Series comparison

-[PULL 00/10] Net patches
+[PULL V2 00/33] Net patches
-The following changes since commit d90f154867ec0ec22fd719164b88716e8fd48672:
+The following changes since commit 3f429a3400822141651486193d6af625eeab05a5:
-  Merge remote-tracking branch 'remotes/dg-gitlab/tags/ppc-for-6.1-20210504' into staging (2021-05-05 20:29:14 +0100)
+  Merge remote-tracking branch 'remotes/kraxel/tags/microvm-20200617-pull-request' into staging (2020-06-18 11:23:15 +0100)
 are available in the git repository at:
   https://github.com/jasowang/qemu.git tags/net-pull-request
-for you to fetch changes up to 2bdeb0c2564c36b218ac73e21d7a6f6accb49091:
+for you to fetch changes up to 71830d8430e65dd20aec4765d87e60336148e1a6:
-  tap-bsd: Remove special casing for older OpenBSD releases (2021-05-08 13:59:12 +0800)
+  net: Drop the NetLegacy structure, always use Netdev instead (2020-06-18 21:05:52 +0800)
 ----------------------------------------------------------------
+Changes from V1:
+- Fix build failure for virtio-net
 ----------------------------------------------------------------
-Andrew Melnychenko (7):
+Derek Su (1):
-      net/tap: Added TUNSETSTEERINGEBPF code.
+      colo-compare: Fix memory leak in packet_enqueue()
       net: Added SetSteeringEBPF method for NetClientState.
       ebpf: Added eBPF RSS program.
       ebpf: Added eBPF RSS loader.
       virtio-net: Added eBPF RSS to virtio-net.
       docs: Added eBPF documentation.
       MAINTAINERS: Added eBPF maintainers information.
-Brad Smith (1):
+Helge Deller (1):
-      tap-bsd: Remove special casing for older OpenBSD releases
+      Fix tulip breakage
-Guenter Roeck (1):
+Jason Wang (1):
-      hw/net/imx_fec: return 0xffff when accessing non-existing PHY
+      net: use peer when purging queue in qemu_flush_or_purge_queue_packets()
-Laurent Vivier (1):
+Lukas Straub (6):
-      virtio-net: failover: add missing remove_migration_state_change_notifier()
+      net/colo-compare.c: Create event_bh with the right AioContext
       chardev/char.c: Use qemu_co_sleep_ns if in coroutine
       net/colo-compare.c: Fix deadlock in compare_chr_send
       net/colo-compare.c: Only hexdump packets if tracing is enabled
       net/colo-compare.c: Check that colo-compare is active
       net/colo-compare.c: Correct ordering in complete and finalize
- MAINTAINERS                    |   8 +
+Philippe Mathieu-Daudé (3):
- configure                      |   8 +-
+      hw/net/tulip: Fix 'Descriptor Error' definition
- docs/devel/ebpf_rss.rst        | 125 +++++++++
+      hw/net/tulip: Log descriptor overflows
- docs/devel/index.rst           |   1 +
+      hw/net/e1000e: Do not abort() on invalid PSRCTL register value
- ebpf/ebpf_rss-stub.c           |  40 +++
- ebpf/ebpf_rss.c                | 165 ++++++++++++
+Sai Pavan Boddu (11):
- ebpf/ebpf_rss.h                |  44 ++++
+      net: cadence_gem: Fix debug statements
- ebpf/meson.build               |   1 +
+      net: cadence_gem: Fix the queue address update during wrap around
- ebpf/rss.bpf.skeleton.h        | 431 +++++++++++++++++++++++++++++++
+      net: cadence_gem: Fix irq update w.r.t queue
- ebpf/trace-events              |   4 +
+      net: cadence_gem: Define access permission for interrupt registers
- ebpf/trace.h                   |   1 +
+      net: cadence_gem: Set ISR according to queue in use
- hw/net/imx_fec.c               |   8 +-
+      net: cadence_gem: Move tx/rx packet buffert to CadenceGEMState
- hw/net/trace-events            |   2 +
+      net: cadence_gem: Fix up code style
- hw/net/vhost_net.c             |   3 +
+      net: cadence_gem: Add support for jumbo frames
- hw/net/virtio-net.c            | 116 ++++++++-
+      net: cadnece_gem: Update irq_read_clear field of designcfg_debug1 reg
- include/hw/virtio/virtio-net.h |   4 +
+      net: cadence_gem: Update the reset value for interrupt mask register
- include/net/net.h              |   2 +
+      net: cadence_gem: TX_LAST bit should be set by guest
- meson.build                    |  23 ++
- meson_options.txt              |   2 +
+Thomas Huth (2):
- net/tap-bsd.c                  |  13 +-
+      net: Drop the legacy "name" parameter from the -net option
- net/tap-linux.c                |  13 +
+      net: Drop the NetLegacy structure, always use Netdev instead
- net/tap-linux.h                |   1 +
- net/tap-solaris.c              |   5 +
+Tong Ho (1):
- net/tap-stub.c                 |   5 +
+      net: cadence_gem: Fix RX address filtering
- net/tap.c                      |   9 +
- net/tap_int.h                  |   1 +
+Yuri Benditovich (7):
- net/vhost-vdpa.c               |   2 +
+      virtio-net: implement RSS configuration command
- tools/ebpf/Makefile.ebpf       |  21 ++
+      virtio-net: implement RX RSS processing
- tools/ebpf/rss.bpf.c           | 569 +++++++++++++++++++++++++++++++++++++++++
+      tap: allow extended virtio header with hash info
-files changed, 1610 insertions(+), 17 deletions(-)
+      virtio-net: reference implementation of hash report
- create mode 100644 docs/devel/ebpf_rss.rst
+      vmstate.h: provide VMSTATE_VARRAY_UINT16_ALLOC macro
- create mode 100644 ebpf/ebpf_rss-stub.c
+      virtio-net: add migration support for RSS and hash report
- create mode 100644 ebpf/ebpf_rss.c
+      virtio-net: align RSC fields with updated virtio-net header
- create mode 100644 ebpf/ebpf_rss.h
- create mode 100644 ebpf/meson.build
+ chardev/char.c                 |   7 +-
- create mode 100644 ebpf/rss.bpf.skeleton.h
+ docs/system/deprecated.rst     |  15 +-
- create mode 100644 ebpf/trace-events
+ hw/net/Makefile.objs           |   1 +
- create mode 100644 ebpf/trace.h
+ hw/net/cadence_gem.c           | 458 +++++++++++++++++++++++------------------
- create mode 100755 tools/ebpf/Makefile.ebpf
+ hw/net/e1000e_core.c           |  10 +-
- create mode 100644 tools/ebpf/rss.bpf.c
+ hw/net/trace-events            |   3 +
  hw/net/tulip.c                 |  12 +-
  hw/net/tulip.h                 |   2 +-
  hw/net/virtio-net.c            | 387 ++++++++++++++++++++++++++++++----
  include/hw/net/cadence_gem.h   |   6 +
  include/hw/virtio/virtio-net.h |  16 ++
  include/migration/vmstate.h    |  10 +
  net/colo-compare.c             | 277 ++++++++++++++++++-------
  net/colo.c                     |   7 +
  net/colo.h                     |   1 +
  net/net.c                      |  89 ++------
  net/tap.c                      |   3 +-
  net/trace-events               |   1 +
  qapi/net.json                  |  49 -----
 files changed, 905 insertions(+), 449 deletions(-)

-New patch
+[PULL V2 01/33] virtio-net: implement RSS configuration command
+From: Yuri Benditovich <yuri.benditovich@daynix.com>
 Optionally report RSS feature.
 Handle RSS configuration command and keep RSS parameters
 in virtio-net device context.
 Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
  hw/net/trace-events            |   3 +
  hw/net/virtio-net.c            | 167 ++++++++++++++++++++++++++++++++++++++---
  include/hw/virtio/virtio-net.h |  13 ++++
 files changed, 174 insertions(+), 9 deletions(-)
 diff --git a/hw/net/trace-events b/hw/net/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/net/trace-events
 +++ b/hw/net/trace-events
@@ -XXX,XX +XXX,XX @@ virtio_net_announce_notify(void) ""
  virtio_net_announce_timer(int round) "%d"
  virtio_net_handle_announce(int round) "%d"
  virtio_net_post_load_device(void)
 +virtio_net_rss_disable(void)
 +virtio_net_rss_error(const char *msg, uint32_t value) "%s, value 0x%08x"
 +virtio_net_rss_enable(uint32_t p1, uint16_t p2, uint8_t p3) "hashes 0x%x, table of %d, key of %d"
  # tulip.c
  tulip_reg_write(uint64_t addr, const char *name, int size, uint64_t val) "addr 0x%02"PRIx64" (%s) size %d value 0x%08"PRIx64
 diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/net/virtio-net.c
 +++ b/hw/net/virtio-net.c
@@ -XXX,XX +XXX,XX @@
     tso/gso/gro 'off'. */
  #define VIRTIO_NET_RSC_DEFAULT_INTERVAL 300000
 +#define VIRTIO_NET_RSS_SUPPORTED_HASHES (VIRTIO_NET_RSS_HASH_TYPE_IPv4 | \
 +                                         VIRTIO_NET_RSS_HASH_TYPE_TCPv4 | \
 +                                         VIRTIO_NET_RSS_HASH_TYPE_UDPv4 | \
 +                                         VIRTIO_NET_RSS_HASH_TYPE_IPv6 | \
 +                                         VIRTIO_NET_RSS_HASH_TYPE_TCPv6 | \
 +                                         VIRTIO_NET_RSS_HASH_TYPE_UDPv6 | \
 +                                         VIRTIO_NET_RSS_HASH_TYPE_IP_EX | \
 +                                         VIRTIO_NET_RSS_HASH_TYPE_TCP_EX | \
 +                                         VIRTIO_NET_RSS_HASH_TYPE_UDP_EX)
 +
  /* temporary until standard header include it */
  #if !defined(VIRTIO_NET_HDR_F_RSC_INFO)
@@ -XXX,XX +XXX,XX @@ static VirtIOFeature feature_sizes[] = {
       .end = endof(struct virtio_net_config, mtu)},
      {.flags = 1ULL << VIRTIO_NET_F_SPEED_DUPLEX,
       .end = endof(struct virtio_net_config, duplex)},
 +    {.flags = 1ULL << VIRTIO_NET_F_RSS,
 +     .end = endof(struct virtio_net_config, supported_hash_types)},
      {}
  };
@@ -XXX,XX +XXX,XX @@ static void virtio_net_get_config(VirtIODevice *vdev, uint8_t *config)
      memcpy(netcfg.mac, n->mac, ETH_ALEN);
      virtio_stl_p(vdev, &netcfg.speed, n->net_conf.speed);
      netcfg.duplex = n->net_conf.duplex;
 +    netcfg.rss_max_key_size = VIRTIO_NET_RSS_MAX_KEY_SIZE;
 +    virtio_stw_p(vdev, &netcfg.rss_max_indirection_table_length,
 +                 VIRTIO_NET_RSS_MAX_TABLE_LEN);
 +    virtio_stl_p(vdev, &netcfg.supported_hash_types,
 +                 VIRTIO_NET_RSS_SUPPORTED_HASHES);
      memcpy(config, &netcfg, n->config_size);
  }
@@ -XXX,XX +XXX,XX @@ static uint64_t virtio_net_get_features(VirtIODevice *vdev, uint64_t features,
          return features;
      }
 +    virtio_clear_feature(&features, VIRTIO_NET_F_RSS);
      features = vhost_net_get_features(get_vhost_net(nc->peer), features);
      vdev->backend_features = features;
@@ -XXX,XX +XXX,XX @@ static void virtio_net_set_features(VirtIODevice *vdev, uint64_t features)
      }
      virtio_net_set_multiqueue(n,
 +                              virtio_has_feature(features, VIRTIO_NET_F_RSS) ||
                                virtio_has_feature(features, VIRTIO_NET_F_MQ));
      virtio_net_set_mrg_rx_bufs(n,
@@ -XXX,XX +XXX,XX @@ static int virtio_net_handle_announce(VirtIONet *n, uint8_t cmd,
      }
  }
 +static void virtio_net_disable_rss(VirtIONet *n)
 +{
 +    if (n->rss_data.enabled) {
 +        trace_virtio_net_rss_disable();
 +    }
 +    n->rss_data.enabled = false;
 +}
 +
 +static uint16_t virtio_net_handle_rss(VirtIONet *n,
 +                                      struct iovec *iov, unsigned int iov_cnt)
 +{
 +    VirtIODevice *vdev = VIRTIO_DEVICE(n);
 +    struct virtio_net_rss_config cfg;
 +    size_t s, offset = 0, size_get;
 +    uint16_t queues, i;
 +    struct {
 +        uint16_t us;
 +        uint8_t b;
 +    } QEMU_PACKED temp;
 +    const char *err_msg = "";
 +    uint32_t err_value = 0;
 +
 +    if (!virtio_vdev_has_feature(vdev, VIRTIO_NET_F_RSS)) {
 +        err_msg = "RSS is not negotiated";
 +        goto error;
 +    }
 +    size_get = offsetof(struct virtio_net_rss_config, indirection_table);
 +    s = iov_to_buf(iov, iov_cnt, offset, &cfg, size_get);
 +    if (s != size_get) {
 +        err_msg = "Short command buffer";
 +        err_value = (uint32_t)s;
 +        goto error;
 +    }
 +    n->rss_data.hash_types = virtio_ldl_p(vdev, &cfg.hash_types);
 +    n->rss_data.indirections_len =
 +        virtio_lduw_p(vdev, &cfg.indirection_table_mask);
 +    n->rss_data.indirections_len++;
 +    if (!is_power_of_2(n->rss_data.indirections_len)) {
 +        err_msg = "Invalid size of indirection table";
 +        err_value = n->rss_data.indirections_len;
 +        goto error;
 +    }
 +    if (n->rss_data.indirections_len > VIRTIO_NET_RSS_MAX_TABLE_LEN) {
 +        err_msg = "Too large indirection table";
 +        err_value = n->rss_data.indirections_len;
 +        goto error;
 +    }
 +    n->rss_data.default_queue =
 +        virtio_lduw_p(vdev, &cfg.unclassified_queue);
 +    if (n->rss_data.default_queue >= n->max_queues) {
 +        err_msg = "Invalid default queue";
 +        err_value = n->rss_data.default_queue;
 +        goto error;
 +    }
 +    offset += size_get;
 +    size_get = sizeof(uint16_t) * n->rss_data.indirections_len;
 +    g_free(n->rss_data.indirections_table);
 +    n->rss_data.indirections_table = g_malloc(size_get);
 +    if (!n->rss_data.indirections_table) {
 +        err_msg = "Can't allocate indirections table";
 +        err_value = n->rss_data.indirections_len;
 +        goto error;
 +    }
 +    s = iov_to_buf(iov, iov_cnt, offset,
 +                   n->rss_data.indirections_table, size_get);
 +    if (s != size_get) {
 +        err_msg = "Short indirection table buffer";
 +        err_value = (uint32_t)s;
 +        goto error;
 +    }
 +    for (i = 0; i < n->rss_data.indirections_len; ++i) {
 +        uint16_t val = n->rss_data.indirections_table[i];
 +        n->rss_data.indirections_table[i] = virtio_lduw_p(vdev, &val);
 +    }
 +    offset += size_get;
 +    size_get = sizeof(temp);
 +    s = iov_to_buf(iov, iov_cnt, offset, &temp, size_get);
 +    if (s != size_get) {
 +        err_msg = "Can't get queues";
 +        err_value = (uint32_t)s;
 +        goto error;
 +    }
 +    queues = virtio_lduw_p(vdev, &temp.us);
 +    if (queues == 0 || queues > n->max_queues) {
 +        err_msg = "Invalid number of queues";
 +        err_value = queues;
 +        goto error;
 +    }
 +    if (temp.b > VIRTIO_NET_RSS_MAX_KEY_SIZE) {
 +        err_msg = "Invalid key size";
 +        err_value = temp.b;
 +        goto error;
 +    }
 +    if (!temp.b && n->rss_data.hash_types) {
 +        err_msg = "No key provided";
 +        err_value = 0;
 +        goto error;
 +    }
 +    if (!temp.b && !n->rss_data.hash_types) {
 +        virtio_net_disable_rss(n);
 +        return queues;
 +    }
 +    offset += size_get;
 +    size_get = temp.b;
 +    s = iov_to_buf(iov, iov_cnt, offset, n->rss_data.key, size_get);
 +    if (s != size_get) {
 +        err_msg = "Can get key buffer";
 +        err_value = (uint32_t)s;
 +        goto error;
 +    }
 +    n->rss_data.enabled = true;
 +    trace_virtio_net_rss_enable(n->rss_data.hash_types,
 +                                n->rss_data.indirections_len,
 +                                temp.b);
 +    return queues;
 +error:
 +    trace_virtio_net_rss_error(err_msg, err_value);
 +    virtio_net_disable_rss(n);
 +    return 0;
 +}
 +
  static int virtio_net_handle_mq(VirtIONet *n, uint8_t cmd,
                                  struct iovec *iov, unsigned int iov_cnt)
  {
      VirtIODevice *vdev = VIRTIO_DEVICE(n);
 -    struct virtio_net_ctrl_mq mq;
 -    size_t s;
      uint16_t queues;
 -    s = iov_to_buf(iov, iov_cnt, 0, &mq, sizeof(mq));
 -    if (s != sizeof(mq)) {
 -        return VIRTIO_NET_ERR;
 -    }
 +    virtio_net_disable_rss(n);
 +    if (cmd == VIRTIO_NET_CTRL_MQ_RSS_CONFIG) {
 +        queues = virtio_net_handle_rss(n, iov, iov_cnt);
 +    } else if (cmd == VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET) {
 +        struct virtio_net_ctrl_mq mq;
 +        size_t s;
 +        if (!virtio_vdev_has_feature(vdev, VIRTIO_NET_F_MQ)) {
 +            return VIRTIO_NET_ERR;
 +        }
 +        s = iov_to_buf(iov, iov_cnt, 0, &mq, sizeof(mq));
 +        if (s != sizeof(mq)) {
 +            return VIRTIO_NET_ERR;
 +        }
 +        queues = virtio_lduw_p(vdev, &mq.virtqueue_pairs);
 -    if (cmd != VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET) {
 +    } else {
          return VIRTIO_NET_ERR;
      }
 -    queues = virtio_lduw_p(vdev, &mq.virtqueue_pairs);
 -
      if (queues < VIRTIO_NET_CTRL_MQ_VQ_PAIRS_MIN ||
          queues > VIRTIO_NET_CTRL_MQ_VQ_PAIRS_MAX ||
          queues > n->max_queues ||
@@ -XXX,XX +XXX,XX @@ static void virtio_net_device_unrealize(DeviceState *dev)
      g_free(n->vqs);
      qemu_del_nic(n->nic);
      virtio_net_rsc_cleanup(n);
 +    g_free(n->rss_data.indirections_table);
      virtio_cleanup(vdev);
  }
@@ -XXX,XX +XXX,XX @@ static Property virtio_net_properties[] = {
      DEFINE_PROP_BIT64("ctrl_guest_offloads", VirtIONet, host_features,
                      VIRTIO_NET_F_CTRL_GUEST_OFFLOADS, true),
      DEFINE_PROP_BIT64("mq", VirtIONet, host_features, VIRTIO_NET_F_MQ, false),
 +    DEFINE_PROP_BIT64("rss", VirtIONet, host_features,
 +                    VIRTIO_NET_F_RSS, false),
      DEFINE_PROP_BIT64("guest_rsc_ext", VirtIONet, host_features,
                      VIRTIO_NET_F_RSC_EXT, false),
      DEFINE_PROP_UINT32("rsc_interval", VirtIONet, rsc_timeout,
 diff --git a/include/hw/virtio/virtio-net.h b/include/hw/virtio/virtio-net.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/virtio/virtio-net.h
 +++ b/include/hw/virtio/virtio-net.h
@@ -XXX,XX +XXX,XX @@ typedef struct VirtioNetRscChain {
  /* Maximum packet size we can receive from tap device: header + 64k */
  #define VIRTIO_NET_MAX_BUFSIZE (sizeof(struct virtio_net_hdr) + (64 * KiB))
 +#define VIRTIO_NET_RSS_MAX_KEY_SIZE     40
 +#define VIRTIO_NET_RSS_MAX_TABLE_LEN    128
 +
 +typedef struct VirtioNetRssData {
 +    bool    enabled;
 +    uint32_t hash_types;
 +    uint8_t key[VIRTIO_NET_RSS_MAX_KEY_SIZE];
 +    uint16_t indirections_len;
 +    uint16_t *indirections_table;
 +    uint16_t default_queue;
 +} VirtioNetRssData;
 +
  typedef struct VirtIONetQueue {
      VirtQueue *rx_vq;
      VirtQueue *tx_vq;
@@ -XXX,XX +XXX,XX @@ struct VirtIONet {
      bool failover;
      DeviceListener primary_listener;
      Notifier migration_state;
 +    VirtioNetRssData rss_data;
  };
  void virtio_net_set_netclient_name(VirtIONet *n, const char *name,
 --
 .5.0

-[PULL 05/10] virtio-net: Added eBPF RSS to virtio-net.
+[PULL V2 02/33] virtio-net: implement RX RSS processing
-From: Andrew Melnychenko <andrew@daynix.com>
+From: Yuri Benditovich <yuri.benditovich@daynix.com>
-When RSS is enabled the device tries to load the eBPF program
+If VIRTIO_NET_F_RSS negotiated and RSS is enabled, process
-to select RX virtqueue in the TUN. If eBPF can be loaded
+incoming packets, calculate packet's hash and place the
-the RSS will function also with vhost (works with kernel 5.8 and later).
+packet into respective RX virtqueue.
 Software RSS is used as a fallback with vhost=off when eBPF can't be loaded
 or when hash population requested by the guest.
 Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
-Signed-off-by: Andrew Melnychenko <andrew@daynix.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- hw/net/vhost_net.c             |   3 ++
+ hw/net/Makefile.objs           |  1 +
- hw/net/virtio-net.c            | 115 +++++++++++++++++++++++++++++++++++++++--
+ hw/net/virtio-net.c            | 88 +++++++++++++++++++++++++++++++++++++++++-
- include/hw/virtio/virtio-net.h |   4 ++
+ include/hw/virtio/virtio-net.h |  1 +
- net/vhost-vdpa.c               |   2 +
+files changed, 88 insertions(+), 2 deletions(-)
 files changed, 121 insertions(+), 3 deletions(-)
-diff --git a/hw/net/vhost_net.c b/hw/net/vhost_net.c
+diff --git a/hw/net/Makefile.objs b/hw/net/Makefile.objs
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/vhost_net.c
+--- a/hw/net/Makefile.objs
-+++ b/hw/net/vhost_net.c
++++ b/hw/net/Makefile.objs
-@@ -XXX,XX +XXX,XX @@ static const int kernel_feature_bits[] = {
+@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_MILKYMIST) += milkymist-minimac2.o
-     VIRTIO_NET_F_MTU,
+ obj-$(CONFIG_PSERIES) += spapr_llan.o
-     VIRTIO_F_IOMMU_PLATFORM,
+ obj-$(CONFIG_XILINX_ETHLITE) += xilinx_ethlite.o
-     VIRTIO_F_RING_PACKED,
-+    VIRTIO_NET_F_HASH_REPORT,
++common-obj-$(CONFIG_VIRTIO_NET) += net_rx_pkt.o
-     VHOST_INVALID_FEATURE_BIT
+ obj-$(CONFIG_VIRTIO_NET) += virtio-net.o
- };
+ common-obj-$(call land,$(CONFIG_VIRTIO_NET),$(CONFIG_VHOST_NET)) += vhost_net.o
+ common-obj-$(call lnot,$(call land,$(CONFIG_VIRTIO_NET),$(CONFIG_VHOST_NET))) += vhost_net-stub.o
@@ -XXX,XX +XXX,XX @@ static const int user_feature_bits[] = {
      VIRTIO_NET_F_MTU,
      VIRTIO_F_IOMMU_PLATFORM,
      VIRTIO_F_RING_PACKED,
 +    VIRTIO_NET_F_RSS,
 +    VIRTIO_NET_F_HASH_REPORT,
      /* This bit implies RARP isn't sent by QEMU out of band */
      VIRTIO_NET_F_GUEST_ANNOUNCE,
 diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/net/virtio-net.c
 +++ b/hw/net/virtio-net.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t virtio_net_get_features(VirtIODevice *vdev, uint64_t features,
+@@ -XXX,XX +XXX,XX @@
-         return features;
+ #include "trace.h"
-     }
+ #include "monitor/qdev.h"
+ #include "hw/pci/pci.h"
--    virtio_clear_feature(&features, VIRTIO_NET_F_RSS);
++#include "net_rx_pkt.h"
--    virtio_clear_feature(&features, VIRTIO_NET_F_HASH_REPORT);
-+    if (!ebpf_rss_is_loaded(&n->ebpf_rss)) {
+ #define VIRTIO_NET_VM_VERSION    11
-+        virtio_clear_feature(&features, VIRTIO_NET_F_RSS);
@@ -XXX,XX +XXX,XX @@ static int receive_filter(VirtIONet *n, const uint8_t *buf, int size)
      return 0;
  }
 +static uint8_t virtio_net_get_hash_type(bool isip4,
 +                                        bool isip6,
 +                                        bool isudp,
 +                                        bool istcp,
 +                                        uint32_t types)
 +{
 +    if (isip4) {
 +        if (istcp && (types & VIRTIO_NET_RSS_HASH_TYPE_TCPv4)) {
 +            return NetPktRssIpV4Tcp;
 +        }
 +        if (isudp && (types & VIRTIO_NET_RSS_HASH_TYPE_UDPv4)) {
 +            return NetPktRssIpV4Udp;
 +        }
 +        if (types & VIRTIO_NET_RSS_HASH_TYPE_IPv4) {
 +            return NetPktRssIpV4;
 +        }
 +    } else if (isip6) {
 +        uint32_t mask = VIRTIO_NET_RSS_HASH_TYPE_TCP_EX |
 +                        VIRTIO_NET_RSS_HASH_TYPE_TCPv6;
 +
 +        if (istcp && (types & mask)) {
 +            return (types & VIRTIO_NET_RSS_HASH_TYPE_TCP_EX) ?
 +                NetPktRssIpV6TcpEx : NetPktRssIpV6Tcp;
 +        }
 +        mask = VIRTIO_NET_RSS_HASH_TYPE_UDP_EX | VIRTIO_NET_RSS_HASH_TYPE_UDPv6;
 +        if (isudp && (types & mask)) {
 +            return (types & VIRTIO_NET_RSS_HASH_TYPE_UDP_EX) ?
 +                NetPktRssIpV6UdpEx : NetPktRssIpV6Udp;
 +        }
 +        mask = VIRTIO_NET_RSS_HASH_TYPE_IP_EX | VIRTIO_NET_RSS_HASH_TYPE_IPv6;
 +        if (types & mask) {
 +            return (types & VIRTIO_NET_RSS_HASH_TYPE_IP_EX) ?
 +                NetPktRssIpV6Ex : NetPktRssIpV6;
 +        }
 +    }
-     features = vhost_net_get_features(get_vhost_net(nc->peer), features);
++    return 0xff;
      vdev->backend_features = features;
@@ -XXX,XX +XXX,XX @@ static int virtio_net_handle_announce(VirtIONet *n, uint8_t cmd,
      }
  }
 +static void virtio_net_detach_epbf_rss(VirtIONet *n);
 +
  static void virtio_net_disable_rss(VirtIONet *n)
  {
      if (n->rss_data.enabled) {
          trace_virtio_net_rss_disable();
      }
      n->rss_data.enabled = false;
 +
 +    virtio_net_detach_epbf_rss(n);
 +}
 +
-+static bool virtio_net_attach_ebpf_to_backend(NICState *nic, int prog_fd)
++static int virtio_net_process_rss(NetClientState *nc, const uint8_t *buf,
 +                                  size_t size)
 +{
-+    NetClientState *nc = qemu_get_peer(qemu_get_queue(nic), 0);
++    VirtIONet *n = qemu_get_nic_opaque(nc);
-+    if (nc == NULL || nc->info->set_steering_ebpf == NULL) {
++    unsigned int index = nc->queue_index, new_index;
-+        return false;
++    struct NetRxPkt *pkt = n->rx_pkt;
 +    uint8_t net_hash_type;
 +    uint32_t hash;
 +    bool isip4, isip6, isudp, istcp;
 +
 +    net_rx_pkt_set_protocols(pkt, buf + n->host_hdr_len,
 +                             size - n->host_hdr_len);
 +    net_rx_pkt_get_protocols(pkt, &isip4, &isip6, &isudp, &istcp);
 +    if (isip4 && (net_rx_pkt_get_ip4_info(pkt)->fragment)) {
 +        istcp = isudp = false;
 +    }
 +    if (isip6 && (net_rx_pkt_get_ip6_info(pkt)->fragment)) {
 +        istcp = isudp = false;
 +    }
 +    net_hash_type = virtio_net_get_hash_type(isip4, isip6, isudp, istcp,
 +                                             n->rss_data.hash_types);
 +    if (net_hash_type > NetPktRssIpV6UdpEx) {
 +        return n->rss_data.default_queue;
 +    }
 +
-+    return nc->info->set_steering_ebpf(nc, prog_fd);
++    hash = net_rx_pkt_calc_rss_hash(pkt, net_hash_type, n->rss_data.key);
 +    new_index = hash & (n->rss_data.indirections_len - 1);
 +    new_index = n->rss_data.indirections_table[new_index];
 +    if (index == new_index) {
 +        return -1;
 +    }
 +    return new_index;
 +}
 +
-+static void rss_data_to_rss_config(struct VirtioNetRssData *data,
+ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
-+                                   struct EBPFRSSConfig *config)
+-                                      size_t size)
-+{
++                                      size_t size, bool no_rss)
-+    config->redirect = data->redirect;
+ {
-+    config->populate_hash = data->populate_hash;
+     VirtIONet *n = qemu_get_nic_opaque(nc);
-+    config->hash_types = data->hash_types;
+     VirtIONetQueue *q = virtio_net_get_subqueue(nc);
 +    config->indirections_len = data->indirections_len;
 +    config->default_queue = data->default_queue;
 +}
 +
 +static bool virtio_net_attach_epbf_rss(VirtIONet *n)
 +{
 +    struct EBPFRSSConfig config = {};
 +
 +    if (!ebpf_rss_is_loaded(&n->ebpf_rss)) {
 +        return false;
 +    }
 +
 +    rss_data_to_rss_config(&n->rss_data, &config);
 +
 +    if (!ebpf_rss_set_all(&n->ebpf_rss, &config,
 +                          n->rss_data.indirections_table, n->rss_data.key)) {
 +        return false;
 +    }
 +
 +    if (!virtio_net_attach_ebpf_to_backend(n->nic, n->ebpf_rss.program_fd)) {
 +        return false;
 +    }
 +
 +    return true;
 +}
 +
 +static void virtio_net_detach_epbf_rss(VirtIONet *n)
 +{
 +    virtio_net_attach_ebpf_to_backend(n->nic, -1);
 +}
 +
 +static bool virtio_net_load_ebpf(VirtIONet *n)
 +{
 +    if (!virtio_net_attach_ebpf_to_backend(n->nic, -1)) {
 +        /* backend does't support steering ebpf */
 +        return false;
 +    }
 +
 +    return ebpf_rss_load(&n->ebpf_rss);
 +}
 +
 +static void virtio_net_unload_ebpf(VirtIONet *n)
 +{
 +    virtio_net_attach_ebpf_to_backend(n->nic, -1);
 +    ebpf_rss_unload(&n->ebpf_rss);
  }
  static uint16_t virtio_net_handle_rss(VirtIONet *n,
@@ -XXX,XX +XXX,XX @@ static uint16_t virtio_net_handle_rss(VirtIONet *n,
          goto error;
      }
      n->rss_data.enabled = true;
 +
 +    if (!n->rss_data.populate_hash) {
 +        if (!virtio_net_attach_epbf_rss(n)) {
 +            /* EBPF must be loaded for vhost */
 +            if (get_vhost_net(qemu_get_queue(n->nic)->peer)) {
 +                warn_report("Can't load eBPF RSS for vhost");
 +                goto error;
 +            }
 +            /* fallback to software RSS */
 +            warn_report("Can't load eBPF RSS - fallback to software RSS");
 +            n->rss_data.enabled_software_rss = true;
 +        }
 +    } else {
 +        /* use software RSS for hash populating */
 +        /* and detach eBPF if was loaded before */
 +        virtio_net_detach_epbf_rss(n);
 +        n->rss_data.enabled_software_rss = true;
 +    }
 +
      trace_virtio_net_rss_enable(n->rss_data.hash_types,
                                  n->rss_data.indirections_len,
                                  temp.b);
 @@ -XXX,XX +XXX,XX @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
          return -1;
      }
--    if (!no_rss && n->rss_data.enabled) {
++    if (!no_rss && n->rss_data.enabled) {
-+    if (!no_rss && n->rss_data.enabled && n->rss_data.enabled_software_rss) {
++        int index = virtio_net_process_rss(nc, buf, size);
-         int index = virtio_net_process_rss(nc, buf, size);
++        if (index >= 0) {
-         if (index >= 0) {
++            NetClientState *nc2 = qemu_get_subqueue(n->nic, index);
-             NetClientState *nc2 = qemu_get_subqueue(n->nic, index);
++            return virtio_net_receive_rcu(nc2, buf, size, true);
@@ -XXX,XX +XXX,XX @@ static int virtio_net_post_load_device(void *opaque, int version_id)
      }
      if (n->rss_data.enabled) {
 +        n->rss_data.enabled_software_rss = n->rss_data.populate_hash;
 +        if (!n->rss_data.populate_hash) {
 +            if (!virtio_net_attach_epbf_rss(n)) {
 +                if (get_vhost_net(qemu_get_queue(n->nic)->peer)) {
 +                    warn_report("Can't post-load eBPF RSS for vhost");
 +                } else {
 +                    warn_report("Can't post-load eBPF RSS - fallback to software RSS");
 +                    n->rss_data.enabled_software_rss = true;
 +                }
 +            }
 +        }
++    }
 +
-         trace_virtio_net_rss_enable(n->rss_data.hash_types,
+     /* hdr_len refers to the header we supply to the guest */
-                                     n->rss_data.indirections_len,
+     if (!virtio_net_has_buffers(q, size + n->guest_hdr_len - n->host_hdr_len)) {
-                                     sizeof(n->rss_data.key));
+         return 0;
@@ -XXX,XX +XXX,XX @@ static ssize_t virtio_net_do_receive(NetClientState *nc, const uint8_t *buf,
  {
      RCU_READ_LOCK_GUARD();
 -    return virtio_net_receive_rcu(nc, buf, size);
 +    return virtio_net_receive_rcu(nc, buf, size, false);
  }
  static void virtio_net_rsc_extract_unit4(VirtioNetRscChain *chain,
 @@ -XXX,XX +XXX,XX @@ static void virtio_net_device_realize(DeviceState *dev, Error **errp)
+     QTAILQ_INIT(&n->rsc_chains);
      n->qdev = dev;
-     net_rx_pkt_init(&n->rx_pkt, false);
 +
-+    if (virtio_has_feature(n->host_features, VIRTIO_NET_F_RSS)) {
++    net_rx_pkt_init(&n->rx_pkt, false);
 +        virtio_net_load_ebpf(n);
 +    }
  }
  static void virtio_net_device_unrealize(DeviceState *dev)
 @@ -XXX,XX +XXX,XX @@ static void virtio_net_device_unrealize(DeviceState *dev)
-     VirtIONet *n = VIRTIO_NET(dev);
+     qemu_del_nic(n->nic);
-     int i, max_queues;
+     virtio_net_rsc_cleanup(n);
+     g_free(n->rss_data.indirections_table);
-+    if (virtio_has_feature(n->host_features, VIRTIO_NET_F_RSS)) {
++    net_rx_pkt_uninit(n->rx_pkt);
-+        virtio_net_unload_ebpf(n);
+     virtio_cleanup(vdev);
 +    }
 +
      /* This will stop vhost backend if appropriate. */
      virtio_net_set_status(vdev, 0);
@@ -XXX,XX +XXX,XX @@ static void virtio_net_instance_init(Object *obj)
      device_add_bootindex_property(obj, &n->nic_conf.bootindex,
                                    "bootindex", "/ethernet-phy@0",
                                    DEVICE(n));
 +
 +    ebpf_rss_init(&n->ebpf_rss);
  }
- static int virtio_net_pre_save(void *opaque)
 diff --git a/include/hw/virtio/virtio-net.h b/include/hw/virtio/virtio-net.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/virtio/virtio-net.h
 +++ b/include/hw/virtio/virtio-net.h
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/option_int.h"
- #include "qom/object.h"
-+#include "ebpf/ebpf_rss.h"
-+
- #define TYPE_VIRTIO_NET "virtio-net-device"
- OBJECT_DECLARE_SIMPLE_TYPE(VirtIONet, VIRTIO_NET)
-@@ -XXX,XX +XXX,XX @@ typedef struct VirtioNetRscChain {
- typedef struct VirtioNetRssData {
-     bool    enabled;
-+    bool    enabled_software_rss;
-     bool    redirect;
-     bool    populate_hash;
-     uint32_t hash_types;
 @@ -XXX,XX +XXX,XX @@ struct VirtIONet {
+     DeviceListener primary_listener;
      Notifier migration_state;
      VirtioNetRssData rss_data;
-     struct NetRxPkt *rx_pkt;
++    struct NetRxPkt *rx_pkt;
 +    struct EBPFRSSContext ebpf_rss;
  };
  void virtio_net_set_netclient_name(VirtIONet *n, const char *name,
-diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
-index XXXXXXX..XXXXXXX 100644
---- a/net/vhost-vdpa.c
-+++ b/net/vhost-vdpa.c
-@@ -XXX,XX +XXX,XX @@ const int vdpa_feature_bits[] = {
-     VIRTIO_NET_F_MTU,
-     VIRTIO_F_IOMMU_PLATFORM,
-     VIRTIO_F_RING_PACKED,
-+    VIRTIO_NET_F_RSS,
-+    VIRTIO_NET_F_HASH_REPORT,
-     VIRTIO_NET_F_GUEST_ANNOUNCE,
-     VIRTIO_NET_F_STATUS,
-     VHOST_INVALID_FEATURE_BIT
 --
-.7.4
+.5.0

