Series comparison

-[Qemu-devel] [PULL 0/6] Net patches
+[Qemu-devel] [PULL V2 0/8] Net patches
-The following changes since commit e607bbee553cfe73072870cef458cfa4e78133e2:
+The following changes since commit 32c7e0ab755745e961f1772e95cac381cc68769d:
-  Merge remote-tracking branch 'remotes/edgar/tags/edgar/xilinx-next-2018-01-26.for-upstream' into staging (2018-01-26 14:24:25 +0000)
+  Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20170421' into staging (2017-04-21 15:59:27 +0100)
 are available in the git repository at:
   https://github.com/jasowang/qemu.git tags/net-pull-request
-for you to fetch changes up to bf4835a4d5338bb7424827715df22570a8adc67c:
+for you to fetch changes up to 0fc8aec7de64f2bf83a274a2a38b938ce03425d2:
-  MAINTAINERS: update Dmitry Fleytman email (2018-01-29 16:05:38 +0800)
+  COLO-compare: Optimize tcp compare trace event (2017-04-25 19:17:25 +0800)
 ----------------------------------------------------------------
+Changes from V1:
+- Fix clang warnings
 ----------------------------------------------------------------
-Mao Zhongyi (2):
+Cédric Le Goater (5):
-      colo: modified the payload compare function
+      hw/net: add MII definitions
-      colo: compare the packet based on the tcp sequence number
+      net: add FTGMAC100 support
       net/ftgmac100: add a 'aspeed' property
       aspeed: add a FTGMAC100 nic
       slirp: add a fake NC-SI backend
-Philippe Mathieu-Daudé (1):
+Zhang Chen (3):
-      MAINTAINERS: update Dmitry Fleytman email
+      colo-compare: Fix old packet check bug.
       COLO-compare: Optimize tcp compare for option field
       COLO-compare: Optimize tcp compare trace event
-Thomas Huth (3):
+ default-configs/arm-softmmu.mak |    1 +
-      net: Allow hubports to connect to other netdevs
+ hw/arm/aspeed_soc.c             |   21 +
-      net: Allow netdevs to be used with 'hostfwd_add' and 'hostfwd_remove'
+ hw/net/Makefile.objs            |    1 +
-      qemu-doc: Get rid of "vlan=X" example in the documentation
+ hw/net/ftgmac100.c              | 1016 +++++++++++++++++++++++++++++++++++++++
+ include/hw/arm/aspeed_soc.h     |    2 +
- MAINTAINERS        |   8 +-
+ include/hw/net/ftgmac100.h      |   64 +++
- hmp-commands.hx    |   4 +-
+ include/hw/net/mii.h            |   71 ++-
- net/colo-compare.c | 411 +++++++++++++++++++++++++++++++++--------------------
+ include/net/eth.h               |    1 +
- net/colo.c         |   9 ++
+ net/colo-compare.c              |   69 ++-
- net/colo.h         |  15 ++
+ net/trace-events                |    3 +-
- net/hub.c          |  27 +++-
+ slirp/Makefile.objs             |    2 +-
- net/hub.h          |   3 +-
+ slirp/ncsi-pkt.h                |  419 ++++++++++++++++
- net/net.c          |   2 +-
+ slirp/ncsi.c                    |  130 +++++
- net/slirp.c        |  33 +++--
+ slirp/slirp.c                   |    4 +
- net/trace-events   |   2 +-
+ slirp/slirp.h                   |    3 +
- qapi/net.json      |   4 +-
+files changed, 1770 insertions(+), 37 deletions(-)
- qemu-options.hx    |  12 +-
+ create mode 100644 hw/net/ftgmac100.c
-files changed, 347 insertions(+), 183 deletions(-)
+ create mode 100644 include/hw/net/ftgmac100.h
  create mode 100644 slirp/ncsi-pkt.h
  create mode 100644 slirp/ncsi.c

-[Qemu-devel] [PULL 1/6] colo: modified the payload compare function
+[Qemu-devel] [PULL V2 1/8] colo-compare: Fix old packet check bug.
-From: Mao Zhongyi <maozy.fnst@cn.fujitsu.com>
+From: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
-Modified the function colo_packet_compare_common to prepare for the
+If colo-compare find one old packet,we can notify colo-frame
-tcp packet comparison in the next patch.
+do checkpoint, no need continue find more old packet here.
-Cc: Zhang Chen <zhangckid@gmail.com>
+Signed-off-by: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
 Cc: Li Zhijian <lizhijian@cn.fujitsu.com>
 Cc: Jason Wang <jasowang@redhat.com>
 Signed-off-by: Mao Zhongyi <maozy.fnst@cn.fujitsu.com>
 Signed-off-by: Li Zhijian <lizhijian@cn.fujitsu.com>
 Signed-off-by: Zhang Chen <zhangckid@gmail.com>
 Reviewed-by: Zhang Chen <zhangckid@gmail.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- net/colo-compare.c | 88 +++++++++++++++++++++++++++---------------------------
+ net/colo-compare.c | 15 +++++++++++----
-file changed, 44 insertions(+), 44 deletions(-)
+file changed, 11 insertions(+), 4 deletions(-)
 diff --git a/net/colo-compare.c b/net/colo-compare.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/colo-compare.c
 +++ b/net/colo-compare.c
-@@ -XXX,XX +XXX,XX @@ static int packet_enqueue(CompareState *s, int mode, Connection **con)
+@@ -XXX,XX +XXX,XX @@ static int colo_old_packet_check_one(Packet *pkt, int64_t *check_time)
-  * return:    0  means packet same
+     }
-  *            > 0 || < 0 means packet different
+ }
-  */
--static int colo_packet_compare_common(Packet *ppkt,
+-static void colo_old_packet_check_one_conn(void *opaque,
--                                      Packet *spkt,
+-                                           void *user_data)
--                                      int poffset,
++static int colo_old_packet_check_one_conn(Connection *conn,
--                                      int soffset)
++                                          void *user_data)
 +static int colo_compare_packet_payload(Packet *ppkt,
 +                                       Packet *spkt,
 +                                       uint16_t poffset,
 +                                       uint16_t soffset,
 +                                       uint16_t len)
 +
  {
-     if (trace_event_get_state_backends(TRACE_COLO_COMPARE_MISCOMPARE)) {
+-    Connection *conn = opaque;
-         char pri_ip_src[20], pri_ip_dst[20], sec_ip_src[20], sec_ip_dst[20];
+     GList *result = NULL;
-@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_common(Packet *ppkt,
+     int64_t check_time = REGULAR_PACKET_CHECK_MS;
-                                    sec_ip_src, sec_ip_dst);
-     }
+@@ -XXX,XX +XXX,XX @@ static void colo_old_packet_check_one_conn(void *opaque,
+     if (result) {
--    poffset = ppkt->vnet_hdr_len + poffset;
+         /* do checkpoint will flush old packet */
--    soffset = ppkt->vnet_hdr_len + soffset;
+         /* TODO: colo_notify_checkpoint();*/
 -
 -    if (ppkt->size - poffset == spkt->size - soffset) {
 -        return memcmp(ppkt->data + poffset,
 -                      spkt->data + soffset,
 -                      spkt->size - soffset);
 -    } else {
 -        trace_colo_compare_main("Net packet size are not the same");
 -        return -1;
 -    }
 +    return memcmp(ppkt->data + poffset, spkt->data + soffset, len);
  }
  /*
@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_tcp(Packet *spkt, Packet *ppkt)
       * the secondary guest's timestamp. COLO just focus on payload,
       * so we just need skip this field.
       */
 -    if (ptcp->th_off > 5) {
 -        ptrdiff_t ptcp_offset, stcp_offset;
 -        ptcp_offset = ppkt->transport_header - (uint8_t *)ppkt->data
 -                      + (ptcp->th_off * 4) - ppkt->vnet_hdr_len;
 -        stcp_offset = spkt->transport_header - (uint8_t *)spkt->data
 -                      + (stcp->th_off * 4) - spkt->vnet_hdr_len;
 +    ptrdiff_t ptcp_offset, stcp_offset;
 -        /*
 -         * When network is busy, some tcp options(like sack) will unpredictable
 -         * occur in primary side or secondary side. it will make packet size
 -         * not same, but the two packet's payload is identical. colo just
 -         * care about packet payload, so we skip the option field.
 -         */
 -        res = colo_packet_compare_common(ppkt, spkt, ptcp_offset, stcp_offset);
 -    } else if (ptcp->th_sum == stcp->th_sum) {
 -        res = colo_packet_compare_common(ppkt, spkt, ETH_HLEN, ETH_HLEN);
 +    ptcp_offset = ppkt->transport_header - (uint8_t *)ppkt->data
 +                  + (ptcp->th_off << 2) - ppkt->vnet_hdr_len;
 +    stcp_offset = spkt->transport_header - (uint8_t *)spkt->data
 +                  + (stcp->th_off << 2) - spkt->vnet_hdr_len;
 +    if (ppkt->size - ptcp_offset == spkt->size - stcp_offset) {
 +        res = colo_compare_packet_payload(ppkt, spkt,
 +                                          ptcp_offset, stcp_offset,
 +                                          ppkt->size - ptcp_offset);
      } else {
 +        trace_colo_compare_main("TCP: payload size of packets are different");
          res = -1;
      }
@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_tcp(Packet *spkt, Packet *ppkt)
   */
  static int colo_packet_compare_udp(Packet *spkt, Packet *ppkt)
  {
 -    int ret;
 -    int network_header_length = ppkt->ip->ip_hl * 4;
 +    uint16_t network_header_length = ppkt->ip->ip_hl << 2;
 +    uint16_t offset = network_header_length + ETH_HLEN + ppkt->vnet_hdr_len;
      trace_colo_compare_main("compare udp");
@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_udp(Packet *spkt, Packet *ppkt)
       * other field like TOS,TTL,IP Checksum. we only need to compare
       * the ip payload here.
       */
 -    ret = colo_packet_compare_common(ppkt, spkt,
 -                                     network_header_length + ETH_HLEN,
 -                                     network_header_length + ETH_HLEN);
 -
 -    if (ret) {
 +    if (ppkt->size != spkt->size) {
 +        trace_colo_compare_main("UDP: payload size of packets are different");
 +        return -1;
 +    }
 +    if (colo_compare_packet_payload(ppkt, spkt, offset, offset,
 +                                    ppkt->size - offset)) {
          trace_colo_compare_udp_miscompare("primary pkt size", ppkt->size);
          trace_colo_compare_udp_miscompare("Secondary pkt size", spkt->size);
          if (trace_event_get_state_backends(TRACE_COLO_COMPARE_MISCOMPARE)) {
@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_udp(Packet *spkt, Packet *ppkt)
              qemu_hexdump((char *)spkt->data, stderr, "colo-compare sec pkt",
                           spkt->size);
          }
 +        return -1;
 +    } else {
 +        return 0;
      }
--
++
--    return ret;
++    return 1;
  }
  /*
-@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_udp(Packet *spkt, Packet *ppkt)
+@@ -XXX,XX +XXX,XX @@ static void colo_old_packet_check(void *opaque)
   */
  static int colo_packet_compare_icmp(Packet *spkt, Packet *ppkt)
  {
--    int network_header_length = ppkt->ip->ip_hl * 4;
+     CompareState *s = opaque;
-+    uint16_t network_header_length = ppkt->ip->ip_hl << 2;
-+    uint16_t offset = network_header_length + ETH_HLEN + ppkt->vnet_hdr_len;
+-    g_queue_foreach(&s->conn_list, colo_old_packet_check_one_conn, NULL);
++    /*
-     trace_colo_compare_main("compare icmp");
++     * If we find one old packet, stop finding job and notify
++     * COLO frame do checkpoint.
-@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_icmp(Packet *spkt, Packet *ppkt)
++     */
-      * other field like TOS,TTL,IP Checksum. we only need to compare
++    g_queue_find_custom(&s->conn_list, NULL,
-      * the ip payload here.
++                        (GCompareFunc)colo_old_packet_check_one_conn);
       */
 -    if (colo_packet_compare_common(ppkt, spkt,
 -                                   network_header_length + ETH_HLEN,
 -                                   network_header_length + ETH_HLEN)) {
 +    if (ppkt->size != spkt->size) {
 +        trace_colo_compare_main("ICMP: payload size of packets are different");
 +        return -1;
 +    }
 +    if (colo_compare_packet_payload(ppkt, spkt, offset, offset,
 +                                    ppkt->size - offset)) {
          trace_colo_compare_icmp_miscompare("primary pkt size",
                                             ppkt->size);
          trace_colo_compare_icmp_miscompare("Secondary pkt size",
@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_icmp(Packet *spkt, Packet *ppkt)
   */
  static int colo_packet_compare_other(Packet *spkt, Packet *ppkt)
  {
 +    uint16_t offset = ppkt->vnet_hdr_len;
 +
      trace_colo_compare_main("compare other");
      if (trace_event_get_state_backends(TRACE_COLO_COMPARE_MISCOMPARE)) {
          char pri_ip_src[20], pri_ip_dst[20], sec_ip_src[20], sec_ip_dst[20];
@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_other(Packet *spkt, Packet *ppkt)
                                     sec_ip_src, sec_ip_dst);
      }
 -    return colo_packet_compare_common(ppkt, spkt, 0, 0);
 +    if (ppkt->size != spkt->size) {
 +        trace_colo_compare_main("Other: payload size of packets are different");
 +        return -1;
 +    }
 +    return colo_compare_packet_payload(ppkt, spkt, offset, offset,
 +                                       ppkt->size - offset);
  }
- static int colo_old_packet_check_one(Packet *pkt, int64_t *check_time)
+ /*
 --
 .7.4

-New patch
+[Qemu-devel] [PULL V2 2/8] hw/net: add MII definitions
+From: Cédric Le Goater <clg@kaod.org>
+This adds comments on the Basic mode control and status registers bit
+definitions. It also adds a couple of bits for 1000BASE-T and the
+RealTek 8211E PHY for the FTGMAC100 model to use.
+Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ include/hw/net/mii.h | 71 +++++++++++++++++++++++++++++++++++++++-------------
+file changed, 53 insertions(+), 18 deletions(-)
+diff --git a/include/hw/net/mii.h b/include/hw/net/mii.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/net/mii.h
++++ b/include/hw/net/mii.h
+@@ -XXX,XX +XXX,XX @@
+ #define MII_H
+ /* PHY registers */
+-#define MII_BMCR            0
+-#define MII_BMSR            1
+-#define MII_PHYID1          2
+-#define MII_PHYID2          3
+-#define MII_ANAR            4
+-#define MII_ANLPAR          5
+-#define MII_ANER            6
++#define MII_BMCR            0  /* Basic mode control register */
++#define MII_BMSR            1  /* Basic mode status register */
++#define MII_PHYID1          2  /* ID register 1 */
++#define MII_PHYID2          3  /* ID register 2 */
++#define MII_ANAR            4  /* Autonegotiation advertisement */
++#define MII_ANLPAR          5  /* Autonegotiation lnk partner abilities */
++#define MII_ANER            6  /* Autonegotiation expansion */
++#define MII_ANNP            7  /* Autonegotiation next page */
++#define MII_ANLPRNP         8  /* Autonegotiation link partner rx next page */
++#define MII_CTRL1000        9  /* 1000BASE-T control */
++#define MII_STAT1000        10 /* 1000BASE-T status */
++#define MII_MDDACR          13 /* MMD access control */
++#define MII_MDDAADR         14 /* MMD access address data */
++#define MII_EXTSTAT         15 /* Extended Status */
+ #define MII_NSR             16
+ #define MII_LBREMR          17
+ #define MII_REC             18
+@@ -XXX,XX +XXX,XX @@
+ /* PHY registers fields */
+ #define MII_BMCR_RESET      (1 << 15)
+ #define MII_BMCR_LOOPBACK   (1 << 14)
+-#define MII_BMCR_SPEED      (1 << 13)
+-#define MII_BMCR_AUTOEN     (1 << 12)
+-#define MII_BMCR_FD         (1 << 8)
++#define MII_BMCR_SPEED100   (1 << 13)  /* LSB of Speed (100) */
++#define MII_BMCR_SPEED      MII_BMCR_SPEED100
++#define MII_BMCR_AUTOEN     (1 << 12) /* Autonegotiation enable */
++#define MII_BMCR_PDOWN      (1 << 11) /* Enable low power state */
++#define MII_BMCR_ISOLATE    (1 << 10) /* Isolate data paths from MII */
++#define MII_BMCR_ANRESTART  (1 << 9)  /* Auto negotiation restart */
++#define MII_BMCR_FD         (1 << 8)  /* Set duplex mode */
++#define MII_BMCR_CTST       (1 << 7)  /* Collision test */
++#define MII_BMCR_SPEED1000  (1 << 6)  /* MSB of Speed (1000) */
+-#define MII_BMSR_100TX_FD   (1 << 14)
+-#define MII_BMSR_100TX_HD   (1 << 13)
+-#define MII_BMSR_10T_FD     (1 << 12)
+-#define MII_BMSR_10T_HD     (1 << 11)
+-#define MII_BMSR_MFPS       (1 << 6)
+-#define MII_BMSR_AN_COMP    (1 << 5)
+-#define MII_BMSR_AUTONEG    (1 << 3)
+-#define MII_BMSR_LINK_ST    (1 << 2)
++#define MII_BMSR_100TX_FD   (1 << 14) /* Can do 100mbps, full-duplex */
++#define MII_BMSR_100TX_HD   (1 << 13) /* Can do 100mbps, half-duplex */
++#define MII_BMSR_10T_FD     (1 << 12) /* Can do 10mbps, full-duplex */
++#define MII_BMSR_10T_HD     (1 << 11) /* Can do 10mbps, half-duplex */
++#define MII_BMSR_100T2_FD   (1 << 10) /* Can do 100mbps T2, full-duplex */
++#define MII_BMSR_100T2_HD   (1 << 9)  /* Can do 100mbps T2, half-duplex */
++#define MII_BMSR_EXTSTAT    (1 << 8)  /* Extended status in register 15 */
++#define MII_BMSR_MFPS       (1 << 6)  /* MII Frame Preamble Suppression */
++#define MII_BMSR_AN_COMP    (1 << 5)  /* Auto-negotiation complete */
++#define MII_BMSR_RFAULT     (1 << 4)  /* Remote fault */
++#define MII_BMSR_AUTONEG    (1 << 3)  /* Able to do auto-negotiation */
++#define MII_BMSR_LINK_ST    (1 << 2)  /* Link status */
++#define MII_BMSR_JABBER     (1 << 1)  /* Jabber detected */
++#define MII_BMSR_EXTCAP     (1 << 0)  /* Ext-reg capability */
++#define MII_ANAR_PAUSE_ASYM (1 << 11) /* Try for asymetric pause */
++#define MII_ANAR_PAUSE      (1 << 10) /* Try for pause */
+ #define MII_ANAR_TXFD       (1 << 8)
+ #define MII_ANAR_TX         (1 << 7)
+ #define MII_ANAR_10FD       (1 << 6)
+@@ -XXX,XX +XXX,XX @@
+ #define MII_ANAR_CSMACD     (1 << 0)
+ #define MII_ANLPAR_ACK      (1 << 14)
++#define MII_ANLPAR_PAUSEASY (1 << 11) /* can pause asymmetrically */
++#define MII_ANLPAR_PAUSE    (1 << 10) /* can pause */
+ #define MII_ANLPAR_TXFD     (1 << 8)
+ #define MII_ANLPAR_TX       (1 << 7)
+ #define MII_ANLPAR_10FD     (1 << 6)
+ #define MII_ANLPAR_10       (1 << 5)
+ #define MII_ANLPAR_CSMACD   (1 << 0)
++#define MII_ANER_NWAY       (1 << 0) /* Can do N-way auto-nego */
++
++#define MII_CTRL1000_FULL   (1 << 9)  /* 1000BASE-T full duplex */
++#define MII_CTRL1000_HALF   (1 << 8)  /* 1000BASE-T half duplex */
++
++#define MII_STAT1000_FULL   (1 << 11) /* 1000BASE-T full duplex */
++#define MII_STAT1000_HALF   (1 << 10) /* 1000BASE-T half duplex */
++
+ /* List of vendor identifiers */
+ /* RealTek 8201 */
+ #define RTL8201CP_PHYID1    0x0000
+ #define RTL8201CP_PHYID2    0x8201
++/* RealTek 8211E */
++#define RTL8211E_PHYID1     0x001c
++#define RTL8211E_PHYID2     0xc915
++
+ /* National Semiconductor DP83848 */
+ #define DP83848_PHYID1      0x2000
+ #define DP83848_PHYID2      0x5c90
+--
+.7.4

