_ADDR_HIGH/LOW reads (2020-03-27 18:59:47 +0800)

----------------------------------------------------------------

----------------------------------------------------------------
Andrew Melnychenko (1):
      Fixed integer overflow in e1000e

Peter Maydell (2):
      hw/net/i82596.c: Avoid reading off end of buffer in i82596_receive()
      hw/net/allwinner-sun8i-emac.c: Fix REG_ADDR_HIGH/LOW reads

Philippe Mathieu-Daudé (7):
      hw/net/i82596: Correct command bitmask (CID 1419392)
      hw/net/e1000e_core: Let e1000e_can_receive() return a boolean
      hw/net/smc91c111: Let smc91c111_can_receive() return a boolean
      hw/net/rtl8139: Simplify if/else statement
      hw/net/rtl8139: Update coding style to make checkpatch.pl happy
      hw/net: Make NetCanReceive() return a boolean
      hw/net/can: Make CanBusClientInfo::can_receive() return a boolean

Prasad J Pandit (1):
      net: tulip: check frame size and r/w data length

Zhang Chen (2):
      net/colo-compare.c: Expose "compare_timeout" to users
      net/colo-compare.c: Expose "expired_scan_cycle" to users

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The command is 32-bit, but we are loading the 16 upper bits with
the 'get_uint16(s->scb + 2)' call.

Once shifted by 16, the command bits match the status bits:

- Command
  Bit 31 ACK-CX   Acknowledges that the CU completed an Action Command.
  Bit 30 ACK-FR   Acknowledges that the RU received a frame.
  Bit 29 ACK-CNA  Acknowledges that the Command Unit became not active.
  Bit 28 ACK-RNR  Acknowledges that the Receive Unit became not ready.

- Status
  Bit 15 CX       The CU finished executing a command with its I(interrupt) bit set.
  Bit 14 FR       The RU finished receiving a frame.
  Bit 13 CNA      The Command Unit left the Active state.
  Bit 12 RNR      The Receive Unit left the Ready state.

Add the SCB_COMMAND_ACK_MASK definition to simplify the code.

This fixes Coverity 1419392 (CONSTANT_EXPRESSION_RESULT):

/hw/net/i82596.c: 352 in examine_scb()
  346         cuc = (command >> 8) & 0x7;
  347         ruc = (command >> 4) & 0x7;
  348         DBG(printf("MAIN COMMAND %04x  cuc %02x ruc %02x\n", command, cuc, ruc));
  349         /* and clear the scb command word */
  350         set_uint16(s->scb + 2, 0);
  351
  >>>     CID 1419392:    (CONSTANT_EXPRESSION_RESULT)
  >>>     "command & (2147483648UL /* 1UL << 31 */)" is always 0 regardless of the values of its operands. This occurs as the logical operand of "if".
  352         if (command & BIT(31))      /* ACK-CX */
  353             s->scb_status &= ~SCB_STATUS_CX;
  >>>     CID 1419392:    (CONSTANT_EXPRESSION_RESULT)
  >>>     "command & (1073741824UL /* 1UL << 30 */)" is always 0 regardless of the values of its operands. This occurs as the logical operand of "if".
  354         if (command & BIT(30))      /*ACK-FR */
  355             s->scb_status &= ~SCB_STATUS_FR;
  >>>     CID 1419392:    (CONSTANT_EXPRESSION_RESULT)
  >>>     "command & (536870912UL /* 1UL << 29 */)" is always 0 regardless of the values of its operands. This occurs as the logical operand of "if".
  356         if (command & BIT(29))      /*ACK-CNA */
  357             s->scb_status &= ~SCB_STATUS_CNA;
  >>>     CID 1419392:    (CONSTANT_EXPRESSION_RESULT)
  >>>     "command & (268435456UL /* 1UL << 28 */)" is always 0 regardless of the values of its operands. This occurs as the logical operand of "if".
  358         if (command & BIT(28))      /*ACK-RNR */
  359             s->scb_status &= ~SCB_STATUS_RNR;

Fixes: Covertiy CID 1419392 (commit 376b851909)
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/i82596.c | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/hw/net/i82596.c b/hw/net/i82596.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/i82596.c
+++ b/hw/net/i82596.c
@@ -XXX,XX +XXX,XX @@
 #define SCB_STATUS_CNA  0x2000 /* CU left active state */
 #define SCB_STATUS_RNR  0x1000 /* RU left active state */
 
+#define SCB_COMMAND_ACK_MASK \
+        (SCB_STATUS_CX | SCB_STATUS_FR | SCB_STATUS_CNA | SCB_STATUS_RNR)
+
 #define CU_IDLE         0
 #define CU_SUSPENDED    1
 #define CU_ACTIVE       2
@@ -XXX,XX +XXX,XX @@ static void examine_scb(I82596State *s)
     /* and clear the scb command word */
     set_uint16(s->scb + 2, 0);
 
-    if (command & BIT(31))      /* ACK-CX */
-        s->scb_status &= ~SCB_STATUS_CX;
-    if (command & BIT(30))      /*ACK-FR */
-        s->scb_status &= ~SCB_STATUS_FR;
-    if (command & BIT(29))      /*ACK-CNA */
-        s->scb_status &= ~SCB_STATUS_CNA;
-    if (command & BIT(28))      /*ACK-RNR */
-        s->scb_status &= ~SCB_STATUS_RNR;
+    s->scb_status &= ~(command & SCB_COMMAND_ACK_MASK);
 
     switch (cuc) {
     case 0:     /* no change */
-- 
2.5.0

From: Peter Maydell <peter.maydell@linaro.org>

The i82596_receive() function attempts to pass the guest a buffer
which is effectively the concatenation of the data it is passed and a
4 byte CRC value.  However, rather than implementing this as "write
the data; then write the CRC" it instead bumps the length value of
the data by 4, and writes 4 extra bytes from beyond the end of the
buffer, which it then overwrites with the CRC.  It also assumed that
we could always fit all four bytes of the CRC into the final receive
buffer, which might not be true if the CRC needs to be split over two
receive buffers.

Calculate separately how many bytes we need to transfer into the
guest's receive buffer from the source buffer, and how many we need
to transfer from the CRC work.

We add a count 'bufsz' of the number of bytes left in the source
buffer, which we use purely to assert() that we don't overrun.

Spotted by Coverity (CID 1419396) for the specific case when we end
up using a local array as the source buffer.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/i82596.c | 44 +++++++++++++++++++++++++++++++++++---------
 1 file changed, 35 insertions(+), 9 deletions(-)

diff --git a/hw/net/i82596.c b/hw/net/i82596.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/i82596.c
+++ b/hw/net/i82596.c
@@ -XXX,XX +XXX,XX @@ ssize_t i82596_receive(NetClientState *nc, const uint8_t *buf, size_t sz)
     uint32_t rfd_p;
     uint32_t rbd;
     uint16_t is_broadcast = 0;
-    size_t len = sz;
+    size_t len = sz; /* length of data for guest (including CRC) */
+    size_t bufsz = sz; /* length of data in buf */
     uint32_t crc;
     uint8_t *crc_ptr;
     uint8_t buf1[MIN_BUF_SIZE + VLAN_HLEN];
@@ -XXX,XX +XXX,XX @@ ssize_t i82596_receive(NetClientState *nc, const uint8_t *buf, size_t sz)
         if (len < MIN_BUF_SIZE) {
             len = MIN_BUF_SIZE;
         }
+        bufsz = len;
     }
 
     /* Calculate the ethernet checksum (4 bytes) */
@@ -XXX,XX +XXX,XX @@ ssize_t i82596_receive(NetClientState *nc, const uint8_t *buf, size_t sz)
         while (len) {
             uint16_t buffer_size, num;
             uint32_t rba;
+            size_t bufcount, crccount;
 
             /* printf("Receive: rbd is %08x\n", rbd); */
             buffer_size = get_uint16(rbd + 12);
@@ -XXX,XX +XXX,XX @@ ssize_t i82596_receive(NetClientState *nc, const uint8_t *buf, size_t sz)
             }
             rba = get_uint32(rbd + 8);
             /* printf("rba is 0x%x\n", rba); */
-            address_space_write(&address_space_memory, rba,
-                                MEMTXATTRS_UNSPECIFIED, buf, num);
-            rba += num;
-            buf += num;
-            len -= num;
-            if (len == 0) { /* copy crc */
-                address_space_write(&address_space_memory, rba - 4,
-                                    MEMTXATTRS_UNSPECIFIED, crc_ptr, 4);
+            /*
+             * Calculate how many bytes we want from buf[] and how many
+             * from the CRC.
+             */
+            if ((len - num) >= 4) {
+                /* The whole guest buffer, we haven't hit the CRC yet */
+                bufcount = num;
+            } else {
+                /* All that's left of buf[] */
+                bufcount = len - 4;
+            }
+            crccount = num - bufcount;
+
+            if (bufcount > 0) {
+                /* Still some of the actual data buffer to transfer */
+                bufsz -= bufcount;
+                assert(bufsz >= 0);
+                address_space_write(&address_space_memory, rba,
+                                    MEMTXATTRS_UNSPECIFIED, buf, bufcount);
+                rba += bufcount;
+                buf += bufcount;
+                len -= bufcount;
+            }
+
+            /* Write as much of the CRC as fits */
+            if (crccount > 0) {
+                address_space_write(&address_space_memory, rba,
+                                    MEMTXATTRS_UNSPECIFIED, crc_ptr, crccount);
+                rba += crccount;
+                crc_ptr += crccount;
+                len -= crccount;
             }
 
             num |= 0x4000; /* set F BIT */
-- 
2.5.0

From: Andrew Melnychenko <andrew@daynix.com>

Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1737400
Fixed setting max_queue_num if there are no peers in
NICConf. qemu_new_nic() creates NICState with 1 NetClientState(index
0) without peers, set max_queue_num to 0 - It prevents undefined
behavior and possible crashes, especially during pcie hotplug.