-[PULL 02/10] net: Added SetSteeringEBPF method for NetClientState.
+[PULL V2 03/33] tap: allow extended virtio header with hash info
-From: Andrew Melnychenko <andrew@daynix.com>
+From: Yuri Benditovich <yuri.benditovich@daynix.com>
-For now, that method supported only by Linux TAP.
+Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
 Linux TAP uses TUNSETSTEERINGEBPF ioctl.
 Signed-off-by: Andrew Melnychenko <andrew@daynix.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- include/net/net.h |  2 ++
+ net/tap.c | 3 ++-
- net/tap-bsd.c     |  5 +++++
+file changed, 2 insertions(+), 1 deletion(-)
  net/tap-linux.c   | 13 +++++++++++++
  net/tap-solaris.c |  5 +++++
  net/tap-stub.c    |  5 +++++
  net/tap.c         |  9 +++++++++
  net/tap_int.h     |  1 +
 files changed, 40 insertions(+)
-diff --git a/include/net/net.h b/include/net/net.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/net/net.h
-+++ b/include/net/net.h
-@@ -XXX,XX +XXX,XX @@ typedef int (SetVnetBE)(NetClientState *, bool);
- typedef struct SocketReadState SocketReadState;
- typedef void (SocketReadStateFinalize)(SocketReadState *rs);
- typedef void (NetAnnounce)(NetClientState *);
-+typedef bool (SetSteeringEBPF)(NetClientState *, int);
- typedef struct NetClientInfo {
-     NetClientDriver type;
-@@ -XXX,XX +XXX,XX @@ typedef struct NetClientInfo {
-     SetVnetLE *set_vnet_le;
-     SetVnetBE *set_vnet_be;
-     NetAnnounce *announce;
-+    SetSteeringEBPF *set_steering_ebpf;
- } NetClientInfo;
- struct NetClientState {
-diff --git a/net/tap-bsd.c b/net/tap-bsd.c
-index XXXXXXX..XXXXXXX 100644
---- a/net/tap-bsd.c
-+++ b/net/tap-bsd.c
-@@ -XXX,XX +XXX,XX @@ int tap_fd_get_ifname(int fd, char *ifname)
- {
-     return -1;
- }
-+
-+int tap_fd_set_steering_ebpf(int fd, int prog_fd)
-+{
-+    return -1;
-+}
-diff --git a/net/tap-linux.c b/net/tap-linux.c
-index XXXXXXX..XXXXXXX 100644
---- a/net/tap-linux.c
-+++ b/net/tap-linux.c
-@@ -XXX,XX +XXX,XX @@ int tap_fd_get_ifname(int fd, char *ifname)
-     pstrcpy(ifname, sizeof(ifr.ifr_name), ifr.ifr_name);
-     return 0;
- }
-+
-+int tap_fd_set_steering_ebpf(int fd, int prog_fd)
-+{
-+    if (ioctl(fd, TUNSETSTEERINGEBPF, (void *) &prog_fd) != 0) {
-+        error_report("Issue while setting TUNSETSTEERINGEBPF:"
-+                    " %s with fd: %d, prog_fd: %d",
-+                    strerror(errno), fd, prog_fd);
-+
-+       return -1;
-+    }
-+
-+    return 0;
-+}
-diff --git a/net/tap-solaris.c b/net/tap-solaris.c
-index XXXXXXX..XXXXXXX 100644
---- a/net/tap-solaris.c
-+++ b/net/tap-solaris.c
-@@ -XXX,XX +XXX,XX @@ int tap_fd_get_ifname(int fd, char *ifname)
- {
-     return -1;
- }
-+
-+int tap_fd_set_steering_ebpf(int fd, int prog_fd)
-+{
-+    return -1;
-+}
-diff --git a/net/tap-stub.c b/net/tap-stub.c
-index XXXXXXX..XXXXXXX 100644
---- a/net/tap-stub.c
-+++ b/net/tap-stub.c
-@@ -XXX,XX +XXX,XX @@ int tap_fd_get_ifname(int fd, char *ifname)
- {
-     return -1;
- }
-+
-+int tap_fd_set_steering_ebpf(int fd, int prog_fd)
-+{
-+    return -1;
-+}
 diff --git a/net/tap.c b/net/tap.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/tap.c
 +++ b/net/tap.c
-@@ -XXX,XX +XXX,XX @@ static void tap_poll(NetClientState *nc, bool enable)
+@@ -XXX,XX +XXX,XX @@ static void tap_set_vnet_hdr_len(NetClientState *nc, int len)
-     tap_write_poll(s, enable);
- }
+     assert(nc->info->type == NET_CLIENT_DRIVER_TAP);
+     assert(len == sizeof(struct virtio_net_hdr_mrg_rxbuf) ||
-+static bool tap_set_steering_ebpf(NetClientState *nc, int prog_fd)
+-           len == sizeof(struct virtio_net_hdr));
-+{
++           len == sizeof(struct virtio_net_hdr) ||
-+    TAPState *s = DO_UPCAST(TAPState, nc, nc);
++           len == sizeof(struct virtio_net_hdr_v1_hash));
-+    assert(nc->info->type == NET_CLIENT_DRIVER_TAP);
-+
+     tap_fd_set_vnet_hdr_len(s->fd, len);
-+    return tap_fd_set_steering_ebpf(s->fd, prog_fd) == 0;
+     s->host_vnet_hdr_len = len;
 +}
 +
  int tap_get_fd(NetClientState *nc)
  {
      TAPState *s = DO_UPCAST(TAPState, nc, nc);
@@ -XXX,XX +XXX,XX @@ static NetClientInfo net_tap_info = {
      .set_vnet_hdr_len = tap_set_vnet_hdr_len,
      .set_vnet_le = tap_set_vnet_le,
      .set_vnet_be = tap_set_vnet_be,
 +    .set_steering_ebpf = tap_set_steering_ebpf,
  };
  static TAPState *net_tap_fd_init(NetClientState *peer,
 diff --git a/net/tap_int.h b/net/tap_int.h
 index XXXXXXX..XXXXXXX 100644
 --- a/net/tap_int.h
 +++ b/net/tap_int.h
@@ -XXX,XX +XXX,XX @@ int tap_fd_set_vnet_be(int fd, int vnet_is_be);
  int tap_fd_enable(int fd);
  int tap_fd_disable(int fd);
  int tap_fd_get_ifname(int fd, char *ifname);
 +int tap_fd_set_steering_ebpf(int fd, int prog_fd);
  #endif /* NET_TAP_INT_H */
 --
-.7.4
+.5.0

-New patch
+[PULL V2 04/33] virtio-net: reference implementation of hash report
+From: Yuri Benditovich <yuri.benditovich@daynix.com>
 Suggest VIRTIO_NET_F_HASH_REPORT if specified in device
 parameters.
 If the VIRTIO_NET_F_HASH_REPORT is set,
 the device extends configuration space. If the feature
 is negotiated, the packet layout is extended to
 accomodate the hash information. In this case deliver
 packet's hash value and report type in virtio header
 extension.
 Use for configuration the same procedure as already
 used for RSS. We add two fields in rss_data that
 controls what the device does with the calculated hash
 if rss_data.enabled is set. If field 'populate' is set
 the hash is set in the packet, if field 'redirect' is
 set the hash is used to decide the queue to place the
 packet to.
 Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
  hw/net/virtio-net.c            | 99 +++++++++++++++++++++++++++++++++---------
  include/hw/virtio/virtio-net.h |  2 +
 files changed, 81 insertions(+), 20 deletions(-)
 diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/net/virtio-net.c
 +++ b/hw/net/virtio-net.c
@@ -XXX,XX +XXX,XX @@ static VirtIOFeature feature_sizes[] = {
       .end = endof(struct virtio_net_config, mtu)},
      {.flags = 1ULL << VIRTIO_NET_F_SPEED_DUPLEX,
       .end = endof(struct virtio_net_config, duplex)},
 -    {.flags = 1ULL << VIRTIO_NET_F_RSS,
 +    {.flags = (1ULL << VIRTIO_NET_F_RSS) | (1ULL << VIRTIO_NET_F_HASH_REPORT),
       .end = endof(struct virtio_net_config, supported_hash_types)},
      {}
  };
@@ -XXX,XX +XXX,XX @@ static void virtio_net_get_config(VirtIODevice *vdev, uint8_t *config)
      netcfg.duplex = n->net_conf.duplex;
      netcfg.rss_max_key_size = VIRTIO_NET_RSS_MAX_KEY_SIZE;
      virtio_stw_p(vdev, &netcfg.rss_max_indirection_table_length,
 -                 VIRTIO_NET_RSS_MAX_TABLE_LEN);
 +                 virtio_host_has_feature(vdev, VIRTIO_NET_F_RSS) ?
 +                 VIRTIO_NET_RSS_MAX_TABLE_LEN : 1);
      virtio_stl_p(vdev, &netcfg.supported_hash_types,
                   VIRTIO_NET_RSS_SUPPORTED_HASHES);
      memcpy(config, &netcfg, n->config_size);
@@ -XXX,XX +XXX,XX @@ static int peer_has_ufo(VirtIONet *n)
  }
  static void virtio_net_set_mrg_rx_bufs(VirtIONet *n, int mergeable_rx_bufs,
 -                                       int version_1)
 +                                       int version_1, int hash_report)
  {
      int i;
      NetClientState *nc;
@@ -XXX,XX +XXX,XX @@ static void virtio_net_set_mrg_rx_bufs(VirtIONet *n, int mergeable_rx_bufs,
      n->mergeable_rx_bufs = mergeable_rx_bufs;
      if (version_1) {
 -        n->guest_hdr_len = sizeof(struct virtio_net_hdr_mrg_rxbuf);
 +        n->guest_hdr_len = hash_report ?
 +            sizeof(struct virtio_net_hdr_v1_hash) :
 +            sizeof(struct virtio_net_hdr_mrg_rxbuf);
 +        n->rss_data.populate_hash = !!hash_report;
      } else {
          n->guest_hdr_len = n->mergeable_rx_bufs ?
              sizeof(struct virtio_net_hdr_mrg_rxbuf) :
@@ -XXX,XX +XXX,XX @@ static uint64_t virtio_net_get_features(VirtIODevice *vdev, uint64_t features,
          virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_TSO4);
          virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_TSO6);
          virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_ECN);
 +
 +        virtio_clear_feature(&features, VIRTIO_NET_F_HASH_REPORT);
      }
      if (!peer_has_vnet_hdr(n) || !peer_has_ufo(n)) {
@@ -XXX,XX +XXX,XX @@ static uint64_t virtio_net_get_features(VirtIODevice *vdev, uint64_t features,
      }
      virtio_clear_feature(&features, VIRTIO_NET_F_RSS);
 +    virtio_clear_feature(&features, VIRTIO_NET_F_HASH_REPORT);
      features = vhost_net_get_features(get_vhost_net(nc->peer), features);
      vdev->backend_features = features;
@@ -XXX,XX +XXX,XX @@ static void virtio_net_set_features(VirtIODevice *vdev, uint64_t features)
                                 virtio_has_feature(features,
                                                    VIRTIO_NET_F_MRG_RXBUF),
                                 virtio_has_feature(features,
 -                                                  VIRTIO_F_VERSION_1));
 +                                                  VIRTIO_F_VERSION_1),
 +                               virtio_has_feature(features,
 +                                                  VIRTIO_NET_F_HASH_REPORT));
      n->rsc4_enabled = virtio_has_feature(features, VIRTIO_NET_F_RSC_EXT) &&
          virtio_has_feature(features, VIRTIO_NET_F_GUEST_TSO4);
      n->rsc6_enabled = virtio_has_feature(features, VIRTIO_NET_F_RSC_EXT) &&
          virtio_has_feature(features, VIRTIO_NET_F_GUEST_TSO6);
 +    n->rss_data.redirect = virtio_has_feature(features, VIRTIO_NET_F_RSS);
      if (n->has_vnet_hdr) {
          n->curr_guest_offloads =
@@ -XXX,XX +XXX,XX @@ static void virtio_net_disable_rss(VirtIONet *n)
  }
  static uint16_t virtio_net_handle_rss(VirtIONet *n,
 -                                      struct iovec *iov, unsigned int iov_cnt)
 +                                      struct iovec *iov,
 +                                      unsigned int iov_cnt,
 +                                      bool do_rss)
  {
      VirtIODevice *vdev = VIRTIO_DEVICE(n);
      struct virtio_net_rss_config cfg;
@@ -XXX,XX +XXX,XX @@ static uint16_t virtio_net_handle_rss(VirtIONet *n,
      const char *err_msg = "";
      uint32_t err_value = 0;
 -    if (!virtio_vdev_has_feature(vdev, VIRTIO_NET_F_RSS)) {
 +    if (do_rss && !virtio_vdev_has_feature(vdev, VIRTIO_NET_F_RSS)) {
          err_msg = "RSS is not negotiated";
          goto error;
      }
 +    if (!do_rss && !virtio_vdev_has_feature(vdev, VIRTIO_NET_F_HASH_REPORT)) {
 +        err_msg = "Hash report is not negotiated";
 +        goto error;
 +    }
      size_get = offsetof(struct virtio_net_rss_config, indirection_table);
      s = iov_to_buf(iov, iov_cnt, offset, &cfg, size_get);
      if (s != size_get) {
@@ -XXX,XX +XXX,XX @@ static uint16_t virtio_net_handle_rss(VirtIONet *n,
      n->rss_data.indirections_len =
          virtio_lduw_p(vdev, &cfg.indirection_table_mask);
      n->rss_data.indirections_len++;
 +    if (!do_rss) {
 +        n->rss_data.indirections_len = 1;
 +    }
      if (!is_power_of_2(n->rss_data.indirections_len)) {
          err_msg = "Invalid size of indirection table";
          err_value = n->rss_data.indirections_len;
@@ -XXX,XX +XXX,XX @@ static uint16_t virtio_net_handle_rss(VirtIONet *n,
          err_value = n->rss_data.indirections_len;
          goto error;
      }
 -    n->rss_data.default_queue =
 -        virtio_lduw_p(vdev, &cfg.unclassified_queue);
 +    n->rss_data.default_queue = do_rss ?
 +        virtio_lduw_p(vdev, &cfg.unclassified_queue) : 0;
      if (n->rss_data.default_queue >= n->max_queues) {
          err_msg = "Invalid default queue";
          err_value = n->rss_data.default_queue;
@@ -XXX,XX +XXX,XX @@ static uint16_t virtio_net_handle_rss(VirtIONet *n,
          err_value = (uint32_t)s;
          goto error;
      }
 -    queues = virtio_lduw_p(vdev, &temp.us);
 +    queues = do_rss ? virtio_lduw_p(vdev, &temp.us) : n->curr_queues;
      if (queues == 0 || queues > n->max_queues) {
          err_msg = "Invalid number of queues";
          err_value = queues;
@@ -XXX,XX +XXX,XX @@ static int virtio_net_handle_mq(VirtIONet *n, uint8_t cmd,
      uint16_t queues;
      virtio_net_disable_rss(n);
 +    if (cmd == VIRTIO_NET_CTRL_MQ_HASH_CONFIG) {
 +        queues = virtio_net_handle_rss(n, iov, iov_cnt, false);
 +        return queues ? VIRTIO_NET_OK : VIRTIO_NET_ERR;
 +    }
      if (cmd == VIRTIO_NET_CTRL_MQ_RSS_CONFIG) {
 -        queues = virtio_net_handle_rss(n, iov, iov_cnt);
 +        queues = virtio_net_handle_rss(n, iov, iov_cnt, true);
      } else if (cmd == VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET) {
          struct virtio_net_ctrl_mq mq;
          size_t s;
@@ -XXX,XX +XXX,XX @@ static uint8_t virtio_net_get_hash_type(bool isip4,
      return 0xff;
  }
 +static void virtio_set_packet_hash(const uint8_t *buf, uint8_t report,
 +                                   uint32_t hash)
 +{
 +    struct virtio_net_hdr_v1_hash *hdr = (void *)buf;
 +    hdr->hash_value = hash;
 +    hdr->hash_report = report;
 +}
 +
  static int virtio_net_process_rss(NetClientState *nc, const uint8_t *buf,
                                    size_t size)
  {
      VirtIONet *n = qemu_get_nic_opaque(nc);
 -    unsigned int index = nc->queue_index, new_index;
 +    unsigned int index = nc->queue_index, new_index = index;
      struct NetRxPkt *pkt = n->rx_pkt;
      uint8_t net_hash_type;
      uint32_t hash;
      bool isip4, isip6, isudp, istcp;
 +    static const uint8_t reports[NetPktRssIpV6UdpEx + 1] = {
 +        VIRTIO_NET_HASH_REPORT_IPv4,
 +        VIRTIO_NET_HASH_REPORT_TCPv4,
 +        VIRTIO_NET_HASH_REPORT_TCPv6,
 +        VIRTIO_NET_HASH_REPORT_IPv6,
 +        VIRTIO_NET_HASH_REPORT_IPv6_EX,
 +        VIRTIO_NET_HASH_REPORT_TCPv6_EX,
 +        VIRTIO_NET_HASH_REPORT_UDPv4,
 +        VIRTIO_NET_HASH_REPORT_UDPv6,
 +        VIRTIO_NET_HASH_REPORT_UDPv6_EX
 +    };
      net_rx_pkt_set_protocols(pkt, buf + n->host_hdr_len,
                               size - n->host_hdr_len);
@@ -XXX,XX +XXX,XX @@ static int virtio_net_process_rss(NetClientState *nc, const uint8_t *buf,
      net_hash_type = virtio_net_get_hash_type(isip4, isip6, isudp, istcp,
                                               n->rss_data.hash_types);
      if (net_hash_type > NetPktRssIpV6UdpEx) {
 -        return n->rss_data.default_queue;
 +        if (n->rss_data.populate_hash) {
 +            virtio_set_packet_hash(buf, VIRTIO_NET_HASH_REPORT_NONE, 0);
 +        }
 +        return n->rss_data.redirect ? n->rss_data.default_queue : -1;
      }
      hash = net_rx_pkt_calc_rss_hash(pkt, net_hash_type, n->rss_data.key);
 -    new_index = hash & (n->rss_data.indirections_len - 1);
 -    new_index = n->rss_data.indirections_table[new_index];
 -    if (index == new_index) {
 -        return -1;
 +
 +    if (n->rss_data.populate_hash) {
 +        virtio_set_packet_hash(buf, reports[net_hash_type], hash);
      }
 -    return new_index;
 +
 +    if (n->rss_data.redirect) {
 +        new_index = hash & (n->rss_data.indirections_len - 1);
 +        new_index = n->rss_data.indirections_table[new_index];
 +    }
 +
 +    return (index == new_index) ? -1 : new_index;
  }
  static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
@@ -XXX,XX +XXX,XX @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
              }
              receive_header(n, sg, elem->in_num, buf, size);
 +            if (n->rss_data.populate_hash) {
 +                offset = sizeof(mhdr);
 +                iov_from_buf(sg, elem->in_num, offset,
 +                             buf + offset, n->host_hdr_len - sizeof(mhdr));
 +            }
              offset = n->host_hdr_len;
              total += n->guest_hdr_len;
              guest_offset = n->guest_hdr_len;
@@ -XXX,XX +XXX,XX @@ static int virtio_net_post_load_device(void *opaque, int version_id)
      trace_virtio_net_post_load_device();
      virtio_net_set_mrg_rx_bufs(n, n->mergeable_rx_bufs,
                                 virtio_vdev_has_feature(vdev,
 -                                                       VIRTIO_F_VERSION_1));
 +                                                       VIRTIO_F_VERSION_1),
 +                               virtio_vdev_has_feature(vdev,
 +                                                       VIRTIO_NET_F_HASH_REPORT));
      /* MAC_TABLE_ENTRIES may be different from the saved image */
      if (n->mac_table.in_use > MAC_TABLE_ENTRIES) {
@@ -XXX,XX +XXX,XX @@ static void virtio_net_device_realize(DeviceState *dev, Error **errp)
      n->vqs[0].tx_waiting = 0;
      n->tx_burst = n->net_conf.txburst;
 -    virtio_net_set_mrg_rx_bufs(n, 0, 0);
 +    virtio_net_set_mrg_rx_bufs(n, 0, 0, 0);
      n->promisc = 1; /* for compatibility */
      n->mac_table.macs = g_malloc0(MAC_TABLE_ENTRIES * ETH_ALEN);
@@ -XXX,XX +XXX,XX @@ static Property virtio_net_properties[] = {
      DEFINE_PROP_BIT64("mq", VirtIONet, host_features, VIRTIO_NET_F_MQ, false),
      DEFINE_PROP_BIT64("rss", VirtIONet, host_features,
                      VIRTIO_NET_F_RSS, false),
 +    DEFINE_PROP_BIT64("hash", VirtIONet, host_features,
 +                    VIRTIO_NET_F_HASH_REPORT, false),
      DEFINE_PROP_BIT64("guest_rsc_ext", VirtIONet, host_features,
                      VIRTIO_NET_F_RSC_EXT, false),
      DEFINE_PROP_UINT32("rsc_interval", VirtIONet, rsc_timeout,
 diff --git a/include/hw/virtio/virtio-net.h b/include/hw/virtio/virtio-net.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/virtio/virtio-net.h
 +++ b/include/hw/virtio/virtio-net.h
@@ -XXX,XX +XXX,XX @@ typedef struct VirtioNetRscChain {
  typedef struct VirtioNetRssData {
      bool    enabled;
 +    bool    redirect;
 +    bool    populate_hash;
      uint32_t hash_types;
      uint8_t key[VIRTIO_NET_RSS_MAX_KEY_SIZE];
      uint16_t indirections_len;
 --
 .5.0

-[PULL 07/10] MAINTAINERS: Added eBPF maintainers information.
+[PULL V2 05/33] vmstate.h: provide VMSTATE_VARRAY_UINT16_ALLOC macro
-From: Andrew Melnychenko <andrew@daynix.com>
+From: Yuri Benditovich <yuri.benditovich@daynix.com>
+Similar to VMSTATE_VARRAY_UINT32_ALLOC, but the size is
+-bit field.
+Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
-Signed-off-by: Andrew Melnychenko <andrew@daynix.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- MAINTAINERS | 8 ++++++++
+ include/migration/vmstate.h | 10 ++++++++++
-file changed, 8 insertions(+)
+file changed, 10 insertions(+)
-diff --git a/MAINTAINERS b/MAINTAINERS
+diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h
 index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
+--- a/include/migration/vmstate.h
-+++ b/MAINTAINERS
++++ b/include/migration/vmstate.h
-@@ -XXX,XX +XXX,XX @@ F: include/hw/remote/proxy-memory-listener.h
+@@ -XXX,XX +XXX,XX @@ extern const VMStateInfo vmstate_info_qlist;
- F: hw/remote/iohub.c
+     .offset     = vmstate_offset_pointer(_state, _field, _type),     \
- F: include/hw/remote/iohub.h
+ }
-+EBPF:
++#define VMSTATE_VARRAY_UINT16_ALLOC(_field, _state, _field_num, _version, _info, _type) {\
-+M: Jason Wang <jasowang@redhat.com>
++    .name       = (stringify(_field)),                               \
-+R: Andrew Melnychenko <andrew@daynix.com>
++    .version_id = (_version),                                        \
-+R: Yuri Benditovich <yuri.benditovich@daynix.com>
++    .num_offset = vmstate_offset_value(_state, _field_num, uint16_t),\
-+S: Maintained
++    .info       = &(_info),                                          \
-+F: ebpf/*
++    .size       = sizeof(_type),                                     \
-+F: tools/ebpf/*
++    .flags      = VMS_VARRAY_UINT16 | VMS_POINTER | VMS_ALLOC,       \
 +    .offset     = vmstate_offset_pointer(_state, _field, _type),     \
 +}
 +
- Build and test automation
+ #define VMSTATE_VARRAY_UINT16_UNSAFE(_field, _state, _field_num, _version, _info, _type) {\
- -------------------------
+     .name       = (stringify(_field)),                               \
- Build and test automation, general continuous integration
+     .version_id = (_version),                                        \
 --
-.7.4
+.5.0

-[PULL 09/10] virtio-net: failover: add missing remove_migration_state_change_notifier()
+[PULL V2 06/33] virtio-net: add migration support for RSS and hash report
-From: Laurent Vivier <lvivier@redhat.com>
+From: Yuri Benditovich <yuri.benditovich@daynix.com>
-In the failover case configuration, virtio_net_device_realize() uses an
+Save and restore RSS/hash report configuration.
 add_migration_state_change_notifier() to add a state notifier, but this
 notifier is not removed by the unrealize function when the virtio-net
 card is unplugged.
-If the card is unplugged and a migration is started, the notifier is
+Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
 called and as it is not valid anymore QEMU crashes.
 This patch fixes the problem by adding the
 remove_migration_state_change_notifier() in virtio_net_device_unrealize().
 The problem can be reproduced with:
   $ qemu-system-x86_64 -enable-kvm -m 1g -M q35 \
     -device pcie-root-port,slot=4,id=root1 \
     -device pcie-root-port,slot=5,id=root2 \
     -device virtio-net-pci,id=net1,mac=52:54:00:6f:55:cc,failover=on,bus=root1 \
     -monitor stdio disk.qcow2
   (qemu) device_del net1
   (qemu) migrate "exec:gzip -c > STATEFILE.gz"
   Thread 1 "qemu-system-x86" received signal SIGSEGV, Segmentation fault.
 x0000000000000000 in ?? ()
   (gdb) bt
   #0  0x0000000000000000 in  ()
   #1  0x0000555555d726d7 in notifier_list_notify (...)
       at .../util/notify.c:39
   #2  0x0000555555842c1a in migrate_fd_connect (...)
       at .../migration/migration.c:3975
   #3  0x0000555555950f7d in migration_channel_connect (...)
       error@entry=0x0) at .../migration/channel.c:107
   #4  0x0000555555910922 in exec_start_outgoing_migration (...)
       at .../migration/exec.c:42
 Reported-by: Igor Mammedov <imammedo@redhat.com>
 Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
 Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Laurent Vivier <lvivier@redhat.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- hw/net/virtio-net.c | 1 +
+ hw/net/virtio-net.c | 37 +++++++++++++++++++++++++++++++++++++
-file changed, 1 insertion(+)
+file changed, 37 insertions(+)
 diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/net/virtio-net.c
 +++ b/hw/net/virtio-net.c
-@@ -XXX,XX +XXX,XX @@ static void virtio_net_device_unrealize(DeviceState *dev)
+@@ -XXX,XX +XXX,XX @@ static int virtio_net_post_load_device(void *opaque, int version_id)
+         }
      if (n->failover) {
          device_listener_unregister(&n->primary_listener);
 +        remove_migration_state_change_notifier(&n->migration_state);
      }
-     max_queues = n->multiqueue ? n->max_queues : 1;
++    if (n->rss_data.enabled) {
 +        trace_virtio_net_rss_enable(n->rss_data.hash_types,
 +                                    n->rss_data.indirections_len,
 +                                    sizeof(n->rss_data.key));
 +    } else {
 +        trace_virtio_net_rss_disable();
 +    }
      return 0;
  }
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_virtio_net_has_vnet = {
      },
  };
 +static bool virtio_net_rss_needed(void *opaque)
 +{
 +    return VIRTIO_NET(opaque)->rss_data.enabled;
 +}
 +
 +static const VMStateDescription vmstate_virtio_net_rss = {
 +    .name      = "virtio-net-device/rss",
 +    .version_id = 1,
 +    .minimum_version_id = 1,
 +    .needed = virtio_net_rss_needed,
 +    .fields = (VMStateField[]) {
 +        VMSTATE_BOOL(rss_data.enabled, VirtIONet),
 +        VMSTATE_BOOL(rss_data.redirect, VirtIONet),
 +        VMSTATE_BOOL(rss_data.populate_hash, VirtIONet),
 +        VMSTATE_UINT32(rss_data.hash_types, VirtIONet),
 +        VMSTATE_UINT16(rss_data.indirections_len, VirtIONet),
 +        VMSTATE_UINT16(rss_data.default_queue, VirtIONet),
 +        VMSTATE_UINT8_ARRAY(rss_data.key, VirtIONet,
 +                            VIRTIO_NET_RSS_MAX_KEY_SIZE),
 +        VMSTATE_VARRAY_UINT16_ALLOC(rss_data.indirections_table, VirtIONet,
 +                                    rss_data.indirections_len, 0,
 +                                    vmstate_info_uint16, uint16_t),
 +        VMSTATE_END_OF_LIST()
 +    },
 +};
 +
  static const VMStateDescription vmstate_virtio_net_device = {
      .name = "virtio-net-device",
      .version_id = VIRTIO_NET_VM_VERSION,
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_virtio_net_device = {
                              has_ctrl_guest_offloads),
          VMSTATE_END_OF_LIST()
     },
 +    .subsections = (const VMStateDescription * []) {
 +        &vmstate_virtio_net_rss,
 +        NULL
 +    }
  };
  static NetClientInfo net_virtio_info = {
 --
-.7.4
+.5.0

-[PULL 10/10] tap-bsd: Remove special casing for older OpenBSD releases
+[PULL V2 07/33] virtio-net: align RSC fields with updated virtio-net header
-From: Brad Smith <brad@comstyle.com>
+From: Yuri Benditovich <yuri.benditovich@daynix.com>
-OpenBSD added support for tap(4) 10 releases ago.
+Removal of duplicated RSC definitions. Changing names of the
 fields to ones defined in the Linux header.
-Remove the special casing for older releases.
+Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
 Signed-off-by: Brad Smith <brad@comstyle.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- net/tap-bsd.c | 8 --------
+ hw/net/virtio-net.c | 28 ++++------------------------
-file changed, 8 deletions(-)
+file changed, 4 insertions(+), 24 deletions(-)
-diff --git a/net/tap-bsd.c b/net/tap-bsd.c
+diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
 index XXXXXXX..XXXXXXX 100644
---- a/net/tap-bsd.c
+--- a/hw/net/virtio-net.c
-+++ b/net/tap-bsd.c
++++ b/hw/net/virtio-net.c
 @@ -XXX,XX +XXX,XX @@
- #include <net/if_tap.h>
+                                          VIRTIO_NET_RSS_HASH_TYPE_TCP_EX | \
- #endif
+                                          VIRTIO_NET_RSS_HASH_TYPE_UDP_EX)
--#if defined(__OpenBSD__)
+-/* temporary until standard header include it */
--#include <sys/param.h>
+-#if !defined(VIRTIO_NET_HDR_F_RSC_INFO)
 -
 -#define VIRTIO_NET_HDR_F_RSC_INFO  4 /* rsc_ext data in csum_ fields */
 -#define VIRTIO_NET_F_RSC_EXT       61
 -
 -#endif
 -
- #ifndef __FreeBSD__
+-static inline __virtio16 *virtio_net_rsc_ext_num_packets(
- int tap_open(char *ifname, int ifname_size, int *vnet_hdr,
+-    struct virtio_net_hdr *hdr)
-              int vnet_hdr_required, int mq_required, Error **errp)
+-{
-@@ -XXX,XX +XXX,XX @@ int tap_open(char *ifname, int ifname_size, int *vnet_hdr,
+-    return &hdr->csum_start;
-         if (*ifname) {
+-}
-             snprintf(dname, sizeof dname, "/dev/%s", ifname);
+-
-         } else {
+-static inline __virtio16 *virtio_net_rsc_ext_num_dupacks(
--#if defined(__OpenBSD__) && OpenBSD < 201605
+-    struct virtio_net_hdr *hdr)
--            snprintf(dname, sizeof dname, "/dev/tun%d", i);
+-{
--#else
+-    return &hdr->csum_offset;
-             snprintf(dname, sizeof dname, "/dev/tap%d", i);
+-}
--#endif
+-
-         }
+ static VirtIOFeature feature_sizes[] = {
-         TFR(fd = open(dname, O_RDWR));
+     {.flags = 1ULL << VIRTIO_NET_F_MAC,
-         if (fd >= 0) {
+      .end = endof(struct virtio_net_config, mac)},
@@ -XXX,XX +XXX,XX @@ static size_t virtio_net_rsc_drain_seg(VirtioNetRscChain *chain,
                                         VirtioNetRscSeg *seg)
  {
      int ret;
 -    struct virtio_net_hdr *h;
 +    struct virtio_net_hdr_v1 *h;
 -    h = (struct virtio_net_hdr *)seg->buf;
 +    h = (struct virtio_net_hdr_v1 *)seg->buf;
      h->flags = 0;
      h->gso_type = VIRTIO_NET_HDR_GSO_NONE;
      if (seg->is_coalesced) {
 -        *virtio_net_rsc_ext_num_packets(h) = seg->packets;
 -        *virtio_net_rsc_ext_num_dupacks(h) = seg->dup_ack;
 +        h->rsc.segments = seg->packets;
 +        h->rsc.dup_acks = seg->dup_ack;
          h->flags = VIRTIO_NET_HDR_F_RSC_INFO;
          if (chain->proto == ETH_P_IP) {
              h->gso_type = VIRTIO_NET_HDR_GSO_TCPV4;
 --
-.7.4
+.5.0

-New patch
+[PULL V2 08/33] Fix tulip breakage
+From: Helge Deller <deller@gmx.de>
+The tulip network driver in a qemu-system-hppa emulation is broken in
+the sense that bigger network packages aren't received any longer and
+thus even running e.g. "apt update" inside the VM fails.
+The breakage was introduced by commit 8ffb7265af ("check frame size and
+r/w data length") which added checks to prevent accesses outside of the
+rx/tx buffers.
+But the new checks were implemented wrong. The variable rx_frame_len
+counts backwards, from rx_frame_size down to zero, and the variable len
+is never bigger than rx_frame_len, so accesses just can't happen and the
+checks are unnecessary.
+On the contrary the checks now prevented bigger packages to be moved
+into the rx buffers.
+This patch reverts the wrong checks and were sucessfully tested with a
+qemu-system-hppa emulation.
+Fixes: 8ffb7265af ("check frame size and r/w data length")
+Buglink: https://bugs.launchpad.net/bugs/1874539
+Signed-off-by: Helge Deller <deller@gmx.de>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ hw/net/tulip.c | 6 ------
+file changed, 6 deletions(-)
+diff --git a/hw/net/tulip.c b/hw/net/tulip.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/tulip.c
++++ b/hw/net/tulip.c
+@@ -XXX,XX +XXX,XX @@ static void tulip_copy_rx_bytes(TULIPState *s, struct tulip_descriptor *desc)
+             len = s->rx_frame_len;
+         }
+-        if (s->rx_frame_len + len > sizeof(s->rx_frame)) {
+-            return;
+-        }
+         pci_dma_write(&s->dev, desc->buf_addr1, s->rx_frame +
+             (s->rx_frame_size - s->rx_frame_len), len);
+         s->rx_frame_len -= len;
+@@ -XXX,XX +XXX,XX @@ static void tulip_copy_rx_bytes(TULIPState *s, struct tulip_descriptor *desc)
+             len = s->rx_frame_len;
+         }
+-        if (s->rx_frame_len + len > sizeof(s->rx_frame)) {
+-            return;
+-        }
+         pci_dma_write(&s->dev, desc->buf_addr2, s->rx_frame +
+             (s->rx_frame_size - s->rx_frame_len), len);
+         s->rx_frame_len -= len;
+--
+.5.0

-New patch
+[PULL V2 09/33] hw/net/tulip: Fix 'Descriptor Error' definition
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Bit #14 is "DE" for 'Descriptor Error':
+  When set, indicates a frame truncation caused by a frame
+  that does not fit within the current descriptor buffers,
+  and that the 21143 does not own the next descriptor.
+  [Table 4-1. RDES0 Bit Fields Description]
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ hw/net/tulip.h | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/hw/net/tulip.h b/hw/net/tulip.h
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/tulip.h
++++ b/hw/net/tulip.h
+@@ -XXX,XX +XXX,XX @@
+ #define RDES0_RF         BIT(11)
+ #define RDES0_DT_SHIFT   12
+ #define RDES0_DT_MASK    3
+-#define RDES0_LE         BIT(14)
++#define RDES0_DE         BIT(14)
+ #define RDES0_ES         BIT(15)
+ #define RDES0_FL_SHIFT   16
+ #define RDES0_FL_MASK    0x3fff
+--
+.5.0

-New patch
+[PULL V2 10/33] hw/net/tulip: Log descriptor overflows
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Log with GUEST_ERROR what the guest is doing wrong.
+Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ hw/net/tulip.c | 6 ++++++
+file changed, 6 insertions(+)
+diff --git a/hw/net/tulip.c b/hw/net/tulip.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/tulip.c
++++ b/hw/net/tulip.c
+@@ -XXX,XX +XXX,XX @@ static int tulip_copy_tx_buffers(TULIPState *s, struct tulip_descriptor *desc)
+     int len2 = (desc->control >> TDES1_BUF2_SIZE_SHIFT) & TDES1_BUF2_SIZE_MASK;
+     if (s->tx_frame_len + len1 > sizeof(s->tx_frame)) {
++        qemu_log_mask(LOG_GUEST_ERROR,
++                      "%s: descriptor overflow (ofs: %u, len:%d, size:%zu)\n",
++                      __func__, s->tx_frame_len, len1, sizeof(s->tx_frame));
+         return -1;
+     }
+     if (len1) {
+@@ -XXX,XX +XXX,XX @@ static int tulip_copy_tx_buffers(TULIPState *s, struct tulip_descriptor *desc)
+     }
+     if (s->tx_frame_len + len2 > sizeof(s->tx_frame)) {
++        qemu_log_mask(LOG_GUEST_ERROR,
++                      "%s: descriptor overflow (ofs: %u, len:%d, size:%zu)\n",
++                      __func__, s->tx_frame_len, len2, sizeof(s->tx_frame));
+         return -1;
+     }
+     if (len2) {
+--
+.5.0

-New patch
+[PULL V2 11/33] net: cadence_gem: Fix debug statements
+From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+Enabling debug breaks the build, Fix them and make debug statements
+always compilable. Fix few statements to use sized integer casting.
+Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ hw/net/cadence_gem.c | 27 +++++++++++++--------------
+file changed, 13 insertions(+), 14 deletions(-)
+diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/cadence_gem.c
++++ b/hw/net/cadence_gem.c
+@@ -XXX,XX +XXX,XX @@
+ #include "sysemu/dma.h"
+ #include "net/checksum.h"
+-#ifdef CADENCE_GEM_ERR_DEBUG
+-#define DB_PRINT(...) do { \
+-    fprintf(stderr,  ": %s: ", __func__); \
+-    fprintf(stderr, ## __VA_ARGS__); \
+-    } while (0)
+-#else
+-    #define DB_PRINT(...)
+-#endif
++#define CADENCE_GEM_ERR_DEBUG 0
++#define DB_PRINT(...) do {\
++    if (CADENCE_GEM_ERR_DEBUG) {   \
++        qemu_log(": %s: ", __func__); \
++        qemu_log(__VA_ARGS__); \
++    } \
++} while (0)
+ #define GEM_NWCTRL        (0x00000000/4) /* Network Control reg */
+ #define GEM_NWCFG         (0x00000004/4) /* Network Config reg */
+@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
+         size += 4;
+     }
+-    DB_PRINT("config bufsize: %d packet size: %ld\n", rxbufsize, size);
++    DB_PRINT("config bufsize: %u packet size: %zd\n", rxbufsize, size);
+     /* Find which queue we are targeting */
+     q = get_queue_from_screen(s, rxbuf_ptr, rxbufsize);
+@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
+             return -1;
+         }
+-        DB_PRINT("copy %u bytes to 0x%" PRIx64 "\n",
+-                 MIN(bytes_to_copy, rxbufsize),
+-                 rx_desc_get_buffer(s, s->rx_desc[q]));
++        DB_PRINT("copy %" PRIu32 " bytes to 0x%" PRIx64 "\n",
++                MIN(bytes_to_copy, rxbufsize),
++                rx_desc_get_buffer(s, s->rx_desc[q]));
+         /* Copy packet data to emulated DMA buffer */
+         address_space_write(&s->dma_as, rx_desc_get_buffer(s, s->rx_desc[q]) +
+@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
+              */
+             if ((tx_desc_get_buffer(s, desc) == 0) ||
+                 (tx_desc_get_length(desc) == 0)) {
+-                DB_PRINT("Invalid TX descriptor @ 0x%x\n",
+-                         (unsigned)packet_desc_addr);
++                DB_PRINT("Invalid TX descriptor @ 0x%" HWADDR_PRIx "\n",
++                         packet_desc_addr);
+                 break;
+             }
+--
+.5.0