-New patch
+[Qemu-devel] [PULL V2 3/8] net: add FTGMAC100 support
+From: Cédric Le Goater <clg@kaod.org>
+The FTGMAC100 device is an Ethernet controller with DMA function that
+can be found on Aspeed SoCs (which include NCSI).
+It is fully compliant with IEEE 802.3 specification for 10/100 Mbps
+Ethernet and IEEE 802.3z specification for 1000 Mbps Ethernet and
+includes Reduced Media Independent Interface (RMII) and Reduced
+Gigabit Media Independent Interface (RGMII) interfaces. It adopts an
+AHB bus interface and integrates a link list DMA engine with direct
+M-Bus accesses for transmitting and receiving packets. It has
+independent TX/RX fifos, supports half and full duplex (1000 Mbps mode
+only supports full duplex), flow control for full duplex and
+backpressure for half duplex.
+The FTGMAC100 also implements IP, TCP, UDP checksum offloads and
+supports IEEE 802.1Q VLAN tag insertion and removal. It offers
+high-priority transmit queue for QoS and CoS applications
+This model is backed with a RealTek 8211E PHY which is the chip found
+on the AST2500 EVB. It is complete enough to satisfy two different
+Linux drivers and a U-Boot driver. Not supported features are :
+ - IEEE 802.1Q VLAN
+ - High Priority Transmit Queue
+ - Wake-On-LAN functions
+The code is based on the Coldfire Fast Ethernet Controller model.
+Signed-off-by: Cédric Le Goater <clg@kaod.org>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ default-configs/arm-softmmu.mak |    1 +
+ hw/net/Makefile.objs            |    1 +
+ hw/net/ftgmac100.c              | 1003 +++++++++++++++++++++++++++++++++++++++
+ include/hw/net/ftgmac100.h      |   60 +++
+files changed, 1065 insertions(+)
+ create mode 100644 hw/net/ftgmac100.c
+ create mode 100644 include/hw/net/ftgmac100.h
+diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
+index XXXXXXX..XXXXXXX 100644
+--- a/default-configs/arm-softmmu.mak
++++ b/default-configs/arm-softmmu.mak
+@@ -XXX,XX +XXX,XX @@ CONFIG_LAN9118=y
+ CONFIG_SMC91C111=y
+ CONFIG_ALLWINNER_EMAC=y
+ CONFIG_IMX_FEC=y
++CONFIG_FTGMAC100=y
+ CONFIG_DS1338=y
+ CONFIG_PFLASH_CFI01=y
+ CONFIG_PFLASH_CFI02=y
+diff --git a/hw/net/Makefile.objs b/hw/net/Makefile.objs
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/Makefile.objs
++++ b/hw/net/Makefile.objs
+@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_IMX_FEC) += imx_fec.o
+ common-obj-$(CONFIG_CADENCE) += cadence_gem.o
+ common-obj-$(CONFIG_STELLARIS_ENET) += stellaris_enet.o
+ common-obj-$(CONFIG_LANCE) += lance.o
++common-obj-$(CONFIG_FTGMAC100) += ftgmac100.o
+ obj-$(CONFIG_ETRAXFS) += etraxfs_eth.o
+ obj-$(CONFIG_COLDFIRE) += mcf_fec.o
+diff --git a/hw/net/ftgmac100.c b/hw/net/ftgmac100.c
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/hw/net/ftgmac100.c
+@@ -XXX,XX +XXX,XX @@
++/*
++ * Faraday FTGMAC100 Gigabit Ethernet
++ *
++ * Copyright (C) 2016-2017, IBM Corporation.
++ *
++ * Based on Coldfire Fast Ethernet Controller emulation.
++ *
++ * Copyright (c) 2007 CodeSourcery.
++ *
++ * This code is licensed under the GPL version 2 or later. See the
++ * COPYING file in the top-level directory.
++ */
++
++#include "qemu/osdep.h"
++#include "hw/net/ftgmac100.h"
++#include "sysemu/dma.h"
++#include "qemu/log.h"
++#include "net/checksum.h"
++#include "net/eth.h"
++#include "hw/net/mii.h"
++
++/* For crc32 */
++#include <zlib.h>
++
++/*
++ * FTGMAC100 registers
++ */
++#define FTGMAC100_ISR             0x00
++#define FTGMAC100_IER             0x04
++#define FTGMAC100_MAC_MADR        0x08
++#define FTGMAC100_MAC_LADR        0x0c
++#define FTGMAC100_MATH0           0x10
++#define FTGMAC100_MATH1           0x14
++#define FTGMAC100_NPTXPD          0x18
++#define FTGMAC100_RXPD            0x1C
++#define FTGMAC100_NPTXR_BADR      0x20
++#define FTGMAC100_RXR_BADR        0x24
++#define FTGMAC100_HPTXPD          0x28
++#define FTGMAC100_HPTXR_BADR      0x2c
++#define FTGMAC100_ITC             0x30
++#define FTGMAC100_APTC            0x34
++#define FTGMAC100_DBLAC           0x38
++#define FTGMAC100_REVR            0x40
++#define FTGMAC100_FEAR1           0x44
++#define FTGMAC100_RBSR            0x4c
++#define FTGMAC100_TPAFCR          0x48
++
++#define FTGMAC100_MACCR           0x50
++#define FTGMAC100_MACSR           0x54
++#define FTGMAC100_PHYCR           0x60
++#define FTGMAC100_PHYDATA         0x64
++#define FTGMAC100_FCR             0x68
++
++/*
++ * Interrupt status register & interrupt enable register
++ */
++#define FTGMAC100_INT_RPKT_BUF    (1 << 0)
++#define FTGMAC100_INT_RPKT_FIFO   (1 << 1)
++#define FTGMAC100_INT_NO_RXBUF    (1 << 2)
++#define FTGMAC100_INT_RPKT_LOST   (1 << 3)
++#define FTGMAC100_INT_XPKT_ETH    (1 << 4)
++#define FTGMAC100_INT_XPKT_FIFO   (1 << 5)
++#define FTGMAC100_INT_NO_NPTXBUF  (1 << 6)
++#define FTGMAC100_INT_XPKT_LOST   (1 << 7)
++#define FTGMAC100_INT_AHB_ERR     (1 << 8)
++#define FTGMAC100_INT_PHYSTS_CHG  (1 << 9)
++#define FTGMAC100_INT_NO_HPTXBUF  (1 << 10)
++
++/*
++ * Automatic polling timer control register
++ */
++#define FTGMAC100_APTC_RXPOLL_CNT(x)        ((x) & 0xf)
++#define FTGMAC100_APTC_RXPOLL_TIME_SEL      (1 << 4)
++#define FTGMAC100_APTC_TXPOLL_CNT(x)        (((x) >> 8) & 0xf)
++#define FTGMAC100_APTC_TXPOLL_TIME_SEL      (1 << 12)
++
++/*
++ * PHY control register
++ */
++#define FTGMAC100_PHYCR_MIIRD               (1 << 26)
++#define FTGMAC100_PHYCR_MIIWR               (1 << 27)
++
++#define FTGMAC100_PHYCR_DEV(x)              (((x) >> 16) & 0x1f)
++#define FTGMAC100_PHYCR_REG(x)              (((x) >> 21) & 0x1f)
++
++/*
++ * PHY data register
++ */
++#define FTGMAC100_PHYDATA_MIIWDATA(x)       ((x) & 0xffff)
++#define FTGMAC100_PHYDATA_MIIRDATA(x)       (((x) >> 16) & 0xffff)
++
++/*
++ * Feature Register
++ */
++#define FTGMAC100_REVR_NEW_MDIO_INTERFACE   (1 << 31)
++
++/*
++ * MAC control register
++ */
++#define FTGMAC100_MACCR_TXDMA_EN         (1 << 0)
++#define FTGMAC100_MACCR_RXDMA_EN         (1 << 1)
++#define FTGMAC100_MACCR_TXMAC_EN         (1 << 2)
++#define FTGMAC100_MACCR_RXMAC_EN         (1 << 3)
++#define FTGMAC100_MACCR_RM_VLAN          (1 << 4)
++#define FTGMAC100_MACCR_HPTXR_EN         (1 << 5)
++#define FTGMAC100_MACCR_LOOP_EN          (1 << 6)
++#define FTGMAC100_MACCR_ENRX_IN_HALFTX   (1 << 7)
++#define FTGMAC100_MACCR_FULLDUP          (1 << 8)
++#define FTGMAC100_MACCR_GIGA_MODE        (1 << 9)
++#define FTGMAC100_MACCR_CRC_APD          (1 << 10) /* not needed */
++#define FTGMAC100_MACCR_RX_RUNT          (1 << 12)
++#define FTGMAC100_MACCR_JUMBO_LF         (1 << 13)
++#define FTGMAC100_MACCR_RX_ALL           (1 << 14)
++#define FTGMAC100_MACCR_HT_MULTI_EN      (1 << 15)
++#define FTGMAC100_MACCR_RX_MULTIPKT      (1 << 16)
++#define FTGMAC100_MACCR_RX_BROADPKT      (1 << 17)
++#define FTGMAC100_MACCR_DISCARD_CRCERR   (1 << 18)
++#define FTGMAC100_MACCR_FAST_MODE        (1 << 19)
++#define FTGMAC100_MACCR_SW_RST           (1 << 31)
++
++/*
++ * Transmit descriptor
++ */
++#define FTGMAC100_TXDES0_TXBUF_SIZE(x)   ((x) & 0x3fff)
++#define FTGMAC100_TXDES0_EDOTR           (1 << 15)
++#define FTGMAC100_TXDES0_CRC_ERR         (1 << 19)
++#define FTGMAC100_TXDES0_LTS             (1 << 28)
++#define FTGMAC100_TXDES0_FTS             (1 << 29)
++#define FTGMAC100_TXDES0_TXDMA_OWN       (1 << 31)
++
++#define FTGMAC100_TXDES1_VLANTAG_CI(x)   ((x) & 0xffff)
++#define FTGMAC100_TXDES1_INS_VLANTAG     (1 << 16)
++#define FTGMAC100_TXDES1_TCP_CHKSUM      (1 << 17)
++#define FTGMAC100_TXDES1_UDP_CHKSUM      (1 << 18)
++#define FTGMAC100_TXDES1_IP_CHKSUM       (1 << 19)
++#define FTGMAC100_TXDES1_LLC             (1 << 22)
++#define FTGMAC100_TXDES1_TX2FIC          (1 << 30)
++#define FTGMAC100_TXDES1_TXIC            (1 << 31)
++
++/*
++ * Receive descriptor
++ */
++#define FTGMAC100_RXDES0_VDBC            0x3fff
++#define FTGMAC100_RXDES0_EDORR           (1 << 15)
++#define FTGMAC100_RXDES0_MULTICAST       (1 << 16)
++#define FTGMAC100_RXDES0_BROADCAST       (1 << 17)
++#define FTGMAC100_RXDES0_RX_ERR          (1 << 18)
++#define FTGMAC100_RXDES0_CRC_ERR         (1 << 19)
++#define FTGMAC100_RXDES0_FTL             (1 << 20)
++#define FTGMAC100_RXDES0_RUNT            (1 << 21)
++#define FTGMAC100_RXDES0_RX_ODD_NB       (1 << 22)
++#define FTGMAC100_RXDES0_FIFO_FULL       (1 << 23)
++#define FTGMAC100_RXDES0_PAUSE_OPCODE    (1 << 24)
++#define FTGMAC100_RXDES0_PAUSE_FRAME     (1 << 25)
++#define FTGMAC100_RXDES0_LRS             (1 << 28)
++#define FTGMAC100_RXDES0_FRS             (1 << 29)
++#define FTGMAC100_RXDES0_RXPKT_RDY       (1 << 31)
++
++#define FTGMAC100_RXDES1_VLANTAG_CI      0xffff
++#define FTGMAC100_RXDES1_PROT_MASK       (0x3 << 20)
++#define FTGMAC100_RXDES1_PROT_NONIP      (0x0 << 20)
++#define FTGMAC100_RXDES1_PROT_IP         (0x1 << 20)
++#define FTGMAC100_RXDES1_PROT_TCPIP      (0x2 << 20)
++#define FTGMAC100_RXDES1_PROT_UDPIP      (0x3 << 20)
++#define FTGMAC100_RXDES1_LLC             (1 << 22)
++#define FTGMAC100_RXDES1_DF              (1 << 23)
++#define FTGMAC100_RXDES1_VLANTAG_AVAIL   (1 << 24)
++#define FTGMAC100_RXDES1_TCP_CHKSUM_ERR  (1 << 25)
++#define FTGMAC100_RXDES1_UDP_CHKSUM_ERR  (1 << 26)
++#define FTGMAC100_RXDES1_IP_CHKSUM_ERR   (1 << 27)
++
++/*
++ * Receive and transmit Buffer Descriptor
++ */
++typedef struct {
++    uint32_t        des0;
++    uint32_t        des1;
++    uint32_t        des2;        /* not used by HW */
++    uint32_t        des3;
++} FTGMAC100Desc;
++
++/*
++ * Specific RTL8211E MII Registers
++ */
++#define RTL8211E_MII_PHYCR        16 /* PHY Specific Control */
++#define RTL8211E_MII_PHYSR        17 /* PHY Specific Status */
++#define RTL8211E_MII_INER         18 /* Interrupt Enable */
++#define RTL8211E_MII_INSR         19 /* Interrupt Status */
++#define RTL8211E_MII_RXERC        24 /* Receive Error Counter */
++#define RTL8211E_MII_LDPSR        27 /* Link Down Power Saving */
++#define RTL8211E_MII_EPAGSR       30 /* Extension Page Select */
++#define RTL8211E_MII_PAGSEL       31 /* Page Select */
++
++/*
++ * RTL8211E Interrupt Status
++ */
++#define PHY_INT_AUTONEG_ERROR       (1 << 15)
++#define PHY_INT_PAGE_RECV           (1 << 12)
++#define PHY_INT_AUTONEG_COMPLETE    (1 << 11)
++#define PHY_INT_LINK_STATUS         (1 << 10)
++#define PHY_INT_ERROR               (1 << 9)
++#define PHY_INT_DOWN                (1 << 8)
++#define PHY_INT_JABBER              (1 << 0)
++
++/*
++ * Max frame size for the receiving buffer
++ */
++#define FTGMAC100_MAX_FRAME_SIZE    10240
++
++/* Limits depending on the type of the frame
++ *
++ *   9216 for Jumbo frames (+ 4 for VLAN)
++ *   1518 for other frames (+ 4 for VLAN)
++ */
++static int ftgmac100_max_frame_size(FTGMAC100State *s)
++{
++    return (s->maccr & FTGMAC100_MACCR_JUMBO_LF ? 9216 : 1518) + 4;
++}
++
++static void ftgmac100_update_irq(FTGMAC100State *s)
++{
++    qemu_set_irq(s->irq, s->isr & s->ier);
++}
++
++/*
++ * The MII phy could raise a GPIO to the processor which in turn
++ * could be handled as an interrpt by the OS.
++ * For now we don't handle any GPIO/interrupt line, so the OS will
++ * have to poll for the PHY status.
++ */
++static void phy_update_irq(FTGMAC100State *s)
++{
++    ftgmac100_update_irq(s);
++}
++
++static void phy_update_link(FTGMAC100State *s)
++{
++    /* Autonegotiation status mirrors link status.  */
++    if (qemu_get_queue(s->nic)->link_down) {
++        s->phy_status &= ~(MII_BMSR_LINK_ST | MII_BMSR_AN_COMP);
++        s->phy_int |= PHY_INT_DOWN;
++    } else {
++        s->phy_status |= (MII_BMSR_LINK_ST | MII_BMSR_AN_COMP);
++        s->phy_int |= PHY_INT_AUTONEG_COMPLETE;
++    }
++    phy_update_irq(s);
++}
++
++static void ftgmac100_set_link(NetClientState *nc)
++{
++    phy_update_link(FTGMAC100(qemu_get_nic_opaque(nc)));
++}
++
++static void phy_reset(FTGMAC100State *s)
++{
++    s->phy_status = (MII_BMSR_100TX_FD | MII_BMSR_100TX_HD | MII_BMSR_10T_FD |
++                     MII_BMSR_10T_HD | MII_BMSR_EXTSTAT | MII_BMSR_MFPS |
++                     MII_BMSR_AN_COMP | MII_BMSR_AUTONEG | MII_BMSR_LINK_ST |
++                     MII_BMSR_EXTCAP);
++    s->phy_control = (MII_BMCR_AUTOEN | MII_BMCR_FD | MII_BMCR_SPEED1000);
++    s->phy_advertise = (MII_ANAR_PAUSE_ASYM | MII_ANAR_PAUSE | MII_ANAR_TXFD |
++                        MII_ANAR_TX | MII_ANAR_10FD | MII_ANAR_10 |
++                        MII_ANAR_CSMACD);
++    s->phy_int_mask = 0;
++    s->phy_int = 0;
++}
++
++static uint32_t do_phy_read(FTGMAC100State *s, int reg)
++{
++    uint32_t val;
++
++    switch (reg) {
++    case MII_BMCR: /* Basic Control */
++        val = s->phy_control;
++        break;
++    case MII_BMSR: /* Basic Status */
++        val = s->phy_status;
++        break;
++    case MII_PHYID1: /* ID1 */
++        val = RTL8211E_PHYID1;
++        break;
++    case MII_PHYID2: /* ID2 */
++        val = RTL8211E_PHYID2;
++        break;
++    case MII_ANAR: /* Auto-neg advertisement */
++        val = s->phy_advertise;
++        break;
++    case MII_ANLPAR: /* Auto-neg Link Partner Ability */
++        val = (MII_ANLPAR_ACK | MII_ANLPAR_PAUSE | MII_ANLPAR_TXFD |
++               MII_ANLPAR_TX | MII_ANLPAR_10FD | MII_ANLPAR_10 |
++               MII_ANLPAR_CSMACD);
++        break;
++    case MII_ANER: /* Auto-neg Expansion */
++        val = MII_ANER_NWAY;
++        break;
++    case MII_CTRL1000: /* 1000BASE-T control  */
++        val = (MII_CTRL1000_HALF | MII_CTRL1000_FULL);
++        break;
++    case MII_STAT1000: /* 1000BASE-T status  */
++        val = MII_STAT1000_FULL;
++        break;
++    case RTL8211E_MII_INSR:  /* Interrupt status.  */
++        val = s->phy_int;
++        s->phy_int = 0;
++        phy_update_irq(s);
++        break;
++    case RTL8211E_MII_INER:  /* Interrupt enable */
++        val = s->phy_int_mask;
++        break;
++    case RTL8211E_MII_PHYCR:
++    case RTL8211E_MII_PHYSR:
++    case RTL8211E_MII_RXERC:
++    case RTL8211E_MII_LDPSR:
++    case RTL8211E_MII_EPAGSR:
++    case RTL8211E_MII_PAGSEL:
++        qemu_log_mask(LOG_UNIMP, "%s: reg %d not implemented\n",
++                      __func__, reg);
++        val = 0;
++        break;
++    default:
++        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad address at offset %d\n",
++                      __func__, reg);
++        val = 0;
++        break;
++    }
++
++    return val;
++}
++
++#define MII_BMCR_MASK (MII_BMCR_LOOPBACK | MII_BMCR_SPEED100 |          \
++                       MII_BMCR_SPEED | MII_BMCR_AUTOEN | MII_BMCR_PDOWN | \
++                       MII_BMCR_FD | MII_BMCR_CTST)
++#define MII_ANAR_MASK 0x2d7f
++
++static void do_phy_write(FTGMAC100State *s, int reg, uint32_t val)
++{
++    switch (reg) {
++    case MII_BMCR:     /* Basic Control */
++        if (val & MII_BMCR_RESET) {
++            phy_reset(s);
++        } else {
++            s->phy_control = val & MII_BMCR_MASK;
++            /* Complete autonegotiation immediately.  */
++            if (val & MII_BMCR_AUTOEN) {
++                s->phy_status |= MII_BMSR_AN_COMP;
++            }
++        }
++        break;
++    case MII_ANAR:     /* Auto-neg advertisement */
++        s->phy_advertise = (val & MII_ANAR_MASK) | MII_ANAR_TX;
++        break;
++    case RTL8211E_MII_INER: /* Interrupt enable */
++        s->phy_int_mask = val & 0xff;
++        phy_update_irq(s);
++        break;
++    case RTL8211E_MII_PHYCR:
++    case RTL8211E_MII_PHYSR:
++    case RTL8211E_MII_RXERC:
++    case RTL8211E_MII_LDPSR:
++    case RTL8211E_MII_EPAGSR:
++    case RTL8211E_MII_PAGSEL:
++        qemu_log_mask(LOG_UNIMP, "%s: reg %d not implemented\n",
++                      __func__, reg);
++        break;
++    default:
++        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad address at offset %d\n",
++                      __func__, reg);
++        break;
++    }
++}
++
++static int ftgmac100_read_bd(FTGMAC100Desc *bd, dma_addr_t addr)
++{
++    if (dma_memory_read(&address_space_memory, addr, bd, sizeof(*bd))) {
++        qemu_log_mask(LOG_GUEST_ERROR, "%s: failed to read descriptor @ 0x%"
++                      HWADDR_PRIx "\n", __func__, addr);
++        return -1;
++    }
++    bd->des0 = le32_to_cpu(bd->des0);
++    bd->des1 = le32_to_cpu(bd->des1);
++    bd->des2 = le32_to_cpu(bd->des2);
++    bd->des3 = le32_to_cpu(bd->des3);
++    return 0;
++}
++
++static int ftgmac100_write_bd(FTGMAC100Desc *bd, dma_addr_t addr)
++{
++    FTGMAC100Desc lebd;
++
++    lebd.des0 = cpu_to_le32(bd->des0);
++    lebd.des1 = cpu_to_le32(bd->des1);
++    lebd.des2 = cpu_to_le32(bd->des2);
++    lebd.des3 = cpu_to_le32(bd->des3);
++    if (dma_memory_write(&address_space_memory, addr, &lebd, sizeof(lebd))) {
++        qemu_log_mask(LOG_GUEST_ERROR, "%s: failed to write descriptor @ 0x%"
++                      HWADDR_PRIx "\n", __func__, addr);
++        return -1;
++    }
++    return 0;
++}
++
++static void ftgmac100_do_tx(FTGMAC100State *s, uint32_t tx_ring,
++                            uint32_t tx_descriptor)
++{
++    int frame_size = 0;
++    uint8_t *ptr = s->frame;
++    uint32_t addr = tx_descriptor;
++    uint32_t flags = 0;
++    int max_frame_size = ftgmac100_max_frame_size(s);
++
++    while (1) {
++        FTGMAC100Desc bd;
++        int len;
++
++        if (ftgmac100_read_bd(&bd, addr) ||
++            ((bd.des0 & FTGMAC100_TXDES0_TXDMA_OWN) == 0)) {
++            /* Run out of descriptors to transmit.  */
++            s->isr |= FTGMAC100_INT_NO_NPTXBUF;
++            break;
++        }
++
++        /* record transmit flags as they are valid only on the first
++         * segment */
++        if (bd.des0 & FTGMAC100_TXDES0_FTS) {
++            flags = bd.des1;
++        }
++
++        len = bd.des0 & 0x3FFF;
++        if (frame_size + len > max_frame_size) {
++            qemu_log_mask(LOG_GUEST_ERROR, "%s: frame too big : %d bytes\n",
++                          __func__, len);
++            len = max_frame_size - frame_size;
++        }
++
++        if (dma_memory_read(&address_space_memory, bd.des3, ptr, len)) {
++            qemu_log_mask(LOG_GUEST_ERROR, "%s: failed to read packet @ 0x%x\n",
++                          __func__, bd.des3);
++            s->isr |= FTGMAC100_INT_NO_NPTXBUF;
++            break;
++        }
++
++        ptr += len;
++        frame_size += len;
++        if (bd.des0 & FTGMAC100_TXDES0_LTS) {
++            if (flags & FTGMAC100_TXDES1_IP_CHKSUM) {
++                net_checksum_calculate(s->frame, frame_size);
++            }
++            /* Last buffer in frame.  */
++            qemu_send_packet(qemu_get_queue(s->nic), s->frame, frame_size);
++            ptr = s->frame;
++            frame_size = 0;
++            if (flags & FTGMAC100_TXDES1_TXIC) {
++                s->isr |= FTGMAC100_INT_XPKT_ETH;
++            }
++        }
++
++        if (flags & FTGMAC100_TXDES1_TX2FIC) {
++            s->isr |= FTGMAC100_INT_XPKT_FIFO;
++        }
++        bd.des0 &= ~FTGMAC100_TXDES0_TXDMA_OWN;
++
++        /* Write back the modified descriptor.  */
++        ftgmac100_write_bd(&bd, addr);
++        /* Advance to the next descriptor.  */
++        if (bd.des0 & FTGMAC100_TXDES0_EDOTR) {
++            addr = tx_ring;
++        } else {
++            addr += sizeof(FTGMAC100Desc);
++        }
++    }
++
++    s->tx_descriptor = addr;
++
++    ftgmac100_update_irq(s);
++}
++
++static int ftgmac100_can_receive(NetClientState *nc)
++{
++    FTGMAC100State *s = FTGMAC100(qemu_get_nic_opaque(nc));
++    FTGMAC100Desc bd;
++
++    if ((s->maccr & (FTGMAC100_MACCR_RXDMA_EN | FTGMAC100_MACCR_RXMAC_EN))
++         != (FTGMAC100_MACCR_RXDMA_EN | FTGMAC100_MACCR_RXMAC_EN)) {
++        return 0;
++    }
++
++    if (ftgmac100_read_bd(&bd, s->rx_descriptor)) {
++        return 0;
++    }
++    return !(bd.des0 & FTGMAC100_RXDES0_RXPKT_RDY);
++}
++
++/*
++ * This is purely informative. The HW can poll the RW (and RX) ring
++ * buffers for available descriptors but we don't need to trigger a
++ * timer for that in qemu.
++ */
++static uint32_t ftgmac100_rxpoll(FTGMAC100State *s)
++{
++    /* Polling times :
++     *
++     * Speed      TIME_SEL=0    TIME_SEL=1
++     *
++     *    10         51.2 ms      819.2 ms
++     *   100         5.12 ms      81.92 ms
++     *  1000        1.024 ms     16.384 ms
++     */
++    static const int div[] = { 20, 200, 1000 };
++
++    uint32_t cnt = 1024 * FTGMAC100_APTC_RXPOLL_CNT(s->aptcr);
++    uint32_t speed = (s->maccr & FTGMAC100_MACCR_FAST_MODE) ? 1 : 0;
++    uint32_t period;
++
++    if (s->aptcr & FTGMAC100_APTC_RXPOLL_TIME_SEL) {
++        cnt <<= 4;
++    }
++
++    if (s->maccr & FTGMAC100_MACCR_GIGA_MODE) {
++        speed = 2;
++    }
++
++    period = cnt / div[speed];
++
++    return period;
++}
++
++static void ftgmac100_reset(DeviceState *d)
++{
++    FTGMAC100State *s = FTGMAC100(d);
++
++    /* Reset the FTGMAC100 */
++    s->isr = 0;
++    s->ier = 0;
++    s->rx_enabled = 0;
++    s->rx_ring = 0;
++    s->rbsr = 0x640;
++    s->rx_descriptor = 0;
++    s->tx_ring = 0;
++    s->tx_descriptor = 0;
++    s->math[0] = 0;
++    s->math[1] = 0;
++    s->itc = 0;
++    s->aptcr = 1;
++    s->dblac = 0x00022f00;
++    s->revr = 0;
++    s->fear1 = 0;
++    s->tpafcr = 0xf1;
++
++    s->maccr = 0;
++    s->phycr = 0;
++    s->phydata = 0;
++    s->fcr = 0x400;
++
++    /* and the PHY */
++    phy_reset(s);
++}
++
++static uint64_t ftgmac100_read(void *opaque, hwaddr addr, unsigned size)
++{
++    FTGMAC100State *s = FTGMAC100(opaque);
++
++    switch (addr & 0xff) {
++    case FTGMAC100_ISR:
++        return s->isr;
++    case FTGMAC100_IER:
++        return s->ier;
++    case FTGMAC100_MAC_MADR:
++        return (s->conf.macaddr.a[0] << 8)  | s->conf.macaddr.a[1];
++    case FTGMAC100_MAC_LADR:
++        return ((uint32_t) s->conf.macaddr.a[2] << 24) |
++            (s->conf.macaddr.a[3] << 16) | (s->conf.macaddr.a[4] << 8) |
++            s->conf.macaddr.a[5];
++    case FTGMAC100_MATH0:
++        return s->math[0];
++    case FTGMAC100_MATH1:
++        return s->math[1];
++    case FTGMAC100_ITC:
++        return s->itc;
++    case FTGMAC100_DBLAC:
++        return s->dblac;
++    case FTGMAC100_REVR:
++        return s->revr;
++    case FTGMAC100_FEAR1:
++        return s->fear1;
++    case FTGMAC100_TPAFCR:
++        return s->tpafcr;
++    case FTGMAC100_FCR:
++        return s->fcr;
++    case FTGMAC100_MACCR:
++        return s->maccr;
++    case FTGMAC100_PHYCR:
++        return s->phycr;
++    case FTGMAC100_PHYDATA:
++        return s->phydata;
++
++        /* We might want to support these one day */
++    case FTGMAC100_HPTXPD: /* High Priority Transmit Poll Demand */
++    case FTGMAC100_HPTXR_BADR: /* High Priority Transmit Ring Base Address */
++    case FTGMAC100_MACSR: /* MAC Status Register (MACSR) */
++        qemu_log_mask(LOG_UNIMP, "%s: read to unimplemented register 0x%"
++                      HWADDR_PRIx "\n", __func__, addr);
++        return 0;
++    default:
++        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad address at offset 0x%"
++                      HWADDR_PRIx "\n", __func__, addr);
++        return 0;
++    }
++}
++
++static void ftgmac100_write(void *opaque, hwaddr addr,
++                          uint64_t value, unsigned size)
++{
++    FTGMAC100State *s = FTGMAC100(opaque);
++    int reg;
++
++    switch (addr & 0xff) {
++    case FTGMAC100_ISR: /* Interrupt status */
++        s->isr &= ~value;
++        break;
++    case FTGMAC100_IER: /* Interrupt control */
++        s->ier = value;
++        break;
++    case FTGMAC100_MAC_MADR: /* MAC */
++        s->conf.macaddr.a[0] = value >> 8;
++        s->conf.macaddr.a[1] = value;
++        break;
++    case FTGMAC100_MAC_LADR:
++        s->conf.macaddr.a[2] = value >> 24;
++        s->conf.macaddr.a[3] = value >> 16;
++        s->conf.macaddr.a[4] = value >> 8;
++        s->conf.macaddr.a[5] = value;
++        break;
++    case FTGMAC100_MATH0: /* Multicast Address Hash Table 0 */
++        s->math[0] = value;
++        break;
++    case FTGMAC100_MATH1: /* Multicast Address Hash Table 1 */
++        s->math[1] = value;
++        break;
++    case FTGMAC100_ITC: /* TODO: Interrupt Timer Control */
++        s->itc = value;
++        break;
++    case FTGMAC100_RXR_BADR: /* Ring buffer address */
++        s->rx_ring = value;
++        s->rx_descriptor = s->rx_ring;
++        break;
++
++    case FTGMAC100_RBSR: /* DMA buffer size */
++        s->rbsr = value;
++        break;
++
++    case FTGMAC100_NPTXR_BADR: /* Transmit buffer address */
++        s->tx_ring = value;
++        s->tx_descriptor = s->tx_ring;
++        break;
++
++    case FTGMAC100_NPTXPD: /* Trigger transmit */
++        if ((s->maccr & (FTGMAC100_MACCR_TXDMA_EN | FTGMAC100_MACCR_TXMAC_EN))
++            == (FTGMAC100_MACCR_TXDMA_EN | FTGMAC100_MACCR_TXMAC_EN)) {
++            /* TODO: high priority tx ring */
++            ftgmac100_do_tx(s, s->tx_ring, s->tx_descriptor);
++        }
++        if (ftgmac100_can_receive(qemu_get_queue(s->nic))) {
++            qemu_flush_queued_packets(qemu_get_queue(s->nic));
++        }
++        break;
++
++    case FTGMAC100_RXPD: /* Receive Poll Demand Register */
++        if (ftgmac100_can_receive(qemu_get_queue(s->nic))) {
++            qemu_flush_queued_packets(qemu_get_queue(s->nic));
++        }
++        break;
++
++    case FTGMAC100_APTC: /* Automatic polling */
++        s->aptcr = value;
++
++        if (FTGMAC100_APTC_RXPOLL_CNT(s->aptcr)) {
++            ftgmac100_rxpoll(s);
++        }
++
++        if (FTGMAC100_APTC_TXPOLL_CNT(s->aptcr)) {
++            qemu_log_mask(LOG_UNIMP, "%s: no transmit polling\n", __func__);
++        }
++        break;
++
++    case FTGMAC100_MACCR: /* MAC Device control */
++        s->maccr = value;
++        if (value & FTGMAC100_MACCR_SW_RST) {
++            ftgmac100_reset(DEVICE(s));
++        }
++
++        if (ftgmac100_can_receive(qemu_get_queue(s->nic))) {
++            qemu_flush_queued_packets(qemu_get_queue(s->nic));
++        }
++        break;
++
++    case FTGMAC100_PHYCR:  /* PHY Device control */
++        reg = FTGMAC100_PHYCR_REG(value);
++        s->phycr = value;
++        if (value & FTGMAC100_PHYCR_MIIWR) {
++            do_phy_write(s, reg, s->phydata & 0xffff);
++            s->phycr &= ~FTGMAC100_PHYCR_MIIWR;
++        } else {
++            s->phydata = do_phy_read(s, reg) << 16;
++            s->phycr &= ~FTGMAC100_PHYCR_MIIRD;
++        }
++        break;
++    case FTGMAC100_PHYDATA:
++        s->phydata = value & 0xffff;
++        break;
++    case FTGMAC100_DBLAC: /* DMA Burst Length and Arbitration Control */
++        s->dblac = value;
++        break;
++    case FTGMAC100_REVR:  /* Feature Register */
++        /* TODO: Only Old MDIO interface is supported */
++        s->revr = value & ~FTGMAC100_REVR_NEW_MDIO_INTERFACE;
++        break;
++    case FTGMAC100_FEAR1: /* Feature Register 1 */
++        s->fear1 = value;
++        break;
++    case FTGMAC100_TPAFCR: /* Transmit Priority Arbitration and FIFO Control */
++        s->tpafcr = value;
++        break;
++    case FTGMAC100_FCR: /* Flow Control  */
++        s->fcr  = value;
++        break;
++
++    case FTGMAC100_HPTXPD: /* High Priority Transmit Poll Demand */
++    case FTGMAC100_HPTXR_BADR: /* High Priority Transmit Ring Base Address */
++    case FTGMAC100_MACSR: /* MAC Status Register (MACSR) */
++        qemu_log_mask(LOG_UNIMP, "%s: write to unimplemented register 0x%"
++                      HWADDR_PRIx "\n", __func__, addr);
++        break;
++    default:
++        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad address at offset 0x%"
++                      HWADDR_PRIx "\n", __func__, addr);
++        break;
++    }
++
++    ftgmac100_update_irq(s);
++}
++
++static int ftgmac100_filter(FTGMAC100State *s, const uint8_t *buf, size_t len)
++{
++    unsigned mcast_idx;
++
++    if (s->maccr & FTGMAC100_MACCR_RX_ALL) {
++        return 1;
++    }
++
++    switch (get_eth_packet_type(PKT_GET_ETH_HDR(buf))) {
++    case ETH_PKT_BCAST:
++        if (!(s->maccr & FTGMAC100_MACCR_RX_BROADPKT)) {
++            return 0;
++        }
++        break;
++    case ETH_PKT_MCAST:
++        if (!(s->maccr & FTGMAC100_MACCR_RX_MULTIPKT)) {
++            if (!(s->maccr & FTGMAC100_MACCR_HT_MULTI_EN)) {
++                return 0;
++            }
++
++            /* TODO: this does not seem to work for ftgmac100 */
++            mcast_idx = compute_mcast_idx(buf);
++            if (!(s->math[mcast_idx / 32] & (1 << (mcast_idx % 32)))) {
++                return 0;
++            }
++        }
++        break;
++    case ETH_PKT_UCAST:
++        if (memcmp(s->conf.macaddr.a, buf, 6)) {
++            return 0;
++        }
++        break;
++    }
++
++    return 1;
++}
++
++static ssize_t ftgmac100_receive(NetClientState *nc, const uint8_t *buf,
++                                 size_t len)
++{
++    FTGMAC100State *s = FTGMAC100(qemu_get_nic_opaque(nc));
++    FTGMAC100Desc bd;
++    uint32_t flags = 0;
++    uint32_t addr;
++    uint32_t crc;
++    uint32_t buf_addr;
++    uint8_t *crc_ptr;
++    uint32_t buf_len;
++    size_t size = len;
++    uint32_t first = FTGMAC100_RXDES0_FRS;
++    int max_frame_size = ftgmac100_max_frame_size(s);
++
++    if ((s->maccr & (FTGMAC100_MACCR_RXDMA_EN | FTGMAC100_MACCR_RXMAC_EN))
++         != (FTGMAC100_MACCR_RXDMA_EN | FTGMAC100_MACCR_RXMAC_EN)) {
++        return -1;
++    }
++
++    /* TODO : Pad to minimum Ethernet frame length */
++    /* handle small packets.  */
++    if (size < 10) {
++        qemu_log_mask(LOG_GUEST_ERROR, "%s: dropped frame of %zd bytes\n",
++                      __func__, size);
++        return size;
++    }
++
++    if (size < 64 && !(s->maccr & FTGMAC100_MACCR_RX_RUNT)) {
++        qemu_log_mask(LOG_GUEST_ERROR, "%s: dropped runt frame of %zd bytes\n",
++                      __func__, size);
++        return size;
++    }
++
++    if (!ftgmac100_filter(s, buf, size)) {
++        return size;
++    }
++
++    /* 4 bytes for the CRC.  */
++    size += 4;
++    crc = cpu_to_be32(crc32(~0, buf, size));
++    crc_ptr = (uint8_t *) &crc;
++
++    /* Huge frames are truncated.  */
++    if (size > max_frame_size) {
++        size = max_frame_size;
++        qemu_log_mask(LOG_GUEST_ERROR, "%s: frame too big : %zd bytes\n",
++                      __func__, size);
++        flags |= FTGMAC100_RXDES0_FTL;
++    }
++
++    switch (get_eth_packet_type(PKT_GET_ETH_HDR(buf))) {
++    case ETH_PKT_BCAST:
++        flags |= FTGMAC100_RXDES0_BROADCAST;
++        break;
++    case ETH_PKT_MCAST:
++        flags |= FTGMAC100_RXDES0_MULTICAST;
++        break;
++    case ETH_PKT_UCAST:
++        break;
++    }
++
++    addr = s->rx_descriptor;
++    while (size > 0) {
++        if (!ftgmac100_can_receive(nc)) {
++            qemu_log_mask(LOG_GUEST_ERROR, "%s: Unexpected packet\n", __func__);
++            return -1;
++        }
++
++        if (ftgmac100_read_bd(&bd, addr) ||
++            (bd.des0 & FTGMAC100_RXDES0_RXPKT_RDY)) {
++            /* No descriptors available.  Bail out.  */
++            qemu_log_mask(LOG_GUEST_ERROR, "%s: Lost end of frame\n",
++                          __func__);
++            s->isr |= FTGMAC100_INT_NO_RXBUF;
++            break;
++        }
++        buf_len = (size <= s->rbsr) ? size : s->rbsr;
++        bd.des0 |= buf_len & 0x3fff;
++        size -= buf_len;
++
++        /* The last 4 bytes are the CRC.  */
++        if (size < 4) {
++            buf_len += size - 4;
++        }
++        buf_addr = bd.des3;
++        dma_memory_write(&address_space_memory, buf_addr, buf, buf_len);
++        buf += buf_len;
++        if (size < 4) {
++            dma_memory_write(&address_space_memory, buf_addr + buf_len,
++                             crc_ptr, 4 - size);
++            crc_ptr += 4 - size;
++        }
++
++        bd.des0 |= first | FTGMAC100_RXDES0_RXPKT_RDY;
++        first = 0;
++        if (size == 0) {
++            /* Last buffer in frame.  */
++            bd.des0 |= flags | FTGMAC100_RXDES0_LRS;
++            s->isr |= FTGMAC100_INT_RPKT_BUF;
++        } else {
++            s->isr |= FTGMAC100_INT_RPKT_FIFO;
++        }
++        ftgmac100_write_bd(&bd, addr);
++        if (bd.des0 & FTGMAC100_RXDES0_EDORR) {
++            addr = s->rx_ring;
++        } else {
++            addr += sizeof(FTGMAC100Desc);
++        }
++    }
++    s->rx_descriptor = addr;
++
++    ftgmac100_update_irq(s);
++    return len;
++}
++
++static const MemoryRegionOps ftgmac100_ops = {
++    .read = ftgmac100_read,
++    .write = ftgmac100_write,
++    .valid.min_access_size = 4,
++    .valid.max_access_size = 4,
++    .endianness = DEVICE_LITTLE_ENDIAN,
++};
++
++static void ftgmac100_cleanup(NetClientState *nc)
++{
++    FTGMAC100State *s = FTGMAC100(qemu_get_nic_opaque(nc));
++
++    s->nic = NULL;
++}
++
++static NetClientInfo net_ftgmac100_info = {
++    .type = NET_CLIENT_DRIVER_NIC,
++    .size = sizeof(NICState),
++    .can_receive = ftgmac100_can_receive,
++    .receive = ftgmac100_receive,
++    .cleanup = ftgmac100_cleanup,
++    .link_status_changed = ftgmac100_set_link,
++};
++
++static void ftgmac100_realize(DeviceState *dev, Error **errp)
++{
++    FTGMAC100State *s = FTGMAC100(dev);
++    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
++
++    memory_region_init_io(&s->iomem, OBJECT(dev), &ftgmac100_ops, s,
++                          TYPE_FTGMAC100, 0x2000);
++    sysbus_init_mmio(sbd, &s->iomem);
++    sysbus_init_irq(sbd, &s->irq);
++    qemu_macaddr_default_if_unset(&s->conf.macaddr);
++
++    s->conf.peers.ncs[0] = nd_table[0].netdev;
++
++    s->nic = qemu_new_nic(&net_ftgmac100_info, &s->conf,
++                          object_get_typename(OBJECT(dev)), DEVICE(dev)->id,
++                          s);
++    qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
++
++    s->frame = g_malloc(FTGMAC100_MAX_FRAME_SIZE);
++}
++
++static const VMStateDescription vmstate_ftgmac100 = {
++    .name = TYPE_FTGMAC100,
++    .version_id = 1,
++    .minimum_version_id = 1,
++    .fields = (VMStateField[]) {
++        VMSTATE_UINT32(irq_state, FTGMAC100State),
++        VMSTATE_UINT32(isr, FTGMAC100State),
++        VMSTATE_UINT32(ier, FTGMAC100State),
++        VMSTATE_UINT32(rx_enabled, FTGMAC100State),
++        VMSTATE_UINT32(rx_ring, FTGMAC100State),
++        VMSTATE_UINT32(rbsr, FTGMAC100State),
++        VMSTATE_UINT32(tx_ring, FTGMAC100State),
++        VMSTATE_UINT32(rx_descriptor, FTGMAC100State),
++        VMSTATE_UINT32(tx_descriptor, FTGMAC100State),
++        VMSTATE_UINT32_ARRAY(math, FTGMAC100State, 2),
++        VMSTATE_UINT32(itc, FTGMAC100State),
++        VMSTATE_UINT32(aptcr, FTGMAC100State),
++        VMSTATE_UINT32(dblac, FTGMAC100State),
++        VMSTATE_UINT32(revr, FTGMAC100State),
++        VMSTATE_UINT32(fear1, FTGMAC100State),
++        VMSTATE_UINT32(tpafcr, FTGMAC100State),
++        VMSTATE_UINT32(maccr, FTGMAC100State),
++        VMSTATE_UINT32(phycr, FTGMAC100State),
++        VMSTATE_UINT32(phydata, FTGMAC100State),
++        VMSTATE_UINT32(fcr, FTGMAC100State),
++        VMSTATE_UINT32(phy_status, FTGMAC100State),
++        VMSTATE_UINT32(phy_control, FTGMAC100State),
++        VMSTATE_UINT32(phy_advertise, FTGMAC100State),
++        VMSTATE_UINT32(phy_int, FTGMAC100State),
++        VMSTATE_UINT32(phy_int_mask, FTGMAC100State),
++        VMSTATE_END_OF_LIST()
++    }
++};
++
++static Property ftgmac100_properties[] = {
++    DEFINE_NIC_PROPERTIES(FTGMAC100State, conf),
++    DEFINE_PROP_END_OF_LIST(),
++};
++
++static void ftgmac100_class_init(ObjectClass *klass, void *data)
++{
++    DeviceClass *dc = DEVICE_CLASS(klass);
++
++    dc->vmsd = &vmstate_ftgmac100;
++    dc->reset = ftgmac100_reset;
++    dc->props = ftgmac100_properties;
++    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
++    dc->realize = ftgmac100_realize;
++    dc->desc = "Faraday FTGMAC100 Gigabit Ethernet emulation";
++}
++
++static const TypeInfo ftgmac100_info = {
++    .name = TYPE_FTGMAC100,
++    .parent = TYPE_SYS_BUS_DEVICE,
++    .instance_size = sizeof(FTGMAC100State),
++    .class_init = ftgmac100_class_init,
++};
++
++static void ftgmac100_register_types(void)
++{
++    type_register_static(&ftgmac100_info);
++}
++
++type_init(ftgmac100_register_types)
+diff --git a/include/hw/net/ftgmac100.h b/include/hw/net/ftgmac100.h
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/include/hw/net/ftgmac100.h
+@@ -XXX,XX +XXX,XX @@
++/*
++ * Faraday FTGMAC100 Gigabit Ethernet
++ *
++ * Copyright (C) 2016-2017, IBM Corporation.
++ *
++ * This code is licensed under the GPL version 2 or later. See the
++ * COPYING file in the top-level directory.
++ */
++
++#ifndef FTGMAC100_H
++#define FTGMAC100_H
++
++#define TYPE_FTGMAC100 "ftgmac100"
++#define FTGMAC100(obj) OBJECT_CHECK(FTGMAC100State, (obj), TYPE_FTGMAC100)
++
++#include "hw/sysbus.h"
++#include "net/net.h"
++
++typedef struct FTGMAC100State {
++    /*< private >*/
++    SysBusDevice parent_obj;
++
++    /*< public >*/
++    NICState *nic;
++    NICConf conf;
++    qemu_irq irq;
++    MemoryRegion iomem;
++
++    uint8_t *frame;
++
++    uint32_t irq_state;
++    uint32_t isr;
++    uint32_t ier;
++    uint32_t rx_enabled;
++    uint32_t rx_ring;
++    uint32_t rx_descriptor;
++    uint32_t tx_ring;
++    uint32_t tx_descriptor;
++    uint32_t math[2];
++    uint32_t rbsr;
++    uint32_t itc;
++    uint32_t aptcr;
++    uint32_t dblac;
++    uint32_t revr;
++    uint32_t fear1;
++    uint32_t tpafcr;
++    uint32_t maccr;
++    uint32_t phycr;
++    uint32_t phydata;
++    uint32_t fcr;
++
++
++    uint32_t phy_status;
++    uint32_t phy_control;
++    uint32_t phy_advertise;
++    uint32_t phy_int;
++    uint32_t phy_int_mask;
++} FTGMAC100State;
++
++#endif
+--
+.7.4

-[Qemu-devel] [PULL 6/6] MAINTAINERS: update Dmitry Fleytman email
+[Qemu-devel] [PULL V2 4/8] net/ftgmac100: add a 'aspeed' property
-From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+From: Cédric Le Goater <clg@kaod.org>
-gently asked by his automatic reply :)
+The Aspeed SoCs have a different definition of the end of the ring
 buffer bit. Add a property to specify which set of bits should be used
 by the NIC.
-Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Cédric Le Goater <clg@kaod.org>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- MAINTAINERS | 8 ++++----
+ hw/net/ftgmac100.c         | 17 +++++++++++++++--
-file changed, 4 insertions(+), 4 deletions(-)
+ include/hw/net/ftgmac100.h |  4 ++++
 files changed, 19 insertions(+), 2 deletions(-)
-diff --git a/MAINTAINERS b/MAINTAINERS
+diff --git a/hw/net/ftgmac100.c b/hw/net/ftgmac100.c
 index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
+--- a/hw/net/ftgmac100.c
-+++ b/MAINTAINERS
++++ b/hw/net/ftgmac100.c
-@@ -XXX,XX +XXX,XX @@ F: hw/scsi/mfi.h
+@@ -XXX,XX +XXX,XX @@
- F: tests/megasas-test.c
+ #define FTGMAC100_TXDES0_CRC_ERR         (1 << 19)
+ #define FTGMAC100_TXDES0_LTS             (1 << 28)
- Network packet abstractions
+ #define FTGMAC100_TXDES0_FTS             (1 << 29)
--M: Dmitry Fleytman <dmitry@daynix.com>
++#define FTGMAC100_TXDES0_EDOTR_ASPEED    (1 << 30)
-+M: Dmitry Fleytman <dmitry.fleytman@gmail.com>
+ #define FTGMAC100_TXDES0_TXDMA_OWN       (1 << 31)
- S: Maintained
- F: include/net/eth.h
+ #define FTGMAC100_TXDES1_VLANTAG_CI(x)   ((x) & 0xffff)
- F: net/eth.c
+@@ -XXX,XX +XXX,XX @@
-@@ -XXX,XX +XXX,XX @@ F: hw/net/net_rx_pkt*
+ #define FTGMAC100_RXDES0_PAUSE_FRAME     (1 << 25)
- F: hw/net/net_tx_pkt*
+ #define FTGMAC100_RXDES0_LRS             (1 << 28)
+ #define FTGMAC100_RXDES0_FRS             (1 << 29)
- Vmware
++#define FTGMAC100_RXDES0_EDORR_ASPEED    (1 << 30)
--M: Dmitry Fleytman <dmitry@daynix.com>
+ #define FTGMAC100_RXDES0_RXPKT_RDY       (1 << 31)
-+M: Dmitry Fleytman <dmitry.fleytman@gmail.com>
- S: Maintained
+ #define FTGMAC100_RXDES1_VLANTAG_CI      0xffff
- F: hw/net/vmxnet*
+@@ -XXX,XX +XXX,XX @@ static void ftgmac100_do_tx(FTGMAC100State *s, uint32_t tx_ring,
- F: hw/scsi/vmw_pvscsi*
+         /* Write back the modified descriptor.  */
-@@ -XXX,XX +XXX,XX @@ F: hw/mem/nvdimm.c
+         ftgmac100_write_bd(&bd, addr);
- F: include/hw/mem/nvdimm.h
+         /* Advance to the next descriptor.  */
+-        if (bd.des0 & FTGMAC100_TXDES0_EDOTR) {
- e1000x
++        if (bd.des0 & s->txdes0_edotr) {
--M: Dmitry Fleytman <dmitry@daynix.com>
+             addr = tx_ring;
-+M: Dmitry Fleytman <dmitry.fleytman@gmail.com>
+         } else {
- S: Maintained
+             addr += sizeof(FTGMAC100Desc);
- F: hw/net/e1000x*
+@@ -XXX,XX +XXX,XX @@ static ssize_t ftgmac100_receive(NetClientState *nc, const uint8_t *buf,
+             s->isr |= FTGMAC100_INT_RPKT_FIFO;
- e1000e
+         }
--M: Dmitry Fleytman <dmitry@daynix.com>
+         ftgmac100_write_bd(&bd, addr);
-+M: Dmitry Fleytman <dmitry.fleytman@gmail.com>
+-        if (bd.des0 & FTGMAC100_RXDES0_EDORR) {
- S: Maintained
++        if (bd.des0 & s->rxdes0_edorr) {
- F: hw/net/e1000e*
+             addr = s->rx_ring;
+         } else {
              addr += sizeof(FTGMAC100Desc);
@@ -XXX,XX +XXX,XX @@ static void ftgmac100_realize(DeviceState *dev, Error **errp)
      FTGMAC100State *s = FTGMAC100(dev);
      SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
 +    if (s->aspeed) {
 +        s->txdes0_edotr = FTGMAC100_TXDES0_EDOTR_ASPEED;
 +        s->rxdes0_edorr = FTGMAC100_RXDES0_EDORR_ASPEED;
 +    } else {
 +        s->txdes0_edotr = FTGMAC100_TXDES0_EDOTR;
 +        s->rxdes0_edorr = FTGMAC100_RXDES0_EDORR;
 +    }
 +
      memory_region_init_io(&s->iomem, OBJECT(dev), &ftgmac100_ops, s,
                            TYPE_FTGMAC100, 0x2000);
      sysbus_init_mmio(sbd, &s->iomem);
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_ftgmac100 = {
          VMSTATE_UINT32(phy_advertise, FTGMAC100State),
          VMSTATE_UINT32(phy_int, FTGMAC100State),
          VMSTATE_UINT32(phy_int_mask, FTGMAC100State),
 +        VMSTATE_UINT32(txdes0_edotr, FTGMAC100State),
 +        VMSTATE_UINT32(rxdes0_edorr, FTGMAC100State),
          VMSTATE_END_OF_LIST()
      }
  };
  static Property ftgmac100_properties[] = {
 +    DEFINE_PROP_BOOL("aspeed", FTGMAC100State, aspeed, false),
      DEFINE_NIC_PROPERTIES(FTGMAC100State, conf),
      DEFINE_PROP_END_OF_LIST(),
  };
 diff --git a/include/hw/net/ftgmac100.h b/include/hw/net/ftgmac100.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/net/ftgmac100.h
 +++ b/include/hw/net/ftgmac100.h
@@ -XXX,XX +XXX,XX @@ typedef struct FTGMAC100State {
      uint32_t phy_advertise;
      uint32_t phy_int;
      uint32_t phy_int_mask;
 +
 +    bool aspeed;
 +    uint32_t txdes0_edotr;
 +    uint32_t rxdes0_edorr;
  } FTGMAC100State;
  #endif
 --
 .7.4