Fixes: 6f3fbe4ed06 ("net: Introduce e1000e device emulation")
Signed-off-by: Andrew Melnychenko <andrew@daynix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Dmitry Fleytman <dmitry.fleytman@gmail.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/e1000e.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/net/e1000e.c b/hw/net/e1000e.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/e1000e.c
+++ b/hw/net/e1000e.c
@@ -XXX,XX +XXX,XX @@ e1000e_init_net_peer(E1000EState *s, PCIDevice *pci_dev, uint8_t *macaddr)
     s->nic = qemu_new_nic(&net_e1000e_info, &s->conf,
         object_get_typename(OBJECT(s)), dev->id, s);
 
-    s->core.max_queue_num = s->conf.peers.queues - 1;
+    s->core.max_queue_num = s->conf.peers.queues ? s->conf.peers.queues - 1 : 0;
 
     trace_e1000e_mac_set_permanent(MAC_ARG(macaddr));
     memcpy(s->core.permanent_mac, macaddr, sizeof(s->core.permanent_mac));
-- 
2.5.0

From: Philippe Mathieu-Daudé <philmd@redhat.com>

The e1000e_can_receive() function simply returns a boolean value.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/e1000e_core.c | 2 +-
 hw/net/e1000e_core.h | 2 +-
 2 files changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/net/e1000e_core.c b/hw/net/e1000e_core.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/e1000e_core.c
+++ b/hw/net/e1000e_core.c
@@ -XXX,XX +XXX,XX @@ e1000e_start_recv(E1000ECore *core)
     }
 }
 
-int
+bool
 e1000e_can_receive(E1000ECore *core)
 {
     int i;
diff --git a/hw/net/e1000e_core.h b/hw/net/e1000e_core.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/e1000e_core.h
+++ b/hw/net/e1000e_core.h
@@ -XXX,XX +XXX,XX @@ e1000e_core_set_link_status(E1000ECore *core);
 void
 e1000e_core_pci_uninit(E1000ECore *core);
 
-int
+bool
 e1000e_can_receive(E1000ECore *core);
 
 ssize_t
-- 
2.5.0

From: Philippe Mathieu-Daudé <philmd@redhat.com>

The smc91c111_can_receive() function simply returns a boolean value.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/smc91c111.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/net/smc91c111.c b/hw/net/smc91c111.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/smc91c111.c
+++ b/hw/net/smc91c111.c
@@ -XXX,XX +XXX,XX @@ static void smc91c111_update(smc91c111_state *s)
     qemu_set_irq(s->irq, level);
 }
 
-static int smc91c111_can_receive(smc91c111_state *s)
+static bool smc91c111_can_receive(smc91c111_state *s)
 {
     if ((s->rcr & RCR_RXEN) == 0 || (s->rcr & RCR_SOFT_RST)) {
-        return 1;
+        return true;
     }
     if (s->allocated == (1 << NUM_PACKETS) - 1 ||
         s->rx_fifo_len == NUM_PACKETS) {
-        return 0;
+        return false;
     }
-    return 1;
+    return true;
 }
 
 static inline void smc91c111_flush_queued_packets(smc91c111_state *s)
-- 
2.5.0

From: Philippe Mathieu-Daudé <philmd@redhat.com>

Rewrite:

if (E) {
          return A;
      } else {
          return B;
      }
      /* EOF */
  }

as:

if (E) {
          return A;
      }
      return B;
  }

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/rtl8139.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/rtl8139.c
+++ b/hw/net/rtl8139.c
@@ -XXX,XX +XXX,XX @@ static int rtl8139_can_receive(NetClientState *nc)
         /* ??? Flow control not implemented in c+ mode.
            This is a hack to work around slirp deficiencies anyway.  */
         return 1;
-    } else {
-        avail = MOD2(s->RxBufferSize + s->RxBufPtr - s->RxBufAddr,
-                     s->RxBufferSize);
-        return (avail == 0 || avail >= 1514 || (s->IntrMask & RxOverflow));
     }
+
+    avail = MOD2(s->RxBufferSize + s->RxBufPtr - s->RxBufAddr,
+                 s->RxBufferSize);
+    return avail == 0 || avail >= 1514 || (s->IntrMask & RxOverflow);
 }
 
 static ssize_t rtl8139_do_receive(NetClientState *nc, const uint8_t *buf, size_t size_, int do_interrupt)
-- 
2.5.0

From: Philippe Mathieu-Daudé <philmd@redhat.com>

We will modify this code in the next commit. Clean it up
first to avoid checkpatch.pl errors.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/rtl8139.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/rtl8139.c
+++ b/hw/net/rtl8139.c
@@ -XXX,XX +XXX,XX @@ static int rtl8139_can_receive(NetClientState *nc)
     int avail;
 
     /* Receive (drop) packets if card is disabled.  */
-    if (!s->clock_enabled)
-      return 1;
-    if (!rtl8139_receiver_enabled(s))
-      return 1;
+    if (!s->clock_enabled) {
+        return 1;
+    }
+    if (!rtl8139_receiver_enabled(s)) {
+        return 1;
+    }
 
     if (rtl8139_cp_receiver_enabled(s) && rtl8139_cp_rx_valid(s)) {
         /* ??? Flow control not implemented in c+ mode.
-- 
2.5.0

From: Philippe Mathieu-Daudé <philmd@redhat.com>

The NetCanReceive handler return whether the device can or
can not receive new packets. Make it obvious by returning
a boolean type.

diff --git a/hw/net/allwinner_emac.c b/hw/net/allwinner_emac.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/allwinner_emac.c
+++ b/hw/net/allwinner_emac.c
@@ -XXX,XX +XXX,XX @@ static uint32_t fifo8_pop_word(Fifo8 *fifo)
     return ret;
 }
 
-static int aw_emac_can_receive(NetClientState *nc)
+static bool aw_emac_can_receive(NetClientState *nc)
 {
     AwEmacState *s = qemu_get_nic_opaque(nc);
 
diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -XXX,XX +XXX,XX @@ static void phy_update_link(CadenceGEMState *s)
     }
 }
 
-static int gem_can_receive(NetClientState *nc)
+static bool gem_can_receive(NetClientState *nc)
 {
     CadenceGEMState *s;
     int i;
@@ -XXX,XX +XXX,XX @@ static int gem_can_receive(NetClientState *nc)
             s->can_rx_state = 1;
             DB_PRINT("can't receive - no enable\n");
         }
-        return 0;
+        return false;
     }
 
     for (i = 0; i < s->num_priority_queues; i++) {
@@ -XXX,XX +XXX,XX @@ static int gem_can_receive(NetClientState *nc)
             s->can_rx_state = 2;
             DB_PRINT("can't receive - all the buffer descriptors are busy\n");
         }
-        return 0;
+        return false;
     }
 
     if (s->can_rx_state != 0) {
         s->can_rx_state = 0;
         DB_PRINT("can receive\n");
     }
-    return 1;
+    return true;
 }
 
 /*
diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/dp8393x.c
+++ b/hw/net/dp8393x.c
@@ -XXX,XX +XXX,XX @@ static void dp8393x_do_stop_timer(dp8393xState *s)
     dp8393x_update_wt_regs(s);
 }
 
-static int dp8393x_can_receive(NetClientState *nc);
+static bool dp8393x_can_receive(NetClientState *nc);
 
 static void dp8393x_do_receiver_enable(dp8393xState *s)
 {
@@ -XXX,XX +XXX,XX @@ static void dp8393x_watchdog(void *opaque)
     dp8393x_update_irq(s);
 }
 