-[PULL 04/10] ebpf: Added eBPF RSS loader.
+[PULL V2 12/33] net: cadence_gem: Fix the queue address update during wrap around
-From: Andrew Melnychenko <andrew@daynix.com>
+From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
-Added function that loads RSS eBPF program.
+During wrap around and reset, queues are pointing to initial base
-Added stub functions for RSS eBPF loader.
+address of queue 0, irrespective of what queue we are dealing with.
-Added meson and configuration options.
+Fix it by assigning proper base address every time.
-By default, eBPF feature enabled if libbpf is present in the build system.
+Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
-libbpf checked in configuration shell script and meson script.
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
 Signed-off-by: Andrew Melnychenko <andrew@daynix.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- configure               |   8 +-
+ hw/net/cadence_gem.c | 37 +++++++++++++++++++++++++++++++++----
- ebpf/ebpf_rss-stub.c    |  40 +++++
+file changed, 33 insertions(+), 4 deletions(-)
  ebpf/ebpf_rss.c         | 165 ++++++++++++++++++
  ebpf/ebpf_rss.h         |  44 +++++
  ebpf/meson.build        |   1 +
  ebpf/rss.bpf.skeleton.h | 431 ++++++++++++++++++++++++++++++++++++++++++++++++
  ebpf/trace-events       |   4 +
  ebpf/trace.h            |   1 +
  meson.build             |  23 +++
  meson_options.txt       |   2 +
 files changed, 718 insertions(+), 1 deletion(-)
  create mode 100644 ebpf/ebpf_rss-stub.c
  create mode 100644 ebpf/ebpf_rss.c
  create mode 100644 ebpf/ebpf_rss.h
  create mode 100644 ebpf/meson.build
  create mode 100644 ebpf/rss.bpf.skeleton.h
  create mode 100644 ebpf/trace-events
  create mode 100644 ebpf/trace.h
-diff --git a/configure b/configure
+diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
-index XXXXXXX..XXXXXXX 100755
+index XXXXXXX..XXXXXXX 100644
---- a/configure
+--- a/hw/net/cadence_gem.c
-+++ b/configure
++++ b/hw/net/cadence_gem.c
-@@ -XXX,XX +XXX,XX @@ vhost_vsock="$default_feature"
+@@ -XXX,XX +XXX,XX @@ static int get_queue_from_screen(CadenceGEMState *s, uint8_t *rxbuf_ptr,
- vhost_user="no"
+     return 0;
- vhost_user_blk_server="auto"
+ }
- vhost_user_fs="$default_feature"
-+bpf="auto"
++static uint32_t gem_get_queue_base_addr(CadenceGEMState *s, bool tx, int q)
- kvm="auto"
++{
- hax="auto"
++    uint32_t base_addr = 0;
  hvf="auto"
@@ -XXX,XX +XXX,XX @@ for opt do
    ;;
    --enable-membarrier) membarrier="yes"
    ;;
 +  --disable-bpf) bpf="disabled"
 +  ;;
 +  --enable-bpf) bpf="enabled"
 +  ;;
    --disable-blobs) blobs="false"
    ;;
    --with-pkgversion=*) pkgversion="$optarg"
@@ -XXX,XX +XXX,XX @@ disabled with --disable-FEATURE, default is enabled if available
    vhost-user      vhost-user backend support
    vhost-user-blk-server    vhost-user-blk server support
    vhost-vdpa      vhost-vdpa kernel backend support
 +  bpf             BPF kernel support
    spice           spice
    rbd             rados block device (rbd)
    libiscsi        iscsi support
@@ -XXX,XX +XXX,XX @@ NINJA=$ninja $meson setup \
          -Dattr=$attr -Ddefault_devices=$default_devices \
          -Ddocs=$docs -Dsphinx_build=$sphinx_build -Dinstall_blobs=$blobs \
          -Dvhost_user_blk_server=$vhost_user_blk_server -Dmultiprocess=$multiprocess \
 -        -Dfuse=$fuse -Dfuse_lseek=$fuse_lseek -Dguest_agent_msi=$guest_agent_msi \
 +        -Dfuse=$fuse -Dfuse_lseek=$fuse_lseek -Dguest_agent_msi=$guest_agent_msi -Dbpf=$bpf\
          $(if test "$default_features" = no; then echo "-Dauto_features=disabled"; fi) \
      -Dtcg_interpreter=$tcg_interpreter \
          $cross_arg \
 diff --git a/ebpf/ebpf_rss-stub.c b/ebpf/ebpf_rss-stub.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/ebpf/ebpf_rss-stub.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * eBPF RSS stub file
 + *
 + * Developed by Daynix Computing LTD (http://www.daynix.com)
 + *
 + * Authors:
 + *  Yuri Benditovich <yuri.benditovich@daynix.com>
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2.  See
 + * the COPYING file in the top-level directory.
 + */
 +
-+#include "qemu/osdep.h"
++    switch (q) {
-+#include "ebpf/ebpf_rss.h"
++    case 0:
 +        base_addr = s->regs[tx ? GEM_TXQBASE : GEM_RXQBASE];
 +        break;
 +    case 1 ... (MAX_PRIORITY_QUEUES - 1):
 +        base_addr = s->regs[(tx ? GEM_TRANSMIT_Q1_PTR :
 +                                 GEM_RECEIVE_Q1_PTR) + q - 1];
 +        break;
 +    default:
 +        g_assert_not_reached();
 +    };
 +
-+void ebpf_rss_init(struct EBPFRSSContext *ctx)
++    return base_addr;
 +{
 +
 +}
 +
-+bool ebpf_rss_is_loaded(struct EBPFRSSContext *ctx)
++static inline uint32_t gem_get_tx_queue_base_addr(CadenceGEMState *s, int q)
 +{
-+    return false;
++    return gem_get_queue_base_addr(s, true, q);
 +}
 +
-+bool ebpf_rss_load(struct EBPFRSSContext *ctx)
++static inline uint32_t gem_get_rx_queue_base_addr(CadenceGEMState *s, int q)
 +{
-+    return false;
++    return gem_get_queue_base_addr(s, false, q);
 +}
 +
-+bool ebpf_rss_set_all(struct EBPFRSSContext *ctx, struct EBPFRSSConfig *config,
+ static hwaddr gem_get_desc_addr(CadenceGEMState *s, bool tx, int q)
-+                      uint16_t *indirections_table, uint8_t *toeplitz_key)
+ {
-+{
+     hwaddr desc_addr = 0;
-+    return false;
+@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
-+}
+         /* Next descriptor */
-+
+         if (rx_desc_get_wrap(s->rx_desc[q])) {
-+void ebpf_rss_unload(struct EBPFRSSContext *ctx)
+             DB_PRINT("wrapping RX descriptor list\n");
-+{
+-            s->rx_desc_addr[q] = s->regs[GEM_RXQBASE];
-+
++            s->rx_desc_addr[q] = gem_get_rx_queue_base_addr(s, q);
-+}
+         } else {
-diff --git a/ebpf/ebpf_rss.c b/ebpf/ebpf_rss.c
+             DB_PRINT("incrementing RX descriptor list\n");
-new file mode 100644
+             s->rx_desc_addr[q] += 4 * gem_get_desc_len(s, true);
-index XXXXXXX..XXXXXXX
+@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
---- /dev/null
+                                     sizeof(desc_first));
-+++ b/ebpf/ebpf_rss.c
+                 /* Advance the hardware current descriptor past this packet */
-@@ -XXX,XX +XXX,XX @@
+                 if (tx_desc_get_wrap(desc)) {
-+/*
+-                    s->tx_desc_addr[q] = s->regs[GEM_TXQBASE];
-+ * eBPF RSS loader
++                    s->tx_desc_addr[q] = gem_get_tx_queue_base_addr(s, q);
-+ *
+                 } else {
-+ * Developed by Daynix Computing LTD (http://www.daynix.com)
+                     s->tx_desc_addr[q] = packet_desc_addr +
-+ *
+* gem_get_desc_len(s, false);
-+ * Authors:
+@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
-+ *  Andrew Melnychenko <andrew@daynix.com>
+                 } else {
-+ *  Yuri Benditovich <yuri.benditovich@daynix.com>
+                     packet_desc_addr = 0;
-+ *
+                 }
-+ * This work is licensed under the terms of the GNU GPL, version 2.  See
+-                packet_desc_addr |= s->regs[GEM_TXQBASE];
-+ * the COPYING file in the top-level directory.
++                packet_desc_addr |= gem_get_tx_queue_base_addr(s, q);
-+ */
+             } else {
-+
+                 packet_desc_addr += 4 * gem_get_desc_len(s, false);
-+#include "qemu/osdep.h"
+             }
-+#include "qemu/error-report.h"
+@@ -XXX,XX +XXX,XX @@ static void gem_write(void *opaque, hwaddr offset, uint64_t val,
-+
+         if (!(val & GEM_NWCTRL_TXENA)) {
-+#include <bpf/libbpf.h>
+             /* Reset to start of Q when transmit disabled. */
-+#include <bpf/bpf.h>
+             for (i = 0; i < s->num_priority_queues; i++) {
-+
+-                s->tx_desc_addr[i] = s->regs[GEM_TXQBASE];
-+#include "hw/virtio/virtio-net.h" /* VIRTIO_NET_RSS_MAX_TABLE_LEN */
++                s->tx_desc_addr[i] = gem_get_tx_queue_base_addr(s, i);
-+
+             }
-+#include "ebpf/ebpf_rss.h"
+         }
-+#include "ebpf/rss.bpf.skeleton.h"
+         if (gem_can_receive(qemu_get_queue(s->nic))) {
 +#include "trace.h"
 +
 +void ebpf_rss_init(struct EBPFRSSContext *ctx)
 +{
 +    if (ctx != NULL) {
 +        ctx->obj = NULL;
 +    }
 +}
 +
 +bool ebpf_rss_is_loaded(struct EBPFRSSContext *ctx)
 +{
 +    return ctx != NULL && ctx->obj != NULL;
 +}
 +
 +bool ebpf_rss_load(struct EBPFRSSContext *ctx)
 +{
 +    struct rss_bpf *rss_bpf_ctx;
 +
 +    if (ctx == NULL) {
 +        return false;
 +    }
 +
 +    rss_bpf_ctx = rss_bpf__open();
 +    if (rss_bpf_ctx == NULL) {
 +        trace_ebpf_error("eBPF RSS", "can not open eBPF RSS object");
 +        goto error;
 +    }
 +
 +    bpf_program__set_socket_filter(rss_bpf_ctx->progs.tun_rss_steering_prog);
 +
 +    if (rss_bpf__load(rss_bpf_ctx)) {
 +        trace_ebpf_error("eBPF RSS", "can not load RSS program");
 +        goto error;
 +    }
 +
 +    ctx->obj = rss_bpf_ctx;
 +    ctx->program_fd = bpf_program__fd(
 +            rss_bpf_ctx->progs.tun_rss_steering_prog);
 +    ctx->map_configuration = bpf_map__fd(
 +            rss_bpf_ctx->maps.tap_rss_map_configurations);
 +    ctx->map_indirections_table = bpf_map__fd(
 +            rss_bpf_ctx->maps.tap_rss_map_indirection_table);
 +    ctx->map_toeplitz_key = bpf_map__fd(
 +            rss_bpf_ctx->maps.tap_rss_map_toeplitz_key);
 +
 +    return true;
 +error:
 +    rss_bpf__destroy(rss_bpf_ctx);
 +    ctx->obj = NULL;
 +
 +    return false;
 +}
 +
 +static bool ebpf_rss_set_config(struct EBPFRSSContext *ctx,
 +                                struct EBPFRSSConfig *config)
 +{
 +    uint32_t map_key = 0;
 +
 +    if (!ebpf_rss_is_loaded(ctx)) {
 +        return false;
 +    }
 +    if (bpf_map_update_elem(ctx->map_configuration,
 +                            &map_key, config, 0) < 0) {
 +        return false;
 +    }
 +    return true;
 +}
 +
 +static bool ebpf_rss_set_indirections_table(struct EBPFRSSContext *ctx,
 +                                            uint16_t *indirections_table,
 +                                            size_t len)
 +{
 +    uint32_t i = 0;
 +
 +    if (!ebpf_rss_is_loaded(ctx) || indirections_table == NULL ||
 +       len > VIRTIO_NET_RSS_MAX_TABLE_LEN) {
 +        return false;
 +    }
 +
 +    for (; i < len; ++i) {
 +        if (bpf_map_update_elem(ctx->map_indirections_table, &i,
 +                                indirections_table + i, 0) < 0) {
 +            return false;
 +        }
 +    }
 +    return true;
 +}
 +
 +static bool ebpf_rss_set_toepliz_key(struct EBPFRSSContext *ctx,
 +                                     uint8_t *toeplitz_key)
 +{
 +    uint32_t map_key = 0;
 +
 +    /* prepare toeplitz key */
 +    uint8_t toe[VIRTIO_NET_RSS_MAX_KEY_SIZE] = {};
 +
 +    if (!ebpf_rss_is_loaded(ctx) || toeplitz_key == NULL) {
 +        return false;
 +    }
 +    memcpy(toe, toeplitz_key, VIRTIO_NET_RSS_MAX_KEY_SIZE);
 +    *(uint32_t *)toe = ntohl(*(uint32_t *)toe);
 +
 +    if (bpf_map_update_elem(ctx->map_toeplitz_key, &map_key, toe,
 +                            0) < 0) {
 +        return false;
 +    }
 +    return true;
 +}
 +
 +bool ebpf_rss_set_all(struct EBPFRSSContext *ctx, struct EBPFRSSConfig *config,
 +                      uint16_t *indirections_table, uint8_t *toeplitz_key)
 +{
 +    if (!ebpf_rss_is_loaded(ctx) || config == NULL ||
 +        indirections_table == NULL || toeplitz_key == NULL) {
 +        return false;
 +    }
 +
 +    if (!ebpf_rss_set_config(ctx, config)) {
 +        return false;
 +    }
 +
 +    if (!ebpf_rss_set_indirections_table(ctx, indirections_table,
 +                                      config->indirections_len)) {
 +        return false;
 +    }
 +
 +    if (!ebpf_rss_set_toepliz_key(ctx, toeplitz_key)) {
 +        return false;
 +    }
 +
 +    return true;
 +}
 +
 +void ebpf_rss_unload(struct EBPFRSSContext *ctx)
 +{
 +    if (!ebpf_rss_is_loaded(ctx)) {
 +        return;
 +    }
 +
 +    rss_bpf__destroy(ctx->obj);
 +    ctx->obj = NULL;
 +}
 diff --git a/ebpf/ebpf_rss.h b/ebpf/ebpf_rss.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/ebpf/ebpf_rss.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * eBPF RSS header
 + *
 + * Developed by Daynix Computing LTD (http://www.daynix.com)
 + *
 + * Authors:
 + *  Andrew Melnychenko <andrew@daynix.com>
 + *  Yuri Benditovich <yuri.benditovich@daynix.com>
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2.  See
 + * the COPYING file in the top-level directory.
 + */
 +
 +#ifndef QEMU_EBPF_RSS_H
 +#define QEMU_EBPF_RSS_H
 +
 +struct EBPFRSSContext {
 +    void *obj;
 +    int program_fd;
 +    int map_configuration;
 +    int map_toeplitz_key;
 +    int map_indirections_table;
 +};
 +
 +struct EBPFRSSConfig {
 +    uint8_t redirect;
 +    uint8_t populate_hash;
 +    uint32_t hash_types;
 +    uint16_t indirections_len;
 +    uint16_t default_queue;
 +} __attribute__((packed));
 +
 +void ebpf_rss_init(struct EBPFRSSContext *ctx);
 +
 +bool ebpf_rss_is_loaded(struct EBPFRSSContext *ctx);
 +
 +bool ebpf_rss_load(struct EBPFRSSContext *ctx);
 +
 +bool ebpf_rss_set_all(struct EBPFRSSContext *ctx, struct EBPFRSSConfig *config,
 +                      uint16_t *indirections_table, uint8_t *toeplitz_key);
 +
 +void ebpf_rss_unload(struct EBPFRSSContext *ctx);
 +
 +#endif /* QEMU_EBPF_RSS_H */
 diff --git a/ebpf/meson.build b/ebpf/meson.build
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/ebpf/meson.build
@@ -0,0 +1 @@
 +common_ss.add(when: libbpf, if_true: files('ebpf_rss.c'), if_false: files('ebpf_rss-stub.c'))
 diff --git a/ebpf/rss.bpf.skeleton.h b/ebpf/rss.bpf.skeleton.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/ebpf/rss.bpf.skeleton.h
@@ -XXX,XX +XXX,XX @@
 +/* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */
 +
 +/* THIS FILE IS AUTOGENERATED! */
 +#ifndef __RSS_BPF_SKEL_H__
 +#define __RSS_BPF_SKEL_H__
 +
 +#include <stdlib.h>
 +#include <bpf/libbpf.h>
 +
 +struct rss_bpf {
 +    struct bpf_object_skeleton *skeleton;
 +    struct bpf_object *obj;
 +    struct {
 +        struct bpf_map *tap_rss_map_configurations;
 +        struct bpf_map *tap_rss_map_indirection_table;
 +        struct bpf_map *tap_rss_map_toeplitz_key;
 +    } maps;
 +    struct {
 +        struct bpf_program *tun_rss_steering_prog;
 +    } progs;
 +    struct {
 +        struct bpf_link *tun_rss_steering_prog;
 +    } links;
 +};
 +
 +static void
 +rss_bpf__destroy(struct rss_bpf *obj)
 +{
 +    if (!obj)
 +        return;
 +    if (obj->skeleton)
 +        bpf_object__destroy_skeleton(obj->skeleton);
 +    free(obj);
 +}
 +
 +static inline int
 +rss_bpf__create_skeleton(struct rss_bpf *obj);
 +
 +static inline struct rss_bpf *
 +rss_bpf__open_opts(const struct bpf_object_open_opts *opts)
 +{
 +    struct rss_bpf *obj;
 +
 +    obj = (struct rss_bpf *)calloc(1, sizeof(*obj));
 +    if (!obj)
 +        return NULL;
 +    if (rss_bpf__create_skeleton(obj))
 +        goto err;
 +    if (bpf_object__open_skeleton(obj->skeleton, opts))
 +        goto err;
 +
 +    return obj;
 +err:
 +    rss_bpf__destroy(obj);
 +    return NULL;
 +}
 +
 +static inline struct rss_bpf *
 +rss_bpf__open(void)
 +{
 +    return rss_bpf__open_opts(NULL);
 +}
 +
 +static inline int
 +rss_bpf__load(struct rss_bpf *obj)
 +{
 +    return bpf_object__load_skeleton(obj->skeleton);
 +}
 +
 +static inline struct rss_bpf *
 +rss_bpf__open_and_load(void)
 +{
 +    struct rss_bpf *obj;
 +
 +    obj = rss_bpf__open();
 +    if (!obj)
 +        return NULL;
 +    if (rss_bpf__load(obj)) {
 +        rss_bpf__destroy(obj);
 +        return NULL;
 +    }
 +    return obj;
 +}
 +
 +static inline int
 +rss_bpf__attach(struct rss_bpf *obj)
 +{
 +    return bpf_object__attach_skeleton(obj->skeleton);
 +}
 +
 +static inline void
 +rss_bpf__detach(struct rss_bpf *obj)
 +{
 +    return bpf_object__detach_skeleton(obj->skeleton);
 +}
 +
 +static inline int
 +rss_bpf__create_skeleton(struct rss_bpf *obj)
 +{
 +    struct bpf_object_skeleton *s;
 +
 +    s = (struct bpf_object_skeleton *)calloc(1, sizeof(*s));
 +    if (!s)
 +        return -1;
 +    obj->skeleton = s;
 +
 +    s->sz = sizeof(*s);
 +    s->name = "rss_bpf";
 +    s->obj = &obj->obj;
 +
 +    /* maps */
 +    s->map_cnt = 3;
 +    s->map_skel_sz = sizeof(*s->maps);
 +    s->maps = (struct bpf_map_skeleton *)calloc(s->map_cnt, s->map_skel_sz);
 +    if (!s->maps)
 +        goto err;
 +
 +    s->maps[0].name = "tap_rss_map_configurations";
 +    s->maps[0].map = &obj->maps.tap_rss_map_configurations;
 +
 +    s->maps[1].name = "tap_rss_map_indirection_table";
 +    s->maps[1].map = &obj->maps.tap_rss_map_indirection_table;
 +
 +    s->maps[2].name = "tap_rss_map_toeplitz_key";
 +    s->maps[2].map = &obj->maps.tap_rss_map_toeplitz_key;
 +
 +    /* programs */
 +    s->prog_cnt = 1;
 +    s->prog_skel_sz = sizeof(*s->progs);
 +    s->progs = (struct bpf_prog_skeleton *)calloc(s->prog_cnt, s->prog_skel_sz);
 +    if (!s->progs)
 +        goto err;
 +
 +    s->progs[0].name = "tun_rss_steering_prog";
 +    s->progs[0].prog = &obj->progs.tun_rss_steering_prog;
 +    s->progs[0].link = &obj->links.tun_rss_steering_prog;
 +
 +    s->data_sz = 8088;
 +    s->data = (void *)"\
 +\x7f\x45\x4c\x46\x02\x01\x01\0\0\0\0\0\0\0\0\0\x01\0\xf7\0\x01\0\0\0\0\0\0\0\0\
 +\0\0\0\0\0\0\0\0\0\0\0\x18\x1d\0\0\0\0\0\0\0\0\0\0\x40\0\0\0\0\0\x40\0\x0a\0\
 +\x01\0\xbf\x18\0\0\0\0\0\0\xb7\x01\0\0\0\0\0\0\x63\x1a\x4c\xff\0\0\0\0\xbf\xa7\
 +\0\0\0\0\0\0\x07\x07\0\0\x4c\xff\xff\xff\x18\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
 +\xbf\x72\0\0\0\0\0\0\x85\0\0\0\x01\0\0\0\xbf\x06\0\0\0\0\0\0\x18\x01\0\0\0\0\0\
 +\0\0\0\0\0\0\0\0\0\xbf\x72\0\0\0\0\0\0\x85\0\0\0\x01\0\0\0\xbf\x07\0\0\0\0\0\0\
 +\x18\0\0\0\xff\xff\xff\xff\0\0\0\0\0\0\0\0\x15\x06\x66\x02\0\0\0\0\xbf\x79\0\0\
 +\0\0\0\0\x15\x09\x64\x02\0\0\0\0\x71\x61\0\0\0\0\0\0\x55\x01\x01\0\0\0\0\0\x05\
 +\0\x5d\x02\0\0\0\0\xb7\x01\0\0\0\0\0\0\x63\x1a\xc0\xff\0\0\0\0\x7b\x1a\xb8\xff\
 +\0\0\0\0\x7b\x1a\xb0\xff\0\0\0\0\x7b\x1a\xa8\xff\0\0\0\0\x7b\x1a\xa0\xff\0\0\0\
 +\0\x63\x1a\x98\xff\0\0\0\0\x7b\x1a\x90\xff\0\0\0\0\x7b\x1a\x88\xff\0\0\0\0\x7b\
 +\x1a\x80\xff\0\0\0\0\x7b\x1a\x78\xff\0\0\0\0\x7b\x1a\x70\xff\0\0\0\0\x7b\x1a\
 +\x68\xff\0\0\0\0\x7b\x1a\x60\xff\0\0\0\0\x7b\x1a\x58\xff\0\0\0\0\x7b\x1a\x50\
 +\xff\0\0\0\0\x15\x08\x4c\x02\0\0\0\0\x6b\x1a\xd0\xff\0\0\0\0\xbf\xa3\0\0\0\0\0\
 +\0\x07\x03\0\0\xd0\xff\xff\xff\xbf\x81\0\0\0\0\0\0\xb7\x02\0\0\x0c\0\0\0\xb7\
 +\x04\0\0\x02\0\0\0\xb7\x05\0\0\0\0\0\0\x85\0\0\0\x44\0\0\0\x67\0\0\0\x20\0\0\0\
 +\x77\0\0\0\x20\0\0\0\x55\0\x11\0\0\0\0\0\xb7\x02\0\0\x10\0\0\0\x69\xa1\xd0\xff\
 +\0\0\0\0\xbf\x13\0\0\0\0\0\0\xdc\x03\0\0\x10\0\0\0\x15\x03\x02\0\0\x81\0\0\x55\
 +\x03\x0c\0\xa8\x88\0\0\xb7\x02\0\0\x14\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\
 +\xd0\xff\xff\xff\xbf\x81\0\0\0\0\0\0\xb7\x04\0\0\x02\0\0\0\xb7\x05\0\0\0\0\0\0\
 +\x85\0\0\0\x44\0\0\0\x69\xa1\xd0\xff\0\0\0\0\x67\0\0\0\x20\0\0\0\x77\0\0\0\x20\
 +\0\0\0\x15\0\x01\0\0\0\0\0\x05\0\x2f\x02\0\0\0\0\x15\x01\x2e\x02\0\0\0\0\x7b\
 +\x9a\x30\xff\0\0\0\0\x15\x01\x57\0\x86\xdd\0\0\x55\x01\x3b\0\x08\0\0\0\x7b\x7a\
 +\x20\xff\0\0\0\0\xb7\x07\0\0\x01\0\0\0\x73\x7a\x50\xff\0\0\0\0\xb7\x01\0\0\0\0\
 +\0\0\x63\x1a\xe0\xff\0\0\0\0\x7b\x1a\xd8\xff\0\0\0\0\x7b\x1a\xd0\xff\0\0\0\0\
 +\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\xd0\xff\xff\xff\xbf\x81\0\0\0\0\0\0\xb7\x02\0\
 +\0\0\0\0\0\xb7\x04\0\0\x14\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\0\0\0\x67\
 +\0\0\0\x20\0\0\0\x77\0\0\0\x20\0\0\0\x55\0\x1a\x02\0\0\0\0\x69\xa1\xd6\xff\0\0\
 +\0\0\x55\x01\x01\0\0\0\0\0\xb7\x07\0\0\0\0\0\0\x61\xa1\xdc\xff\0\0\0\0\x63\x1a\
 +\x5c\xff\0\0\0\0\x61\xa1\xe0\xff\0\0\0\0\x63\x1a\x60\xff\0\0\0\0\x73\x7a\x56\
 +\xff\0\0\0\0\x71\xa9\xd9\xff\0\0\0\0\x71\xa1\xd0\xff\0\0\0\0\x67\x01\0\0\x02\0\
 +\0\0\x57\x01\0\0\x3c\0\0\0\x7b\x1a\x40\xff\0\0\0\0\x79\xa7\x20\xff\0\0\0\0\xbf\
 +\x91\0\0\0\0\0\0\x57\x01\0\0\xff\0\0\0\x15\x01\x19\0\0\0\0\0\x71\xa1\x56\xff\0\
 +\0\0\0\x55\x01\x17\0\0\0\0\0\x57\x09\0\0\xff\0\0\0\x15\x09\x7a\x01\x11\0\0\0\
 +\x55\x09\x14\0\x06\0\0\0\xb7\x01\0\0\x01\0\0\0\x73\x1a\x53\xff\0\0\0\0\xb7\x01\
 +\0\0\0\0\0\0\x63\x1a\xe0\xff\0\0\0\0\x7b\x1a\xd8\xff\0\0\0\0\x7b\x1a\xd0\xff\0\
 +\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\xd0\xff\xff\xff\xbf\x81\0\0\0\0\0\0\x79\
 +\xa2\x40\xff\0\0\0\0\xb7\x04\0\0\x14\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\
 +\0\0\0\x67\0\0\0\x20\0\0\0\x77\0\0\0\x20\0\0\0\x55\0\xf4\x01\0\0\0\0\x69\xa1\
 +\xd0\xff\0\0\0\0\x6b\x1a\x58\xff\0\0\0\0\x69\xa1\xd2\xff\0\0\0\0\x6b\x1a\x5a\
 +\xff\0\0\0\0\x71\xa1\x50\xff\0\0\0\0\x15\x01\xd4\0\0\0\0\0\x71\x62\x03\0\0\0\0\
 +\0\x67\x02\0\0\x08\0\0\0\x71\x61\x02\0\0\0\0\0\x4f\x12\0\0\0\0\0\0\x71\x63\x04\
 +\0\0\0\0\0\x71\x61\x05\0\0\0\0\0\x67\x01\0\0\x08\0\0\0\x4f\x31\0\0\0\0\0\0\x67\
 +\x01\0\0\x10\0\0\0\x4f\x21\0\0\0\0\0\0\x71\xa2\x53\xff\0\0\0\0\x79\xa0\x30\xff\
 +\0\0\0\0\x15\x02\x06\x01\0\0\0\0\xbf\x12\0\0\0\0\0\0\x57\x02\0\0\x02\0\0\0\x15\
 +\x02\x03\x01\0\0\0\0\x61\xa1\x5c\xff\0\0\0\0\x63\x1a\xa0\xff\0\0\0\0\x61\xa1\
 +\x60\xff\0\0\0\0\x63\x1a\xa4\xff\0\0\0\0\x69\xa1\x58\xff\0\0\0\0\x6b\x1a\xa8\
 +\xff\0\0\0\0\x69\xa1\x5a\xff\0\0\0\0\x6b\x1a\xaa\xff\0\0\0\0\x05\0\x65\x01\0\0\
 +\0\0\xb7\x01\0\0\x01\0\0\0\x73\x1a\x51\xff\0\0\0\0\xb7\x01\0\0\0\0\0\0\x7b\x1a\
 +\xf0\xff\0\0\0\0\x7b\x1a\xe8\xff\0\0\0\0\x7b\x1a\xe0\xff\0\0\0\0\x7b\x1a\xd8\
 +\xff\0\0\0\0\x7b\x1a\xd0\xff\0\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\xd0\xff\
 +\xff\xff\xb7\x01\0\0\x28\0\0\0\x7b\x1a\x40\xff\0\0\0\0\xbf\x81\0\0\0\0\0\0\xb7\
 +\x02\0\0\0\0\0\0\xb7\x04\0\0\x28\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\0\0\
 +\0\x67\0\0\0\x20\0\0\0\x77\0\0\0\x20\0\0\0\x55\0\x10\x01\0\0\0\0\x79\xa1\xe0\
 +\xff\0\0\0\0\x63\x1a\x64\xff\0\0\0\0\x77\x01\0\0\x20\0\0\0\x63\x1a\x68\xff\0\0\
 +\0\0\x79\xa1\xd8\xff\0\0\0\0\x63\x1a\x5c\xff\0\0\0\0\x77\x01\0\0\x20\0\0\0\x63\
 +\x1a\x60\xff\0\0\0\0\x79\xa1\xe8\xff\0\0\0\0\x63\x1a\x6c\xff\0\0\0\0\x77\x01\0\
 +\0\x20\0\0\0\x63\x1a\x70\xff\0\0\0\0\x79\xa1\xf0\xff\0\0\0\0\x63\x1a\x74\xff\0\
 +\0\0\0\x77\x01\0\0\x20\0\0\0\x63\x1a\x78\xff\0\0\0\0\x71\xa9\xd6\xff\0\0\0\0\
 +\x25\x09\xff\0\x3c\0\0\0\xb7\x01\0\0\x01\0\0\0\x6f\x91\0\0\0\0\0\0\x18\x02\0\0\
 +\x01\0\0\0\0\0\0\0\0\x18\0\x1c\x5f\x21\0\0\0\0\0\0\x55\x01\x01\0\0\0\0\0\x05\0\
 +\xf8\0\0\0\0\0\xb7\x01\0\0\0\0\0\0\x6b\x1a\xfe\xff\0\0\0\0\xb7\x01\0\0\x28\0\0\
 +\0\x7b\x1a\x40\xff\0\0\0\0\xbf\xa1\0\0\0\0\0\0\x07\x01\0\0\x8c\xff\xff\xff\x7b\
 +\x1a\x18\xff\0\0\0\0\xbf\xa1\0\0\0\0\0\0\x07\x01\0\0\x7c\xff\xff\xff\x7b\x1a\
 +\x10\xff\0\0\0\0\xb7\x01\0\0\0\0\0\0\x7b\x1a\x28\xff\0\0\0\0\x7b\x7a\x20\xff\0\
 +\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\xfe\xff\xff\xff\xbf\x81\0\0\0\0\0\0\x79\
 +\xa2\x40\xff\0\0\0\0\xb7\x04\0\0\x02\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\
 +\0\0\0\x67\0\0\0\x20\0\0\0\x77\0\0\0\x20\0\0\0\x15\0\x01\0\0\0\0\0\x05\0\x90\
 +\x01\0\0\0\0\xbf\x91\0\0\0\0\0\0\x15\x01\x23\0\x3c\0\0\0\x15\x01\x59\0\x2c\0\0\
 +\0\x55\x01\x5a\0\x2b\0\0\0\xb7\x01\0\0\0\0\0\0\x63\x1a\xf8\xff\0\0\0\0\xbf\xa3\
 +\0\0\0\0\0\0\x07\x03\0\0\xf8\xff\xff\xff\xbf\x81\0\0\0\0\0\0\x79\xa2\x40\xff\0\
 +\0\0\0\xb7\x04\0\0\x04\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\0\0\0\xbf\x01\
 +\0\0\0\0\0\0\x67\x01\0\0\x20\0\0\0\x77\x01\0\0\x20\0\0\0\x55\x01\x03\x01\0\0\0\
 +\0\x71\xa1\xfa\xff\0\0\0\0\x55\x01\x4b\0\x02\0\0\0\x71\xa1\xf9\xff\0\0\0\0\x55\
 +\x01\x49\0\x02\0\0\0\x71\xa1\xfb\xff\0\0\0\0\x55\x01\x47\0\x01\0\0\0\x79\xa2\
 +\x40\xff\0\0\0\0\x07\x02\0\0\x08\0\0\0\xbf\x81\0\0\0\0\0\0\x79\xa3\x18\xff\0\0\
 +\0\0\xb7\x04\0\0\x10\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\0\0\0\xbf\x01\0\
 +\0\0\0\0\0\x67\x01\0\0\x20\0\0\0\x77\x01\0\0\x20\0\0\0\x55\x01\xf2\0\0\0\0\0\
 +\xb7\x01\0\0\x01\0\0\0\x73\x1a\x55\xff\0\0\0\0\x05\0\x39\0\0\0\0\0\xb7\x01\0\0\
 +\0\0\0\0\x6b\x1a\xf8\xff\0\0\0\0\xb7\x09\0\0\x02\0\0\0\xb7\x07\0\0\x1e\0\0\0\
 +\x05\0\x0e\0\0\0\0\0\x79\xa2\x38\xff\0\0\0\0\x0f\x29\0\0\0\0\0\0\xbf\x92\0\0\0\
 +\0\0\0\x07\x02\0\0\x01\0\0\0\x71\xa3\xff\xff\0\0\0\0\x67\x03\0\0\x03\0\0\0\x2d\
 +\x23\x02\0\0\0\0\0\x79\xa7\x20\xff\0\0\0\0\x05\0\x2b\0\0\0\0\0\x07\x07\0\0\xff\
 +\xff\xff\xff\xbf\x72\0\0\0\0\0\0\x67\x02\0\0\x20\0\0\0\x77\x02\0\0\x20\0\0\0\
 +\x15\x02\xf9\xff\0\0\0\0\x7b\x9a\x38\xff\0\0\0\0\x79\xa1\x40\xff\0\0\0\0\x0f\
 +\x19\0\0\0\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\xf8\xff\xff\xff\xbf\x81\0\0\0\
 +\0\0\0\xbf\x92\0\0\0\0\0\0\xb7\x04\0\0\x02\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\
 +\0\x44\0\0\0\xbf\x01\0\0\0\0\0\0\x67\x01\0\0\x20\0\0\0\x77\x01\0\0\x20\0\0\0\
 +\x55\x01\x94\0\0\0\0\0\x71\xa2\xf8\xff\0\0\0\0\x55\x02\x0f\0\xc9\0\0\0\x07\x09\
 +\0\0\x02\0\0\0\xbf\x81\0\0\0\0\0\0\xbf\x92\0\0\0\0\0\0\x79\xa3\x10\xff\0\0\0\0\
 +\xb7\x04\0\0\x10\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\0\0\0\xbf\x01\0\0\0\
 +\0\0\0\x67\x01\0\0\x20\0\0\0\x77\x01\0\0\x20\0\0\0\x55\x01\x87\0\0\0\0\0\xb7\
 +\x01\0\0\x01\0\0\0\x73\x1a\x54\xff\0\0\0\0\x79\xa7\x20\xff\0\0\0\0\x05\0\x07\0\
 +\0\0\0\0\xb7\x09\0\0\x01\0\0\0\x15\x02\xd1\xff\0\0\0\0\x71\xa9\xf9\xff\0\0\0\0\
 +\x07\x09\0\0\x02\0\0\0\x05\0\xce\xff\0\0\0\0\xb7\x01\0\0\x01\0\0\0\x73\x1a\x56\
 +\xff\0\0\0\0\x71\xa1\xff\xff\0\0\0\0\x67\x01\0\0\x03\0\0\0\x79\xa2\x40\xff\0\0\
 +\0\0\x0f\x12\0\0\0\0\0\0\x07\x02\0\0\x08\0\0\0\x7b\x2a\x40\xff\0\0\0\0\x71\xa9\
 +\xfe\xff\0\0\0\0\x25\x09\x0e\0\x3c\0\0\0\xb7\x01\0\0\x01\0\0\0\x6f\x91\0\0\0\0\
 +\0\0\x18\x02\0\0\x01\0\0\0\0\0\0\0\0\x18\0\x1c\x5f\x21\0\0\0\0\0\0\x55\x01\x01\
 +\0\0\0\0\0\x05\0\x07\0\0\0\0\0\x79\xa1\x28\xff\0\0\0\0\x07\x01\0\0\x01\0\0\0\
 +\x7b\x1a\x28\xff\0\0\0\0\x67\x01\0\0\x20\0\0\0\x77\x01\0\0\x20\0\0\0\x55\x01\
 +\x82\xff\x0b\0\0\0\x05\0\x10\xff\0\0\0\0\x15\x09\xf8\xff\x87\0\0\0\x05\0\xfd\
 +\xff\0\0\0\0\x71\xa1\x51\xff\0\0\0\0\x79\xa0\x30\xff\0\0\0\0\x15\x01\x17\x01\0\
 +\0\0\0\x71\x62\x03\0\0\0\0\0\x67\x02\0\0\x08\0\0\0\x71\x61\x02\0\0\0\0\0\x4f\
 +\x12\0\0\0\0\0\0\x71\x63\x04\0\0\0\0\0\x71\x61\x05\0\0\0\0\0\x67\x01\0\0\x08\0\
 +\0\0\x4f\x31\0\0\0\0\0\0\x67\x01\0\0\x10\0\0\0\x4f\x21\0\0\0\0\0\0\x71\xa2\x53\
 +\xff\0\0\0\0\x15\x02\x3d\0\0\0\0\0\xbf\x12\0\0\0\0\0\0\x57\x02\0\0\x10\0\0\0\
 +\x15\x02\x3a\0\0\0\0\0\xbf\xa2\0\0\0\0\0\0\x07\x02\0\0\x5c\xff\xff\xff\x71\xa4\
 +\x54\xff\0\0\0\0\xbf\x23\0\0\0\0\0\0\x15\x04\x02\0\0\0\0\0\xbf\xa3\0\0\0\0\0\0\
 +\x07\x03\0\0\x7c\xff\xff\xff\x67\x01\0\0\x38\0\0\0\xc7\x01\0\0\x38\0\0\0\x65\
 +\x01\x01\0\xff\xff\xff\xff\xbf\x32\0\0\0\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\
 +\x6c\xff\xff\xff\x71\xa5\x55\xff\0\0\0\0\xbf\x34\0\0\0\0\0\0\x15\x05\x02\0\0\0\
 +\0\0\xbf\xa4\0\0\0\0\0\0\x07\x04\0\0\x8c\xff\xff\xff\x65\x01\x01\0\xff\xff\xff\
 +\xff\xbf\x43\0\0\0\0\0\0\x61\x21\x04\0\0\0\0\0\x67\x01\0\0\x20\0\0\0\x61\x24\0\
 +\0\0\0\0\0\x4f\x41\0\0\0\0\0\0\x7b\x1a\xa0\xff\0\0\0\0\x61\x21\x08\0\0\0\0\0\
 +\x61\x22\x0c\0\0\0\0\0\x67\x02\0\0\x20\0\0\0\x4f\x12\0\0\0\0\0\0\x7b\x2a\xa8\
 +\xff\0\0\0\0\x61\x31\0\0\0\0\0\0\x61\x32\x04\0\0\0\0\0\x61\x34\x08\0\0\0\0\0\
 +\x61\x33\x0c\0\0\0\0\0\x69\xa5\x5a\xff\0\0\0\0\x6b\x5a\xc2\xff\0\0\0\0\x69\xa5\
 +\x58\xff\0\0\0\0\x6b\x5a\xc0\xff\0\0\0\0\x67\x03\0\0\x20\0\0\0\x4f\x43\0\0\0\0\
 +\0\0\x7b\x3a\xb8\xff\0\0\0\0\x67\x02\0\0\x20\0\0\0\x4f\x12\0\0\0\0\0\0\x7b\x2a\
 +\xb0\xff\0\0\0\0\x05\0\x6b\0\0\0\0\0\x71\xa2\x52\xff\0\0\0\0\x15\x02\x04\0\0\0\
 +\0\0\xbf\x12\0\0\0\0\0\0\x57\x02\0\0\x04\0\0\0\x15\x02\x01\0\0\0\0\0\x05\0\xf7\
 +\xfe\0\0\0\0\x57\x01\0\0\x01\0\0\0\x15\x01\xd3\0\0\0\0\0\x61\xa1\x5c\xff\0\0\0\
 +\0\x63\x1a\xa0\xff\0\0\0\0\x61\xa1\x60\xff\0\0\0\0\x63\x1a\xa4\xff\0\0\0\0\x05\
 +\0\x5e\0\0\0\0\0\x71\xa2\x52\xff\0\0\0\0\x15\x02\x1e\0\0\0\0\0\xbf\x12\0\0\0\0\
 +\0\0\x57\x02\0\0\x20\0\0\0\x15\x02\x1b\0\0\0\0\0\xbf\xa2\0\0\0\0\0\0\x07\x02\0\
 +\0\x5c\xff\xff\xff\x71\xa4\x54\xff\0\0\0\0\xbf\x23\0\0\0\0\0\0\x15\x04\x02\0\0\
 +\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\x7c\xff\xff\xff\x57\x01\0\0\0\x01\0\0\
 +\x15\x01\x01\0\0\0\0\0\xbf\x32\0\0\0\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\x6c\
 +\xff\xff\xff\x71\xa5\x55\xff\0\0\0\0\xbf\x34\0\0\0\0\0\0\x15\x05\x02\0\0\0\0\0\
 +\xbf\xa4\0\0\0\0\0\0\x07\x04\0\0\x8c\xff\xff\xff\x15\x01\xc3\xff\0\0\0\0\x05\0\
 +\xc1\xff\0\0\0\0\xb7\x09\0\0\x3c\0\0\0\x79\xa7\x20\xff\0\0\0\0\x67\0\0\0\x20\0\
 +\0\0\x77\0\0\0\x20\0\0\0\x15\0\xa5\xfe\0\0\0\0\x05\0\xb0\0\0\0\0\0\x15\x09\x07\
 +\xff\x87\0\0\0\x05\0\xa2\xfe\0\0\0\0\xbf\x12\0\0\0\0\0\0\x57\x02\0\0\x08\0\0\0\
 +\x15\x02\xab\0\0\0\0\0\xbf\xa2\0\0\0\0\0\0\x07\x02\0\0\x5c\xff\xff\xff\x71\xa4\
 +\x54\xff\0\0\0\0\xbf\x23\0\0\0\0\0\0\x15\x04\x02\0\0\0\0\0\xbf\xa3\0\0\0\0\0\0\
 +\x07\x03\0\0\x7c\xff\xff\xff\x57\x01\0\0\x40\0\0\0\x15\x01\x01\0\0\0\0\0\xbf\
 +\x32\0\0\0\0\0\0\x61\x23\x04\0\0\0\0\0\x67\x03\0\0\x20\0\0\0\x61\x24\0\0\0\0\0\
 +\0\x4f\x43\0\0\0\0\0\0\x7b\x3a\xa0\xff\0\0\0\0\x61\x23\x08\0\0\0\0\0\x61\x22\
 +\x0c\0\0\0\0\0\x67\x02\0\0\x20\0\0\0\x4f\x32\0\0\0\0\0\0\x7b\x2a\xa8\xff\0\0\0\
 +\0\x15\x01\x1c\0\0\0\0\0\x71\xa1\x55\xff\0\0\0\0\x15\x01\x1a\0\0\0\0\0\x61\xa1\
 +\x98\xff\0\0\0\0\x67\x01\0\0\x20\0\0\0\x61\xa2\x94\xff\0\0\0\0\x4f\x21\0\0\0\0\
 +\0\0\x7b\x1a\xb8\xff\0\0\0\0\x61\xa1\x90\xff\0\0\0\0\x67\x01\0\0\x20\0\0\0\x61\
 +\xa2\x8c\xff\0\0\0\0\x05\0\x19\0\0\0\0\0\xb7\x01\0\0\x01\0\0\0\x73\x1a\x52\xff\
 +\0\0\0\0\xb7\x01\0\0\0\0\0\0\x7b\x1a\xd0\xff\0\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\
 +\x03\0\0\xd0\xff\xff\xff\xbf\x81\0\0\0\0\0\0\x79\xa2\x40\xff\0\0\0\0\xb7\x04\0\
 +\0\x08\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\0\0\0\x67\0\0\0\x20\0\0\0\x77\
 +\0\0\0\x20\0\0\0\x55\0\x7d\0\0\0\0\0\x05\0\x88\xfe\0\0\0\0\xb7\x09\0\0\x2b\0\0\
 +\0\x05\0\xc6\xff\0\0\0\0\x61\xa1\x78\xff\0\0\0\0\x67\x01\0\0\x20\0\0\0\x61\xa2\
 +\x74\xff\0\0\0\0\x4f\x21\0\0\0\0\0\0\x7b\x1a\xb8\xff\0\0\0\0\x61\xa1\x70\xff\0\
 +\0\0\0\x67\x01\0\0\x20\0\0\0\x61\xa2\x6c\xff\0\0\0\0\x4f\x21\0\0\0\0\0\0\x7b\
 +\x1a\xb0\xff\0\0\0\0\xb7\x01\0\0\0\0\0\0\x07\x07\0\0\x04\0\0\0\x61\x03\0\0\0\0\
 +\0\0\xb7\x05\0\0\0\0\0\0\x05\0\x4e\0\0\0\0\0\xaf\x52\0\0\0\0\0\0\xbf\x75\0\0\0\
 +\0\0\0\x0f\x15\0\0\0\0\0\0\x71\x55\0\0\0\0\0\0\x67\x03\0\0\x01\0\0\0\xbf\x50\0\
 +\0\0\0\0\0\x77\0\0\0\x07\0\0\0\x4f\x03\0\0\0\0\0\0\xbf\x40\0\0\0\0\0\0\x67\0\0\
 +\0\x39\0\0\0\xc7\0\0\0\x3f\0\0\0\x5f\x30\0\0\0\0\0\0\xaf\x02\0\0\0\0\0\0\xbf\
 +\x50\0\0\0\0\0\0\x77\0\0\0\x06\0\0\0\x57\0\0\0\x01\0\0\0\x67\x03\0\0\x01\0\0\0\
 +\x4f\x03\0\0\0\0\0\0\xbf\x40\0\0\0\0\0\0\x67\0\0\0\x3a\0\0\0\xc7\0\0\0\x3f\0\0\
 +\0\x5f\x30\0\0\0\0\0\0\xaf\x02\0\0\0\0\0\0\x67\x03\0\0\x01\0\0\0\xbf\x50\0\0\0\
 +\0\0\0\x77\0\0\0\x05\0\0\0\x57\0\0\0\x01\0\0\0\x4f\x03\0\0\0\0\0\0\xbf\x40\0\0\
 +\0\0\0\0\x67\0\0\0\x3b\0\0\0\xc7\0\0\0\x3f\0\0\0\x5f\x30\0\0\0\0\0\0\xaf\x02\0\
 +\0\0\0\0\0\x67\x03\0\0\x01\0\0\0\xbf\x50\0\0\0\0\0\0\x77\0\0\0\x04\0\0\0\x57\0\
 +\0\0\x01\0\0\0\x4f\x03\0\0\0\0\0\0\xbf\x40\0\0\0\0\0\0\x67\0\0\0\x3c\0\0\0\xc7\
 +\0\0\0\x3f\0\0\0\x5f\x30\0\0\0\0\0\0\xaf\x02\0\0\0\0\0\0\xbf\x50\0\0\0\0\0\0\
 +\x77\0\0\0\x03\0\0\0\x57\0\0\0\x01\0\0\0\x67\x03\0\0\x01\0\0\0\x4f\x03\0\0\0\0\
 +\0\0\xbf\x40\0\0\0\0\0\0\x67\0\0\0\x3d\0\0\0\xc7\0\0\0\x3f\0\0\0\x5f\x30\0\0\0\
 +\0\0\0\xaf\x02\0\0\0\0\0\0\xbf\x50\0\0\0\0\0\0\x77\0\0\0\x02\0\0\0\x57\0\0\0\
 +\x01\0\0\0\x67\x03\0\0\x01\0\0\0\x4f\x03\0\0\0\0\0\0\xbf\x40\0\0\0\0\0\0\x67\0\
 +\0\0\x3e\0\0\0\xc7\0\0\0\x3f\0\0\0\x5f\x30\0\0\0\0\0\0\xaf\x02\0\0\0\0\0\0\xbf\
 +\x50\0\0\0\0\0\0\x77\0\0\0\x01\0\0\0\x57\0\0\0\x01\0\0\0\x67\x03\0\0\x01\0\0\0\
 +\x4f\x03\0\0\0\0\0\0\x57\x04\0\0\x01\0\0\0\x87\x04\0\0\0\0\0\0\x5f\x34\0\0\0\0\
 +\0\0\xaf\x42\0\0\0\0\0\0\x57\x05\0\0\x01\0\0\0\x67\x03\0\0\x01\0\0\0\x4f\x53\0\
 +\0\0\0\0\0\x07\x01\0\0\x01\0\0\0\xbf\x25\0\0\0\0\0\0\x15\x01\x0b\0\x24\0\0\0\
 +\xbf\xa2\0\0\0\0\0\0\x07\x02\0\0\xa0\xff\xff\xff\x0f\x12\0\0\0\0\0\0\x71\x24\0\
 +\0\0\0\0\0\xbf\x40\0\0\0\0\0\0\x67\0\0\0\x38\0\0\0\xc7\0\0\0\x38\0\0\0\xb7\x02\
 +\0\0\0\0\0\0\x65\0\xa9\xff\xff\xff\xff\xff\xbf\x32\0\0\0\0\0\0\x05\0\xa7\xff\0\
 +\0\0\0\xbf\x21\0\0\0\0\0\0\x67\x01\0\0\x20\0\0\0\x77\x01\0\0\x20\0\0\0\x15\x01\
 +\x0e\0\0\0\0\0\x71\x63\x06\0\0\0\0\0\x71\x64\x07\0\0\0\0\0\x67\x04\0\0\x08\0\0\
 +\0\x4f\x34\0\0\0\0\0\0\x3f\x41\0\0\0\0\0\0\x2f\x41\0\0\0\0\0\0\x1f\x12\0\0\0\0\
 +\0\0\x63\x2a\x50\xff\0\0\0\0\xbf\xa2\0\0\0\0\0\0\x07\x02\0\0\x50\xff\xff\xff\
 +\x18\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x85\0\0\0\x01\0\0\0\x55\0\x05\0\0\0\0\0\
 +\x71\x61\x08\0\0\0\0\0\x71\x60\x09\0\0\0\0\0\x67\0\0\0\x08\0\0\0\x4f\x10\0\0\0\
 +\0\0\0\x95\0\0\0\0\0\0\0\x69\0\0\0\0\0\0\0\x05\0\xfd\xff\0\0\0\0\x02\0\0\0\x04\
 +\0\0\0\x0a\0\0\0\x01\0\0\0\0\0\0\0\x02\0\0\0\x04\0\0\0\x28\0\0\0\x01\0\0\0\0\0\
 +\0\0\x02\0\0\0\x04\0\0\0\x02\0\0\0\x80\0\0\0\0\0\0\0\x47\x50\x4c\x20\x76\x32\0\
 +\0\0\0\0\0\x10\0\0\0\0\0\0\0\x01\x7a\x52\0\x08\x7c\x0b\x01\x0c\0\0\0\x18\0\0\0\
 +\x18\0\0\0\0\0\0\0\0\0\0\0\xd8\x13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
 +\0\0\0\0\0\0\0\0\0\0\0\0\xa0\0\0\0\x04\0\xf1\xff\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
 +\0\x60\x02\0\0\0\0\x03\0\x20\x02\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x3f\x02\0\0\0\0\
 +\x03\0\xd0\x0f\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xed\x01\0\0\0\0\x03\0\x10\x10\0\0\0\
 +\0\0\0\0\0\0\0\0\0\0\0\xd4\x01\0\0\0\0\x03\0\x20\x10\0\0\0\0\0\0\0\0\0\0\0\0\0\
 +\0\xa3\x01\0\0\0\0\x03\0\xb8\x12\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x63\x01\0\0\0\0\
 +\x03\0\x48\x10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x2a\x01\0\0\0\0\x03\0\x10\x13\0\0\0\
 +\0\0\0\0\0\0\0\0\0\0\0\xe1\0\0\0\0\0\x03\0\xa0\x13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
 +\x2e\x02\0\0\0\0\x03\0\x28\x02\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x68\x02\0\0\0\0\x03\
 +\0\xc0\x13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x36\x02\0\0\0\0\x03\0\xc8\x13\0\0\0\0\0\
 +\0\0\0\0\0\0\0\0\0\x22\x01\0\0\0\0\x03\0\xe8\x02\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
 +\x02\x01\0\0\0\0\x03\0\x40\x03\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xd9\0\0\0\0\0\x03\0\
 +\xf8\x04\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x26\x02\0\0\0\0\x03\0\x20\x0e\0\0\0\0\0\0\
 +\0\0\0\0\0\0\0\0\xcc\x01\0\0\0\0\x03\0\x60\x06\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x9b\
 +\x01\0\0\0\0\x03\0\xc8\x06\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x5b\x01\0\0\0\0\x03\0\
 +\x20\x07\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x7c\x01\0\0\0\0\x03\0\x48\x08\0\0\0\0\0\0\
 +\0\0\0\0\0\0\0\0\x53\x01\0\0\0\0\x03\0\xb8\x08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x1a\
 +\x01\0\0\0\0\x03\0\xe0\x08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x84\x01\0\0\0\0\x03\0\
 +\xb8\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x1e\x02\0\0\0\0\x03\0\xd8\x09\0\0\0\0\0\0\0\
 +\0\0\0\0\0\0\0\xc4\x01\0\0\0\0\x03\0\x70\x08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x93\
 +\x01\0\0\0\0\x03\0\xa8\x08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x74\x01\0\0\0\0\x03\0\
 +\xf0\x0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x4b\x01\0\0\0\0\x03\0\0\x0a\0\0\0\0\0\0\0\
 +\0\0\0\0\0\0\0\x12\x01\0\0\0\0\x03\0\x10\x0a\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xfa\0\
 +\0\0\0\0\x03\0\xc0\x0a\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x58\x02\0\0\0\0\x03\0\x88\
 +\x0a\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x16\x02\0\0\0\0\x03\0\xb8\x0a\0\0\0\0\0\0\0\0\
 +\0\0\0\0\0\0\xe5\x01\0\0\0\0\x03\0\xc0\x0f\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xbc\x01\
 +\0\0\0\0\x03\0\0\x0e\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x8b\x01\0\0\0\0\x03\0\x18\x0e\
 +\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xd1\0\0\0\0\0\x03\0\0\x04\0\0\0\0\0\0\0\0\0\0\0\0\
 +\0\0\x50\x02\0\0\0\0\x03\0\x20\x04\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x0e\x02\0\0\0\0\
 +\x03\0\x48\x0f\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x6c\x01\0\0\0\0\x03\0\xb0\x04\0\0\0\
 +\0\0\0\0\0\0\0\0\0\0\0\x43\x01\0\0\0\0\x03\0\xc8\x0c\0\0\0\0\0\0\0\0\0\0\0\0\0\
 +\0\xc9\0\0\0\0\0\x03\0\xf8\x0c\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x06\x02\0\0\0\0\x03\
 +\0\xd0\x0a\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x3b\x01\0\0\0\0\x03\0\x98\x0b\0\0\0\0\0\
 +\0\0\0\0\0\0\0\0\0\xf2\0\0\0\0\0\x03\0\xb8\x0b\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x48\
 +\x02\0\0\0\0\x03\0\xf0\x0b\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xfe\x01\0\0\0\0\x03\0\
 +\xf8\x0b\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xdd\x01\0\0\0\0\x03\0\0\x0c\0\0\0\0\0\0\0\
 +\0\0\0\0\0\0\0\xb4\x01\0\0\0\0\x03\0\x30\x0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x0a\
 +\x01\0\0\0\0\x03\0\x90\x0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xc1\0\0\0\0\0\x03\0\xa8\
 +\x0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xba\0\0\0\0\0\x03\0\xd0\x01\0\0\0\0\0\0\0\0\0\
 +\0\0\0\0\0\xf6\x01\0\0\0\0\x03\0\xe0\x0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xac\x01\0\
 +\0\0\0\x03\0\x30\x0e\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x33\x01\0\0\0\0\x03\0\x80\x0e\
 +\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xea\0\0\0\0\0\x03\0\x98\x0e\0\0\0\0\0\0\0\0\0\0\0\
 +\0\0\0\0\0\0\0\x03\0\x03\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x6b\0\0\0\x11\0\x06\
 +\0\0\0\0\0\0\0\0\0\x07\0\0\0\0\0\0\0\x25\0\0\0\x11\0\x05\0\0\0\0\0\0\0\0\0\x14\
 +\0\0\0\0\0\0\0\x82\0\0\0\x11\0\x05\0\x28\0\0\0\0\0\0\0\x14\0\0\0\0\0\0\0\x01\0\
 +\0\0\x11\0\x05\0\x14\0\0\0\0\0\0\0\x14\0\0\0\0\0\0\0\x40\0\0\0\x12\0\x03\0\0\0\
 +\0\0\0\0\0\0\xd8\x13\0\0\0\0\0\0\x28\0\0\0\0\0\0\0\x01\0\0\0\x3a\0\0\0\x50\0\0\
 +\0\0\0\0\0\x01\0\0\0\x3c\0\0\0\x80\x13\0\0\0\0\0\0\x01\0\0\0\x3b\0\0\0\x1c\0\0\
 +\0\0\0\0\0\x01\0\0\0\x38\0\0\0\0\x74\x61\x70\x5f\x72\x73\x73\x5f\x6d\x61\x70\
 +\x5f\x74\x6f\x65\x70\x6c\x69\x74\x7a\x5f\x6b\x65\x79\0\x2e\x74\x65\x78\x74\0\
 +\x6d\x61\x70\x73\0\x74\x61\x70\x5f\x72\x73\x73\x5f\x6d\x61\x70\x5f\x63\x6f\x6e\
 +\x66\x69\x67\x75\x72\x61\x74\x69\x6f\x6e\x73\0\x74\x75\x6e\x5f\x72\x73\x73\x5f\
 +\x73\x74\x65\x65\x72\x69\x6e\x67\x5f\x70\x72\x6f\x67\0\x2e\x72\x65\x6c\x74\x75\
 +\x6e\x5f\x72\x73\x73\x5f\x73\x74\x65\x65\x72\x69\x6e\x67\0\x5f\x6c\x69\x63\x65\
 +\x6e\x73\x65\0\x2e\x72\x65\x6c\x2e\x65\x68\x5f\x66\x72\x61\x6d\x65\0\x74\x61\
 +\x70\x5f\x72\x73\x73\x5f\x6d\x61\x70\x5f\x69\x6e\x64\x69\x72\x65\x63\x74\x69\
 +\x6f\x6e\x5f\x74\x61\x62\x6c\x65\0\x72\x73\x73\x2e\x62\x70\x66\x2e\x63\0\x2e\
 +\x73\x74\x72\x74\x61\x62\0\x2e\x73\x79\x6d\x74\x61\x62\0\x4c\x42\x42\x30\x5f\
 +\x39\0\x4c\x42\x42\x30\x5f\x38\x39\0\x4c\x42\x42\x30\x5f\x36\x39\0\x4c\x42\x42\
 +\x30\x5f\x35\x39\0\x4c\x42\x42\x30\x5f\x31\x39\0\x4c\x42\x42\x30\x5f\x31\x30\
 +\x39\0\x4c\x42\x42\x30\x5f\x39\x38\0\x4c\x42\x42\x30\x5f\x37\x38\0\x4c\x42\x42\
 +\x30\x5f\x34\x38\0\x4c\x42\x42\x30\x5f\x31\x38\0\x4c\x42\x42\x30\x5f\x38\x37\0\
 +\x4c\x42\x42\x30\x5f\x34\x37\0\x4c\x42\x42\x30\x5f\x33\x37\0\x4c\x42\x42\x30\
 +\x5f\x31\x37\0\x4c\x42\x42\x30\x5f\x31\x30\x37\0\x4c\x42\x42\x30\x5f\x39\x36\0\
 +\x4c\x42\x42\x30\x5f\x37\x36\0\x4c\x42\x42\x30\x5f\x36\x36\0\x4c\x42\x42\x30\
 +\x5f\x34\x36\0\x4c\x42\x42\x30\x5f\x33\x36\0\x4c\x42\x42\x30\x5f\x32\x36\0\x4c\
 +\x42\x42\x30\x5f\x31\x30\x36\0\x4c\x42\x42\x30\x5f\x36\x35\0\x4c\x42\x42\x30\
 +\x5f\x34\x35\0\x4c\x42\x42\x30\x5f\x33\x35\0\x4c\x42\x42\x30\x5f\x34\0\x4c\x42\
 +\x42\x30\x5f\x35\x34\0\x4c\x42\x42\x30\x5f\x34\x34\0\x4c\x42\x42\x30\x5f\x32\
 +\x34\0\x4c\x42\x42\x30\x5f\x31\x30\x34\0\x4c\x42\x42\x30\x5f\x39\x33\0\x4c\x42\
 +\x42\x30\x5f\x38\x33\0\x4c\x42\x42\x30\x5f\x35\x33\0\x4c\x42\x42\x30\x5f\x34\
 +\x33\0\x4c\x42\x42\x30\x5f\x32\x33\0\x4c\x42\x42\x30\x5f\x31\x30\x33\0\x4c\x42\
 +\x42\x30\x5f\x38\x32\0\x4c\x42\x42\x30\x5f\x35\x32\0\x4c\x42\x42\x30\x5f\x31\
 +\x30\x32\0\x4c\x42\x42\x30\x5f\x39\x31\0\x4c\x42\x42\x30\x5f\x38\x31\0\x4c\x42\
 +\x42\x30\x5f\x37\x31\0\x4c\x42\x42\x30\x5f\x36\x31\0\x4c\x42\x42\x30\x5f\x35\
 +\x31\0\x4c\x42\x42\x30\x5f\x34\x31\0\x4c\x42\x42\x30\x5f\x32\x31\0\x4c\x42\x42\
 +\x30\x5f\x31\x31\0\x4c\x42\x42\x30\x5f\x31\x31\x31\0\x4c\x42\x42\x30\x5f\x31\
 +\x30\x31\0\x4c\x42\x42\x30\x5f\x38\x30\0\x4c\x42\x42\x30\x5f\x36\x30\0\x4c\x42\
 +\x42\x30\x5f\x35\x30\0\x4c\x42\x42\x30\x5f\x31\x30\0\x4c\x42\x42\x30\x5f\x31\
 +\x31\x30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
 +\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xaa\
 +\0\0\0\x03\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xa0\x1a\0\0\0\0\0\0\x71\x02\0\
 +\0\0\0\0\0\0\0\0\0\0\0\0\0\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x1a\0\0\0\x01\0\0\
 +\0\x06\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x40\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
 +\0\0\0\0\x04\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x5a\0\0\0\x01\0\0\0\x06\0\0\0\0\0\0\
 +\0\0\0\0\0\0\0\0\0\x40\0\0\0\0\0\0\0\xd8\x13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x08\0\
 +\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x56\0\0\0\x09\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
 +\0\x60\x1a\0\0\0\0\0\0\x30\0\0\0\0\0\0\0\x09\0\0\0\x03\0\0\0\x08\0\0\0\0\0\0\0\
 +\x10\0\0\0\0\0\0\0\x20\0\0\0\x01\0\0\0\x03\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x18\
 +\x14\0\0\0\0\0\0\x3c\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x04\0\0\0\0\0\0\0\0\0\0\0\0\
 +\0\0\0\x6c\0\0\0\x01\0\0\0\x03\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x54\x14\0\0\0\0\0\
 +\0\x07\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x78\0\0\
 +\0\x01\0\0\0\x02\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x60\x14\0\0\0\0\0\0\x30\0\0\0\0\
 +\0\0\0\0\0\0\0\0\0\0\0\x08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x74\0\0\0\x09\0\0\0\0\
 +\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x90\x1a\0\0\0\0\0\0\x10\0\0\0\0\0\0\0\x09\0\0\0\
 +\x07\0\0\0\x08\0\0\0\0\0\0\0\x10\0\0\0\0\0\0\0\xb2\0\0\0\x02\0\0\0\0\0\0\0\0\0\
 +\0\0\0\0\0\0\0\0\0\0\x90\x14\0\0\0\0\0\0\xd0\x05\0\0\0\0\0\0\x01\0\0\0\x39\0\0\
 +\0\x08\0\0\0\0\0\0\0\x18\0\0\0\0\0\0\0";
 +
 +    return 0;
 +err:
 +    bpf_object__destroy_skeleton(s);
 +    return -1;
 +}
 +
 +#endif /* __RSS_BPF_SKEL_H__ */
 diff --git a/ebpf/trace-events b/ebpf/trace-events
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/ebpf/trace-events
@@ -XXX,XX +XXX,XX @@
 +# See docs/devel/tracing.txt for syntax documentation.
 +
 +# ebpf-rss.c
 +ebpf_error(const char *s1, const char *s2) "error in %s: %s"
 diff --git a/ebpf/trace.h b/ebpf/trace.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/ebpf/trace.h
@@ -0,0 +1 @@
 +#include "trace/trace-ebpf.h"
 diff --git a/meson.build b/meson.build
 index XXXXXXX..XXXXXXX 100644
 --- a/meson.build
 +++ b/meson.build
@@ -XXX,XX +XXX,XX @@ if not get_option('fuse_lseek').disabled()
    endif
  endif
 +# libbpf
 +libbpf = dependency('libbpf', required: get_option('bpf'))
 +if libbpf.found() and not cc.links('''
 +   #include <bpf/libbpf.h>
 +   int main(void)
 +   {
 +     bpf_object__destroy_skeleton(NULL);
 +     return 0;
 +   }''', dependencies: libbpf)
 +  libbpf = not_found
 +  if get_option('bpf').enabled()
 +    error('libbpf skeleton test failed')
 +  else
 +    warning('libbpf skeleton test failed, disabling')
 +  endif
 +endif
 +
  if get_option('cfi')
    cfi_flags=[]
    # Check for dependency on LTO
@@ -XXX,XX +XXX,XX @@ endif
  config_host_data.set('CONFIG_GTK', gtk.found())
  config_host_data.set('CONFIG_LIBATTR', have_old_libattr)
  config_host_data.set('CONFIG_LIBCAP_NG', libcap_ng.found())
 +config_host_data.set('CONFIG_EBPF', libbpf.found())
  config_host_data.set('CONFIG_LIBISCSI', libiscsi.found())
  config_host_data.set('CONFIG_LIBNFS', libnfs.found())
  config_host_data.set('CONFIG_RBD', rbd.found())
@@ -XXX,XX +XXX,XX @@ if have_system
      'backends',
      'backends/tpm',
      'chardev',
 +    'ebpf',
      'hw/9pfs',
      'hw/acpi',
      'hw/adc',
@@ -XXX,XX +XXX,XX @@ subdir('accel')
  subdir('plugins')
  subdir('bsd-user')
  subdir('linux-user')
 +subdir('ebpf')
 +
 +common_ss.add(libbpf)
  bsd_user_ss.add(files('gdbstub.c'))
  specific_ss.add_all(when: 'CONFIG_BSD_USER', if_true: bsd_user_ss)
@@ -XXX,XX +XXX,XX @@ summary_info += {'RDMA support':      config_host.has_key('CONFIG_RDMA')}
  summary_info += {'PVRDMA support':    config_host.has_key('CONFIG_PVRDMA')}
  summary_info += {'fdt support':       fdt_opt == 'disabled' ? false : fdt_opt}
  summary_info += {'libcap-ng support': libcap_ng.found()}
 +summary_info += {'bpf support': libbpf.found()}
  # TODO: add back protocol and server version
  summary_info += {'spice support':     config_host.has_key('CONFIG_SPICE')}
  summary_info += {'rbd support':       rbd.found()}
 diff --git a/meson_options.txt b/meson_options.txt
 index XXXXXXX..XXXXXXX 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
@@ -XXX,XX +XXX,XX @@ option('bzip2', type : 'feature', value : 'auto',
         description: 'bzip2 support for DMG images')
  option('cap_ng', type : 'feature', value : 'auto',
         description: 'cap_ng support')
 +option('bpf', type : 'feature', value : 'auto',
 +        description: 'eBPF support')
  option('cocoa', type : 'feature', value : 'auto',
         description: 'Cocoa user interface (macOS only)')
  option('curl', type : 'feature', value : 'auto',
 --
-.7.4
+.5.0