-[Qemu-devel] [PULL 5/6] qemu-doc: Get rid of "vlan=X" example in the documentation
+[Qemu-devel] [PULL V2 5/8] aspeed: add a FTGMAC100 nic
-From: Thomas Huth <thuth@redhat.com>
+From: Cédric Le Goater <clg@kaod.org>
-The vlan concept is marked as deprecated, so we should not use
+There is a second NIC but we do not use it for the moment. We use the
-this for examples in the documentation anymore.
+'aspeed' property to tune the definition of the end of ring buffer bit
 for the Aspeed SoCs.
-Signed-off-by: Thomas Huth <thuth@redhat.com>
+Signed-off-by: Cédric Le Goater <clg@kaod.org>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- qemu-options.hx | 4 ++--
+ hw/arm/aspeed_soc.c         | 21 +++++++++++++++++++++
-file changed, 2 insertions(+), 2 deletions(-)
+ include/hw/arm/aspeed_soc.h |  2 ++
 files changed, 23 insertions(+)
-diff --git a/qemu-options.hx b/qemu-options.hx
+diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
 index XXXXXXX..XXXXXXX 100644
---- a/qemu-options.hx
+--- a/hw/arm/aspeed_soc.c
-+++ b/qemu-options.hx
++++ b/hw/arm/aspeed_soc.c
-@@ -XXX,XX +XXX,XX @@ qemu-system-i386 linux.img -net nic -net tap
+@@ -XXX,XX +XXX,XX @@
- #launch a QEMU instance with two NICs, each one connected
+ #include "hw/char/serial.h"
- #to a TAP device
+ #include "qemu/log.h"
- qemu-system-i386 linux.img \
+ #include "hw/i2c/aspeed_i2c.h"
--                 -net nic,vlan=0 -net tap,vlan=0,ifname=tap0 \
++#include "net/net.h"
--                 -net nic,vlan=1 -net tap,vlan=1,ifname=tap1
-+        -netdev tap,id=nd0,ifname=tap0 -device e1000,netdev=nd0 \
+ #define ASPEED_SOC_UART_5_BASE      0x00184000
-+        -netdev tap,id=nd1,ifname=tap1 -device rtl8139,netdev=nd1
+ #define ASPEED_SOC_IOMEM_SIZE       0x00200000
- @end example
+@@ -XXX,XX +XXX,XX @@
+ #define ASPEED_SOC_TIMER_BASE       0x1E782000
- @example
+ #define ASPEED_SOC_WDT_BASE         0x1E785000
  #define ASPEED_SOC_I2C_BASE         0x1E78A000
 +#define ASPEED_SOC_ETH1_BASE        0x1E660000
 +#define ASPEED_SOC_ETH2_BASE        0x1E680000
  static const int uart_irqs[] = { 9, 32, 33, 34, 10 };
  static const int timer_irqs[] = { 16, 17, 18, 35, 36, 37, 38, 39, };
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
      object_initialize(&s->wdt, sizeof(s->wdt), TYPE_ASPEED_WDT);
      object_property_add_child(obj, "wdt", OBJECT(&s->wdt), NULL);
      qdev_set_parent_bus(DEVICE(&s->wdt), sysbus_get_default());
 +
 +    object_initialize(&s->ftgmac100, sizeof(s->ftgmac100), TYPE_FTGMAC100);
 +    object_property_add_child(obj, "ftgmac100", OBJECT(&s->ftgmac100), NULL);
 +    qdev_set_parent_bus(DEVICE(&s->ftgmac100), sysbus_get_default());
  }
  static void aspeed_soc_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
          return;
      }
      sysbus_mmio_map(SYS_BUS_DEVICE(&s->wdt), 0, ASPEED_SOC_WDT_BASE);
 +
 +    /* Net */
 +    qdev_set_nic_properties(DEVICE(&s->ftgmac100), &nd_table[0]);
 +    object_property_set_bool(OBJECT(&s->ftgmac100), true, "aspeed", &err);
 +    object_property_set_bool(OBJECT(&s->ftgmac100), true, "realized",
 +                             &local_err);
 +    error_propagate(&err, local_err);
 +    if (err) {
 +        error_propagate(errp, err);
 +        return;
 +    }
 +    sysbus_mmio_map(SYS_BUS_DEVICE(&s->ftgmac100), 0, ASPEED_SOC_ETH1_BASE);
 +    sysbus_connect_irq(SYS_BUS_DEVICE(&s->ftgmac100), 0,
 +                       qdev_get_gpio_in(DEVICE(&s->vic), 2));
  }
  static void aspeed_soc_class_init(ObjectClass *oc, void *data)
 diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/arm/aspeed_soc.h
 +++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@
  #include "hw/i2c/aspeed_i2c.h"
  #include "hw/ssi/aspeed_smc.h"
  #include "hw/watchdog/wdt_aspeed.h"
 +#include "hw/net/ftgmac100.h"
  #define ASPEED_SPIS_NUM  2
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCState {
      AspeedSMCState spi[ASPEED_SPIS_NUM];
      AspeedSDMCState sdmc;
      AspeedWDTState wdt;
 +    FTGMAC100State ftgmac100;
  } AspeedSoCState;
  #define TYPE_ASPEED_SOC "aspeed-soc"
 --
 .7.4

-[Qemu-devel] [PULL 3/6] net: Allow hubports to connect to other netdevs
+[Qemu-devel] [PULL V2 6/8] slirp: add a fake NC-SI backend
-From: Thomas Huth <thuth@redhat.com>
+From: Cédric Le Goater <clg@kaod.org>
-QEMU can emulate hubs to connect NICs and netdevs. This is currently
+NC-SI (Network Controller Sideband Interface) enables a BMC to manage
-primarily used for the mis-named 'vlan' feature of the networking
+a set of NICs on a system. This model takes the simplest approach and
-subsystem. Now the 'vlan' feature has been marked as deprecated, since
+reverses the NC-SI packets to pretend a NIC is present and exercise
-its name is rather confusing and the users often rather mis-configure
+the Linux driver.
 their network when trying to use it. But while the 'vlan' parameter
 should be removed at one point in time, the basic idea of emulating
 a hub in QEMU is still good: It's useful for bundling up the output of
 multiple NICs into one single l2tp netdev for example.
-Now to be able to use the hubport feature without 'vlan's, there is one
+The NCSI header file <ncsi-pkt.h> comes from mainline Linux and was
-missing piece: The possibility to connect a hubport to a netdev, too.
+untabified.
 This patch adds this possibility by introducing a new "netdev=..."
 parameter to the hubports.
-To bundle up the output of multiple NICs into one socket netdev, you can
+Signed-off-by: Cédric Le Goater <clg@kaod.org>
-now run QEMU with these parameters for example:
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Acked-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
 qemu-system-ppc64 ... -netdev socket,id=s1,connect=:11122 \
     -netdev hubport,hubid=1,id=h1,netdev=s1 \
     -netdev hubport,hubid=1,id=h2 -device e1000,netdev=h2 \
     -netdev hubport,hubid=1,id=h3 -device virtio-net-pci,netdev=h3
 For using the socket netdev, you have got to start another QEMU as the
 receiving side first, for example with network dumping enabled:
 qemu-system-x86_64 -M isapc -netdev socket,id=s0,listen=:11122 \
     -device ne2k_isa,netdev=s0 \
     -object filter-dump,id=f1,netdev=s0,file=/tmp/dump.dat
 After the ppc64 guest tried to boot from both NICs, you can see in the
 dump file (using Wireshark, for example), that the output of both NICs
 (the e1000 and the virtio-net-pci) has been successfully transfered
 via the socket netdev in this case.
 Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- net/hub.c       | 27 +++++++++++++++++++++------
+ include/net/eth.h   |   1 +
- net/hub.h       |  3 ++-
+ slirp/Makefile.objs |   2 +-
- net/net.c       |  2 +-
+ slirp/ncsi-pkt.h    | 419 ++++++++++++++++++++++++++++++++++++++++++++++++++++
- qapi/net.json   |  4 +++-
+ slirp/ncsi.c        | 130 ++++++++++++++++
- qemu-options.hx |  8 +++++---
+ slirp/slirp.c       |   4 +
-files changed, 32 insertions(+), 12 deletions(-)
+ slirp/slirp.h       |   3 +
 files changed, 558 insertions(+), 1 deletion(-)
  create mode 100644 slirp/ncsi-pkt.h
  create mode 100644 slirp/ncsi.c
-diff --git a/net/hub.c b/net/hub.c
+diff --git a/include/net/eth.h b/include/net/eth.h
 index XXXXXXX..XXXXXXX 100644
---- a/net/hub.c
+--- a/include/net/eth.h
-+++ b/net/hub.c
++++ b/include/net/eth.h
@@ -XXX,XX +XXX,XX @@ struct tcp_hdr {
  #define ETH_P_IPV6                (0x86dd)
  #define ETH_P_VLAN                (0x8100)
  #define ETH_P_DVLAN               (0x88a8)
 +#define ETH_P_NCSI                (0x88f8)
  #define ETH_P_UNKNOWN             (0xffff)
  #define VLAN_VID_MASK             0x0fff
  #define IP_HEADER_VERSION_4       (4)
 diff --git a/slirp/Makefile.objs b/slirp/Makefile.objs
 index XXXXXXX..XXXXXXX 100644
 --- a/slirp/Makefile.objs
 +++ b/slirp/Makefile.objs
@@ -XXX,XX +XXX,XX @@ common-obj-y = cksum.o if.o ip_icmp.o ip6_icmp.o ip6_input.o ip6_output.o \
                 ip_input.o ip_output.o dnssearch.o dhcpv6.o
  common-obj-y += slirp.o mbuf.o misc.o sbuf.o socket.o tcp_input.o tcp_output.o
  common-obj-y += tcp_subr.o tcp_timer.o udp.o udp6.o bootp.o tftp.o arp_table.o \
 -                ndp_table.o
 +                ndp_table.o ncsi.o
 diff --git a/slirp/ncsi-pkt.h b/slirp/ncsi-pkt.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/slirp/ncsi-pkt.h
 @@ -XXX,XX +XXX,XX @@
-  */
++/*
++ * Copyright Gavin Shan, IBM Corporation 2016.
- #include "qemu/osdep.h"
++ *
-+#include "qapi/error.h"
++ * This program is free software; you can redistribute it and/or modify
- #include "monitor/monitor.h"
++ * it under the terms of the GNU General Public License as published by
- #include "net/net.h"
++ * the Free Software Foundation; either version 2 of the License, or
- #include "clients.h"
++ * (at your option) any later version.
-@@ -XXX,XX +XXX,XX @@ static NetClientInfo net_hub_port_info = {
++ */
-     .cleanup = net_hub_port_cleanup,
++
- };
++#ifndef NCSI_PKT_H
++#define NCSI_PKT_H
--static NetHubPort *net_hub_port_new(NetHub *hub, const char *name)
++
-+static NetHubPort *net_hub_port_new(NetHub *hub, const char *name,
++/* from linux/net/ncsi/ncsi-pkt.h */
-+                                    NetClientState *hubpeer)
++#define __be32 uint32_t
- {
++#define __be16 uint16_t
-     NetClientState *nc;
++
-     NetHubPort *port;
++struct ncsi_pkt_hdr {
-@@ -XXX,XX +XXX,XX @@ static NetHubPort *net_hub_port_new(NetHub *hub, const char *name)
++        unsigned char mc_id;        /* Management controller ID */
-         name = default_name;
++        unsigned char revision;     /* NCSI version - 0x01      */
-     }
++        unsigned char reserved;     /* Reserved                 */
++        unsigned char id;           /* Packet sequence number   */
--    nc = qemu_new_net_client(&net_hub_port_info, NULL, "hub", name);
++        unsigned char type;         /* Packet type              */
-+    nc = qemu_new_net_client(&net_hub_port_info, hubpeer, "hub", name);
++        unsigned char channel;      /* Network controller ID    */
-     port = DO_UPCAST(NetHubPort, nc, nc);
++        __be16        length;       /* Payload length           */
-     port->id = id;
++        __be32        reserved1[2]; /* Reserved                 */
-     port->hub = hub;
++};
-@@ -XXX,XX +XXX,XX @@ static NetHubPort *net_hub_port_new(NetHub *hub, const char *name)
++
++struct ncsi_cmd_pkt_hdr {
- /**
++        struct ncsi_pkt_hdr common; /* Common NCSI packet header */
-  * Create a port on a given hub
++};
-+ * @hub_id: Number of the hub
++
-  * @name: Net client name or NULL for default name.
++struct ncsi_rsp_pkt_hdr {
-+ * @hubpeer: Peer to use (if "netdev=id" has been specified)
++        struct ncsi_pkt_hdr common; /* Common NCSI packet header */
-  *
++        __be16              code;   /* Response code             */
-  * If there is no existing hub with the given id then a new hub is created.
++        __be16              reason; /* Response reason           */
-  */
++};
--NetClientState *net_hub_add_port(int hub_id, const char *name)
++
-+NetClientState *net_hub_add_port(int hub_id, const char *name,
++struct ncsi_aen_pkt_hdr {
-+                                 NetClientState *hubpeer)
++        struct ncsi_pkt_hdr common;       /* Common NCSI packet header */
- {
++        unsigned char       reserved2[3]; /* Reserved                  */
-     NetHub *hub;
++        unsigned char       type;         /* AEN packet type           */
-     NetHubPort *port;
++};
-@@ -XXX,XX +XXX,XX @@ NetClientState *net_hub_add_port(int hub_id, const char *name)
++
-         hub = net_hub_new(hub_id);
++/* NCSI common command packet */
-     }
++struct ncsi_cmd_pkt {
++        struct ncsi_cmd_pkt_hdr cmd;      /* Command header */
--    port = net_hub_port_new(hub, name);
++        __be32                  checksum; /* Checksum       */
-+    port = net_hub_port_new(hub, name, hubpeer);
++        unsigned char           pad[26];
-     return &port->nc;
++};
- }
++
++struct ncsi_rsp_pkt {
-@@ -XXX,XX +XXX,XX @@ NetClientState *net_hub_port_find(int hub_id)
++        struct ncsi_rsp_pkt_hdr rsp;      /* Response header */
-         }
++        __be32                  checksum; /* Checksum        */
-     }
++        unsigned char           pad[22];
++};
--    nc = net_hub_add_port(hub_id, NULL);
++
-+    nc = net_hub_add_port(hub_id, NULL, NULL);
++/* Select Package */
-     return nc;
++struct ncsi_cmd_sp_pkt {
- }
++        struct ncsi_cmd_pkt_hdr cmd;            /* Command header */
++        unsigned char           reserved[3];    /* Reserved       */
-@@ -XXX,XX +XXX,XX @@ int net_init_hubport(const Netdev *netdev, const char *name,
++        unsigned char           hw_arbitration; /* HW arbitration */
-                      NetClientState *peer, Error **errp)
++        __be32                  checksum;       /* Checksum       */
- {
++        unsigned char           pad[22];
-     const NetdevHubPortOptions *hubport;
++};
-+    NetClientState *hubpeer = NULL;
++
++/* Disable Channel */
-     assert(netdev->type == NET_CLIENT_DRIVER_HUBPORT);
++struct ncsi_cmd_dc_pkt {
-     assert(!peer);
++        struct ncsi_cmd_pkt_hdr cmd;         /* Command header  */
-     hubport = &netdev->u.hubport;
++        unsigned char           reserved[3]; /* Reserved        */
++        unsigned char           ald;         /* Allow link down */
--    net_hub_add_port(hubport->hubid, name);
++        __be32                  checksum;    /* Checksum        */
-+    if (hubport->has_netdev) {
++        unsigned char           pad[22];
-+        hubpeer = qemu_find_netdev(hubport->netdev);
++};
-+        if (!hubpeer) {
++
-+            error_setg(errp, "netdev '%s' not found", hubport->netdev);
++/* Reset Channel */
-+            return -1;
++struct ncsi_cmd_rc_pkt {
 +        struct ncsi_cmd_pkt_hdr cmd;      /* Command header */
 +        __be32                  reserved; /* Reserved       */
 +        __be32                  checksum; /* Checksum       */
 +        unsigned char           pad[22];
 +};
 +
 +/* AEN Enable */
 +struct ncsi_cmd_ae_pkt {
 +        struct ncsi_cmd_pkt_hdr cmd;         /* Command header   */
 +        unsigned char           reserved[3]; /* Reserved         */
 +        unsigned char           mc_id;       /* MC ID            */
 +        __be32                  mode;        /* AEN working mode */
 +        __be32                  checksum;    /* Checksum         */
 +        unsigned char           pad[18];
 +};
 +
 +/* Set Link */
 +struct ncsi_cmd_sl_pkt {
 +        struct ncsi_cmd_pkt_hdr cmd;      /* Command header    */
 +        __be32                  mode;     /* Link working mode */
 +        __be32                  oem_mode; /* OEM link mode     */
 +        __be32                  checksum; /* Checksum          */
 +        unsigned char           pad[18];
 +};
 +
 +/* Set VLAN Filter */
 +struct ncsi_cmd_svf_pkt {
 +        struct ncsi_cmd_pkt_hdr cmd;       /* Command header    */
 +        __be16                  reserved;  /* Reserved          */
 +        __be16                  vlan;      /* VLAN ID           */
 +        __be16                  reserved1; /* Reserved          */
 +        unsigned char           index;     /* VLAN table index  */
 +        unsigned char           enable;    /* Enable or disable */
 +        __be32                  checksum;  /* Checksum          */
 +        unsigned char           pad[14];
 +};
 +
 +/* Enable VLAN */
 +struct ncsi_cmd_ev_pkt {
 +        struct ncsi_cmd_pkt_hdr cmd;         /* Command header   */
 +        unsigned char           reserved[3]; /* Reserved         */
 +        unsigned char           mode;        /* VLAN filter mode */
 +        __be32                  checksum;    /* Checksum         */
 +        unsigned char           pad[22];
 +};
 +
 +/* Set MAC Address */
 +struct ncsi_cmd_sma_pkt {
 +        struct ncsi_cmd_pkt_hdr cmd;      /* Command header          */
 +        unsigned char           mac[6];   /* MAC address             */
 +        unsigned char           index;    /* MAC table index         */
 +        unsigned char           at_e;     /* Addr type and operation */
 +        __be32                  checksum; /* Checksum                */
 +        unsigned char           pad[18];
 +};
 +
 +/* Enable Broadcast Filter */
 +struct ncsi_cmd_ebf_pkt {
 +        struct ncsi_cmd_pkt_hdr cmd;      /* Command header */
 +        __be32                  mode;     /* Filter mode    */
 +        __be32                  checksum; /* Checksum       */
 +        unsigned char           pad[22];
 +};
 +
 +/* Enable Global Multicast Filter */
 +struct ncsi_cmd_egmf_pkt {
 +        struct ncsi_cmd_pkt_hdr cmd;      /* Command header */
 +        __be32                  mode;     /* Global MC mode */
 +        __be32                  checksum; /* Checksum       */
 +        unsigned char           pad[22];
 +};
 +
 +/* Set NCSI Flow Control */
 +struct ncsi_cmd_snfc_pkt {
 +        struct ncsi_cmd_pkt_hdr cmd;         /* Command header    */
 +        unsigned char           reserved[3]; /* Reserved          */
 +        unsigned char           mode;        /* Flow control mode */
 +        __be32                  checksum;    /* Checksum          */
 +        unsigned char           pad[22];
 +};
 +
 +/* Get Link Status */
 +struct ncsi_rsp_gls_pkt {
 +        struct ncsi_rsp_pkt_hdr rsp;        /* Response header   */
 +        __be32                  status;     /* Link status       */
 +        __be32                  other;      /* Other indications */
 +        __be32                  oem_status; /* OEM link status   */
 +        __be32                  checksum;
 +        unsigned char           pad[10];
 +};
 +
 +/* Get Version ID */
 +struct ncsi_rsp_gvi_pkt {
 +        struct ncsi_rsp_pkt_hdr rsp;          /* Response header */
 +        __be32                  ncsi_version; /* NCSI version    */
 +        unsigned char           reserved[3];  /* Reserved        */
 +        unsigned char           alpha2;       /* NCSI version    */
 +        unsigned char           fw_name[12];  /* f/w name string */
 +        __be32                  fw_version;   /* f/w version     */
 +        __be16                  pci_ids[4];   /* PCI IDs         */
 +        __be32                  mf_id;        /* Manufacture ID  */
 +        __be32                  checksum;
 +};
 +
 +/* Get Capabilities */
 +struct ncsi_rsp_gc_pkt {
 +        struct ncsi_rsp_pkt_hdr rsp;         /* Response header   */
 +        __be32                  cap;         /* Capabilities      */
 +        __be32                  bc_cap;      /* Broadcast cap     */
 +        __be32                  mc_cap;      /* Multicast cap     */
 +        __be32                  buf_cap;     /* Buffering cap     */
 +        __be32                  aen_cap;     /* AEN cap           */
 +        unsigned char           vlan_cnt;    /* VLAN filter count */
 +        unsigned char           mixed_cnt;   /* Mix filter count  */
 +        unsigned char           mc_cnt;      /* MC filter count   */
 +        unsigned char           uc_cnt;      /* UC filter count   */
 +        unsigned char           reserved[2]; /* Reserved          */
 +        unsigned char           vlan_mode;   /* VLAN mode         */
 +        unsigned char           channel_cnt; /* Channel count     */
 +        __be32                  checksum;    /* Checksum          */
 +};
 +
 +/* Get Parameters */
 +struct ncsi_rsp_gp_pkt {
 +        struct ncsi_rsp_pkt_hdr rsp;          /* Response header       */
 +        unsigned char           mac_cnt;      /* Number of MAC addr    */
 +        unsigned char           reserved[2];  /* Reserved              */
 +        unsigned char           mac_enable;   /* MAC addr enable flags */
 +        unsigned char           vlan_cnt;     /* VLAN tag count        */
 +        unsigned char           reserved1;    /* Reserved              */
 +        __be16                  vlan_enable;  /* VLAN tag enable flags */
 +        __be32                  link_mode;    /* Link setting          */
 +        __be32                  bc_mode;      /* BC filter mode        */
 +        __be32                  valid_modes;  /* Valid mode parameters */
 +        unsigned char           vlan_mode;    /* VLAN mode             */
 +        unsigned char           fc_mode;      /* Flow control mode     */
 +        unsigned char           reserved2[2]; /* Reserved              */
 +        __be32                  aen_mode;     /* AEN mode              */
 +        unsigned char           mac[6];       /* Supported MAC addr    */
 +        __be16                  vlan;         /* Supported VLAN tags   */
 +        __be32                  checksum;     /* Checksum              */
 +};
 +
 +/* Get Controller Packet Statistics */
 +struct ncsi_rsp_gcps_pkt {
 +        struct ncsi_rsp_pkt_hdr rsp;            /* Response header            */
 +        __be32                  cnt_hi;         /* Counter cleared            */
 +        __be32                  cnt_lo;         /* Counter cleared            */
 +        __be32                  rx_bytes;       /* Rx bytes                   */
 +        __be32                  tx_bytes;       /* Tx bytes                   */
 +        __be32                  rx_uc_pkts;     /* Rx UC packets              */
 +        __be32                  rx_mc_pkts;     /* Rx MC packets              */
 +        __be32                  rx_bc_pkts;     /* Rx BC packets              */
 +        __be32                  tx_uc_pkts;     /* Tx UC packets              */
 +        __be32                  tx_mc_pkts;     /* Tx MC packets              */
 +        __be32                  tx_bc_pkts;     /* Tx BC packets              */
 +        __be32                  fcs_err;        /* FCS errors                 */
 +        __be32                  align_err;      /* Alignment errors           */
 +        __be32                  false_carrier;  /* False carrier detection    */
 +        __be32                  runt_pkts;      /* Rx runt packets            */
 +        __be32                  jabber_pkts;    /* Rx jabber packets          */
 +        __be32                  rx_pause_xon;   /* Rx pause XON frames        */
 +        __be32                  rx_pause_xoff;  /* Rx XOFF frames             */
 +        __be32                  tx_pause_xon;   /* Tx XON frames              */
 +        __be32                  tx_pause_xoff;  /* Tx XOFF frames             */
 +        __be32                  tx_s_collision; /* Single collision frames    */
 +        __be32                  tx_m_collision; /* Multiple collision frames  */
 +        __be32                  l_collision;    /* Late collision frames      */
 +        __be32                  e_collision;    /* Excessive collision frames */
 +        __be32                  rx_ctl_frames;  /* Rx control frames          */
 +        __be32                  rx_64_frames;   /* Rx 64-bytes frames         */
 +        __be32                  rx_127_frames;  /* Rx 65-127 bytes frames     */
 +        __be32                  rx_255_frames;  /* Rx 128-255 bytes frames    */
 +        __be32                  rx_511_frames;  /* Rx 256-511 bytes frames    */
 +        __be32                  rx_1023_frames; /* Rx 512-1023 bytes frames   */
 +        __be32                  rx_1522_frames; /* Rx 1024-1522 bytes frames  */
 +        __be32                  rx_9022_frames; /* Rx 1523-9022 bytes frames  */
 +        __be32                  tx_64_frames;   /* Tx 64-bytes frames         */
 +        __be32                  tx_127_frames;  /* Tx 65-127 bytes frames     */
 +        __be32                  tx_255_frames;  /* Tx 128-255 bytes frames    */
 +        __be32                  tx_511_frames;  /* Tx 256-511 bytes frames    */
 +        __be32                  tx_1023_frames; /* Tx 512-1023 bytes frames   */
 +        __be32                  tx_1522_frames; /* Tx 1024-1522 bytes frames  */
 +        __be32                  tx_9022_frames; /* Tx 1523-9022 bytes frames  */
 +        __be32                  rx_valid_bytes; /* Rx valid bytes             */
 +        __be32                  rx_runt_pkts;   /* Rx error runt packets      */
 +        __be32                  rx_jabber_pkts; /* Rx error jabber packets    */
 +        __be32                  checksum;       /* Checksum                   */
 +};
 +
 +/* Get NCSI Statistics */
 +struct ncsi_rsp_gns_pkt {
 +        struct ncsi_rsp_pkt_hdr rsp;           /* Response header         */
 +        __be32                  rx_cmds;       /* Rx NCSI commands        */
 +        __be32                  dropped_cmds;  /* Dropped commands        */
 +        __be32                  cmd_type_errs; /* Command type errors     */
 +        __be32                  cmd_csum_errs; /* Command checksum errors */
 +        __be32                  rx_pkts;       /* Rx NCSI packets         */
 +        __be32                  tx_pkts;       /* Tx NCSI packets         */
 +        __be32                  tx_aen_pkts;   /* Tx AEN packets          */
 +        __be32                  checksum;      /* Checksum                */
 +};
 +
 +/* Get NCSI Pass-through Statistics */
 +struct ncsi_rsp_gnpts_pkt {
 +        struct ncsi_rsp_pkt_hdr rsp;            /* Response header     */
 +        __be32                  tx_pkts;        /* Tx packets          */
 +        __be32                  tx_dropped;     /* Tx dropped packets  */
 +        __be32                  tx_channel_err; /* Tx channel errors   */
 +        __be32                  tx_us_err;      /* Tx undersize errors */
 +        __be32                  rx_pkts;        /* Rx packets          */
 +        __be32                  rx_dropped;     /* Rx dropped packets  */
 +        __be32                  rx_channel_err; /* Rx channel errors   */
 +        __be32                  rx_us_err;      /* Rx undersize errors */
 +        __be32                  rx_os_err;      /* Rx oversize errors  */
 +        __be32                  checksum;       /* Checksum            */
 +};
 +
 +/* Get package status */
 +struct ncsi_rsp_gps_pkt {
 +        struct ncsi_rsp_pkt_hdr rsp;      /* Response header             */
 +        __be32                  status;   /* Hardware arbitration status */
 +        __be32                  checksum;
 +};
 +
 +/* Get package UUID */
 +struct ncsi_rsp_gpuuid_pkt {
 +        struct ncsi_rsp_pkt_hdr rsp;      /* Response header */
 +        unsigned char           uuid[16]; /* UUID            */
 +        __be32                  checksum;
 +};
 +
 +/* AEN: Link State Change */
 +struct ncsi_aen_lsc_pkt {
 +        struct ncsi_aen_pkt_hdr aen;        /* AEN header      */
 +        __be32                  status;     /* Link status     */
 +        __be32                  oem_status; /* OEM link status */
 +        __be32                  checksum;   /* Checksum        */
 +        unsigned char           pad[14];
 +};
 +
 +/* AEN: Configuration Required */
 +struct ncsi_aen_cr_pkt {
 +        struct ncsi_aen_pkt_hdr aen;      /* AEN header */
 +        __be32                  checksum; /* Checksum   */
 +        unsigned char           pad[22];
 +};
 +
 +/* AEN: Host Network Controller Driver Status Change */
 +struct ncsi_aen_hncdsc_pkt {
 +        struct ncsi_aen_pkt_hdr aen;      /* AEN header */
 +        __be32                  status;   /* Status     */
 +        __be32                  checksum; /* Checksum   */
 +        unsigned char           pad[18];
 +};
 +
 +/* NCSI packet revision */
 +#define NCSI_PKT_REVISION       0x01
 +
 +/* NCSI packet commands */
 +#define NCSI_PKT_CMD_CIS        0x00 /* Clear Initial State              */
 +#define NCSI_PKT_CMD_SP         0x01 /* Select Package                   */
 +#define NCSI_PKT_CMD_DP         0x02 /* Deselect Package                 */
 +#define NCSI_PKT_CMD_EC         0x03 /* Enable Channel                   */
 +#define NCSI_PKT_CMD_DC         0x04 /* Disable Channel                  */
 +#define NCSI_PKT_CMD_RC         0x05 /* Reset Channel                    */
 +#define NCSI_PKT_CMD_ECNT       0x06 /* Enable Channel Network Tx        */
 +#define NCSI_PKT_CMD_DCNT       0x07 /* Disable Channel Network Tx       */
 +#define NCSI_PKT_CMD_AE         0x08 /* AEN Enable                       */
 +#define NCSI_PKT_CMD_SL         0x09 /* Set Link                         */
 +#define NCSI_PKT_CMD_GLS        0x0a /* Get Link                         */
 +#define NCSI_PKT_CMD_SVF        0x0b /* Set VLAN Filter                  */
 +#define NCSI_PKT_CMD_EV         0x0c /* Enable VLAN                      */
 +#define NCSI_PKT_CMD_DV         0x0d /* Disable VLAN                     */
 +#define NCSI_PKT_CMD_SMA        0x0e /* Set MAC address                  */
 +#define NCSI_PKT_CMD_EBF        0x10 /* Enable Broadcast Filter          */
 +#define NCSI_PKT_CMD_DBF        0x11 /* Disable Broadcast Filter         */
 +#define NCSI_PKT_CMD_EGMF       0x12 /* Enable Global Multicast Filter   */
 +#define NCSI_PKT_CMD_DGMF       0x13 /* Disable Global Multicast Filter  */
 +#define NCSI_PKT_CMD_SNFC       0x14 /* Set NCSI Flow Control            */
 +#define NCSI_PKT_CMD_GVI        0x15 /* Get Version ID                   */
 +#define NCSI_PKT_CMD_GC         0x16 /* Get Capabilities                 */
 +#define NCSI_PKT_CMD_GP         0x17 /* Get Parameters                   */
 +#define NCSI_PKT_CMD_GCPS       0x18 /* Get Controller Packet Statistics */
 +#define NCSI_PKT_CMD_GNS        0x19 /* Get NCSI Statistics              */
 +#define NCSI_PKT_CMD_GNPTS      0x1a /* Get NCSI Pass-throu Statistics   */
 +#define NCSI_PKT_CMD_GPS        0x1b /* Get package status               */
 +#define NCSI_PKT_CMD_OEM        0x50 /* OEM                              */
 +#define NCSI_PKT_CMD_PLDM       0x51 /* PLDM request over NCSI over RBT  */
 +#define NCSI_PKT_CMD_GPUUID     0x52 /* Get package UUID                 */
 +
 +/* NCSI packet responses */
 +#define NCSI_PKT_RSP_CIS        (NCSI_PKT_CMD_CIS    + 0x80)
 +#define NCSI_PKT_RSP_SP         (NCSI_PKT_CMD_SP     + 0x80)
 +#define NCSI_PKT_RSP_DP         (NCSI_PKT_CMD_DP     + 0x80)
 +#define NCSI_PKT_RSP_EC         (NCSI_PKT_CMD_EC     + 0x80)
 +#define NCSI_PKT_RSP_DC         (NCSI_PKT_CMD_DC     + 0x80)
 +#define NCSI_PKT_RSP_RC         (NCSI_PKT_CMD_RC     + 0x80)
 +#define NCSI_PKT_RSP_ECNT       (NCSI_PKT_CMD_ECNT   + 0x80)
 +#define NCSI_PKT_RSP_DCNT       (NCSI_PKT_CMD_DCNT   + 0x80)
 +#define NCSI_PKT_RSP_AE         (NCSI_PKT_CMD_AE     + 0x80)
 +#define NCSI_PKT_RSP_SL         (NCSI_PKT_CMD_SL     + 0x80)
 +#define NCSI_PKT_RSP_GLS        (NCSI_PKT_CMD_GLS    + 0x80)
 +#define NCSI_PKT_RSP_SVF        (NCSI_PKT_CMD_SVF    + 0x80)
 +#define NCSI_PKT_RSP_EV         (NCSI_PKT_CMD_EV     + 0x80)
 +#define NCSI_PKT_RSP_DV         (NCSI_PKT_CMD_DV     + 0x80)
 +#define NCSI_PKT_RSP_SMA        (NCSI_PKT_CMD_SMA    + 0x80)
 +#define NCSI_PKT_RSP_EBF        (NCSI_PKT_CMD_EBF    + 0x80)
 +#define NCSI_PKT_RSP_DBF        (NCSI_PKT_CMD_DBF    + 0x80)
 +#define NCSI_PKT_RSP_EGMF       (NCSI_PKT_CMD_EGMF   + 0x80)
 +#define NCSI_PKT_RSP_DGMF       (NCSI_PKT_CMD_DGMF   + 0x80)
 +#define NCSI_PKT_RSP_SNFC       (NCSI_PKT_CMD_SNFC   + 0x80)
 +#define NCSI_PKT_RSP_GVI        (NCSI_PKT_CMD_GVI    + 0x80)
 +#define NCSI_PKT_RSP_GC         (NCSI_PKT_CMD_GC     + 0x80)
 +#define NCSI_PKT_RSP_GP         (NCSI_PKT_CMD_GP     + 0x80)
 +#define NCSI_PKT_RSP_GCPS       (NCSI_PKT_CMD_GCPS   + 0x80)
 +#define NCSI_PKT_RSP_GNS        (NCSI_PKT_CMD_GNS    + 0x80)
 +#define NCSI_PKT_RSP_GNPTS      (NCSI_PKT_CMD_GNPTS  + 0x80)
 +#define NCSI_PKT_RSP_GPS        (NCSI_PKT_CMD_GPS    + 0x80)
 +#define NCSI_PKT_RSP_OEM        (NCSI_PKT_CMD_OEM    + 0x80)
 +#define NCSI_PKT_RSP_PLDM       (NCSI_PKT_CMD_PLDM   + 0x80)
 +#define NCSI_PKT_RSP_GPUUID     (NCSI_PKT_CMD_GPUUID + 0x80)
 +
 +/* NCSI response code/reason */
 +#define NCSI_PKT_RSP_C_COMPLETED        0x0000 /* Command Completed        */
 +#define NCSI_PKT_RSP_C_FAILED           0x0001 /* Command Failed           */
 +#define NCSI_PKT_RSP_C_UNAVAILABLE      0x0002 /* Command Unavailable      */
 +#define NCSI_PKT_RSP_C_UNSUPPORTED      0x0003 /* Command Unsupported      */
 +#define NCSI_PKT_RSP_R_NO_ERROR         0x0000 /* No Error                 */
 +#define NCSI_PKT_RSP_R_INTERFACE        0x0001 /* Interface not ready      */
 +#define NCSI_PKT_RSP_R_PARAM            0x0002 /* Invalid Parameter        */
 +#define NCSI_PKT_RSP_R_CHANNEL          0x0003 /* Channel not Ready        */
 +#define NCSI_PKT_RSP_R_PACKAGE          0x0004 /* Package not Ready        */
 +#define NCSI_PKT_RSP_R_LENGTH           0x0005 /* Invalid payload length   */
 +#define NCSI_PKT_RSP_R_UNKNOWN          0x7fff /* Command type unsupported */
 +
 +/* NCSI AEN packet type */
 +#define NCSI_PKT_AEN            0xFF /* AEN Packet               */
 +#define NCSI_PKT_AEN_LSC        0x00 /* Link status change       */
 +#define NCSI_PKT_AEN_CR         0x01 /* Configuration required   */
 +#define NCSI_PKT_AEN_HNCDSC     0x02 /* HNC driver status change */
 +
 +#endif /* NCSI_PKT_H */
 diff --git a/slirp/ncsi.c b/slirp/ncsi.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/slirp/ncsi.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * NC-SI (Network Controller Sideband Interface) "echo" model
 + *
 + * Copyright (C) 2016 IBM Corp.
 + *
 + * This code is licensed under the GPL version 2 or later. See the
 + * COPYING file in the top-level directory.
 + */
 +#include "qemu/osdep.h"
 +#include "slirp.h"
 +
 +#include "ncsi-pkt.h"
 +
 +/* Get Capabilities */
 +static int ncsi_rsp_handler_gc(struct ncsi_rsp_pkt_hdr *rnh)
 +{
 +    struct ncsi_rsp_gc_pkt *rsp = (struct ncsi_rsp_gc_pkt *) rnh;
 +
 +    rsp->cap = htonl(~0);
 +    rsp->bc_cap = htonl(~0);
 +    rsp->mc_cap = htonl(~0);
 +    rsp->buf_cap = htonl(~0);
 +    rsp->aen_cap = htonl(~0);
 +    rsp->vlan_mode = 0xff;
 +    rsp->uc_cnt = 2;
 +    return 0;
 +}
 +
 +/* Get Link status */
 +static int ncsi_rsp_handler_gls(struct ncsi_rsp_pkt_hdr *rnh)
 +{
 +    struct ncsi_rsp_gls_pkt *rsp = (struct ncsi_rsp_gls_pkt *) rnh;
 +
 +    rsp->status = htonl(0x1);
 +    return 0;
 +}
 +
 +static const struct ncsi_rsp_handler {
 +        unsigned char   type;
 +        int             payload;
 +        int             (*handler)(struct ncsi_rsp_pkt_hdr *rnh);
 +} ncsi_rsp_handlers[] = {
 +        { NCSI_PKT_RSP_CIS,     4, NULL },
 +        { NCSI_PKT_RSP_SP,      4, NULL },
 +        { NCSI_PKT_RSP_DP,      4, NULL },
 +        { NCSI_PKT_RSP_EC,      4, NULL },
 +        { NCSI_PKT_RSP_DC,      4, NULL },
 +        { NCSI_PKT_RSP_RC,      4, NULL },
 +        { NCSI_PKT_RSP_ECNT,    4, NULL },
 +        { NCSI_PKT_RSP_DCNT,    4, NULL },
 +        { NCSI_PKT_RSP_AE,      4, NULL },
 +        { NCSI_PKT_RSP_SL,      4, NULL },
 +        { NCSI_PKT_RSP_GLS,    16, ncsi_rsp_handler_gls },
 +        { NCSI_PKT_RSP_SVF,     4, NULL },
 +        { NCSI_PKT_RSP_EV,      4, NULL },
 +        { NCSI_PKT_RSP_DV,      4, NULL },
 +        { NCSI_PKT_RSP_SMA,     4, NULL },
 +        { NCSI_PKT_RSP_EBF,     4, NULL },
 +        { NCSI_PKT_RSP_DBF,     4, NULL },
 +        { NCSI_PKT_RSP_EGMF,    4, NULL },
 +        { NCSI_PKT_RSP_DGMF,    4, NULL },
 +        { NCSI_PKT_RSP_SNFC,    4, NULL },
 +        { NCSI_PKT_RSP_GVI,    36, NULL },
 +        { NCSI_PKT_RSP_GC,     32, ncsi_rsp_handler_gc },
 +        { NCSI_PKT_RSP_GP,     -1, NULL },
 +        { NCSI_PKT_RSP_GCPS,  172, NULL },
 +        { NCSI_PKT_RSP_GNS,   172, NULL },
 +        { NCSI_PKT_RSP_GNPTS, 172, NULL },
 +        { NCSI_PKT_RSP_GPS,     8, NULL },
 +        { NCSI_PKT_RSP_OEM,     0, NULL },
 +        { NCSI_PKT_RSP_PLDM,    0, NULL },
 +        { NCSI_PKT_RSP_GPUUID, 20, NULL }
 +};
 +
 +/*
 + * packet format : ncsi header + payload + checksum
 + */
 +#define NCSI_MAX_PAYLOAD 172
 +#define NCSI_MAX_LEN     (sizeof(struct ncsi_pkt_hdr) + NCSI_MAX_PAYLOAD + 4)
 +
 +void ncsi_input(Slirp *slirp, const uint8_t *pkt, int pkt_len)
 +{
 +    struct ncsi_pkt_hdr *nh = (struct ncsi_pkt_hdr *)(pkt + ETH_HLEN);
 +    uint8_t ncsi_reply[ETH_HLEN + NCSI_MAX_LEN];
 +    struct ethhdr *reh = (struct ethhdr *)ncsi_reply;
 +    struct ncsi_rsp_pkt_hdr *rnh = (struct ncsi_rsp_pkt_hdr *)
 +        (ncsi_reply + ETH_HLEN);
 +    const struct ncsi_rsp_handler *handler = NULL;
 +    int i;
 +
 +    memset(ncsi_reply, 0, sizeof(ncsi_reply));
 +
 +    memset(reh->h_dest, 0xff, ETH_ALEN);
 +    memset(reh->h_source, 0xff, ETH_ALEN);
 +    reh->h_proto = htons(ETH_P_NCSI);
 +
 +    for (i = 0; i < ARRAY_SIZE(ncsi_rsp_handlers); i++) {
 +        if (ncsi_rsp_handlers[i].type == nh->type + 0x80) {
 +            handler = &ncsi_rsp_handlers[i];
 +            break;
 +        }
 +    }
 +
-+    net_hub_add_port(hubport->hubid, name, hubpeer);
++    rnh->common.mc_id      = nh->mc_id;
-+
++    rnh->common.revision   = NCSI_PKT_REVISION;
-     return 0;
++    rnh->common.id         = nh->id;
- }
++    rnh->common.type       = nh->type + 0x80;
++    rnh->common.channel    = nh->channel;
-diff --git a/net/hub.h b/net/hub.h
++
 +    if (handler) {
 +        rnh->common.length = htons(handler->payload);
 +        rnh->code          = htons(NCSI_PKT_RSP_C_COMPLETED);
 +        rnh->reason        = htons(NCSI_PKT_RSP_R_NO_ERROR);
 +
 +        if (handler->handler) {
 +            /* TODO: handle errors */
 +            handler->handler(rnh);
 +        }
 +    } else {
 +        rnh->common.length = 0;
 +        rnh->code          = htons(NCSI_PKT_RSP_C_UNAVAILABLE);
 +        rnh->reason        = htons(NCSI_PKT_RSP_R_UNKNOWN);
 +    }
 +
 +    /* TODO: add a checksum at the end of the frame but the specs
 +     * allows it to be zero */
 +
 +    slirp_output(slirp->opaque, ncsi_reply, ETH_HLEN + sizeof(*nh) +
 +                 (handler ? handler->payload : 0) + 4);
 +}
 diff --git a/slirp/slirp.c b/slirp/slirp.c
 index XXXXXXX..XXXXXXX 100644
---- a/net/hub.h
+--- a/slirp/slirp.c
-+++ b/net/hub.h
++++ b/slirp/slirp.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ void slirp_input(Slirp *slirp, const uint8_t *pkt, int pkt_len)
+         }
- #include "qemu-common.h"
+         break;
--NetClientState *net_hub_add_port(int hub_id, const char *name);
++    case ETH_P_NCSI:
-+NetClientState *net_hub_add_port(int hub_id, const char *name,
++        ncsi_input(slirp, pkt, pkt_len);
-+                                 NetClientState *hubpeer);
++        break;
- NetClientState *net_hub_find_client_by_name(int hub_id, const char *name);
++
- void net_hub_info(Monitor *mon);
+     default:
- void net_hub_check_clients(void);
+         break;
-diff --git a/net/net.c b/net/net.c
+     }
 diff --git a/slirp/slirp.h b/slirp/slirp.h
 index XXXXXXX..XXXXXXX 100644
---- a/net/net.c
+--- a/slirp/slirp.h
-+++ b/net/net.c
++++ b/slirp/slirp.h
-@@ -XXX,XX +XXX,XX @@ static int net_client_init1(const void *object, bool is_netdev, Error **errp)
+@@ -XXX,XX +XXX,XX @@ extern Slirp *slirp_instance;
-         /* Do not add to a vlan if it's a nic with a netdev= parameter. */
-         if (netdev->type != NET_CLIENT_DRIVER_NIC ||
+ void if_start(Slirp *);
-             !opts->u.nic.has_netdev) {
--            peer = net_hub_add_port(net->has_vlan ? net->vlan : 0, NULL);
++/* ncsi.c */
-+            peer = net_hub_add_port(net->has_vlan ? net->vlan : 0, NULL, NULL);
++void ncsi_input(Slirp *slirp, const uint8_t *pkt, int pkt_len);
-         }
++
+ #ifndef _WIN32
-         if (net->has_vlan && !vlan_warned) {
+ #include <netdb.h>
 diff --git a/qapi/net.json b/qapi/net.json
 index XXXXXXX..XXXXXXX 100644
 --- a/qapi/net.json
 +++ b/qapi/net.json
@@ -XXX,XX +XXX,XX @@
  # Connect two or more net clients through a software hub.
  #
  # @hubid: hub identifier number
 +# @netdev: used to connect hub to a netdev instead of a device (since 2.12)
  #
  # Since: 1.2
  ##
  { 'struct': 'NetdevHubPortOptions',
    'data': {
 -    'hubid':     'int32' } }
 +    'hubid':     'int32',
 +    '*netdev':    'str' } }
  ##
  # @NetdevNetmapOptions:
 diff --git a/qemu-options.hx b/qemu-options.hx
 index XXXXXXX..XXXXXXX 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
@@ -XXX,XX +XXX,XX @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev,
  #endif
-     "-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]\n"
-     "                configure a vhost-user network, backed by a chardev 'dev'\n"
--    "-netdev hubport,id=str,hubid=n\n"
-+    "-netdev hubport,id=str,hubid=n[,netdev=nd]\n"
-     "                configure a hub port on QEMU VLAN 'n'\n", QEMU_ARCH_ALL)
- DEF("net", HAS_ARG, QEMU_OPTION_net,
-     "-net nic[,vlan=n][,netdev=nd][,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]\n"
-@@ -XXX,XX +XXX,XX @@ vde_switch -F -sock /tmp/myswitch
- qemu-system-i386 linux.img -net nic -net vde,sock=/tmp/myswitch
- @end example
--@item -netdev hubport,id=@var{id},hubid=@var{hubid}
-+@item -netdev hubport,id=@var{id},hubid=@var{hubid}[,netdev=@var{nd}]
- Create a hub port on QEMU "vlan" @var{hubid}.
- The hubport netdev lets you connect a NIC to a QEMU "vlan" instead of a single
- netdev.  @code{-net} and @code{-device} with parameter @option{vlan} create the
--required hub automatically.
-+required hub automatically. Alternatively, you can also connect the hubport
-+to another netdev with ID @var{nd} by using the @option{netdev=@var{nd}}
-+option.
- @item -netdev vhost-user,chardev=@var{id}[,vhostforce=on|off][,queues=n]
 --
 .7.4