-static int dp8393x_can_receive(NetClientState *nc)
+static bool dp8393x_can_receive(NetClientState *nc)
 {
     dp8393xState *s = qemu_get_nic_opaque(nc);
 
-    if (!(s->regs[SONIC_CR] & SONIC_CR_RXEN))
-        return 0;
-    return 1;
+    return !!(s->regs[SONIC_CR] & SONIC_CR_RXEN);
 }
 
 static int dp8393x_receive_filter(dp8393xState *s, const uint8_t * buf,
diff --git a/hw/net/e1000.c b/hw/net/e1000.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/e1000.c
+++ b/hw/net/e1000.c
@@ -XXX,XX +XXX,XX @@ static bool e1000_has_rxbufs(E1000State *s, size_t total_size)
     return total_size <= bufs * s->rxbuf_size;
 }
 
-static int
+static bool
 e1000_can_receive(NetClientState *nc)
 {
     E1000State *s = qemu_get_nic_opaque(nc);
diff --git a/hw/net/e1000e.c b/hw/net/e1000e.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/e1000e.c
+++ b/hw/net/e1000e.c
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps io_ops = {
     },
 };
 
-static int
+static bool
 e1000e_nc_can_receive(NetClientState *nc)
 {
     E1000EState *s = qemu_get_nic_opaque(nc);
diff --git a/hw/net/ftgmac100.c b/hw/net/ftgmac100.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/ftgmac100.c
+++ b/hw/net/ftgmac100.c
@@ -XXX,XX +XXX,XX @@ static void ftgmac100_do_tx(FTGMAC100State *s, uint32_t tx_ring,
     ftgmac100_update_irq(s);
 }
 
-static int ftgmac100_can_receive(NetClientState *nc)
+static bool ftgmac100_can_receive(NetClientState *nc)
 {
     FTGMAC100State *s = FTGMAC100(qemu_get_nic_opaque(nc));
     FTGMAC100Desc bd;
 
     if ((s->maccr & (FTGMAC100_MACCR_RXDMA_EN | FTGMAC100_MACCR_RXMAC_EN))
          != (FTGMAC100_MACCR_RXDMA_EN | FTGMAC100_MACCR_RXMAC_EN)) {
-        return 0;
+        return false;
     }
 
     if (ftgmac100_read_bd(&bd, s->rx_descriptor)) {
-        return 0;
+        return false;
     }
     return !(bd.des0 & FTGMAC100_RXDES0_RXPKT_RDY);
 }
diff --git a/hw/net/i82596.c b/hw/net/i82596.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/i82596.c
+++ b/hw/net/i82596.c
@@ -XXX,XX +XXX,XX @@ void i82596_h_reset(void *opaque)
     i82596_s_reset(s);
 }
 
-int i82596_can_receive(NetClientState *nc)
+bool i82596_can_receive(NetClientState *nc)
 {
     I82596State *s = qemu_get_nic_opaque(nc);
 
     if (s->rx_status == RX_SUSPENDED) {
-        return 0;
+        return false;
     }
 
     if (!s->lnkst) {
-        return 0;
+        return false;
     }
 
     if (USE_TIMER && !timer_pending(s->flush_queue_timer)) {
-        return 1;
+        return true;
     }
 
-    return 1;
+    return true;
 }
 
 #define MIN_BUF_SIZE 60
diff --git a/hw/net/i82596.h b/hw/net/i82596.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/i82596.h
+++ b/hw/net/i82596.h
@@ -XXX,XX +XXX,XX @@ void i82596_ioport_writel(void *opaque, uint32_t addr, uint32_t val);
 uint32_t i82596_ioport_readl(void *opaque, uint32_t addr);
 uint32_t i82596_bcr_readw(I82596State *s, uint32_t rap);
 ssize_t i82596_receive(NetClientState *nc, const uint8_t *buf, size_t size_);
-int i82596_can_receive(NetClientState *nc);
+bool i82596_can_receive(NetClientState *nc);
 void i82596_set_link_status(NetClientState *nc);
 void i82596_common_init(DeviceState *dev, I82596State *s, NetClientInfo *info);
 extern const VMStateDescription vmstate_i82596;
diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/imx_fec.c
+++ b/hw/net/imx_fec.c
@@ -XXX,XX +XXX,XX @@ static void imx_eth_write(void *opaque, hwaddr offset, uint64_t value,
     imx_eth_update(s);
 }
 
-static int imx_eth_can_receive(NetClientState *nc)
+static bool imx_eth_can_receive(NetClientState *nc)
 {
     IMXFECState *s = IMX_FEC(qemu_get_nic_opaque(nc));
 
diff --git a/hw/net/opencores_eth.c b/hw/net/opencores_eth.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/opencores_eth.c
+++ b/hw/net/opencores_eth.c
@@ -XXX,XX +XXX,XX @@ static void open_eth_reset(void *opaque)
     open_eth_set_link_status(qemu_get_queue(s->nic));
 }
 
-static int open_eth_can_receive(NetClientState *nc)
+static bool open_eth_can_receive(NetClientState *nc)
 {
     OpenEthState *s = qemu_get_nic_opaque(nc);
 
-    return GET_REGBIT(s, MODER, RXEN) &&
-        (s->regs[TX_BD_NUM] < 0x80);
+    return GET_REGBIT(s, MODER, RXEN) && (s->regs[TX_BD_NUM] < 0x80);
 }
 
 static ssize_t open_eth_receive(NetClientState *nc,
diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/rtl8139.c
+++ b/hw/net/rtl8139.c
@@ -XXX,XX +XXX,XX @@ static bool rtl8139_cp_rx_valid(RTL8139State *s)
     return !(s->RxRingAddrLO == 0 && s->RxRingAddrHI == 0);
 }
 
-static int rtl8139_can_receive(NetClientState *nc)
+static bool rtl8139_can_receive(NetClientState *nc)
 {
     RTL8139State *s = qemu_get_nic_opaque(nc);
     int avail;
 
     /* Receive (drop) packets if card is disabled.  */
     if (!s->clock_enabled) {
-        return 1;
+        return true;
     }
     if (!rtl8139_receiver_enabled(s)) {
-        return 1;
+        return true;
     }
 
     if (rtl8139_cp_receiver_enabled(s) && rtl8139_cp_rx_valid(s)) {
         /* ??? Flow control not implemented in c+ mode.
            This is a hack to work around slirp deficiencies anyway.  */
-        return 1;
+        return true;
     }
 
     avail = MOD2(s->RxBufferSize + s->RxBufPtr - s->RxBufAddr,
diff --git a/hw/net/smc91c111.c b/hw/net/smc91c111.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/smc91c111.c
+++ b/hw/net/smc91c111.c
@@ -XXX,XX +XXX,XX @@ static void smc91c111_writefn(void *opaque, hwaddr addr,
     }
 }
 
-static int smc91c111_can_receive_nc(NetClientState *nc)
+static bool smc91c111_can_receive_nc(NetClientState *nc)
 {
     smc91c111_state *s = qemu_get_nic_opaque(nc);
 
diff --git a/hw/net/spapr_llan.c b/hw/net/spapr_llan.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/spapr_llan.c
+++ b/hw/net/spapr_llan.c
@@ -XXX,XX +XXX,XX @@ typedef struct SpaprVioVlan {
     RxBufPool *rx_pool[RX_MAX_POOLS];  /* Receive buffer descriptor pools */
 } SpaprVioVlan;
 
-static int spapr_vlan_can_receive(NetClientState *nc)
+static bool spapr_vlan_can_receive(NetClientState *nc)
 {
     SpaprVioVlan *dev = qemu_get_nic_opaque(nc);
 
-    return (dev->isopen && dev->rx_bufs > 0);
+    return dev->isopen && dev->rx_bufs > 0;
 }
 
 /**
diff --git a/hw/net/sungem.c b/hw/net/sungem.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/sungem.c
+++ b/hw/net/sungem.c
@@ -XXX,XX +XXX,XX @@ static bool sungem_rx_full(SunGEMState *s, uint32_t kick, uint32_t done)
     return kick == ((done + 1) & s->rx_mask);
 }
 
-static int sungem_can_receive(NetClientState *nc)
+static bool sungem_can_receive(NetClientState *nc)
 {
     SunGEMState *s = qemu_get_nic_opaque(nc);
     uint32_t kick, done, rxdma_cfg, rxmac_cfg;
@@ -XXX,XX +XXX,XX @@ static int sungem_can_receive(NetClientState *nc)
     /* If MAC disabled, can't receive */
     if ((rxmac_cfg & MAC_RXCFG_ENAB) == 0) {
         trace_sungem_rx_mac_disabled();
-        return 0;
+        return false;
     }
     if ((rxdma_cfg & RXDMA_CFG_ENABLE) == 0) {
         trace_sungem_rx_txdma_disabled();
-        return 0;
+        return false;
     }
 