-New patch
+[PULL V2 13/33] net: cadence_gem: Fix irq update w.r.t queue
+From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+Set irq's specific to a queue, present implementation is setting q1 irq
+based on q0 status.
+Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ hw/net/cadence_gem.c | 25 +++----------------------
+file changed, 3 insertions(+), 22 deletions(-)
+diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/cadence_gem.c
++++ b/hw/net/cadence_gem.c
+@@ -XXX,XX +XXX,XX @@ static void gem_update_int_status(CadenceGEMState *s)
+ {
+     int i;
+-    if (!s->regs[GEM_ISR]) {
+-        /* ISR isn't set, clear all the interrupts */
+-        for (i = 0; i < s->num_priority_queues; ++i) {
+-            qemu_set_irq(s->irq[i], 0);
+-        }
+-        return;
+-    }
++    qemu_set_irq(s->irq[0], !!s->regs[GEM_ISR]);
+-    /* If we get here we know s->regs[GEM_ISR] is set, so we don't need to
+-     * check it again.
+-     */
+-    if (s->num_priority_queues == 1) {
+-        /* No priority queues, just trigger the interrupt */
+-        DB_PRINT("asserting int.\n");
+-        qemu_set_irq(s->irq[0], 1);
+-        return;
+-    }
+-
+-    for (i = 0; i < s->num_priority_queues; ++i) {
+-        if (s->regs[GEM_INT_Q1_STATUS + i]) {
+-            DB_PRINT("asserting int. (q=%d)\n", i);
+-            qemu_set_irq(s->irq[i], 1);
+-        }
++    for (i = 1; i < s->num_priority_queues; ++i) {
++        qemu_set_irq(s->irq[i], !!s->regs[GEM_INT_Q1_STATUS + i - 1]);
+     }
+ }
+--
+.5.0

-New patch
+[PULL V2 14/33] net: cadence_gem: Define access permission for interrupt registers
+From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+Q1 to Q7 ISR's are clear-on-read, IER/IDR registers
+are write-only, mask reg are read-only.
+Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ hw/net/cadence_gem.c | 14 ++++++++++++++
+file changed, 14 insertions(+)
+diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/cadence_gem.c
++++ b/hw/net/cadence_gem.c
+@@ -XXX,XX +XXX,XX @@ static const uint8_t broadcast_addr[] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
+  */
+ static void gem_init_register_masks(CadenceGEMState *s)
+ {
++    unsigned int i;
+     /* Mask of register bits which are read only */
+     memset(&s->regs_ro[0], 0, sizeof(s->regs_ro));
+     s->regs_ro[GEM_NWCTRL]   = 0xFFF80000;
+@@ -XXX,XX +XXX,XX @@ static void gem_init_register_masks(CadenceGEMState *s)
+     s->regs_ro[GEM_ISR]      = 0xFFFFFFFF;
+     s->regs_ro[GEM_IMR]      = 0xFFFFFFFF;
+     s->regs_ro[GEM_MODID]    = 0xFFFFFFFF;
++    for (i = 0; i < s->num_priority_queues; i++) {
++        s->regs_ro[GEM_INT_Q1_STATUS + i] = 0xFFFFFFFF;
++        s->regs_ro[GEM_INT_Q1_ENABLE + i] = 0xFFFFF319;
++        s->regs_ro[GEM_INT_Q1_DISABLE + i] = 0xFFFFF319;
++        s->regs_ro[GEM_INT_Q1_MASK + i] = 0xFFFFFFFF;
++    }
+     /* Mask of register bits which are clear on read */
+     memset(&s->regs_rtc[0], 0, sizeof(s->regs_rtc));
+     s->regs_rtc[GEM_ISR]      = 0xFFFFFFFF;
++    for (i = 0; i < s->num_priority_queues; i++) {
++        s->regs_rtc[GEM_INT_Q1_STATUS + i] = 0x00000CE6;
++    }
+     /* Mask of register bits which are write 1 to clear */
+     memset(&s->regs_w1c[0], 0, sizeof(s->regs_w1c));
+@@ -XXX,XX +XXX,XX @@ static void gem_init_register_masks(CadenceGEMState *s)
+     s->regs_wo[GEM_NWCTRL]   = 0x00073E60;
+     s->regs_wo[GEM_IER]      = 0x07FFFFFF;
+     s->regs_wo[GEM_IDR]      = 0x07FFFFFF;
++    for (i = 0; i < s->num_priority_queues; i++) {
++        s->regs_wo[GEM_INT_Q1_ENABLE + i] = 0x00000CE6;
++        s->regs_wo[GEM_INT_Q1_DISABLE + i] = 0x00000CE6;
++    }
+ }
+ /*
+--
+.5.0

-New patch
+[PULL V2 15/33] net: cadence_gem: Set ISR according to queue in use
+From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+Set ISR according to queue in use, added interrupt support for
+all queues.
+Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ hw/net/cadence_gem.c | 27 +++++++++++++++++----------
+file changed, 17 insertions(+), 10 deletions(-)
+diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/cadence_gem.c
++++ b/hw/net/cadence_gem.c
+@@ -XXX,XX +XXX,XX @@ static inline void rx_desc_set_sar(uint32_t *desc, int sar_idx)
+ /* The broadcast MAC address: 0xFFFFFFFFFFFF */
+ static const uint8_t broadcast_addr[] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
++static void gem_set_isr(CadenceGEMState *s, int q, uint32_t flag)
++{
++    if (q == 0) {
++        s->regs[GEM_ISR] |= flag & ~(s->regs[GEM_IMR]);
++    } else {
++        s->regs[GEM_INT_Q1_STATUS + q - 1] |= flag &
++                                      ~(s->regs[GEM_INT_Q1_MASK + q - 1]);
++    }
++}
++
+ /*
+  * gem_init_register_masks:
+  * One time initialization.
+@@ -XXX,XX +XXX,XX @@ static void gem_get_rx_desc(CadenceGEMState *s, int q)
+     if (rx_desc_get_ownership(s->rx_desc[q]) == 1) {
+         DB_PRINT("descriptor 0x%" HWADDR_PRIx " owned by sw.\n", desc_addr);
+         s->regs[GEM_RXSTATUS] |= GEM_RXSTATUS_NOBUF;
+-        s->regs[GEM_ISR] |= GEM_INT_RXUSED & ~(s->regs[GEM_IMR]);
++        gem_set_isr(s, q, GEM_INT_RXUSED);
+         /* Handle interrupt consequences */
+         gem_update_int_status(s);
+     }
+@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
+     gem_receive_updatestats(s, buf, size);
+     s->regs[GEM_RXSTATUS] |= GEM_RXSTATUS_FRMRCVD;
+-    s->regs[GEM_ISR] |= GEM_INT_RXCMPL & ~(s->regs[GEM_IMR]);
++    gem_set_isr(s, q, GEM_INT_RXCMPL);
+     /* Handle interrupt consequences */
+     gem_update_int_status(s);
+@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
+                 DB_PRINT("TX descriptor next: 0x%08x\n", s->tx_desc_addr[q]);
+                 s->regs[GEM_TXSTATUS] |= GEM_TXSTATUS_TXCMPL;
+-                s->regs[GEM_ISR] |= GEM_INT_TXCMPL & ~(s->regs[GEM_IMR]);
+-
+-                /* Update queue interrupt status */
+-                if (s->num_priority_queues > 1) {
+-                    s->regs[GEM_INT_Q1_STATUS + q] |=
+-                            GEM_INT_TXCMPL & ~(s->regs[GEM_INT_Q1_MASK + q]);
+-                }
++                gem_set_isr(s, q, GEM_INT_TXCMPL);
+                 /* Handle interrupt consequences */
+                 gem_update_int_status(s);
+@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
+         if (tx_desc_get_used(desc)) {
+             s->regs[GEM_TXSTATUS] |= GEM_TXSTATUS_USED;
+-            s->regs[GEM_ISR] |= GEM_INT_TXUSED & ~(s->regs[GEM_IMR]);
++            /* IRQ TXUSED is defined only for queue 0 */
++            if (q == 0) {
++                gem_set_isr(s, 0, GEM_INT_TXUSED);
++            }
+             gem_update_int_status(s);
+         }
+     }
+--
+.5.0

-New patch
+[PULL V2 16/33] net: cadence_gem: Move tx/rx packet buffert to CadenceGEMState
+From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+Moving this buffers to CadenceGEMState, as their size will be increased
+more when JUMBO frames support is added.
+Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ hw/net/cadence_gem.c         | 38 +++++++++++++++++---------------------
+ include/hw/net/cadence_gem.h |  4 ++++
+files changed, 21 insertions(+), 21 deletions(-)
+diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/cadence_gem.c
++++ b/hw/net/cadence_gem.c
+@@ -XXX,XX +XXX,XX @@ static void gem_get_rx_desc(CadenceGEMState *s, int q)
+  */
+ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
+ {
+-    CadenceGEMState *s;
++    CadenceGEMState *s = qemu_get_nic_opaque(nc);
+     unsigned   rxbufsize, bytes_to_copy;
+     unsigned   rxbuf_offset;
+-    uint8_t    rxbuf[2048];
+     uint8_t   *rxbuf_ptr;
+     bool first_desc = true;
+     int maf;
+     int q = 0;
+-    s = qemu_get_nic_opaque(nc);
+-
+     /* Is this destination MAC address "for us" ? */
+     maf = gem_mac_address_filter(s, buf);
+     if (maf == GEM_RX_REJECT) {
+@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
+     } else {
+         unsigned crc_val;
+-        if (size > sizeof(rxbuf) - sizeof(crc_val)) {
+-            size = sizeof(rxbuf) - sizeof(crc_val);
++        if (size > MAX_FRAME_SIZE - sizeof(crc_val)) {
++            size = MAX_FRAME_SIZE - sizeof(crc_val);
+         }
+         bytes_to_copy = size;
+         /* The application wants the FCS field, which QEMU does not provide.
+          * We must try and calculate one.
+          */
+-        memcpy(rxbuf, buf, size);
+-        memset(rxbuf + size, 0, sizeof(rxbuf) - size);
+-        rxbuf_ptr = rxbuf;
+-        crc_val = cpu_to_le32(crc32(0, rxbuf, MAX(size, 60)));
+-        memcpy(rxbuf + size, &crc_val, sizeof(crc_val));
++        memcpy(s->rx_packet, buf, size);
++        memset(s->rx_packet + size, 0, MAX_FRAME_SIZE - size);
++        rxbuf_ptr = s->rx_packet;
++        crc_val = cpu_to_le32(crc32(0, s->rx_packet, MAX(size, 60)));
++        memcpy(s->rx_packet + size, &crc_val, sizeof(crc_val));
+         bytes_to_copy += 4;
+         size += 4;
+@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
+ {
+     uint32_t desc[DESC_MAX_NUM_WORDS];
+     hwaddr packet_desc_addr;
+-    uint8_t     tx_packet[2048];
+     uint8_t     *p;
+     unsigned    total_bytes;
+     int q = 0;
+@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
+      * Packets scattered across multiple descriptors are gathered to this
+      * one contiguous buffer first.
+      */
+-    p = tx_packet;
++    p = s->tx_packet;
+     total_bytes = 0;
+     for (q = s->num_priority_queues - 1; q >= 0; q--) {
+@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
+                 break;
+             }
+-            if (tx_desc_get_length(desc) > sizeof(tx_packet) -
+-                                               (p - tx_packet)) {
++            if (tx_desc_get_length(desc) > MAX_FRAME_SIZE -
++                                               (p - s->tx_packet)) {
+                 DB_PRINT("TX descriptor @ 0x%" HWADDR_PRIx \
+                          " too large: size 0x%x space 0x%zx\n",
+                          packet_desc_addr, tx_desc_get_length(desc),
+-                         sizeof(tx_packet) - (p - tx_packet));
++                         MAX_FRAME_SIZE - (p - s->tx_packet));
+                 break;
+             }
+@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
+                 /* Is checksum offload enabled? */
+                 if (s->regs[GEM_DMACFG] & GEM_DMACFG_TXCSUM_OFFL) {
+-                    net_checksum_calculate(tx_packet, total_bytes);
++                    net_checksum_calculate(s->tx_packet, total_bytes);
+                 }
+                 /* Update MAC statistics */
+-                gem_transmit_updatestats(s, tx_packet, total_bytes);
++                gem_transmit_updatestats(s, s->tx_packet, total_bytes);
+                 /* Send the packet somewhere */
+                 if (s->phy_loop || (s->regs[GEM_NWCTRL] &
+                                     GEM_NWCTRL_LOCALLOOP)) {
+-                    gem_receive(qemu_get_queue(s->nic), tx_packet,
++                    gem_receive(qemu_get_queue(s->nic), s->tx_packet,
+                                 total_bytes);
+                 } else {
+-                    qemu_send_packet(qemu_get_queue(s->nic), tx_packet,
++                    qemu_send_packet(qemu_get_queue(s->nic), s->tx_packet,
+                                      total_bytes);
+                 }
+                 /* Prepare for next packet */
+-                p = tx_packet;
++                p = s->tx_packet;
+                 total_bytes = 0;
+             }
+diff --git a/include/hw/net/cadence_gem.h b/include/hw/net/cadence_gem.h
+index XXXXXXX..XXXXXXX 100644
+--- a/include/hw/net/cadence_gem.h
++++ b/include/hw/net/cadence_gem.h
+@@ -XXX,XX +XXX,XX @@
+ #define MAX_TYPE1_SCREENERS             16
+ #define MAX_TYPE2_SCREENERS             16
++#define MAX_FRAME_SIZE 2048
++
+ typedef struct CadenceGEMState {
+     /*< private >*/
+     SysBusDevice parent_obj;
+@@ -XXX,XX +XXX,XX @@ typedef struct CadenceGEMState {
+     uint8_t can_rx_state; /* Debug only */
++    uint8_t tx_packet[MAX_FRAME_SIZE];
++    uint8_t rx_packet[MAX_FRAME_SIZE];
+     uint32_t rx_desc[MAX_PRIORITY_QUEUES][DESC_MAX_NUM_WORDS];
+     bool sar_active[4];
+--
+.5.0