-[Qemu-devel] [PULL 4/6] net: Allow netdevs to be used with 'hostfwd_add' and 'hostfwd_remove'
+[Qemu-devel] [PULL V2 7/8] COLO-compare: Optimize tcp compare for option field
-From: Thomas Huth <thuth@redhat.com>
+From: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
-It does not make much sense to limit these commands to the legacy 'vlan'
+In this patch we support packet that have tcp options field.
-concept only, they should work with the modern netdevs, too. So now
+Add tcp options field check, If the packet have options
-it is possible to use this command with one, two or three parameters.
+field we just skip it and compare tcp payload,
 Avoid unnecessary checkpoint, optimize performance.
-With one parameter, the command installs a hostfwd rule on the default
+Signed-off-by: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
 "user" network:
     hostfwd_add tcp:...
 With two parameters, the command installs a hostfwd rule on a netdev
 (that's the new way of using this command):
     hostfwd_add netdev_id tcp:...
 With three parameters, the command installs a rule on a 'vlan' (aka hub):
     hostfwd_add hub_id name tcp:...
 Same applies to the hostfwd_remove command now.
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- hmp-commands.hx |  4 ++--
+ net/colo-compare.c | 27 ++++++++++++++++++++++++++-
- net/slirp.c     | 33 +++++++++++++++++++++++----------
+file changed, 26 insertions(+), 1 deletion(-)
 files changed, 25 insertions(+), 12 deletions(-)
-diff --git a/hmp-commands.hx b/hmp-commands.hx
+diff --git a/net/colo-compare.c b/net/colo-compare.c
 index XXXXXXX..XXXXXXX 100644
---- a/hmp-commands.hx
+--- a/net/colo-compare.c
-+++ b/hmp-commands.hx
++++ b/net/colo-compare.c
-@@ -XXX,XX +XXX,XX @@ ETEXI
+@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_tcp(Packet *spkt, Packet *ppkt)
-     {
+         spkt->ip->ip_sum = ppkt->ip->ip_sum;
-         .name       = "hostfwd_add",
+     }
-         .args_type  = "arg1:s,arg2:s?,arg3:s?",
--        .params     = "[vlan_id name] [tcp|udp]:[hostaddr]:hostport-[guestaddr]:guestport",
+-    if (ptcp->th_sum == stcp->th_sum) {
-+        .params     = "[hub_id name]|[netdev_id] [tcp|udp]:[hostaddr]:hostport-[guestaddr]:guestport",
++    /*
-         .help       = "redirect TCP or UDP connections from host to guest (requires -net user)",
++     * Check tcp header length for tcp option field.
-         .cmd        = hmp_hostfwd_add,
++     * th_off > 5 means this tcp packet have options field.
-     },
++     * The tcp options maybe always different.
-@@ -XXX,XX +XXX,XX @@ ETEXI
++     * for example:
-     {
++     * From RFC 7323.
-         .name       = "hostfwd_remove",
++     * TCP Timestamps option (TSopt):
-         .args_type  = "arg1:s,arg2:s?,arg3:s?",
++     * Kind: 8
--        .params     = "[vlan_id name] [tcp|udp]:[hostaddr]:hostport",
++     *
-+        .params     = "[hub_id name]|[netdev_id] [tcp|udp]:[hostaddr]:hostport",
++     * Length: 10 bytes
-         .help       = "remove host-to-guest TCP or UDP redirection",
++     *
-         .cmd        = hmp_hostfwd_remove,
++     *    +-------+-------+---------------------+---------------------+
-     },
++     *    |Kind=8 |  10   |   TS Value (TSval)  |TS Echo Reply (TSecr)|
-diff --git a/net/slirp.c b/net/slirp.c
++     *    +-------+-------+---------------------+---------------------+
-index XXXXXXX..XXXXXXX 100644
++     *       1       1              4                     4
---- a/net/slirp.c
++     *
-+++ b/net/slirp.c
++     * In this case the primary guest's timestamp always different with
-@@ -XXX,XX +XXX,XX @@ error:
++     * the secondary guest's timestamp. COLO just focus on payload,
-     return -1;
++     * so we just need skip this field.
- }
++     */
++    if (ptcp->th_off > 5) {
--static SlirpState *slirp_lookup(Monitor *mon, const char *vlan,
++        ptrdiff_t tcp_offset;
--                                const char *stack)
++        tcp_offset = ppkt->transport_header - (uint8_t *)ppkt->data
-+static SlirpState *slirp_lookup(Monitor *mon, const char *hub_id,
++                     + (ptcp->th_off * 4);
-+                                const char *name)
++        res = colo_packet_compare_common(ppkt, spkt, tcp_offset);
- {
++    } else if (ptcp->th_sum == stcp->th_sum) {
--
+         res = colo_packet_compare_common(ppkt, spkt, ETH_HLEN);
 -    if (vlan) {
 +    if (name) {
          NetClientState *nc;
 -        nc = net_hub_find_client_by_name(strtol(vlan, NULL, 0), stack);
 -        if (!nc) {
 -            monitor_printf(mon, "unrecognized (vlan-id, stackname) pair\n");
 -            return NULL;
 +        if (hub_id) {
 +            nc = net_hub_find_client_by_name(strtol(hub_id, NULL, 0), name);
 +            if (!nc) {
 +                monitor_printf(mon, "unrecognized (vlan-id, stackname) pair\n");
 +                return NULL;
 +            }
 +        } else {
 +            nc = qemu_find_netdev(name);
 +            if (!nc) {
 +                monitor_printf(mon, "unrecognized netdev id '%s'\n", name);
 +                return NULL;
 +            }
          }
          if (strcmp(nc->model, "user")) {
              monitor_printf(mon, "invalid device specified\n");
@@ -XXX,XX +XXX,XX @@ void hmp_hostfwd_remove(Monitor *mon, const QDict *qdict)
      const char *arg2 = qdict_get_try_str(qdict, "arg2");
      const char *arg3 = qdict_get_try_str(qdict, "arg3");
 -    if (arg2) {
 +    if (arg3) {
          s = slirp_lookup(mon, arg1, arg2);
          src_str = arg3;
 +    } else if (arg2) {
 +        s = slirp_lookup(mon, NULL, arg1);
 +        src_str = arg2;
      } else {
-         s = slirp_lookup(mon, NULL, NULL);
+         res = -1;
          src_str = arg1;
@@ -XXX,XX +XXX,XX @@ void hmp_hostfwd_add(Monitor *mon, const QDict *qdict)
      const char *arg2 = qdict_get_try_str(qdict, "arg2");
      const char *arg3 = qdict_get_try_str(qdict, "arg3");
 -    if (arg2) {
 +    if (arg3) {
          s = slirp_lookup(mon, arg1, arg2);
          redir_str = arg3;
 +    } else if (arg2) {
 +        s = slirp_lookup(mon, NULL, arg1);
 +        redir_str = arg2;
      } else {
          s = slirp_lookup(mon, NULL, NULL);
          redir_str = arg1;
 --
 .7.4

-[Qemu-devel] [PULL 2/6] colo: compare the packet based on the tcp sequence number
+[Qemu-devel] [PULL V2 8/8] COLO-compare: Optimize tcp compare trace event
-From: Mao Zhongyi <maozy.fnst@cn.fujitsu.com>
+From: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
-Packet size some time different or when network is busy.
+Optimize two trace events as one, adjust print format make
-Based on same payload size, but TCP protocol can not
+it easy to read. rename trace_colo_compare_pkt_info_src/dst
-guarantee send the same one packet in the same way,
+to trace_colo_compare_tcp_info.
-like that:
+Signed-off-by: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
 We send this payload:
 ------------------------------
 | header |1|2|3|4|5|6|7|8|9|0|
 ------------------------------
 primary:
 ppkt1:
 ----------------
 | header |1|2|3|
 ----------------
 ppkt2:
 ------------------------
 | header |4|5|6|7|8|9|0|
 ------------------------
 secondary:
 spkt1:
 ------------------------------
 | header |1|2|3|4|5|6|7|8|9|0|
 ------------------------------
 In the original method, ppkt1 and ppkt2 are different in size and
 spkt1, so they can't compare and trigger the checkpoint.
 I have tested FTP get 200M and 1G file many times, I found that
 the performance was less than 1% of the native.
 Now I reconstructed the comparison of TCP packets based on the
 TCP sequence number. first of all, ppkt1 and spkt1 have the same
 starting sequence number, so they can compare, even though their
 length is different. And then ppkt1 with a smaller payload length
 is used as the comparison length, if the payload is same, send
 out the ppkt1 and record the offset(the length of ppkt1 payload)
 in spkt1. The next comparison, ppkt2 and spkt1 can be compared
 from the recorded position of spkt1.
 like that:
 ----------------
 | header |1|2|3| ppkt1
 ---------|-----|
          |     |
 ---------v-----v--------------
 | header |1|2|3|4|5|6|7|8|9|0| spkt1
 ---------------|\------------|
                | \offset     |
       ---------v-------------v
       | header |4|5|6|7|8|9|0| ppkt2
       ------------------------
 In this way, the performance can reach native 20% in my multiple
 tests.
 Cc: Zhang Chen <zhangckid@gmail.com>
 Cc: Li Zhijian <lizhijian@cn.fujitsu.com>
 Cc: Jason Wang <jasowang@redhat.com>
 Signed-off-by: Mao Zhongyi <maozy.fnst@cn.fujitsu.com>
 Signed-off-by: Li Zhijian <lizhijian@cn.fujitsu.com>
 Signed-off-by: Zhang Chen <zhangckid@gmail.com>
 Reviewed-by: Zhang Chen <zhangckid@gmail.com>
 Tested-by: Zhang Chen <zhangckid@gmail.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- net/colo-compare.c | 343 +++++++++++++++++++++++++++++++++++------------------
+ net/colo-compare.c | 29 +++++++++++++++++------------
- net/colo.c         |   9 ++
+ net/trace-events   |  3 +--
- net/colo.h         |  15 +++
+files changed, 18 insertions(+), 14 deletions(-)
  net/trace-events   |   2 +-
 files changed, 250 insertions(+), 119 deletions(-)
 diff --git a/net/colo-compare.c b/net/colo-compare.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/colo-compare.c
 +++ b/net/colo-compare.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_tcp(Packet *spkt, Packet *ppkt)
- #define COMPARE_READ_LEN_MAX NET_BUFSIZE
+         res = -1;
- #define MAX_QUEUE_SIZE 1024
+     }
-+#define COLO_COMPARE_FREE_PRIMARY     0x01
+-    if (res != 0 && trace_event_get_state(TRACE_COLO_COMPARE_MISCOMPARE)) {
-+#define COLO_COMPARE_FREE_SECONDARY   0x02
+-        trace_colo_compare_pkt_info_src(inet_ntoa(ppkt->ip->ip_src),
 -                                        ntohl(stcp->th_seq),
 -                                        ntohl(stcp->th_ack),
 -                                        res, stcp->th_flags,
 -                                        spkt->size);
 -
 -        trace_colo_compare_pkt_info_dst(inet_ntoa(ppkt->ip->ip_dst),
 -                                        ntohl(ptcp->th_seq),
 -                                        ntohl(ptcp->th_ack),
 -                                        res, ptcp->th_flags,
 -                                        ppkt->size);
 +    if (res && trace_event_get_state(TRACE_COLO_COMPARE_MISCOMPARE)) {
 +        char ip_src[20], ip_dst[20];
 +
- /* TODO: Should be configurable */
++        strcpy(ip_src, inet_ntoa(ppkt->ip->ip_src));
- #define REGULAR_PACKET_CHECK_MS 3000
++        strcpy(ip_dst, inet_ntoa(ppkt->ip->ip_dst));
@@ -XXX,XX +XXX,XX @@ static gint seq_sorter(Packet *a, Packet *b, gpointer data)
      return ntohl(atcp->th_seq) - ntohl(btcp->th_seq);
  }
 +static void fill_pkt_tcp_info(void *data, uint32_t *max_ack)
 +{
 +    Packet *pkt = data;
 +    struct tcphdr *tcphd;
 +
-+    tcphd = (struct tcphdr *)pkt->transport_header;
++        trace_colo_compare_tcp_info(ip_src,
-+
++                                    ip_dst,
-+    pkt->tcp_seq = ntohl(tcphd->th_seq);
++                                    ntohl(ptcp->th_seq),
-+    pkt->tcp_ack = ntohl(tcphd->th_ack);
++                                    ntohl(stcp->th_seq),
-+    *max_ack = *max_ack > pkt->tcp_ack ? *max_ack : pkt->tcp_ack;
++                                    ntohl(ptcp->th_ack),
-+    pkt->header_size = pkt->transport_header - (uint8_t *)pkt->data
++                                    ntohl(stcp->th_ack),
-+                       + (tcphd->th_off << 2) - pkt->vnet_hdr_len;
++                                    res,
-+    pkt->payload_size = pkt->size - pkt->header_size;
++                                    ptcp->th_flags,
-+    pkt->seq_end = pkt->tcp_seq + pkt->payload_size;
++                                    stcp->th_flags,
-+    pkt->flags = tcphd->th_flags;
++                                    ppkt->size,
-+}
++                                    spkt->size);
 +
  /*
   * Return 1 on success, if return 0 means the
   * packet will be dropped
   */
 -static int colo_insert_packet(GQueue *queue, Packet *pkt)
 +static int colo_insert_packet(GQueue *queue, Packet *pkt, uint32_t *max_ack)
  {
      if (g_queue_get_length(queue) <= MAX_QUEUE_SIZE) {
          if (pkt->ip->ip_p == IPPROTO_TCP) {
 +            fill_pkt_tcp_info(pkt, max_ack);
              g_queue_insert_sorted(queue,
                                    pkt,
                                    (GCompareDataFunc)seq_sorter,
@@ -XXX,XX +XXX,XX @@ static int packet_enqueue(CompareState *s, int mode, Connection **con)
      }
      if (mode == PRIMARY_IN) {
 -        if (!colo_insert_packet(&conn->primary_list, pkt)) {
 +        if (!colo_insert_packet(&conn->primary_list, pkt, &conn->pack)) {
              error_report("colo compare primary queue size too big,"
                           "drop packet");
          }
      } else {
 -        if (!colo_insert_packet(&conn->secondary_list, pkt)) {
 +        if (!colo_insert_packet(&conn->secondary_list, pkt, &conn->sack)) {
              error_report("colo compare secondary queue size too big,"
                           "drop packet");
          }
@@ -XXX,XX +XXX,XX @@ static int packet_enqueue(CompareState *s, int mode, Connection **con)
      return 0;
  }
 +static inline bool after(uint32_t seq1, uint32_t seq2)
 +{
 +        return (int32_t)(seq1 - seq2) > 0;
 +}
 +
 +static void colo_release_primary_pkt(CompareState *s, Packet *pkt)
 +{
 +    int ret;
 +    ret = compare_chr_send(s,
 +                           pkt->data,
 +                           pkt->size,
 +                           pkt->vnet_hdr_len);
 +    if (ret < 0) {
 +        error_report("colo send primary packet failed");
 +    }
 +    trace_colo_compare_main("packet same and release packet");
 +    packet_destroy(pkt, NULL);
 +}
 +
  /*
   * The IP packets sent by primary and secondary
   * will be compared in here
@@ -XXX,XX +XXX,XX @@ static int colo_compare_packet_payload(Packet *ppkt,
  }
  /*
 - * Called from the compare thread on the primary
 - * for compare tcp packet
 - * compare_tcp copied from Dr. David Alan Gilbert's branch
 - */
 -static int colo_packet_compare_tcp(Packet *spkt, Packet *ppkt)
 + * return true means that the payload is consist and
 + * need to make the next comparison, false means do
 + * the checkpoint
 +*/
 +static bool colo_mark_tcp_pkt(Packet *ppkt, Packet *spkt,
 +                              int8_t *mark, uint32_t max_ack)
  {
 -    struct tcphdr *ptcp, *stcp;
 -    int res;
 +    *mark = 0;
 +
 +    if (ppkt->tcp_seq == spkt->tcp_seq && ppkt->seq_end == spkt->seq_end) {
 +        if (colo_compare_packet_payload(ppkt, spkt,
 +                                        ppkt->header_size, spkt->header_size,
 +                                        ppkt->payload_size)) {
 +            *mark = COLO_COMPARE_FREE_SECONDARY | COLO_COMPARE_FREE_PRIMARY;
 +            return true;
 +        }
 +    }
 +    if (ppkt->tcp_seq == spkt->tcp_seq && ppkt->seq_end == spkt->seq_end) {
 +        if (colo_compare_packet_payload(ppkt, spkt,
 +                                        ppkt->header_size, spkt->header_size,
 +                                        ppkt->payload_size)) {
 +            *mark = COLO_COMPARE_FREE_SECONDARY | COLO_COMPARE_FREE_PRIMARY;
 +            return true;
 +        }
 +    }
 +
 +    /* one part of secondary packet payload still need to be compared */
 +    if (!after(ppkt->seq_end, spkt->seq_end)) {
 +        if (colo_compare_packet_payload(ppkt, spkt,
 +                                        ppkt->header_size + ppkt->offset,
 +                                        spkt->header_size + spkt->offset,
 +                                        ppkt->payload_size - ppkt->offset)) {
 +            if (!after(ppkt->tcp_ack, max_ack)) {
 +                *mark = COLO_COMPARE_FREE_PRIMARY;
 +                spkt->offset += ppkt->payload_size - ppkt->offset;
 +                return true;
 +            } else {
 +                /* secondary guest hasn't ack the data, don't send
 +                 * out this packet
 +                 */
 +                return false;
 +            }
 +        }
 +    } else {
 +        /* primary packet is longer than secondary packet, compare
 +         * the same part and mark the primary packet offset
 +         */
 +        if (colo_compare_packet_payload(ppkt, spkt,
 +                                        ppkt->header_size + ppkt->offset,
 +                                        spkt->header_size + spkt->offset,
 +                                        spkt->payload_size - spkt->offset)) {
 +            *mark = COLO_COMPARE_FREE_SECONDARY;
 +            ppkt->offset += spkt->payload_size - spkt->offset;
 +            return true;
 +        }
 +    }
 -    trace_colo_compare_main("compare tcp");
 +    return false;
 +}
 -    ptcp = (struct tcphdr *)ppkt->transport_header;
 -    stcp = (struct tcphdr *)spkt->transport_header;
 +static void colo_compare_tcp(CompareState *s, Connection *conn)
 +{
 +    Packet *ppkt = NULL, *spkt = NULL;
 +    int8_t mark;
      /*
 -     * The 'identification' field in the IP header is *very* random
 -     * it almost never matches.  Fudge this by ignoring differences in
 -     * unfragmented packets; they'll normally sort themselves out if different
 -     * anyway, and it should recover at the TCP level.
 -     * An alternative would be to get both the primary and secondary to rewrite
 -     * somehow; but that would need some sync traffic to sync the state
 -     */
 -    if (ntohs(ppkt->ip->ip_off) & IP_DF) {
 -        spkt->ip->ip_id = ppkt->ip->ip_id;
 -        /* and the sum will be different if the IDs were different */
 -        spkt->ip->ip_sum = ppkt->ip->ip_sum;
 +     * If ppkt and spkt have the same payload, but ppkt's ACK
 +     * is greater than spkt's ACK, in this case we can not
 +     * send the ppkt because it will cause the secondary guest
 +     * to miss sending some data in the next. Therefore, we
 +     * record the maximum ACK in the current queue at both
 +     * primary side and secondary side. Only when the ack is
 +     * less than the smaller of the two maximum ack, then we
 +     * can ensure that the packet's payload is acknowledged by
 +     * primary and secondary.
 +    */
 +    uint32_t min_ack = conn->pack > conn->sack ? conn->sack : conn->pack;
 +
 +pri:
 +    if (g_queue_is_empty(&conn->primary_list)) {
 +        return;
      }
 +    ppkt = g_queue_pop_head(&conn->primary_list);
 +sec:
 +    if (g_queue_is_empty(&conn->secondary_list)) {
 +        g_queue_push_head(&conn->primary_list, ppkt);
 +        return;
 +    }
 +    spkt = g_queue_pop_head(&conn->secondary_list);
 -    /*
 -     * Check tcp header length for tcp option field.
 -     * th_off > 5 means this tcp packet have options field.
 -     * The tcp options maybe always different.
 -     * for example:
 -     * From RFC 7323.
 -     * TCP Timestamps option (TSopt):
 -     * Kind: 8
 -     *
 -     * Length: 10 bytes
 -     *
 -     *    +-------+-------+---------------------+---------------------+
 -     *    |Kind=8 |  10   |   TS Value (TSval)  |TS Echo Reply (TSecr)|
 -     *    +-------+-------+---------------------+---------------------+
 -     *       1       1              4                     4
 -     *
 -     * In this case the primary guest's timestamp always different with
 -     * the secondary guest's timestamp. COLO just focus on payload,
 -     * so we just need skip this field.
 -     */
 +    if (ppkt->tcp_seq == ppkt->seq_end) {
 +        colo_release_primary_pkt(s, ppkt);
 +        ppkt = NULL;
 +    }
 -    ptrdiff_t ptcp_offset, stcp_offset;
 +    if (ppkt && conn->compare_seq && !after(ppkt->seq_end, conn->compare_seq)) {
 +        trace_colo_compare_main("pri: this packet has compared");
 +        colo_release_primary_pkt(s, ppkt);
 +        ppkt = NULL;
 +    }
 -    ptcp_offset = ppkt->transport_header - (uint8_t *)ppkt->data
 -                  + (ptcp->th_off << 2) - ppkt->vnet_hdr_len;
 -    stcp_offset = spkt->transport_header - (uint8_t *)spkt->data
 -                  + (stcp->th_off << 2) - spkt->vnet_hdr_len;
 -    if (ppkt->size - ptcp_offset == spkt->size - stcp_offset) {
 -        res = colo_compare_packet_payload(ppkt, spkt,
 -                                          ptcp_offset, stcp_offset,
 -                                          ppkt->size - ptcp_offset);
 +    if (spkt->tcp_seq == spkt->seq_end) {
 +        packet_destroy(spkt, NULL);
 +        if (!ppkt) {
 +            goto pri;
 +        } else {
 +            goto sec;
 +        }
      } else {
 -        trace_colo_compare_main("TCP: payload size of packets are different");
 -        res = -1;
 +        if (conn->compare_seq && !after(spkt->seq_end, conn->compare_seq)) {
 +            trace_colo_compare_main("sec: this packet has compared");
 +            packet_destroy(spkt, NULL);
 +            if (!ppkt) {
 +                goto pri;
 +            } else {
 +                goto sec;
 +            }
 +        }
 +        if (!ppkt) {
 +            g_queue_push_head(&conn->secondary_list, spkt);
 +            goto pri;
 +        }
      }
 -    if (res != 0 &&
 -        trace_event_get_state_backends(TRACE_COLO_COMPARE_MISCOMPARE)) {
 -        char pri_ip_src[20], pri_ip_dst[20], sec_ip_src[20], sec_ip_dst[20];
 -
 -        strcpy(pri_ip_src, inet_ntoa(ppkt->ip->ip_src));
 -        strcpy(pri_ip_dst, inet_ntoa(ppkt->ip->ip_dst));
 -        strcpy(sec_ip_src, inet_ntoa(spkt->ip->ip_src));
 -        strcpy(sec_ip_dst, inet_ntoa(spkt->ip->ip_dst));
 -
 -        trace_colo_compare_ip_info(ppkt->size, pri_ip_src,
 -                                   pri_ip_dst, spkt->size,
 -                                   sec_ip_src, sec_ip_dst);
 -
 -        trace_colo_compare_tcp_info("pri tcp packet",
 -                                    ntohl(ptcp->th_seq),
 -                                    ntohl(ptcp->th_ack),
 -                                    res, ptcp->th_flags,
 -                                    ppkt->size);
 -
 -        trace_colo_compare_tcp_info("sec tcp packet",
 -                                    ntohl(stcp->th_seq),
 -                                    ntohl(stcp->th_ack),
 -                                    res, stcp->th_flags,
 -                                    spkt->size);
 +    if (colo_mark_tcp_pkt(ppkt, spkt, &mark, min_ack)) {
 +        trace_colo_compare_tcp_info("pri",
 +                                    ppkt->tcp_seq, ppkt->tcp_ack,
 +                                    ppkt->header_size, ppkt->payload_size,
 +                                    ppkt->offset, ppkt->flags);
 +
 +        trace_colo_compare_tcp_info("sec",
 +                                    spkt->tcp_seq, spkt->tcp_ack,
 +                                    spkt->header_size, spkt->payload_size,
 +                                    spkt->offset, spkt->flags);
 +
 +        if (mark == COLO_COMPARE_FREE_PRIMARY) {
 +            conn->compare_seq = ppkt->seq_end;
 +            colo_release_primary_pkt(s, ppkt);
 +            g_queue_push_head(&conn->secondary_list, spkt);
 +            goto pri;
 +        }
 +        if (mark == COLO_COMPARE_FREE_SECONDARY) {
 +            conn->compare_seq = spkt->seq_end;
 +            packet_destroy(spkt, NULL);
 +            goto sec;
 +        }
 +        if (mark == (COLO_COMPARE_FREE_PRIMARY | COLO_COMPARE_FREE_SECONDARY)) {
 +            conn->compare_seq = ppkt->seq_end;
 +            colo_release_primary_pkt(s, ppkt);
 +            packet_destroy(spkt, NULL);
 +            goto pri;
 +        }
 +    } else {
 +        g_queue_push_head(&conn->primary_list, ppkt);
 +        g_queue_push_head(&conn->secondary_list, spkt);
          qemu_hexdump((char *)ppkt->data, stderr,
                       "colo-compare ppkt", ppkt->size);
-         qemu_hexdump((char *)spkt->data, stderr,
-                      "colo-compare spkt", spkt->size);
--    }
--    return res;
-+        /*
-+         * colo_compare_inconsistent_notify();
-+         * TODO: notice to checkpoint();
-+         */
-+    }
- }
-+
- /*
-  * Called from the compare thread on the primary
-  * for compare udp packet
-@@ -XXX,XX +XXX,XX @@ static void colo_old_packet_check(void *opaque)
-                         (GCompareFunc)colo_old_packet_check_one_conn);
- }
--/*
-- * Called from the compare thread on the primary
-- * for compare packet with secondary list of the
-- * specified connection when a new packet was
-- * queued to it.
-- */
--static void colo_compare_connection(void *opaque, void *user_data)
-+static void colo_compare_packet(CompareState *s, Connection *conn,
-+                                int (*HandlePacket)(Packet *spkt,
-+                                Packet *ppkt))
- {
--    CompareState *s = user_data;
--    Connection *conn = opaque;
-     Packet *pkt = NULL;
-     GList *result = NULL;
--    int ret;
-     while (!g_queue_is_empty(&conn->primary_list) &&
-            !g_queue_is_empty(&conn->secondary_list)) {
-         pkt = g_queue_pop_head(&conn->primary_list);
--        switch (conn->ip_proto) {
--        case IPPROTO_TCP:
--            result = g_queue_find_custom(&conn->secondary_list,
--                     pkt, (GCompareFunc)colo_packet_compare_tcp);
--            break;
--        case IPPROTO_UDP:
--            result = g_queue_find_custom(&conn->secondary_list,
--                     pkt, (GCompareFunc)colo_packet_compare_udp);
--            break;
--        case IPPROTO_ICMP:
--            result = g_queue_find_custom(&conn->secondary_list,
--                     pkt, (GCompareFunc)colo_packet_compare_icmp);
--            break;
--        default:
--            result = g_queue_find_custom(&conn->secondary_list,
--                     pkt, (GCompareFunc)colo_packet_compare_other);
--            break;
--        }
-+        result = g_queue_find_custom(&conn->secondary_list,
-+                 pkt, (GCompareFunc)HandlePacket);
-         if (result) {
--            ret = compare_chr_send(s,
--                                   pkt->data,
--                                   pkt->size,
--                                   pkt->vnet_hdr_len);
--            if (ret < 0) {
--                error_report("colo_send_primary_packet failed");
--            }
--            trace_colo_compare_main("packet same and release packet");
-+            colo_release_primary_pkt(s, pkt);
-             g_queue_remove(&conn->secondary_list, result->data);
--            packet_destroy(pkt, NULL);
-         } else {
-             /*
-              * If one packet arrive late, the secondary_list or
-@@ -XXX,XX +XXX,XX @@ static void colo_compare_connection(void *opaque, void *user_data)
-     }
- }
-+/*
-+ * Called from the compare thread on the primary
-+ * for compare packet with secondary list of the
-+ * specified connection when a new packet was
-+ * queued to it.
-+ */
-+static void colo_compare_connection(void *opaque, void *user_data)
-+{
-+    CompareState *s = user_data;
-+    Connection *conn = opaque;
-+
-+    switch (conn->ip_proto) {
-+    case IPPROTO_TCP:
-+        colo_compare_tcp(s, conn);
-+        break;
-+    case IPPROTO_UDP:
-+        colo_compare_packet(s, conn, colo_packet_compare_udp);
-+        break;
-+    case IPPROTO_ICMP:
-+        colo_compare_packet(s, conn, colo_packet_compare_icmp);
-+        break;
-+    default:
-+        colo_compare_packet(s, conn, colo_packet_compare_other);
-+        break;
-+    }
-+}
-+
- static int compare_chr_send(CompareState *s,
-                             const uint8_t *buf,
-                             uint32_t size,
-diff --git a/net/colo.c b/net/colo.c
-index XXXXXXX..XXXXXXX 100644
---- a/net/colo.c
-+++ b/net/colo.c
-@@ -XXX,XX +XXX,XX @@ Connection *connection_new(ConnectionKey *key)
-     conn->processing = false;
-     conn->offset = 0;
-     conn->syn_flag = 0;
-+    conn->pack = 0;
-+    conn->sack = 0;
-     g_queue_init(&conn->primary_list);
-     g_queue_init(&conn->secondary_list);
-@@ -XXX,XX +XXX,XX @@ Packet *packet_new(const void *data, int size, int vnet_hdr_len)
-     pkt->size = size;
-     pkt->creation_ms = qemu_clock_get_ms(QEMU_CLOCK_HOST);
-     pkt->vnet_hdr_len = vnet_hdr_len;
-+    pkt->tcp_seq = 0;
-+    pkt->tcp_ack = 0;
-+    pkt->seq_end = 0;
-+    pkt->header_size = 0;
-+    pkt->payload_size = 0;
-+    pkt->offset = 0;
-+    pkt->flags = 0;
-     return pkt;
- }
-diff --git a/net/colo.h b/net/colo.h
-index XXXXXXX..XXXXXXX 100644
---- a/net/colo.h
-+++ b/net/colo.h
-@@ -XXX,XX +XXX,XX @@ typedef struct Packet {
-     int64_t creation_ms;
-     /* Get vnet_hdr_len from filter */
-     uint32_t vnet_hdr_len;
-+    uint32_t tcp_seq; /* sequence number */
-+    uint32_t tcp_ack; /* acknowledgement number */
-+    /* the sequence number of the last byte of the packet */
-+    uint32_t seq_end;
-+    uint8_t header_size;  /* the header length */
-+    uint16_t payload_size; /* the payload length */
-+    /* record the payload offset(the length that has been compared) */
-+    uint16_t offset;
-+    uint8_t flags; /* Flags(aka Control bits) */
- } Packet;
- typedef struct ConnectionKey {
-@@ -XXX,XX +XXX,XX @@ typedef struct Connection {
-     /* flag to enqueue unprocessed_connections */
-     bool processing;
-     uint8_t ip_proto;
-+    /* record the sequence number that has been compared */
-+    uint32_t compare_seq;
-+    /* the maximum of acknowledgement number in primary_list queue */
-+    uint32_t pack;
-+    /* the maximum of acknowledgement number in secondary_list queue */
-+    uint32_t sack;
-     /* offset = secondary_seq - primary_seq */
-     tcp_seq  offset;
-     /*
 diff --git a/net/trace-events b/net/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/net/trace-events
 +++ b/net/trace-events
 @@ -XXX,XX +XXX,XX @@ colo_compare_icmp_miscompare(const char *sta, int size) ": %s = %d"
  colo_compare_ip_info(int psize, const char *sta, const char *stb, int ssize, const char *stc, const char *std) "ppkt size = %d, ip_src = %s, ip_dst = %s, spkt size = %d, ip_src = %s, ip_dst = %s"
  colo_old_packet_check_found(int64_t old_time) "%" PRId64
  colo_compare_miscompare(void) ""
--colo_compare_tcp_info(const char *pkt, uint32_t seq, uint32_t ack, int res, uint32_t flag, int size) "side: %s seq/ack= %u/%u res= %d flags= 0x%x pkt_size: %d\n"
+-colo_compare_pkt_info_src(const char *src, uint32_t sseq, uint32_t sack, int res, uint32_t sflag, int ssize) "src/dst: %s s: seq/ack=%u/%u res=%d flags=%x spkt_size: %d\n"
-+colo_compare_tcp_info(const char *pkt, uint32_t seq, uint32_t ack, int hdlen, int pdlen, int offset, int flags) "%s: seq/ack= %u/%u hdlen= %d pdlen= %d offset= %d flags=%d\n"
+-colo_compare_pkt_info_dst(const char *dst, uint32_t dseq, uint32_t dack, int res, uint32_t dflag, int dsize) "src/dst: %s d: seq/ack=%u/%u res=%d flags=%x dpkt_size: %d\n"
 +colo_compare_tcp_info(const char *src, const char *dst, uint32_t pseq, uint32_t sseq, uint32_t pack, uint32_t sack, int res, uint32_t pflag, uint32_t sflag, int psize, int ssize) "src/dst: %s/%s pseq/sseq:%u/%u pack/sack:%u/%u res=%d pflags/sflag:%x/%x psize/ssize:%d/%d \n"
  # net/filter-rewriter.c
  colo_filter_rewriter_debug(void) ""
 --
 .7.4

The following changes since commit e607bbee553cfe73072870cef458cfa4e78133e2:

Merge remote-tracking branch 'remotes/edgar/tags/edgar/xilinx-next-2018-01-26.for-upstream' into staging (2018-01-26 14:24:25 +0000)

are available in the git repository at:

https://github.com/jasowang/qemu.git tags/net-pull-request

for you to fetch changes up to bf4835a4d5338bb7424827715df22570a8adc67c:

MAINTAINERS: update Dmitry Fleytman email (2018-01-29 16:05:38 +0800)

----------------------------------------------------------------

----------------------------------------------------------------
Mao Zhongyi (2):
      colo: modified the payload compare function
      colo: compare the packet based on the tcp sequence number

Philippe Mathieu-Daudé (1):
      MAINTAINERS: update Dmitry Fleytman email

Thomas Huth (3):
      net: Allow hubports to connect to other netdevs
      net: Allow netdevs to be used with 'hostfwd_add' and 'hostfwd_remove'
      qemu-doc: Get rid of "vlan=X" example in the documentation

From: Mao Zhongyi <maozy.fnst@cn.fujitsu.com>

Modified the function colo_packet_compare_common to prepare for the
tcp packet comparison in the next patch.