     /* Check RX availability */
diff --git a/hw/net/sunhme.c b/hw/net/sunhme.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/sunhme.c
+++ b/hw/net/sunhme.c
@@ -XXX,XX +XXX,XX @@ static void sunhme_transmit(SunHMEState *s)
     sunhme_update_irq(s);
 }
 
-static int sunhme_can_receive(NetClientState *nc)
+static bool sunhme_can_receive(NetClientState *nc)
 {
     SunHMEState *s = qemu_get_nic_opaque(nc);
 
-    return s->macregs[HME_MACI_RXCFG >> 2] & HME_MAC_RXCFG_ENABLE;
+    return !!(s->macregs[HME_MACI_RXCFG >> 2] & HME_MAC_RXCFG_ENABLE);
 }
 
 static void sunhme_link_status_changed(NetClientState *nc)
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -XXX,XX +XXX,XX @@ static void virtio_net_handle_rx(VirtIODevice *vdev, VirtQueue *vq)
     qemu_flush_queued_packets(qemu_get_subqueue(n->nic, queue_index));
 }
 
-static int virtio_net_can_receive(NetClientState *nc)
+static bool virtio_net_can_receive(NetClientState *nc)
 {
     VirtIONet *n = qemu_get_nic_opaque(nc);
     VirtIODevice *vdev = VIRTIO_DEVICE(n);
     VirtIONetQueue *q = virtio_net_get_subqueue(nc);
 
     if (!vdev->vm_running) {
-        return 0;
+        return false;
     }
 
     if (nc->queue_index >= n->curr_queues) {
-        return 0;
+        return false;
     }
 
     if (!virtio_queue_ready(q->rx_vq) ||
         !(vdev->status & VIRTIO_CONFIG_S_DRIVER_OK)) {
-        return 0;
+        return false;
     }
 
-    return 1;
+    return true;
 }
 
 static int virtio_net_has_buffers(VirtIONetQueue *q, int bufsize)
diff --git a/hw/net/xilinx_ethlite.c b/hw/net/xilinx_ethlite.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/xilinx_ethlite.c
+++ b/hw/net/xilinx_ethlite.c
@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps eth_ops = {
     }
 };
 
-static int eth_can_rx(NetClientState *nc)
+static bool eth_can_rx(NetClientState *nc)
 {
     struct xlx_ethlite *s = qemu_get_nic_opaque(nc);
     unsigned int rxbase = s->rxbuf * (0x800 / 4);
diff --git a/include/net/net.h b/include/net/net.h
index XXXXXXX..XXXXXXX 100644
--- a/include/net/net.h
+++ b/include/net/net.h
@@ -XXX,XX +XXX,XX @@ typedef struct NICConf {
 /* Net clients */
 
 typedef void (NetPoll)(NetClientState *, bool enable);
-typedef int (NetCanReceive)(NetClientState *);
+typedef bool (NetCanReceive)(NetClientState *);
 typedef ssize_t (NetReceive)(NetClientState *, const uint8_t *, size_t);
 typedef ssize_t (NetReceiveIOV)(NetClientState *, const struct iovec *, int);
 typedef void (NetCleanup) (NetClientState *);
diff --git a/net/filter-buffer.c b/net/filter-buffer.c
index XXXXXXX..XXXXXXX 100644
--- a/net/filter-buffer.c
+++ b/net/filter-buffer.c
@@ -XXX,XX +XXX,XX @@ static ssize_t filter_buffer_receive_iov(NetFilterState *nf,
      * the filter can still accept packets until its internal queue is full.
      * For example:
      *   For some reason, receiver could not receive more packets
-     * (.can_receive() returns zero). Without a filter, at most one packet
+     * (.can_receive() returns false). Without a filter, at most one packet
      * will be queued in incoming queue and sender's poll will be disabled
      * unit its sent_cb() was called. With a filter, it will keep receiving
      * the packets without caring about the receiver. This is suboptimal.
diff --git a/net/hub.c b/net/hub.c
index XXXXXXX..XXXXXXX 100644
--- a/net/hub.c
+++ b/net/hub.c
@@ -XXX,XX +XXX,XX @@ static NetHub *net_hub_new(int id)
     return hub;
 }
 
-static int net_hub_port_can_receive(NetClientState *nc)
+static bool net_hub_port_can_receive(NetClientState *nc)
 {
     NetHubPort *port;
     NetHubPort *src_port = DO_UPCAST(NetHubPort, nc, nc);
@@ -XXX,XX +XXX,XX @@ static int net_hub_port_can_receive(NetClientState *nc)
         }
 
         if (qemu_can_send_packet(&port->nc)) {
-            return 1;
+            return true;
         }
     }
 
-    return 0;
+    return false;
 }
 
 static ssize_t net_hub_port_receive(NetClientState *nc,
-- 
2.5.0

From: Philippe Mathieu-Daudé <philmd@redhat.com>

The CanBusClientInfo::can_receive handler return whether the
device can or can not receive new frames. Make it obvious by
returning a boolean type.

Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Reviewed-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/can/can_sja1000.c | 8 ++++----
 hw/net/can/can_sja1000.h | 2 +-
 include/net/can_emu.h    | 2 +-
 net/can/can_socketcan.c  | 4 ++--
 4 files changed, 8 insertions(+), 8 deletions(-)

diff --git a/hw/net/can/can_sja1000.c b/hw/net/can/can_sja1000.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/can/can_sja1000.c
+++ b/hw/net/can/can_sja1000.c
@@ -XXX,XX +XXX,XX @@ uint64_t can_sja_mem_read(CanSJA1000State *s, hwaddr addr, unsigned size)
     return temp;
 }
 
-int can_sja_can_receive(CanBusClientState *client)
+bool can_sja_can_receive(CanBusClientState *client)
 {
     CanSJA1000State *s = container_of(client, CanSJA1000State, bus_client);
 
     if (s->clock & 0x80) { /* PeliCAN Mode */
         if (s->mode & 0x01) { /* reset mode. */
-            return 0;
+            return false;
         }
     } else { /* BasicCAN mode */
         if (s->control & 0x01) {
-            return 0;
+            return false;
         }
     }
 
-    return 1; /* always return 1, when operation mode */
+    return true; /* always return true, when operation mode */
 }
 
 ssize_t can_sja_receive(CanBusClientState *client, const qemu_can_frame *frames,
diff --git a/hw/net/can/can_sja1000.h b/hw/net/can/can_sja1000.h
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/can/can_sja1000.h
+++ b/hw/net/can/can_sja1000.h
@@ -XXX,XX +XXX,XX @@ void can_sja_disconnect(CanSJA1000State *s);
 
 int can_sja_init(CanSJA1000State *s, qemu_irq irq);
 
-int can_sja_can_receive(CanBusClientState *client);
+bool can_sja_can_receive(CanBusClientState *client);
 
 ssize_t can_sja_receive(CanBusClientState *client,
                         const qemu_can_frame *frames, size_t frames_cnt);
diff --git a/include/net/can_emu.h b/include/net/can_emu.h
index XXXXXXX..XXXXXXX 100644
--- a/include/net/can_emu.h
+++ b/include/net/can_emu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CanBusClientState CanBusClientState;
 typedef struct CanBusState CanBusState;
 
 typedef struct CanBusClientInfo {
-    int (*can_receive)(CanBusClientState *);
+    bool (*can_receive)(CanBusClientState *);
     ssize_t (*receive)(CanBusClientState *,
         const struct qemu_can_frame *frames, size_t frames_cnt);
 } CanBusClientInfo;
diff --git a/net/can/can_socketcan.c b/net/can/can_socketcan.c
index XXXXXXX..XXXXXXX 100644
--- a/net/can/can_socketcan.c
+++ b/net/can/can_socketcan.c
@@ -XXX,XX +XXX,XX @@ static void can_host_socketcan_read(void *opaque)
     }
 }
 
-static int can_host_socketcan_can_receive(CanBusClientState *client)
+static bool can_host_socketcan_can_receive(CanBusClientState *client)
 {
-    return 1;
+    return true;
 }
 
 static ssize_t can_host_socketcan_receive(CanBusClientState *client,
-- 
2.5.0

From: Zhang Chen <chen.zhang@intel.com>

The "compare_timeout" determines the maximum time to hold the primary net packet.
This patch expose the "compare_timeout", make user have ability to
adjest the value according to application scenarios.