-New patch
+[PULL V2 17/33] net: cadence_gem: Fix up code style
+From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
 Fix the code style for register definitions.
 Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
 Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
  hw/net/cadence_gem.c | 204 ++++++++++++++++++++++++++-------------------------
 file changed, 103 insertions(+), 101 deletions(-)
 diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/net/cadence_gem.c
 +++ b/hw/net/cadence_gem.c
@@ -XXX,XX +XXX,XX @@
      } \
  } while (0)
 -#define GEM_NWCTRL        (0x00000000/4) /* Network Control reg */
 -#define GEM_NWCFG         (0x00000004/4) /* Network Config reg */
 -#define GEM_NWSTATUS      (0x00000008/4) /* Network Status reg */
 -#define GEM_USERIO        (0x0000000C/4) /* User IO reg */
 -#define GEM_DMACFG        (0x00000010/4) /* DMA Control reg */
 -#define GEM_TXSTATUS      (0x00000014/4) /* TX Status reg */
 -#define GEM_RXQBASE       (0x00000018/4) /* RX Q Base address reg */
 -#define GEM_TXQBASE       (0x0000001C/4) /* TX Q Base address reg */
 -#define GEM_RXSTATUS      (0x00000020/4) /* RX Status reg */
 -#define GEM_ISR           (0x00000024/4) /* Interrupt Status reg */
 -#define GEM_IER           (0x00000028/4) /* Interrupt Enable reg */
 -#define GEM_IDR           (0x0000002C/4) /* Interrupt Disable reg */
 -#define GEM_IMR           (0x00000030/4) /* Interrupt Mask reg */
 -#define GEM_PHYMNTNC      (0x00000034/4) /* Phy Maintenance reg */
 -#define GEM_RXPAUSE       (0x00000038/4) /* RX Pause Time reg */
 -#define GEM_TXPAUSE       (0x0000003C/4) /* TX Pause Time reg */
 -#define GEM_TXPARTIALSF   (0x00000040/4) /* TX Partial Store and Forward */
 -#define GEM_RXPARTIALSF   (0x00000044/4) /* RX Partial Store and Forward */
 -#define GEM_HASHLO        (0x00000080/4) /* Hash Low address reg */
 -#define GEM_HASHHI        (0x00000084/4) /* Hash High address reg */
 -#define GEM_SPADDR1LO     (0x00000088/4) /* Specific addr 1 low reg */
 -#define GEM_SPADDR1HI     (0x0000008C/4) /* Specific addr 1 high reg */
 -#define GEM_SPADDR2LO     (0x00000090/4) /* Specific addr 2 low reg */
 -#define GEM_SPADDR2HI     (0x00000094/4) /* Specific addr 2 high reg */
 -#define GEM_SPADDR3LO     (0x00000098/4) /* Specific addr 3 low reg */
 -#define GEM_SPADDR3HI     (0x0000009C/4) /* Specific addr 3 high reg */
 -#define GEM_SPADDR4LO     (0x000000A0/4) /* Specific addr 4 low reg */
 -#define GEM_SPADDR4HI     (0x000000A4/4) /* Specific addr 4 high reg */
 -#define GEM_TIDMATCH1     (0x000000A8/4) /* Type ID1 Match reg */
 -#define GEM_TIDMATCH2     (0x000000AC/4) /* Type ID2 Match reg */
 -#define GEM_TIDMATCH3     (0x000000B0/4) /* Type ID3 Match reg */
 -#define GEM_TIDMATCH4     (0x000000B4/4) /* Type ID4 Match reg */
 -#define GEM_WOLAN         (0x000000B8/4) /* Wake on LAN reg */
 -#define GEM_IPGSTRETCH    (0x000000BC/4) /* IPG Stretch reg */
 -#define GEM_SVLAN         (0x000000C0/4) /* Stacked VLAN reg */
 -#define GEM_MODID         (0x000000FC/4) /* Module ID reg */
 -#define GEM_OCTTXLO       (0x00000100/4) /* Octects transmitted Low reg */
 -#define GEM_OCTTXHI       (0x00000104/4) /* Octects transmitted High reg */
 -#define GEM_TXCNT         (0x00000108/4) /* Error-free Frames transmitted */
 -#define GEM_TXBCNT        (0x0000010C/4) /* Error-free Broadcast Frames */
 -#define GEM_TXMCNT        (0x00000110/4) /* Error-free Multicast Frame */
 -#define GEM_TXPAUSECNT    (0x00000114/4) /* Pause Frames Transmitted */
 -#define GEM_TX64CNT       (0x00000118/4) /* Error-free 64 TX */
 -#define GEM_TX65CNT       (0x0000011C/4) /* Error-free 65-127 TX */
 -#define GEM_TX128CNT      (0x00000120/4) /* Error-free 128-255 TX */
 -#define GEM_TX256CNT      (0x00000124/4) /* Error-free 256-511 */
 -#define GEM_TX512CNT      (0x00000128/4) /* Error-free 512-1023 TX */
 -#define GEM_TX1024CNT     (0x0000012C/4) /* Error-free 1024-1518 TX */
 -#define GEM_TX1519CNT     (0x00000130/4) /* Error-free larger than 1519 TX */
 -#define GEM_TXURUNCNT     (0x00000134/4) /* TX under run error counter */
 -#define GEM_SINGLECOLLCNT (0x00000138/4) /* Single Collision Frames */
 -#define GEM_MULTCOLLCNT   (0x0000013C/4) /* Multiple Collision Frames */
 -#define GEM_EXCESSCOLLCNT (0x00000140/4) /* Excessive Collision Frames */
 -#define GEM_LATECOLLCNT   (0x00000144/4) /* Late Collision Frames */
 -#define GEM_DEFERTXCNT    (0x00000148/4) /* Deferred Transmission Frames */
 -#define GEM_CSENSECNT     (0x0000014C/4) /* Carrier Sense Error Counter */
 -#define GEM_OCTRXLO       (0x00000150/4) /* Octects Received register Low */
 -#define GEM_OCTRXHI       (0x00000154/4) /* Octects Received register High */
 -#define GEM_RXCNT         (0x00000158/4) /* Error-free Frames Received */
 -#define GEM_RXBROADCNT    (0x0000015C/4) /* Error-free Broadcast Frames RX */
 -#define GEM_RXMULTICNT    (0x00000160/4) /* Error-free Multicast Frames RX */
 -#define GEM_RXPAUSECNT    (0x00000164/4) /* Pause Frames Received Counter */
 -#define GEM_RX64CNT       (0x00000168/4) /* Error-free 64 byte Frames RX */
 -#define GEM_RX65CNT       (0x0000016C/4) /* Error-free 65-127B Frames RX */
 -#define GEM_RX128CNT      (0x00000170/4) /* Error-free 128-255B Frames RX */
 -#define GEM_RX256CNT      (0x00000174/4) /* Error-free 256-512B Frames RX */
 -#define GEM_RX512CNT      (0x00000178/4) /* Error-free 512-1023B Frames RX */
 -#define GEM_RX1024CNT     (0x0000017C/4) /* Error-free 1024-1518B Frames RX */
 -#define GEM_RX1519CNT     (0x00000180/4) /* Error-free 1519-max Frames RX */
 -#define GEM_RXUNDERCNT    (0x00000184/4) /* Undersize Frames Received */
 -#define GEM_RXOVERCNT     (0x00000188/4) /* Oversize Frames Received */
 -#define GEM_RXJABCNT      (0x0000018C/4) /* Jabbers Received Counter */
 -#define GEM_RXFCSCNT      (0x00000190/4) /* Frame Check seq. Error Counter */
 -#define GEM_RXLENERRCNT   (0x00000194/4) /* Length Field Error Counter */
 -#define GEM_RXSYMERRCNT   (0x00000198/4) /* Symbol Error Counter */
 -#define GEM_RXALIGNERRCNT (0x0000019C/4) /* Alignment Error Counter */
 -#define GEM_RXRSCERRCNT   (0x000001A0/4) /* Receive Resource Error Counter */
 -#define GEM_RXORUNCNT     (0x000001A4/4) /* Receive Overrun Counter */
 -#define GEM_RXIPCSERRCNT  (0x000001A8/4) /* IP header Checksum Error Counter */
 -#define GEM_RXTCPCCNT     (0x000001AC/4) /* TCP Checksum Error Counter */
 -#define GEM_RXUDPCCNT     (0x000001B0/4) /* UDP Checksum Error Counter */
 -
 -#define GEM_1588S         (0x000001D0/4) /* 1588 Timer Seconds */
 -#define GEM_1588NS        (0x000001D4/4) /* 1588 Timer Nanoseconds */
 -#define GEM_1588ADJ       (0x000001D8/4) /* 1588 Timer Adjust */
 -#define GEM_1588INC       (0x000001DC/4) /* 1588 Timer Increment */
 -#define GEM_PTPETXS       (0x000001E0/4) /* PTP Event Frame Transmitted (s) */
 -#define GEM_PTPETXNS      (0x000001E4/4) /* PTP Event Frame Transmitted (ns) */
 -#define GEM_PTPERXS       (0x000001E8/4) /* PTP Event Frame Received (s) */
 -#define GEM_PTPERXNS      (0x000001EC/4) /* PTP Event Frame Received (ns) */
 -#define GEM_PTPPTXS       (0x000001E0/4) /* PTP Peer Frame Transmitted (s) */
 -#define GEM_PTPPTXNS      (0x000001E4/4) /* PTP Peer Frame Transmitted (ns) */
 -#define GEM_PTPPRXS       (0x000001E8/4) /* PTP Peer Frame Received (s) */
 -#define GEM_PTPPRXNS      (0x000001EC/4) /* PTP Peer Frame Received (ns) */
 +#define GEM_NWCTRL        (0x00000000 / 4) /* Network Control reg */
 +#define GEM_NWCFG         (0x00000004 / 4) /* Network Config reg */
 +#define GEM_NWSTATUS      (0x00000008 / 4) /* Network Status reg */
 +#define GEM_USERIO        (0x0000000C / 4) /* User IO reg */
 +#define GEM_DMACFG        (0x00000010 / 4) /* DMA Control reg */
 +#define GEM_TXSTATUS      (0x00000014 / 4) /* TX Status reg */
 +#define GEM_RXQBASE       (0x00000018 / 4) /* RX Q Base address reg */
 +#define GEM_TXQBASE       (0x0000001C / 4) /* TX Q Base address reg */
 +#define GEM_RXSTATUS      (0x00000020 / 4) /* RX Status reg */
 +#define GEM_ISR           (0x00000024 / 4) /* Interrupt Status reg */
 +#define GEM_IER           (0x00000028 / 4) /* Interrupt Enable reg */
 +#define GEM_IDR           (0x0000002C / 4) /* Interrupt Disable reg */
 +#define GEM_IMR           (0x00000030 / 4) /* Interrupt Mask reg */
 +#define GEM_PHYMNTNC      (0x00000034 / 4) /* Phy Maintenance reg */
 +#define GEM_RXPAUSE       (0x00000038 / 4) /* RX Pause Time reg */
 +#define GEM_TXPAUSE       (0x0000003C / 4) /* TX Pause Time reg */
 +#define GEM_TXPARTIALSF   (0x00000040 / 4) /* TX Partial Store and Forward */
 +#define GEM_RXPARTIALSF   (0x00000044 / 4) /* RX Partial Store and Forward */
 +#define GEM_HASHLO        (0x00000080 / 4) /* Hash Low address reg */
 +#define GEM_HASHHI        (0x00000084 / 4) /* Hash High address reg */
 +#define GEM_SPADDR1LO     (0x00000088 / 4) /* Specific addr 1 low reg */
 +#define GEM_SPADDR1HI     (0x0000008C / 4) /* Specific addr 1 high reg */
 +#define GEM_SPADDR2LO     (0x00000090 / 4) /* Specific addr 2 low reg */
 +#define GEM_SPADDR2HI     (0x00000094 / 4) /* Specific addr 2 high reg */
 +#define GEM_SPADDR3LO     (0x00000098 / 4) /* Specific addr 3 low reg */
 +#define GEM_SPADDR3HI     (0x0000009C / 4) /* Specific addr 3 high reg */
 +#define GEM_SPADDR4LO     (0x000000A0 / 4) /* Specific addr 4 low reg */
 +#define GEM_SPADDR4HI     (0x000000A4 / 4) /* Specific addr 4 high reg */
 +#define GEM_TIDMATCH1     (0x000000A8 / 4) /* Type ID1 Match reg */
 +#define GEM_TIDMATCH2     (0x000000AC / 4) /* Type ID2 Match reg */
 +#define GEM_TIDMATCH3     (0x000000B0 / 4) /* Type ID3 Match reg */
 +#define GEM_TIDMATCH4     (0x000000B4 / 4) /* Type ID4 Match reg */
 +#define GEM_WOLAN         (0x000000B8 / 4) /* Wake on LAN reg */
 +#define GEM_IPGSTRETCH    (0x000000BC / 4) /* IPG Stretch reg */
 +#define GEM_SVLAN         (0x000000C0 / 4) /* Stacked VLAN reg */
 +#define GEM_MODID         (0x000000FC / 4) /* Module ID reg */
 +#define GEM_OCTTXLO       (0x00000100 / 4) /* Octects transmitted Low reg */
 +#define GEM_OCTTXHI       (0x00000104 / 4) /* Octects transmitted High reg */
 +#define GEM_TXCNT         (0x00000108 / 4) /* Error-free Frames transmitted */
 +#define GEM_TXBCNT        (0x0000010C / 4) /* Error-free Broadcast Frames */
 +#define GEM_TXMCNT        (0x00000110 / 4) /* Error-free Multicast Frame */
 +#define GEM_TXPAUSECNT    (0x00000114 / 4) /* Pause Frames Transmitted */
 +#define GEM_TX64CNT       (0x00000118 / 4) /* Error-free 64 TX */
 +#define GEM_TX65CNT       (0x0000011C / 4) /* Error-free 65-127 TX */
 +#define GEM_TX128CNT      (0x00000120 / 4) /* Error-free 128-255 TX */
 +#define GEM_TX256CNT      (0x00000124 / 4) /* Error-free 256-511 */
 +#define GEM_TX512CNT      (0x00000128 / 4) /* Error-free 512-1023 TX */
 +#define GEM_TX1024CNT     (0x0000012C / 4) /* Error-free 1024-1518 TX */
 +#define GEM_TX1519CNT     (0x00000130 / 4) /* Error-free larger than 1519 TX */
 +#define GEM_TXURUNCNT     (0x00000134 / 4) /* TX under run error counter */
 +#define GEM_SINGLECOLLCNT (0x00000138 / 4) /* Single Collision Frames */
 +#define GEM_MULTCOLLCNT   (0x0000013C / 4) /* Multiple Collision Frames */
 +#define GEM_EXCESSCOLLCNT (0x00000140 / 4) /* Excessive Collision Frames */
 +#define GEM_LATECOLLCNT   (0x00000144 / 4) /* Late Collision Frames */
 +#define GEM_DEFERTXCNT    (0x00000148 / 4) /* Deferred Transmission Frames */
 +#define GEM_CSENSECNT     (0x0000014C / 4) /* Carrier Sense Error Counter */
 +#define GEM_OCTRXLO       (0x00000150 / 4) /* Octects Received register Low */
 +#define GEM_OCTRXHI       (0x00000154 / 4) /* Octects Received register High */
 +#define GEM_RXCNT         (0x00000158 / 4) /* Error-free Frames Received */
 +#define GEM_RXBROADCNT    (0x0000015C / 4) /* Error-free Broadcast Frames RX */
 +#define GEM_RXMULTICNT    (0x00000160 / 4) /* Error-free Multicast Frames RX */
 +#define GEM_RXPAUSECNT    (0x00000164 / 4) /* Pause Frames Received Counter */
 +#define GEM_RX64CNT       (0x00000168 / 4) /* Error-free 64 byte Frames RX */
 +#define GEM_RX65CNT       (0x0000016C / 4) /* Error-free 65-127B Frames RX */
 +#define GEM_RX128CNT      (0x00000170 / 4) /* Error-free 128-255B Frames RX */
 +#define GEM_RX256CNT      (0x00000174 / 4) /* Error-free 256-512B Frames RX */
 +#define GEM_RX512CNT      (0x00000178 / 4) /* Error-free 512-1023B Frames RX */
 +#define GEM_RX1024CNT     (0x0000017C / 4) /* Error-free 1024-1518B Frames RX */
 +#define GEM_RX1519CNT     (0x00000180 / 4) /* Error-free 1519-max Frames RX */
 +#define GEM_RXUNDERCNT    (0x00000184 / 4) /* Undersize Frames Received */
 +#define GEM_RXOVERCNT     (0x00000188 / 4) /* Oversize Frames Received */
 +#define GEM_RXJABCNT      (0x0000018C / 4) /* Jabbers Received Counter */
 +#define GEM_RXFCSCNT      (0x00000190 / 4) /* Frame Check seq. Error Counter */
 +#define GEM_RXLENERRCNT   (0x00000194 / 4) /* Length Field Error Counter */
 +#define GEM_RXSYMERRCNT   (0x00000198 / 4) /* Symbol Error Counter */
 +#define GEM_RXALIGNERRCNT (0x0000019C / 4) /* Alignment Error Counter */
 +#define GEM_RXRSCERRCNT   (0x000001A0 / 4) /* Receive Resource Error Counter */
 +#define GEM_RXORUNCNT     (0x000001A4 / 4) /* Receive Overrun Counter */
 +#define GEM_RXIPCSERRCNT  (0x000001A8 / 4) /* IP header Checksum Err Counter */
 +#define GEM_RXTCPCCNT     (0x000001AC / 4) /* TCP Checksum Error Counter */
 +#define GEM_RXUDPCCNT     (0x000001B0 / 4) /* UDP Checksum Error Counter */
 +
 +#define GEM_1588S         (0x000001D0 / 4) /* 1588 Timer Seconds */
 +#define GEM_1588NS        (0x000001D4 / 4) /* 1588 Timer Nanoseconds */
 +#define GEM_1588ADJ       (0x000001D8 / 4) /* 1588 Timer Adjust */
 +#define GEM_1588INC       (0x000001DC / 4) /* 1588 Timer Increment */
 +#define GEM_PTPETXS       (0x000001E0 / 4) /* PTP Event Frame Transmitted (s) */
 +#define GEM_PTPETXNS      (0x000001E4 / 4) /*
 +                                            * PTP Event Frame Transmitted (ns)
 +                                            */
 +#define GEM_PTPERXS       (0x000001E8 / 4) /* PTP Event Frame Received (s) */
 +#define GEM_PTPERXNS      (0x000001EC / 4) /* PTP Event Frame Received (ns) */
 +#define GEM_PTPPTXS       (0x000001E0 / 4) /* PTP Peer Frame Transmitted (s) */
 +#define GEM_PTPPTXNS      (0x000001E4 / 4) /* PTP Peer Frame Transmitted (ns) */
 +#define GEM_PTPPRXS       (0x000001E8 / 4) /* PTP Peer Frame Received (s) */
 +#define GEM_PTPPRXNS      (0x000001EC / 4) /* PTP Peer Frame Received (ns) */
  /* Design Configuration Registers */
 -#define GEM_DESCONF       (0x00000280/4)
 -#define GEM_DESCONF2      (0x00000284/4)
 -#define GEM_DESCONF3      (0x00000288/4)
 -#define GEM_DESCONF4      (0x0000028C/4)
 -#define GEM_DESCONF5      (0x00000290/4)
 -#define GEM_DESCONF6      (0x00000294/4)
 +#define GEM_DESCONF       (0x00000280 / 4)
 +#define GEM_DESCONF2      (0x00000284 / 4)
 +#define GEM_DESCONF3      (0x00000288 / 4)
 +#define GEM_DESCONF4      (0x0000028C / 4)
 +#define GEM_DESCONF5      (0x00000290 / 4)
 +#define GEM_DESCONF6      (0x00000294 / 4)
  #define GEM_DESCONF6_64B_MASK (1U << 23)
 -#define GEM_DESCONF7      (0x00000298/4)
 +#define GEM_DESCONF7      (0x00000298 / 4)
  #define GEM_INT_Q1_STATUS               (0x00000400 / 4)
  #define GEM_INT_Q1_MASK                 (0x00000640 / 4)
 --
 .5.0

-[PULL 03/10] ebpf: Added eBPF RSS program.
+[PULL V2 18/33] net: cadence_gem: Add support for jumbo frames
-From: Andrew Melnychenko <andrew@daynix.com>
+From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
-RSS program and Makefile to build it.
+Add a property "jumbo-max-len", which sets default value of jumbo frames
-The bpftool used to generate '.h' file.
+up to 16,383 bytes. Add Frame length checks for standard and jumbo
-The data in that file may be loaded by libbpf.
+frames.
 EBPF compilation is not required for building qemu.
 You can use Makefile if you need to regenerate rss.bpf.skeleton.h.
-Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
+Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
-Signed-off-by: Andrew Melnychenko <andrew@daynix.com>
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- tools/ebpf/Makefile.ebpf |  21 ++
+ hw/net/cadence_gem.c         | 51 +++++++++++++++++++++++++++++++++++++++-----
- tools/ebpf/rss.bpf.c     | 569 +++++++++++++++++++++++++++++++++++++++++++++++
+ include/hw/net/cadence_gem.h |  4 +++-
-files changed, 590 insertions(+)
+files changed, 49 insertions(+), 6 deletions(-)
  create mode 100755 tools/ebpf/Makefile.ebpf
  create mode 100644 tools/ebpf/rss.bpf.c
-diff --git a/tools/ebpf/Makefile.ebpf b/tools/ebpf/Makefile.ebpf
+diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
-new file mode 100755
+index XXXXXXX..XXXXXXX 100644
-index XXXXXXX..XXXXXXX
+--- a/hw/net/cadence_gem.c
---- /dev/null
++++ b/hw/net/cadence_gem.c
 +++ b/tools/ebpf/Makefile.ebpf
 @@ -XXX,XX +XXX,XX @@
-+OBJS = rss.bpf.o
+ #define GEM_TXPAUSE       (0x0000003C / 4) /* TX Pause Time reg */
-+
+ #define GEM_TXPARTIALSF   (0x00000040 / 4) /* TX Partial Store and Forward */
-+LLC ?= llc
+ #define GEM_RXPARTIALSF   (0x00000044 / 4) /* RX Partial Store and Forward */
-+CLANG ?= clang
++#define GEM_JUMBO_MAX_LEN (0x00000048 / 4) /* Max Jumbo Frame Size */
-+INC_FLAGS = `$(CLANG) -print-file-name=include`
+ #define GEM_HASHLO        (0x00000080 / 4) /* Hash Low address reg */
-+EXTRA_CFLAGS ?= -O2 -emit-llvm -fno-stack-protector
+ #define GEM_HASHHI        (0x00000084 / 4) /* Hash High address reg */
-+
+ #define GEM_SPADDR1LO     (0x00000088 / 4) /* Specific addr 1 low reg */
 +all: $(OBJS)
 +
 +.PHONY: clean
 +
 +clean:
 +    rm -f $(OBJS)
 +
 +$(OBJS):  %.o:%.c
 +    $(CLANG) $(INC_FLAGS) \
 +                -D__KERNEL__ -D__ASM_SYSREG_H \
 +                -I../include $(LINUXINCLUDE) \
 +                $(EXTRA_CFLAGS) -c $< -o -| $(LLC) -march=bpf -filetype=obj -o $@
 +    bpftool gen skeleton rss.bpf.o > rss.bpf.skeleton.h
 +    cp rss.bpf.skeleton.h ../../ebpf/
 diff --git a/tools/ebpf/rss.bpf.c b/tools/ebpf/rss.bpf.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/tools/ebpf/rss.bpf.c
 @@ -XXX,XX +XXX,XX @@
-+/*
+ #define GEM_NWCFG_LERR_DISC    0x00010000 /* Discard RX frames with len err */
-+ * eBPF RSS program
+ #define GEM_NWCFG_BUFF_OFST_M  0x0000C000 /* Receive buffer offset mask */
-+ *
+ #define GEM_NWCFG_BUFF_OFST_S  14         /* Receive buffer offset shift */
-+ * Developed by Daynix Computing LTD (http://www.daynix.com)
++#define GEM_NWCFG_RCV_1538     0x00000100 /* Receive 1538 bytes frame */
-+ *
+ #define GEM_NWCFG_UCAST_HASH   0x00000080 /* accept unicast if hash match */
-+ * Authors:
+ #define GEM_NWCFG_MCAST_HASH   0x00000040 /* accept multicast if hash match */
-+ *  Andrew Melnychenko <andrew@daynix.com>
+ #define GEM_NWCFG_BCAST_REJ    0x00000020 /* Reject broadcast packets */
-+ *  Yuri Benditovich <yuri.benditovich@daynix.com>
+ #define GEM_NWCFG_PROMISC      0x00000010 /* Accept all packets */
-+ *
++#define GEM_NWCFG_JUMBO_FRAME  0x00000008 /* Jumbo Frames enable */
-+ * This work is licensed under the terms of the GNU GPL, version 2.  See
-+ * the COPYING file in the top-level directory.
+ #define GEM_DMACFG_ADDR_64B    (1U << 30)
-+ *
+ #define GEM_DMACFG_TX_BD_EXT   (1U << 29)
-+ * Prepare:
+@@ -XXX,XX +XXX,XX @@
-+ * Requires llvm, clang, bpftool, linux kernel tree
-+ *
+ /* GEM_ISR GEM_IER GEM_IDR GEM_IMR */
-+ * Build rss.bpf.skeleton.h:
+ #define GEM_INT_TXCMPL        0x00000080 /* Transmit Complete */
-+ * make -f Makefile.ebpf clean all
++#define GEM_INT_AMBA_ERR      0x00000040
-+ */
+ #define GEM_INT_TXUSED         0x00000008
-+
+ #define GEM_INT_RXUSED         0x00000004
-+#include <stddef.h>
+ #define GEM_INT_RXCMPL        0x00000002
-+#include <stdbool.h>
+@@ -XXX,XX +XXX,XX @@ static inline void rx_desc_set_sar(uint32_t *desc, int sar_idx)
-+#include <linux/bpf.h>
+ /* The broadcast MAC address: 0xFFFFFFFFFFFF */
-+
+ static const uint8_t broadcast_addr[] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
-+#include <linux/in.h>
-+#include <linux/if_ether.h>
++static uint32_t gem_get_max_buf_len(CadenceGEMState *s, bool tx)
-+#include <linux/ip.h>
++{
-+#include <linux/ipv6.h>
++    uint32_t size;
-+
++    if (s->regs[GEM_NWCFG] & GEM_NWCFG_JUMBO_FRAME) {
-+#include <linux/udp.h>
++        size = s->regs[GEM_JUMBO_MAX_LEN];
-+#include <linux/tcp.h>
++        if (size > s->jumbo_max_len) {
-+
++            size = s->jumbo_max_len;
-+#include <bpf/bpf_helpers.h>
++            qemu_log_mask(LOG_GUEST_ERROR, "GEM_JUMBO_MAX_LEN reg cannot be"
-+#include <bpf/bpf_endian.h>
++                " greater than 0x%" PRIx32 "\n", s->jumbo_max_len);
-+#include <linux/virtio_net.h>
++        }
-+
++    } else if (tx) {
-+#define INDIRECTION_TABLE_SIZE 128
++        size = 1518;
-+#define HASH_CALCULATION_BUFFER_SIZE 36
++    } else {
-+
++        size = s->regs[GEM_NWCFG] & GEM_NWCFG_RCV_1538 ? 1538 : 1518;
-+struct rss_config_t {
++    }
-+    __u8 redirect;
++    return size;
 +    __u8 populate_hash;
 +    __u32 hash_types;
 +    __u16 indirections_len;
 +    __u16 default_queue;
 +} __attribute__((packed));
 +
 +struct toeplitz_key_data_t {
 +    __u32 leftmost_32_bits;
 +    __u8 next_byte[HASH_CALCULATION_BUFFER_SIZE];
 +};
 +
 +struct packet_hash_info_t {
 +    __u8 is_ipv4;
 +    __u8 is_ipv6;
 +    __u8 is_udp;
 +    __u8 is_tcp;
 +    __u8 is_ipv6_ext_src;
 +    __u8 is_ipv6_ext_dst;
 +    __u8 is_fragmented;
 +
 +    __u16 src_port;
 +    __u16 dst_port;
 +
 +    union {
 +        struct {
 +            __be32 in_src;
 +            __be32 in_dst;
 +        };
 +
 +        struct {
 +            struct in6_addr in6_src;
 +            struct in6_addr in6_dst;
 +            struct in6_addr in6_ext_src;
 +            struct in6_addr in6_ext_dst;
 +        };
 +    };
 +};
 +
 +struct bpf_map_def SEC("maps")
 +tap_rss_map_configurations = {
 +        .type        = BPF_MAP_TYPE_ARRAY,
 +        .key_size    = sizeof(__u32),
 +        .value_size  = sizeof(struct rss_config_t),
 +        .max_entries = 1,
 +};
 +
 +struct bpf_map_def SEC("maps")
 +tap_rss_map_toeplitz_key = {
 +        .type        = BPF_MAP_TYPE_ARRAY,
 +        .key_size    = sizeof(__u32),
 +        .value_size  = sizeof(struct toeplitz_key_data_t),
 +        .max_entries = 1,
 +};
 +
 +struct bpf_map_def SEC("maps")
 +tap_rss_map_indirection_table = {
 +        .type        = BPF_MAP_TYPE_ARRAY,
 +        .key_size    = sizeof(__u32),
 +        .value_size  = sizeof(__u16),
 +        .max_entries = INDIRECTION_TABLE_SIZE,
 +};
 +
 +static inline void net_rx_rss_add_chunk(__u8 *rss_input, size_t *bytes_written,
 +                                        const void *ptr, size_t size) {
 +    __builtin_memcpy(&rss_input[*bytes_written], ptr, size);
 +    *bytes_written += size;
 +}
 +
-+static inline
+ static void gem_set_isr(CadenceGEMState *s, int q, uint32_t flag)
-+void net_toeplitz_add(__u32 *result,
+ {
-+                      __u8 *input,
+     if (q == 0) {
-+                      __u32 len
+@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
-+        , struct toeplitz_key_data_t *key) {
+     /* Find which queue we are targeting */
-+
+     q = get_queue_from_screen(s, rxbuf_ptr, rxbufsize);
-+    __u32 accumulator = *result;
-+    __u32 leftmost_32_bits = key->leftmost_32_bits;
++    if (size > gem_get_max_buf_len(s, false)) {
-+    __u32 byte;
++        qemu_log_mask(LOG_GUEST_ERROR, "rx frame too long\n");
-+
++        gem_set_isr(s, q, GEM_INT_AMBA_ERR);
 +    for (byte = 0; byte < HASH_CALCULATION_BUFFER_SIZE; byte++) {
 +        __u8 input_byte = input[byte];
 +        __u8 key_byte = key->next_byte[byte];
 +        __u8 bit;
 +
 +        for (bit = 0; bit < 8; bit++) {
 +            if (input_byte & (1 << 7)) {
 +                accumulator ^= leftmost_32_bits;
 +            }
 +
 +            leftmost_32_bits =
 +                    (leftmost_32_bits << 1) | ((key_byte & (1 << 7)) >> 7);
 +
 +            input_byte <<= 1;
 +            key_byte <<= 1;
 +        }
 +    }
 +
 +    *result = accumulator;
 +}
 +
 +
 +static inline int ip6_extension_header_type(__u8 hdr_type)
 +{
 +    switch (hdr_type) {
 +    case IPPROTO_HOPOPTS:
 +    case IPPROTO_ROUTING:
 +    case IPPROTO_FRAGMENT:
 +    case IPPROTO_ICMPV6:
 +    case IPPROTO_NONE:
 +    case IPPROTO_DSTOPTS:
 +    case IPPROTO_MH:
 +        return 1;
 +    default:
 +        return 0;
 +    }
 +}
 +/*
 + * According to https://www.iana.org/assignments/ipv6-parameters/ipv6-parameters.xhtml
 + * we suspect that there are would be no more than 11 extensions in IPv6 header,
 + * also there is 27 TLV options for Destination and Hop-by-hop extensions.
 + * Need to choose reasonable amount of maximum extensions/options we may check to find
 + * ext src/dst.
 + */
 +#define IP6_EXTENSIONS_COUNT 11
 +#define IP6_OPTIONS_COUNT 30
 +
 +static inline int parse_ipv6_ext(struct __sk_buff *skb,
 +        struct packet_hash_info_t *info,
 +        __u8 *l4_protocol, size_t *l4_offset)
 +{
 +    int err = 0;
 +
 +    if (!ip6_extension_header_type(*l4_protocol)) {
 +        return 0;
 +    }
 +
 +    struct ipv6_opt_hdr ext_hdr = {};
 +
 +    for (unsigned int i = 0; i < IP6_EXTENSIONS_COUNT; ++i) {
 +
 +        err = bpf_skb_load_bytes_relative(skb, *l4_offset, &ext_hdr,
 +                                    sizeof(ext_hdr), BPF_HDR_START_NET);
 +        if (err) {
 +            goto error;
 +        }
 +
 +        if (*l4_protocol == IPPROTO_ROUTING) {
 +            struct ipv6_rt_hdr ext_rt = {};
 +
 +            err = bpf_skb_load_bytes_relative(skb, *l4_offset, &ext_rt,
 +                                        sizeof(ext_rt), BPF_HDR_START_NET);
 +            if (err) {
 +                goto error;
 +            }
 +
 +            if ((ext_rt.type == IPV6_SRCRT_TYPE_2) &&
 +                    (ext_rt.hdrlen == sizeof(struct in6_addr) / 8) &&
 +                    (ext_rt.segments_left == 1)) {
 +
 +                err = bpf_skb_load_bytes_relative(skb,
 +                    *l4_offset + offsetof(struct rt2_hdr, addr),
 +                    &info->in6_ext_dst, sizeof(info->in6_ext_dst),
 +                    BPF_HDR_START_NET);
 +                if (err) {
 +                    goto error;
 +                }
 +
 +                info->is_ipv6_ext_dst = 1;
 +            }
 +
 +        } else if (*l4_protocol == IPPROTO_DSTOPTS) {
 +            struct ipv6_opt_t {
 +                __u8 type;
 +                __u8 length;
 +            } __attribute__((packed)) opt = {};
 +
 +            size_t opt_offset = sizeof(ext_hdr);
 +
 +            for (unsigned int j = 0; j < IP6_OPTIONS_COUNT; ++j) {
 +                err = bpf_skb_load_bytes_relative(skb, *l4_offset + opt_offset,
 +                                        &opt, sizeof(opt), BPF_HDR_START_NET);
 +                if (err) {
 +                    goto error;
 +                }
 +
 +                if (opt.type == IPV6_TLV_HAO) {
 +                    err = bpf_skb_load_bytes_relative(skb,
 +                        *l4_offset + opt_offset + offsetof(struct ipv6_destopt_hao, addr),
 +                        &info->in6_ext_src, sizeof(info->in6_ext_src),
 +                        BPF_HDR_START_NET);
 +                    if (err) {
 +                        goto error;
 +                    }
 +
 +                    info->is_ipv6_ext_src = 1;
 +                    break;
 +                }
 +
 +                opt_offset += (opt.type == IPV6_TLV_PAD1) ?
 +                              1 : opt.length + sizeof(opt);
 +
 +                if (opt_offset + 1 >= ext_hdr.hdrlen * 8) {
 +                    break;
 +                }
 +            }
 +        } else if (*l4_protocol == IPPROTO_FRAGMENT) {
 +            info->is_fragmented = true;
 +        }
 +
 +        *l4_protocol = ext_hdr.nexthdr;
 +        *l4_offset += (ext_hdr.hdrlen + 1) * 8;
 +
 +        if (!ip6_extension_header_type(ext_hdr.nexthdr)) {
 +            return 0;
 +        }
 +    }
 +
 +    return 0;
 +error:
 +    return err;
 +}
 +
 +static __be16 parse_eth_type(struct __sk_buff *skb)
 +{
 +    unsigned int offset = 12;
 +    __be16 ret = 0;
 +    int err = 0;
 +
 +    err = bpf_skb_load_bytes_relative(skb, offset, &ret, sizeof(ret),
 +                                BPF_HDR_START_MAC);
 +    if (err) {
 +        return 0;
 +    }
 +
 +    switch (bpf_ntohs(ret)) {
 +    case ETH_P_8021AD:
 +        offset += 4;
 +    case ETH_P_8021Q:
 +        offset += 4;
 +        err = bpf_skb_load_bytes_relative(skb, offset, &ret, sizeof(ret),
 +                                    BPF_HDR_START_MAC);
 +    default:
 +        break;
 +    }
 +
 +    if (err) {
 +        return 0;
 +    }
 +
 +    return ret;
 +}
 +
 +static inline int parse_packet(struct __sk_buff *skb,
 +        struct packet_hash_info_t *info)
 +{
 +    int err = 0;
 +
 +    if (!info || !skb) {
 +        return -1;
 +    }
 +
-+    size_t l4_offset = 0;
+     while (bytes_to_copy) {
-+    __u8 l4_protocol = 0;
+         hwaddr desc_addr;
-+    __u16 l3_protocol = bpf_ntohs(parse_eth_type(skb));
-+    if (l3_protocol == 0) {
+@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
-+        err = -1;
+                 break;
-+        goto error;
+             }
 -            if (tx_desc_get_length(desc) > MAX_FRAME_SIZE -
 +            if (tx_desc_get_length(desc) > gem_get_max_buf_len(s, true) -
                                                 (p - s->tx_packet)) {
 -                DB_PRINT("TX descriptor @ 0x%" HWADDR_PRIx \
 -                         " too large: size 0x%x space 0x%zx\n",
 +                qemu_log_mask(LOG_GUEST_ERROR, "TX descriptor @ 0x%" \
 +                         HWADDR_PRIx " too large: size 0x%x space 0x%zx\n",
                           packet_desc_addr, tx_desc_get_length(desc),
 -                         MAX_FRAME_SIZE - (p - s->tx_packet));
 +                         gem_get_max_buf_len(s, true) - (p - s->tx_packet));
 +                gem_set_isr(s, q, GEM_INT_AMBA_ERR);
                  break;
              }
@@ -XXX,XX +XXX,XX @@ static void gem_reset(DeviceState *d)
      s->regs[GEM_RXPARTIALSF] = 0x000003ff;
      s->regs[GEM_MODID] = s->revision;
      s->regs[GEM_DESCONF] = 0x02500111;
 -    s->regs[GEM_DESCONF2] = 0x2ab13fff;
 +    s->regs[GEM_DESCONF2] = 0x2ab10000 | s->jumbo_max_len;
      s->regs[GEM_DESCONF5] = 0x002f2045;
      s->regs[GEM_DESCONF6] = GEM_DESCONF6_64B_MASK;
 +    s->regs[GEM_JUMBO_MAX_LEN] = s->jumbo_max_len;
      if (s->num_priority_queues > 1) {
          queues_mask = MAKE_64BIT_MASK(1, s->num_priority_queues - 1);
@@ -XXX,XX +XXX,XX @@ static void gem_write(void *opaque, hwaddr offset, uint64_t val,
          s->regs[GEM_IMR] &= ~val;
          gem_update_int_status(s);
          break;
 +    case GEM_JUMBO_MAX_LEN:
 +        s->regs[GEM_JUMBO_MAX_LEN] = val & MAX_JUMBO_FRAME_SIZE_MASK;
 +        break;
      case GEM_INT_Q1_ENABLE ... GEM_INT_Q7_ENABLE:
          s->regs[GEM_INT_Q1_MASK + offset - GEM_INT_Q1_ENABLE] &= ~val;
          gem_update_int_status(s);
@@ -XXX,XX +XXX,XX @@ static void gem_realize(DeviceState *dev, Error **errp)
      s->nic = qemu_new_nic(&net_gem_info, &s->conf,
                            object_get_typename(OBJECT(dev)), dev->id, s);
 +
 +    if (s->jumbo_max_len > MAX_FRAME_SIZE) {
 +        error_setg(errp, "jumbo-max-len is greater than %d",
 +                  MAX_FRAME_SIZE);
 +        return;
 +    }
-+
+ }
-+    if (l3_protocol == ETH_P_IP) {
-+        info->is_ipv4 = 1;
+ static void gem_init(Object *obj)
-+
+@@ -XXX,XX +XXX,XX @@ static Property gem_properties[] = {
-+        struct iphdr ip = {};
+                       num_type1_screeners, 4),
-+        err = bpf_skb_load_bytes_relative(skb, 0, &ip, sizeof(ip),
+     DEFINE_PROP_UINT8("num-type2-screeners", CadenceGEMState,
-+                                    BPF_HDR_START_NET);
+                       num_type2_screeners, 4),
-+        if (err) {
++    DEFINE_PROP_UINT16("jumbo-max-len", CadenceGEMState,
-+            goto error;
++                       jumbo_max_len, 10240),
-+        }
+     DEFINE_PROP_END_OF_LIST(),
-+
+ };
-+        info->in_src = ip.saddr;
-+        info->in_dst = ip.daddr;
+diff --git a/include/hw/net/cadence_gem.h b/include/hw/net/cadence_gem.h
-+        info->is_fragmented = !!ip.frag_off;
+index XXXXXXX..XXXXXXX 100644
-+
+--- a/include/hw/net/cadence_gem.h
-+        l4_protocol = ip.protocol;
++++ b/include/hw/net/cadence_gem.h
-+        l4_offset = ip.ihl * 4;
+@@ -XXX,XX +XXX,XX @@
-+    } else if (l3_protocol == ETH_P_IPV6) {
+ #define MAX_TYPE1_SCREENERS             16
-+        info->is_ipv6 = 1;
+ #define MAX_TYPE2_SCREENERS             16
-+
-+        struct ipv6hdr ip6 = {};
+-#define MAX_FRAME_SIZE 2048
-+        err = bpf_skb_load_bytes_relative(skb, 0, &ip6, sizeof(ip6),
++#define MAX_JUMBO_FRAME_SIZE_MASK 0x3FFF
-+                                    BPF_HDR_START_NET);
++#define MAX_FRAME_SIZE MAX_JUMBO_FRAME_SIZE_MASK
-+        if (err) {
-+            goto error;
+ typedef struct CadenceGEMState {
-+        }
+     /*< private >*/
-+
+@@ -XXX,XX +XXX,XX @@ typedef struct CadenceGEMState {
-+        info->in6_src = ip6.saddr;
+     uint8_t num_type1_screeners;
-+        info->in6_dst = ip6.daddr;
+     uint8_t num_type2_screeners;
-+
+     uint32_t revision;
-+        l4_protocol = ip6.nexthdr;
++    uint16_t jumbo_max_len;
-+        l4_offset = sizeof(ip6);
-+
+     /* GEM registers backing store */
-+        err = parse_ipv6_ext(skb, info, &l4_protocol, &l4_offset);
+     uint32_t regs[CADENCE_GEM_MAXREG];
 +        if (err) {
 +            goto error;
 +        }
 +    }
 +
 +    if (l4_protocol != 0 && !info->is_fragmented) {
 +        if (l4_protocol == IPPROTO_TCP) {
 +            info->is_tcp = 1;
 +
 +            struct tcphdr tcp = {};
 +            err = bpf_skb_load_bytes_relative(skb, l4_offset, &tcp, sizeof(tcp),
 +                                        BPF_HDR_START_NET);
 +            if (err) {
 +                goto error;
 +            }
 +
 +            info->src_port = tcp.source;
 +            info->dst_port = tcp.dest;
 +        } else if (l4_protocol == IPPROTO_UDP) { /* TODO: add udplite? */
 +            info->is_udp = 1;
 +
 +            struct udphdr udp = {};
 +            err = bpf_skb_load_bytes_relative(skb, l4_offset, &udp, sizeof(udp),
 +                                        BPF_HDR_START_NET);
 +            if (err) {
 +                goto error;
 +            }
 +
 +            info->src_port = udp.source;
 +            info->dst_port = udp.dest;
 +        }
 +    }
 +
 +    return 0;
 +
 +error:
 +    return err;
 +}
 +
 +static inline __u32 calculate_rss_hash(struct __sk_buff *skb,
 +        struct rss_config_t *config, struct toeplitz_key_data_t *toe)
 +{
 +    __u8 rss_input[HASH_CALCULATION_BUFFER_SIZE] = {};
 +    size_t bytes_written = 0;
 +    __u32 result = 0;
 +    int err = 0;
 +    struct packet_hash_info_t packet_info = {};
 +
 +    err = parse_packet(skb, &packet_info);
 +    if (err) {
 +        return 0;
 +    }
 +
 +    if (packet_info.is_ipv4) {
 +        if (packet_info.is_tcp &&
 +            config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_TCPv4) {
 +
 +            net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                 &packet_info.in_src,
 +                                 sizeof(packet_info.in_src));
 +            net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                 &packet_info.in_dst,
 +                                 sizeof(packet_info.in_dst));
 +            net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                 &packet_info.src_port,
 +                                 sizeof(packet_info.src_port));
 +            net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                 &packet_info.dst_port,
 +                                 sizeof(packet_info.dst_port));
 +        } else if (packet_info.is_udp &&
 +                   config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_UDPv4) {
 +
 +            net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                 &packet_info.in_src,
 +                                 sizeof(packet_info.in_src));
 +            net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                 &packet_info.in_dst,
 +                                 sizeof(packet_info.in_dst));
 +            net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                 &packet_info.src_port,
 +                                 sizeof(packet_info.src_port));
 +            net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                 &packet_info.dst_port,
 +                                 sizeof(packet_info.dst_port));
 +        } else if (config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_IPv4) {
 +            net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                 &packet_info.in_src,
 +                                 sizeof(packet_info.in_src));
 +            net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                 &packet_info.in_dst,
 +                                 sizeof(packet_info.in_dst));
 +        }
 +    } else if (packet_info.is_ipv6) {
 +        if (packet_info.is_tcp &&
 +            config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_TCPv6) {
 +
 +            if (packet_info.is_ipv6_ext_src &&
 +                config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_TCP_EX) {
 +
 +                net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                     &packet_info.in6_ext_src,
 +                                     sizeof(packet_info.in6_ext_src));
 +            } else {
 +                net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                     &packet_info.in6_src,
 +                                     sizeof(packet_info.in6_src));
 +            }
 +            if (packet_info.is_ipv6_ext_dst &&
 +                config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_TCP_EX) {
 +
 +                net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                     &packet_info.in6_ext_dst,
 +                                     sizeof(packet_info.in6_ext_dst));
 +            } else {
 +                net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                     &packet_info.in6_dst,
 +                                     sizeof(packet_info.in6_dst));
 +            }
 +            net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                 &packet_info.src_port,
 +                                 sizeof(packet_info.src_port));
 +            net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                 &packet_info.dst_port,
 +                                 sizeof(packet_info.dst_port));
 +        } else if (packet_info.is_udp &&
 +                   config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_UDPv6) {
 +
 +            if (packet_info.is_ipv6_ext_src &&
 +               config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_UDP_EX) {
 +
 +                net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                     &packet_info.in6_ext_src,
 +                                     sizeof(packet_info.in6_ext_src));
 +            } else {
 +                net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                     &packet_info.in6_src,
 +                                     sizeof(packet_info.in6_src));
 +            }
 +            if (packet_info.is_ipv6_ext_dst &&
 +               config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_UDP_EX) {
 +
 +                net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                     &packet_info.in6_ext_dst,
 +                                     sizeof(packet_info.in6_ext_dst));
 +            } else {
 +                net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                     &packet_info.in6_dst,
 +                                     sizeof(packet_info.in6_dst));
 +            }
 +
 +            net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                 &packet_info.src_port,
 +                                 sizeof(packet_info.src_port));
 +            net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                 &packet_info.dst_port,
 +                                 sizeof(packet_info.dst_port));
 +
 +        } else if (config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_IPv6) {
 +            if (packet_info.is_ipv6_ext_src &&
 +               config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_IP_EX) {
 +
 +                net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                     &packet_info.in6_ext_src,
 +                                     sizeof(packet_info.in6_ext_src));
 +            } else {
 +                net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                     &packet_info.in6_src,
 +                                     sizeof(packet_info.in6_src));
 +            }
 +            if (packet_info.is_ipv6_ext_dst &&
 +                config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_IP_EX) {
 +
 +                net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                     &packet_info.in6_ext_dst,
 +                                     sizeof(packet_info.in6_ext_dst));
 +            } else {
 +                net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                     &packet_info.in6_dst,
 +                                     sizeof(packet_info.in6_dst));
 +            }
 +        }
 +    }
 +
 +    if (bytes_written) {
 +        net_toeplitz_add(&result, rss_input, bytes_written, toe);
 +    }
 +
 +    return result;
 +}
 +
 +SEC("tun_rss_steering")
 +int tun_rss_steering_prog(struct __sk_buff *skb)
 +{
 +
 +    struct rss_config_t *config;
 +    struct toeplitz_key_data_t *toe;
 +
 +    __u32 key = 0;
 +    __u32 hash = 0;
 +
 +    config = bpf_map_lookup_elem(&tap_rss_map_configurations, &key);
 +    toe = bpf_map_lookup_elem(&tap_rss_map_toeplitz_key, &key);
 +
 +    if (config && toe) {
 +        if (!config->redirect) {
 +            return config->default_queue;
 +        }
 +
 +        hash = calculate_rss_hash(skb, config, toe);
 +        if (hash) {
 +            __u32 table_idx = hash % config->indirections_len;
 +            __u16 *queue = 0;
 +
 +            queue = bpf_map_lookup_elem(&tap_rss_map_indirection_table,
 +                                        &table_idx);
 +
 +            if (queue) {
 +                return *queue;
 +            }
 +        }
 +
 +        return config->default_queue;
 +    }
 +
 +    return -1;
 +}
 +
 +char _license[] SEC("license") = "GPL v2";
 --
-.7.4
+.5.0