Cc: Zhang Chen <zhangckid@gmail.com>
Cc: Li Zhijian <lizhijian@cn.fujitsu.com>
Cc: Jason Wang <jasowang@redhat.com>

Signed-off-by: Mao Zhongyi <maozy.fnst@cn.fujitsu.com>
Signed-off-by: Li Zhijian <lizhijian@cn.fujitsu.com>
Signed-off-by: Zhang Chen <zhangckid@gmail.com>
Reviewed-by: Zhang Chen <zhangckid@gmail.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/colo-compare.c | 88 +++++++++++++++++++++++++++---------------------------
 1 file changed, 44 insertions(+), 44 deletions(-)

diff --git a/net/colo-compare.c b/net/colo-compare.c
index XXXXXXX..XXXXXXX 100644
--- a/net/colo-compare.c
+++ b/net/colo-compare.c
@@ -XXX,XX +XXX,XX @@ static int packet_enqueue(CompareState *s, int mode, Connection **con)
  * return:    0  means packet same
  *            > 0 || < 0 means packet different
  */
-static int colo_packet_compare_common(Packet *ppkt,
-                                      Packet *spkt,
-                                      int poffset,
-                                      int soffset)
+static int colo_compare_packet_payload(Packet *ppkt,
+                                       Packet *spkt,
+                                       uint16_t poffset,
+                                       uint16_t soffset,
+                                       uint16_t len)
+
 {
     if (trace_event_get_state_backends(TRACE_COLO_COMPARE_MISCOMPARE)) {
         char pri_ip_src[20], pri_ip_dst[20], sec_ip_src[20], sec_ip_dst[20];
@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_common(Packet *ppkt,
                                    sec_ip_src, sec_ip_dst);
     }
 
-    poffset = ppkt->vnet_hdr_len + poffset;
-    soffset = ppkt->vnet_hdr_len + soffset;
-
-    if (ppkt->size - poffset == spkt->size - soffset) {
-        return memcmp(ppkt->data + poffset,
-                      spkt->data + soffset,
-                      spkt->size - soffset);
-    } else {
-        trace_colo_compare_main("Net packet size are not the same");
-        return -1;
-    }
+    return memcmp(ppkt->data + poffset, spkt->data + soffset, len);
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_tcp(Packet *spkt, Packet *ppkt)
      * the secondary guest's timestamp. COLO just focus on payload,
      * so we just need skip this field.
      */
-    if (ptcp->th_off > 5) {
-        ptrdiff_t ptcp_offset, stcp_offset;
 
-        ptcp_offset = ppkt->transport_header - (uint8_t *)ppkt->data
-                      + (ptcp->th_off * 4) - ppkt->vnet_hdr_len;
-        stcp_offset = spkt->transport_header - (uint8_t *)spkt->data
-                      + (stcp->th_off * 4) - spkt->vnet_hdr_len;
+    ptrdiff_t ptcp_offset, stcp_offset;
 
-        /*
-         * When network is busy, some tcp options(like sack) will unpredictable
-         * occur in primary side or secondary side. it will make packet size
-         * not same, but the two packet's payload is identical. colo just
-         * care about packet payload, so we skip the option field.
-         */
-        res = colo_packet_compare_common(ppkt, spkt, ptcp_offset, stcp_offset);
-    } else if (ptcp->th_sum == stcp->th_sum) {
-        res = colo_packet_compare_common(ppkt, spkt, ETH_HLEN, ETH_HLEN);
+    ptcp_offset = ppkt->transport_header - (uint8_t *)ppkt->data
+                  + (ptcp->th_off << 2) - ppkt->vnet_hdr_len;
+    stcp_offset = spkt->transport_header - (uint8_t *)spkt->data
+                  + (stcp->th_off << 2) - spkt->vnet_hdr_len;
+    if (ppkt->size - ptcp_offset == spkt->size - stcp_offset) {
+        res = colo_compare_packet_payload(ppkt, spkt,
+                                          ptcp_offset, stcp_offset,
+                                          ppkt->size - ptcp_offset);
     } else {
+        trace_colo_compare_main("TCP: payload size of packets are different");
         res = -1;
     }
 
@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_tcp(Packet *spkt, Packet *ppkt)
  */
 static int colo_packet_compare_udp(Packet *spkt, Packet *ppkt)
 {
-    int ret;
-    int network_header_length = ppkt->ip->ip_hl * 4;
+    uint16_t network_header_length = ppkt->ip->ip_hl << 2;
+    uint16_t offset = network_header_length + ETH_HLEN + ppkt->vnet_hdr_len;
 
     trace_colo_compare_main("compare udp");
 
@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_udp(Packet *spkt, Packet *ppkt)
      * other field like TOS,TTL,IP Checksum. we only need to compare
      * the ip payload here.
      */
-    ret = colo_packet_compare_common(ppkt, spkt,
-                                     network_header_length + ETH_HLEN,
-                                     network_header_length + ETH_HLEN);
-
-    if (ret) {
+    if (ppkt->size != spkt->size) {
+        trace_colo_compare_main("UDP: payload size of packets are different");
+        return -1;
+    }
+    if (colo_compare_packet_payload(ppkt, spkt, offset, offset,
+                                    ppkt->size - offset)) {
         trace_colo_compare_udp_miscompare("primary pkt size", ppkt->size);
         trace_colo_compare_udp_miscompare("Secondary pkt size", spkt->size);
         if (trace_event_get_state_backends(TRACE_COLO_COMPARE_MISCOMPARE)) {
@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_udp(Packet *spkt, Packet *ppkt)
             qemu_hexdump((char *)spkt->data, stderr, "colo-compare sec pkt",
                          spkt->size);
         }
+        return -1;
+    } else {
+        return 0;
     }
-
-    return ret;
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_udp(Packet *spkt, Packet *ppkt)
  */
 static int colo_packet_compare_icmp(Packet *spkt, Packet *ppkt)
 {
-    int network_header_length = ppkt->ip->ip_hl * 4;
+    uint16_t network_header_length = ppkt->ip->ip_hl << 2;
+    uint16_t offset = network_header_length + ETH_HLEN + ppkt->vnet_hdr_len;
 
     trace_colo_compare_main("compare icmp");
 
@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_icmp(Packet *spkt, Packet *ppkt)
      * other field like TOS,TTL,IP Checksum. we only need to compare
      * the ip payload here.
      */
-    if (colo_packet_compare_common(ppkt, spkt,
-                                   network_header_length + ETH_HLEN,
-                                   network_header_length + ETH_HLEN)) {
+    if (ppkt->size != spkt->size) {
+        trace_colo_compare_main("ICMP: payload size of packets are different");
+        return -1;
+    }
+    if (colo_compare_packet_payload(ppkt, spkt, offset, offset,
+                                    ppkt->size - offset)) {
         trace_colo_compare_icmp_miscompare("primary pkt size",
                                            ppkt->size);
         trace_colo_compare_icmp_miscompare("Secondary pkt size",
@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_icmp(Packet *spkt, Packet *ppkt)
  */
 static int colo_packet_compare_other(Packet *spkt, Packet *ppkt)
 {
+    uint16_t offset = ppkt->vnet_hdr_len;
+
     trace_colo_compare_main("compare other");
     if (trace_event_get_state_backends(TRACE_COLO_COMPARE_MISCOMPARE)) {
         char pri_ip_src[20], pri_ip_dst[20], sec_ip_src[20], sec_ip_dst[20];
@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_other(Packet *spkt, Packet *ppkt)
                                    sec_ip_src, sec_ip_dst);
     }
 
-    return colo_packet_compare_common(ppkt, spkt, 0, 0);
+    if (ppkt->size != spkt->size) {
+        trace_colo_compare_main("Other: payload size of packets are different");
+        return -1;
+    }
+    return colo_compare_packet_payload(ppkt, spkt, offset, offset,
+                                       ppkt->size - offset);
 }
 
 static int colo_old_packet_check_one(Packet *pkt, int64_t *check_time)
-- 
2.7.4

From: Mao Zhongyi <maozy.fnst@cn.fujitsu.com>

Packet size some time different or when network is busy.
Based on same payload size, but TCP protocol can not
guarantee send the same one packet in the same way,

like that:
We send this payload:
------------------------------
| header |1|2|3|4|5|6|7|8|9|0|
------------------------------

primary:
ppkt1:
----------------
| header |1|2|3|
----------------
ppkt2:
------------------------
| header |4|5|6|7|8|9|0|
------------------------

secondary:
spkt1:
------------------------------
| header |1|2|3|4|5|6|7|8|9|0|
------------------------------

In the original method, ppkt1 and ppkt2 are different in size and
spkt1, so they can't compare and trigger the checkpoint.

I have tested FTP get 200M and 1G file many times, I found that
the performance was less than 1% of the native.

Now I reconstructed the comparison of TCP packets based on the
TCP sequence number. first of all, ppkt1 and spkt1 have the same
starting sequence number, so they can compare, even though their
length is different. And then ppkt1 with a smaller payload length
is used as the comparison length, if the payload is same, send
out the ppkt1 and record the offset(the length of ppkt1 payload)
in spkt1. The next comparison, ppkt2 and spkt1 can be compared
from the recorded position of spkt1.

like that:
----------------
| header |1|2|3| ppkt1
---------|-----|
         |     |
---------v-----v--------------
| header |1|2|3|4|5|6|7|8|9|0| spkt1
---------------|\------------|
               | \offset     |
      ---------v-------------v
      | header |4|5|6|7|8|9|0| ppkt2
      ------------------------

In this way, the performance can reach native 20% in my multiple
tests.

Cc: Zhang Chen <zhangckid@gmail.com>
Cc: Li Zhijian <lizhijian@cn.fujitsu.com>
Cc: Jason Wang <jasowang@redhat.com>

Signed-off-by: Mao Zhongyi <maozy.fnst@cn.fujitsu.com>
Signed-off-by: Li Zhijian <lizhijian@cn.fujitsu.com>
Signed-off-by: Zhang Chen <zhangckid@gmail.com>
Reviewed-by: Zhang Chen <zhangckid@gmail.com>
Tested-by: Zhang Chen <zhangckid@gmail.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/colo-compare.c | 343 +++++++++++++++++++++++++++++++++++------------------
 net/colo.c         |   9 ++
 net/colo.h         |  15 +++
 net/trace-events   |   2 +-
 4 files changed, 250 insertions(+), 119 deletions(-)

diff --git a/net/colo-compare.c b/net/colo-compare.c
index XXXXXXX..XXXXXXX 100644
--- a/net/colo-compare.c
+++ b/net/colo-compare.c
@@ -XXX,XX +XXX,XX @@
 #define COMPARE_READ_LEN_MAX NET_BUFSIZE
 #define MAX_QUEUE_SIZE 1024
 
+#define COLO_COMPARE_FREE_PRIMARY     0x01
+#define COLO_COMPARE_FREE_SECONDARY   0x02
+
 /* TODO: Should be configurable */
 #define REGULAR_PACKET_CHECK_MS 3000
 
@@ -XXX,XX +XXX,XX @@ static gint seq_sorter(Packet *a, Packet *b, gpointer data)
     return ntohl(atcp->th_seq) - ntohl(btcp->th_seq);
 }
 
+static void fill_pkt_tcp_info(void *data, uint32_t *max_ack)
+{
+    Packet *pkt = data;
+    struct tcphdr *tcphd;
+
+    tcphd = (struct tcphdr *)pkt->transport_header;
+
+    pkt->tcp_seq = ntohl(tcphd->th_seq);
+    pkt->tcp_ack = ntohl(tcphd->th_ack);
+    *max_ack = *max_ack > pkt->tcp_ack ? *max_ack : pkt->tcp_ack;
+    pkt->header_size = pkt->transport_header - (uint8_t *)pkt->data
+                       + (tcphd->th_off << 2) - pkt->vnet_hdr_len;
+    pkt->payload_size = pkt->size - pkt->header_size;
+    pkt->seq_end = pkt->tcp_seq + pkt->payload_size;
+    pkt->flags = tcphd->th_flags;
+}
+
 /*
  * Return 1 on success, if return 0 means the
  * packet will be dropped
  */
-static int colo_insert_packet(GQueue *queue, Packet *pkt)
+static int colo_insert_packet(GQueue *queue, Packet *pkt, uint32_t *max_ack)
 {
     if (g_queue_get_length(queue) <= MAX_QUEUE_SIZE) {
         if (pkt->ip->ip_p == IPPROTO_TCP) {
+            fill_pkt_tcp_info(pkt, max_ack);
             g_queue_insert_sorted(queue,
                                   pkt,
                                   (GCompareDataFunc)seq_sorter,
@@ -XXX,XX +XXX,XX @@ static int packet_enqueue(CompareState *s, int mode, Connection **con)
     }
 
     if (mode == PRIMARY_IN) {
-        if (!colo_insert_packet(&conn->primary_list, pkt)) {
+        if (!colo_insert_packet(&conn->primary_list, pkt, &conn->pack)) {
             error_report("colo compare primary queue size too big,"
                          "drop packet");
         }
     } else {
-        if (!colo_insert_packet(&conn->secondary_list, pkt)) {
+        if (!colo_insert_packet(&conn->secondary_list, pkt, &conn->sack)) {
             error_report("colo compare secondary queue size too big,"
                          "drop packet");
         }
@@ -XXX,XX +XXX,XX @@ static int packet_enqueue(CompareState *s, int mode, Connection **con)
     return 0;
 }
 
+static inline bool after(uint32_t seq1, uint32_t seq2)
+{
+        return (int32_t)(seq1 - seq2) > 0;
+}
+
+static void colo_release_primary_pkt(CompareState *s, Packet *pkt)
+{
+    int ret;
+    ret = compare_chr_send(s,
+                           pkt->data,
+                           pkt->size,
+                           pkt->vnet_hdr_len);
+    if (ret < 0) {
+        error_report("colo send primary packet failed");
+    }
+    trace_colo_compare_main("packet same and release packet");
+    packet_destroy(pkt, NULL);
+}
+
 /*
  * The IP packets sent by primary and secondary
  * will be compared in here
@@ -XXX,XX +XXX,XX @@ static int colo_compare_packet_payload(Packet *ppkt,
 }
 
 /*
- * Called from the compare thread on the primary
- * for compare tcp packet
- * compare_tcp copied from Dr. David Alan Gilbert's branch
- */
-static int colo_packet_compare_tcp(Packet *spkt, Packet *ppkt)
+ * return true means that the payload is consist and
+ * need to make the next comparison, false means do
+ * the checkpoint
+*/
+static bool colo_mark_tcp_pkt(Packet *ppkt, Packet *spkt,
+                              int8_t *mark, uint32_t max_ack)
 {
-    struct tcphdr *ptcp, *stcp;
-    int res;
+    *mark = 0;
+
+    if (ppkt->tcp_seq == spkt->tcp_seq && ppkt->seq_end == spkt->seq_end) {
+        if (colo_compare_packet_payload(ppkt, spkt,
+                                        ppkt->header_size, spkt->header_size,
+                                        ppkt->payload_size)) {
+            *mark = COLO_COMPARE_FREE_SECONDARY | COLO_COMPARE_FREE_PRIMARY;
+            return true;
+        }
+    }
+    if (ppkt->tcp_seq == spkt->tcp_seq && ppkt->seq_end == spkt->seq_end) {
+        if (colo_compare_packet_payload(ppkt, spkt,
+                                        ppkt->header_size, spkt->header_size,
+                                        ppkt->payload_size)) {
+            *mark = COLO_COMPARE_FREE_SECONDARY | COLO_COMPARE_FREE_PRIMARY;
+            return true;
+        }
+    }
+
+    /* one part of secondary packet payload still need to be compared */
+    if (!after(ppkt->seq_end, spkt->seq_end)) {
+        if (colo_compare_packet_payload(ppkt, spkt,
+                                        ppkt->header_size + ppkt->offset,
+                                        spkt->header_size + spkt->offset,
+                                        ppkt->payload_size - ppkt->offset)) {
+            if (!after(ppkt->tcp_ack, max_ack)) {
+                *mark = COLO_COMPARE_FREE_PRIMARY;
+                spkt->offset += ppkt->payload_size - ppkt->offset;
+                return true;
+            } else {
+                /* secondary guest hasn't ack the data, don't send
+                 * out this packet
+                 */
+                return false;
+            }
+        }
+    } else {
+        /* primary packet is longer than secondary packet, compare
+         * the same part and mark the primary packet offset
+         */
+        if (colo_compare_packet_payload(ppkt, spkt,
+                                        ppkt->header_size + ppkt->offset,
+                                        spkt->header_size + spkt->offset,
+                                        spkt->payload_size - spkt->offset)) {
+            *mark = COLO_COMPARE_FREE_SECONDARY;
+            ppkt->offset += spkt->payload_size - spkt->offset;
+            return true;
+        }
+    }
 
-    trace_colo_compare_main("compare tcp");
+    return false;
+}
 
-    ptcp = (struct tcphdr *)ppkt->transport_header;
-    stcp = (struct tcphdr *)spkt->transport_header;
+static void colo_compare_tcp(CompareState *s, Connection *conn)
+{
+    Packet *ppkt = NULL, *spkt = NULL;
+    int8_t mark;
 
     /*
-     * The 'identification' field in the IP header is *very* random
-     * it almost never matches.  Fudge this by ignoring differences in
-     * unfragmented packets; they'll normally sort themselves out if different
-     * anyway, and it should recover at the TCP level.
-     * An alternative would be to get both the primary and secondary to rewrite
-     * somehow; but that would need some sync traffic to sync the state
-     */
-    if (ntohs(ppkt->ip->ip_off) & IP_DF) {
-        spkt->ip->ip_id = ppkt->ip->ip_id;
-        /* and the sum will be different if the IDs were different */
-        spkt->ip->ip_sum = ppkt->ip->ip_sum;
+     * If ppkt and spkt have the same payload, but ppkt's ACK
+     * is greater than spkt's ACK, in this case we can not
+     * send the ppkt because it will cause the secondary guest
+     * to miss sending some data in the next. Therefore, we
+     * record the maximum ACK in the current queue at both
+     * primary side and secondary side. Only when the ack is
+     * less than the smaller of the two maximum ack, then we
+     * can ensure that the packet's payload is acknowledged by
+     * primary and secondary.
+    */
+    uint32_t min_ack = conn->pack > conn->sack ? conn->sack : conn->pack;
+
+pri:
+    if (g_queue_is_empty(&conn->primary_list)) {
+        return;
     }
+    ppkt = g_queue_pop_head(&conn->primary_list);
+sec:
+    if (g_queue_is_empty(&conn->secondary_list)) {
+        g_queue_push_head(&conn->primary_list, ppkt);
+        return;
+    }
+    spkt = g_queue_pop_head(&conn->secondary_list);
 
-    /*
-     * Check tcp header length for tcp option field.
-     * th_off > 5 means this tcp packet have options field.
-     * The tcp options maybe always different.
-     * for example:
-     * From RFC 7323.
-     * TCP Timestamps option (TSopt):
-     * Kind: 8
-     *
-     * Length: 10 bytes
-     *
-     *    +-------+-------+---------------------+---------------------+
-     *    |Kind=8 |  10   |   TS Value (TSval)  |TS Echo Reply (TSecr)|
-     *    +-------+-------+---------------------+---------------------+
-     *       1       1              4                     4
-     *
-     * In this case the primary guest's timestamp always different with
-     * the secondary guest's timestamp. COLO just focus on payload,
-     * so we just need skip this field.
-     */
+    if (ppkt->tcp_seq == ppkt->seq_end) {
+        colo_release_primary_pkt(s, ppkt);
+        ppkt = NULL;
+    }
 
-    ptrdiff_t ptcp_offset, stcp_offset;
+    if (ppkt && conn->compare_seq && !after(ppkt->seq_end, conn->compare_seq)) {
+        trace_colo_compare_main("pri: this packet has compared");
+        colo_release_primary_pkt(s, ppkt);
+        ppkt = NULL;
+    }
 
-    ptcp_offset = ppkt->transport_header - (uint8_t *)ppkt->data
-                  + (ptcp->th_off << 2) - ppkt->vnet_hdr_len;
-    stcp_offset = spkt->transport_header - (uint8_t *)spkt->data
-                  + (stcp->th_off << 2) - spkt->vnet_hdr_len;
-    if (ppkt->size - ptcp_offset == spkt->size - stcp_offset) {
-        res = colo_compare_packet_payload(ppkt, spkt,
-                                          ptcp_offset, stcp_offset,
-                                          ppkt->size - ptcp_offset);
+    if (spkt->tcp_seq == spkt->seq_end) {
+        packet_destroy(spkt, NULL);
+        if (!ppkt) {
+            goto pri;
+        } else {
+            goto sec;
+        }
     } else {
-        trace_colo_compare_main("TCP: payload size of packets are different");
-        res = -1;
+        if (conn->compare_seq && !after(spkt->seq_end, conn->compare_seq)) {
+            trace_colo_compare_main("sec: this packet has compared");
+            packet_destroy(spkt, NULL);
+            if (!ppkt) {
+                goto pri;
+            } else {
+                goto sec;
+            }
+        }
+        if (!ppkt) {
+            g_queue_push_head(&conn->secondary_list, spkt);
+            goto pri;
+        }
     }
 
-    if (res != 0 &&
-        trace_event_get_state_backends(TRACE_COLO_COMPARE_MISCOMPARE)) {
-        char pri_ip_src[20], pri_ip_dst[20], sec_ip_src[20], sec_ip_dst[20];
-
-        strcpy(pri_ip_src, inet_ntoa(ppkt->ip->ip_src));
-        strcpy(pri_ip_dst, inet_ntoa(ppkt->ip->ip_dst));
-        strcpy(sec_ip_src, inet_ntoa(spkt->ip->ip_src));
-        strcpy(sec_ip_dst, inet_ntoa(spkt->ip->ip_dst));
-
-        trace_colo_compare_ip_info(ppkt->size, pri_ip_src,
-                                   pri_ip_dst, spkt->size,
-                                   sec_ip_src, sec_ip_dst);
-
-        trace_colo_compare_tcp_info("pri tcp packet",
-                                    ntohl(ptcp->th_seq),
-                                    ntohl(ptcp->th_ack),
-                                    res, ptcp->th_flags,
-                                    ppkt->size);
-
-        trace_colo_compare_tcp_info("sec tcp packet",
-                                    ntohl(stcp->th_seq),
-                                    ntohl(stcp->th_ack),
-                                    res, stcp->th_flags,
-                                    spkt->size);
+    if (colo_mark_tcp_pkt(ppkt, spkt, &mark, min_ack)) {
+        trace_colo_compare_tcp_info("pri",
+                                    ppkt->tcp_seq, ppkt->tcp_ack,
+                                    ppkt->header_size, ppkt->payload_size,
+                                    ppkt->offset, ppkt->flags);
+
+        trace_colo_compare_tcp_info("sec",
+                                    spkt->tcp_seq, spkt->tcp_ack,
+                                    spkt->header_size, spkt->payload_size,
+                                    spkt->offset, spkt->flags);
+
+        if (mark == COLO_COMPARE_FREE_PRIMARY) {
+            conn->compare_seq = ppkt->seq_end;
+            colo_release_primary_pkt(s, ppkt);
+            g_queue_push_head(&conn->secondary_list, spkt);
+            goto pri;
+        }
+        if (mark == COLO_COMPARE_FREE_SECONDARY) {
+            conn->compare_seq = spkt->seq_end;
+            packet_destroy(spkt, NULL);
+            goto sec;
+        }
+        if (mark == (COLO_COMPARE_FREE_PRIMARY | COLO_COMPARE_FREE_SECONDARY)) {
+            conn->compare_seq = ppkt->seq_end;
+            colo_release_primary_pkt(s, ppkt);
+            packet_destroy(spkt, NULL);
+            goto pri;
+        }
+    } else {
+        g_queue_push_head(&conn->primary_list, ppkt);
+        g_queue_push_head(&conn->secondary_list, spkt);
 
         qemu_hexdump((char *)ppkt->data, stderr,
                      "colo-compare ppkt", ppkt->size);
         qemu_hexdump((char *)spkt->data, stderr,
                      "colo-compare spkt", spkt->size);
-    }
 
-    return res;
+        /*
+         * colo_compare_inconsistent_notify();
+         * TODO: notice to checkpoint();
+         */
+    }
 }
 
+
 /*
  * Called from the compare thread on the primary
  * for compare udp packet
@@ -XXX,XX +XXX,XX @@ static void colo_old_packet_check(void *opaque)
                         (GCompareFunc)colo_old_packet_check_one_conn);
 }
 
-/*
- * Called from the compare thread on the primary
- * for compare packet with secondary list of the
- * specified connection when a new packet was
- * queued to it.
- */
-static void colo_compare_connection(void *opaque, void *user_data)
+static void colo_compare_packet(CompareState *s, Connection *conn,
+                                int (*HandlePacket)(Packet *spkt,
+                                Packet *ppkt))
 {
-    CompareState *s = user_data;
-    Connection *conn = opaque;
     Packet *pkt = NULL;
     GList *result = NULL;
-    int ret;
 
     while (!g_queue_is_empty(&conn->primary_list) &&
            !g_queue_is_empty(&conn->secondary_list)) {
         pkt = g_queue_pop_head(&conn->primary_list);
-        switch (conn->ip_proto) {
-        case IPPROTO_TCP:
-            result = g_queue_find_custom(&conn->secondary_list,
-                     pkt, (GCompareFunc)colo_packet_compare_tcp);
-            break;
-        case IPPROTO_UDP:
-            result = g_queue_find_custom(&conn->secondary_list,
-                     pkt, (GCompareFunc)colo_packet_compare_udp);
-            break;
-        case IPPROTO_ICMP:
-            result = g_queue_find_custom(&conn->secondary_list,
-                     pkt, (GCompareFunc)colo_packet_compare_icmp);
-            break;
-        default:
-            result = g_queue_find_custom(&conn->secondary_list,
-                     pkt, (GCompareFunc)colo_packet_compare_other);
-            break;
-        }
+        result = g_queue_find_custom(&conn->secondary_list,
+                 pkt, (GCompareFunc)HandlePacket);
 
         if (result) {
-            ret = compare_chr_send(s,
-                                   pkt->data,
-                                   pkt->size,
-                                   pkt->vnet_hdr_len);
-            if (ret < 0) {
-                error_report("colo_send_primary_packet failed");
-            }
-            trace_colo_compare_main("packet same and release packet");
+            colo_release_primary_pkt(s, pkt);
             g_queue_remove(&conn->secondary_list, result->data);
-            packet_destroy(pkt, NULL);
         } else {
             /*
              * If one packet arrive late, the secondary_list or
@@ -XXX,XX +XXX,XX @@ static void colo_compare_connection(void *opaque, void *user_data)
     }
 }
 
+/*
+ * Called from the compare thread on the primary
+ * for compare packet with secondary list of the
+ * specified connection when a new packet was
+ * queued to it.
+ */
+static void colo_compare_connection(void *opaque, void *user_data)
+{
+    CompareState *s = user_data;
+    Connection *conn = opaque;
+
+    switch (conn->ip_proto) {
+    case IPPROTO_TCP:
+        colo_compare_tcp(s, conn);
+        break;
+    case IPPROTO_UDP:
+        colo_compare_packet(s, conn, colo_packet_compare_udp);
+        break;
+    case IPPROTO_ICMP:
+        colo_compare_packet(s, conn, colo_packet_compare_icmp);
+        break;
+    default:
+        colo_compare_packet(s, conn, colo_packet_compare_other);
+        break;
+    }
+}
+
 static int compare_chr_send(CompareState *s,
                             const uint8_t *buf,
                             uint32_t size,
diff --git a/net/colo.c b/net/colo.c
index XXXXXXX..XXXXXXX 100644
--- a/net/colo.c
+++ b/net/colo.c
@@ -XXX,XX +XXX,XX @@ Connection *connection_new(ConnectionKey *key)
     conn->processing = false;
     conn->offset = 0;
     conn->syn_flag = 0;
+    conn->pack = 0;
+    conn->sack = 0;
     g_queue_init(&conn->primary_list);
     g_queue_init(&conn->secondary_list);
 
@@ -XXX,XX +XXX,XX @@ Packet *packet_new(const void *data, int size, int vnet_hdr_len)
     pkt->size = size;
     pkt->creation_ms = qemu_clock_get_ms(QEMU_CLOCK_HOST);
     pkt->vnet_hdr_len = vnet_hdr_len;
+    pkt->tcp_seq = 0;
+    pkt->tcp_ack = 0;
+    pkt->seq_end = 0;
+    pkt->header_size = 0;
+    pkt->payload_size = 0;
+    pkt->offset = 0;
+    pkt->flags = 0;
 
     return pkt;
 }
diff --git a/net/colo.h b/net/colo.h
index XXXXXXX..XXXXXXX 100644
--- a/net/colo.h
+++ b/net/colo.h
@@ -XXX,XX +XXX,XX @@ typedef struct Packet {
     int64_t creation_ms;
     /* Get vnet_hdr_len from filter */
     uint32_t vnet_hdr_len;
+    uint32_t tcp_seq; /* sequence number */
+    uint32_t tcp_ack; /* acknowledgement number */
+    /* the sequence number of the last byte of the packet */
+    uint32_t seq_end;
+    uint8_t header_size;  /* the header length */
+    uint16_t payload_size; /* the payload length */
+    /* record the payload offset(the length that has been compared) */
+    uint16_t offset;
+    uint8_t flags; /* Flags(aka Control bits) */
 } Packet;
 
 typedef struct ConnectionKey {
@@ -XXX,XX +XXX,XX @@ typedef struct Connection {
     /* flag to enqueue unprocessed_connections */
     bool processing;
     uint8_t ip_proto;
+    /* record the sequence number that has been compared */
+    uint32_t compare_seq;
+    /* the maximum of acknowledgement number in primary_list queue */
+    uint32_t pack;
+    /* the maximum of acknowledgement number in secondary_list queue */
+    uint32_t sack;
     /* offset = secondary_seq - primary_seq */
     tcp_seq  offset;
     /*
diff --git a/net/trace-events b/net/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/net/trace-events
+++ b/net/trace-events
@@ -XXX,XX +XXX,XX @@ colo_compare_icmp_miscompare(const char *sta, int size) ": %s = %d"
 colo_compare_ip_info(int psize, const char *sta, const char *stb, int ssize, const char *stc, const char *std) "ppkt size = %d, ip_src = %s, ip_dst = %s, spkt size = %d, ip_src = %s, ip_dst = %s"
 colo_old_packet_check_found(int64_t old_time) "%" PRId64
 colo_compare_miscompare(void) ""
-colo_compare_tcp_info(const char *pkt, uint32_t seq, uint32_t ack, int res, uint32_t flag, int size) "side: %s seq/ack= %u/%u res= %d flags= 0x%x pkt_size: %d\n"
+colo_compare_tcp_info(const char *pkt, uint32_t seq, uint32_t ack, int hdlen, int pdlen, int offset, int flags) "%s: seq/ack= %u/%u hdlen= %d pdlen= %d offset= %d flags=%d\n"
 
 # net/filter-rewriter.c
 colo_filter_rewriter_debug(void) ""
-- 
2.7.4

From: Thomas Huth <thuth@redhat.com>

QEMU can emulate hubs to connect NICs and netdevs. This is currently
primarily used for the mis-named 'vlan' feature of the networking
subsystem. Now the 'vlan' feature has been marked as deprecated, since
its name is rather confusing and the users often rather mis-configure
their network when trying to use it. But while the 'vlan' parameter
should be removed at one point in time, the basic idea of emulating
a hub in QEMU is still good: It's useful for bundling up the output of
multiple NICs into one single l2tp netdev for example.

Now to be able to use the hubport feature without 'vlan's, there is one
missing piece: The possibility to connect a hubport to a netdev, too.
This patch adds this possibility by introducing a new "netdev=..."
parameter to the hubports.

To bundle up the output of multiple NICs into one socket netdev, you can
now run QEMU with these parameters for example:

qemu-system-ppc64 ... -netdev socket,id=s1,connect=:11122 \
    -netdev hubport,hubid=1,id=h1,netdev=s1 \
    -netdev hubport,hubid=1,id=h2 -device e1000,netdev=h2 \
    -netdev hubport,hubid=1,id=h3 -device virtio-net-pci,netdev=h3

For using the socket netdev, you have got to start another QEMU as the
receiving side first, for example with network dumping enabled:

qemu-system-x86_64 -M isapc -netdev socket,id=s0,listen=:11122 \
    -device ne2k_isa,netdev=s0 \
    -object filter-dump,id=f1,netdev=s0,file=/tmp/dump.dat

After the ppc64 guest tried to boot from both NICs, you can see in the
dump file (using Wireshark, for example), that the output of both NICs
(the e1000 and the virtio-net-pci) has been successfully transfered
via the socket netdev in this case.