QMP command demo:
    { "execute": "qom-get",
         "arguments": { "path": "/objects/comp0",
                        "property": "compare_timeout" } }

{ "execute": "qom-set",
         "arguments": { "path": "/objects/comp0",
                        "property": "compare_timeout",
                        "value": 5000} }

Signed-off-by: Zhang Chen <chen.zhang@intel.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/colo-compare.c | 47 +++++++++++++++++++++++++++++++++++++++++++++--
 qemu-options.hx    |  8 +++++---
 2 files changed, 50 insertions(+), 5 deletions(-)

diff --git a/net/colo-compare.c b/net/colo-compare.c
index XXXXXXX..XXXXXXX 100644
--- a/net/colo-compare.c
+++ b/net/colo-compare.c
@@ -XXX,XX +XXX,XX @@ static NotifierList colo_compare_notifiers =
 
 /* TODO: Should be configurable */
 #define REGULAR_PACKET_CHECK_MS 3000
+#define DEFAULT_TIME_OUT_MS 3000
 
 static QemuMutex event_mtx;
 static QemuCond event_complete_cond;
@@ -XXX,XX +XXX,XX @@ typedef struct CompareState {
     SocketReadState sec_rs;
     SocketReadState notify_rs;
     bool vnet_hdr;
+    uint32_t compare_timeout;
 
     /*
      * Record the connection that through the NIC
@@ -XXX,XX +XXX,XX @@ static int colo_old_packet_check_one_conn(Connection *conn,
                                           CompareState *s)
 {
     GList *result = NULL;
-    int64_t check_time = REGULAR_PACKET_CHECK_MS;
 
     result = g_queue_find_custom(&conn->primary_list,
-                                 &check_time,
+                                 &s->compare_timeout,
                                  (GCompareFunc)colo_old_packet_check_one);
 
     if (result) {
@@ -XXX,XX +XXX,XX @@ static void compare_set_notify_dev(Object *obj, const char *value, Error **errp)
     s->notify_dev = g_strdup(value);
 }
 
+static void compare_get_timeout(Object *obj, Visitor *v,
+                                const char *name, void *opaque,
+                                Error **errp)
+{
+    CompareState *s = COLO_COMPARE(obj);
+    uint32_t value = s->compare_timeout;
+
+    visit_type_uint32(v, name, &value, errp);
+}
+
+static void compare_set_timeout(Object *obj, Visitor *v,
+                                const char *name, void *opaque,
+                                Error **errp)
+{
+    CompareState *s = COLO_COMPARE(obj);
+    Error *local_err = NULL;
+    uint32_t value;
+
+    visit_type_uint32(v, name, &value, &local_err);
+    if (local_err) {
+        goto out;
+    }
+    if (!value) {
+        error_setg(&local_err, "Property '%s.%s' requires a positive value",
+                   object_get_typename(obj), name);
+        goto out;
+    }
+    s->compare_timeout = value;
+
+out:
+    error_propagate(errp, local_err);
+}
+
 static void compare_pri_rs_finalize(SocketReadState *pri_rs)
 {
     CompareState *s = container_of(pri_rs, CompareState, pri_rs);
@@ -XXX,XX +XXX,XX @@ static void colo_compare_complete(UserCreatable *uc, Error **errp)
         return;
     }
 
+    if (!s->compare_timeout) {
+        /* Set default value to 3000 MS */
+        s->compare_timeout = DEFAULT_TIME_OUT_MS;
+    }
+
     if (find_and_check_chardev(&chr, s->pri_indev, errp) ||
         !qemu_chr_fe_init(&s->chr_pri_in, chr, errp)) {
         return;
@@ -XXX,XX +XXX,XX @@ static void colo_compare_init(Object *obj)
                             compare_get_notify_dev, compare_set_notify_dev,
                             NULL);
 
+    object_property_add(obj, "compare_timeout", "uint32",
+                        compare_get_timeout,
+                        compare_set_timeout, NULL, NULL, NULL);
+
     s->vnet_hdr = false;
     object_property_add_bool(obj, "vnet_hdr_support", compare_get_vnet_hdr,
                              compare_set_vnet_hdr, NULL);
diff --git a/qemu-options.hx b/qemu-options.hx
index XXXXXXX..XXXXXXX 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -XXX,XX +XXX,XX @@ SRST
         stored. The file format is libpcap, so it can be analyzed with
         tools such as tcpdump or Wireshark.
 
-    ``-object colo-compare,id=id,primary_in=chardevid,secondary_in=chardevid,outdev=chardevid,iothread=id[,vnet_hdr_support][,notify_dev=id]``
+    ``-object colo-compare,id=id,primary_in=chardevid,secondary_in=chardevid,outdev=chardevid,iothread=id[,vnet_hdr_support][,notify_dev=id][,compare_timeout=@var{ms}]``
         Colo-compare gets packet from primary\_inchardevid and
         secondary\_inchardevid, than compare primary packet with
         secondary packet. If the packets are same, we will output
@@ -XXX,XX +XXX,XX @@ SRST
         outdevchardevid. In order to improve efficiency, we need to put
         the task of comparison in another thread. If it has the
         vnet\_hdr\_support flag, colo compare will send/recv packet with
-        vnet\_hdr\_len. If you want to use Xen COLO, will need the
-        notify\_dev to notify Xen colo-frame to do checkpoint.
+        vnet\_hdr\_len. Then compare\_timeout=@var{ms} determines the
+        maximum delay colo-compare wait for the packet.
+        If you want to use Xen COLO, will need the notify\_dev to
+        notify Xen colo-frame to do checkpoint.
 
         we must use it with the help of filter-mirror and
         filter-redirector.
-- 
2.5.0

From: Zhang Chen <chen.zhang@intel.com>

The "expired_scan_cycle" determines period of scanning expired
primary node net packets.

Signed-off-by: Zhang Chen <chen.zhang@intel.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/colo-compare.c | 48 +++++++++++++++++++++++++++++++++++++++++++++---
 qemu-options.hx    |  4 +++-
 2 files changed, 48 insertions(+), 4 deletions(-)

diff --git a/net/colo-compare.c b/net/colo-compare.c
index XXXXXXX..XXXXXXX 100644
--- a/net/colo-compare.c
+++ b/net/colo-compare.c
@@ -XXX,XX +XXX,XX @@ static NotifierList colo_compare_notifiers =
 #define COLO_COMPARE_FREE_PRIMARY     0x01
 #define COLO_COMPARE_FREE_SECONDARY   0x02
 
-/* TODO: Should be configurable */
 #define REGULAR_PACKET_CHECK_MS 3000
 #define DEFAULT_TIME_OUT_MS 3000
 
@@ -XXX,XX +XXX,XX @@ typedef struct CompareState {
     SocketReadState notify_rs;
     bool vnet_hdr;
     uint32_t compare_timeout;
+    uint32_t expired_scan_cycle;
 
     /*
      * Record the connection that through the NIC
@@ -XXX,XX +XXX,XX @@ static void check_old_packet_regular(void *opaque)
     /* if have old packet we will notify checkpoint */
     colo_old_packet_check(s);
     timer_mod(s->packet_check_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) +
-                REGULAR_PACKET_CHECK_MS);
+              s->expired_scan_cycle);
 }
 
 /* Public API, Used for COLO frame to notify compare event */
@@ -XXX,XX +XXX,XX @@ static void colo_compare_timer_init(CompareState *s)
                                 SCALE_MS, check_old_packet_regular,
                                 s);
     timer_mod(s->packet_check_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) +
-                    REGULAR_PACKET_CHECK_MS);
+              s->expired_scan_cycle);
 }
 
 static void colo_compare_timer_del(CompareState *s)
@@ -XXX,XX +XXX,XX @@ out:
     error_propagate(errp, local_err);
 }
 
+static void compare_get_expired_scan_cycle(Object *obj, Visitor *v,
+                                           const char *name, void *opaque,
+                                           Error **errp)
+{
+    CompareState *s = COLO_COMPARE(obj);
+    uint32_t value = s->expired_scan_cycle;
+
+    visit_type_uint32(v, name, &value, errp);
+}
+
+static void compare_set_expired_scan_cycle(Object *obj, Visitor *v,
+                                           const char *name, void *opaque,
+                                           Error **errp)
+{
+    CompareState *s = COLO_COMPARE(obj);
+    Error *local_err = NULL;
+    uint32_t value;
+
+    visit_type_uint32(v, name, &value, &local_err);
+    if (local_err) {
+        goto out;
+    }
+    if (!value) {
+        error_setg(&local_err, "Property '%s.%s' requires a positive value",
+                   object_get_typename(obj), name);
+        goto out;
+    }
+    s->expired_scan_cycle = value;
+
+out:
+    error_propagate(errp, local_err);
+}
+
 static void compare_pri_rs_finalize(SocketReadState *pri_rs)
 {
     CompareState *s = container_of(pri_rs, CompareState, pri_rs);
@@ -XXX,XX +XXX,XX @@ static void colo_compare_complete(UserCreatable *uc, Error **errp)
         s->compare_timeout = DEFAULT_TIME_OUT_MS;
     }
 