-New patch
+[PULL V2 19/33] net: cadnece_gem: Update irq_read_clear field of designcfg_debug1 reg
+From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+Advertise support of clear-on-read for ISR registers.
+Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ hw/net/cadence_gem.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/cadence_gem.c
++++ b/hw/net/cadence_gem.c
+@@ -XXX,XX +XXX,XX @@ static void gem_reset(DeviceState *d)
+     s->regs[GEM_TXPARTIALSF] = 0x000003ff;
+     s->regs[GEM_RXPARTIALSF] = 0x000003ff;
+     s->regs[GEM_MODID] = s->revision;
+-    s->regs[GEM_DESCONF] = 0x02500111;
++    s->regs[GEM_DESCONF] = 0x02D00111;
+     s->regs[GEM_DESCONF2] = 0x2ab10000 | s->jumbo_max_len;
+     s->regs[GEM_DESCONF5] = 0x002f2045;
+     s->regs[GEM_DESCONF6] = GEM_DESCONF6_64B_MASK;
+--
+.5.0

-New patch
+[PULL V2 20/33] net: cadence_gem: Update the reset value for interrupt mask register
+From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+Mask all interrupt on reset.
+Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ hw/net/cadence_gem.c | 1 +
+file changed, 1 insertion(+)
+diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/cadence_gem.c
++++ b/hw/net/cadence_gem.c
+@@ -XXX,XX +XXX,XX @@ static void gem_reset(DeviceState *d)
+     s->regs[GEM_DESCONF2] = 0x2ab10000 | s->jumbo_max_len;
+     s->regs[GEM_DESCONF5] = 0x002f2045;
+     s->regs[GEM_DESCONF6] = GEM_DESCONF6_64B_MASK;
++    s->regs[GEM_INT_Q1_MASK] = 0x00000CE6;
+     s->regs[GEM_JUMBO_MAX_LEN] = s->jumbo_max_len;
+     if (s->num_priority_queues > 1) {
+--
+.5.0

-New patch
+[PULL V2 21/33] net: cadence_gem: TX_LAST bit should be set by guest
+From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+TX_LAST bit should not be set by hardware, its set by guest to inform
+the last bd of the frame.
+Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ hw/net/cadence_gem.c | 6 ------
+file changed, 6 deletions(-)
+diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/cadence_gem.c
++++ b/hw/net/cadence_gem.c
+@@ -XXX,XX +XXX,XX @@ static inline unsigned tx_desc_get_last(uint32_t *desc)
+     return (desc[1] & DESC_1_TX_LAST) ? 1 : 0;
+ }
+-static inline void tx_desc_set_last(uint32_t *desc)
+-{
+-    desc[1] |= DESC_1_TX_LAST;
+-}
+-
+ static inline unsigned tx_desc_get_length(uint32_t *desc)
+ {
+     return desc[1] & DESC_1_LENGTH;
+@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
+             /* read next descriptor */
+             if (tx_desc_get_wrap(desc)) {
+-                tx_desc_set_last(desc);
+                 if (s->regs[GEM_DMACFG] & GEM_DMACFG_ADDR_64B) {
+                     packet_desc_addr = s->regs[GEM_TBQPH];
+--
+.5.0

-New patch
+[PULL V2 22/33] net: cadence_gem: Fix RX address filtering
+From: Tong Ho <tong.ho@xilinx.com>
+Two defects are fixed:
+/ Detection of multicast frames
+/ Treating drop of mis-addressed frames as non-error
+Signed-off-by: Tong Ho <tong.ho@xilinx.com>
+Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
+Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ hw/net/cadence_gem.c | 26 +++++++++++---------------
+file changed, 11 insertions(+), 15 deletions(-)
+diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/cadence_gem.c
++++ b/hw/net/cadence_gem.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/module.h"
+ #include "sysemu/dma.h"
+ #include "net/checksum.h"
++#include "net/eth.h"
+ #define CADENCE_GEM_ERR_DEBUG 0
+ #define DB_PRINT(...) do {\
+@@ -XXX,XX +XXX,XX @@ static unsigned calc_mac_hash(const uint8_t *mac)
+ static int gem_mac_address_filter(CadenceGEMState *s, const uint8_t *packet)
+ {
+     uint8_t *gem_spaddr;
+-    int i;
++    int i, is_mc;
+     /* Promiscuous mode? */
+     if (s->regs[GEM_NWCFG] & GEM_NWCFG_PROMISC) {
+@@ -XXX,XX +XXX,XX @@ static int gem_mac_address_filter(CadenceGEMState *s, const uint8_t *packet)
+     }
+     /* Accept packets -w- hash match? */
+-    if ((packet[0] == 0x01 && (s->regs[GEM_NWCFG] & GEM_NWCFG_MCAST_HASH)) ||
+-        (packet[0] != 0x01 && (s->regs[GEM_NWCFG] & GEM_NWCFG_UCAST_HASH))) {
++    is_mc = is_multicast_ether_addr(packet);
++    if ((is_mc && (s->regs[GEM_NWCFG] & GEM_NWCFG_MCAST_HASH)) ||
++        (!is_mc && (s->regs[GEM_NWCFG] & GEM_NWCFG_UCAST_HASH))) {
++        uint64_t buckets;
+         unsigned hash_index;
+         hash_index = calc_mac_hash(packet);
+-        if (hash_index < 32) {
+-            if (s->regs[GEM_HASHLO] & (1<<hash_index)) {
+-                return packet[0] == 0x01 ? GEM_RX_MULTICAST_HASH_ACCEPT :
+-                                           GEM_RX_UNICAST_HASH_ACCEPT;
+-            }
+-        } else {
+-            hash_index -= 32;
+-            if (s->regs[GEM_HASHHI] & (1<<hash_index)) {
+-                return packet[0] == 0x01 ? GEM_RX_MULTICAST_HASH_ACCEPT :
+-                                           GEM_RX_UNICAST_HASH_ACCEPT;
+-            }
++        buckets = ((uint64_t)s->regs[GEM_HASHHI] << 32) | s->regs[GEM_HASHLO];
++        if ((buckets >> hash_index) & 1) {
++            return is_mc ? GEM_RX_MULTICAST_HASH_ACCEPT
++                         : GEM_RX_UNICAST_HASH_ACCEPT;
+         }
+     }
+@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
+     /* Is this destination MAC address "for us" ? */
+     maf = gem_mac_address_filter(s, buf);
+     if (maf == GEM_RX_REJECT) {
+-        return -1;
++        return size;  /* no, drop siliently b/c it's not an error */
+     }
+     /* Discard packets with receive length error enabled ? */
+--
+.5.0

-New patch
+[PULL V2 23/33] net: use peer when purging queue in qemu_flush_or_purge_queue_packets()
+The sender of packet will be checked in the qemu_net_queue_purge() but
+we use NetClientState not its peer when trying to purge the incoming
+queue in qemu_flush_or_purge_packets(). This will trigger the assert
+in virtio_net_reset since we can't pass the sender check:
+hw/net/virtio-net.c:533: void virtio_net_reset(VirtIODevice *): Assertion
+`!virtio_net_get_subqueue(nc)->async_tx.elem' failed.
+#9 0x55a33fa31b78 in virtio_net_reset hw/net/virtio-net.c:533:13
+#10 0x55a33fc88412 in virtio_reset hw/virtio/virtio.c:1919:9
+#11 0x55a341d82764 in virtio_bus_reset hw/virtio/virtio-bus.c:95:9
+#12 0x55a341dba2de in virtio_pci_reset hw/virtio/virtio-pci.c:1824:5
+#13 0x55a341db3e02 in virtio_pci_common_write hw/virtio/virtio-pci.c:1252:13
+#14 0x55a33f62117b in memory_region_write_accessor memory.c:496:5
+#15 0x55a33f6205e4 in access_with_adjusted_size memory.c:557:18
+#16 0x55a33f61e177 in memory_region_dispatch_write memory.c:1488:16
+Reproducer:
+https://www.mail-archive.com/qemu-devel@nongnu.org/msg701914.html
+Fix by using the peer.
+Reported-by: "Alexander Bulekov" <alxndr@bu.edu>
+Acked-by: Alexander Bulekov <alxndr@bu.edu>
+Fixes: ca77d85e1dbf9 ("net: complete all queued packets on VM stop")
+Cc: qemu-stable@nongnu.org
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ net/net.c | 2 +-
+file changed, 1 insertion(+), 1 deletion(-)
+diff --git a/net/net.c b/net/net.c
+index XXXXXXX..XXXXXXX 100644
+--- a/net/net.c
++++ b/net/net.c
+@@ -XXX,XX +XXX,XX @@ void qemu_flush_or_purge_queued_packets(NetClientState *nc, bool purge)
+         qemu_notify_event();
+     } else if (purge) {
+         /* Unable to empty the queue, purge remaining packets */
+-        qemu_net_queue_purge(nc->incoming_queue, nc);
++        qemu_net_queue_purge(nc->incoming_queue, nc->peer);
+     }
+ }
+--
+.5.0

-New patch
+[PULL V2 24/33] net/colo-compare.c: Create event_bh with the right AioContext
+From: Lukas Straub <lukasstraub2@web.de>
+qemu_bh_new will set the bh to be executed in the main
+loop. This causes crashes as colo_compare_handle_event assumes
+that it has exclusive access the queues, which are also
+concurrently accessed in the iothread.
+Create the bh with the AioContext of the iothread to fulfill
+these assumptions and fix the crashes. This is safe, because
+the bh already takes the appropriate locks.
+Signed-off-by: Lukas Straub <lukasstraub2@web.de>
+Reviewed-by: Zhang Chen <chen.zhang@intel.com>
+Reviewed-by: Derek Su <dereksu@qnap.com>
+Tested-by: Derek Su <dereksu@qnap.com>
+Signed-off-by: Zhang Chen <chen.zhang@intel.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ net/colo-compare.c | 3 ++-
+file changed, 2 insertions(+), 1 deletion(-)
+diff --git a/net/colo-compare.c b/net/colo-compare.c
+index XXXXXXX..XXXXXXX 100644
+--- a/net/colo-compare.c
++++ b/net/colo-compare.c
+@@ -XXX,XX +XXX,XX @@ static void colo_compare_handle_event(void *opaque)
+ static void colo_compare_iothread(CompareState *s)
+ {
++    AioContext *ctx = iothread_get_aio_context(s->iothread);
+     object_ref(OBJECT(s->iothread));
+     s->worker_context = iothread_get_g_main_context(s->iothread);
+@@ -XXX,XX +XXX,XX @@ static void colo_compare_iothread(CompareState *s)
+     }
+     colo_compare_timer_init(s);
+-    s->event_bh = qemu_bh_new(colo_compare_handle_event, s);
++    s->event_bh = aio_bh_new(ctx, colo_compare_handle_event, s);
+ }
+ static char *compare_get_pri_indev(Object *obj, Error **errp)
+--
+.5.0

-New patch
+[PULL V2 25/33] chardev/char.c: Use qemu_co_sleep_ns if in coroutine
+From: Lukas Straub <lukasstraub2@web.de>
+To be able to convert compare_chr_send to a coroutine in the
+next commit, use qemu_co_sleep_ns if in coroutine.
+Signed-off-by: Lukas Straub <lukasstraub2@web.de>
+Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
+Reviewed-by: Zhang Chen <chen.zhang@intel.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Signed-off-by: Zhang Chen <chen.zhang@intel.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ chardev/char.c | 7 ++++++-
+file changed, 6 insertions(+), 1 deletion(-)
+diff --git a/chardev/char.c b/chardev/char.c
+index XXXXXXX..XXXXXXX 100644
+--- a/chardev/char.c
++++ b/chardev/char.c
+@@ -XXX,XX +XXX,XX @@
+ #include "qemu/module.h"
+ #include "qemu/option.h"
+ #include "qemu/id.h"
++#include "qemu/coroutine.h"
+ #include "chardev/char-mux.h"
+@@ -XXX,XX +XXX,XX @@ static int qemu_chr_write_buffer(Chardev *s,
+     retry:
+         res = cc->chr_write(s, buf + *offset, len - *offset);
+         if (res < 0 && errno == EAGAIN && write_all) {
+-            g_usleep(100);
++            if (qemu_in_coroutine()) {
++                qemu_co_sleep_ns(QEMU_CLOCK_REALTIME, 100000);
++            } else {
++                g_usleep(100);
++            }
+             goto retry;
+         }
+--
+.5.0

-New patch
+[PULL V2 26/33] net/colo-compare.c: Fix deadlock in compare_chr_send
+From: Lukas Straub <lukasstraub2@web.de>
 The chr_out chardev is connected to a filter-redirector
 running in the main loop. qemu_chr_fe_write_all might block
 here in compare_chr_send if the (socket-)buffer is full.
 If another filter-redirector in the main loop want's to
 send data to chr_pri_in it might also block if the buffer
 is full. This leads to a deadlock because both event loops
 get blocked.
 Fix this by converting compare_chr_send to a coroutine and
 putting the packets in a send queue.
 Signed-off-by: Lukas Straub <lukasstraub2@web.de>
 Reviewed-by: Zhang Chen <chen.zhang@intel.com>
 Tested-by: Zhang Chen <chen.zhang@intel.com>
 Signed-off-by: Zhang Chen <chen.zhang@intel.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
  net/colo-compare.c | 193 ++++++++++++++++++++++++++++++++++++++++-------------
  net/colo.c         |   7 ++
  net/colo.h         |   1 +
 files changed, 156 insertions(+), 45 deletions(-)
 diff --git a/net/colo-compare.c b/net/colo-compare.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/colo-compare.c
 +++ b/net/colo-compare.c
@@ -XXX,XX +XXX,XX @@
  #include "migration/migration.h"
  #include "util.h"
 +#include "block/aio-wait.h"
 +#include "qemu/coroutine.h"
 +
  #define TYPE_COLO_COMPARE "colo-compare"
  #define COLO_COMPARE(obj) \
      OBJECT_CHECK(CompareState, (obj), TYPE_COLO_COMPARE)
@@ -XXX,XX +XXX,XX @@ static int event_unhandled_count;
   *                    |packet  |  |packet  +    |packet  | |packet  +
   *                    +--------+  +--------+    +--------+ +--------+
   */
 +
 +typedef struct SendCo {
 +    Coroutine *co;
 +    struct CompareState *s;
 +    CharBackend *chr;
 +    GQueue send_list;
 +    bool notify_remote_frame;
 +    bool done;
 +    int ret;
 +} SendCo;
 +
 +typedef struct SendEntry {
 +    uint32_t size;
 +    uint32_t vnet_hdr_len;
 +    uint8_t *buf;
 +} SendEntry;
 +
  typedef struct CompareState {
      Object parent;
@@ -XXX,XX +XXX,XX @@ typedef struct CompareState {
      SocketReadState pri_rs;
      SocketReadState sec_rs;
      SocketReadState notify_rs;
 +    SendCo out_sendco;
 +    SendCo notify_sendco;
      bool vnet_hdr;
      uint32_t compare_timeout;
      uint32_t expired_scan_cycle;
@@ -XXX,XX +XXX,XX @@ enum {
  static int compare_chr_send(CompareState *s,
 -                            const uint8_t *buf,
 +                            uint8_t *buf,
                              uint32_t size,
                              uint32_t vnet_hdr_len,
 -                            bool notify_remote_frame);
 +                            bool notify_remote_frame,
 +                            bool zero_copy);
  static bool packet_matches_str(const char *str,
                                 const uint8_t *buf,
@@ -XXX,XX +XXX,XX @@ static void notify_remote_frame(CompareState *s)
      char msg[] = "DO_CHECKPOINT";
      int ret = 0;
 -    ret = compare_chr_send(s, (uint8_t *)msg, strlen(msg), 0, true);
 +    ret = compare_chr_send(s, (uint8_t *)msg, strlen(msg), 0, true, false);
      if (ret < 0) {
          error_report("Notify Xen COLO-frame failed");
      }
@@ -XXX,XX +XXX,XX @@ static void colo_release_primary_pkt(CompareState *s, Packet *pkt)
                             pkt->data,
                             pkt->size,
                             pkt->vnet_hdr_len,
 -                           false);
 +                           false,
 +                           true);
      if (ret < 0) {
          error_report("colo send primary packet failed");
      }
      trace_colo_compare_main("packet same and release packet");
 -    packet_destroy(pkt, NULL);
 +    packet_destroy_partial(pkt, NULL);
  }
  /*
@@ -XXX,XX +XXX,XX @@ static void colo_compare_connection(void *opaque, void *user_data)
      }
  }
 -static int compare_chr_send(CompareState *s,
 -                            const uint8_t *buf,
 -                            uint32_t size,
 -                            uint32_t vnet_hdr_len,
 -                            bool notify_remote_frame)
 +static void coroutine_fn _compare_chr_send(void *opaque)
  {
 +    SendCo *sendco = opaque;
 +    CompareState *s = sendco->s;
      int ret = 0;
 -    uint32_t len = htonl(size);
 -    if (!size) {
 -        return 0;
 -    }
 +    while (!g_queue_is_empty(&sendco->send_list)) {
 +        SendEntry *entry = g_queue_pop_tail(&sendco->send_list);
 +        uint32_t len = htonl(entry->size);
 -    if (notify_remote_frame) {
 -        ret = qemu_chr_fe_write_all(&s->chr_notify_dev,
 -                                    (uint8_t *)&len,
 -                                    sizeof(len));
 -    } else {
 -        ret = qemu_chr_fe_write_all(&s->chr_out, (uint8_t *)&len, sizeof(len));
 -    }
 +        ret = qemu_chr_fe_write_all(sendco->chr, (uint8_t *)&len, sizeof(len));
 -    if (ret != sizeof(len)) {
 -        goto err;
 -    }
 +        if (ret != sizeof(len)) {
 +            g_free(entry->buf);
 +            g_slice_free(SendEntry, entry);
 +            goto err;
 +        }
 -    if (s->vnet_hdr) {
 -        /*
 -         * We send vnet header len make other module(like filter-redirector)
 -         * know how to parse net packet correctly.
 -         */
 -        len = htonl(vnet_hdr_len);
 +        if (!sendco->notify_remote_frame && s->vnet_hdr) {
 +            /*
 +             * We send vnet header len make other module(like filter-redirector)
 +             * know how to parse net packet correctly.
 +             */
 +            len = htonl(entry->vnet_hdr_len);
 -        if (!notify_remote_frame) {
 -            ret = qemu_chr_fe_write_all(&s->chr_out,
 +            ret = qemu_chr_fe_write_all(sendco->chr,
                                          (uint8_t *)&len,
                                          sizeof(len));
 +
 +            if (ret != sizeof(len)) {
 +                g_free(entry->buf);
 +                g_slice_free(SendEntry, entry);
 +                goto err;
 +            }
          }
 -        if (ret != sizeof(len)) {
 +        ret = qemu_chr_fe_write_all(sendco->chr,
 +                                    (uint8_t *)entry->buf,
 +                                    entry->size);
 +
 +        if (ret != entry->size) {
 +            g_free(entry->buf);
 +            g_slice_free(SendEntry, entry);
              goto err;
          }
 +
 +        g_free(entry->buf);
 +        g_slice_free(SendEntry, entry);
      }
 +    sendco->ret = 0;
 +    goto out;
 +
 +err:
 +    while (!g_queue_is_empty(&sendco->send_list)) {
 +        SendEntry *entry = g_queue_pop_tail(&sendco->send_list);
 +        g_free(entry->buf);
 +        g_slice_free(SendEntry, entry);
 +    }
 +    sendco->ret = ret < 0 ? ret : -EIO;
 +out:
 +    sendco->co = NULL;
 +    sendco->done = true;
 +    aio_wait_kick();
 +}
 +
 +static int compare_chr_send(CompareState *s,
 +                            uint8_t *buf,
 +                            uint32_t size,
 +                            uint32_t vnet_hdr_len,
 +                            bool notify_remote_frame,
 +                            bool zero_copy)
 +{
 +    SendCo *sendco;
 +    SendEntry *entry;
 +
      if (notify_remote_frame) {
 -        ret = qemu_chr_fe_write_all(&s->chr_notify_dev,
 -                                    (uint8_t *)buf,
 -                                    size);
 +        sendco = &s->notify_sendco;
      } else {
 -        ret = qemu_chr_fe_write_all(&s->chr_out, (uint8_t *)buf, size);
 +        sendco = &s->out_sendco;
      }
 -    if (ret != size) {
 -        goto err;
 +    if (!size) {
 +        return 0;
      }
 -    return 0;
 +    entry = g_slice_new(SendEntry);
 +    entry->size = size;
 +    entry->vnet_hdr_len = vnet_hdr_len;
 +    if (zero_copy) {
 +        entry->buf = buf;
 +    } else {
 +        entry->buf = g_malloc(size);
 +        memcpy(entry->buf, buf, size);
 +    }
 +    g_queue_push_head(&sendco->send_list, entry);
 +
 +    if (sendco->done) {
 +        sendco->co = qemu_coroutine_create(_compare_chr_send, sendco);
 +        sendco->done = false;
 +        qemu_coroutine_enter(sendco->co);
 +        if (sendco->done) {
 +            /* report early errors */
 +            return sendco->ret;
 +        }
 +    }
 -err:
 -    return ret < 0 ? ret : -EIO;
 +    /* assume success */
 +    return 0;
  }
  static int compare_chr_can_read(void *opaque)
@@ -XXX,XX +XXX,XX @@ static void compare_pri_rs_finalize(SocketReadState *pri_rs)
                           pri_rs->buf,
                           pri_rs->packet_len,
                           pri_rs->vnet_hdr_len,
 +                         false,
                           false);
      } else {
          /* compare packet in the specified connection */
@@ -XXX,XX +XXX,XX @@ static void compare_notify_rs_finalize(SocketReadState *notify_rs)
      if (packet_matches_str("COLO_USERSPACE_PROXY_INIT",
                             notify_rs->buf,
                             notify_rs->packet_len)) {
 -        ret = compare_chr_send(s, (uint8_t *)msg, strlen(msg), 0, true);
 +        ret = compare_chr_send(s, (uint8_t *)msg, strlen(msg), 0, true, false);
          if (ret < 0) {
              error_report("Notify Xen COLO-frame INIT failed");
          }
@@ -XXX,XX +XXX,XX @@ static void colo_compare_complete(UserCreatable *uc, Error **errp)
      QTAILQ_INSERT_TAIL(&net_compares, s, next);
 +    s->out_sendco.s = s;
 +    s->out_sendco.chr = &s->chr_out;
 +    s->out_sendco.notify_remote_frame = false;
 +    s->out_sendco.done = true;
 +    g_queue_init(&s->out_sendco.send_list);
 +
 +    if (s->notify_dev) {
 +        s->notify_sendco.s = s;
 +        s->notify_sendco.chr = &s->chr_notify_dev;
 +        s->notify_sendco.notify_remote_frame = true;
 +        s->notify_sendco.done = true;
 +        g_queue_init(&s->notify_sendco.send_list);
 +    }
 +
      g_queue_init(&s->conn_list);
      qemu_mutex_init(&event_mtx);
@@ -XXX,XX +XXX,XX @@ static void colo_flush_packets(void *opaque, void *user_data)
                           pkt->data,
                           pkt->size,
                           pkt->vnet_hdr_len,
 -                         false);
 -        packet_destroy(pkt, NULL);
 +                         false,
 +                         true);
 +        packet_destroy_partial(pkt, NULL);
      }
      while (!g_queue_is_empty(&conn->secondary_list)) {
          pkt = g_queue_pop_head(&conn->secondary_list);
@@ -XXX,XX +XXX,XX @@ static void colo_compare_finalize(Object *obj)
          }
      }
 +    AioContext *ctx = iothread_get_aio_context(s->iothread);
 +    aio_context_acquire(ctx);
 +    AIO_WAIT_WHILE(ctx, !s->out_sendco.done);
 +    if (s->notify_dev) {
 +        AIO_WAIT_WHILE(ctx, !s->notify_sendco.done);
 +    }
 +    aio_context_release(ctx);
 +
      /* Release all unhandled packets after compare thead exited */
      g_queue_foreach(&s->conn_list, colo_flush_packets, s);
 +    AIO_WAIT_WHILE(NULL, !s->out_sendco.done);
      g_queue_clear(&s->conn_list);
 +    g_queue_clear(&s->out_sendco.send_list);
 +    if (s->notify_dev) {
 +        g_queue_clear(&s->notify_sendco.send_list);
 +    }
      if (s->connection_track_table) {
          g_hash_table_destroy(s->connection_track_table);
 diff --git a/net/colo.c b/net/colo.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/colo.c
 +++ b/net/colo.c
@@ -XXX,XX +XXX,XX @@ void packet_destroy(void *opaque, void *user_data)
      g_slice_free(Packet, pkt);
  }
 +void packet_destroy_partial(void *opaque, void *user_data)
 +{
 +    Packet *pkt = opaque;
 +
 +    g_slice_free(Packet, pkt);
 +}
 +
  /*
   * Clear hashtable, stop this hash growing really huge
   */
 diff --git a/net/colo.h b/net/colo.h
 index XXXXXXX..XXXXXXX 100644
 --- a/net/colo.h
 +++ b/net/colo.h
@@ -XXX,XX +XXX,XX @@ bool connection_has_tracked(GHashTable *connection_track_table,
  void connection_hashtable_reset(GHashTable *connection_track_table);
  Packet *packet_new(const void *data, int size, int vnet_hdr_len);
  void packet_destroy(void *opaque, void *user_data);
 +void packet_destroy_partial(void *opaque, void *user_data);
  #endif /* NET_COLO_H */
 --
 .5.0

-New patch
+[PULL V2 27/33] net/colo-compare.c: Only hexdump packets if tracing is enabled
+From: Lukas Straub <lukasstraub2@web.de>
+Else the log will be flooded if there is a lot of network
+traffic.
+Signed-off-by: Lukas Straub <lukasstraub2@web.de>
+Reviewed-by: Zhang Chen <chen.zhang@intel.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Signed-off-by: Zhang Chen <chen.zhang@intel.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ net/colo-compare.c | 10 ++++++----
+file changed, 6 insertions(+), 4 deletions(-)
+diff --git a/net/colo-compare.c b/net/colo-compare.c
+index XXXXXXX..XXXXXXX 100644
+--- a/net/colo-compare.c
++++ b/net/colo-compare.c
+@@ -XXX,XX +XXX,XX @@ sec:
+         g_queue_push_head(&conn->primary_list, ppkt);
+         g_queue_push_head(&conn->secondary_list, spkt);
+-        qemu_hexdump((char *)ppkt->data, stderr,
+-                     "colo-compare ppkt", ppkt->size);
+-        qemu_hexdump((char *)spkt->data, stderr,
+-                     "colo-compare spkt", spkt->size);
++        if (trace_event_get_state_backends(TRACE_COLO_COMPARE_MISCOMPARE)) {
++            qemu_hexdump((char *)ppkt->data, stderr,
++                        "colo-compare ppkt", ppkt->size);
++            qemu_hexdump((char *)spkt->data, stderr,
++                        "colo-compare spkt", spkt->size);
++        }
+         colo_compare_inconsistency_notify(s);
+     }
+--
+.5.0