Suggested-by: Paolo Bonzini <pbonzini@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/hub.c       | 27 +++++++++++++++++++++------
 net/hub.h       |  3 ++-
 net/net.c       |  2 +-
 qapi/net.json   |  4 +++-
 qemu-options.hx |  8 +++++---
 5 files changed, 32 insertions(+), 12 deletions(-)

diff --git a/net/hub.c b/net/hub.c
index XXXXXXX..XXXXXXX 100644
--- a/net/hub.c
+++ b/net/hub.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
+#include "qapi/error.h"
 #include "monitor/monitor.h"
 #include "net/net.h"
 #include "clients.h"
@@ -XXX,XX +XXX,XX @@ static NetClientInfo net_hub_port_info = {
     .cleanup = net_hub_port_cleanup,
 };
 
-static NetHubPort *net_hub_port_new(NetHub *hub, const char *name)
+static NetHubPort *net_hub_port_new(NetHub *hub, const char *name,
+                                    NetClientState *hubpeer)
 {
     NetClientState *nc;
     NetHubPort *port;
@@ -XXX,XX +XXX,XX @@ static NetHubPort *net_hub_port_new(NetHub *hub, const char *name)
         name = default_name;
     }
 
-    nc = qemu_new_net_client(&net_hub_port_info, NULL, "hub", name);
+    nc = qemu_new_net_client(&net_hub_port_info, hubpeer, "hub", name);
     port = DO_UPCAST(NetHubPort, nc, nc);
     port->id = id;
     port->hub = hub;
@@ -XXX,XX +XXX,XX @@ static NetHubPort *net_hub_port_new(NetHub *hub, const char *name)
 
 /**
  * Create a port on a given hub
+ * @hub_id: Number of the hub
  * @name: Net client name or NULL for default name.
+ * @hubpeer: Peer to use (if "netdev=id" has been specified)
  *
  * If there is no existing hub with the given id then a new hub is created.
  */
-NetClientState *net_hub_add_port(int hub_id, const char *name)
+NetClientState *net_hub_add_port(int hub_id, const char *name,
+                                 NetClientState *hubpeer)
 {
     NetHub *hub;
     NetHubPort *port;
@@ -XXX,XX +XXX,XX @@ NetClientState *net_hub_add_port(int hub_id, const char *name)
         hub = net_hub_new(hub_id);
     }
 
-    port = net_hub_port_new(hub, name);
+    port = net_hub_port_new(hub, name, hubpeer);
     return &port->nc;
 }
 
@@ -XXX,XX +XXX,XX @@ NetClientState *net_hub_port_find(int hub_id)
         }
     }
 
-    nc = net_hub_add_port(hub_id, NULL);
+    nc = net_hub_add_port(hub_id, NULL, NULL);
     return nc;
 }
 
@@ -XXX,XX +XXX,XX @@ int net_init_hubport(const Netdev *netdev, const char *name,
                      NetClientState *peer, Error **errp)
 {
     const NetdevHubPortOptions *hubport;
+    NetClientState *hubpeer = NULL;
 
     assert(netdev->type == NET_CLIENT_DRIVER_HUBPORT);
     assert(!peer);
     hubport = &netdev->u.hubport;
 
-    net_hub_add_port(hubport->hubid, name);
+    if (hubport->has_netdev) {
+        hubpeer = qemu_find_netdev(hubport->netdev);
+        if (!hubpeer) {
+            error_setg(errp, "netdev '%s' not found", hubport->netdev);
+            return -1;
+        }
+    }
+
+    net_hub_add_port(hubport->hubid, name, hubpeer);
+
     return 0;
 }
 
diff --git a/net/hub.h b/net/hub.h
index XXXXXXX..XXXXXXX 100644
--- a/net/hub.h
+++ b/net/hub.h
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu-common.h"
 
-NetClientState *net_hub_add_port(int hub_id, const char *name);
+NetClientState *net_hub_add_port(int hub_id, const char *name,
+                                 NetClientState *hubpeer);
 NetClientState *net_hub_find_client_by_name(int hub_id, const char *name);
 void net_hub_info(Monitor *mon);
 void net_hub_check_clients(void);
diff --git a/net/net.c b/net/net.c
index XXXXXXX..XXXXXXX 100644
--- a/net/net.c
+++ b/net/net.c
@@ -XXX,XX +XXX,XX @@ static int net_client_init1(const void *object, bool is_netdev, Error **errp)
         /* Do not add to a vlan if it's a nic with a netdev= parameter. */
         if (netdev->type != NET_CLIENT_DRIVER_NIC ||
             !opts->u.nic.has_netdev) {
-            peer = net_hub_add_port(net->has_vlan ? net->vlan : 0, NULL);
+            peer = net_hub_add_port(net->has_vlan ? net->vlan : 0, NULL, NULL);
         }
 
         if (net->has_vlan && !vlan_warned) {
diff --git a/qapi/net.json b/qapi/net.json
index XXXXXXX..XXXXXXX 100644
--- a/qapi/net.json
+++ b/qapi/net.json
@@ -XXX,XX +XXX,XX @@
 # Connect two or more net clients through a software hub.
 #
 # @hubid: hub identifier number
+# @netdev: used to connect hub to a netdev instead of a device (since 2.12)
 #
 # Since: 1.2
 ##
 { 'struct': 'NetdevHubPortOptions',
   'data': {
-    'hubid':     'int32' } }
+    'hubid':     'int32',
+    '*netdev':    'str' } }
 
 ##
 # @NetdevNetmapOptions:
diff --git a/qemu-options.hx b/qemu-options.hx
index XXXXXXX..XXXXXXX 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -XXX,XX +XXX,XX @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev,
 #endif
     "-netdev vhost-user,id=str,chardev=dev[,vhostforce=on|off]\n"
     "                configure a vhost-user network, backed by a chardev 'dev'\n"
-    "-netdev hubport,id=str,hubid=n\n"
+    "-netdev hubport,id=str,hubid=n[,netdev=nd]\n"
     "                configure a hub port on QEMU VLAN 'n'\n", QEMU_ARCH_ALL)
 DEF("net", HAS_ARG, QEMU_OPTION_net,
     "-net nic[,vlan=n][,netdev=nd][,macaddr=mac][,model=type][,name=str][,addr=str][,vectors=v]\n"
@@ -XXX,XX +XXX,XX @@ vde_switch -F -sock /tmp/myswitch
 qemu-system-i386 linux.img -net nic -net vde,sock=/tmp/myswitch
 @end example
 
-@item -netdev hubport,id=@var{id},hubid=@var{hubid}
+@item -netdev hubport,id=@var{id},hubid=@var{hubid}[,netdev=@var{nd}]
 
 Create a hub port on QEMU "vlan" @var{hubid}.
 
 The hubport netdev lets you connect a NIC to a QEMU "vlan" instead of a single
 netdev.  @code{-net} and @code{-device} with parameter @option{vlan} create the
-required hub automatically.
+required hub automatically. Alternatively, you can also connect the hubport
+to another netdev with ID @var{nd} by using the @option{netdev=@var{nd}}
+option.
 
 @item -netdev vhost-user,chardev=@var{id}[,vhostforce=on|off][,queues=n]
 
-- 
2.7.4

From: Thomas Huth <thuth@redhat.com>

It does not make much sense to limit these commands to the legacy 'vlan'
concept only, they should work with the modern netdevs, too. So now
it is possible to use this command with one, two or three parameters.

With one parameter, the command installs a hostfwd rule on the default
"user" network:
    hostfwd_add tcp:...

With two parameters, the command installs a hostfwd rule on a netdev
(that's the new way of using this command):
    hostfwd_add netdev_id tcp:...

With three parameters, the command installs a rule on a 'vlan' (aka hub):
    hostfwd_add hub_id name tcp:...

Same applies to the hostfwd_remove command now.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hmp-commands.hx |  4 ++--
 net/slirp.c     | 33 +++++++++++++++++++++++----------
 2 files changed, 25 insertions(+), 12 deletions(-)

diff --git a/hmp-commands.hx b/hmp-commands.hx
index XXXXXXX..XXXXXXX 100644
--- a/hmp-commands.hx
+++ b/hmp-commands.hx
@@ -XXX,XX +XXX,XX @@ ETEXI
     {
         .name       = "hostfwd_add",
         .args_type  = "arg1:s,arg2:s?,arg3:s?",
-        .params     = "[vlan_id name] [tcp|udp]:[hostaddr]:hostport-[guestaddr]:guestport",
+        .params     = "[hub_id name]|[netdev_id] [tcp|udp]:[hostaddr]:hostport-[guestaddr]:guestport",
         .help       = "redirect TCP or UDP connections from host to guest (requires -net user)",
         .cmd        = hmp_hostfwd_add,
     },
@@ -XXX,XX +XXX,XX @@ ETEXI
     {
         .name       = "hostfwd_remove",
         .args_type  = "arg1:s,arg2:s?,arg3:s?",
-        .params     = "[vlan_id name] [tcp|udp]:[hostaddr]:hostport",
+        .params     = "[hub_id name]|[netdev_id] [tcp|udp]:[hostaddr]:hostport",
         .help       = "remove host-to-guest TCP or UDP redirection",
         .cmd        = hmp_hostfwd_remove,
     },
diff --git a/net/slirp.c b/net/slirp.c
index XXXXXXX..XXXXXXX 100644
--- a/net/slirp.c
+++ b/net/slirp.c
@@ -XXX,XX +XXX,XX @@ error:
     return -1;
 }
 
-static SlirpState *slirp_lookup(Monitor *mon, const char *vlan,
-                                const char *stack)
+static SlirpState *slirp_lookup(Monitor *mon, const char *hub_id,
+                                const char *name)
 {
-
-    if (vlan) {
+    if (name) {
         NetClientState *nc;
-        nc = net_hub_find_client_by_name(strtol(vlan, NULL, 0), stack);
-        if (!nc) {
-            monitor_printf(mon, "unrecognized (vlan-id, stackname) pair\n");
-            return NULL;
+        if (hub_id) {
+            nc = net_hub_find_client_by_name(strtol(hub_id, NULL, 0), name);
+            if (!nc) {
+                monitor_printf(mon, "unrecognized (vlan-id, stackname) pair\n");
+                return NULL;
+            }
+        } else {
+            nc = qemu_find_netdev(name);
+            if (!nc) {
+                monitor_printf(mon, "unrecognized netdev id '%s'\n", name);
+                return NULL;
+            }
         }
         if (strcmp(nc->model, "user")) {
             monitor_printf(mon, "invalid device specified\n");
@@ -XXX,XX +XXX,XX @@ void hmp_hostfwd_remove(Monitor *mon, const QDict *qdict)
     const char *arg2 = qdict_get_try_str(qdict, "arg2");
     const char *arg3 = qdict_get_try_str(qdict, "arg3");
 
-    if (arg2) {
+    if (arg3) {
         s = slirp_lookup(mon, arg1, arg2);
         src_str = arg3;
+    } else if (arg2) {
+        s = slirp_lookup(mon, NULL, arg1);
+        src_str = arg2;
     } else {
         s = slirp_lookup(mon, NULL, NULL);
         src_str = arg1;
@@ -XXX,XX +XXX,XX @@ void hmp_hostfwd_add(Monitor *mon, const QDict *qdict)
     const char *arg2 = qdict_get_try_str(qdict, "arg2");
     const char *arg3 = qdict_get_try_str(qdict, "arg3");
 
-    if (arg2) {
+    if (arg3) {
         s = slirp_lookup(mon, arg1, arg2);
         redir_str = arg3;
+    } else if (arg2) {
+        s = slirp_lookup(mon, NULL, arg1);
+        redir_str = arg2;
     } else {
         s = slirp_lookup(mon, NULL, NULL);
         redir_str = arg1;
-- 
2.7.4

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

gently asked by his automatic reply :)

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 MAINTAINERS | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ F: hw/scsi/mfi.h
 F: tests/megasas-test.c
 
 Network packet abstractions
-M: Dmitry Fleytman <dmitry@daynix.com>
+M: Dmitry Fleytman <dmitry.fleytman@gmail.com>
 S: Maintained
 F: include/net/eth.h
 F: net/eth.c
@@ -XXX,XX +XXX,XX @@ F: hw/net/net_rx_pkt*
 F: hw/net/net_tx_pkt*
 
 Vmware
-M: Dmitry Fleytman <dmitry@daynix.com>
+M: Dmitry Fleytman <dmitry.fleytman@gmail.com>
 S: Maintained
 F: hw/net/vmxnet*
 F: hw/scsi/vmw_pvscsi*
@@ -XXX,XX +XXX,XX @@ F: hw/mem/nvdimm.c
 F: include/hw/mem/nvdimm.h
 
 e1000x
-M: Dmitry Fleytman <dmitry@daynix.com>
+M: Dmitry Fleytman <dmitry.fleytman@gmail.com>
 S: Maintained
 F: hw/net/e1000x*
 
 e1000e
-M: Dmitry Fleytman <dmitry@daynix.com>
+M: Dmitry Fleytman <dmitry.fleytman@gmail.com>
 S: Maintained
 F: hw/net/e1000e*
 
-- 
2.7.4

The following changes since commit 32c7e0ab755745e961f1772e95cac381cc68769d:

Merge remote-tracking branch 'remotes/juanquintela/tags/migration/20170421' into staging (2017-04-21 15:59:27 +0100)

are available in the git repository at:

https://github.com/jasowang/qemu.git tags/net-pull-request

for you to fetch changes up to 0fc8aec7de64f2bf83a274a2a38b938ce03425d2:

COLO-compare: Optimize tcp compare trace event (2017-04-25 19:17:25 +0800)

----------------------------------------------------------------

Changes from V1:
- Fix clang warnings

----------------------------------------------------------------
Cédric Le Goater (5):
      hw/net: add MII definitions
      net: add FTGMAC100 support
      net/ftgmac100: add a 'aspeed' property
      aspeed: add a FTGMAC100 nic
      slirp: add a fake NC-SI backend

Zhang Chen (3):
      colo-compare: Fix old packet check bug.
      COLO-compare: Optimize tcp compare for option field
      COLO-compare: Optimize tcp compare trace event

From: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>

If colo-compare find one old packet,we can notify colo-frame
do checkpoint, no need continue find more old packet here.

Signed-off-by: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/colo-compare.c | 15 +++++++++++----
 1 file changed, 11 insertions(+), 4 deletions(-)

diff --git a/net/colo-compare.c b/net/colo-compare.c
index XXXXXXX..XXXXXXX 100644
--- a/net/colo-compare.c
+++ b/net/colo-compare.c
@@ -XXX,XX +XXX,XX @@ static int colo_old_packet_check_one(Packet *pkt, int64_t *check_time)
     }
 }
 
-static void colo_old_packet_check_one_conn(void *opaque,
-                                           void *user_data)
+static int colo_old_packet_check_one_conn(Connection *conn,
+                                          void *user_data)
 {
-    Connection *conn = opaque;
     GList *result = NULL;
     int64_t check_time = REGULAR_PACKET_CHECK_MS;
 
@@ -XXX,XX +XXX,XX @@ static void colo_old_packet_check_one_conn(void *opaque,
     if (result) {
         /* do checkpoint will flush old packet */
         /* TODO: colo_notify_checkpoint();*/
+        return 0;
     }
+
+    return 1;
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ static void colo_old_packet_check(void *opaque)
 {
     CompareState *s = opaque;
 
-    g_queue_foreach(&s->conn_list, colo_old_packet_check_one_conn, NULL);
+    /*
+     * If we find one old packet, stop finding job and notify
+     * COLO frame do checkpoint.
+     */
+    g_queue_find_custom(&s->conn_list, NULL,
+                        (GCompareFunc)colo_old_packet_check_one_conn);
 }
 
 /*
-- 
2.7.4

From: Cédric Le Goater <clg@kaod.org>

This adds comments on the Basic mode control and status registers bit
definitions. It also adds a couple of bits for 1000BASE-T and the
RealTek 8211E PHY for the FTGMAC100 model to use.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 include/hw/net/mii.h | 71 +++++++++++++++++++++++++++++++++++++++-------------
 1 file changed, 53 insertions(+), 18 deletions(-)

diff --git a/include/hw/net/mii.h b/include/hw/net/mii.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/net/mii.h
+++ b/include/hw/net/mii.h
@@ -XXX,XX +XXX,XX @@
 #define MII_H
 
 /* PHY registers */
-#define MII_BMCR            0
-#define MII_BMSR            1
-#define MII_PHYID1          2
-#define MII_PHYID2          3
-#define MII_ANAR            4
-#define MII_ANLPAR          5
-#define MII_ANER            6
+#define MII_BMCR            0  /* Basic mode control register */
+#define MII_BMSR            1  /* Basic mode status register */
+#define MII_PHYID1          2  /* ID register 1 */
+#define MII_PHYID2          3  /* ID register 2 */
+#define MII_ANAR            4  /* Autonegotiation advertisement */
+#define MII_ANLPAR          5  /* Autonegotiation lnk partner abilities */
+#define MII_ANER            6  /* Autonegotiation expansion */
+#define MII_ANNP            7  /* Autonegotiation next page */
+#define MII_ANLPRNP         8  /* Autonegotiation link partner rx next page */
+#define MII_CTRL1000        9  /* 1000BASE-T control */
+#define MII_STAT1000        10 /* 1000BASE-T status */
+#define MII_MDDACR          13 /* MMD access control */
+#define MII_MDDAADR         14 /* MMD access address data */
+#define MII_EXTSTAT         15 /* Extended Status */
 #define MII_NSR             16
 #define MII_LBREMR          17
 #define MII_REC             18
@@ -XXX,XX +XXX,XX @@
 /* PHY registers fields */
 #define MII_BMCR_RESET      (1 << 15)
 #define MII_BMCR_LOOPBACK   (1 << 14)
-#define MII_BMCR_SPEED      (1 << 13)
-#define MII_BMCR_AUTOEN     (1 << 12)
-#define MII_BMCR_FD         (1 << 8)
+#define MII_BMCR_SPEED100   (1 << 13)  /* LSB of Speed (100) */
+#define MII_BMCR_SPEED      MII_BMCR_SPEED100
+#define MII_BMCR_AUTOEN     (1 << 12) /* Autonegotiation enable */
+#define MII_BMCR_PDOWN      (1 << 11) /* Enable low power state */
+#define MII_BMCR_ISOLATE    (1 << 10) /* Isolate data paths from MII */
+#define MII_BMCR_ANRESTART  (1 << 9)  /* Auto negotiation restart */
+#define MII_BMCR_FD         (1 << 8)  /* Set duplex mode */
+#define MII_BMCR_CTST       (1 << 7)  /* Collision test */
+#define MII_BMCR_SPEED1000  (1 << 6)  /* MSB of Speed (1000) */
 
-#define MII_BMSR_100TX_FD   (1 << 14)
-#define MII_BMSR_100TX_HD   (1 << 13)
-#define MII_BMSR_10T_FD     (1 << 12)
-#define MII_BMSR_10T_HD     (1 << 11)
-#define MII_BMSR_MFPS       (1 << 6)
-#define MII_BMSR_AN_COMP    (1 << 5)
-#define MII_BMSR_AUTONEG    (1 << 3)
-#define MII_BMSR_LINK_ST    (1 << 2)
+#define MII_BMSR_100TX_FD   (1 << 14) /* Can do 100mbps, full-duplex */
+#define MII_BMSR_100TX_HD   (1 << 13) /* Can do 100mbps, half-duplex */
+#define MII_BMSR_10T_FD     (1 << 12) /* Can do 10mbps, full-duplex */
+#define MII_BMSR_10T_HD     (1 << 11) /* Can do 10mbps, half-duplex */
+#define MII_BMSR_100T2_FD   (1 << 10) /* Can do 100mbps T2, full-duplex */
+#define MII_BMSR_100T2_HD   (1 << 9)  /* Can do 100mbps T2, half-duplex */
+#define MII_BMSR_EXTSTAT    (1 << 8)  /* Extended status in register 15 */
+#define MII_BMSR_MFPS       (1 << 6)  /* MII Frame Preamble Suppression */
+#define MII_BMSR_AN_COMP    (1 << 5)  /* Auto-negotiation complete */
+#define MII_BMSR_RFAULT     (1 << 4)  /* Remote fault */
+#define MII_BMSR_AUTONEG    (1 << 3)  /* Able to do auto-negotiation */
+#define MII_BMSR_LINK_ST    (1 << 2)  /* Link status */
+#define MII_BMSR_JABBER     (1 << 1)  /* Jabber detected */
+#define MII_BMSR_EXTCAP     (1 << 0)  /* Ext-reg capability */
 
+#define MII_ANAR_PAUSE_ASYM (1 << 11) /* Try for asymetric pause */
+#define MII_ANAR_PAUSE      (1 << 10) /* Try for pause */
 #define MII_ANAR_TXFD       (1 << 8)
 #define MII_ANAR_TX         (1 << 7)
 #define MII_ANAR_10FD       (1 << 6)
@@ -XXX,XX +XXX,XX @@
 #define MII_ANAR_CSMACD     (1 << 0)
 
 #define MII_ANLPAR_ACK      (1 << 14)
+#define MII_ANLPAR_PAUSEASY (1 << 11) /* can pause asymmetrically */
+#define MII_ANLPAR_PAUSE    (1 << 10) /* can pause */
 #define MII_ANLPAR_TXFD     (1 << 8)
 #define MII_ANLPAR_TX       (1 << 7)
 #define MII_ANLPAR_10FD     (1 << 6)
 #define MII_ANLPAR_10       (1 << 5)
 #define MII_ANLPAR_CSMACD   (1 << 0)
 
+#define MII_ANER_NWAY       (1 << 0) /* Can do N-way auto-nego */
+
+#define MII_CTRL1000_FULL   (1 << 9)  /* 1000BASE-T full duplex */
+#define MII_CTRL1000_HALF   (1 << 8)  /* 1000BASE-T half duplex */
+
+#define MII_STAT1000_FULL   (1 << 11) /* 1000BASE-T full duplex */
+#define MII_STAT1000_HALF   (1 << 10) /* 1000BASE-T half duplex */
+
 /* List of vendor identifiers */
 /* RealTek 8201 */
 #define RTL8201CP_PHYID1    0x0000
 #define RTL8201CP_PHYID2    0x8201
 
+/* RealTek 8211E */
+#define RTL8211E_PHYID1     0x001c
+#define RTL8211E_PHYID2     0xc915
+
 /* National Semiconductor DP83848 */
 #define DP83848_PHYID1      0x2000
 #define DP83848_PHYID2      0x5c90
-- 
2.7.4

From: Cédric Le Goater <clg@kaod.org>

The FTGMAC100 device is an Ethernet controller with DMA function that
can be found on Aspeed SoCs (which include NCSI).

It is fully compliant with IEEE 802.3 specification for 10/100 Mbps
Ethernet and IEEE 802.3z specification for 1000 Mbps Ethernet and
includes Reduced Media Independent Interface (RMII) and Reduced
Gigabit Media Independent Interface (RGMII) interfaces. It adopts an
AHB bus interface and integrates a link list DMA engine with direct
M-Bus accesses for transmitting and receiving packets. It has
independent TX/RX fifos, supports half and full duplex (1000 Mbps mode
only supports full duplex), flow control for full duplex and
backpressure for half duplex.

The FTGMAC100 also implements IP, TCP, UDP checksum offloads and
supports IEEE 802.1Q VLAN tag insertion and removal. It offers
high-priority transmit queue for QoS and CoS applications

This model is backed with a RealTek 8211E PHY which is the chip found
on the AST2500 EVB. It is complete enough to satisfy two different
Linux drivers and a U-Boot driver. Not supported features are :

- IEEE 802.1Q VLAN
 - High Priority Transmit Queue
 - Wake-On-LAN functions

The code is based on the Coldfire Fast Ethernet Controller model.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 default-configs/arm-softmmu.mak |    1 +
 hw/net/Makefile.objs            |    1 +
 hw/net/ftgmac100.c              | 1003 +++++++++++++++++++++++++++++++++++++++
 include/hw/net/ftgmac100.h      |   60 +++
 4 files changed, 1065 insertions(+)
 create mode 100644 hw/net/ftgmac100.c
 create mode 100644 include/hw/net/ftgmac100.h

diff --git a/default-configs/arm-softmmu.mak b/default-configs/arm-softmmu.mak
index XXXXXXX..XXXXXXX 100644
--- a/default-configs/arm-softmmu.mak
+++ b/default-configs/arm-softmmu.mak
@@ -XXX,XX +XXX,XX @@ CONFIG_LAN9118=y
 CONFIG_SMC91C111=y
 CONFIG_ALLWINNER_EMAC=y
 CONFIG_IMX_FEC=y
+CONFIG_FTGMAC100=y
 CONFIG_DS1338=y
 CONFIG_PFLASH_CFI01=y
 CONFIG_PFLASH_CFI02=y
diff --git a/hw/net/Makefile.objs b/hw/net/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/Makefile.objs
+++ b/hw/net/Makefile.objs
@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_IMX_FEC) += imx_fec.o
 common-obj-$(CONFIG_CADENCE) += cadence_gem.o
 common-obj-$(CONFIG_STELLARIS_ENET) += stellaris_enet.o
 common-obj-$(CONFIG_LANCE) += lance.o
+common-obj-$(CONFIG_FTGMAC100) += ftgmac100.o
 
