[PULL 00/16] Net patches

[PULL 00/16] Net patches

[Jason Wang]

The following changes since commit f4abdf32714d1845b7c01ec136dd2b04c2f7db47:

  Merge remote-tracking branch 'remotes/stsquad/tags/pull-testing-docs-xen-updates-100321-2' into staging (2021-03-11 16:20:58 +0000)

are available in the git repository at:

  https://github.com/jasowang/qemu.git tags/net-pull-request

for you to fetch changes up to 9bdb56367679e68e5e71a1c29a1087bda6414b25:

  pvrdma: wean code off pvrdma_ring.h kernel header (2021-03-12 14:08:31 +0800)

----------------------------------------------------------------

----------------------------------------------------------------
Alexander Bulekov (4):
      rtl8139: switch to use qemu_receive_packet() for loopback
      pcnet: switch to use qemu_receive_packet() for loopback
      cadence_gem: switch to use qemu_receive_packet() for loopback
      lan9118: switch to use qemu_receive_packet() for loopback

Bin Meng (1):
      net: Fix build error when DEBUG_NET is on

Cornelia Huck (1):
      pvrdma: wean code off pvrdma_ring.h kernel header

Jason Wang (9):
      virtio-net: calculating proper msix vectors on init
      net: unbreak well-form id check for "-nic"
      e1000: fail early for evil descriptor
      net: introduce qemu_receive_packet()
      e1000: switch to use qemu_receive_packet() for loopback
      dp8393x: switch to use qemu_receive_packet() for loopback packet
      msf2-mac: switch to use qemu_receive_packet() for loopback
      sungem: switch to use qemu_receive_packet() for loopback
      tx_pkt: switch to use qemu_receive_packet_iov() for loopback

Paolo Bonzini (1):
      net: validate that ids are well formed

 hw/core/machine.c                                  |   1 +
 hw/net/cadence_gem.c                               |   4 +-
 hw/net/dp8393x.c                                   |   2 +-
 hw/net/e1000.c                                     |   6 +-
 hw/net/lan9118.c                                   |   2 +-
 hw/net/msf2-emac.c                                 |   2 +-
 hw/net/net_tx_pkt.c                                |   2 +-
 hw/net/pcnet.c                                     |   2 +-
 hw/net/rtl8139.c                                   |   2 +-
 hw/net/sungem.c                                    |   2 +-
 hw/rdma/vmw/pvrdma.h                               |   5 +-
 hw/rdma/vmw/pvrdma_cmd.c                           |   6 +-
 hw/rdma/vmw/pvrdma_dev_ring.c                      |  41 ++++----
 hw/rdma/vmw/pvrdma_dev_ring.h                      |   9 +-
 hw/rdma/vmw/pvrdma_main.c                          |   4 +-
 hw/virtio/virtio-net-pci.c                         |  10 +-
 include/net/net.h                                  |   5 +
 include/net/queue.h                                |   8 ++
 .../drivers/infiniband/hw/vmw_pvrdma/pvrdma_ring.h | 114 ---------------------
 net/net.c                                          |  53 ++++++++--
 net/queue.c                                        |  22 ++++
 scripts/update-linux-headers.sh                    |   3 +-
 22 files changed, 142 insertions(+), 163 deletions(-)
 delete mode 100644 include/standard-headers/drivers/infiniband/hw/vmw_pvrdma/pvrdma_ring.h

[PULL 01/16] virtio-net: calculating proper msix vectors on init

[Jason Wang]

Currently, the default msix vectors for virtio-net-pci is 3 which is
obvious not suitable for multiqueue guest, so we depends on the user
or management tools to pass a correct vectors parameter. In fact, we
can simplifying this by calculating the number of vectors on realize.

Consider we have N queues, the number of vectors needed is 2*N + 2
(#queue pairs + plus one config interrupt and control vq). We didn't
check whether or not host support control vq because it was added
unconditionally by qemu to avoid breaking legacy guests such as Minix.

Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com
Reviewed-by: Stefano Garzarella <sgarzare@redhat.com>
Reviewed-by: Stefan Hajnoczi <stefanha@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/core/machine.c          |  1 +
 hw/virtio/virtio-net-pci.c | 10 +++++++++-
 2 files changed, 10 insertions(+), 1 deletion(-)

diff --git a/hw/core/machine.c b/hw/core/machine.c
index 4386f57..979133f 100644
--- a/hw/core/machine.c
+++ b/hw/core/machine.c
@@ -39,6 +39,7 @@
 GlobalProperty hw_compat_5_2[] = {
     { "ICH9-LPC", "smm-compat", "on"},
     { "PIIX4_PM", "smm-compat", "on"},
+    { "virtio-net-pci", "vectors", "3"},
 };
 const size_t hw_compat_5_2_len = G_N_ELEMENTS(hw_compat_5_2);
 
diff --git a/hw/virtio/virtio-net-pci.c b/hw/virtio/virtio-net-pci.c
index 292d13d..aa0b3ca 100644
--- a/hw/virtio/virtio-net-pci.c
+++ b/hw/virtio/virtio-net-pci.c
@@ -41,7 +41,8 @@ struct VirtIONetPCI {
 static Property virtio_net_properties[] = {
     DEFINE_PROP_BIT("ioeventfd", VirtIOPCIProxy, flags,
                     VIRTIO_PCI_FLAG_USE_IOEVENTFD_BIT, true),
-    DEFINE_PROP_UINT32("vectors", VirtIOPCIProxy, nvectors, 3),
+    DEFINE_PROP_UINT32("vectors", VirtIOPCIProxy, nvectors,
+                       DEV_NVECTORS_UNSPECIFIED),
     DEFINE_PROP_END_OF_LIST(),
 };
 
@@ -50,6 +51,13 @@ static void virtio_net_pci_realize(VirtIOPCIProxy *vpci_dev, Error **errp)
     DeviceState *qdev = DEVICE(vpci_dev);
     VirtIONetPCI *dev = VIRTIO_NET_PCI(vpci_dev);
     DeviceState *vdev = DEVICE(&dev->vdev);
+    VirtIONet *net = VIRTIO_NET(vdev);
+
+    if (vpci_dev->nvectors == DEV_NVECTORS_UNSPECIFIED) {
+        vpci_dev->nvectors = 2 * MAX(net->nic_conf.peers.queues, 1)
+            + 1 /* Config interrupt */
+            + 1 /* Control vq */;
+    }
 
     virtio_net_set_netclient_name(&dev->vdev, qdev->id,
                                   object_get_typename(OBJECT(qdev)));
-- 
2.7.4

[PULL 02/16] net: Fix build error when DEBUG_NET is on

[Jason Wang]

From: Bin Meng <bin.meng@windriver.com>

"qemu-common.h" should be included to provide the forward declaration
of qemu_hexdump() when DEBUG_NET is on.

Signed-off-by: Bin Meng <bin.meng@windriver.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/net.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/net.c b/net/net.c
index 6002ba5..9c784da 100644
--- a/net/net.c
+++ b/net/net.c
@@ -23,6 +23,7 @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu-common.h"
 
 #include "net/net.h"
 #include "clients.h"
-- 
2.7.4

[PULL 03/16] net: validate that ids are well formed

[Jason Wang]

From: Paolo Bonzini <pbonzini@redhat.com>

When a network or network device is created from the command line or HMP,
QemuOpts ensures that the id passes the id_wellformed check.  However,
QMP skips this:

   $ qemu-system-x86_64 -qmp stdio -S -nic user,id=123/456
   qemu-system-x86_64: -nic user,id=123/456: Parameter id expects an identifier
   Identifiers consist of letters, digits, -, ., _, starting with a letter.

   $ qemu-system-x86_64 -qmp stdio -S
   {"execute":"qmp_capabilities"}
   {"return": {}}
   {"execute":"netdev_add", "arguments": {"type": "user", "id": "123/456"}}
   {"return": {}}

After:

   $ qemu-system-x86_64 -qmp stdio -S
   {"execute":"qmp_capabilities"}
   {"return": {}}
   {"execute":"netdev_add", "arguments": {"type": "user", "id": "123/456"}}
   {"error": {"class": "GenericError", "desc": "Parameter "id" expects an identifier"}}

Validity checks should be performed always at the bottom of the call chain,
because QMP skips all the steps above.  Do this for the network subsystem.