-[PULL 08/10] hw/net/imx_fec: return 0xffff when accessing non-existing PHY
+[PULL V2 28/33] net/colo-compare.c: Check that colo-compare is active
-From: Guenter Roeck <linux@roeck-us.net>
+From: Lukas Straub <lukasstraub2@web.de>
-If a PHY does not exist, attempts to read from it should return 0xffff.
+If the colo-compare object is removed before failover and a
-Otherwise the Linux kernel will believe that a PHY is there and select
+checkpoint happens, qemu crashes because it tries to lock
-the non-existing PHY. This in turn will result in network errors later
+the destroyed event_mtx in colo_notify_compares_event.
 on since the real PHY is not selected or configured.
-Since reading from or writing to a non-existing PHY is not an emulation
+Fix this by checking if everything is initialized by
-error, replace guest error messages with traces.
+introducing a new variable colo_compare_active which
 is protected by a new mutex colo_compare_mutex. The new mutex
 also protects against concurrent access of the net_compares
 list and makes sure that colo_notify_compares_event isn't
 active while we destroy event_mtx and event_complete_cond.
-Fixes: 461c51ad4275 ("Add a phy-num property to the i.MX FEC emulator")
+With this it also is again possible to use colo without
-Cc: Jean-Christophe Dubois <jcd@tribudubois.net>
+colo-compare (periodic mode) and to use multiple colo-compare
-Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
+for multiple network interfaces.
-Tested-by: Bin Meng <bmeng.cn@gmail.com>
-Reviewed-by: Philippe Mathieu-Daud茅 <f4bug@amsat.org>
+Signed-off-by: Lukas Straub <lukasstraub2@web.de>
-Signed-off-by: Guenter Roeck <linux@roeck-us.net>
+Tested-by: Lukas Straub <lukasstraub2@web.de>
 Reviewed-by: Zhang Chen <chen.zhang@intel.com>
 Signed-off-by: Zhang Chen <chen.zhang@intel.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- hw/net/imx_fec.c    | 8 +++-----
+ net/colo-compare.c | 35 +++++++++++++++++++++++++++++------
- hw/net/trace-events | 2 ++
+file changed, 29 insertions(+), 6 deletions(-)
 files changed, 5 insertions(+), 5 deletions(-)
-diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
+diff --git a/net/colo-compare.c b/net/colo-compare.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/imx_fec.c
+--- a/net/colo-compare.c
-+++ b/hw/net/imx_fec.c
++++ b/net/colo-compare.c
-@@ -XXX,XX +XXX,XX @@ static uint32_t imx_phy_read(IMXFECState *s, int reg)
+@@ -XXX,XX +XXX,XX @@ static NotifierList colo_compare_notifiers =
-     uint32_t phy = reg / 32;
+ #define REGULAR_PACKET_CHECK_MS 3000
+ #define DEFAULT_TIME_OUT_MS 3000
-     if (phy != s->phy_num) {
--        qemu_log_mask(LOG_GUEST_ERROR, "[%s.phy]%s: Bad phy num %u\n",
++static QemuMutex colo_compare_mutex;
--                      TYPE_IMX_FEC, __func__, phy);
++static bool colo_compare_active;
--        return 0;
+ static QemuMutex event_mtx;
-+        trace_imx_phy_read_num(phy, s->phy_num);
+ static QemuCond event_complete_cond;
-+        return 0xffff;
+ static int event_unhandled_count;
@@ -XXX,XX +XXX,XX @@ static void check_old_packet_regular(void *opaque)
  void colo_notify_compares_event(void *opaque, int event, Error **errp)
  {
      CompareState *s;
 +    qemu_mutex_lock(&colo_compare_mutex);
 +
 +    if (!colo_compare_active) {
 +        qemu_mutex_unlock(&colo_compare_mutex);
 +        return;
 +    }
      qemu_mutex_lock(&event_mtx);
      QTAILQ_FOREACH(s, &net_compares, next) {
@@ -XXX,XX +XXX,XX @@ void colo_notify_compares_event(void *opaque, int event, Error **errp)
      }
-     reg %= 32;
+     qemu_mutex_unlock(&event_mtx);
-@@ -XXX,XX +XXX,XX @@ static void imx_phy_write(IMXFECState *s, int reg, uint32_t val)
++    qemu_mutex_unlock(&colo_compare_mutex);
-     uint32_t phy = reg / 32;
+ }
-     if (phy != s->phy_num) {
+ static void colo_compare_timer_init(CompareState *s)
--        qemu_log_mask(LOG_GUEST_ERROR, "[%s.phy]%s: Bad phy num %u\n",
+@@ -XXX,XX +XXX,XX @@ static void colo_compare_complete(UserCreatable *uc, Error **errp)
--                      TYPE_IMX_FEC, __func__, phy);
+                            s->vnet_hdr);
 +        trace_imx_phy_write_num(phy, s->phy_num);
          return;
      }
-diff --git a/hw/net/trace-events b/hw/net/trace-events
++    qemu_mutex_lock(&colo_compare_mutex);
-index XXXXXXX..XXXXXXX 100644
++    if (!colo_compare_active) {
---- a/hw/net/trace-events
++        qemu_mutex_init(&event_mtx);
-+++ b/hw/net/trace-events
++        qemu_cond_init(&event_complete_cond);
-@@ -XXX,XX +XXX,XX @@ i82596_channel_attention(void *s) "%p: Received CHANNEL ATTENTION"
++        colo_compare_active = true;
++    }
- # imx_fec.c
+     QTAILQ_INSERT_TAIL(&net_compares, s, next);
- imx_phy_read(uint32_t val, int phy, int reg) "0x%04"PRIx32" <= phy[%d].reg[%d]"
++    qemu_mutex_unlock(&colo_compare_mutex);
-+imx_phy_read_num(int phy, int configured) "read request from unconfigured phy %d (configured %d)"
- imx_phy_write(uint32_t val, int phy, int reg) "0x%04"PRIx32" => phy[%d].reg[%d]"
+     s->out_sendco.s = s;
-+imx_phy_write_num(int phy, int configured) "write request to unconfigured phy %d (configured %d)"
+     s->out_sendco.chr = &s->chr_out;
- imx_phy_update_link(const char *s) "%s"
+@@ -XXX,XX +XXX,XX @@ static void colo_compare_complete(UserCreatable *uc, Error **errp)
- imx_phy_reset(void) ""
- imx_fec_read_bd(uint64_t addr, int flags, int len, int data) "tx_bd 0x%"PRIx64" flags 0x%04x len %d data 0x%08x"
+     g_queue_init(&s->conn_list);
 -    qemu_mutex_init(&event_mtx);
 -    qemu_cond_init(&event_complete_cond);
 -
      s->connection_track_table = g_hash_table_new_full(connection_key_hash,
                                                        connection_key_equal,
                                                        g_free,
@@ -XXX,XX +XXX,XX @@ static void colo_compare_finalize(Object *obj)
      qemu_bh_delete(s->event_bh);
 +    qemu_mutex_lock(&colo_compare_mutex);
      QTAILQ_FOREACH(tmp, &net_compares, next) {
          if (tmp == s) {
              QTAILQ_REMOVE(&net_compares, s, next);
              break;
          }
      }
 +    if (QTAILQ_EMPTY(&net_compares)) {
 +        colo_compare_active = false;
 +        qemu_mutex_destroy(&event_mtx);
 +        qemu_cond_destroy(&event_complete_cond);
 +    }
 +    qemu_mutex_unlock(&colo_compare_mutex);
      AioContext *ctx = iothread_get_aio_context(s->iothread);
      aio_context_acquire(ctx);
@@ -XXX,XX +XXX,XX @@ static void colo_compare_finalize(Object *obj)
          object_unref(OBJECT(s->iothread));
      }
 -    qemu_mutex_destroy(&event_mtx);
 -    qemu_cond_destroy(&event_complete_cond);
 -
      g_free(s->pri_indev);
      g_free(s->sec_indev);
      g_free(s->outdev);
      g_free(s->notify_dev);
  }
 +static void __attribute__((__constructor__)) colo_compare_init_globals(void)
 +{
 +    colo_compare_active = false;
 +    qemu_mutex_init(&colo_compare_mutex);
 +}
 +
  static const TypeInfo colo_compare_info = {
      .name = TYPE_COLO_COMPARE,
      .parent = TYPE_OBJECT,
 --
-.7.4
+.5.0

-New patch
+[PULL V2 29/33] net/colo-compare.c: Correct ordering in complete and finalize
+From: Lukas Straub <lukasstraub2@web.de>
+In colo_compare_complete, insert CompareState into net_compares
+only after everything has been initialized.
+In colo_compare_finalize, remove CompareState from net_compares
+before anything is deinitialized.
+Signed-off-by: Lukas Straub <lukasstraub2@web.de>
+Reviewed-by: Zhang Chen <chen.zhang@intel.com>
+Signed-off-by: Zhang Chen <chen.zhang@intel.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ net/colo-compare.c | 45 +++++++++++++++++++++++----------------------
+file changed, 23 insertions(+), 22 deletions(-)
+diff --git a/net/colo-compare.c b/net/colo-compare.c
+index XXXXXXX..XXXXXXX 100644
+--- a/net/colo-compare.c
++++ b/net/colo-compare.c
+@@ -XXX,XX +XXX,XX @@ static void colo_compare_complete(UserCreatable *uc, Error **errp)
+                            s->vnet_hdr);
+     }
+-    qemu_mutex_lock(&colo_compare_mutex);
+-    if (!colo_compare_active) {
+-        qemu_mutex_init(&event_mtx);
+-        qemu_cond_init(&event_complete_cond);
+-        colo_compare_active = true;
+-    }
+-    QTAILQ_INSERT_TAIL(&net_compares, s, next);
+-    qemu_mutex_unlock(&colo_compare_mutex);
+-
+     s->out_sendco.s = s;
+     s->out_sendco.chr = &s->chr_out;
+     s->out_sendco.notify_remote_frame = false;
+@@ -XXX,XX +XXX,XX @@ static void colo_compare_complete(UserCreatable *uc, Error **errp)
+                                                       connection_destroy);
+     colo_compare_iothread(s);
++
++    qemu_mutex_lock(&colo_compare_mutex);
++    if (!colo_compare_active) {
++        qemu_mutex_init(&event_mtx);
++        qemu_cond_init(&event_complete_cond);
++        colo_compare_active = true;
++    }
++    QTAILQ_INSERT_TAIL(&net_compares, s, next);
++    qemu_mutex_unlock(&colo_compare_mutex);
++
+     return;
+ }
+@@ -XXX,XX +XXX,XX @@ static void colo_compare_finalize(Object *obj)
+     CompareState *s = COLO_COMPARE(obj);
+     CompareState *tmp = NULL;
+-    qemu_chr_fe_deinit(&s->chr_pri_in, false);
+-    qemu_chr_fe_deinit(&s->chr_sec_in, false);
+-    qemu_chr_fe_deinit(&s->chr_out, false);
+-    if (s->notify_dev) {
+-        qemu_chr_fe_deinit(&s->chr_notify_dev, false);
+-    }
+-
+-    if (s->iothread) {
+-        colo_compare_timer_del(s);
+-    }
+-
+-    qemu_bh_delete(s->event_bh);
+-
+     qemu_mutex_lock(&colo_compare_mutex);
+     QTAILQ_FOREACH(tmp, &net_compares, next) {
+         if (tmp == s) {
+@@ -XXX,XX +XXX,XX @@ static void colo_compare_finalize(Object *obj)
+     }
+     qemu_mutex_unlock(&colo_compare_mutex);
++    qemu_chr_fe_deinit(&s->chr_pri_in, false);
++    qemu_chr_fe_deinit(&s->chr_sec_in, false);
++    qemu_chr_fe_deinit(&s->chr_out, false);
++    if (s->notify_dev) {
++        qemu_chr_fe_deinit(&s->chr_notify_dev, false);
++    }
++
++    if (s->iothread) {
++        colo_compare_timer_del(s);
++    }
++
++    qemu_bh_delete(s->event_bh);
++
+     AioContext *ctx = iothread_get_aio_context(s->iothread);
+     aio_context_acquire(ctx);
+     AIO_WAIT_WHILE(ctx, !s->out_sendco.done);
+--
+.5.0

-New patch
+[PULL V2 30/33] colo-compare: Fix memory leak in packet_enqueue()
+From: Derek Su <dereksu@qnap.com>
+The patch is to fix the "pkt" memory leak in packet_enqueue().
+The allocated "pkt" needs to be freed if the colo compare
+primary or secondary queue is too big.
+Replace the error_report of full queue with a trace event.
+Signed-off-by: Derek Su <dereksu@qnap.com>
+Reviewed-by: Zhang Chen <chen.zhang@intel.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Signed-off-by: Zhang Chen <chen.zhang@intel.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ net/colo-compare.c | 23 +++++++++++++++--------
+ net/trace-events   |  1 +
+files changed, 16 insertions(+), 8 deletions(-)
+diff --git a/net/colo-compare.c b/net/colo-compare.c
+index XXXXXXX..XXXXXXX 100644
+--- a/net/colo-compare.c
++++ b/net/colo-compare.c
+@@ -XXX,XX +XXX,XX @@ enum {
+     SECONDARY_IN,
+ };
++static const char *colo_mode[] = {
++    [PRIMARY_IN] = "primary",
++    [SECONDARY_IN] = "secondary",
++};
+ static int compare_chr_send(CompareState *s,
+                             uint8_t *buf,
+@@ -XXX,XX +XXX,XX @@ static int packet_enqueue(CompareState *s, int mode, Connection **con)
+     ConnectionKey key;
+     Packet *pkt = NULL;
+     Connection *conn;
++    int ret;
+     if (mode == PRIMARY_IN) {
+         pkt = packet_new(s->pri_rs.buf,
+@@ -XXX,XX +XXX,XX @@ static int packet_enqueue(CompareState *s, int mode, Connection **con)
+     }
+     if (mode == PRIMARY_IN) {
+-        if (!colo_insert_packet(&conn->primary_list, pkt, &conn->pack)) {
+-            error_report("colo compare primary queue size too big,"
+-                         "drop packet");
+-        }
++        ret = colo_insert_packet(&conn->primary_list, pkt, &conn->pack);
+     } else {
+-        if (!colo_insert_packet(&conn->secondary_list, pkt, &conn->sack)) {
+-            error_report("colo compare secondary queue size too big,"
+-                         "drop packet");
+-        }
++        ret = colo_insert_packet(&conn->secondary_list, pkt, &conn->sack);
+     }
++
++    if (!ret) {
++        trace_colo_compare_drop_packet(colo_mode[mode],
++            "queue size too big, drop packet");
++        packet_destroy(pkt, NULL);
++        pkt = NULL;
++    }
++
+     *con = conn;
+     return 0;
+diff --git a/net/trace-events b/net/trace-events
+index XXXXXXX..XXXXXXX 100644
+--- a/net/trace-events
++++ b/net/trace-events
+@@ -XXX,XX +XXX,XX @@ colo_proxy_main(const char *chr) ": %s"
+ # colo-compare.c
+ colo_compare_main(const char *chr) ": %s"
++colo_compare_drop_packet(const char *queue, const char *chr) ": %s: %s"
+ colo_compare_udp_miscompare(const char *sta, int size) ": %s = %d"
+ colo_compare_icmp_miscompare(const char *sta, int size) ": %s = %d"
+ colo_compare_ip_info(int psize, const char *sta, const char *stb, int ssize, const char *stc, const char *std) "ppkt size = %d, ip_src = %s, ip_dst = %s, spkt size = %d, ip_src = %s, ip_dst = %s"
+--
+.5.0

-[PULL 01/10] net/tap: Added TUNSETSTEERINGEBPF code.
+[PULL V2 31/33] hw/net/e1000e: Do not abort() on invalid PSRCTL register value
-From: Andrew Melnychenko <andrew@daynix.com>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Additional code that will be used for eBPF setting steering routine.
+libFuzzer found using 'qemu-system-i386 -M q35':
-Signed-off-by: Andrew Melnychenko <andrew@daynix.com>
+qemu: hardware error: e1000e: PSRCTL.BSIZE0 cannot be zero
 CPU #0:
 EAX=00000000 EBX=00000000 ECX=00000000 EDX=00000663
 ESI=00000000 EDI=00000000 EBP=00000000 ESP=00000000
 EIP=0000fff0 EFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
 ES =0000 00000000 0000ffff 00009300
 CS =f000 ffff0000 0000ffff 00009b00
 SS =0000 00000000 0000ffff 00009300
 DS =0000 00000000 0000ffff 00009300
 FS =0000 00000000 0000ffff 00009300
 GS =0000 00000000 0000ffff 00009300
 LDT=0000 00000000 0000ffff 00008200
 TR =0000 00000000 0000ffff 00008b00
 GDT=     00000000 0000ffff
 IDT=     00000000 0000ffff
 CR0=60000010 CR2=00000000 CR3=00000000 CR4=00000000
 DR0=00000000 DR1=00000000 DR2=00000000 DR3=00000000
 DR6=ffff0ff0 DR7=00000400
 EFER=0000000000000000
 FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
 FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
 FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
 FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
 FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
 XMM00=00000000000000000000000000000000 XMM01=00000000000000000000000000000000
 XMM02=00000000000000000000000000000000 XMM03=00000000000000000000000000000000
 XMM04=00000000000000000000000000000000 XMM05=00000000000000000000000000000000
 XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000
 ==1988== ERROR: libFuzzer: deadly signal
     #6 0x7fae4d3ea894 in __GI_abort (/lib64/libc.so.6+0x22894)
     #7 0x563f4cc59a1d in hw_error (qemu-fuzz-i386+0xe8ca1d)
     #8 0x563f4d7c93f2 in e1000e_set_psrctl (qemu-fuzz-i386+0x19fc3f2)
     #9 0x563f4d7b798f in e1000e_core_write (qemu-fuzz-i386+0x19ea98f)
     #10 0x563f4d7afc46 in e1000e_mmio_write (qemu-fuzz-i386+0x19e2c46)
     #11 0x563f4cc9a0a7 in memory_region_write_accessor (qemu-fuzz-i386+0xecd0a7)
     #12 0x563f4cc99c13 in access_with_adjusted_size (qemu-fuzz-i386+0xeccc13)
     #13 0x563f4cc987b4 in memory_region_dispatch_write (qemu-fuzz-i386+0xecb7b4)
 It simply sent the following 2 I/O command to the e1000e
 PCI BAR #2 I/O region:
   writew 0x0100 0x0c00 # RCTL =   E1000_RCTL_DTYP_MASK
   writeb 0x2170 0x00   # PSRCTL = 0
 static void
 e1000e_set_psrctl(E1000ECore *core, int index, uint32_t val)
 {
 if (core->mac[RCTL] & E1000_RCTL_DTYP_MASK) {
 if ((val & E1000_PSRCTL_BSIZE0_MASK) == 0) {
 hw_error("e1000e: PSRCTL.BSIZE0 cannot be zero");
 }
 Instead of calling hw_error() which abort the process (it is
 meant for CPU fatal error condition, not for device logging),
 log the invalid request with qemu_log_mask(LOG_GUEST_ERROR)
 and return, ignoring the request.
 Cc: qemu-stable@nongnu.org
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- net/tap-linux.h | 1 +
+ hw/net/e1000e_core.c | 10 +++++++---
-file changed, 1 insertion(+)
+file changed, 7 insertions(+), 3 deletions(-)
-diff --git a/net/tap-linux.h b/net/tap-linux.h
+diff --git a/hw/net/e1000e_core.c b/hw/net/e1000e_core.c
 index XXXXXXX..XXXXXXX 100644
---- a/net/tap-linux.h
+--- a/hw/net/e1000e_core.c
-+++ b/net/tap-linux.h
++++ b/hw/net/e1000e_core.c
 @@ -XXX,XX +XXX,XX @@
- #define TUNSETQUEUE  _IOW('T', 217, int)
+ */
- #define TUNSETVNETLE _IOW('T', 220, int)
- #define TUNSETVNETBE _IOW('T', 222, int)
+ #include "qemu/osdep.h"
-+#define TUNSETSTEERINGEBPF _IOR('T', 224, int)
++#include "qemu/log.h"
+ #include "net/net.h"
- #endif
+ #include "net/tap.h"
 -#include "hw/hw.h"
  #include "hw/pci/msi.h"
  #include "hw/pci/msix.h"
  #include "sysemu/runstate.h"
@@ -XXX,XX +XXX,XX @@ e1000e_set_psrctl(E1000ECore *core, int index, uint32_t val)
      if (core->mac[RCTL] & E1000_RCTL_DTYP_MASK) {
          if ((val & E1000_PSRCTL_BSIZE0_MASK) == 0) {
 -            hw_error("e1000e: PSRCTL.BSIZE0 cannot be zero");
 +            qemu_log_mask(LOG_GUEST_ERROR,
 +                          "e1000e: PSRCTL.BSIZE0 cannot be zero");
 +            return;
          }
          if ((val & E1000_PSRCTL_BSIZE1_MASK) == 0) {
 -            hw_error("e1000e: PSRCTL.BSIZE1 cannot be zero");
 +            qemu_log_mask(LOG_GUEST_ERROR,
 +                          "e1000e: PSRCTL.BSIZE1 cannot be zero");
 +            return;
          }
      }
 --
-.7.4
+.5.0

-[PULL 06/10] docs: Added eBPF documentation.
+[PULL V2 32/33] net: Drop the legacy "name" parameter from the -net option
-From: Andrew Melnychenko <andrew@daynix.com>
+From: Thomas Huth <thuth@redhat.com>
-Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
+It's been deprecated since QEMU v3.1, so it's time to finally
-Signed-off-by: Andrew Melnychenko <andrew@daynix.com>
+remove it. The "id" parameter can simply be used instead.
 Reviewed-by: Eric Blake <eblake@redhat.com>
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- docs/devel/ebpf_rss.rst | 125 ++++++++++++++++++++++++++++++++++++++++++++++++
+ docs/system/deprecated.rst | 15 +++++++++------
- docs/devel/index.rst    |   1 +
+ net/net.c                  | 10 +---------
-files changed, 126 insertions(+)
+ qapi/net.json              |  3 ---
- create mode 100644 docs/devel/ebpf_rss.rst
+files changed, 10 insertions(+), 18 deletions(-)
-diff --git a/docs/devel/ebpf_rss.rst b/docs/devel/ebpf_rss.rst
+diff --git a/docs/system/deprecated.rst b/docs/system/deprecated.rst
-new file mode 100644
+index XXXXXXX..XXXXXXX 100644
-index XXXXXXX..XXXXXXX
+--- a/docs/system/deprecated.rst
---- /dev/null
++++ b/docs/system/deprecated.rst
-+++ b/docs/devel/ebpf_rss.rst
+@@ -XXX,XX +XXX,XX @@ The 'file' driver for drives is no longer appropriate for character or host
  devices and will only accept regular files (S_IFREG). The correct driver
  for these file types is 'host_cdrom' or 'host_device' as appropriate.
 -``-net ...,name=``\ *name* (since 3.1)
 -''''''''''''''''''''''''''''''''''''''
 -
 -The ``name`` parameter of the ``-net`` option is a synonym
 -for the ``id`` parameter, which should now be used instead.
 -
  ``-smp`` (invalid topologies) (since 3.1)
  '''''''''''''''''''''''''''''''''''''''''
@@ -XXX,XX +XXX,XX @@ What follows is a record of recently removed, formerly deprecated
  features that serves as a record for users who have encountered
  trouble after a recent upgrade.
 +System emulator command line arguments
 +--------------------------------------
 +
 +``-net ...,name=``\ *name* (removed in 5.1)
 +'''''''''''''''''''''''''''''''''''''''''''
 +
 +The ``name`` parameter of the ``-net`` option was a synonym
 +for the ``id`` parameter, which should now be used instead.
 +
  QEMU Machine Protocol (QMP) commands
  ------------------------------------
 diff --git a/net/net.c b/net/net.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/net.c
 +++ b/net/net.c
@@ -XXX,XX +XXX,XX @@ static int net_client_init1(const void *object, bool is_netdev, Error **errp)
  {
      Netdev legacy = {0};
      const Netdev *netdev;
 -    const char *name;
      NetClientState *peer = NULL;
      if (is_netdev) {
          netdev = object;
 -        name = netdev->id;
          if (netdev->type == NET_CLIENT_DRIVER_NIC ||
              !net_client_init_fun[netdev->type]) {
@@ -XXX,XX +XXX,XX @@ static int net_client_init1(const void *object, bool is_netdev, Error **errp)
          const NetLegacyOptions *opts = net->opts;
          legacy.id = net->id;
          netdev = &legacy;
 -        /* missing optional values have been initialized to "all bits zero" */
 -        name = net->has_id ? net->id : net->name;
 -
 -        if (net->has_name) {
 -            warn_report("The 'name' parameter is deprecated, use 'id' instead");
 -        }
          /* Map the old options to the new flat type */
          switch (opts->type) {
@@ -XXX,XX +XXX,XX @@ static int net_client_init1(const void *object, bool is_netdev, Error **errp)
          }
      }
 -    if (net_client_init_fun[netdev->type](netdev, name, peer, errp) < 0) {
 +    if (net_client_init_fun[netdev->type](netdev, netdev->id, peer, errp) < 0) {
          /* FIXME drop when all init functions store an Error */
          if (errp && !*errp) {
              error_setg(errp, QERR_DEVICE_INIT_FAILED,
 diff --git a/qapi/net.json b/qapi/net.json
 index XXXXXXX..XXXXXXX 100644
 --- a/qapi/net.json
 +++ b/qapi/net.json
 @@ -XXX,XX +XXX,XX @@
-+===========================
+ #
-+eBPF RSS virtio-net support
+ # @id: identifier for monitor commands
-+===========================
+ #
-+
+-# @name: identifier for monitor commands, ignored if @id is present
-+RSS(Receive Side Scaling) is used to distribute network packets to guest virtqueues
+-#
-+by calculating packet hash. Usually every queue is processed then by a specific guest CPU core.
+ # @opts: device type specific properties (legacy)
-+
+ #
-+For now there are 2 RSS implementations in qemu:
+ # Since: 1.2
-+- 'in-qemu' RSS (functions if qemu receives network packets, i.e. vhost=off)
+@@ -XXX,XX +XXX,XX @@
-+- eBPF RSS (can function with also with vhost=on)
+ { 'struct': 'NetLegacy',
-+
+   'data': {
-+eBPF support (CONFIG_EBPF) is enabled by 'configure' script.
+     '*id':   'str',
-+To enable eBPF RSS support use './configure --enable-bpf'.
+-    '*name': 'str',
-+
+     'opts':  'NetLegacyOptions' } }
-+If steering BPF is not set for kernel's TUN module, the TUN uses automatic selection
-+of rx virtqueue based on lookup table built according to calculated symmetric hash
+ ##
 +of transmitted packets.
 +If steering BPF is set for TUN the BPF code calculates the hash of packet header and
 +returns the virtqueue number to place the packet to.
 +
 +Simplified decision formula:
 +
 +.. code:: C
 +
 +    queue_index = indirection_table[hash(<packet data>)%<indirection_table size>]
 +
 +
 +Not for all packets, the hash can/should be calculated.
 +
 +Note: currently, eBPF RSS does not support hash reporting.
 +
 +eBPF RSS turned on by different combinations of vhost-net, vitrio-net and tap configurations:
 +
 +- eBPF is used:
 +
 +        tap,vhost=off & virtio-net-pci,rss=on,hash=off
 +
 +- eBPF is used:
 +
 +        tap,vhost=on & virtio-net-pci,rss=on,hash=off
 +
 +- 'in-qemu' RSS is used:
 +
 +        tap,vhost=off & virtio-net-pci,rss=on,hash=on
 +
 +- eBPF is used, hash population feature is not reported to the guest:
 +
 +        tap,vhost=on & virtio-net-pci,rss=on,hash=on
 +
 +If CONFIG_EBPF is not set then only 'in-qemu' RSS is supported.
 +Also 'in-qemu' RSS, as a fallback, is used if the eBPF program failed to load or set to TUN.
 +
 +RSS eBPF program
 +----------------
 +
 +RSS program located in ebpf/rss.bpf.skeleton.h generated by bpftool.
 +So the program is part of the qemu binary.
 +Initially, the eBPF program was compiled by clang and source code located at tools/ebpf/rss.bpf.c.
 +Prerequisites to recompile the eBPF program (regenerate ebpf/rss.bpf.skeleton.h):
 +
 +        llvm, clang, kernel source tree, bpftool
 +        Adjust Makefile.ebpf to reflect the location of the kernel source tree
 +
 +        $ cd tools/ebpf
 +        $ make -f Makefile.ebpf
 +
 +Current eBPF RSS implementation uses 'bounded loops' with 'backward jump instructions' which present in the last kernels.
 +Overall eBPF RSS works on kernels 5.8+.
 +
 +eBPF RSS implementation
 +-----------------------
 +
 +eBPF RSS loading functionality located in ebpf/ebpf_rss.c and ebpf/ebpf_rss.h.
 +
 +The `struct EBPFRSSContext` structure that holds 4 file descriptors:
 +
 +- ctx - pointer of the libbpf context.
 +- program_fd - file descriptor of the eBPF RSS program.
 +- map_configuration - file descriptor of the 'configuration' map. This map contains one element of 'struct EBPFRSSConfig'. This configuration determines eBPF program behavior.
 +- map_toeplitz_key - file descriptor of the 'Toeplitz key' map. One element of the 40byte key prepared for the hashing algorithm.
 +- map_indirections_table - 128 elements of queue indexes.
 +
 +`struct EBPFRSSConfig` fields:
 +
 +- redirect - "boolean" value, should the hash be calculated, on false  - `default_queue` would be used as the final decision.
 +- populate_hash - for now, not used. eBPF RSS doesn't support hash reporting.
 +- hash_types - binary mask of different hash types. See `VIRTIO_NET_RSS_HASH_TYPE_*` defines. If for packet hash should not be calculated - `default_queue` would be used.
 +- indirections_len - length of the indirections table, maximum 128.
 +- default_queue - the queue index that used for packet that shouldn't be hashed. For some packets, the hash can't be calculated(g.e ARP).
 +
 +Functions:
 +
 +- `ebpf_rss_init()` - sets ctx to NULL, which indicates that EBPFRSSContext is not loaded.
 +- `ebpf_rss_load()` - creates 3 maps and loads eBPF program from the rss.bpf.skeleton.h. Returns 'true' on success. After that, program_fd can be used to set steering for TAP.
 +- `ebpf_rss_set_all()` - sets values for eBPF maps. `indirections_table` length is in EBPFRSSConfig. `toeplitz_key` is VIRTIO_NET_RSS_MAX_KEY_SIZE aka 40 bytes array.
 +- `ebpf_rss_unload()` - close all file descriptors and set ctx to NULL.
 +
 +Simplified eBPF RSS workflow:
 +
 +.. code:: C
 +
 +    struct EBPFRSSConfig config;
 +    config.redirect = 1;
 +    config.hash_types = VIRTIO_NET_RSS_HASH_TYPE_UDPv4 | VIRTIO_NET_RSS_HASH_TYPE_TCPv4;
 +    config.indirections_len = VIRTIO_NET_RSS_MAX_TABLE_LEN;
 +    config.default_queue = 0;
 +
 +    uint16_t table[VIRTIO_NET_RSS_MAX_TABLE_LEN] = {...};
 +    uint8_t key[VIRTIO_NET_RSS_MAX_KEY_SIZE] = {...};
 +
 +    struct EBPFRSSContext ctx;
 +    ebpf_rss_init(&ctx);
 +    ebpf_rss_load(&ctx);
 +    ebpf_rss_set_all(&ctx, &config, table, key);
 +    if (net_client->info->set_steering_ebpf != NULL) {
 +        net_client->info->set_steering_ebpf(net_client, ctx->program_fd);
 +    }
 +    ...
 +    ebpf_unload(&ctx);
 +
 +
 +NetClientState SetSteeringEBPF()
 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 +
 +For now, `set_steering_ebpf()` method supported by Linux TAP NetClientState. The method requires an eBPF program file descriptor as an argument.
 diff --git a/docs/devel/index.rst b/docs/devel/index.rst
 index XXXXXXX..XXXXXXX 100644
 --- a/docs/devel/index.rst
 +++ b/docs/devel/index.rst
@@ -XXX,XX +XXX,XX @@ Contents:
     qom
     block-coroutine-wrapper
     multi-process
 +   ebpf_rss
 --
-.7.4
+.5.0

-New patch
+[PULL V2 33/33] net: Drop the NetLegacy structure, always use Netdev instead
+From: Thomas Huth <thuth@redhat.com>
 Now that the "name" parameter is gone, there is hardly any difference
 between NetLegacy and Netdev anymore, so we can drop NetLegacy and always
 use Netdev to simplify the code quite a bit.
 The only two differences that were really left between Netdev and NetLegacy:
 ) NetLegacy does not allow a "hubport" type. We can continue to block
    this with a simple check in net_client_init1() for this type.
 ) The "id" parameter was optional in NetLegacy (and an internal id
    was chosen via assign_name() during initialization), but it is mandatory
    for Netdev. To avoid that the visitor code bails out here, we have to
    add an internal id to the QemuOpts already earlier now.
 Signed-off-by: Thomas Huth <thuth@redhat.com>
 Reviewed-by: Eric Blake <eblake@redhat.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
  net/net.c     | 77 ++++++++++-------------------------------------------------
  qapi/net.json | 46 -----------------------------------
 files changed, 13 insertions(+), 110 deletions(-)
 diff --git a/net/net.c b/net/net.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/net.c
 +++ b/net/net.c
@@ -XXX,XX +XXX,XX @@ static int (* const net_client_init_fun[NET_CLIENT_DRIVER__MAX])(
  };
 -static int net_client_init1(const void *object, bool is_netdev, Error **errp)
 +static int net_client_init1(const Netdev *netdev, bool is_netdev, Error **errp)
  {
 -    Netdev legacy = {0};
 -    const Netdev *netdev;
      NetClientState *peer = NULL;
      if (is_netdev) {
 -        netdev = object;
 -
          if (netdev->type == NET_CLIENT_DRIVER_NIC ||
              !net_client_init_fun[netdev->type]) {
              error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "type",
@@ -XXX,XX +XXX,XX @@ static int net_client_init1(const void *object, bool is_netdev, Error **errp)
              return -1;
          }
      } else {
 -        const NetLegacy *net = object;
 -        const NetLegacyOptions *opts = net->opts;
 -        legacy.id = net->id;
 -        netdev = &legacy;
 -
 -        /* Map the old options to the new flat type */
 -        switch (opts->type) {
 -        case NET_LEGACY_OPTIONS_TYPE_NONE:
 +        if (netdev->type == NET_CLIENT_DRIVER_NONE) {
              return 0; /* nothing to do */
 -        case NET_LEGACY_OPTIONS_TYPE_NIC:
 -            legacy.type = NET_CLIENT_DRIVER_NIC;
 -            legacy.u.nic = opts->u.nic;
 -            break;
 -        case NET_LEGACY_OPTIONS_TYPE_USER:
 -            legacy.type = NET_CLIENT_DRIVER_USER;
 -            legacy.u.user = opts->u.user;
 -            break;
 -        case NET_LEGACY_OPTIONS_TYPE_TAP:
 -            legacy.type = NET_CLIENT_DRIVER_TAP;
 -            legacy.u.tap = opts->u.tap;
 -            break;
 -        case NET_LEGACY_OPTIONS_TYPE_L2TPV3:
 -            legacy.type = NET_CLIENT_DRIVER_L2TPV3;
 -            legacy.u.l2tpv3 = opts->u.l2tpv3;
 -            break;
 -        case NET_LEGACY_OPTIONS_TYPE_SOCKET:
 -            legacy.type = NET_CLIENT_DRIVER_SOCKET;
 -            legacy.u.socket = opts->u.socket;
 -            break;
 -        case NET_LEGACY_OPTIONS_TYPE_VDE:
 -            legacy.type = NET_CLIENT_DRIVER_VDE;
 -            legacy.u.vde = opts->u.vde;
 -            break;
 -        case NET_LEGACY_OPTIONS_TYPE_BRIDGE:
 -            legacy.type = NET_CLIENT_DRIVER_BRIDGE;
 -            legacy.u.bridge = opts->u.bridge;
 -            break;
 -        case NET_LEGACY_OPTIONS_TYPE_NETMAP:
 -            legacy.type = NET_CLIENT_DRIVER_NETMAP;
 -            legacy.u.netmap = opts->u.netmap;
 -            break;
 -        case NET_LEGACY_OPTIONS_TYPE_VHOST_USER:
 -            legacy.type = NET_CLIENT_DRIVER_VHOST_USER;
 -            legacy.u.vhost_user = opts->u.vhost_user;
 -            break;
 -        default:
 -            abort();
          }
 -
 -        if (!net_client_init_fun[netdev->type]) {
 +        if (netdev->type == NET_CLIENT_DRIVER_HUBPORT ||
 +            !net_client_init_fun[netdev->type]) {
              error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "type",
                         "a net backend type (maybe it is not compiled "
                         "into this binary)");
@@ -XXX,XX +XXX,XX @@ static int net_client_init1(const void *object, bool is_netdev, Error **errp)
          /* Do not add to a hub if it's a nic with a netdev= parameter. */
          if (netdev->type != NET_CLIENT_DRIVER_NIC ||
 -            !opts->u.nic.has_netdev) {
 +            !netdev->u.nic.has_netdev) {
              peer = net_hub_add_port(0, NULL, NULL);
          }
      }
@@ -XXX,XX +XXX,XX @@ static void show_netdevs(void)
  static int net_client_init(QemuOpts *opts, bool is_netdev, Error **errp)
  {
      gchar **substrings = NULL;
 -    void *object = NULL;
 +    Netdev *object = NULL;
      Error *err = NULL;
      int ret = -1;
      Visitor *v = opts_visitor_new(opts);
@@ -XXX,XX +XXX,XX @@ static int net_client_init(QemuOpts *opts, bool is_netdev, Error **errp)
          }
      }
 -    if (is_netdev) {
 -        visit_type_Netdev(v, NULL, (Netdev **)&object, &err);
 -    } else {
 -        visit_type_NetLegacy(v, NULL, (NetLegacy **)&object, &err);
 +    /* Create an ID for -net if the user did not specify one */
 +    if (!is_netdev && !qemu_opts_id(opts)) {
 +        static int idx;
 +        qemu_opts_set_id(opts, g_strdup_printf("__org.qemu.net%i", idx++));
      }
 +    visit_type_Netdev(v, NULL, &object, &err);
 +
      if (!err) {
          ret = net_client_init1(object, is_netdev, &err);
      }
 -    if (is_netdev) {
 -        qapi_free_Netdev(object);
 -    } else {
 -        qapi_free_NetLegacy(object);
 -    }
 +    qapi_free_Netdev(object);
  out:
      error_propagate(errp, err);
 diff --git a/qapi/net.json b/qapi/net.json
 index XXXXXXX..XXXXXXX 100644
 --- a/qapi/net.json
 +++ b/qapi/net.json
@@ -XXX,XX +XXX,XX @@
      'vhost-user': 'NetdevVhostUserOptions' } }
  ##
 -# @NetLegacy:
 -#
 -# Captures the configuration of a network device; legacy.
 -#
 -# @id: identifier for monitor commands
 -#
 -# @opts: device type specific properties (legacy)
 -#
 -# Since: 1.2
 -##
 -{ 'struct': 'NetLegacy',
 -  'data': {
 -    '*id':   'str',
 -    'opts':  'NetLegacyOptions' } }
 -
 -##
 -# @NetLegacyOptionsType:
 -#
 -# Since: 1.2
 -##
 -{ 'enum': 'NetLegacyOptionsType',
 -  'data': ['none', 'nic', 'user', 'tap', 'l2tpv3', 'socket', 'vde',
 -           'bridge', 'netmap', 'vhost-user'] }
 -
 -##
 -# @NetLegacyOptions:
 -#
 -# Like Netdev, but for use only by the legacy command line options
 -#
 -# Since: 1.2
 -##
 -{ 'union': 'NetLegacyOptions',
 -  'base': { 'type': 'NetLegacyOptionsType' },
 -  'discriminator': 'type',
 -  'data': {
 -    'nic':      'NetLegacyNicOptions',
 -    'user':     'NetdevUserOptions',
 -    'tap':      'NetdevTapOptions',
 -    'l2tpv3':   'NetdevL2TPv3Options',
 -    'socket':   'NetdevSocketOptions',
 -    'vde':      'NetdevVdeOptions',
 -    'bridge':   'NetdevBridgeOptions',
 -    'netmap':   'NetdevNetmapOptions',
 -    'vhost-user': 'NetdevVhostUserOptions' } }
 -
 -##
  # @NetFilterDirection:
  #
  # Indicates whether a netfilter is attached to a netdev's transmit queue or
 --
 .5.0

The following changes since commit d90f154867ec0ec22fd719164b88716e8fd48672:

Merge remote-tracking branch 'remotes/dg-gitlab/tags/ppc-for-6.1-20210504' into staging (2021-05-05 20:29:14 +0100)

are available in the git repository at:

https://github.com/jasowang/qemu.git tags/net-pull-request

for you to fetch changes up to 2bdeb0c2564c36b218ac73e21d7a6f6accb49091:

tap-bsd: Remove special casing for older OpenBSD releases (2021-05-08 13:59:12 +0800)

----------------------------------------------------------------

----------------------------------------------------------------
Andrew Melnychenko (7):
      net/tap: Added TUNSETSTEERINGEBPF code.
      net: Added SetSteeringEBPF method for NetClientState.
      ebpf: Added eBPF RSS program.
      ebpf: Added eBPF RSS loader.
      virtio-net: Added eBPF RSS to virtio-net.
      docs: Added eBPF documentation.
      MAINTAINERS: Added eBPF maintainers information.