 obj-$(CONFIG_ETRAXFS) += etraxfs_eth.o
 obj-$(CONFIG_COLDFIRE) += mcf_fec.o
diff --git a/hw/net/ftgmac100.c b/hw/net/ftgmac100.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/net/ftgmac100.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * Faraday FTGMAC100 Gigabit Ethernet
+ *
+ * Copyright (C) 2016-2017, IBM Corporation.
+ *
+ * Based on Coldfire Fast Ethernet Controller emulation.
+ *
+ * Copyright (c) 2007 CodeSourcery.
+ *
+ * This code is licensed under the GPL version 2 or later. See the
+ * COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "hw/net/ftgmac100.h"
+#include "sysemu/dma.h"
+#include "qemu/log.h"
+#include "net/checksum.h"
+#include "net/eth.h"
+#include "hw/net/mii.h"
+
+/* For crc32 */
+#include <zlib.h>
+
+/*
+ * FTGMAC100 registers
+ */
+#define FTGMAC100_ISR             0x00
+#define FTGMAC100_IER             0x04
+#define FTGMAC100_MAC_MADR        0x08
+#define FTGMAC100_MAC_LADR        0x0c
+#define FTGMAC100_MATH0           0x10
+#define FTGMAC100_MATH1           0x14
+#define FTGMAC100_NPTXPD          0x18
+#define FTGMAC100_RXPD            0x1C
+#define FTGMAC100_NPTXR_BADR      0x20
+#define FTGMAC100_RXR_BADR        0x24
+#define FTGMAC100_HPTXPD          0x28
+#define FTGMAC100_HPTXR_BADR      0x2c
+#define FTGMAC100_ITC             0x30
+#define FTGMAC100_APTC            0x34
+#define FTGMAC100_DBLAC           0x38
+#define FTGMAC100_REVR            0x40
+#define FTGMAC100_FEAR1           0x44
+#define FTGMAC100_RBSR            0x4c
+#define FTGMAC100_TPAFCR          0x48
+
+#define FTGMAC100_MACCR           0x50
+#define FTGMAC100_MACSR           0x54
+#define FTGMAC100_PHYCR           0x60
+#define FTGMAC100_PHYDATA         0x64
+#define FTGMAC100_FCR             0x68
+
+/*
+ * Interrupt status register & interrupt enable register
+ */
+#define FTGMAC100_INT_RPKT_BUF    (1 << 0)
+#define FTGMAC100_INT_RPKT_FIFO   (1 << 1)
+#define FTGMAC100_INT_NO_RXBUF    (1 << 2)
+#define FTGMAC100_INT_RPKT_LOST   (1 << 3)
+#define FTGMAC100_INT_XPKT_ETH    (1 << 4)
+#define FTGMAC100_INT_XPKT_FIFO   (1 << 5)
+#define FTGMAC100_INT_NO_NPTXBUF  (1 << 6)
+#define FTGMAC100_INT_XPKT_LOST   (1 << 7)
+#define FTGMAC100_INT_AHB_ERR     (1 << 8)
+#define FTGMAC100_INT_PHYSTS_CHG  (1 << 9)
+#define FTGMAC100_INT_NO_HPTXBUF  (1 << 10)
+
+/*
+ * Automatic polling timer control register
+ */
+#define FTGMAC100_APTC_RXPOLL_CNT(x)        ((x) & 0xf)
+#define FTGMAC100_APTC_RXPOLL_TIME_SEL      (1 << 4)
+#define FTGMAC100_APTC_TXPOLL_CNT(x)        (((x) >> 8) & 0xf)
+#define FTGMAC100_APTC_TXPOLL_TIME_SEL      (1 << 12)
+
+/*
+ * PHY control register
+ */
+#define FTGMAC100_PHYCR_MIIRD               (1 << 26)
+#define FTGMAC100_PHYCR_MIIWR               (1 << 27)
+
+#define FTGMAC100_PHYCR_DEV(x)              (((x) >> 16) & 0x1f)
+#define FTGMAC100_PHYCR_REG(x)              (((x) >> 21) & 0x1f)
+
+/*
+ * PHY data register
+ */
+#define FTGMAC100_PHYDATA_MIIWDATA(x)       ((x) & 0xffff)
+#define FTGMAC100_PHYDATA_MIIRDATA(x)       (((x) >> 16) & 0xffff)
+
+/*
+ * Feature Register
+ */
+#define FTGMAC100_REVR_NEW_MDIO_INTERFACE   (1 << 31)
+
+/*
+ * MAC control register
+ */
+#define FTGMAC100_MACCR_TXDMA_EN         (1 << 0)
+#define FTGMAC100_MACCR_RXDMA_EN         (1 << 1)
+#define FTGMAC100_MACCR_TXMAC_EN         (1 << 2)
+#define FTGMAC100_MACCR_RXMAC_EN         (1 << 3)
+#define FTGMAC100_MACCR_RM_VLAN          (1 << 4)
+#define FTGMAC100_MACCR_HPTXR_EN         (1 << 5)
+#define FTGMAC100_MACCR_LOOP_EN          (1 << 6)
+#define FTGMAC100_MACCR_ENRX_IN_HALFTX   (1 << 7)
+#define FTGMAC100_MACCR_FULLDUP          (1 << 8)
+#define FTGMAC100_MACCR_GIGA_MODE        (1 << 9)
+#define FTGMAC100_MACCR_CRC_APD          (1 << 10) /* not needed */
+#define FTGMAC100_MACCR_RX_RUNT          (1 << 12)
+#define FTGMAC100_MACCR_JUMBO_LF         (1 << 13)
+#define FTGMAC100_MACCR_RX_ALL           (1 << 14)
+#define FTGMAC100_MACCR_HT_MULTI_EN      (1 << 15)
+#define FTGMAC100_MACCR_RX_MULTIPKT      (1 << 16)
+#define FTGMAC100_MACCR_RX_BROADPKT      (1 << 17)
+#define FTGMAC100_MACCR_DISCARD_CRCERR   (1 << 18)
+#define FTGMAC100_MACCR_FAST_MODE        (1 << 19)
+#define FTGMAC100_MACCR_SW_RST           (1 << 31)
+
+/*
+ * Transmit descriptor
+ */
+#define FTGMAC100_TXDES0_TXBUF_SIZE(x)   ((x) & 0x3fff)
+#define FTGMAC100_TXDES0_EDOTR           (1 << 15)
+#define FTGMAC100_TXDES0_CRC_ERR         (1 << 19)
+#define FTGMAC100_TXDES0_LTS             (1 << 28)
+#define FTGMAC100_TXDES0_FTS             (1 << 29)
+#define FTGMAC100_TXDES0_TXDMA_OWN       (1 << 31)
+
+#define FTGMAC100_TXDES1_VLANTAG_CI(x)   ((x) & 0xffff)
+#define FTGMAC100_TXDES1_INS_VLANTAG     (1 << 16)
+#define FTGMAC100_TXDES1_TCP_CHKSUM      (1 << 17)
+#define FTGMAC100_TXDES1_UDP_CHKSUM      (1 << 18)
+#define FTGMAC100_TXDES1_IP_CHKSUM       (1 << 19)
+#define FTGMAC100_TXDES1_LLC             (1 << 22)
+#define FTGMAC100_TXDES1_TX2FIC          (1 << 30)
+#define FTGMAC100_TXDES1_TXIC            (1 << 31)
+
+/*
+ * Receive descriptor
+ */
+#define FTGMAC100_RXDES0_VDBC            0x3fff
+#define FTGMAC100_RXDES0_EDORR           (1 << 15)
+#define FTGMAC100_RXDES0_MULTICAST       (1 << 16)
+#define FTGMAC100_RXDES0_BROADCAST       (1 << 17)
+#define FTGMAC100_RXDES0_RX_ERR          (1 << 18)
+#define FTGMAC100_RXDES0_CRC_ERR         (1 << 19)
+#define FTGMAC100_RXDES0_FTL             (1 << 20)
+#define FTGMAC100_RXDES0_RUNT            (1 << 21)
+#define FTGMAC100_RXDES0_RX_ODD_NB       (1 << 22)
+#define FTGMAC100_RXDES0_FIFO_FULL       (1 << 23)
+#define FTGMAC100_RXDES0_PAUSE_OPCODE    (1 << 24)
+#define FTGMAC100_RXDES0_PAUSE_FRAME     (1 << 25)
+#define FTGMAC100_RXDES0_LRS             (1 << 28)
+#define FTGMAC100_RXDES0_FRS             (1 << 29)
+#define FTGMAC100_RXDES0_RXPKT_RDY       (1 << 31)
+
+#define FTGMAC100_RXDES1_VLANTAG_CI      0xffff
+#define FTGMAC100_RXDES1_PROT_MASK       (0x3 << 20)
+#define FTGMAC100_RXDES1_PROT_NONIP      (0x0 << 20)
+#define FTGMAC100_RXDES1_PROT_IP         (0x1 << 20)
+#define FTGMAC100_RXDES1_PROT_TCPIP      (0x2 << 20)
+#define FTGMAC100_RXDES1_PROT_UDPIP      (0x3 << 20)
+#define FTGMAC100_RXDES1_LLC             (1 << 22)
+#define FTGMAC100_RXDES1_DF              (1 << 23)
+#define FTGMAC100_RXDES1_VLANTAG_AVAIL   (1 << 24)
+#define FTGMAC100_RXDES1_TCP_CHKSUM_ERR  (1 << 25)
+#define FTGMAC100_RXDES1_UDP_CHKSUM_ERR  (1 << 26)
+#define FTGMAC100_RXDES1_IP_CHKSUM_ERR   (1 << 27)
+
+/*
+ * Receive and transmit Buffer Descriptor
+ */
+typedef struct {
+    uint32_t        des0;
+    uint32_t        des1;
+    uint32_t        des2;        /* not used by HW */
+    uint32_t        des3;
+} FTGMAC100Desc;
+
+/*
+ * Specific RTL8211E MII Registers
+ */
+#define RTL8211E_MII_PHYCR        16 /* PHY Specific Control */
+#define RTL8211E_MII_PHYSR        17 /* PHY Specific Status */
+#define RTL8211E_MII_INER         18 /* Interrupt Enable */
+#define RTL8211E_MII_INSR         19 /* Interrupt Status */
+#define RTL8211E_MII_RXERC        24 /* Receive Error Counter */
+#define RTL8211E_MII_LDPSR        27 /* Link Down Power Saving */
+#define RTL8211E_MII_EPAGSR       30 /* Extension Page Select */
+#define RTL8211E_MII_PAGSEL       31 /* Page Select */
+
+/*
+ * RTL8211E Interrupt Status
+ */
+#define PHY_INT_AUTONEG_ERROR       (1 << 15)
+#define PHY_INT_PAGE_RECV           (1 << 12)
+#define PHY_INT_AUTONEG_COMPLETE    (1 << 11)
+#define PHY_INT_LINK_STATUS         (1 << 10)
+#define PHY_INT_ERROR               (1 << 9)
+#define PHY_INT_DOWN                (1 << 8)
+#define PHY_INT_JABBER              (1 << 0)
+
+/*
+ * Max frame size for the receiving buffer
+ */
+#define FTGMAC100_MAX_FRAME_SIZE    10240
+
+/* Limits depending on the type of the frame
+ *
+ *   9216 for Jumbo frames (+ 4 for VLAN)
+ *   1518 for other frames (+ 4 for VLAN)
+ */
+static int ftgmac100_max_frame_size(FTGMAC100State *s)
+{
+    return (s->maccr & FTGMAC100_MACCR_JUMBO_LF ? 9216 : 1518) + 4;
+}
+
+static void ftgmac100_update_irq(FTGMAC100State *s)
+{
+    qemu_set_irq(s->irq, s->isr & s->ier);
+}
+
+/*
+ * The MII phy could raise a GPIO to the processor which in turn
+ * could be handled as an interrpt by the OS.
+ * For now we don't handle any GPIO/interrupt line, so the OS will
+ * have to poll for the PHY status.
+ */
+static void phy_update_irq(FTGMAC100State *s)
+{
+    ftgmac100_update_irq(s);
+}
+
+static void phy_update_link(FTGMAC100State *s)
+{
+    /* Autonegotiation status mirrors link status.  */
+    if (qemu_get_queue(s->nic)->link_down) {
+        s->phy_status &= ~(MII_BMSR_LINK_ST | MII_BMSR_AN_COMP);
+        s->phy_int |= PHY_INT_DOWN;
+    } else {
+        s->phy_status |= (MII_BMSR_LINK_ST | MII_BMSR_AN_COMP);
+        s->phy_int |= PHY_INT_AUTONEG_COMPLETE;
+    }
+    phy_update_irq(s);
+}
+
+static void ftgmac100_set_link(NetClientState *nc)
+{
+    phy_update_link(FTGMAC100(qemu_get_nic_opaque(nc)));
+}
+
+static void phy_reset(FTGMAC100State *s)
+{
+    s->phy_status = (MII_BMSR_100TX_FD | MII_BMSR_100TX_HD | MII_BMSR_10T_FD |
+                     MII_BMSR_10T_HD | MII_BMSR_EXTSTAT | MII_BMSR_MFPS |
+                     MII_BMSR_AN_COMP | MII_BMSR_AUTONEG | MII_BMSR_LINK_ST |
+                     MII_BMSR_EXTCAP);
+    s->phy_control = (MII_BMCR_AUTOEN | MII_BMCR_FD | MII_BMCR_SPEED1000);
+    s->phy_advertise = (MII_ANAR_PAUSE_ASYM | MII_ANAR_PAUSE | MII_ANAR_TXFD |
+                        MII_ANAR_TX | MII_ANAR_10FD | MII_ANAR_10 |
+                        MII_ANAR_CSMACD);
+    s->phy_int_mask = 0;
+    s->phy_int = 0;
+}
+
+static uint32_t do_phy_read(FTGMAC100State *s, int reg)
+{
+    uint32_t val;
+
+    switch (reg) {
+    case MII_BMCR: /* Basic Control */
+        val = s->phy_control;
+        break;
+    case MII_BMSR: /* Basic Status */
+        val = s->phy_status;
+        break;
+    case MII_PHYID1: /* ID1 */
+        val = RTL8211E_PHYID1;
+        break;
+    case MII_PHYID2: /* ID2 */
+        val = RTL8211E_PHYID2;
+        break;
+    case MII_ANAR: /* Auto-neg advertisement */
+        val = s->phy_advertise;
+        break;
+    case MII_ANLPAR: /* Auto-neg Link Partner Ability */
+        val = (MII_ANLPAR_ACK | MII_ANLPAR_PAUSE | MII_ANLPAR_TXFD |
+               MII_ANLPAR_TX | MII_ANLPAR_10FD | MII_ANLPAR_10 |
+               MII_ANLPAR_CSMACD);
+        break;
+    case MII_ANER: /* Auto-neg Expansion */
+        val = MII_ANER_NWAY;
+        break;
+    case MII_CTRL1000: /* 1000BASE-T control  */
+        val = (MII_CTRL1000_HALF | MII_CTRL1000_FULL);
+        break;
+    case MII_STAT1000: /* 1000BASE-T status  */
+        val = MII_STAT1000_FULL;
+        break;
+    case RTL8211E_MII_INSR:  /* Interrupt status.  */
+        val = s->phy_int;
+        s->phy_int = 0;
+        phy_update_irq(s);
+        break;
+    case RTL8211E_MII_INER:  /* Interrupt enable */
+        val = s->phy_int_mask;
+        break;
+    case RTL8211E_MII_PHYCR:
+    case RTL8211E_MII_PHYSR:
+    case RTL8211E_MII_RXERC:
+    case RTL8211E_MII_LDPSR:
+    case RTL8211E_MII_EPAGSR:
+    case RTL8211E_MII_PAGSEL:
+        qemu_log_mask(LOG_UNIMP, "%s: reg %d not implemented\n",
+                      __func__, reg);
+        val = 0;
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad address at offset %d\n",
+                      __func__, reg);
+        val = 0;
+        break;
+    }
+
+    return val;
+}
+
+#define MII_BMCR_MASK (MII_BMCR_LOOPBACK | MII_BMCR_SPEED100 |          \
+                       MII_BMCR_SPEED | MII_BMCR_AUTOEN | MII_BMCR_PDOWN | \
+                       MII_BMCR_FD | MII_BMCR_CTST)
+#define MII_ANAR_MASK 0x2d7f
+
+static void do_phy_write(FTGMAC100State *s, int reg, uint32_t val)
+{
+    switch (reg) {
+    case MII_BMCR:     /* Basic Control */
+        if (val & MII_BMCR_RESET) {
+            phy_reset(s);
+        } else {
+            s->phy_control = val & MII_BMCR_MASK;
+            /* Complete autonegotiation immediately.  */
+            if (val & MII_BMCR_AUTOEN) {
+                s->phy_status |= MII_BMSR_AN_COMP;
+            }
+        }
+        break;
+    case MII_ANAR:     /* Auto-neg advertisement */
+        s->phy_advertise = (val & MII_ANAR_MASK) | MII_ANAR_TX;
+        break;
+    case RTL8211E_MII_INER: /* Interrupt enable */
+        s->phy_int_mask = val & 0xff;
+        phy_update_irq(s);
+        break;
+    case RTL8211E_MII_PHYCR:
+    case RTL8211E_MII_PHYSR:
+    case RTL8211E_MII_RXERC:
+    case RTL8211E_MII_LDPSR:
+    case RTL8211E_MII_EPAGSR:
+    case RTL8211E_MII_PAGSEL:
+        qemu_log_mask(LOG_UNIMP, "%s: reg %d not implemented\n",
+                      __func__, reg);
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad address at offset %d\n",
+                      __func__, reg);
+        break;
+    }
+}
+
+static int ftgmac100_read_bd(FTGMAC100Desc *bd, dma_addr_t addr)
+{
+    if (dma_memory_read(&address_space_memory, addr, bd, sizeof(*bd))) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: failed to read descriptor @ 0x%"
+                      HWADDR_PRIx "\n", __func__, addr);
+        return -1;
+    }
+    bd->des0 = le32_to_cpu(bd->des0);
+    bd->des1 = le32_to_cpu(bd->des1);
+    bd->des2 = le32_to_cpu(bd->des2);
+    bd->des3 = le32_to_cpu(bd->des3);
+    return 0;
+}
+
+static int ftgmac100_write_bd(FTGMAC100Desc *bd, dma_addr_t addr)
+{
+    FTGMAC100Desc lebd;
+
+    lebd.des0 = cpu_to_le32(bd->des0);
+    lebd.des1 = cpu_to_le32(bd->des1);
+    lebd.des2 = cpu_to_le32(bd->des2);
+    lebd.des3 = cpu_to_le32(bd->des3);
+    if (dma_memory_write(&address_space_memory, addr, &lebd, sizeof(lebd))) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: failed to write descriptor @ 0x%"
+                      HWADDR_PRIx "\n", __func__, addr);
+        return -1;
+    }
+    return 0;
+}
+
+static void ftgmac100_do_tx(FTGMAC100State *s, uint32_t tx_ring,
+                            uint32_t tx_descriptor)
+{
+    int frame_size = 0;
+    uint8_t *ptr = s->frame;
+    uint32_t addr = tx_descriptor;
+    uint32_t flags = 0;
+    int max_frame_size = ftgmac100_max_frame_size(s);
+
+    while (1) {
+        FTGMAC100Desc bd;
+        int len;
+
+        if (ftgmac100_read_bd(&bd, addr) ||
+            ((bd.des0 & FTGMAC100_TXDES0_TXDMA_OWN) == 0)) {
+            /* Run out of descriptors to transmit.  */
+            s->isr |= FTGMAC100_INT_NO_NPTXBUF;
+            break;
+        }
+
+        /* record transmit flags as they are valid only on the first
+         * segment */
+        if (bd.des0 & FTGMAC100_TXDES0_FTS) {
+            flags = bd.des1;
+        }
+
+        len = bd.des0 & 0x3FFF;
+        if (frame_size + len > max_frame_size) {
+            qemu_log_mask(LOG_GUEST_ERROR, "%s: frame too big : %d bytes\n",
+                          __func__, len);
+            len = max_frame_size - frame_size;
+        }
+
+        if (dma_memory_read(&address_space_memory, bd.des3, ptr, len)) {
+            qemu_log_mask(LOG_GUEST_ERROR, "%s: failed to read packet @ 0x%x\n",
+                          __func__, bd.des3);
+            s->isr |= FTGMAC100_INT_NO_NPTXBUF;
+            break;
+        }
+
+        ptr += len;
+        frame_size += len;
+        if (bd.des0 & FTGMAC100_TXDES0_LTS) {
+            if (flags & FTGMAC100_TXDES1_IP_CHKSUM) {
+                net_checksum_calculate(s->frame, frame_size);
+            }
+            /* Last buffer in frame.  */
+            qemu_send_packet(qemu_get_queue(s->nic), s->frame, frame_size);
+            ptr = s->frame;
+            frame_size = 0;
+            if (flags & FTGMAC100_TXDES1_TXIC) {
+                s->isr |= FTGMAC100_INT_XPKT_ETH;
+            }
+        }
+
+        if (flags & FTGMAC100_TXDES1_TX2FIC) {
+            s->isr |= FTGMAC100_INT_XPKT_FIFO;
+        }
+        bd.des0 &= ~FTGMAC100_TXDES0_TXDMA_OWN;
+
+        /* Write back the modified descriptor.  */
+        ftgmac100_write_bd(&bd, addr);
+        /* Advance to the next descriptor.  */
+        if (bd.des0 & FTGMAC100_TXDES0_EDOTR) {
+            addr = tx_ring;
+        } else {
+            addr += sizeof(FTGMAC100Desc);
+        }
+    }
+
+    s->tx_descriptor = addr;
+
+    ftgmac100_update_irq(s);
+}
+
+static int ftgmac100_can_receive(NetClientState *nc)
+{
+    FTGMAC100State *s = FTGMAC100(qemu_get_nic_opaque(nc));
+    FTGMAC100Desc bd;
+
+    if ((s->maccr & (FTGMAC100_MACCR_RXDMA_EN | FTGMAC100_MACCR_RXMAC_EN))
+         != (FTGMAC100_MACCR_RXDMA_EN | FTGMAC100_MACCR_RXMAC_EN)) {
+        return 0;
+    }
+
+    if (ftgmac100_read_bd(&bd, s->rx_descriptor)) {
+        return 0;
+    }
+    return !(bd.des0 & FTGMAC100_RXDES0_RXPKT_RDY);
+}
+
+/*
+ * This is purely informative. The HW can poll the RW (and RX) ring
+ * buffers for available descriptors but we don't need to trigger a
+ * timer for that in qemu.
+ */
+static uint32_t ftgmac100_rxpoll(FTGMAC100State *s)
+{
+    /* Polling times :
+     *
+     * Speed      TIME_SEL=0    TIME_SEL=1
+     *
+     *    10         51.2 ms      819.2 ms
+     *   100         5.12 ms      81.92 ms
+     *  1000        1.024 ms     16.384 ms
+     */
+    static const int div[] = { 20, 200, 1000 };
+
+    uint32_t cnt = 1024 * FTGMAC100_APTC_RXPOLL_CNT(s->aptcr);
+    uint32_t speed = (s->maccr & FTGMAC100_MACCR_FAST_MODE) ? 1 : 0;
+    uint32_t period;
+
+    if (s->aptcr & FTGMAC100_APTC_RXPOLL_TIME_SEL) {
+        cnt <<= 4;
+    }
+
+    if (s->maccr & FTGMAC100_MACCR_GIGA_MODE) {
+        speed = 2;
+    }
+
+    period = cnt / div[speed];
+
+    return period;
+}
+
+static void ftgmac100_reset(DeviceState *d)
+{
+    FTGMAC100State *s = FTGMAC100(d);
+
+    /* Reset the FTGMAC100 */
+    s->isr = 0;
+    s->ier = 0;
+    s->rx_enabled = 0;
+    s->rx_ring = 0;
+    s->rbsr = 0x640;
+    s->rx_descriptor = 0;
+    s->tx_ring = 0;
+    s->tx_descriptor = 0;
+    s->math[0] = 0;
+    s->math[1] = 0;
+    s->itc = 0;
+    s->aptcr = 1;
+    s->dblac = 0x00022f00;
+    s->revr = 0;
+    s->fear1 = 0;
+    s->tpafcr = 0xf1;
+
+    s->maccr = 0;
+    s->phycr = 0;
+    s->phydata = 0;
+    s->fcr = 0x400;
+
+    /* and the PHY */
+    phy_reset(s);
+}
+
+static uint64_t ftgmac100_read(void *opaque, hwaddr addr, unsigned size)
+{
+    FTGMAC100State *s = FTGMAC100(opaque);
+
+    switch (addr & 0xff) {
+    case FTGMAC100_ISR:
+        return s->isr;
+    case FTGMAC100_IER:
+        return s->ier;
+    case FTGMAC100_MAC_MADR:
+        return (s->conf.macaddr.a[0] << 8)  | s->conf.macaddr.a[1];
+    case FTGMAC100_MAC_LADR:
+        return ((uint32_t) s->conf.macaddr.a[2] << 24) |
+            (s->conf.macaddr.a[3] << 16) | (s->conf.macaddr.a[4] << 8) |
+            s->conf.macaddr.a[5];
+    case FTGMAC100_MATH0:
+        return s->math[0];
+    case FTGMAC100_MATH1:
+        return s->math[1];
+    case FTGMAC100_ITC:
+        return s->itc;
+    case FTGMAC100_DBLAC:
+        return s->dblac;
+    case FTGMAC100_REVR:
+        return s->revr;
+    case FTGMAC100_FEAR1:
+        return s->fear1;
+    case FTGMAC100_TPAFCR:
+        return s->tpafcr;
+    case FTGMAC100_FCR:
+        return s->fcr;
+    case FTGMAC100_MACCR:
+        return s->maccr;
+    case FTGMAC100_PHYCR:
+        return s->phycr;
+    case FTGMAC100_PHYDATA:
+        return s->phydata;
+
+        /* We might want to support these one day */
+    case FTGMAC100_HPTXPD: /* High Priority Transmit Poll Demand */
+    case FTGMAC100_HPTXR_BADR: /* High Priority Transmit Ring Base Address */
+    case FTGMAC100_MACSR: /* MAC Status Register (MACSR) */
+        qemu_log_mask(LOG_UNIMP, "%s: read to unimplemented register 0x%"
+                      HWADDR_PRIx "\n", __func__, addr);
+        return 0;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad address at offset 0x%"
+                      HWADDR_PRIx "\n", __func__, addr);
+        return 0;
+    }
+}
+
+static void ftgmac100_write(void *opaque, hwaddr addr,
+                          uint64_t value, unsigned size)
+{
+    FTGMAC100State *s = FTGMAC100(opaque);
+    int reg;
+
+    switch (addr & 0xff) {
+    case FTGMAC100_ISR: /* Interrupt status */
+        s->isr &= ~value;
+        break;
+    case FTGMAC100_IER: /* Interrupt control */
+        s->ier = value;
+        break;
+    case FTGMAC100_MAC_MADR: /* MAC */
+        s->conf.macaddr.a[0] = value >> 8;
+        s->conf.macaddr.a[1] = value;
+        break;
+    case FTGMAC100_MAC_LADR:
+        s->conf.macaddr.a[2] = value >> 24;
+        s->conf.macaddr.a[3] = value >> 16;
+        s->conf.macaddr.a[4] = value >> 8;
+        s->conf.macaddr.a[5] = value;
+        break;
+    case FTGMAC100_MATH0: /* Multicast Address Hash Table 0 */
+        s->math[0] = value;
+        break;
+    case FTGMAC100_MATH1: /* Multicast Address Hash Table 1 */
+        s->math[1] = value;
+        break;
+    case FTGMAC100_ITC: /* TODO: Interrupt Timer Control */
+        s->itc = value;
+        break;
+    case FTGMAC100_RXR_BADR: /* Ring buffer address */
+        s->rx_ring = value;
+        s->rx_descriptor = s->rx_ring;
+        break;
+
+    case FTGMAC100_RBSR: /* DMA buffer size */
+        s->rbsr = value;
+        break;
+
+    case FTGMAC100_NPTXR_BADR: /* Transmit buffer address */
+        s->tx_ring = value;
+        s->tx_descriptor = s->tx_ring;
+        break;
+
+    case FTGMAC100_NPTXPD: /* Trigger transmit */
+        if ((s->maccr & (FTGMAC100_MACCR_TXDMA_EN | FTGMAC100_MACCR_TXMAC_EN))
+            == (FTGMAC100_MACCR_TXDMA_EN | FTGMAC100_MACCR_TXMAC_EN)) {
+            /* TODO: high priority tx ring */
+            ftgmac100_do_tx(s, s->tx_ring, s->tx_descriptor);
+        }
+        if (ftgmac100_can_receive(qemu_get_queue(s->nic))) {
+            qemu_flush_queued_packets(qemu_get_queue(s->nic));
+        }
+        break;
+
+    case FTGMAC100_RXPD: /* Receive Poll Demand Register */
+        if (ftgmac100_can_receive(qemu_get_queue(s->nic))) {
+            qemu_flush_queued_packets(qemu_get_queue(s->nic));
+        }
+        break;
+
+    case FTGMAC100_APTC: /* Automatic polling */
+        s->aptcr = value;
+
+        if (FTGMAC100_APTC_RXPOLL_CNT(s->aptcr)) {
+            ftgmac100_rxpoll(s);
+        }
+
+        if (FTGMAC100_APTC_TXPOLL_CNT(s->aptcr)) {
+            qemu_log_mask(LOG_UNIMP, "%s: no transmit polling\n", __func__);
+        }
+        break;
+
+    case FTGMAC100_MACCR: /* MAC Device control */
+        s->maccr = value;
+        if (value & FTGMAC100_MACCR_SW_RST) {
+            ftgmac100_reset(DEVICE(s));
+        }
+
+        if (ftgmac100_can_receive(qemu_get_queue(s->nic))) {
+            qemu_flush_queued_packets(qemu_get_queue(s->nic));
+        }
+        break;
+
+    case FTGMAC100_PHYCR:  /* PHY Device control */
+        reg = FTGMAC100_PHYCR_REG(value);
+        s->phycr = value;
+        if (value & FTGMAC100_PHYCR_MIIWR) {
+            do_phy_write(s, reg, s->phydata & 0xffff);
+            s->phycr &= ~FTGMAC100_PHYCR_MIIWR;
+        } else {
+            s->phydata = do_phy_read(s, reg) << 16;
+            s->phycr &= ~FTGMAC100_PHYCR_MIIRD;
+        }
+        break;
+    case FTGMAC100_PHYDATA:
+        s->phydata = value & 0xffff;
+        break;
+    case FTGMAC100_DBLAC: /* DMA Burst Length and Arbitration Control */
+        s->dblac = value;
+        break;
+    case FTGMAC100_REVR:  /* Feature Register */
+        /* TODO: Only Old MDIO interface is supported */
+        s->revr = value & ~FTGMAC100_REVR_NEW_MDIO_INTERFACE;
+        break;
+    case FTGMAC100_FEAR1: /* Feature Register 1 */
+        s->fear1 = value;
+        break;
+    case FTGMAC100_TPAFCR: /* Transmit Priority Arbitration and FIFO Control */
+        s->tpafcr = value;
+        break;
+    case FTGMAC100_FCR: /* Flow Control  */
+        s->fcr  = value;
+        break;
+
+    case FTGMAC100_HPTXPD: /* High Priority Transmit Poll Demand */
+    case FTGMAC100_HPTXR_BADR: /* High Priority Transmit Ring Base Address */
+    case FTGMAC100_MACSR: /* MAC Status Register (MACSR) */
+        qemu_log_mask(LOG_UNIMP, "%s: write to unimplemented register 0x%"
+                      HWADDR_PRIx "\n", __func__, addr);
+        break;
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad address at offset 0x%"
+                      HWADDR_PRIx "\n", __func__, addr);
+        break;
+    }
+
+    ftgmac100_update_irq(s);
+}
+
+static int ftgmac100_filter(FTGMAC100State *s, const uint8_t *buf, size_t len)
+{
+    unsigned mcast_idx;
+
+    if (s->maccr & FTGMAC100_MACCR_RX_ALL) {
+        return 1;
+    }
+
+    switch (get_eth_packet_type(PKT_GET_ETH_HDR(buf))) {
+    case ETH_PKT_BCAST:
+        if (!(s->maccr & FTGMAC100_MACCR_RX_BROADPKT)) {
+            return 0;
+        }
+        break;
+    case ETH_PKT_MCAST:
+        if (!(s->maccr & FTGMAC100_MACCR_RX_MULTIPKT)) {
+            if (!(s->maccr & FTGMAC100_MACCR_HT_MULTI_EN)) {
+                return 0;
+            }
+
+            /* TODO: this does not seem to work for ftgmac100 */
+            mcast_idx = compute_mcast_idx(buf);
+            if (!(s->math[mcast_idx / 32] & (1 << (mcast_idx % 32)))) {
+                return 0;
+            }
+        }
+        break;
+    case ETH_PKT_UCAST:
+        if (memcmp(s->conf.macaddr.a, buf, 6)) {
+            return 0;
+        }
+        break;
+    }
+
+    return 1;
+}
+
+static ssize_t ftgmac100_receive(NetClientState *nc, const uint8_t *buf,
+                                 size_t len)
+{
+    FTGMAC100State *s = FTGMAC100(qemu_get_nic_opaque(nc));
+    FTGMAC100Desc bd;
+    uint32_t flags = 0;
+    uint32_t addr;
+    uint32_t crc;
+    uint32_t buf_addr;
+    uint8_t *crc_ptr;
+    uint32_t buf_len;
+    size_t size = len;
+    uint32_t first = FTGMAC100_RXDES0_FRS;
+    int max_frame_size = ftgmac100_max_frame_size(s);
+
+    if ((s->maccr & (FTGMAC100_MACCR_RXDMA_EN | FTGMAC100_MACCR_RXMAC_EN))
+         != (FTGMAC100_MACCR_RXDMA_EN | FTGMAC100_MACCR_RXMAC_EN)) {
+        return -1;
+    }
+
+    /* TODO : Pad to minimum Ethernet frame length */
+    /* handle small packets.  */
+    if (size < 10) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: dropped frame of %zd bytes\n",
+                      __func__, size);
+        return size;
+    }
+
+    if (size < 64 && !(s->maccr & FTGMAC100_MACCR_RX_RUNT)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: dropped runt frame of %zd bytes\n",
+                      __func__, size);
+        return size;
+    }
+
+    if (!ftgmac100_filter(s, buf, size)) {
+        return size;
+    }
+
+    /* 4 bytes for the CRC.  */
+    size += 4;
+    crc = cpu_to_be32(crc32(~0, buf, size));
+    crc_ptr = (uint8_t *) &crc;
+
+    /* Huge frames are truncated.  */
+    if (size > max_frame_size) {
+        size = max_frame_size;
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: frame too big : %zd bytes\n",
+                      __func__, size);
+        flags |= FTGMAC100_RXDES0_FTL;
+    }
+
+    switch (get_eth_packet_type(PKT_GET_ETH_HDR(buf))) {
+    case ETH_PKT_BCAST:
+        flags |= FTGMAC100_RXDES0_BROADCAST;
+        break;
+    case ETH_PKT_MCAST:
+        flags |= FTGMAC100_RXDES0_MULTICAST;
+        break;
+    case ETH_PKT_UCAST:
+        break;
+    }
+
+    addr = s->rx_descriptor;
+    while (size > 0) {
+        if (!ftgmac100_can_receive(nc)) {
+            qemu_log_mask(LOG_GUEST_ERROR, "%s: Unexpected packet\n", __func__);
+            return -1;
+        }
+
+        if (ftgmac100_read_bd(&bd, addr) ||
+            (bd.des0 & FTGMAC100_RXDES0_RXPKT_RDY)) {
+            /* No descriptors available.  Bail out.  */
+            qemu_log_mask(LOG_GUEST_ERROR, "%s: Lost end of frame\n",
+                          __func__);
+            s->isr |= FTGMAC100_INT_NO_RXBUF;
+            break;
+        }
+        buf_len = (size <= s->rbsr) ? size : s->rbsr;
+        bd.des0 |= buf_len & 0x3fff;
+        size -= buf_len;
+
+        /* The last 4 bytes are the CRC.  */
+        if (size < 4) {
+            buf_len += size - 4;
+        }
+        buf_addr = bd.des3;
+        dma_memory_write(&address_space_memory, buf_addr, buf, buf_len);
+        buf += buf_len;
+        if (size < 4) {
+            dma_memory_write(&address_space_memory, buf_addr + buf_len,
+                             crc_ptr, 4 - size);
+            crc_ptr += 4 - size;
+        }
+
+        bd.des0 |= first | FTGMAC100_RXDES0_RXPKT_RDY;
+        first = 0;
+        if (size == 0) {
+            /* Last buffer in frame.  */
+            bd.des0 |= flags | FTGMAC100_RXDES0_LRS;
+            s->isr |= FTGMAC100_INT_RPKT_BUF;
+        } else {
+            s->isr |= FTGMAC100_INT_RPKT_FIFO;
+        }
+        ftgmac100_write_bd(&bd, addr);
+        if (bd.des0 & FTGMAC100_RXDES0_EDORR) {
+            addr = s->rx_ring;
+        } else {
+            addr += sizeof(FTGMAC100Desc);
+        }
+    }
+    s->rx_descriptor = addr;
+
+    ftgmac100_update_irq(s);
+    return len;
+}
+
+static const MemoryRegionOps ftgmac100_ops = {
+    .read = ftgmac100_read,
+    .write = ftgmac100_write,
+    .valid.min_access_size = 4,
+    .valid.max_access_size = 4,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+};
+
+static void ftgmac100_cleanup(NetClientState *nc)
+{
+    FTGMAC100State *s = FTGMAC100(qemu_get_nic_opaque(nc));
+
+    s->nic = NULL;
+}
+
+static NetClientInfo net_ftgmac100_info = {
+    .type = NET_CLIENT_DRIVER_NIC,
+    .size = sizeof(NICState),
+    .can_receive = ftgmac100_can_receive,
+    .receive = ftgmac100_receive,
+    .cleanup = ftgmac100_cleanup,
+    .link_status_changed = ftgmac100_set_link,
+};
+
+static void ftgmac100_realize(DeviceState *dev, Error **errp)
+{
+    FTGMAC100State *s = FTGMAC100(dev);
+    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
+
+    memory_region_init_io(&s->iomem, OBJECT(dev), &ftgmac100_ops, s,
+                          TYPE_FTGMAC100, 0x2000);
+    sysbus_init_mmio(sbd, &s->iomem);
+    sysbus_init_irq(sbd, &s->irq);
+    qemu_macaddr_default_if_unset(&s->conf.macaddr);
+
+    s->conf.peers.ncs[0] = nd_table[0].netdev;
+
+    s->nic = qemu_new_nic(&net_ftgmac100_info, &s->conf,
+                          object_get_typename(OBJECT(dev)), DEVICE(dev)->id,
+                          s);
+    qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
+
+    s->frame = g_malloc(FTGMAC100_MAX_FRAME_SIZE);
+}
+
+static const VMStateDescription vmstate_ftgmac100 = {
+    .name = TYPE_FTGMAC100,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32(irq_state, FTGMAC100State),
+        VMSTATE_UINT32(isr, FTGMAC100State),
+        VMSTATE_UINT32(ier, FTGMAC100State),
+        VMSTATE_UINT32(rx_enabled, FTGMAC100State),
+        VMSTATE_UINT32(rx_ring, FTGMAC100State),
+        VMSTATE_UINT32(rbsr, FTGMAC100State),
+        VMSTATE_UINT32(tx_ring, FTGMAC100State),
+        VMSTATE_UINT32(rx_descriptor, FTGMAC100State),
+        VMSTATE_UINT32(tx_descriptor, FTGMAC100State),
+        VMSTATE_UINT32_ARRAY(math, FTGMAC100State, 2),
+        VMSTATE_UINT32(itc, FTGMAC100State),
+        VMSTATE_UINT32(aptcr, FTGMAC100State),
+        VMSTATE_UINT32(dblac, FTGMAC100State),
+        VMSTATE_UINT32(revr, FTGMAC100State),
+        VMSTATE_UINT32(fear1, FTGMAC100State),
+        VMSTATE_UINT32(tpafcr, FTGMAC100State),
+        VMSTATE_UINT32(maccr, FTGMAC100State),
+        VMSTATE_UINT32(phycr, FTGMAC100State),
+        VMSTATE_UINT32(phydata, FTGMAC100State),
+        VMSTATE_UINT32(fcr, FTGMAC100State),
+        VMSTATE_UINT32(phy_status, FTGMAC100State),
+        VMSTATE_UINT32(phy_control, FTGMAC100State),
+        VMSTATE_UINT32(phy_advertise, FTGMAC100State),
+        VMSTATE_UINT32(phy_int, FTGMAC100State),
+        VMSTATE_UINT32(phy_int_mask, FTGMAC100State),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static Property ftgmac100_properties[] = {
+    DEFINE_NIC_PROPERTIES(FTGMAC100State, conf),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void ftgmac100_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+
+    dc->vmsd = &vmstate_ftgmac100;
+    dc->reset = ftgmac100_reset;
+    dc->props = ftgmac100_properties;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
+    dc->realize = ftgmac100_realize;
+    dc->desc = "Faraday FTGMAC100 Gigabit Ethernet emulation";
+}
+
+static const TypeInfo ftgmac100_info = {
+    .name = TYPE_FTGMAC100,
+    .parent = TYPE_SYS_BUS_DEVICE,
+    .instance_size = sizeof(FTGMAC100State),
+    .class_init = ftgmac100_class_init,
+};
+
+static void ftgmac100_register_types(void)
+{
+    type_register_static(&ftgmac100_info);
+}
+
+type_init(ftgmac100_register_types)
diff --git a/include/hw/net/ftgmac100.h b/include/hw/net/ftgmac100.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/include/hw/net/ftgmac100.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Faraday FTGMAC100 Gigabit Ethernet
+ *
+ * Copyright (C) 2016-2017, IBM Corporation.
+ *
+ * This code is licensed under the GPL version 2 or later. See the
+ * COPYING file in the top-level directory.
+ */
+
+#ifndef FTGMAC100_H
+#define FTGMAC100_H
+
+#define TYPE_FTGMAC100 "ftgmac100"
+#define FTGMAC100(obj) OBJECT_CHECK(FTGMAC100State, (obj), TYPE_FTGMAC100)
+
+#include "hw/sysbus.h"
+#include "net/net.h"
+
+typedef struct FTGMAC100State {
+    /*< private >*/
+    SysBusDevice parent_obj;
+
+    /*< public >*/
+    NICState *nic;
+    NICConf conf;
+    qemu_irq irq;
+    MemoryRegion iomem;
+
+    uint8_t *frame;
+
+    uint32_t irq_state;
+    uint32_t isr;
+    uint32_t ier;
+    uint32_t rx_enabled;
+    uint32_t rx_ring;
+    uint32_t rx_descriptor;
+    uint32_t tx_ring;
+    uint32_t tx_descriptor;
+    uint32_t math[2];
+    uint32_t rbsr;
+    uint32_t itc;
+    uint32_t aptcr;
+    uint32_t dblac;
+    uint32_t revr;
+    uint32_t fear1;
+    uint32_t tpafcr;
+    uint32_t maccr;
+    uint32_t phycr;
+    uint32_t phydata;
+    uint32_t fcr;
+
+
+    uint32_t phy_status;
+    uint32_t phy_control;
+    uint32_t phy_advertise;
+    uint32_t phy_int;
+    uint32_t phy_int_mask;
+} FTGMAC100State;
+
+#endif
-- 
2.7.4

From: Cédric Le Goater <clg@kaod.org>

The Aspeed SoCs have a different definition of the end of the ring
buffer bit. Add a property to specify which set of bits should be used
by the NIC.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/ftgmac100.c         | 17 +++++++++++++++--
 include/hw/net/ftgmac100.h |  4 ++++
 2 files changed, 19 insertions(+), 2 deletions(-)

diff --git a/hw/net/ftgmac100.c b/hw/net/ftgmac100.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/ftgmac100.c
+++ b/hw/net/ftgmac100.c
@@ -XXX,XX +XXX,XX @@
 #define FTGMAC100_TXDES0_CRC_ERR         (1 << 19)
 #define FTGMAC100_TXDES0_LTS             (1 << 28)
 #define FTGMAC100_TXDES0_FTS             (1 << 29)
+#define FTGMAC100_TXDES0_EDOTR_ASPEED    (1 << 30)
 #define FTGMAC100_TXDES0_TXDMA_OWN       (1 << 31)
 
 #define FTGMAC100_TXDES1_VLANTAG_CI(x)   ((x) & 0xffff)
@@ -XXX,XX +XXX,XX @@
 #define FTGMAC100_RXDES0_PAUSE_FRAME     (1 << 25)
 #define FTGMAC100_RXDES0_LRS             (1 << 28)
 #define FTGMAC100_RXDES0_FRS             (1 << 29)
+#define FTGMAC100_RXDES0_EDORR_ASPEED    (1 << 30)
 #define FTGMAC100_RXDES0_RXPKT_RDY       (1 << 31)
 
 #define FTGMAC100_RXDES1_VLANTAG_CI      0xffff
@@ -XXX,XX +XXX,XX @@ static void ftgmac100_do_tx(FTGMAC100State *s, uint32_t tx_ring,
         /* Write back the modified descriptor.  */
         ftgmac100_write_bd(&bd, addr);
         /* Advance to the next descriptor.  */
-        if (bd.des0 & FTGMAC100_TXDES0_EDOTR) {
+        if (bd.des0 & s->txdes0_edotr) {
             addr = tx_ring;
         } else {
             addr += sizeof(FTGMAC100Desc);
@@ -XXX,XX +XXX,XX @@ static ssize_t ftgmac100_receive(NetClientState *nc, const uint8_t *buf,
             s->isr |= FTGMAC100_INT_RPKT_FIFO;
         }
         ftgmac100_write_bd(&bd, addr);
-        if (bd.des0 & FTGMAC100_RXDES0_EDORR) {
+        if (bd.des0 & s->rxdes0_edorr) {
             addr = s->rx_ring;
         } else {
             addr += sizeof(FTGMAC100Desc);
@@ -XXX,XX +XXX,XX @@ static void ftgmac100_realize(DeviceState *dev, Error **errp)
     FTGMAC100State *s = FTGMAC100(dev);
     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
 
+    if (s->aspeed) {
+        s->txdes0_edotr = FTGMAC100_TXDES0_EDOTR_ASPEED;
+        s->rxdes0_edorr = FTGMAC100_RXDES0_EDORR_ASPEED;
+    } else {
+        s->txdes0_edotr = FTGMAC100_TXDES0_EDOTR;
+        s->rxdes0_edorr = FTGMAC100_RXDES0_EDORR;
+    }
+
     memory_region_init_io(&s->iomem, OBJECT(dev), &ftgmac100_ops, s,
                           TYPE_FTGMAC100, 0x2000);
     sysbus_init_mmio(sbd, &s->iomem);
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_ftgmac100 = {
         VMSTATE_UINT32(phy_advertise, FTGMAC100State),
         VMSTATE_UINT32(phy_int, FTGMAC100State),
         VMSTATE_UINT32(phy_int_mask, FTGMAC100State),
+        VMSTATE_UINT32(txdes0_edotr, FTGMAC100State),
+        VMSTATE_UINT32(rxdes0_edorr, FTGMAC100State),
         VMSTATE_END_OF_LIST()
     }
 };
 
 static Property ftgmac100_properties[] = {
+    DEFINE_PROP_BOOL("aspeed", FTGMAC100State, aspeed, false),
     DEFINE_NIC_PROPERTIES(FTGMAC100State, conf),
     DEFINE_PROP_END_OF_LIST(),
 };
diff --git a/include/hw/net/ftgmac100.h b/include/hw/net/ftgmac100.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/net/ftgmac100.h
+++ b/include/hw/net/ftgmac100.h
@@ -XXX,XX +XXX,XX @@ typedef struct FTGMAC100State {
     uint32_t phy_advertise;
     uint32_t phy_int;
     uint32_t phy_int_mask;
+
+    bool aspeed;
+    uint32_t txdes0_edotr;
+    uint32_t rxdes0_edorr;
 } FTGMAC100State;
 
 #endif
-- 
2.7.4

From: Cédric Le Goater <clg@kaod.org>

There is a second NIC but we do not use it for the moment. We use the
'aspeed' property to tune the definition of the end of ring buffer bit
for the Aspeed SoCs.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/arm/aspeed_soc.c         | 21 +++++++++++++++++++++
 include/hw/arm/aspeed_soc.h |  2 ++
 2 files changed, 23 insertions(+)

diff --git a/hw/arm/aspeed_soc.c b/hw/arm/aspeed_soc.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/arm/aspeed_soc.c
+++ b/hw/arm/aspeed_soc.c
@@ -XXX,XX +XXX,XX @@
 #include "hw/char/serial.h"
 #include "qemu/log.h"
 #include "hw/i2c/aspeed_i2c.h"
+#include "net/net.h"
 
 #define ASPEED_SOC_UART_5_BASE      0x00184000
 #define ASPEED_SOC_IOMEM_SIZE       0x00200000
@@ -XXX,XX +XXX,XX @@
 #define ASPEED_SOC_TIMER_BASE       0x1E782000
 #define ASPEED_SOC_WDT_BASE         0x1E785000
 #define ASPEED_SOC_I2C_BASE         0x1E78A000
+#define ASPEED_SOC_ETH1_BASE        0x1E660000
+#define ASPEED_SOC_ETH2_BASE        0x1E680000
 
 static const int uart_irqs[] = { 9, 32, 33, 34, 10 };
 static const int timer_irqs[] = { 16, 17, 18, 35, 36, 37, 38, 39, };
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_init(Object *obj)
     object_initialize(&s->wdt, sizeof(s->wdt), TYPE_ASPEED_WDT);
     object_property_add_child(obj, "wdt", OBJECT(&s->wdt), NULL);
     qdev_set_parent_bus(DEVICE(&s->wdt), sysbus_get_default());
+
+    object_initialize(&s->ftgmac100, sizeof(s->ftgmac100), TYPE_FTGMAC100);
+    object_property_add_child(obj, "ftgmac100", OBJECT(&s->ftgmac100), NULL);
+    qdev_set_parent_bus(DEVICE(&s->ftgmac100), sysbus_get_default());
 }
 
 static void aspeed_soc_realize(DeviceState *dev, Error **errp)
@@ -XXX,XX +XXX,XX @@ static void aspeed_soc_realize(DeviceState *dev, Error **errp)
         return;
     }
     sysbus_mmio_map(SYS_BUS_DEVICE(&s->wdt), 0, ASPEED_SOC_WDT_BASE);
+
+    /* Net */
+    qdev_set_nic_properties(DEVICE(&s->ftgmac100), &nd_table[0]);
+    object_property_set_bool(OBJECT(&s->ftgmac100), true, "aspeed", &err);
+    object_property_set_bool(OBJECT(&s->ftgmac100), true, "realized",
+                             &local_err);
+    error_propagate(&err, local_err);
+    if (err) {
+        error_propagate(errp, err);
+        return;
+    }
+    sysbus_mmio_map(SYS_BUS_DEVICE(&s->ftgmac100), 0, ASPEED_SOC_ETH1_BASE);
+    sysbus_connect_irq(SYS_BUS_DEVICE(&s->ftgmac100), 0,
+                       qdev_get_gpio_in(DEVICE(&s->vic), 2));
 }
 
 static void aspeed_soc_class_init(ObjectClass *oc, void *data)
diff --git a/include/hw/arm/aspeed_soc.h b/include/hw/arm/aspeed_soc.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/arm/aspeed_soc.h
+++ b/include/hw/arm/aspeed_soc.h
@@ -XXX,XX +XXX,XX @@
 #include "hw/i2c/aspeed_i2c.h"
 #include "hw/ssi/aspeed_smc.h"
 #include "hw/watchdog/wdt_aspeed.h"
+#include "hw/net/ftgmac100.h"
 
 #define ASPEED_SPIS_NUM  2
 
@@ -XXX,XX +XXX,XX @@ typedef struct AspeedSoCState {
     AspeedSMCState spi[ASPEED_SPIS_NUM];
     AspeedSDMCState sdmc;
     AspeedWDTState wdt;
+    FTGMAC100State ftgmac100;
 } AspeedSoCState;
 
 #define TYPE_ASPEED_SOC "aspeed-soc"
-- 
2.7.4

From: Cédric Le Goater <clg@kaod.org>

NC-SI (Network Controller Sideband Interface) enables a BMC to manage
a set of NICs on a system. This model takes the simplest approach and
reverses the NC-SI packets to pretend a NIC is present and exercise
the Linux driver.