Cc: Jason Wang <jasowang@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/net.c | 12 ++++++++++++
 1 file changed, 12 insertions(+)

diff --git a/net/net.c b/net/net.c
index 9c784da..d36729f 100644
--- a/net/net.c
+++ b/net/net.c
@@ -44,6 +44,7 @@
 #include "qemu/cutils.h"
 #include "qemu/config-file.h"
 #include "qemu/ctype.h"
+#include "qemu/id.h"
 #include "qemu/iov.h"
 #include "qemu/qemu-print.h"
 #include "qemu/main-loop.h"
@@ -1011,6 +1012,17 @@ static int net_client_init1(const Netdev *netdev, bool is_netdev, Error **errp)
         }
     }
 
+    /*
+     * The id for -net has already been checked by QemuOpts and
+     * could be automatically generated, in which case it is not
+     * well-formed by design.  HMP and QMP only call us with
+     * is_netdev == true.
+     */
+    if (is_netdev && !id_wellformed(netdev->id)) {
+        error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "id", "an identifier");
+        return -1;
+    }
+
     nc = qemu_find_netdev(netdev->id);
     if (nc) {
         error_setg(errp, "Duplicate ID '%s'", netdev->id);
-- 
2.7.4

Re: [PULL 03/16] net: validate that ids are well formed

[Paolo Bonzini]

On 12/03/21 07:16, Jason Wang wrote:
> From: Paolo Bonzini <pbonzini@redhat.com>
> 
> When a network or network device is created from the command line or HMP,
> QemuOpts ensures that the id passes the id_wellformed check.  However,
> QMP skips this:
> 
>     $ qemu-system-x86_64 -qmp stdio -S -nic user,id=123/456
>     qemu-system-x86_64: -nic user,id=123/456: Parameter id expects an identifier
>     Identifiers consist of letters, digits, -, ., _, starting with a letter.
> 
>     $ qemu-system-x86_64 -qmp stdio -S
>     {"execute":"qmp_capabilities"}
>     {"return": {}}
>     {"execute":"netdev_add", "arguments": {"type": "user", "id": "123/456"}}
>     {"return": {}}
> 
> After:
> 
>     $ qemu-system-x86_64 -qmp stdio -S
>     {"execute":"qmp_capabilities"}
>     {"return": {}}
>     {"execute":"netdev_add", "arguments": {"type": "user", "id": "123/456"}}
>     {"error": {"class": "GenericError", "desc": "Parameter "id" expects an identifier"}}
> 
> Validity checks should be performed always at the bottom of the call chain,
> because QMP skips all the steps above.  Do this for the network subsystem.
> 
> Cc: Jason Wang <jasowang@redhat.com>
> Reviewed-by: Eric Blake <eblake@redhat.com>
> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
> Signed-off-by: Jason Wang <jasowang@redhat.com>
> ---
>   net/net.c | 12 ++++++++++++
>   1 file changed, 12 insertions(+)
> 
> diff --git a/net/net.c b/net/net.c
> index 9c784da..d36729f 100644
> --- a/net/net.c
> +++ b/net/net.c
> @@ -44,6 +44,7 @@
>   #include "qemu/cutils.h"
>   #include "qemu/config-file.h"
>   #include "qemu/ctype.h"
> +#include "qemu/id.h"
>   #include "qemu/iov.h"
>   #include "qemu/qemu-print.h"
>   #include "qemu/main-loop.h"
> @@ -1011,6 +1012,17 @@ static int net_client_init1(const Netdev *netdev, bool is_netdev, Error **errp)
>           }
>       }
>   
> +    /*
> +     * The id for -net has already been checked by QemuOpts and
> +     * could be automatically generated, in which case it is not
> +     * well-formed by design.  HMP and QMP only call us with
> +     * is_netdev == true.
> +     */
> +    if (is_netdev && !id_wellformed(netdev->id)) {
> +        error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "id", "an identifier");
> +        return -1;
> +    }
> +
>       nc = qemu_find_netdev(netdev->id);
>       if (nc) {
>           error_setg(errp, "Duplicate ID '%s'", netdev->id);
> 

Sorry, I sent v2 yesterday.  This patch passed the tests at the time it 
was submitted, but now fails (because it does not work with -nic).

Paolo

Re: [PULL 03/16] net: validate that ids are well formed

[Jason Wang]

On 2021/3/12 4:44 下午, Paolo Bonzini wrote:
> On 12/03/21 07:16, Jason Wang wrote:
>> From: Paolo Bonzini <pbonzini@redhat.com>
>>
>> When a network or network device is created from the command line or 
>> HMP,
>> QemuOpts ensures that the id passes the id_wellformed check. However,
>> QMP skips this:
>>
>>     $ qemu-system-x86_64 -qmp stdio -S -nic user,id=123/456
>>     qemu-system-x86_64: -nic user,id=123/456: Parameter id expects an 
>> identifier
>>     Identifiers consist of letters, digits, -, ., _, starting with a 
>> letter.
>>
>>     $ qemu-system-x86_64 -qmp stdio -S
>>     {"execute":"qmp_capabilities"}
>>     {"return": {}}
>>     {"execute":"netdev_add", "arguments": {"type": "user", "id": 
>> "123/456"}}
>>     {"return": {}}
>>
>> After:
>>
>>     $ qemu-system-x86_64 -qmp stdio -S
>>     {"execute":"qmp_capabilities"}
>>     {"return": {}}
>>     {"execute":"netdev_add", "arguments": {"type": "user", "id": 
>> "123/456"}}
>>     {"error": {"class": "GenericError", "desc": "Parameter "id" 
>> expects an identifier"}}
>>
>> Validity checks should be performed always at the bottom of the call 
>> chain,
>> because QMP skips all the steps above.  Do this for the network 
>> subsystem.
>>
>> Cc: Jason Wang <jasowang@redhat.com>
>> Reviewed-by: Eric Blake <eblake@redhat.com>
>> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
>> Signed-off-by: Jason Wang <jasowang@redhat.com>
>> ---
>>   net/net.c | 12 ++++++++++++
>>   1 file changed, 12 insertions(+)
>>
>> diff --git a/net/net.c b/net/net.c
>> index 9c784da..d36729f 100644
>> --- a/net/net.c
>> +++ b/net/net.c
>> @@ -44,6 +44,7 @@
>>   #include "qemu/cutils.h"
>>   #include "qemu/config-file.h"
>>   #include "qemu/ctype.h"
>> +#include "qemu/id.h"
>>   #include "qemu/iov.h"
>>   #include "qemu/qemu-print.h"
>>   #include "qemu/main-loop.h"
>> @@ -1011,6 +1012,17 @@ static int net_client_init1(const Netdev 
>> *netdev, bool is_netdev, Error **errp)
>>           }
>>       }
>>   +    /*
>> +     * The id for -net has already been checked by QemuOpts and
>> +     * could be automatically generated, in which case it is not
>> +     * well-formed by design.  HMP and QMP only call us with
>> +     * is_netdev == true.
>> +     */
>> +    if (is_netdev && !id_wellformed(netdev->id)) {
>> +        error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "id", "an 
>> identifier");
>> +        return -1;
>> +    }
>> +
>>       nc = qemu_find_netdev(netdev->id);
>>       if (nc) {
>>           error_setg(errp, "Duplicate ID '%s'", netdev->id);
>>
>
> Sorry, I sent v2 yesterday.  This patch passed the tests at the time 
> it was submitted, but now fails (because it does not work with -nic).


I don't see that. But I add a fixup in the pull request:

https://lists.gnu.org/archive/html/qemu-devel/2021-03/msg04237.html

If it doesn't make sense, I will drop this and send a new pull request 
next week.