+    if (!s->expired_scan_cycle) {
+        /* Set default value to 3000 MS */
+        s->expired_scan_cycle = REGULAR_PACKET_CHECK_MS;
+    }
+
     if (find_and_check_chardev(&chr, s->pri_indev, errp) ||
         !qemu_chr_fe_init(&s->chr_pri_in, chr, errp)) {
         return;
@@ -XXX,XX +XXX,XX @@ static void colo_compare_init(Object *obj)
                         compare_get_timeout,
                         compare_set_timeout, NULL, NULL, NULL);
 
+    object_property_add(obj, "expired_scan_cycle", "uint32",
+                        compare_get_expired_scan_cycle,
+                        compare_set_expired_scan_cycle, NULL, NULL, NULL);
+
     s->vnet_hdr = false;
     object_property_add_bool(obj, "vnet_hdr_support", compare_get_vnet_hdr,
                              compare_set_vnet_hdr, NULL);
diff --git a/qemu-options.hx b/qemu-options.hx
index XXXXXXX..XXXXXXX 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -XXX,XX +XXX,XX @@ SRST
         stored. The file format is libpcap, so it can be analyzed with
         tools such as tcpdump or Wireshark.
 
-    ``-object colo-compare,id=id,primary_in=chardevid,secondary_in=chardevid,outdev=chardevid,iothread=id[,vnet_hdr_support][,notify_dev=id][,compare_timeout=@var{ms}]``
+    ``-object colo-compare,id=id,primary_in=chardevid,secondary_in=chardevid,outdev=chardevid,iothread=id[,vnet_hdr_support][,notify_dev=id][,compare_timeout=@var{ms}][,expired_scan_cycle=@var{ms}``
         Colo-compare gets packet from primary\_inchardevid and
         secondary\_inchardevid, than compare primary packet with
         secondary packet. If the packets are same, we will output
@@ -XXX,XX +XXX,XX @@ SRST
         vnet\_hdr\_support flag, colo compare will send/recv packet with
         vnet\_hdr\_len. Then compare\_timeout=@var{ms} determines the
         maximum delay colo-compare wait for the packet.
+        The expired\_scan\_cycle=@var{ms} to set the period of scanning
+        expired primary node network packets.
         If you want to use Xen COLO, will need the notify\_dev to
         notify Xen colo-frame to do checkpoint.
 
-- 
2.5.0

From: Prasad J Pandit <pjp@fedoraproject.org>

Tulip network driver while copying tx/rx buffers does not check
frame size against r/w data length. This may lead to OOB buffer
access. Add check to avoid it.

Limit iterations over descriptors to avoid potential infinite
loop issue in tulip_xmit_list_update.

Reported-by: Li Qiang <pangpei.lq@antfin.com>
Reported-by: Ziming Zhang <ezrakiez@gmail.com>
Reported-by: Jason Wang <jasowang@redhat.com>
Tested-by: Li Qiang <liq3ea@gmail.com>
Reviewed-by: Li Qiang <liq3ea@gmail.com>
Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/tulip.c | 36 +++++++++++++++++++++++++++---------
 1 file changed, 27 insertions(+), 9 deletions(-)

diff --git a/hw/net/tulip.c b/hw/net/tulip.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/tulip.c
+++ b/hw/net/tulip.c
@@ -XXX,XX +XXX,XX @@ static void tulip_copy_rx_bytes(TULIPState *s, struct tulip_descriptor *desc)
         } else {
             len = s->rx_frame_len;
         }
+
+        if (s->rx_frame_len + len > sizeof(s->rx_frame)) {
+            return;
+        }
         pci_dma_write(&s->dev, desc->buf_addr1, s->rx_frame +
             (s->rx_frame_size - s->rx_frame_len), len);
         s->rx_frame_len -= len;
@@ -XXX,XX +XXX,XX @@ static void tulip_copy_rx_bytes(TULIPState *s, struct tulip_descriptor *desc)
         } else {
             len = s->rx_frame_len;
         }
+
+        if (s->rx_frame_len + len > sizeof(s->rx_frame)) {
+            return;
+        }
         pci_dma_write(&s->dev, desc->buf_addr2, s->rx_frame +
             (s->rx_frame_size - s->rx_frame_len), len);
         s->rx_frame_len -= len;
@@ -XXX,XX +XXX,XX @@ static ssize_t tulip_receive(TULIPState *s, const uint8_t *buf, size_t size)
 
     trace_tulip_receive(buf, size);
 
-    if (size < 14 || size > 2048 || s->rx_frame_len || tulip_rx_stopped(s)) {
+    if (size < 14 || size > sizeof(s->rx_frame) - 4
+        || s->rx_frame_len || tulip_rx_stopped(s)) {
         return 0;
     }
 
@@ -XXX,XX +XXX,XX @@ static ssize_t tulip_receive_nc(NetClientState *nc,
     return tulip_receive(qemu_get_nic_opaque(nc), buf, size);
 }
 
-
 static NetClientInfo net_tulip_info = {
     .type = NET_CLIENT_DRIVER_NIC,
     .size = sizeof(NICState),
@@ -XXX,XX +XXX,XX @@ static void tulip_tx(TULIPState *s, struct tulip_descriptor *desc)
         if ((s->csr[6] >> CSR6_OM_SHIFT) & CSR6_OM_MASK) {
             /* Internal or external Loopback */
             tulip_receive(s, s->tx_frame, s->tx_frame_len);
-        } else {
+        } else if (s->tx_frame_len <= sizeof(s->tx_frame)) {
             qemu_send_packet(qemu_get_queue(s->nic),
                 s->tx_frame, s->tx_frame_len);
         }
@@ -XXX,XX +XXX,XX @@ static void tulip_tx(TULIPState *s, struct tulip_descriptor *desc)
     }
 }
 
-static void tulip_copy_tx_buffers(TULIPState *s, struct tulip_descriptor *desc)
+static int tulip_copy_tx_buffers(TULIPState *s, struct tulip_descriptor *desc)
 {
     int len1 = (desc->control >> TDES1_BUF1_SIZE_SHIFT) & TDES1_BUF1_SIZE_MASK;
     int len2 = (desc->control >> TDES1_BUF2_SIZE_SHIFT) & TDES1_BUF2_SIZE_MASK;
 
+    if (s->tx_frame_len + len1 > sizeof(s->tx_frame)) {
+        return -1;
+    }
     if (len1) {
         pci_dma_read(&s->dev, desc->buf_addr1,
             s->tx_frame + s->tx_frame_len, len1);
         s->tx_frame_len += len1;
     }
 
+    if (s->tx_frame_len + len2 > sizeof(s->tx_frame)) {
+        return -1;
+    }
     if (len2) {
         pci_dma_read(&s->dev, desc->buf_addr2,
             s->tx_frame + s->tx_frame_len, len2);
         s->tx_frame_len += len2;
     }
     desc->status = (len1 + len2) ? 0 : 0x7fffffff;
+
+    return 0;
 }
 
 static void tulip_setup_filter_addr(TULIPState *s, uint8_t *buf, int n)
@@ -XXX,XX +XXX,XX @@ static uint32_t tulip_ts(TULIPState *s)
 
 static void tulip_xmit_list_update(TULIPState *s)
 {
+#define TULIP_DESC_MAX 128
+    uint8_t i = 0;
     struct tulip_descriptor desc;
 
     if (tulip_ts(s) != CSR5_TS_SUSPENDED) {
         return;
     }
 
-    for (;;) {
+    for (i = 0; i < TULIP_DESC_MAX; i++) {
         tulip_desc_read(s, s->current_tx_desc, &desc);
         tulip_dump_tx_descriptor(s, &desc);
 
@@ -XXX,XX +XXX,XX @@ static void tulip_xmit_list_update(TULIPState *s)
                 s->tx_frame_len = 0;
             }
 
-            tulip_copy_tx_buffers(s, &desc);
-
-            if (desc.control & TDES1_LS) {
-                tulip_tx(s, &desc);
+            if (!tulip_copy_tx_buffers(s, &desc)) {
+                if (desc.control & TDES1_LS) {
+                    tulip_tx(s, &desc);
+                }
             }
         }
         tulip_desc_write(s, s->current_tx_desc, &desc);
-- 
2.5.0

From: Peter Maydell <peter.maydell@linaro.org>

Coverity points out (CID 1421926) that the read code for
REG_ADDR_HIGH reads off the end of the buffer, because it does a
32-bit read from byte 4 of a 6-byte buffer.

