The following changes since commit 23895cbd82be95428e90168b12e925d0d3ca2f06:

Merge remote-tracking branch 'remotes/awilliam/tags/vfio-update-20201123.0' into staging (2020-11-23 18:51:13 +0000)

for you to fetch changes up to 9925990d01a92564af55f6f69d0f5f59b47609b1:

net: Use correct default-path macro for downscript (2020-11-24 10:40:17 +0800)

Keqian Zhu (1):

net: Use correct default-path macro for downscript

Paolo Bonzini (1):

net: do not exit on "netdev_add help" monitor command

Prasad J Pandit (1):

hw/net/e1000e: advance desc_offset in case of null descriptor

Yuri Benditovich (1):

net: purge queued rx packets on queue deletion

yuanjungong (1):

tap: fix a memory leak

hw/net/e1000e_core.c | 8 +++---

include/net/net.h | 1 +

monitor/hmp-cmds.c | 6 ++++

net/net.c | 80 +++++++++++++++++++++++++++-------------------------

net/tap.c | 5 +++-

5 files changed, 57 insertions(+), 43 deletions(-)

While receiving packets via e1000e_write_packet_to_guest() routine,

'desc_offset' is advanced only when RX descriptor is processed. And

RX descriptor is not processed if it has NULL buffer address.

This may lead to an infinite loop condition. Increament 'desc_offset'

to process next descriptor in the ring to avoid infinite loop.

Reported-by: Cheol-woo Myung <330cjfdn@gmail.com>

hw/net/e1000e_core.c | 8 ++++----

1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/net/e1000e_core.c b/hw/net/e1000e_core.c

--- a/hw/net/e1000e_core.c

+++ b/hw/net/e1000e_core.c

@@ -XXX,XX +XXX,XX @@ e1000e_write_packet_to_guest(E1000ECore *core, struct NetRxPkt *pkt,

(const char *) &fcs_pad, e1000x_fcs_len(core->mac));

}

}

- desc_offset += desc_size;

- if (desc_offset >= total_size) {

- is_last = true;

- }

} else { /* as per intel docs; skip descriptors with null buf addr */

trace_e1000e_rx_null_descriptor();

}

+ desc_offset += desc_size;

+ if (desc_offset >= total_size) {

+ is_last = true;

e1000e_write_rx_descr(core, desc, is_last ? core->rx_pkt : NULL,

rss_info, do_ps ? ps_hdr_len : 0, &bastate.written);

From: Keqian Zhu <zhukeqian1@huawei.com>

Fixes: 63c4db4c2e6d (net: relocate paths to helpers and scripts)

Signed-off-by: Keqian Zhu <zhukeqian1@huawei.com>

net/tap.c | 3 ++-

1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/tap.c b/net/tap.c

--- a/net/tap.c

+++ b/net/tap.c

@@ -XXX,XX +XXX,XX @@ free_fail:

script = default_script = get_relocated_path(DEFAULT_NETWORK_SCRIPT);

}

if (!downscript) {

- downscript = default_downscript = get_relocated_path(DEFAULT_NETWORK_SCRIPT);

+ downscript = default_downscript =

+ get_relocated_path(DEFAULT_NETWORK_DOWN_SCRIPT);

}

if (tap->has_ifname) {

From: Yuri Benditovich <yuri.benditovich@daynix.com>

https://bugzilla.redhat.com/show_bug.cgi?id=1829272

When deleting queue pair, purge pending RX packets if any.

Example of problematic flow:

1. Bring up q35 VM with tap (vhost off) and virtio-net or e1000e

2. Run ping flood to the VM NIC ( 1 ms interval)

3. Hot unplug the NIC device (device_del)

During unplug process one or more packets come, the NIC

can't receive, tap disables read_poll

4. Hot plug the device (device_add) with the same netdev

The tap stays with read_poll disabled and does not receive

any packets anymore (tap_send never triggered)

Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>

net/net.c | 12 ++++++++----

1 file changed, 8 insertions(+), 4 deletions(-)

diff --git a/net/net.c b/net/net.c

--- a/net/net.c

+++ b/net/net.c

@@ -XXX,XX +XXX,XX @@ void qemu_del_nic(NICState *nic)

qemu_macaddr_set_free(&nic->conf->macaddr);

- /* If this is a peer NIC and peer has already been deleted, free it now. */

- if (nic->peer_deleted) {

- for (i = 0; i < queues; i++) {

- qemu_free_net_client(qemu_get_subqueue(nic, i)->peer);

+ for (i = 0; i < queues; i++) {

+ NetClientState *nc = qemu_get_subqueue(nic, i);

+ /* If this is a peer NIC and peer has already been deleted, free it now. */

+ if (nic->peer_deleted) {

+ qemu_free_net_client(nc->peer);

+ } else if (nc->peer) {

+ /* if there are RX packets pending, complete them */

+ qemu_purge_queued_packets(nc->peer);

}