THanks


>
> Paolo
>
>

Re: [PULL 03/16] net: validate that ids are well formed

[Paolo Bonzini]

On 12/03/21 14:26, Jason Wang wrote:
> 
> On 2021/3/12 4:44 下午, Paolo Bonzini wrote:
>> On 12/03/21 07:16, Jason Wang wrote:
>>> From: Paolo Bonzini <pbonzini@redhat.com>
>>>
>>> When a network or network device is created from the command line or 
>>> HMP,
>>> QemuOpts ensures that the id passes the id_wellformed check. However,
>>> QMP skips this:
>>>
>>>     $ qemu-system-x86_64 -qmp stdio -S -nic user,id=123/456
>>>     qemu-system-x86_64: -nic user,id=123/456: Parameter id expects an 
>>> identifier
>>>     Identifiers consist of letters, digits, -, ., _, starting with a 
>>> letter.
>>>
>>>     $ qemu-system-x86_64 -qmp stdio -S
>>>     {"execute":"qmp_capabilities"}
>>>     {"return": {}}
>>>     {"execute":"netdev_add", "arguments": {"type": "user", "id": 
>>> "123/456"}}
>>>     {"return": {}}
>>>
>>> After:
>>>
>>>     $ qemu-system-x86_64 -qmp stdio -S
>>>     {"execute":"qmp_capabilities"}
>>>     {"return": {}}
>>>     {"execute":"netdev_add", "arguments": {"type": "user", "id": 
>>> "123/456"}}
>>>     {"error": {"class": "GenericError", "desc": "Parameter "id" 
>>> expects an identifier"}}
>>>
>>> Validity checks should be performed always at the bottom of the call 
>>> chain,
>>> because QMP skips all the steps above.  Do this for the network 
>>> subsystem.
>>>
>>> Cc: Jason Wang <jasowang@redhat.com>
>>> Reviewed-by: Eric Blake <eblake@redhat.com>
>>> Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
>>> Signed-off-by: Jason Wang <jasowang@redhat.com>
>>> ---
>>>   net/net.c | 12 ++++++++++++
>>>   1 file changed, 12 insertions(+)
>>>
>>> diff --git a/net/net.c b/net/net.c
>>> index 9c784da..d36729f 100644
>>> --- a/net/net.c
>>> +++ b/net/net.c
>>> @@ -44,6 +44,7 @@
>>>   #include "qemu/cutils.h"
>>>   #include "qemu/config-file.h"
>>>   #include "qemu/ctype.h"
>>> +#include "qemu/id.h"
>>>   #include "qemu/iov.h"
>>>   #include "qemu/qemu-print.h"
>>>   #include "qemu/main-loop.h"
>>> @@ -1011,6 +1012,17 @@ static int net_client_init1(const Netdev 
>>> *netdev, bool is_netdev, Error **errp)
>>>           }
>>>       }
>>>   +    /*
>>> +     * The id for -net has already been checked by QemuOpts and
>>> +     * could be automatically generated, in which case it is not
>>> +     * well-formed by design.  HMP and QMP only call us with
>>> +     * is_netdev == true.
>>> +     */
>>> +    if (is_netdev && !id_wellformed(netdev->id)) {
>>> +        error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "id", "an 
>>> identifier");
>>> +        return -1;
>>> +    }
>>> +
>>>       nc = qemu_find_netdev(netdev->id);
>>>       if (nc) {
>>>           error_setg(errp, "Duplicate ID '%s'", netdev->id);
>>>
>>
>> Sorry, I sent v2 yesterday.  This patch passed the tests at the time 
>> it was submitted, but now fails (because it does not work with -nic).
> 
> I don't see that. But I add a fixup in the pull request:
> 
> https://lists.gnu.org/archive/html/qemu-devel/2021-03/msg04237.html
> 
> If it doesn't make sense, I will drop this and send a new pull request 
> next week.

Hmm no, it didn't reach the list.  Let me resend.

Paolo

[PULL 04/16] net: unbreak well-form id check for "-nic"

[Jason Wang]

The auto genreated id for "-nic" has "_" prefix which can't satisfy
the well-formed id check that is introduced by
871579b9834aca517dc2d4941691a1d2082db6f2 ("net: validate that ids are
well formed"). Fix this by simply removing the "__" prefix.

Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/net.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/net.c b/net/net.c
index d36729f..254b42f 100644
--- a/net/net.c
+++ b/net/net.c
@@ -1479,7 +1479,7 @@ static int net_param_nic(void *dummy, QemuOpts *opts, Error **errp)
     /* Create an ID if the user did not specify one */
     nd_id = g_strdup(qemu_opts_id(opts));
     if (!nd_id) {
-        nd_id = g_strdup_printf("__org.qemu.nic%i", idx);
+        nd_id = g_strdup_printf("org.qemu.nic%i", idx);
         qemu_opts_set_id(opts, nd_id);
     }
 
-- 
2.7.4

[PULL 05/16] e1000: fail early for evil descriptor

[Jason Wang]

During procss_tx_desc(), driver can try to chain data descriptor with
legacy descriptor, when will lead underflow for the following
calculation in process_tx_desc() for bytes:

            if (tp->size + bytes > msh)
                bytes = msh - tp->size;

This will lead a infinite loop. So check and fail early if tp->size if
greater or equal to msh.

Reported-by: Alexander Bulekov <alxndr@bu.edu>
Reported-by: Cheolwoo Myung <cwmyung@snu.ac.kr>
Reported-by: Ruhr-University Bochum <bugs-syssec@rub.de>
Cc: Prasad J Pandit <ppandit@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/e1000.c | 4 ++++
 1 file changed, 4 insertions(+)

diff --git a/hw/net/e1000.c b/hw/net/e1000.c
index d8da2f6..4345d86 100644
--- a/hw/net/e1000.c
+++ b/hw/net/e1000.c
@@ -670,6 +670,9 @@ process_tx_desc(E1000State *s, struct e1000_tx_desc *dp)
         msh = tp->tso_props.hdr_len + tp->tso_props.mss;
         do {
             bytes = split_size;
+            if (tp->size >= msh) {
+                goto eop;
+            }
             if (tp->size + bytes > msh)
                 bytes = msh - tp->size;
 
@@ -695,6 +698,7 @@ process_tx_desc(E1000State *s, struct e1000_tx_desc *dp)
         tp->size += split_size;
     }
 
+eop:
     if (!(txd_lower & E1000_TXD_CMD_EOP))
         return;
     if (!(tp->cptse && tp->size < tp->tso_props.hdr_len)) {
-- 
2.7.4

[PULL 06/16] net: introduce qemu_receive_packet()

[Jason Wang]

Some NIC supports loopback mode and this is done by calling
nc->info->receive() directly which in fact suppresses the effort of
reentrancy check that is done in qemu_net_queue_send().

Unfortunately we can't use qemu_net_queue_send() here since for
loopback there's no sender as peer, so this patch introduce a
qemu_receive_packet() which is used for implementing loopback mode
for a NIC with this check.

NIC that supports loopback mode will be converted to this helper.

This is intended to address CVE-2021-3416.