The code also has an endianness issue for both REG_ADDR_HIGH and
REG_ADDR_LOW, because it will do the wrong thing on a big-endian
host.

Rewrite the read code to use ldl_le_p() and lduw_le_p() to fix this;
the write code is not incorrect, but for consistency we make it use
stl_le_p() and stw_le_p().

Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
Tested-by: Niek Linnenbank <nieklinnenbank@gmail.com>
Reviewed-by: Niek Linnenbank <nieklinnenbank@gmail.com>
Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/allwinner-sun8i-emac.c | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/hw/net/allwinner-sun8i-emac.c b/hw/net/allwinner-sun8i-emac.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/allwinner-sun8i-emac.c
+++ b/hw/net/allwinner-sun8i-emac.c
@@ -XXX,XX +XXX,XX @@ static uint64_t allwinner_sun8i_emac_read(void *opaque, hwaddr offset,
         value = s->mii_data;
         break;
     case REG_ADDR_HIGH:         /* MAC Address High */
-        value = *(((uint32_t *) (s->conf.macaddr.a)) + 1);
+        value = lduw_le_p(s->conf.macaddr.a + 4);
         break;
     case REG_ADDR_LOW:          /* MAC Address Low */
-        value = *(uint32_t *) (s->conf.macaddr.a);
+        value = ldl_le_p(s->conf.macaddr.a);
         break;
     case REG_TX_DMA_STA:        /* Transmit DMA Status */
         break;
@@ -XXX,XX +XXX,XX @@ static void allwinner_sun8i_emac_write(void *opaque, hwaddr offset,
         s->mii_data = value;
         break;
     case REG_ADDR_HIGH:         /* MAC Address High */
-        s->conf.macaddr.a[4] = (value & 0xff);
-        s->conf.macaddr.a[5] = (value & 0xff00) >> 8;
+        stw_le_p(s->conf.macaddr.a + 4, value);
         break;
     case REG_ADDR_LOW:          /* MAC Address Low */
-        s->conf.macaddr.a[0] = (value & 0xff);
-        s->conf.macaddr.a[1] = (value & 0xff00) >> 8;
-        s->conf.macaddr.a[2] = (value & 0xff0000) >> 16;
-        s->conf.macaddr.a[3] = (value & 0xff000000) >> 24;
+        stl_le_p(s->conf.macaddr.a, value);
         break;
     case REG_TX_DMA_STA:        /* Transmit DMA Status */
     case REG_TX_CUR_DESC:       /* Transmit Current Descriptor */
-- 
2.5.0

The following changes since commit d9a4282c4b690e45d25c2b933f318bb41eeb271d:

Merge tag 'pull-tcg-20250308' of https://gitlab.com/rth7680/qemu into staging (2025-03-09 11:45:00 +0800)

are available in the Git repository at:

https://github.com/jasowang/qemu.git tags/net-pull-request

for you to fetch changes up to ac2ff9b840ce82cc7d5fd9ce4fd3019a434d7dc9:

tap-linux: Open ipvtap and macvtap (2025-03-10 17:07:16 +0800)

----------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----

iQEzBAABCAAdFiEEIV1G9IJGaJ7HfzVi7wSWWzmNYhEFAmfO1zkACgkQ7wSWWzmN
YhET+wf+PkaGeFTNUrOtWpl35fSMKlmOVbb1fkPfuhVBmeY2Vh1EIN3OjqnzdV0F
wxpuk+wwmFiuV1n6RNuMHQ0nz1mhgsSlZh93N5rArC/PUr3iViaT0cb82RjwxhaI
RODBhhy7V9WxEhT9hR8sCP2ky2mrKgcYbjiIEw+IvFZOVQa58rMr2h/cbAb/iH4l
7T9Wba03JBqOS6qgzSFZOMxvqnYdVjhqXN8M6W9ngRJOjPEAkTB6Evwep6anRjcM
mCUOgkf2sgQwKve8pYAeTMkzXFctvTc/qCU4ZbN8XcoKVVxe2jllGQqdOpMskPEf
slOuINeW5M0K5gyjsb/huqcOTfDI2A==
=/Y0+
-----END PGP SIGNATURE-----

----------------------------------------------------------------
Akihiko Odaki (3):
      util/iov: Do not assert offset is in iov
      Revert "hw/net/net_tx_pkt: Fix overrun in update_sctp_checksum()"
      tap-linux: Open ipvtap and macvtap

Eugenio Pérez (2):
      net: parameterize the removing client from nc list
      net: move backend cleanup to NIC cleanup

From: Eugenio Pérez <eperezma@redhat.com>

This change is used in later commits so we can avoid the removal of the
netclient if it is delayed.

No functional change intended.

Reviewed-by: Si-Wei Liu <si-wei.liu@oracle.com>
Acked-by: Jason Wang <jasowang@redhat.com>
Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/net.c | 13 ++++++++-----
 1 file changed, 8 insertions(+), 5 deletions(-)

diff --git a/net/net.c b/net/net.c
index XXXXXXX..XXXXXXX 100644
--- a/net/net.c
+++ b/net/net.c
@@ -XXX,XX +XXX,XX @@ NetClientState *qemu_get_peer(NetClientState *nc, int queue_index)
     return ncs->peer;
 }
 
-static void qemu_cleanup_net_client(NetClientState *nc)
+static void qemu_cleanup_net_client(NetClientState *nc,
+                                    bool remove_from_net_clients)
 {
-    QTAILQ_REMOVE(&net_clients, nc, next);
+    if (remove_from_net_clients) {
+        QTAILQ_REMOVE(&net_clients, nc, next);
+    }
 
     if (nc->info->cleanup) {
         nc->info->cleanup(nc);
@@ -XXX,XX +XXX,XX @@ void qemu_del_net_client(NetClientState *nc)
         }
 
         for (i = 0; i < queues; i++) {
-            qemu_cleanup_net_client(ncs[i]);
+            qemu_cleanup_net_client(ncs[i], true);
         }
 
         return;
     }
 
     for (i = 0; i < queues; i++) {
-        qemu_cleanup_net_client(ncs[i]);
+        qemu_cleanup_net_client(ncs[i], true);
         qemu_free_net_client(ncs[i]);
     }
 }
@@ -XXX,XX +XXX,XX @@ void qemu_del_nic(NICState *nic)
     for (i = queues - 1; i >= 0; i--) {
         NetClientState *nc = qemu_get_subqueue(nic, i);
 
-        qemu_cleanup_net_client(nc);
+        qemu_cleanup_net_client(nc, true);
         qemu_free_net_client(nc);
     }
 
-- 
2.42.0

From: Eugenio Pérez <eperezma@redhat.com>

Commit a0d7215e33 ("vhost-vdpa: do not cleanup the vdpa/vhost-net
structures if peer nic is present") effectively delayed the backend
cleanup, allowing the frontend or the guest to access it resources as
long as the frontend is still visible to the guest.

However it does not clean up the resources until the qemu process is
over.  This causes an effective leak if the device is deleted with
device_del, as there is no way to close the vdpa device.  This makes
impossible to re-add that device to this or other QEMU instances until
the first instance of QEMU is finished.

Move the cleanup from qemu_cleanup to the NIC deletion and to
net_cleanup.

Fixes: a0d7215e33 ("vhost-vdpa: do not cleanup the vdpa/vhost-net structures if peer nic is present")
Reported-by: Lei Yang <leiyang@redhat.com>
Signed-off-by: Eugenio Pérez <eperezma@redhat.com>
Signed-off-by: Jonah Palmer <jonah.palmer@oracle.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/net.c        | 33 +++++++++++++++++++++++++++------
 net/vhost-vdpa.c |  8 --------
 2 files changed, 27 insertions(+), 14 deletions(-)

diff --git a/net/net.c b/net/net.c
index XXXXXXX..XXXXXXX 100644
--- a/net/net.c
+++ b/net/net.c
@@ -XXX,XX +XXX,XX @@ void qemu_del_net_client(NetClientState *nc)
         object_unparent(OBJECT(nf));
     }
 
-    /* If there is a peer NIC, delete and cleanup client, but do not free. */
+    /*
+     * If there is a peer NIC, transfer ownership to it.  Delete the client
+     * from net_client list but do not cleanup nor free.  This way NIC can
+     * still access to members of the backend.
+     *
+     * The cleanup and free will be done when the NIC is free.
+     */
     if (nc->peer && nc->peer->info->type == NET_CLIENT_DRIVER_NIC) {
         NICState *nic = qemu_get_nic(nc->peer);
         if (nic->peer_deleted) {
@@ -XXX,XX +XXX,XX @@ void qemu_del_net_client(NetClientState *nc)
 
         for (i = 0; i < queues; i++) {
             ncs[i]->peer->link_down = true;
+            QTAILQ_REMOVE(&net_clients, ncs[i], next);
         }
 
         if (nc->peer->info->link_status_changed) {
             nc->peer->info->link_status_changed(nc->peer);
         }
 