The NCSI header file <ncsi-pkt.h> comes from mainline Linux and was
untabified.

Signed-off-by: Cédric Le Goater <clg@kaod.org>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Acked-by: Samuel Thibault <samuel.thibault@ens-lyon.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 include/net/eth.h   |   1 +
 slirp/Makefile.objs |   2 +-
 slirp/ncsi-pkt.h    | 419 ++++++++++++++++++++++++++++++++++++++++++++++++++++
 slirp/ncsi.c        | 130 ++++++++++++++++
 slirp/slirp.c       |   4 +
 slirp/slirp.h       |   3 +
 6 files changed, 558 insertions(+), 1 deletion(-)
 create mode 100644 slirp/ncsi-pkt.h
 create mode 100644 slirp/ncsi.c

diff --git a/include/net/eth.h b/include/net/eth.h
index XXXXXXX..XXXXXXX 100644
--- a/include/net/eth.h
+++ b/include/net/eth.h
@@ -XXX,XX +XXX,XX @@ struct tcp_hdr {
 #define ETH_P_IPV6                (0x86dd)
 #define ETH_P_VLAN                (0x8100)
 #define ETH_P_DVLAN               (0x88a8)
+#define ETH_P_NCSI                (0x88f8)
 #define ETH_P_UNKNOWN             (0xffff)
 #define VLAN_VID_MASK             0x0fff
 #define IP_HEADER_VERSION_4       (4)
diff --git a/slirp/Makefile.objs b/slirp/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/slirp/Makefile.objs
+++ b/slirp/Makefile.objs
@@ -XXX,XX +XXX,XX @@ common-obj-y = cksum.o if.o ip_icmp.o ip6_icmp.o ip6_input.o ip6_output.o \
                ip_input.o ip_output.o dnssearch.o dhcpv6.o
 common-obj-y += slirp.o mbuf.o misc.o sbuf.o socket.o tcp_input.o tcp_output.o
 common-obj-y += tcp_subr.o tcp_timer.o udp.o udp6.o bootp.o tftp.o arp_table.o \
-                ndp_table.o
+                ndp_table.o ncsi.o
diff --git a/slirp/ncsi-pkt.h b/slirp/ncsi-pkt.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/slirp/ncsi-pkt.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * Copyright Gavin Shan, IBM Corporation 2016.
+ *
+ * This program is free software; you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation; either version 2 of the License, or
+ * (at your option) any later version.
+ */
+
+#ifndef NCSI_PKT_H
+#define NCSI_PKT_H
+
+/* from linux/net/ncsi/ncsi-pkt.h */
+#define __be32 uint32_t
+#define __be16 uint16_t
+
+struct ncsi_pkt_hdr {
+        unsigned char mc_id;        /* Management controller ID */
+        unsigned char revision;     /* NCSI version - 0x01      */
+        unsigned char reserved;     /* Reserved                 */
+        unsigned char id;           /* Packet sequence number   */
+        unsigned char type;         /* Packet type              */
+        unsigned char channel;      /* Network controller ID    */
+        __be16        length;       /* Payload length           */
+        __be32        reserved1[2]; /* Reserved                 */
+};
+
+struct ncsi_cmd_pkt_hdr {
+        struct ncsi_pkt_hdr common; /* Common NCSI packet header */
+};
+
+struct ncsi_rsp_pkt_hdr {
+        struct ncsi_pkt_hdr common; /* Common NCSI packet header */
+        __be16              code;   /* Response code             */
+        __be16              reason; /* Response reason           */
+};
+
+struct ncsi_aen_pkt_hdr {
+        struct ncsi_pkt_hdr common;       /* Common NCSI packet header */
+        unsigned char       reserved2[3]; /* Reserved                  */
+        unsigned char       type;         /* AEN packet type           */
+};
+
+/* NCSI common command packet */
+struct ncsi_cmd_pkt {
+        struct ncsi_cmd_pkt_hdr cmd;      /* Command header */
+        __be32                  checksum; /* Checksum       */
+        unsigned char           pad[26];
+};
+
+struct ncsi_rsp_pkt {
+        struct ncsi_rsp_pkt_hdr rsp;      /* Response header */
+        __be32                  checksum; /* Checksum        */
+        unsigned char           pad[22];
+};
+
+/* Select Package */
+struct ncsi_cmd_sp_pkt {
+        struct ncsi_cmd_pkt_hdr cmd;            /* Command header */
+        unsigned char           reserved[3];    /* Reserved       */
+        unsigned char           hw_arbitration; /* HW arbitration */
+        __be32                  checksum;       /* Checksum       */
+        unsigned char           pad[22];
+};
+
+/* Disable Channel */
+struct ncsi_cmd_dc_pkt {
+        struct ncsi_cmd_pkt_hdr cmd;         /* Command header  */
+        unsigned char           reserved[3]; /* Reserved        */
+        unsigned char           ald;         /* Allow link down */
+        __be32                  checksum;    /* Checksum        */
+        unsigned char           pad[22];
+};
+
+/* Reset Channel */
+struct ncsi_cmd_rc_pkt {
+        struct ncsi_cmd_pkt_hdr cmd;      /* Command header */
+        __be32                  reserved; /* Reserved       */
+        __be32                  checksum; /* Checksum       */
+        unsigned char           pad[22];
+};
+
+/* AEN Enable */
+struct ncsi_cmd_ae_pkt {
+        struct ncsi_cmd_pkt_hdr cmd;         /* Command header   */
+        unsigned char           reserved[3]; /* Reserved         */
+        unsigned char           mc_id;       /* MC ID            */
+        __be32                  mode;        /* AEN working mode */
+        __be32                  checksum;    /* Checksum         */
+        unsigned char           pad[18];
+};
+
+/* Set Link */
+struct ncsi_cmd_sl_pkt {
+        struct ncsi_cmd_pkt_hdr cmd;      /* Command header    */
+        __be32                  mode;     /* Link working mode */
+        __be32                  oem_mode; /* OEM link mode     */
+        __be32                  checksum; /* Checksum          */
+        unsigned char           pad[18];
+};
+
+/* Set VLAN Filter */
+struct ncsi_cmd_svf_pkt {
+        struct ncsi_cmd_pkt_hdr cmd;       /* Command header    */
+        __be16                  reserved;  /* Reserved          */
+        __be16                  vlan;      /* VLAN ID           */
+        __be16                  reserved1; /* Reserved          */
+        unsigned char           index;     /* VLAN table index  */
+        unsigned char           enable;    /* Enable or disable */
+        __be32                  checksum;  /* Checksum          */
+        unsigned char           pad[14];
+};
+
+/* Enable VLAN */
+struct ncsi_cmd_ev_pkt {
+        struct ncsi_cmd_pkt_hdr cmd;         /* Command header   */
+        unsigned char           reserved[3]; /* Reserved         */
+        unsigned char           mode;        /* VLAN filter mode */
+        __be32                  checksum;    /* Checksum         */
+        unsigned char           pad[22];
+};
+
+/* Set MAC Address */
+struct ncsi_cmd_sma_pkt {
+        struct ncsi_cmd_pkt_hdr cmd;      /* Command header          */
+        unsigned char           mac[6];   /* MAC address             */
+        unsigned char           index;    /* MAC table index         */
+        unsigned char           at_e;     /* Addr type and operation */
+        __be32                  checksum; /* Checksum                */
+        unsigned char           pad[18];
+};
+
+/* Enable Broadcast Filter */
+struct ncsi_cmd_ebf_pkt {
+        struct ncsi_cmd_pkt_hdr cmd;      /* Command header */
+        __be32                  mode;     /* Filter mode    */
+        __be32                  checksum; /* Checksum       */
+        unsigned char           pad[22];
+};
+
+/* Enable Global Multicast Filter */
+struct ncsi_cmd_egmf_pkt {
+        struct ncsi_cmd_pkt_hdr cmd;      /* Command header */
+        __be32                  mode;     /* Global MC mode */
+        __be32                  checksum; /* Checksum       */
+        unsigned char           pad[22];
+};
+
+/* Set NCSI Flow Control */
+struct ncsi_cmd_snfc_pkt {
+        struct ncsi_cmd_pkt_hdr cmd;         /* Command header    */
+        unsigned char           reserved[3]; /* Reserved          */
+        unsigned char           mode;        /* Flow control mode */
+        __be32                  checksum;    /* Checksum          */
+        unsigned char           pad[22];
+};
+
+/* Get Link Status */
+struct ncsi_rsp_gls_pkt {
+        struct ncsi_rsp_pkt_hdr rsp;        /* Response header   */
+        __be32                  status;     /* Link status       */
+        __be32                  other;      /* Other indications */
+        __be32                  oem_status; /* OEM link status   */
+        __be32                  checksum;
+        unsigned char           pad[10];
+};
+
+/* Get Version ID */
+struct ncsi_rsp_gvi_pkt {
+        struct ncsi_rsp_pkt_hdr rsp;          /* Response header */
+        __be32                  ncsi_version; /* NCSI version    */
+        unsigned char           reserved[3];  /* Reserved        */
+        unsigned char           alpha2;       /* NCSI version    */
+        unsigned char           fw_name[12];  /* f/w name string */
+        __be32                  fw_version;   /* f/w version     */
+        __be16                  pci_ids[4];   /* PCI IDs         */
+        __be32                  mf_id;        /* Manufacture ID  */
+        __be32                  checksum;
+};
+
+/* Get Capabilities */
+struct ncsi_rsp_gc_pkt {
+        struct ncsi_rsp_pkt_hdr rsp;         /* Response header   */
+        __be32                  cap;         /* Capabilities      */
+        __be32                  bc_cap;      /* Broadcast cap     */
+        __be32                  mc_cap;      /* Multicast cap     */
+        __be32                  buf_cap;     /* Buffering cap     */
+        __be32                  aen_cap;     /* AEN cap           */
+        unsigned char           vlan_cnt;    /* VLAN filter count */
+        unsigned char           mixed_cnt;   /* Mix filter count  */
+        unsigned char           mc_cnt;      /* MC filter count   */
+        unsigned char           uc_cnt;      /* UC filter count   */
+        unsigned char           reserved[2]; /* Reserved          */
+        unsigned char           vlan_mode;   /* VLAN mode         */
+        unsigned char           channel_cnt; /* Channel count     */
+        __be32                  checksum;    /* Checksum          */
+};
+
+/* Get Parameters */
+struct ncsi_rsp_gp_pkt {
+        struct ncsi_rsp_pkt_hdr rsp;          /* Response header       */
+        unsigned char           mac_cnt;      /* Number of MAC addr    */
+        unsigned char           reserved[2];  /* Reserved              */
+        unsigned char           mac_enable;   /* MAC addr enable flags */
+        unsigned char           vlan_cnt;     /* VLAN tag count        */
+        unsigned char           reserved1;    /* Reserved              */
+        __be16                  vlan_enable;  /* VLAN tag enable flags */
+        __be32                  link_mode;    /* Link setting          */
+        __be32                  bc_mode;      /* BC filter mode        */
+        __be32                  valid_modes;  /* Valid mode parameters */
+        unsigned char           vlan_mode;    /* VLAN mode             */
+        unsigned char           fc_mode;      /* Flow control mode     */
+        unsigned char           reserved2[2]; /* Reserved              */
+        __be32                  aen_mode;     /* AEN mode              */
+        unsigned char           mac[6];       /* Supported MAC addr    */
+        __be16                  vlan;         /* Supported VLAN tags   */
+        __be32                  checksum;     /* Checksum              */
+};
+
+/* Get Controller Packet Statistics */
+struct ncsi_rsp_gcps_pkt {
+        struct ncsi_rsp_pkt_hdr rsp;            /* Response header            */
+        __be32                  cnt_hi;         /* Counter cleared            */
+        __be32                  cnt_lo;         /* Counter cleared            */
+        __be32                  rx_bytes;       /* Rx bytes                   */
+        __be32                  tx_bytes;       /* Tx bytes                   */
+        __be32                  rx_uc_pkts;     /* Rx UC packets              */
+        __be32                  rx_mc_pkts;     /* Rx MC packets              */
+        __be32                  rx_bc_pkts;     /* Rx BC packets              */
+        __be32                  tx_uc_pkts;     /* Tx UC packets              */
+        __be32                  tx_mc_pkts;     /* Tx MC packets              */
+        __be32                  tx_bc_pkts;     /* Tx BC packets              */
+        __be32                  fcs_err;        /* FCS errors                 */
+        __be32                  align_err;      /* Alignment errors           */
+        __be32                  false_carrier;  /* False carrier detection    */
+        __be32                  runt_pkts;      /* Rx runt packets            */
+        __be32                  jabber_pkts;    /* Rx jabber packets          */
+        __be32                  rx_pause_xon;   /* Rx pause XON frames        */
+        __be32                  rx_pause_xoff;  /* Rx XOFF frames             */
+        __be32                  tx_pause_xon;   /* Tx XON frames              */
+        __be32                  tx_pause_xoff;  /* Tx XOFF frames             */
+        __be32                  tx_s_collision; /* Single collision frames    */
+        __be32                  tx_m_collision; /* Multiple collision frames  */
+        __be32                  l_collision;    /* Late collision frames      */
+        __be32                  e_collision;    /* Excessive collision frames */
+        __be32                  rx_ctl_frames;  /* Rx control frames          */
+        __be32                  rx_64_frames;   /* Rx 64-bytes frames         */
+        __be32                  rx_127_frames;  /* Rx 65-127 bytes frames     */
+        __be32                  rx_255_frames;  /* Rx 128-255 bytes frames    */
+        __be32                  rx_511_frames;  /* Rx 256-511 bytes frames    */
+        __be32                  rx_1023_frames; /* Rx 512-1023 bytes frames   */
+        __be32                  rx_1522_frames; /* Rx 1024-1522 bytes frames  */
+        __be32                  rx_9022_frames; /* Rx 1523-9022 bytes frames  */
+        __be32                  tx_64_frames;   /* Tx 64-bytes frames         */
+        __be32                  tx_127_frames;  /* Tx 65-127 bytes frames     */
+        __be32                  tx_255_frames;  /* Tx 128-255 bytes frames    */
+        __be32                  tx_511_frames;  /* Tx 256-511 bytes frames    */
+        __be32                  tx_1023_frames; /* Tx 512-1023 bytes frames   */
+        __be32                  tx_1522_frames; /* Tx 1024-1522 bytes frames  */
+        __be32                  tx_9022_frames; /* Tx 1523-9022 bytes frames  */
+        __be32                  rx_valid_bytes; /* Rx valid bytes             */
+        __be32                  rx_runt_pkts;   /* Rx error runt packets      */
+        __be32                  rx_jabber_pkts; /* Rx error jabber packets    */
+        __be32                  checksum;       /* Checksum                   */
+};
+
+/* Get NCSI Statistics */
+struct ncsi_rsp_gns_pkt {
+        struct ncsi_rsp_pkt_hdr rsp;           /* Response header         */
+        __be32                  rx_cmds;       /* Rx NCSI commands        */
+        __be32                  dropped_cmds;  /* Dropped commands        */
+        __be32                  cmd_type_errs; /* Command type errors     */
+        __be32                  cmd_csum_errs; /* Command checksum errors */
+        __be32                  rx_pkts;       /* Rx NCSI packets         */
+        __be32                  tx_pkts;       /* Tx NCSI packets         */
+        __be32                  tx_aen_pkts;   /* Tx AEN packets          */
+        __be32                  checksum;      /* Checksum                */
+};
+
+/* Get NCSI Pass-through Statistics */
+struct ncsi_rsp_gnpts_pkt {
+        struct ncsi_rsp_pkt_hdr rsp;            /* Response header     */
+        __be32                  tx_pkts;        /* Tx packets          */
+        __be32                  tx_dropped;     /* Tx dropped packets  */
+        __be32                  tx_channel_err; /* Tx channel errors   */
+        __be32                  tx_us_err;      /* Tx undersize errors */
+        __be32                  rx_pkts;        /* Rx packets          */
+        __be32                  rx_dropped;     /* Rx dropped packets  */
+        __be32                  rx_channel_err; /* Rx channel errors   */
+        __be32                  rx_us_err;      /* Rx undersize errors */
+        __be32                  rx_os_err;      /* Rx oversize errors  */
+        __be32                  checksum;       /* Checksum            */
+};
+
+/* Get package status */
+struct ncsi_rsp_gps_pkt {
+        struct ncsi_rsp_pkt_hdr rsp;      /* Response header             */
+        __be32                  status;   /* Hardware arbitration status */
+        __be32                  checksum;
+};
+
+/* Get package UUID */
+struct ncsi_rsp_gpuuid_pkt {
+        struct ncsi_rsp_pkt_hdr rsp;      /* Response header */
+        unsigned char           uuid[16]; /* UUID            */
+        __be32                  checksum;
+};
+
+/* AEN: Link State Change */
+struct ncsi_aen_lsc_pkt {
+        struct ncsi_aen_pkt_hdr aen;        /* AEN header      */
+        __be32                  status;     /* Link status     */
+        __be32                  oem_status; /* OEM link status */
+        __be32                  checksum;   /* Checksum        */
+        unsigned char           pad[14];
+};
+
+/* AEN: Configuration Required */
+struct ncsi_aen_cr_pkt {
+        struct ncsi_aen_pkt_hdr aen;      /* AEN header */
+        __be32                  checksum; /* Checksum   */
+        unsigned char           pad[22];
+};
+
+/* AEN: Host Network Controller Driver Status Change */
+struct ncsi_aen_hncdsc_pkt {
+        struct ncsi_aen_pkt_hdr aen;      /* AEN header */
+        __be32                  status;   /* Status     */
+        __be32                  checksum; /* Checksum   */
+        unsigned char           pad[18];
+};
+
+/* NCSI packet revision */
+#define NCSI_PKT_REVISION       0x01
+
+/* NCSI packet commands */
+#define NCSI_PKT_CMD_CIS        0x00 /* Clear Initial State              */
+#define NCSI_PKT_CMD_SP         0x01 /* Select Package                   */
+#define NCSI_PKT_CMD_DP         0x02 /* Deselect Package                 */
+#define NCSI_PKT_CMD_EC         0x03 /* Enable Channel                   */
+#define NCSI_PKT_CMD_DC         0x04 /* Disable Channel                  */
+#define NCSI_PKT_CMD_RC         0x05 /* Reset Channel                    */
+#define NCSI_PKT_CMD_ECNT       0x06 /* Enable Channel Network Tx        */
+#define NCSI_PKT_CMD_DCNT       0x07 /* Disable Channel Network Tx       */
+#define NCSI_PKT_CMD_AE         0x08 /* AEN Enable                       */
+#define NCSI_PKT_CMD_SL         0x09 /* Set Link                         */
+#define NCSI_PKT_CMD_GLS        0x0a /* Get Link                         */
+#define NCSI_PKT_CMD_SVF        0x0b /* Set VLAN Filter                  */
+#define NCSI_PKT_CMD_EV         0x0c /* Enable VLAN                      */
+#define NCSI_PKT_CMD_DV         0x0d /* Disable VLAN                     */
+#define NCSI_PKT_CMD_SMA        0x0e /* Set MAC address                  */
+#define NCSI_PKT_CMD_EBF        0x10 /* Enable Broadcast Filter          */
+#define NCSI_PKT_CMD_DBF        0x11 /* Disable Broadcast Filter         */
+#define NCSI_PKT_CMD_EGMF       0x12 /* Enable Global Multicast Filter   */
+#define NCSI_PKT_CMD_DGMF       0x13 /* Disable Global Multicast Filter  */
+#define NCSI_PKT_CMD_SNFC       0x14 /* Set NCSI Flow Control            */
+#define NCSI_PKT_CMD_GVI        0x15 /* Get Version ID                   */
+#define NCSI_PKT_CMD_GC         0x16 /* Get Capabilities                 */
+#define NCSI_PKT_CMD_GP         0x17 /* Get Parameters                   */
+#define NCSI_PKT_CMD_GCPS       0x18 /* Get Controller Packet Statistics */
+#define NCSI_PKT_CMD_GNS        0x19 /* Get NCSI Statistics              */
+#define NCSI_PKT_CMD_GNPTS      0x1a /* Get NCSI Pass-throu Statistics   */
+#define NCSI_PKT_CMD_GPS        0x1b /* Get package status               */
+#define NCSI_PKT_CMD_OEM        0x50 /* OEM                              */
+#define NCSI_PKT_CMD_PLDM       0x51 /* PLDM request over NCSI over RBT  */
+#define NCSI_PKT_CMD_GPUUID     0x52 /* Get package UUID                 */
+
+/* NCSI packet responses */
+#define NCSI_PKT_RSP_CIS        (NCSI_PKT_CMD_CIS    + 0x80)
+#define NCSI_PKT_RSP_SP         (NCSI_PKT_CMD_SP     + 0x80)
+#define NCSI_PKT_RSP_DP         (NCSI_PKT_CMD_DP     + 0x80)
+#define NCSI_PKT_RSP_EC         (NCSI_PKT_CMD_EC     + 0x80)
+#define NCSI_PKT_RSP_DC         (NCSI_PKT_CMD_DC     + 0x80)
+#define NCSI_PKT_RSP_RC         (NCSI_PKT_CMD_RC     + 0x80)
+#define NCSI_PKT_RSP_ECNT       (NCSI_PKT_CMD_ECNT   + 0x80)
+#define NCSI_PKT_RSP_DCNT       (NCSI_PKT_CMD_DCNT   + 0x80)
+#define NCSI_PKT_RSP_AE         (NCSI_PKT_CMD_AE     + 0x80)
+#define NCSI_PKT_RSP_SL         (NCSI_PKT_CMD_SL     + 0x80)
+#define NCSI_PKT_RSP_GLS        (NCSI_PKT_CMD_GLS    + 0x80)
+#define NCSI_PKT_RSP_SVF        (NCSI_PKT_CMD_SVF    + 0x80)
+#define NCSI_PKT_RSP_EV         (NCSI_PKT_CMD_EV     + 0x80)
+#define NCSI_PKT_RSP_DV         (NCSI_PKT_CMD_DV     + 0x80)
+#define NCSI_PKT_RSP_SMA        (NCSI_PKT_CMD_SMA    + 0x80)
+#define NCSI_PKT_RSP_EBF        (NCSI_PKT_CMD_EBF    + 0x80)
+#define NCSI_PKT_RSP_DBF        (NCSI_PKT_CMD_DBF    + 0x80)
+#define NCSI_PKT_RSP_EGMF       (NCSI_PKT_CMD_EGMF   + 0x80)
+#define NCSI_PKT_RSP_DGMF       (NCSI_PKT_CMD_DGMF   + 0x80)
+#define NCSI_PKT_RSP_SNFC       (NCSI_PKT_CMD_SNFC   + 0x80)
+#define NCSI_PKT_RSP_GVI        (NCSI_PKT_CMD_GVI    + 0x80)
+#define NCSI_PKT_RSP_GC         (NCSI_PKT_CMD_GC     + 0x80)
+#define NCSI_PKT_RSP_GP         (NCSI_PKT_CMD_GP     + 0x80)
+#define NCSI_PKT_RSP_GCPS       (NCSI_PKT_CMD_GCPS   + 0x80)
+#define NCSI_PKT_RSP_GNS        (NCSI_PKT_CMD_GNS    + 0x80)
+#define NCSI_PKT_RSP_GNPTS      (NCSI_PKT_CMD_GNPTS  + 0x80)
+#define NCSI_PKT_RSP_GPS        (NCSI_PKT_CMD_GPS    + 0x80)
+#define NCSI_PKT_RSP_OEM        (NCSI_PKT_CMD_OEM    + 0x80)
+#define NCSI_PKT_RSP_PLDM       (NCSI_PKT_CMD_PLDM   + 0x80)
+#define NCSI_PKT_RSP_GPUUID     (NCSI_PKT_CMD_GPUUID + 0x80)
+
+/* NCSI response code/reason */
+#define NCSI_PKT_RSP_C_COMPLETED        0x0000 /* Command Completed        */
+#define NCSI_PKT_RSP_C_FAILED           0x0001 /* Command Failed           */
+#define NCSI_PKT_RSP_C_UNAVAILABLE      0x0002 /* Command Unavailable      */
+#define NCSI_PKT_RSP_C_UNSUPPORTED      0x0003 /* Command Unsupported      */
+#define NCSI_PKT_RSP_R_NO_ERROR         0x0000 /* No Error                 */
+#define NCSI_PKT_RSP_R_INTERFACE        0x0001 /* Interface not ready      */
+#define NCSI_PKT_RSP_R_PARAM            0x0002 /* Invalid Parameter        */
+#define NCSI_PKT_RSP_R_CHANNEL          0x0003 /* Channel not Ready        */
+#define NCSI_PKT_RSP_R_PACKAGE          0x0004 /* Package not Ready        */
+#define NCSI_PKT_RSP_R_LENGTH           0x0005 /* Invalid payload length   */
+#define NCSI_PKT_RSP_R_UNKNOWN          0x7fff /* Command type unsupported */
+
+/* NCSI AEN packet type */
+#define NCSI_PKT_AEN            0xFF /* AEN Packet               */
+#define NCSI_PKT_AEN_LSC        0x00 /* Link status change       */
+#define NCSI_PKT_AEN_CR         0x01 /* Configuration required   */
+#define NCSI_PKT_AEN_HNCDSC     0x02 /* HNC driver status change */
+
+#endif /* NCSI_PKT_H */
diff --git a/slirp/ncsi.c b/slirp/ncsi.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/slirp/ncsi.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * NC-SI (Network Controller Sideband Interface) "echo" model
+ *
+ * Copyright (C) 2016 IBM Corp.
+ *
+ * This code is licensed under the GPL version 2 or later. See the
+ * COPYING file in the top-level directory.
+ */
+#include "qemu/osdep.h"
+#include "slirp.h"
+
+#include "ncsi-pkt.h"
+
+/* Get Capabilities */
+static int ncsi_rsp_handler_gc(struct ncsi_rsp_pkt_hdr *rnh)
+{
+    struct ncsi_rsp_gc_pkt *rsp = (struct ncsi_rsp_gc_pkt *) rnh;
+
+    rsp->cap = htonl(~0);
+    rsp->bc_cap = htonl(~0);
+    rsp->mc_cap = htonl(~0);
+    rsp->buf_cap = htonl(~0);
+    rsp->aen_cap = htonl(~0);
+    rsp->vlan_mode = 0xff;
+    rsp->uc_cnt = 2;
+    return 0;
+}
+
+/* Get Link status */
+static int ncsi_rsp_handler_gls(struct ncsi_rsp_pkt_hdr *rnh)
+{
+    struct ncsi_rsp_gls_pkt *rsp = (struct ncsi_rsp_gls_pkt *) rnh;
+
+    rsp->status = htonl(0x1);
+    return 0;
+}
+
+static const struct ncsi_rsp_handler {
+        unsigned char   type;
+        int             payload;
+        int             (*handler)(struct ncsi_rsp_pkt_hdr *rnh);
+} ncsi_rsp_handlers[] = {
+        { NCSI_PKT_RSP_CIS,     4, NULL },
+        { NCSI_PKT_RSP_SP,      4, NULL },
+        { NCSI_PKT_RSP_DP,      4, NULL },
+        { NCSI_PKT_RSP_EC,      4, NULL },
+        { NCSI_PKT_RSP_DC,      4, NULL },
+        { NCSI_PKT_RSP_RC,      4, NULL },
+        { NCSI_PKT_RSP_ECNT,    4, NULL },
+        { NCSI_PKT_RSP_DCNT,    4, NULL },
+        { NCSI_PKT_RSP_AE,      4, NULL },
+        { NCSI_PKT_RSP_SL,      4, NULL },
+        { NCSI_PKT_RSP_GLS,    16, ncsi_rsp_handler_gls },
+        { NCSI_PKT_RSP_SVF,     4, NULL },
+        { NCSI_PKT_RSP_EV,      4, NULL },
+        { NCSI_PKT_RSP_DV,      4, NULL },
+        { NCSI_PKT_RSP_SMA,     4, NULL },
+        { NCSI_PKT_RSP_EBF,     4, NULL },
+        { NCSI_PKT_RSP_DBF,     4, NULL },
+        { NCSI_PKT_RSP_EGMF,    4, NULL },
+        { NCSI_PKT_RSP_DGMF,    4, NULL },
+        { NCSI_PKT_RSP_SNFC,    4, NULL },
+        { NCSI_PKT_RSP_GVI,    36, NULL },
+        { NCSI_PKT_RSP_GC,     32, ncsi_rsp_handler_gc },
+        { NCSI_PKT_RSP_GP,     -1, NULL },
+        { NCSI_PKT_RSP_GCPS,  172, NULL },
+        { NCSI_PKT_RSP_GNS,   172, NULL },
+        { NCSI_PKT_RSP_GNPTS, 172, NULL },
+        { NCSI_PKT_RSP_GPS,     8, NULL },
+        { NCSI_PKT_RSP_OEM,     0, NULL },
+        { NCSI_PKT_RSP_PLDM,    0, NULL },
+        { NCSI_PKT_RSP_GPUUID, 20, NULL }
+};
+
+/*
+ * packet format : ncsi header + payload + checksum
+ */
+#define NCSI_MAX_PAYLOAD 172
+#define NCSI_MAX_LEN     (sizeof(struct ncsi_pkt_hdr) + NCSI_MAX_PAYLOAD + 4)
+
+void ncsi_input(Slirp *slirp, const uint8_t *pkt, int pkt_len)
+{
+    struct ncsi_pkt_hdr *nh = (struct ncsi_pkt_hdr *)(pkt + ETH_HLEN);
+    uint8_t ncsi_reply[ETH_HLEN + NCSI_MAX_LEN];
+    struct ethhdr *reh = (struct ethhdr *)ncsi_reply;
+    struct ncsi_rsp_pkt_hdr *rnh = (struct ncsi_rsp_pkt_hdr *)
+        (ncsi_reply + ETH_HLEN);
+    const struct ncsi_rsp_handler *handler = NULL;
+    int i;
+
+    memset(ncsi_reply, 0, sizeof(ncsi_reply));
+
+    memset(reh->h_dest, 0xff, ETH_ALEN);
+    memset(reh->h_source, 0xff, ETH_ALEN);
+    reh->h_proto = htons(ETH_P_NCSI);
+
+    for (i = 0; i < ARRAY_SIZE(ncsi_rsp_handlers); i++) {
+        if (ncsi_rsp_handlers[i].type == nh->type + 0x80) {
+            handler = &ncsi_rsp_handlers[i];
+            break;
+        }
+    }
+
+    rnh->common.mc_id      = nh->mc_id;
+    rnh->common.revision   = NCSI_PKT_REVISION;
+    rnh->common.id         = nh->id;
+    rnh->common.type       = nh->type + 0x80;
+    rnh->common.channel    = nh->channel;
+
+    if (handler) {
+        rnh->common.length = htons(handler->payload);
+        rnh->code          = htons(NCSI_PKT_RSP_C_COMPLETED);
+        rnh->reason        = htons(NCSI_PKT_RSP_R_NO_ERROR);
+
+        if (handler->handler) {
+            /* TODO: handle errors */
+            handler->handler(rnh);
+        }
+    } else {
+        rnh->common.length = 0;
+        rnh->code          = htons(NCSI_PKT_RSP_C_UNAVAILABLE);
+        rnh->reason        = htons(NCSI_PKT_RSP_R_UNKNOWN);
+    }
+
+    /* TODO: add a checksum at the end of the frame but the specs
+     * allows it to be zero */
+
+    slirp_output(slirp->opaque, ncsi_reply, ETH_HLEN + sizeof(*nh) +
+                 (handler ? handler->payload : 0) + 4);
+}
diff --git a/slirp/slirp.c b/slirp/slirp.c
index XXXXXXX..XXXXXXX 100644
--- a/slirp/slirp.c
+++ b/slirp/slirp.c
@@ -XXX,XX +XXX,XX @@ void slirp_input(Slirp *slirp, const uint8_t *pkt, int pkt_len)
         }
         break;
 
+    case ETH_P_NCSI:
+        ncsi_input(slirp, pkt, pkt_len);
+        break;
+
     default:
         break;
     }
diff --git a/slirp/slirp.h b/slirp/slirp.h
index XXXXXXX..XXXXXXX 100644
--- a/slirp/slirp.h
+++ b/slirp/slirp.h
@@ -XXX,XX +XXX,XX @@ extern Slirp *slirp_instance;
 
 void if_start(Slirp *);
 
+/* ncsi.c */
+void ncsi_input(Slirp *slirp, const uint8_t *pkt, int pkt_len);
+
 #ifndef _WIN32
 #include <netdb.h>
 #endif
-- 
2.7.4

From: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>

In this patch we support packet that have tcp options field.
Add tcp options field check, If the packet have options
field we just skip it and compare tcp payload,
Avoid unnecessary checkpoint, optimize performance.

Signed-off-by: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/colo-compare.c | 27 ++++++++++++++++++++++++++-
 1 file changed, 26 insertions(+), 1 deletion(-)

diff --git a/net/colo-compare.c b/net/colo-compare.c
index XXXXXXX..XXXXXXX 100644
--- a/net/colo-compare.c
+++ b/net/colo-compare.c
@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_tcp(Packet *spkt, Packet *ppkt)
         spkt->ip->ip_sum = ppkt->ip->ip_sum;
     }
 
-    if (ptcp->th_sum == stcp->th_sum) {
+    /*
+     * Check tcp header length for tcp option field.
+     * th_off > 5 means this tcp packet have options field.
+     * The tcp options maybe always different.
+     * for example:
+     * From RFC 7323.
+     * TCP Timestamps option (TSopt):
+     * Kind: 8
+     *
+     * Length: 10 bytes
+     *
+     *    +-------+-------+---------------------+---------------------+
+     *    |Kind=8 |  10   |   TS Value (TSval)  |TS Echo Reply (TSecr)|
+     *    +-------+-------+---------------------+---------------------+
+     *       1       1              4                     4
+     *
+     * In this case the primary guest's timestamp always different with
+     * the secondary guest's timestamp. COLO just focus on payload,
+     * so we just need skip this field.
+     */
+    if (ptcp->th_off > 5) {
+        ptrdiff_t tcp_offset;
+        tcp_offset = ppkt->transport_header - (uint8_t *)ppkt->data
+                     + (ptcp->th_off * 4);
+        res = colo_packet_compare_common(ppkt, spkt, tcp_offset);
+    } else if (ptcp->th_sum == stcp->th_sum) {
         res = colo_packet_compare_common(ppkt, spkt, ETH_HLEN);
     } else {
         res = -1;
-- 
2.7.4

From: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>

Optimize two trace events as one, adjust print format make
it easy to read. rename trace_colo_compare_pkt_info_src/dst
to trace_colo_compare_tcp_info.

Signed-off-by: Zhang Chen <zhangchen.fnst@cn.fujitsu.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/colo-compare.c | 29 +++++++++++++++++------------
 net/trace-events   |  3 +--
 2 files changed, 18 insertions(+), 14 deletions(-)

diff --git a/net/colo-compare.c b/net/colo-compare.c
index XXXXXXX..XXXXXXX 100644
--- a/net/colo-compare.c
+++ b/net/colo-compare.c
@@ -XXX,XX +XXX,XX @@ static int colo_packet_compare_tcp(Packet *spkt, Packet *ppkt)
         res = -1;
     }
 
-    if (res != 0 && trace_event_get_state(TRACE_COLO_COMPARE_MISCOMPARE)) {
-        trace_colo_compare_pkt_info_src(inet_ntoa(ppkt->ip->ip_src),
-                                        ntohl(stcp->th_seq),
-                                        ntohl(stcp->th_ack),
-                                        res, stcp->th_flags,
-                                        spkt->size);
-
-        trace_colo_compare_pkt_info_dst(inet_ntoa(ppkt->ip->ip_dst),
-                                        ntohl(ptcp->th_seq),
-                                        ntohl(ptcp->th_ack),
-                                        res, ptcp->th_flags,
-                                        ppkt->size);
+    if (res && trace_event_get_state(TRACE_COLO_COMPARE_MISCOMPARE)) {
+        char ip_src[20], ip_dst[20];
+
+        strcpy(ip_src, inet_ntoa(ppkt->ip->ip_src));
+        strcpy(ip_dst, inet_ntoa(ppkt->ip->ip_dst));
+
+        trace_colo_compare_tcp_info(ip_src,
+                                    ip_dst,
+                                    ntohl(ptcp->th_seq),
+                                    ntohl(stcp->th_seq),
+                                    ntohl(ptcp->th_ack),
+                                    ntohl(stcp->th_ack),
+                                    res,
+                                    ptcp->th_flags,
+                                    stcp->th_flags,
+                                    ppkt->size,
+                                    spkt->size);
 
         qemu_hexdump((char *)ppkt->data, stderr,
                      "colo-compare ppkt", ppkt->size);
diff --git a/net/trace-events b/net/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/net/trace-events
+++ b/net/trace-events
@@ -XXX,XX +XXX,XX @@ colo_compare_icmp_miscompare(const char *sta, int size) ": %s = %d"
 colo_compare_ip_info(int psize, const char *sta, const char *stb, int ssize, const char *stc, const char *std) "ppkt size = %d, ip_src = %s, ip_dst = %s, spkt size = %d, ip_src = %s, ip_dst = %s"
 colo_old_packet_check_found(int64_t old_time) "%" PRId64
 colo_compare_miscompare(void) ""
-colo_compare_pkt_info_src(const char *src, uint32_t sseq, uint32_t sack, int res, uint32_t sflag, int ssize) "src/dst: %s s: seq/ack=%u/%u res=%d flags=%x spkt_size: %d\n"
-colo_compare_pkt_info_dst(const char *dst, uint32_t dseq, uint32_t dack, int res, uint32_t dflag, int dsize) "src/dst: %s d: seq/ack=%u/%u res=%d flags=%x dpkt_size: %d\n"
+colo_compare_tcp_info(const char *src, const char *dst, uint32_t pseq, uint32_t sseq, uint32_t pack, uint32_t sack, int res, uint32_t pflag, uint32_t sflag, int psize, int ssize) "src/dst: %s/%s pseq/sseq:%u/%u pack/sack:%u/%u res=%d pflags/sflag:%x/%x psize/ssize:%d/%d \n"
 
 # net/filter-rewriter.c
 colo_filter_rewriter_debug(void) ""
-- 
2.7.4