Cc: Prasad J Pandit <ppandit@redhat.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Cc: qemu-stable@nongnu.org
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 include/net/net.h   |  5 +++++
 include/net/queue.h |  8 ++++++++
 net/net.c           | 38 +++++++++++++++++++++++++++++++-------
 net/queue.c         | 22 ++++++++++++++++++++++
 4 files changed, 66 insertions(+), 7 deletions(-)

diff --git a/include/net/net.h b/include/net/net.h
index 919faca..4f56cae 100644
--- a/include/net/net.h
+++ b/include/net/net.h
@@ -144,12 +144,17 @@ void *qemu_get_nic_opaque(NetClientState *nc);
 void qemu_del_net_client(NetClientState *nc);
 typedef void (*qemu_nic_foreach)(NICState *nic, void *opaque);
 void qemu_foreach_nic(qemu_nic_foreach func, void *opaque);
+int qemu_can_receive_packet(NetClientState *nc);
 int qemu_can_send_packet(NetClientState *nc);
 ssize_t qemu_sendv_packet(NetClientState *nc, const struct iovec *iov,
                           int iovcnt);
 ssize_t qemu_sendv_packet_async(NetClientState *nc, const struct iovec *iov,
                                 int iovcnt, NetPacketSent *sent_cb);
 ssize_t qemu_send_packet(NetClientState *nc, const uint8_t *buf, int size);
+ssize_t qemu_receive_packet(NetClientState *nc, const uint8_t *buf, int size);
+ssize_t qemu_receive_packet_iov(NetClientState *nc,
+                                const struct iovec *iov,
+                                int iovcnt);
 ssize_t qemu_send_packet_raw(NetClientState *nc, const uint8_t *buf, int size);
 ssize_t qemu_send_packet_async(NetClientState *nc, const uint8_t *buf,
                                int size, NetPacketSent *sent_cb);
diff --git a/include/net/queue.h b/include/net/queue.h
index c0269bb..9f2f289 100644
--- a/include/net/queue.h
+++ b/include/net/queue.h
@@ -55,6 +55,14 @@ void qemu_net_queue_append_iov(NetQueue *queue,
 
 void qemu_del_net_queue(NetQueue *queue);
 
+ssize_t qemu_net_queue_receive(NetQueue *queue,
+                               const uint8_t *data,
+                               size_t size);
+
+ssize_t qemu_net_queue_receive_iov(NetQueue *queue,
+                                   const struct iovec *iov,
+                                   int iovcnt);
+
 ssize_t qemu_net_queue_send(NetQueue *queue,
                             NetClientState *sender,
                             unsigned flags,
diff --git a/net/net.c b/net/net.c
index 254b42f..6e61053 100644
--- a/net/net.c
+++ b/net/net.c
@@ -529,6 +529,17 @@ int qemu_set_vnet_be(NetClientState *nc, bool is_be)
 #endif
 }
 
+int qemu_can_receive_packet(NetClientState *nc)
+{
+    if (nc->receive_disabled) {
+        return 0;
+    } else if (nc->info->can_receive &&
+               !nc->info->can_receive(nc)) {
+        return 0;
+    }
+    return 1;
+}
+
 int qemu_can_send_packet(NetClientState *sender)
 {
     int vm_running = runstate_is_running();
@@ -541,13 +552,7 @@ int qemu_can_send_packet(NetClientState *sender)
         return 1;
     }
 
-    if (sender->peer->receive_disabled) {
-        return 0;
-    } else if (sender->peer->info->can_receive &&
-               !sender->peer->info->can_receive(sender->peer)) {
-        return 0;
-    }
-    return 1;
+    return qemu_can_receive_packet(sender->peer);
 }
 
 static ssize_t filter_receive_iov(NetClientState *nc,
@@ -680,6 +685,25 @@ ssize_t qemu_send_packet(NetClientState *nc, const uint8_t *buf, int size)
     return qemu_send_packet_async(nc, buf, size, NULL);
 }
 
+ssize_t qemu_receive_packet(NetClientState *nc, const uint8_t *buf, int size)
+{
+    if (!qemu_can_receive_packet(nc)) {
+        return 0;
+    }
+
+    return qemu_net_queue_receive(nc->incoming_queue, buf, size);
+}
+
+ssize_t qemu_receive_packet_iov(NetClientState *nc, const struct iovec *iov,
+                                int iovcnt)
+{
+    if (!qemu_can_receive_packet(nc)) {
+        return 0;
+    }
+
+    return qemu_net_queue_receive_iov(nc->incoming_queue, iov, iovcnt);
+}
+
 ssize_t qemu_send_packet_raw(NetClientState *nc, const uint8_t *buf, int size)
 {
     return qemu_send_packet_async_with_flags(nc, QEMU_NET_PACKET_FLAG_RAW,
diff --git a/net/queue.c b/net/queue.c
index 19e32c8..c872d51 100644
--- a/net/queue.c
+++ b/net/queue.c
@@ -182,6 +182,28 @@ static ssize_t qemu_net_queue_deliver_iov(NetQueue *queue,
     return ret;
 }
 
+ssize_t qemu_net_queue_receive(NetQueue *queue,
+                               const uint8_t *data,
+                               size_t size)
+{
+    if (queue->delivering) {
+        return 0;
+    }
+
+    return qemu_net_queue_deliver(queue, NULL, 0, data, size);
+}
+
+ssize_t qemu_net_queue_receive_iov(NetQueue *queue,
+                                   const struct iovec *iov,
+                                   int iovcnt)
+{
+    if (queue->delivering) {
+        return 0;
+    }
+
+    return qemu_net_queue_deliver_iov(queue, NULL, 0, iov, iovcnt);
+}
+
 ssize_t qemu_net_queue_send(NetQueue *queue,
                             NetClientState *sender,
                             unsigned flags,
-- 
2.7.4

[PULL 07/16] e1000: switch to use qemu_receive_packet() for loopback

[Jason Wang]

This patch switches to use qemu_receive_packet() which can detect
reentrancy and return early.

This is intended to address CVE-2021-3416.

Cc: Prasad J Pandit <ppandit@redhat.com>
Cc: qemu-stable@nongnu.org
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/e1000.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/net/e1000.c b/hw/net/e1000.c
index 4345d86..4f75b44 100644
--- a/hw/net/e1000.c
+++ b/hw/net/e1000.c
@@ -546,7 +546,7 @@ e1000_send_packet(E1000State *s, const uint8_t *buf, int size)
 
     NetClientState *nc = qemu_get_queue(s->nic);
     if (s->phy_reg[PHY_CTRL] & MII_CR_LOOPBACK) {
-        nc->info->receive(nc, buf, size);
+        qemu_receive_packet(nc, buf, size);
     } else {
         qemu_send_packet(nc, buf, size);
     }
-- 
2.7.4

[PULL 08/16] dp8393x: switch to use qemu_receive_packet() for loopback packet

[Jason Wang]

This patch switches to use qemu_receive_packet() which can detect
reentrancy and return early.

This is intended to address CVE-2021-3416.

Cc: Prasad J Pandit <ppandit@redhat.com>
Cc: qemu-stable@nongnu.org
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/dp8393x.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c
index 205c0de..533a830 100644
--- a/hw/net/dp8393x.c
+++ b/hw/net/dp8393x.c
@@ -506,7 +506,7 @@ static void dp8393x_do_transmit_packets(dp8393xState *s)
             s->regs[SONIC_TCR] |= SONIC_TCR_CRSL;
             if (nc->info->can_receive(nc)) {
                 s->loopback_packet = 1;
-                nc->info->receive(nc, s->tx_buffer, tx_len);
+                qemu_receive_packet(nc, s->tx_buffer, tx_len);
             }
         } else {
             /* Transmit packet */
-- 
2.7.4

[PULL 09/16] msf2-mac: switch to use qemu_receive_packet() for loopback

[Jason Wang]

This patch switches to use qemu_receive_packet() which can detect
reentrancy and return early.

This is intended to address CVE-2021-3416.

Cc: Prasad J Pandit <ppandit@redhat.com>
Cc: qemu-stable@nongnu.org
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/msf2-emac.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/net/msf2-emac.c b/hw/net/msf2-emac.c
index 32ba9e8..3e62060 100644
--- a/hw/net/msf2-emac.c
+++ b/hw/net/msf2-emac.c
@@ -158,7 +158,7 @@ static void msf2_dma_tx(MSF2EmacState *s)
          * R_CFG1 bit 0 is set.
          */
         if (s->regs[R_CFG1] & R_CFG1_LB_EN_MASK) {
-            nc->info->receive(nc, buf, size);
+            qemu_receive_packet(nc, buf, size);
         } else {
             qemu_send_packet(nc, buf, size);
         }
-- 
2.7.4

[PULL 10/16] sungem: switch to use qemu_receive_packet() for loopback

[Jason Wang]

This patch switches to use qemu_receive_packet() which can detect
reentrancy and return early.

This is intended to address CVE-2021-3416.