-        for (i = 0; i < queues; i++) {
-            qemu_cleanup_net_client(ncs[i], true);
-        }
-
         return;
     }
 
@@ -XXX,XX +XXX,XX @@ void qemu_del_nic(NICState *nic)
 
     for (i = 0; i < queues; i++) {
         NetClientState *nc = qemu_get_subqueue(nic, i);
-        /* If this is a peer NIC and peer has already been deleted, free it now. */
+        /*
+         * If this is a peer NIC and peer has already been deleted, clean it up
+         * and free it now.
+         */
         if (nic->peer_deleted) {
+            qemu_cleanup_net_client(nc->peer, false);
             qemu_free_net_client(nc->peer);
         } else if (nc->peer) {
             /* if there are RX packets pending, complete them */
@@ -XXX,XX +XXX,XX @@ void net_cleanup(void)
      * of the latest NET_CLIENT_DRIVER_NIC, and operate on *p as we walk
      * the list.
      *
+     * However, the NIC may have peers that trust to be clean beyond this
+     * point.  For example, if they have been removed with device_del.
+     *
      * The 'nc' variable isn't part of the list traversal; it's purely
      * for convenience as too much '(*p)->' has a tendency to make the
      * readers' eyes bleed.
@@ -XXX,XX +XXX,XX @@ void net_cleanup(void)
     while (*p) {
         nc = *p;
         if (nc->info->type == NET_CLIENT_DRIVER_NIC) {
+            NICState *nic = qemu_get_nic(nc);
+
+            if (nic->peer_deleted) {
+                int queues = MAX(nic->conf->peers.queues, 1);
+
+                for (int i = 0; i < queues; i++) {
+                    nc = qemu_get_subqueue(nic, i);
+                    qemu_cleanup_net_client(nc->peer, false);
+                }
+            }
+
             /* Skip NET_CLIENT_DRIVER_NIC entries */
             p = &QTAILQ_NEXT(nc, next);
         } else {
diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index XXXXXXX..XXXXXXX 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -XXX,XX +XXX,XX @@ static void vhost_vdpa_cleanup(NetClientState *nc)
 {
     VhostVDPAState *s = DO_UPCAST(VhostVDPAState, nc, nc);
 
-    /*
-     * If a peer NIC is attached, do not cleanup anything.
-     * Cleanup will happen as a part of qemu_cleanup() -> net_cleanup()
-     * when the guest is shutting down.
-     */
-    if (nc->peer && nc->peer->info->type == NET_CLIENT_DRIVER_NIC) {
-        return;
-    }
     munmap(s->cvq_cmd_out_buffer, vhost_vdpa_net_cvq_cmd_page_len());
     munmap(s->status, vhost_vdpa_net_cvq_cmd_page_len());
     if (s->vhost_net) {
-- 
2.42.0

From: Akihiko Odaki <akihiko.odaki@daynix.com>

iov_from_buf(), iov_to_buf(), iov_memset(), and iov_copy() asserts
that the given offset fits in the iov while tolerating the specified
number of bytes to operate with to be greater than the size of iov.
This is inconsistent so remove the assertions.

Asserting the offset fits in the iov makes sense if it is expected that
there are other operations that process the content before the offset
and the content is processed in order. Under this expectation, the
offset should point to the end of bytes that are previously processed
and fit in the iov. However, this expectation depends on the details of
the caller, and did not hold true at least one case and required code to
check iov_size(), which is added with commit 83ddb3dbba2e
("hw/net/net_tx_pkt: Fix overrun in update_sctp_checksum()").

Adding such a check is inefficient and error-prone. These functions
already tolerate the specified number of bytes to operate with to be
greater than the size of iov to avoid such checks so remove the
assertions to tolerate invalid offset as well. They return the number of
bytes they operated with so their callers can still check the returned
value to ensure there are sufficient space at the given offset.

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 include/qemu/iov.h | 5 +++--
 util/iov.c         | 5 -----
 2 files changed, 3 insertions(+), 7 deletions(-)

diff --git a/include/qemu/iov.h b/include/qemu/iov.h
index XXXXXXX..XXXXXXX 100644
--- a/include/qemu/iov.h
+++ b/include/qemu/iov.h
@@ -XXX,XX +XXX,XX @@ size_t iov_size(const struct iovec *iov, const unsigned int iov_cnt);
  * only part of data will be copied, up to the end of the iovec.
  * Number of bytes actually copied will be returned, which is
  *  min(bytes, iov_size(iov)-offset)
- * `Offset' must point to the inside of iovec.
+ * Returns 0 when `offset' points to the outside of iovec.
  */
 size_t iov_from_buf_full(const struct iovec *iov, unsigned int iov_cnt,
                          size_t offset, const void *buf, size_t bytes);
@@ -XXX,XX +XXX,XX @@ iov_to_buf(const struct iovec *iov, const unsigned int iov_cnt,
 /**
  * Set data bytes pointed out by iovec `iov' of size `iov_cnt' elements,
  * starting at byte offset `start', to value `fillc', repeating it
- * `bytes' number of times.  `Offset' must point to the inside of iovec.
+ * `bytes' number of times.
  * If `bytes' is large enough, only last bytes portion of iovec,
  * up to the end of it, will be filled with the specified value.
  * Function return actual number of bytes processed, which is
  * min(size, iov_size(iov) - offset).
+ * Returns 0 when `offset' points to the outside of iovec.
  */
 size_t iov_memset(const struct iovec *iov, const unsigned int iov_cnt,
                   size_t offset, int fillc, size_t bytes);
diff --git a/util/iov.c b/util/iov.c
index XXXXXXX..XXXXXXX 100644
--- a/util/iov.c
+++ b/util/iov.c
@@ -XXX,XX +XXX,XX @@ size_t iov_from_buf_full(const struct iovec *iov, unsigned int iov_cnt,
             offset -= iov[i].iov_len;
         }
     }
-    assert(offset == 0);
     return done;
 }
 
@@ -XXX,XX +XXX,XX @@ size_t iov_to_buf_full(const struct iovec *iov, const unsigned int iov_cnt,
             offset -= iov[i].iov_len;
         }
     }
-    assert(offset == 0);
     return done;
 }
 
@@ -XXX,XX +XXX,XX @@ size_t iov_memset(const struct iovec *iov, const unsigned int iov_cnt,
             offset -= iov[i].iov_len;
         }
     }
-    assert(offset == 0);
     return done;
 }
 
@@ -XXX,XX +XXX,XX @@ unsigned iov_copy(struct iovec *dst_iov, unsigned int dst_iov_cnt,
         bytes -= len;
         offset = 0;
     }
-    assert(offset == 0);
     return j;
 }
 
@@ -XXX,XX +XXX,XX @@ size_t qemu_iovec_concat_iov(QEMUIOVector *dst,
             soffset -= src_iov[i].iov_len;
         }
     }
-    assert(soffset == 0); /* offset beyond end of src */
 
     return done;
 }
-- 
2.42.0

From: Akihiko Odaki <akihiko.odaki@daynix.com>

ipvtap and macvtap create a file for each interface unlike tuntap, which
creates one file shared by all interfaces. Try to open a file dedicated
to the interface first for ipvtap and macvtap.

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/tap-linux.c | 17 ++++++++++++++---
 1 file changed, 14 insertions(+), 3 deletions(-)

diff --git a/net/tap-linux.c b/net/tap-linux.c
index XXXXXXX..XXXXXXX 100644
--- a/net/tap-linux.c
+++ b/net/tap-linux.c
@@ -XXX,XX +XXX,XX @@ int tap_open(char *ifname, int ifname_size, int *vnet_hdr,
     int len = sizeof(struct virtio_net_hdr);
     unsigned int features;
 
-    fd = RETRY_ON_EINTR(open(PATH_NET_TUN, O_RDWR));
+
+    ret = if_nametoindex(ifname);
+    if (ret) {
+        g_autofree char *file = g_strdup_printf("/dev/tap%d", ret);
+        fd = open(file, O_RDWR);
+    } else {
+        fd = -1;
+    }
+
     if (fd < 0) {
-        error_setg_errno(errp, errno, "could not open %s", PATH_NET_TUN);
-        return -1;
+        fd = RETRY_ON_EINTR(open(PATH_NET_TUN, O_RDWR));
+        if (fd < 0) {
+            error_setg_errno(errp, errno, "could not open %s", PATH_NET_TUN);
+            return -1;
+        }
     }
     memset(&ifr, 0, sizeof(ifr));
     ifr.ifr_flags = IFF_TAP | IFF_NO_PI;
-- 
2.42.0