Cc: Prasad J Pandit <ppandit@redhat.com>
Cc: qemu-stable@nongnu.org
Reviewed-by: Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/sungem.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/net/sungem.c b/hw/net/sungem.c
index 33c3722..3684a4d 100644
--- a/hw/net/sungem.c
+++ b/hw/net/sungem.c
@@ -306,7 +306,7 @@ static void sungem_send_packet(SunGEMState *s, const uint8_t *buf,
     NetClientState *nc = qemu_get_queue(s->nic);
 
     if (s->macregs[MAC_XIFCFG >> 2] & MAC_XIFCFG_LBCK) {
-        nc->info->receive(nc, buf, size);
+        qemu_receive_packet(nc, buf, size);
     } else {
         qemu_send_packet(nc, buf, size);
     }
-- 
2.7.4

[PULL 11/16] tx_pkt: switch to use qemu_receive_packet_iov() for loopback

[Jason Wang]

This patch switches to use qemu_receive_receive_iov() which can detect
reentrancy and return early.

This is intended to address CVE-2021-3416.

Cc: Prasad J Pandit <ppandit@redhat.com>
Cc: qemu-stable@nongnu.org
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/net_tx_pkt.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/net/net_tx_pkt.c b/hw/net/net_tx_pkt.c
index da262ed..1f9aa59 100644
--- a/hw/net/net_tx_pkt.c
+++ b/hw/net/net_tx_pkt.c
@@ -553,7 +553,7 @@ static inline void net_tx_pkt_sendv(struct NetTxPkt *pkt,
     NetClientState *nc, const struct iovec *iov, int iov_cnt)
 {
     if (pkt->is_loopback) {
-        nc->info->receive_iov(nc, iov, iov_cnt);
+        qemu_receive_packet_iov(nc, iov, iov_cnt);
     } else {
         qemu_sendv_packet(nc, iov, iov_cnt);
     }
-- 
2.7.4

[PULL 12/16] rtl8139: switch to use qemu_receive_packet() for loopback

[Jason Wang]

From: Alexander Bulekov <alxndr@bu.edu>

This patch switches to use qemu_receive_packet() which can detect
reentrancy and return early.

This is intended to address CVE-2021-3416.

Cc: Prasad J Pandit <ppandit@redhat.com>
Cc: qemu-stable@nongnu.org
Buglink: https://bugs.launchpad.net/qemu/+bug/1910826
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com
Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/rtl8139.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
index 4675ac8..90b4fc6 100644
--- a/hw/net/rtl8139.c
+++ b/hw/net/rtl8139.c
@@ -1795,7 +1795,7 @@ static void rtl8139_transfer_frame(RTL8139State *s, uint8_t *buf, int size,
         }
 
         DPRINTF("+++ transmit loopback mode\n");
-        rtl8139_do_receive(qemu_get_queue(s->nic), buf, size, do_interrupt);
+        qemu_receive_packet(qemu_get_queue(s->nic), buf, size);
 
         if (iov) {
             g_free(buf2);
-- 
2.7.4

[PULL 13/16] pcnet: switch to use qemu_receive_packet() for loopback

[Jason Wang]

From: Alexander Bulekov <alxndr@bu.edu>

This patch switches to use qemu_receive_packet() which can detect
reentrancy and return early.

This is intended to address CVE-2021-3416.

Cc: Prasad J Pandit <ppandit@redhat.com>
Cc: qemu-stable@nongnu.org
Buglink: https://bugs.launchpad.net/qemu/+bug/1917085
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com
Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/pcnet.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/net/pcnet.c b/hw/net/pcnet.c
index f3f18d8..dcd3fc4 100644
--- a/hw/net/pcnet.c
+++ b/hw/net/pcnet.c
@@ -1250,7 +1250,7 @@ txagain:
             if (BCR_SWSTYLE(s) == 1)
                 add_crc = !GET_FIELD(tmd.status, TMDS, NOFCS);
             s->looptest = add_crc ? PCNET_LOOPTEST_CRC : PCNET_LOOPTEST_NOCRC;
-            pcnet_receive(qemu_get_queue(s->nic), s->buffer, s->xmit_pos);
+            qemu_receive_packet(qemu_get_queue(s->nic), s->buffer, s->xmit_pos);
             s->looptest = 0;
         } else {
             if (s->nic) {
-- 
2.7.4

[PULL 14/16] cadence_gem: switch to use qemu_receive_packet() for loopback

[Jason Wang]

From: Alexander Bulekov <alxndr@bu.edu>

This patch switches to use qemu_receive_packet() which can detect
reentrancy and return early.

This is intended to address CVE-2021-3416.

Cc: Prasad J Pandit <ppandit@redhat.com>
Cc: qemu-stable@nongnu.org
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/cadence_gem.c | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index 9a4474a..24b3a0f 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -1275,8 +1275,8 @@ static void gem_transmit(CadenceGEMState *s)
                 /* Send the packet somewhere */
                 if (s->phy_loop || (s->regs[GEM_NWCTRL] &
                                     GEM_NWCTRL_LOCALLOOP)) {
-                    gem_receive(qemu_get_queue(s->nic), s->tx_packet,
-                                total_bytes);
+                    qemu_receive_packet(qemu_get_queue(s->nic), s->tx_packet,
+                                        total_bytes);
                 } else {
                     qemu_send_packet(qemu_get_queue(s->nic), s->tx_packet,
                                      total_bytes);
-- 
2.7.4

[PULL 15/16] lan9118: switch to use qemu_receive_packet() for loopback

[Jason Wang]

From: Alexander Bulekov <alxndr@bu.edu>

This patch switches to use qemu_receive_packet() which can detect
reentrancy and return early.

This is intended to address CVE-2021-3416.

Cc: Prasad J Pandit <ppandit@redhat.com>
Cc: qemu-stable@nongnu.org
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com
Signed-off-by: Alexander Bulekov <alxndr@bu.edu>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/lan9118.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/net/lan9118.c b/hw/net/lan9118.c
index abc7962..6aff424 100644
--- a/hw/net/lan9118.c
+++ b/hw/net/lan9118.c
@@ -680,7 +680,7 @@ static void do_tx_packet(lan9118_state *s)
     /* FIXME: Honor TX disable, and allow queueing of packets.  */
     if (s->phy_control & 0x4000)  {
         /* This assumes the receive routine doesn't touch the VLANClient.  */
-        lan9118_receive(qemu_get_queue(s->nic), s->txp->data, s->txp->len);
+        qemu_receive_packet(qemu_get_queue(s->nic), s->txp->data, s->txp->len);
     } else {
         qemu_send_packet(qemu_get_queue(s->nic), s->txp->data, s->txp->len);
     }
-- 
2.7.4

[PULL 16/16] pvrdma: wean code off pvrdma_ring.h kernel header

[Jason Wang]

From: Cornelia Huck <cohuck@redhat.com>

The pvrdma code relies on the pvrdma_ring.h kernel header for some
basic ring buffer handling. The content of that header isn't very
exciting, but contains some (q)atomic_*() invocations that (a)
cause manual massaging when doing a headers update, and (b) are
an indication that we probably should not be importing that header
at all.

Let's reimplement the ring buffer handling directly in the pvrdma
code instead. This arguably also improves readability of the code.

Importing the header can now be dropped.

Signed-off-by: Cornelia Huck <cohuck@redhat.com>
Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
Reviewed-by: Yuval Shaia <yuval.shaia.ml@gmail.com>
Tested-by: Yuval Shaia <yuval.shaia.ml@gmail.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/rdma/vmw/pvrdma.h                               |   5 +-
 hw/rdma/vmw/pvrdma_cmd.c                           |   6 +-
 hw/rdma/vmw/pvrdma_dev_ring.c                      |  41 ++++----
 hw/rdma/vmw/pvrdma_dev_ring.h                      |   9 +-
 hw/rdma/vmw/pvrdma_main.c                          |   4 +-
 .../drivers/infiniband/hw/vmw_pvrdma/pvrdma_ring.h | 114 ---------------------
 scripts/update-linux-headers.sh                    |   3 +-
 7 files changed, 38 insertions(+), 144 deletions(-)
 delete mode 100644 include/standard-headers/drivers/infiniband/hw/vmw_pvrdma/pvrdma_ring.h

diff --git a/hw/rdma/vmw/pvrdma.h b/hw/rdma/vmw/pvrdma.h
index 1d36a76..d08965d 100644
--- a/hw/rdma/vmw/pvrdma.h
+++ b/hw/rdma/vmw/pvrdma.h
@@ -26,7 +26,6 @@
 #include "../rdma_backend_defs.h"
 #include "../rdma_rm_defs.h"
 
-#include "standard-headers/drivers/infiniband/hw/vmw_pvrdma/pvrdma_ring.h"
 #include "standard-headers/drivers/infiniband/hw/vmw_pvrdma/pvrdma_dev_api.h"
 #include "pvrdma_dev_ring.h"
 #include "qom/object.h"
@@ -64,10 +63,10 @@ typedef struct DSRInfo {
     union pvrdma_cmd_req *req;
     union pvrdma_cmd_resp *rsp;
 
-    struct pvrdma_ring *async_ring_state;
+    PvrdmaRingState *async_ring_state;
     PvrdmaRing async;
 
-    struct pvrdma_ring *cq_ring_state;
+    PvrdmaRingState *cq_ring_state;
     PvrdmaRing cq;
 } DSRInfo;
 
diff --git a/hw/rdma/vmw/pvrdma_cmd.c b/hw/rdma/vmw/pvrdma_cmd.c
index 692125a..f59879e 100644
--- a/hw/rdma/vmw/pvrdma_cmd.c
+++ b/hw/rdma/vmw/pvrdma_cmd.c
@@ -262,7 +262,7 @@ static int create_cq_ring(PCIDevice *pci_dev , PvrdmaRing **ring,
     r = g_malloc(sizeof(*r));
     *ring = r;
 
-    r->ring_state = (struct pvrdma_ring *)
+    r->ring_state = (PvrdmaRingState *)
         rdma_pci_dma_map(pci_dev, tbl[0], TARGET_PAGE_SIZE);
 
     if (!r->ring_state) {
@@ -398,7 +398,7 @@ static int create_qp_rings(PCIDevice *pci_dev, uint64_t pdir_dma,
     *rings = sr;
 
     /* Create send ring */
-    sr->ring_state = (struct pvrdma_ring *)
+    sr->ring_state = (PvrdmaRingState *)
         rdma_pci_dma_map(pci_dev, tbl[0], TARGET_PAGE_SIZE);
     if (!sr->ring_state) {
         rdma_error_report("Failed to map to QP ring state");
@@ -639,7 +639,7 @@ static int create_srq_ring(PCIDevice *pci_dev, PvrdmaRing **ring,
     r = g_malloc(sizeof(*r));
     *ring = r;
 
-    r->ring_state = (struct pvrdma_ring *)
+    r->ring_state = (PvrdmaRingState *)
             rdma_pci_dma_map(pci_dev, tbl[0], TARGET_PAGE_SIZE);
     if (!r->ring_state) {
         rdma_error_report("Failed to map tp SRQ ring state");
diff --git a/hw/rdma/vmw/pvrdma_dev_ring.c b/hw/rdma/vmw/pvrdma_dev_ring.c
index f0bcde7..074ac59 100644
--- a/hw/rdma/vmw/pvrdma_dev_ring.c
+++ b/hw/rdma/vmw/pvrdma_dev_ring.c
@@ -22,11 +22,10 @@
 #include "trace.h"
 
 #include "../rdma_utils.h"
-#include "standard-headers/drivers/infiniband/hw/vmw_pvrdma/pvrdma_ring.h"
 #include "pvrdma_dev_ring.h"
 
 int pvrdma_ring_init(PvrdmaRing *ring, const char *name, PCIDevice *dev,
-                     struct pvrdma_ring *ring_state, uint32_t max_elems,
+                     PvrdmaRingState *ring_state, uint32_t max_elems,
                      size_t elem_sz, dma_addr_t *tbl, uint32_t npages)
 {
     int i;
@@ -73,48 +72,54 @@ out:
 
 void *pvrdma_ring_next_elem_read(PvrdmaRing *ring)
 {
-    int e;
-    unsigned int idx = 0, offset;
+    unsigned int idx, offset;
+    const uint32_t tail = qatomic_read(&ring->ring_state->prod_tail);
+    const uint32_t head = qatomic_read(&ring->ring_state->cons_head);
 
-    e = pvrdma_idx_ring_has_data(ring->ring_state, ring->max_elems, &idx);
-    if (e <= 0) {
+    if (tail & ~((ring->max_elems << 1) - 1) ||
+        head & ~((ring->max_elems << 1) - 1) ||
+        tail == head) {
         trace_pvrdma_ring_next_elem_read_no_data(ring->name);
         return NULL;
     }
 
+    idx = head & (ring->max_elems - 1);
     offset = idx * ring->elem_sz;
     return ring->pages[offset / TARGET_PAGE_SIZE] + (offset % TARGET_PAGE_SIZE);
 }
 
 void pvrdma_ring_read_inc(PvrdmaRing *ring)
 {
-    pvrdma_idx_ring_inc(&ring->ring_state->cons_head, ring->max_elems);
+    uint32_t idx = qatomic_read(&ring->ring_state->cons_head);
+
+    idx = (idx + 1) & ((ring->max_elems << 1) - 1);
+    qatomic_set(&ring->ring_state->cons_head, idx);
 }
 
 void *pvrdma_ring_next_elem_write(PvrdmaRing *ring)
 {
-    int idx;
-    unsigned int offset, tail;
+    unsigned int idx, offset;
+    const uint32_t tail = qatomic_read(&ring->ring_state->prod_tail);
+    const uint32_t head = qatomic_read(&ring->ring_state->cons_head);
 
-    idx = pvrdma_idx_ring_has_space(ring->ring_state, ring->max_elems, &tail);
-    if (idx <= 0) {
+    if (tail & ~((ring->max_elems << 1) - 1) ||
+        head & ~((ring->max_elems << 1) - 1) ||
+        tail == (head ^ ring->max_elems)) {
         rdma_error_report("CQ is full");
         return NULL;
     }
 
-    idx = pvrdma_idx(&ring->ring_state->prod_tail, ring->max_elems);
-    if (idx < 0 || tail != idx) {
-        rdma_error_report("Invalid idx %d", idx);
-        return NULL;
-    }
-
+    idx = tail & (ring->max_elems - 1);
     offset = idx * ring->elem_sz;
     return ring->pages[offset / TARGET_PAGE_SIZE] + (offset % TARGET_PAGE_SIZE);
 }
 
 void pvrdma_ring_write_inc(PvrdmaRing *ring)
 {
-    pvrdma_idx_ring_inc(&ring->ring_state->prod_tail, ring->max_elems);
+    uint32_t idx = qatomic_read(&ring->ring_state->prod_tail);
+
+    idx = (idx + 1) & ((ring->max_elems << 1) - 1);
+    qatomic_set(&ring->ring_state->prod_tail, idx);
 }
 
 void pvrdma_ring_free(PvrdmaRing *ring)
diff --git a/hw/rdma/vmw/pvrdma_dev_ring.h b/hw/rdma/vmw/pvrdma_dev_ring.h
index 5f2a0cf..d231588 100644
--- a/hw/rdma/vmw/pvrdma_dev_ring.h
+++ b/hw/rdma/vmw/pvrdma_dev_ring.h
@@ -19,18 +19,23 @@
 
 #define MAX_RING_NAME_SZ 32
 
+typedef struct PvrdmaRingState {
+    int prod_tail; /* producer tail */
+    int cons_head; /* consumer head */
+} PvrdmaRingState;
+
 typedef struct PvrdmaRing {
     char name[MAX_RING_NAME_SZ];
     PCIDevice *dev;
     uint32_t max_elems;
     size_t elem_sz;
-    struct pvrdma_ring *ring_state; /* used only for unmap */
+    PvrdmaRingState *ring_state; /* used only for unmap */
     int npages;
     void **pages;
 } PvrdmaRing;
 
 int pvrdma_ring_init(PvrdmaRing *ring, const char *name, PCIDevice *dev,
-                     struct pvrdma_ring *ring_state, uint32_t max_elems,
+                     PvrdmaRingState *ring_state, uint32_t max_elems,
                      size_t elem_sz, dma_addr_t *tbl, uint32_t npages);
 void *pvrdma_ring_next_elem_read(PvrdmaRing *ring);
 void pvrdma_ring_read_inc(PvrdmaRing *ring);
diff --git a/hw/rdma/vmw/pvrdma_main.c b/hw/rdma/vmw/pvrdma_main.c
index 8593570..84ae802 100644
--- a/hw/rdma/vmw/pvrdma_main.c
+++ b/hw/rdma/vmw/pvrdma_main.c
@@ -85,7 +85,7 @@ static void free_dev_ring(PCIDevice *pci_dev, PvrdmaRing *ring,
     rdma_pci_dma_unmap(pci_dev, ring_state, TARGET_PAGE_SIZE);
 }
 
-static int init_dev_ring(PvrdmaRing *ring, struct pvrdma_ring **ring_state,
+static int init_dev_ring(PvrdmaRing *ring, PvrdmaRingState **ring_state,
                          const char *name, PCIDevice *pci_dev,
                          dma_addr_t dir_addr, uint32_t num_pages)
 {
@@ -114,7 +114,7 @@ static int init_dev_ring(PvrdmaRing *ring, struct pvrdma_ring **ring_state,
     /* RX ring is the second */
     (*ring_state)++;
     rc = pvrdma_ring_init(ring, name, pci_dev,
-                          (struct pvrdma_ring *)*ring_state,
+                          (PvrdmaRingState *)*ring_state,
                           (num_pages - 1) * TARGET_PAGE_SIZE /
                           sizeof(struct pvrdma_cqne),
                           sizeof(struct pvrdma_cqne),
diff --git a/include/standard-headers/drivers/infiniband/hw/vmw_pvrdma/pvrdma_ring.h b/include/standard-headers/drivers/infiniband/hw/vmw_pvrdma/pvrdma_ring.h
deleted file mode 100644
index 7b4062a..0000000
--- a/include/standard-headers/drivers/infiniband/hw/vmw_pvrdma/pvrdma_ring.h
+++ /dev/null
@@ -1,114 +0,0 @@
-/*
- * Copyright (c) 2012-2016 VMware, Inc.  All rights reserved.
- *
- * This program is free software; you can redistribute it and/or
- * modify it under the terms of EITHER the GNU General Public License
- * version 2 as published by the Free Software Foundation or the BSD
- * 2-Clause License. This program is distributed in the hope that it
- * will be useful, but WITHOUT ANY WARRANTY; WITHOUT EVEN THE IMPLIED
- * WARRANTY OF MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE.
- * See the GNU General Public License version 2 for more details at
- * http://www.gnu.org/licenses/old-licenses/gpl-2.0.en.html.
- *
- * You should have received a copy of the GNU General Public License
- * along with this program available in the file COPYING in the main
- * directory of this source tree.
- *
- * The BSD 2-Clause License
- *
- *     Redistribution and use in source and binary forms, with or
- *     without modification, are permitted provided that the following
- *     conditions are met:
- *
- *      - Redistributions of source code must retain the above
- *        copyright notice, this list of conditions and the following
- *        disclaimer.
- *
- *      - Redistributions in binary form must reproduce the above
- *        copyright notice, this list of conditions and the following
- *        disclaimer in the documentation and/or other materials
- *        provided with the distribution.
- *
- * THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS
- * "AS IS" AND ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT
- * LIMITED TO, THE IMPLIED WARRANTIES OF MERCHANTABILITY AND FITNESS
- * FOR A PARTICULAR PURPOSE ARE DISCLAIMED. IN NO EVENT SHALL THE
- * COPYRIGHT HOLDER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
- * INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES
- * (INCLUDING, BUT NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR
- * SERVICES; LOSS OF USE, DATA, OR PROFITS; OR BUSINESS INTERRUPTION)
- * HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY, WHETHER IN CONTRACT,
- * STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
- * ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED
- * OF THE POSSIBILITY OF SUCH DAMAGE.
- */
-
-#ifndef __PVRDMA_RING_H__
-#define __PVRDMA_RING_H__
-
-#include "standard-headers/linux/types.h"
-
-#define PVRDMA_INVALID_IDX	-1	/* Invalid index. */
-
-struct pvrdma_ring {
-	int prod_tail;	/* Producer tail. */
-	int cons_head;	/* Consumer head. */
-};
-
-struct pvrdma_ring_state {
-	struct pvrdma_ring tx;	/* Tx ring. */
-	struct pvrdma_ring rx;	/* Rx ring. */
-};
-
-static inline int pvrdma_idx_valid(uint32_t idx, uint32_t max_elems)
-{
-	/* Generates fewer instructions than a less-than. */
-	return (idx & ~((max_elems << 1) - 1)) == 0;
-}
-
-static inline int32_t pvrdma_idx(int *var, uint32_t max_elems)
-{
-	const unsigned int idx = qatomic_read(var);
-
-	if (pvrdma_idx_valid(idx, max_elems))
-		return idx & (max_elems - 1);
-	return PVRDMA_INVALID_IDX;
-}
-
-static inline void pvrdma_idx_ring_inc(int *var, uint32_t max_elems)
-{
-	uint32_t idx = qatomic_read(var) + 1;	/* Increment. */
-
-	idx &= (max_elems << 1) - 1;		/* Modulo size, flip gen. */
-	qatomic_set(var, idx);
-}
-
-static inline int32_t pvrdma_idx_ring_has_space(const struct pvrdma_ring *r,
-					      uint32_t max_elems, uint32_t *out_tail)
-{
-	const uint32_t tail = qatomic_read(&r->prod_tail);
-	const uint32_t head = qatomic_read(&r->cons_head);
-
-	if (pvrdma_idx_valid(tail, max_elems) &&
-	    pvrdma_idx_valid(head, max_elems)) {
-		*out_tail = tail & (max_elems - 1);
-		return tail != (head ^ max_elems);
-	}
-	return PVRDMA_INVALID_IDX;
-}
-
-static inline int32_t pvrdma_idx_ring_has_data(const struct pvrdma_ring *r,
-					     uint32_t max_elems, uint32_t *out_head)
-{
-	const uint32_t tail = qatomic_read(&r->prod_tail);
-	const uint32_t head = qatomic_read(&r->cons_head);
-
-	if (pvrdma_idx_valid(tail, max_elems) &&
-	    pvrdma_idx_valid(head, max_elems)) {
-		*out_head = head & (max_elems - 1);
-		return tail != head;
-	}
-	return PVRDMA_INVALID_IDX;
-}
-
-#endif /* __PVRDMA_RING_H__ */
diff --git a/scripts/update-linux-headers.sh b/scripts/update-linux-headers.sh
index fa6f2b6..1050e36 100755
--- a/scripts/update-linux-headers.sh
+++ b/scripts/update-linux-headers.sh
@@ -215,8 +215,7 @@ sed  -e '1h;2,$H;$!d;g'  -e 's/[^};]*pvrdma[^(| ]*([^)]*);//g' \
     "$linux/drivers/infiniband/hw/vmw_pvrdma/pvrdma_verbs.h" > \
     "$tmp_pvrdma_verbs";
 
-for i in "$linux/drivers/infiniband/hw/vmw_pvrdma/pvrdma_ring.h" \
-         "$linux/drivers/infiniband/hw/vmw_pvrdma/pvrdma_dev_api.h" \
+for i in "$linux/drivers/infiniband/hw/vmw_pvrdma/pvrdma_dev_api.h" \
          "$tmp_pvrdma_verbs"; do \
     cp_portable "$i" \
          "$output/include/standard-headers/drivers/infiniband/hw/vmw_pvrdma/"
-- 
2.7.4

Re: [PULL 00/16] Net patches

[Peter Maydell]

On Fri, 12 Mar 2021 at 06:16, Jason Wang <jasowang@redhat.com> wrote:
>
> The following changes since commit f4abdf32714d1845b7c01ec136dd2b04c2f7db47:
>
>   Merge remote-tracking branch 'remotes/stsquad/tags/pull-testing-docs-xen-updates-100321-2' into staging (2021-03-11 16:20:58 +0000)
>
> are available in the git repository at:
>
>   https://github.com/jasowang/qemu.git tags/net-pull-request
>
> for you to fetch changes up to 9bdb56367679e68e5e71a1c29a1087bda6414b25:
>
>   pvrdma: wean code off pvrdma_ring.h kernel header (2021-03-12 14:08:31 +0800)
>
> ----------------------------------------------------------------
>

Hi; this has a merge conflict in net/nic.c relating to
ID generation: it looks like
"net: unbreak well-form id check for "-nic" (in this pullreq)
"net: Use id_generate() in the network subsystem, too" (in master)
are both changing the way that NIC ID strings are created, and
I don't know which is supposed to be the correct way.

Please can you fix up the conflict appropriately and resend?

thanks
-- PMM

Re: [PULL 00/16] Net patches

[Jason Wang]

[-- Attachment #1: Type: text/plain, Size: 1261 bytes --]



> 2021年3月14日 下午7:37，Peter Maydell <peter.maydell@linaro.org> 写道：
> 
> On Fri, 12 Mar 2021 at 06:16, Jason Wang <jasowang@redhat.com <mailto:jasowang@redhat.com>> wrote:
>> 
>> The following changes since commit f4abdf32714d1845b7c01ec136dd2b04c2f7db47:
>> 
>>  Merge remote-tracking branch 'remotes/stsquad/tags/pull-testing-docs-xen-updates-100321-2' into staging (2021-03-11 16:20:58 +0000)
>> 
>> are available in the git repository at:
>> 
>>  https://github.com/jasowang/qemu.git tags/net-pull-request
>> 
>> for you to fetch changes up to 9bdb56367679e68e5e71a1c29a1087bda6414b25:
>> 
>>  pvrdma: wean code off pvrdma_ring.h kernel header (2021-03-12 14:08:31 +0800)
>> 
>> ----------------------------------------------------------------
>> 
> 
> Hi; this has a merge conflict in net/nic.c relating to
> ID generation: it looks like
> "net: unbreak well-form id check for "-nic" (in this pullreq)
> "net: Use id_generate() in the network subsystem, too" (in master)
> are both changing the way that NIC ID strings are created, and
> I don't know which is supposed to be the correct way.
> 
> Please can you fix up the conflict appropriately and resend?

Will do.

Thanks


> 
> thanks
> -- PMM


[-- Attachment #2: Type: text/html, Size: 11037 bytes --]

Re: [PULL 00/16] Net patches

[Thomas Huth]

On 14/03/2021 12.37, Peter Maydell wrote:
> On Fri, 12 Mar 2021 at 06:16, Jason Wang <jasowang@redhat.com> wrote:
>>
>> The following changes since commit f4abdf32714d1845b7c01ec136dd2b04c2f7db47:
>>
>>    Merge remote-tracking branch 'remotes/stsquad/tags/pull-testing-docs-xen-updates-100321-2' into staging (2021-03-11 16:20:58 +0000)
>>
>> are available in the git repository at:
>>
>>    https://github.com/jasowang/qemu.git tags/net-pull-request
>>
>> for you to fetch changes up to 9bdb56367679e68e5e71a1c29a1087bda6414b25:
>>
>>    pvrdma: wean code off pvrdma_ring.h kernel header (2021-03-12 14:08:31 +0800)
>>
>> ----------------------------------------------------------------
>>
> 
> Hi; this has a merge conflict in net/nic.c relating to
> ID generation: it looks like
> "net: unbreak well-form id check for "-nic" (in this pullreq)

Uh, I haven't seen that patch on the list, when did you send it?

Also what about:

  https://patchew.org/QEMU/20210303095910.78277-1-lekiravi@yandex-team.ru/

... that has been on the list since quite a while already and should maybe 
go into v6.0, too?

  Thomas

Re: [PULL 00/16] Net patches

[Jason Wang]

在 2021/3/15 下午1:39, Thomas Huth 写道:
> On 14/03/2021 12.37, Peter Maydell wrote:
>> On Fri, 12 Mar 2021 at 06:16, Jason Wang <jasowang@redhat.com> wrote:
>>>
>>> The following changes since commit 
>>> f4abdf32714d1845b7c01ec136dd2b04c2f7db47:
>>>
>>>    Merge remote-tracking branch 
>>> 'remotes/stsquad/tags/pull-testing-docs-xen-updates-100321-2' into 
>>> staging (2021-03-11 16:20:58 +0000)
>>>
>>> are available in the git repository at:
>>>
>>>    https://github.com/jasowang/qemu.git tags/net-pull-request
>>>
>>> for you to fetch changes up to 
>>> 9bdb56367679e68e5e71a1c29a1087bda6414b25:
>>>
>>>    pvrdma: wean code off pvrdma_ring.h kernel header (2021-03-12 
>>> 14:08:31 +0800)
>>>
>>> ----------------------------------------------------------------
>>>
>>
>> Hi; this has a merge conflict in net/nic.c relating to
>> ID generation: it looks like
>> "net: unbreak well-form id check for "-nic" (in this pullreq)
>
> Uh, I haven't seen that patch on the list, when did you send it?


My bad, I thought I sent it but it looks not.


>
> Also what about:
>
>  https://patchew.org/QEMU/20210303095910.78277-1-lekiravi@yandex-team.ru/
>
> ... that has been on the list since quite a while already and should 
> maybe go into v6.0, too?


Yes.

Thanks


>
>  Thomas

Re: [PULL 00/16] Net patches

[Philippe Mathieu-Daudé]

On Mon, Mar 15, 2021 at 9:10 AM Jason Wang <jasowang@redhat.com> wrote:
> 在 2021/3/15 下午1:39, Thomas Huth 写道:
> > On 14/03/2021 12.37, Peter Maydell wrote:
> >> On Fri, 12 Mar 2021 at 06:16, Jason Wang <jasowang@redhat.com> wrote:
> >>>
> >>> The following changes since commit
> >>> f4abdf32714d1845b7c01ec136dd2b04c2f7db47:
> >>>
> >>>    Merge remote-tracking branch
> >>> 'remotes/stsquad/tags/pull-testing-docs-xen-updates-100321-2' into
> >>> staging (2021-03-11 16:20:58 +0000)
> >>>
> >>> are available in the git repository at:
> >>>
> >>>    https://github.com/jasowang/qemu.git tags/net-pull-request
> >>>
> >>> for you to fetch changes up to
> >>> 9bdb56367679e68e5e71a1c29a1087bda6414b25:
> >>>
> >>>    pvrdma: wean code off pvrdma_ring.h kernel header (2021-03-12
> >>> 14:08:31 +0800)
> >>>
> >>> ----------------------------------------------------------------
> >>>
> >>
> >> Hi; this has a merge conflict in net/nic.c relating to
> >> ID generation: it looks like
> >> "net: unbreak well-form id check for "-nic" (in this pullreq)
> >
> > Uh, I haven't seen that patch on the list, when did you send it?
>
>
> My bad, I thought I sent it but it looks not.
>
>
> >
> > Also what about:
> >
> >  https://patchew.org/QEMU/20210303095910.78277-1-lekiravi@yandex-team.ru/
> >
> > ... that has been on the list since quite a while already and should
> > maybe go into v6.0, too?

Another candidate: "Fix stack-buffer-overflow in _eth_get_rss_ex_dst_addr()"
https://www.mail-archive.com/qemu-devel@nongnu.org/msg789998.html