Brad Smith (1):
      tap-bsd: Remove special casing for older OpenBSD releases

Guenter Roeck (1):
      hw/net/imx_fec: return 0xffff when accessing non-existing PHY

Laurent Vivier (1):
      virtio-net: failover: add missing remove_migration_state_change_notifier()

From: Andrew Melnychenko <andrew@daynix.com>

For now, that method supported only by Linux TAP.
Linux TAP uses TUNSETSTEERINGEBPF ioctl.

diff --git a/include/net/net.h b/include/net/net.h
index XXXXXXX..XXXXXXX 100644
--- a/include/net/net.h
+++ b/include/net/net.h
@@ -XXX,XX +XXX,XX @@ typedef int (SetVnetBE)(NetClientState *, bool);
 typedef struct SocketReadState SocketReadState;
 typedef void (SocketReadStateFinalize)(SocketReadState *rs);
 typedef void (NetAnnounce)(NetClientState *);
+typedef bool (SetSteeringEBPF)(NetClientState *, int);
 
 typedef struct NetClientInfo {
     NetClientDriver type;
@@ -XXX,XX +XXX,XX @@ typedef struct NetClientInfo {
     SetVnetLE *set_vnet_le;
     SetVnetBE *set_vnet_be;
     NetAnnounce *announce;
+    SetSteeringEBPF *set_steering_ebpf;
 } NetClientInfo;
 
 struct NetClientState {
diff --git a/net/tap-bsd.c b/net/tap-bsd.c
index XXXXXXX..XXXXXXX 100644
--- a/net/tap-bsd.c
+++ b/net/tap-bsd.c
@@ -XXX,XX +XXX,XX @@ int tap_fd_get_ifname(int fd, char *ifname)
 {
     return -1;
 }
+
+int tap_fd_set_steering_ebpf(int fd, int prog_fd)
+{
+    return -1;
+}
diff --git a/net/tap-linux.c b/net/tap-linux.c
index XXXXXXX..XXXXXXX 100644
--- a/net/tap-linux.c
+++ b/net/tap-linux.c
@@ -XXX,XX +XXX,XX @@ int tap_fd_get_ifname(int fd, char *ifname)
     pstrcpy(ifname, sizeof(ifr.ifr_name), ifr.ifr_name);
     return 0;
 }
+
+int tap_fd_set_steering_ebpf(int fd, int prog_fd)
+{
+    if (ioctl(fd, TUNSETSTEERINGEBPF, (void *) &prog_fd) != 0) {
+        error_report("Issue while setting TUNSETSTEERINGEBPF:"
+                    " %s with fd: %d, prog_fd: %d",
+                    strerror(errno), fd, prog_fd);
+
+       return -1;
+    }
+
+    return 0;
+}
diff --git a/net/tap-solaris.c b/net/tap-solaris.c
index XXXXXXX..XXXXXXX 100644
--- a/net/tap-solaris.c
+++ b/net/tap-solaris.c
@@ -XXX,XX +XXX,XX @@ int tap_fd_get_ifname(int fd, char *ifname)
 {
     return -1;
 }
+
+int tap_fd_set_steering_ebpf(int fd, int prog_fd)
+{
+    return -1;
+}
diff --git a/net/tap-stub.c b/net/tap-stub.c
index XXXXXXX..XXXXXXX 100644
--- a/net/tap-stub.c
+++ b/net/tap-stub.c
@@ -XXX,XX +XXX,XX @@ int tap_fd_get_ifname(int fd, char *ifname)
 {
     return -1;
 }
+
+int tap_fd_set_steering_ebpf(int fd, int prog_fd)
+{
+    return -1;
+}
diff --git a/net/tap.c b/net/tap.c
index XXXXXXX..XXXXXXX 100644
--- a/net/tap.c
+++ b/net/tap.c
@@ -XXX,XX +XXX,XX @@ static void tap_poll(NetClientState *nc, bool enable)
     tap_write_poll(s, enable);
 }
 
+static bool tap_set_steering_ebpf(NetClientState *nc, int prog_fd)
+{
+    TAPState *s = DO_UPCAST(TAPState, nc, nc);
+    assert(nc->info->type == NET_CLIENT_DRIVER_TAP);
+
+    return tap_fd_set_steering_ebpf(s->fd, prog_fd) == 0;
+}
+
 int tap_get_fd(NetClientState *nc)
 {
     TAPState *s = DO_UPCAST(TAPState, nc, nc);
@@ -XXX,XX +XXX,XX @@ static NetClientInfo net_tap_info = {
     .set_vnet_hdr_len = tap_set_vnet_hdr_len,
     .set_vnet_le = tap_set_vnet_le,
     .set_vnet_be = tap_set_vnet_be,
+    .set_steering_ebpf = tap_set_steering_ebpf,
 };
 
 static TAPState *net_tap_fd_init(NetClientState *peer,
diff --git a/net/tap_int.h b/net/tap_int.h
index XXXXXXX..XXXXXXX 100644
--- a/net/tap_int.h
+++ b/net/tap_int.h
@@ -XXX,XX +XXX,XX @@ int tap_fd_set_vnet_be(int fd, int vnet_is_be);
 int tap_fd_enable(int fd);
 int tap_fd_disable(int fd);
 int tap_fd_get_ifname(int fd, char *ifname);
+int tap_fd_set_steering_ebpf(int fd, int prog_fd);
 
 #endif /* NET_TAP_INT_H */
-- 
2.7.4

From: Andrew Melnychenko <andrew@daynix.com>

RSS program and Makefile to build it.
The bpftool used to generate '.h' file.
The data in that file may be loaded by libbpf.
EBPF compilation is not required for building qemu.
You can use Makefile if you need to regenerate rss.bpf.skeleton.h.

Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
Signed-off-by: Andrew Melnychenko <andrew@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 tools/ebpf/Makefile.ebpf |  21 ++
 tools/ebpf/rss.bpf.c     | 569 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 590 insertions(+)
 create mode 100755 tools/ebpf/Makefile.ebpf
 create mode 100644 tools/ebpf/rss.bpf.c

diff --git a/tools/ebpf/Makefile.ebpf b/tools/ebpf/Makefile.ebpf
new file mode 100755
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tools/ebpf/Makefile.ebpf
@@ -XXX,XX +XXX,XX @@
+OBJS = rss.bpf.o
+
+LLC ?= llc
+CLANG ?= clang
+INC_FLAGS = `$(CLANG) -print-file-name=include`
+EXTRA_CFLAGS ?= -O2 -emit-llvm -fno-stack-protector
+
+all: $(OBJS)
+
+.PHONY: clean
+
+clean:
+	rm -f $(OBJS)
+
+$(OBJS):  %.o:%.c
+	$(CLANG) $(INC_FLAGS) \
+                -D__KERNEL__ -D__ASM_SYSREG_H \
+                -I../include $(LINUXINCLUDE) \
+                $(EXTRA_CFLAGS) -c $< -o -| $(LLC) -march=bpf -filetype=obj -o $@
+	bpftool gen skeleton rss.bpf.o > rss.bpf.skeleton.h
+	cp rss.bpf.skeleton.h ../../ebpf/
diff --git a/tools/ebpf/rss.bpf.c b/tools/ebpf/rss.bpf.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tools/ebpf/rss.bpf.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * eBPF RSS program
+ *
+ * Developed by Daynix Computing LTD (http://www.daynix.com)
+ *
+ * Authors:
+ *  Andrew Melnychenko <andrew@daynix.com>
+ *  Yuri Benditovich <yuri.benditovich@daynix.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.  See
+ * the COPYING file in the top-level directory.
+ *
+ * Prepare:
+ * Requires llvm, clang, bpftool, linux kernel tree
+ *
+ * Build rss.bpf.skeleton.h:
+ * make -f Makefile.ebpf clean all
+ */
+
+#include <stddef.h>
+#include <stdbool.h>
+#include <linux/bpf.h>
+
+#include <linux/in.h>
+#include <linux/if_ether.h>
+#include <linux/ip.h>
+#include <linux/ipv6.h>
+
+#include <linux/udp.h>
+#include <linux/tcp.h>
+
+#include <bpf/bpf_helpers.h>
+#include <bpf/bpf_endian.h>
+#include <linux/virtio_net.h>
+
+#define INDIRECTION_TABLE_SIZE 128
+#define HASH_CALCULATION_BUFFER_SIZE 36
+
+struct rss_config_t {
+    __u8 redirect;
+    __u8 populate_hash;
+    __u32 hash_types;
+    __u16 indirections_len;
+    __u16 default_queue;
+} __attribute__((packed));
+
+struct toeplitz_key_data_t {
+    __u32 leftmost_32_bits;
+    __u8 next_byte[HASH_CALCULATION_BUFFER_SIZE];
+};
+
+struct packet_hash_info_t {
+    __u8 is_ipv4;
+    __u8 is_ipv6;
+    __u8 is_udp;
+    __u8 is_tcp;
+    __u8 is_ipv6_ext_src;
+    __u8 is_ipv6_ext_dst;
+    __u8 is_fragmented;
+
+    __u16 src_port;
+    __u16 dst_port;
+
+    union {
+        struct {
+            __be32 in_src;
+            __be32 in_dst;
+        };
+
+        struct {
+            struct in6_addr in6_src;
+            struct in6_addr in6_dst;
+            struct in6_addr in6_ext_src;
+            struct in6_addr in6_ext_dst;
+        };
+    };
+};
+
+struct bpf_map_def SEC("maps")
+tap_rss_map_configurations = {
+        .type        = BPF_MAP_TYPE_ARRAY,
+        .key_size    = sizeof(__u32),
+        .value_size  = sizeof(struct rss_config_t),
+        .max_entries = 1,
+};
+
+struct bpf_map_def SEC("maps")
+tap_rss_map_toeplitz_key = {
+        .type        = BPF_MAP_TYPE_ARRAY,
+        .key_size    = sizeof(__u32),
+        .value_size  = sizeof(struct toeplitz_key_data_t),
+        .max_entries = 1,
+};
+
+struct bpf_map_def SEC("maps")
+tap_rss_map_indirection_table = {
+        .type        = BPF_MAP_TYPE_ARRAY,
+        .key_size    = sizeof(__u32),
+        .value_size  = sizeof(__u16),
+        .max_entries = INDIRECTION_TABLE_SIZE,
+};
+
+static inline void net_rx_rss_add_chunk(__u8 *rss_input, size_t *bytes_written,
+                                        const void *ptr, size_t size) {
+    __builtin_memcpy(&rss_input[*bytes_written], ptr, size);
+    *bytes_written += size;
+}
+
+static inline
+void net_toeplitz_add(__u32 *result,
+                      __u8 *input,
+                      __u32 len
+        , struct toeplitz_key_data_t *key) {
+
+    __u32 accumulator = *result;
+    __u32 leftmost_32_bits = key->leftmost_32_bits;
+    __u32 byte;
+
+    for (byte = 0; byte < HASH_CALCULATION_BUFFER_SIZE; byte++) {
+        __u8 input_byte = input[byte];
+        __u8 key_byte = key->next_byte[byte];
+        __u8 bit;
+
+        for (bit = 0; bit < 8; bit++) {
+            if (input_byte & (1 << 7)) {
+                accumulator ^= leftmost_32_bits;
+            }
+
+            leftmost_32_bits =
+                    (leftmost_32_bits << 1) | ((key_byte & (1 << 7)) >> 7);
+
+            input_byte <<= 1;
+            key_byte <<= 1;
+        }
+    }
+
+    *result = accumulator;
+}
+
+
+static inline int ip6_extension_header_type(__u8 hdr_type)
+{
+    switch (hdr_type) {
+    case IPPROTO_HOPOPTS:
+    case IPPROTO_ROUTING:
+    case IPPROTO_FRAGMENT:
+    case IPPROTO_ICMPV6:
+    case IPPROTO_NONE:
+    case IPPROTO_DSTOPTS:
+    case IPPROTO_MH:
+        return 1;
+    default:
+        return 0;
+    }
+}
+/*
+ * According to https://www.iana.org/assignments/ipv6-parameters/ipv6-parameters.xhtml
+ * we suspect that there are would be no more than 11 extensions in IPv6 header,
+ * also there is 27 TLV options for Destination and Hop-by-hop extensions.
+ * Need to choose reasonable amount of maximum extensions/options we may check to find
+ * ext src/dst.
+ */
+#define IP6_EXTENSIONS_COUNT 11
+#define IP6_OPTIONS_COUNT 30
+
+static inline int parse_ipv6_ext(struct __sk_buff *skb,
+        struct packet_hash_info_t *info,
+        __u8 *l4_protocol, size_t *l4_offset)
+{
+    int err = 0;
+
+    if (!ip6_extension_header_type(*l4_protocol)) {
+        return 0;
+    }
+
+    struct ipv6_opt_hdr ext_hdr = {};
+
+    for (unsigned int i = 0; i < IP6_EXTENSIONS_COUNT; ++i) {
+
+        err = bpf_skb_load_bytes_relative(skb, *l4_offset, &ext_hdr,
+                                    sizeof(ext_hdr), BPF_HDR_START_NET);
+        if (err) {
+            goto error;
+        }
+
+        if (*l4_protocol == IPPROTO_ROUTING) {
+            struct ipv6_rt_hdr ext_rt = {};
+
+            err = bpf_skb_load_bytes_relative(skb, *l4_offset, &ext_rt,
+                                        sizeof(ext_rt), BPF_HDR_START_NET);
+            if (err) {
+                goto error;
+            }
+
+            if ((ext_rt.type == IPV6_SRCRT_TYPE_2) &&
+                    (ext_rt.hdrlen == sizeof(struct in6_addr) / 8) &&
+                    (ext_rt.segments_left == 1)) {
+
+                err = bpf_skb_load_bytes_relative(skb,
+                    *l4_offset + offsetof(struct rt2_hdr, addr),
+                    &info->in6_ext_dst, sizeof(info->in6_ext_dst),
+                    BPF_HDR_START_NET);
+                if (err) {
+                    goto error;
+                }
+
+                info->is_ipv6_ext_dst = 1;
+            }
+
+        } else if (*l4_protocol == IPPROTO_DSTOPTS) {
+            struct ipv6_opt_t {
+                __u8 type;
+                __u8 length;
+            } __attribute__((packed)) opt = {};
+
+            size_t opt_offset = sizeof(ext_hdr);
+
+            for (unsigned int j = 0; j < IP6_OPTIONS_COUNT; ++j) {
+                err = bpf_skb_load_bytes_relative(skb, *l4_offset + opt_offset,
+                                        &opt, sizeof(opt), BPF_HDR_START_NET);
+                if (err) {
+                    goto error;
+                }
+
+                if (opt.type == IPV6_TLV_HAO) {
+                    err = bpf_skb_load_bytes_relative(skb,
+                        *l4_offset + opt_offset + offsetof(struct ipv6_destopt_hao, addr),
+                        &info->in6_ext_src, sizeof(info->in6_ext_src),
+                        BPF_HDR_START_NET);
+                    if (err) {
+                        goto error;
+                    }
+
+                    info->is_ipv6_ext_src = 1;
+                    break;
+                }
+
+                opt_offset += (opt.type == IPV6_TLV_PAD1) ?
+                              1 : opt.length + sizeof(opt);
+
+                if (opt_offset + 1 >= ext_hdr.hdrlen * 8) {
+                    break;
+                }
+            }
+        } else if (*l4_protocol == IPPROTO_FRAGMENT) {
+            info->is_fragmented = true;
+        }
+
+        *l4_protocol = ext_hdr.nexthdr;
+        *l4_offset += (ext_hdr.hdrlen + 1) * 8;
+
+        if (!ip6_extension_header_type(ext_hdr.nexthdr)) {
+            return 0;
+        }
+    }
+
+    return 0;
+error:
+    return err;
+}
+
+static __be16 parse_eth_type(struct __sk_buff *skb)
+{
+    unsigned int offset = 12;
+    __be16 ret = 0;
+    int err = 0;
+
+    err = bpf_skb_load_bytes_relative(skb, offset, &ret, sizeof(ret),
+                                BPF_HDR_START_MAC);
+    if (err) {
+        return 0;
+    }
+
+    switch (bpf_ntohs(ret)) {
+    case ETH_P_8021AD:
+        offset += 4;
+    case ETH_P_8021Q:
+        offset += 4;
+        err = bpf_skb_load_bytes_relative(skb, offset, &ret, sizeof(ret),
+                                    BPF_HDR_START_MAC);
+    default:
+        break;
+    }
+
+    if (err) {
+        return 0;
+    }
+
+    return ret;
+}
+
+static inline int parse_packet(struct __sk_buff *skb,
+        struct packet_hash_info_t *info)
+{
+    int err = 0;
+
+    if (!info || !skb) {
+        return -1;
+    }
+
+    size_t l4_offset = 0;
+    __u8 l4_protocol = 0;
+    __u16 l3_protocol = bpf_ntohs(parse_eth_type(skb));
+    if (l3_protocol == 0) {
+        err = -1;
+        goto error;
+    }
+
+    if (l3_protocol == ETH_P_IP) {
+        info->is_ipv4 = 1;
+
+        struct iphdr ip = {};
+        err = bpf_skb_load_bytes_relative(skb, 0, &ip, sizeof(ip),
+                                    BPF_HDR_START_NET);
+        if (err) {
+            goto error;
+        }
+
+        info->in_src = ip.saddr;
+        info->in_dst = ip.daddr;
+        info->is_fragmented = !!ip.frag_off;
+
+        l4_protocol = ip.protocol;
+        l4_offset = ip.ihl * 4;
+    } else if (l3_protocol == ETH_P_IPV6) {
+        info->is_ipv6 = 1;
+
+        struct ipv6hdr ip6 = {};
+        err = bpf_skb_load_bytes_relative(skb, 0, &ip6, sizeof(ip6),
+                                    BPF_HDR_START_NET);
+        if (err) {
+            goto error;
+        }
+
+        info->in6_src = ip6.saddr;
+        info->in6_dst = ip6.daddr;
+
+        l4_protocol = ip6.nexthdr;
+        l4_offset = sizeof(ip6);
+
+        err = parse_ipv6_ext(skb, info, &l4_protocol, &l4_offset);
+        if (err) {
+            goto error;
+        }
+    }
+
+    if (l4_protocol != 0 && !info->is_fragmented) {
+        if (l4_protocol == IPPROTO_TCP) {
+            info->is_tcp = 1;
+
+            struct tcphdr tcp = {};
+            err = bpf_skb_load_bytes_relative(skb, l4_offset, &tcp, sizeof(tcp),
+                                        BPF_HDR_START_NET);
+            if (err) {
+                goto error;
+            }
+
+            info->src_port = tcp.source;
+            info->dst_port = tcp.dest;
+        } else if (l4_protocol == IPPROTO_UDP) { /* TODO: add udplite? */
+            info->is_udp = 1;
+
+            struct udphdr udp = {};
+            err = bpf_skb_load_bytes_relative(skb, l4_offset, &udp, sizeof(udp),
+                                        BPF_HDR_START_NET);
+            if (err) {
+                goto error;
+            }
+
+            info->src_port = udp.source;
+            info->dst_port = udp.dest;
+        }
+    }
+
+    return 0;
+
+error:
+    return err;
+}
+
+static inline __u32 calculate_rss_hash(struct __sk_buff *skb,
+        struct rss_config_t *config, struct toeplitz_key_data_t *toe)
+{
+    __u8 rss_input[HASH_CALCULATION_BUFFER_SIZE] = {};
+    size_t bytes_written = 0;
+    __u32 result = 0;
+    int err = 0;
+    struct packet_hash_info_t packet_info = {};
+
+    err = parse_packet(skb, &packet_info);
+    if (err) {
+        return 0;
+    }
+
+    if (packet_info.is_ipv4) {
+        if (packet_info.is_tcp &&
+            config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_TCPv4) {
+
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.in_src,
+                                 sizeof(packet_info.in_src));
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.in_dst,
+                                 sizeof(packet_info.in_dst));
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.src_port,
+                                 sizeof(packet_info.src_port));
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.dst_port,
+                                 sizeof(packet_info.dst_port));
+        } else if (packet_info.is_udp &&
+                   config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_UDPv4) {
+
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.in_src,
+                                 sizeof(packet_info.in_src));
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.in_dst,
+                                 sizeof(packet_info.in_dst));
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.src_port,
+                                 sizeof(packet_info.src_port));
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.dst_port,
+                                 sizeof(packet_info.dst_port));
+        } else if (config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_IPv4) {
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.in_src,
+                                 sizeof(packet_info.in_src));
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.in_dst,
+                                 sizeof(packet_info.in_dst));
+        }
+    } else if (packet_info.is_ipv6) {
+        if (packet_info.is_tcp &&
+            config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_TCPv6) {
+
+            if (packet_info.is_ipv6_ext_src &&
+                config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_TCP_EX) {
+
+                net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                     &packet_info.in6_ext_src,
+                                     sizeof(packet_info.in6_ext_src));
+            } else {
+                net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                     &packet_info.in6_src,
+                                     sizeof(packet_info.in6_src));
+            }
+            if (packet_info.is_ipv6_ext_dst &&
+                config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_TCP_EX) {
+
+                net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                     &packet_info.in6_ext_dst,
+                                     sizeof(packet_info.in6_ext_dst));
+            } else {
+                net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                     &packet_info.in6_dst,
+                                     sizeof(packet_info.in6_dst));
+            }
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.src_port,
+                                 sizeof(packet_info.src_port));
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.dst_port,
+                                 sizeof(packet_info.dst_port));
+        } else if (packet_info.is_udp &&
+                   config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_UDPv6) {
+
+            if (packet_info.is_ipv6_ext_src &&
+               config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_UDP_EX) {
+
+                net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                     &packet_info.in6_ext_src,
+                                     sizeof(packet_info.in6_ext_src));
+            } else {
+                net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                     &packet_info.in6_src,
+                                     sizeof(packet_info.in6_src));
+            }
+            if (packet_info.is_ipv6_ext_dst &&
+               config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_UDP_EX) {
+
+                net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                     &packet_info.in6_ext_dst,
+                                     sizeof(packet_info.in6_ext_dst));
+            } else {
+                net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                     &packet_info.in6_dst,
+                                     sizeof(packet_info.in6_dst));
+            }
+
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.src_port,
+                                 sizeof(packet_info.src_port));
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.dst_port,
+                                 sizeof(packet_info.dst_port));
+
+        } else if (config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_IPv6) {
+            if (packet_info.is_ipv6_ext_src &&
+               config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_IP_EX) {
+
+                net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                     &packet_info.in6_ext_src,
+                                     sizeof(packet_info.in6_ext_src));
+            } else {
+                net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                     &packet_info.in6_src,
+                                     sizeof(packet_info.in6_src));
+            }
+            if (packet_info.is_ipv6_ext_dst &&
+                config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_IP_EX) {
+
+                net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                     &packet_info.in6_ext_dst,
+                                     sizeof(packet_info.in6_ext_dst));
+            } else {
+                net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                     &packet_info.in6_dst,
+                                     sizeof(packet_info.in6_dst));
+            }
+        }
+    }
+
+    if (bytes_written) {
+        net_toeplitz_add(&result, rss_input, bytes_written, toe);
+    }
+
+    return result;
+}
+
+SEC("tun_rss_steering")
+int tun_rss_steering_prog(struct __sk_buff *skb)
+{
+
+    struct rss_config_t *config;
+    struct toeplitz_key_data_t *toe;
+
+    __u32 key = 0;
+    __u32 hash = 0;
+
+    config = bpf_map_lookup_elem(&tap_rss_map_configurations, &key);
+    toe = bpf_map_lookup_elem(&tap_rss_map_toeplitz_key, &key);
+
+    if (config && toe) {
+        if (!config->redirect) {
+            return config->default_queue;
+        }
+
+        hash = calculate_rss_hash(skb, config, toe);
+        if (hash) {
+            __u32 table_idx = hash % config->indirections_len;
+            __u16 *queue = 0;
+
+            queue = bpf_map_lookup_elem(&tap_rss_map_indirection_table,
+                                        &table_idx);
+
+            if (queue) {
+                return *queue;
+            }
+        }
+
+        return config->default_queue;
+    }
+
+    return -1;
+}
+
+char _license[] SEC("license") = "GPL v2";
-- 
2.7.4

From: Andrew Melnychenko <andrew@daynix.com>

Added function that loads RSS eBPF program.
Added stub functions for RSS eBPF loader.
Added meson and configuration options.

By default, eBPF feature enabled if libbpf is present in the build system.
libbpf checked in configuration shell script and meson script.

Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
Signed-off-by: Andrew Melnychenko <andrew@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 configure               |   8 +-
 ebpf/ebpf_rss-stub.c    |  40 +++++
 ebpf/ebpf_rss.c         | 165 ++++++++++++++++++
 ebpf/ebpf_rss.h         |  44 +++++
 ebpf/meson.build        |   1 +
 ebpf/rss.bpf.skeleton.h | 431 ++++++++++++++++++++++++++++++++++++++++++++++++
 ebpf/trace-events       |   4 +
 ebpf/trace.h            |   1 +
 meson.build             |  23 +++
 meson_options.txt       |   2 +
 10 files changed, 718 insertions(+), 1 deletion(-)
 create mode 100644 ebpf/ebpf_rss-stub.c
 create mode 100644 ebpf/ebpf_rss.c
 create mode 100644 ebpf/ebpf_rss.h
 create mode 100644 ebpf/meson.build
 create mode 100644 ebpf/rss.bpf.skeleton.h
 create mode 100644 ebpf/trace-events
 create mode 100644 ebpf/trace.h

diff --git a/configure b/configure
index XXXXXXX..XXXXXXX 100755
--- a/configure
+++ b/configure
@@ -XXX,XX +XXX,XX @@ vhost_vsock="$default_feature"
 vhost_user="no"
 vhost_user_blk_server="auto"
 vhost_user_fs="$default_feature"
+bpf="auto"
 kvm="auto"
 hax="auto"
 hvf="auto"
@@ -XXX,XX +XXX,XX @@ for opt do
   ;;
   --enable-membarrier) membarrier="yes"
   ;;
+  --disable-bpf) bpf="disabled"
+  ;;
+  --enable-bpf) bpf="enabled"
+  ;;
   --disable-blobs) blobs="false"
   ;;
   --with-pkgversion=*) pkgversion="$optarg"
@@ -XXX,XX +XXX,XX @@ disabled with --disable-FEATURE, default is enabled if available
   vhost-user      vhost-user backend support
   vhost-user-blk-server    vhost-user-blk server support
   vhost-vdpa      vhost-vdpa kernel backend support
+  bpf             BPF kernel support
   spice           spice
   rbd             rados block device (rbd)
   libiscsi        iscsi support
@@ -XXX,XX +XXX,XX @@ NINJA=$ninja $meson setup \
         -Dattr=$attr -Ddefault_devices=$default_devices \
         -Ddocs=$docs -Dsphinx_build=$sphinx_build -Dinstall_blobs=$blobs \
         -Dvhost_user_blk_server=$vhost_user_blk_server -Dmultiprocess=$multiprocess \
-        -Dfuse=$fuse -Dfuse_lseek=$fuse_lseek -Dguest_agent_msi=$guest_agent_msi \
+        -Dfuse=$fuse -Dfuse_lseek=$fuse_lseek -Dguest_agent_msi=$guest_agent_msi -Dbpf=$bpf\
         $(if test "$default_features" = no; then echo "-Dauto_features=disabled"; fi) \
 	-Dtcg_interpreter=$tcg_interpreter \
         $cross_arg \
diff --git a/ebpf/ebpf_rss-stub.c b/ebpf/ebpf_rss-stub.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/ebpf/ebpf_rss-stub.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * eBPF RSS stub file
+ *
+ * Developed by Daynix Computing LTD (http://www.daynix.com)
+ *
+ * Authors:
+ *  Yuri Benditovich <yuri.benditovich@daynix.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.  See
+ * the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "ebpf/ebpf_rss.h"
+
+void ebpf_rss_init(struct EBPFRSSContext *ctx)
+{
+
+}
+
+bool ebpf_rss_is_loaded(struct EBPFRSSContext *ctx)
+{
+    return false;
+}
+
+bool ebpf_rss_load(struct EBPFRSSContext *ctx)
+{
+    return false;
+}
+
+bool ebpf_rss_set_all(struct EBPFRSSContext *ctx, struct EBPFRSSConfig *config,
+                      uint16_t *indirections_table, uint8_t *toeplitz_key)
+{
+    return false;
+}
+
+void ebpf_rss_unload(struct EBPFRSSContext *ctx)
+{
+
+}
diff --git a/ebpf/ebpf_rss.c b/ebpf/ebpf_rss.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/ebpf/ebpf_rss.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * eBPF RSS loader
+ *
+ * Developed by Daynix Computing LTD (http://www.daynix.com)
+ *
+ * Authors:
+ *  Andrew Melnychenko <andrew@daynix.com>
+ *  Yuri Benditovich <yuri.benditovich@daynix.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.  See
+ * the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/error-report.h"
+
+#include <bpf/libbpf.h>
+#include <bpf/bpf.h>
+
+#include "hw/virtio/virtio-net.h" /* VIRTIO_NET_RSS_MAX_TABLE_LEN */
+
+#include "ebpf/ebpf_rss.h"
+#include "ebpf/rss.bpf.skeleton.h"
+#include "trace.h"
+
+void ebpf_rss_init(struct EBPFRSSContext *ctx)
+{
+    if (ctx != NULL) {
+        ctx->obj = NULL;
+    }
+}
+
+bool ebpf_rss_is_loaded(struct EBPFRSSContext *ctx)
+{
+    return ctx != NULL && ctx->obj != NULL;
+}
+
+bool ebpf_rss_load(struct EBPFRSSContext *ctx)
+{
+    struct rss_bpf *rss_bpf_ctx;
+
+    if (ctx == NULL) {
+        return false;
+    }
+
+    rss_bpf_ctx = rss_bpf__open();
+    if (rss_bpf_ctx == NULL) {
+        trace_ebpf_error("eBPF RSS", "can not open eBPF RSS object");
+        goto error;
+    }
+
+    bpf_program__set_socket_filter(rss_bpf_ctx->progs.tun_rss_steering_prog);
+
+    if (rss_bpf__load(rss_bpf_ctx)) {
+        trace_ebpf_error("eBPF RSS", "can not load RSS program");
+        goto error;
+    }
+
+    ctx->obj = rss_bpf_ctx;
+    ctx->program_fd = bpf_program__fd(
+            rss_bpf_ctx->progs.tun_rss_steering_prog);
+    ctx->map_configuration = bpf_map__fd(
+            rss_bpf_ctx->maps.tap_rss_map_configurations);
+    ctx->map_indirections_table = bpf_map__fd(
+            rss_bpf_ctx->maps.tap_rss_map_indirection_table);
+    ctx->map_toeplitz_key = bpf_map__fd(
+            rss_bpf_ctx->maps.tap_rss_map_toeplitz_key);
+
+    return true;
+error:
+    rss_bpf__destroy(rss_bpf_ctx);
+    ctx->obj = NULL;
+
+    return false;
+}
+
+static bool ebpf_rss_set_config(struct EBPFRSSContext *ctx,
+                                struct EBPFRSSConfig *config)
+{
+    uint32_t map_key = 0;
+
+    if (!ebpf_rss_is_loaded(ctx)) {
+        return false;
+    }
+    if (bpf_map_update_elem(ctx->map_configuration,
+                            &map_key, config, 0) < 0) {
+        return false;
+    }
+    return true;
+}
+
+static bool ebpf_rss_set_indirections_table(struct EBPFRSSContext *ctx,
+                                            uint16_t *indirections_table,
+                                            size_t len)
+{
+    uint32_t i = 0;
+
+    if (!ebpf_rss_is_loaded(ctx) || indirections_table == NULL ||
+       len > VIRTIO_NET_RSS_MAX_TABLE_LEN) {
+        return false;
+    }
+
+    for (; i < len; ++i) {
+        if (bpf_map_update_elem(ctx->map_indirections_table, &i,
+                                indirections_table + i, 0) < 0) {
+            return false;
+        }
+    }
+    return true;
+}
+
+static bool ebpf_rss_set_toepliz_key(struct EBPFRSSContext *ctx,
+                                     uint8_t *toeplitz_key)
+{
+    uint32_t map_key = 0;
+
+    /* prepare toeplitz key */
+    uint8_t toe[VIRTIO_NET_RSS_MAX_KEY_SIZE] = {};
+
+    if (!ebpf_rss_is_loaded(ctx) || toeplitz_key == NULL) {
+        return false;
+    }
+    memcpy(toe, toeplitz_key, VIRTIO_NET_RSS_MAX_KEY_SIZE);
+    *(uint32_t *)toe = ntohl(*(uint32_t *)toe);
+
+    if (bpf_map_update_elem(ctx->map_toeplitz_key, &map_key, toe,
+                            0) < 0) {
+        return false;
+    }
+    return true;
+}
+
+bool ebpf_rss_set_all(struct EBPFRSSContext *ctx, struct EBPFRSSConfig *config,
+                      uint16_t *indirections_table, uint8_t *toeplitz_key)
+{
+    if (!ebpf_rss_is_loaded(ctx) || config == NULL ||
+        indirections_table == NULL || toeplitz_key == NULL) {
+        return false;
+    }
+
+    if (!ebpf_rss_set_config(ctx, config)) {
+        return false;
+    }
+
+    if (!ebpf_rss_set_indirections_table(ctx, indirections_table,
+                                      config->indirections_len)) {
+        return false;
+    }
+
+    if (!ebpf_rss_set_toepliz_key(ctx, toeplitz_key)) {
+        return false;
+    }
+
+    return true;
+}
+
+void ebpf_rss_unload(struct EBPFRSSContext *ctx)
+{
+    if (!ebpf_rss_is_loaded(ctx)) {
+        return;
+    }
+
+    rss_bpf__destroy(ctx->obj);
+    ctx->obj = NULL;
+}
diff --git a/ebpf/ebpf_rss.h b/ebpf/ebpf_rss.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/ebpf/ebpf_rss.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * eBPF RSS header
+ *
+ * Developed by Daynix Computing LTD (http://www.daynix.com)
+ *
+ * Authors:
+ *  Andrew Melnychenko <andrew@daynix.com>
+ *  Yuri Benditovich <yuri.benditovich@daynix.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.  See
+ * the COPYING file in the top-level directory.
+ */
+
+#ifndef QEMU_EBPF_RSS_H
+#define QEMU_EBPF_RSS_H
+
+struct EBPFRSSContext {
+    void *obj;
+    int program_fd;
+    int map_configuration;
+    int map_toeplitz_key;
+    int map_indirections_table;
+};
+
+struct EBPFRSSConfig {
+    uint8_t redirect;
+    uint8_t populate_hash;
+    uint32_t hash_types;
+    uint16_t indirections_len;
+    uint16_t default_queue;
+} __attribute__((packed));
+
+void ebpf_rss_init(struct EBPFRSSContext *ctx);
+
+bool ebpf_rss_is_loaded(struct EBPFRSSContext *ctx);
+
+bool ebpf_rss_load(struct EBPFRSSContext *ctx);
+
+bool ebpf_rss_set_all(struct EBPFRSSContext *ctx, struct EBPFRSSConfig *config,
+                      uint16_t *indirections_table, uint8_t *toeplitz_key);
+
+void ebpf_rss_unload(struct EBPFRSSContext *ctx);
+
+#endif /* QEMU_EBPF_RSS_H */
diff --git a/ebpf/meson.build b/ebpf/meson.build
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/ebpf/meson.build
@@ -0,0 +1 @@
+common_ss.add(when: libbpf, if_true: files('ebpf_rss.c'), if_false: files('ebpf_rss-stub.c'))
diff --git a/ebpf/rss.bpf.skeleton.h b/ebpf/rss.bpf.skeleton.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/ebpf/rss.bpf.skeleton.h
@@ -XXX,XX +XXX,XX @@
+/* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */
+
+/* THIS FILE IS AUTOGENERATED! */
+#ifndef __RSS_BPF_SKEL_H__
+#define __RSS_BPF_SKEL_H__
+
+#include <stdlib.h>
+#include <bpf/libbpf.h>
+
+struct rss_bpf {
+	struct bpf_object_skeleton *skeleton;
+	struct bpf_object *obj;
+	struct {
+		struct bpf_map *tap_rss_map_configurations;
+		struct bpf_map *tap_rss_map_indirection_table;
+		struct bpf_map *tap_rss_map_toeplitz_key;
+	} maps;
+	struct {
+		struct bpf_program *tun_rss_steering_prog;
+	} progs;
+	struct {
+		struct bpf_link *tun_rss_steering_prog;
+	} links;
+};
+
+static void
+rss_bpf__destroy(struct rss_bpf *obj)
+{
+	if (!obj)
+		return;
+	if (obj->skeleton)
+		bpf_object__destroy_skeleton(obj->skeleton);
+	free(obj);
+}
+
+static inline int
+rss_bpf__create_skeleton(struct rss_bpf *obj);
+
+static inline struct rss_bpf *
+rss_bpf__open_opts(const struct bpf_object_open_opts *opts)
+{
+	struct rss_bpf *obj;
+
+	obj = (struct rss_bpf *)calloc(1, sizeof(*obj));
+	if (!obj)
+		return NULL;
+	if (rss_bpf__create_skeleton(obj))
+		goto err;
+	if (bpf_object__open_skeleton(obj->skeleton, opts))
+		goto err;
+
+	return obj;
+err:
+	rss_bpf__destroy(obj);
+	return NULL;
+}
+
+static inline struct rss_bpf *
+rss_bpf__open(void)
+{
+	return rss_bpf__open_opts(NULL);
+}
+
+static inline int
+rss_bpf__load(struct rss_bpf *obj)
+{
+	return bpf_object__load_skeleton(obj->skeleton);
+}
+
+static inline struct rss_bpf *
+rss_bpf__open_and_load(void)
+{
+	struct rss_bpf *obj;
+
+	obj = rss_bpf__open();
+	if (!obj)
+		return NULL;
+	if (rss_bpf__load(obj)) {
+		rss_bpf__destroy(obj);
+		return NULL;
+	}
+	return obj;
+}
+
+static inline int
+rss_bpf__attach(struct rss_bpf *obj)
+{
+	return bpf_object__attach_skeleton(obj->skeleton);
+}
+
+static inline void
+rss_bpf__detach(struct rss_bpf *obj)
+{
+	return bpf_object__detach_skeleton(obj->skeleton);
+}
+
+static inline int
+rss_bpf__create_skeleton(struct rss_bpf *obj)
+{
+	struct bpf_object_skeleton *s;
+
+	s = (struct bpf_object_skeleton *)calloc(1, sizeof(*s));
+	if (!s)
+		return -1;
+	obj->skeleton = s;
+
+	s->sz = sizeof(*s);
+	s->name = "rss_bpf";
+	s->obj = &obj->obj;
+
+	/* maps */
+	s->map_cnt = 3;
+	s->map_skel_sz = sizeof(*s->maps);
+	s->maps = (struct bpf_map_skeleton *)calloc(s->map_cnt, s->map_skel_sz);
+	if (!s->maps)
+		goto err;
+
+	s->maps[0].name = "tap_rss_map_configurations";
+	s->maps[0].map = &obj->maps.tap_rss_map_configurations;
+
+	s->maps[1].name = "tap_rss_map_indirection_table";
+	s->maps[1].map = &obj->maps.tap_rss_map_indirection_table;
+
+	s->maps[2].name = "tap_rss_map_toeplitz_key";
+	s->maps[2].map = &obj->maps.tap_rss_map_toeplitz_key;
+
+	/* programs */
+	s->prog_cnt = 1;
+	s->prog_skel_sz = sizeof(*s->progs);
+	s->progs = (struct bpf_prog_skeleton *)calloc(s->prog_cnt, s->prog_skel_sz);
+	if (!s->progs)
+		goto err;
+
+	s->progs[0].name = "tun_rss_steering_prog";
+	s->progs[0].prog = &obj->progs.tun_rss_steering_prog;
+	s->progs[0].link = &obj->links.tun_rss_steering_prog;
+
+	s->data_sz = 8088;
+	s->data = (void *)"\
+\x7f\x45\x4c\x46\x02\x01\x01\0\0\0\0\0\0\0\0\0\x01\0\xf7\0\x01\0\0\0\0\0\0\0\0\
+\0\0\0\0\0\0\0\0\0\0\0\x18\x1d\0\0\0\0\0\0\0\0\0\0\x40\0\0\0\0\0\x40\0\x0a\0\
+\x01\0\xbf\x18\0\0\0\0\0\0\xb7\x01\0\0\0\0\0\0\x63\x1a\x4c\xff\0\0\0\0\xbf\xa7\
+\0\0\0\0\0\0\x07\x07\0\0\x4c\xff\xff\xff\x18\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
+\xbf\x72\0\0\0\0\0\0\x85\0\0\0\x01\0\0\0\xbf\x06\0\0\0\0\0\0\x18\x01\0\0\0\0\0\
+\0\0\0\0\0\0\0\0\0\xbf\x72\0\0\0\0\0\0\x85\0\0\0\x01\0\0\0\xbf\x07\0\0\0\0\0\0\
+\x18\0\0\0\xff\xff\xff\xff\0\0\0\0\0\0\0\0\x15\x06\x66\x02\0\0\0\0\xbf\x79\0\0\
+\0\0\0\0\x15\x09\x64\x02\0\0\0\0\x71\x61\0\0\0\0\0\0\x55\x01\x01\0\0\0\0\0\x05\
+\0\x5d\x02\0\0\0\0\xb7\x01\0\0\0\0\0\0\x63\x1a\xc0\xff\0\0\0\0\x7b\x1a\xb8\xff\
+\0\0\0\0\x7b\x1a\xb0\xff\0\0\0\0\x7b\x1a\xa8\xff\0\0\0\0\x7b\x1a\xa0\xff\0\0\0\
+\0\x63\x1a\x98\xff\0\0\0\0\x7b\x1a\x90\xff\0\0\0\0\x7b\x1a\x88\xff\0\0\0\0\x7b\
+\x1a\x80\xff\0\0\0\0\x7b\x1a\x78\xff\0\0\0\0\x7b\x1a\x70\xff\0\0\0\0\x7b\x1a\
+\x68\xff\0\0\0\0\x7b\x1a\x60\xff\0\0\0\0\x7b\x1a\x58\xff\0\0\0\0\x7b\x1a\x50\
+\xff\0\0\0\0\x15\x08\x4c\x02\0\0\0\0\x6b\x1a\xd0\xff\0\0\0\0\xbf\xa3\0\0\0\0\0\
+\0\x07\x03\0\0\xd0\xff\xff\xff\xbf\x81\0\0\0\0\0\0\xb7\x02\0\0\x0c\0\0\0\xb7\
+\x04\0\0\x02\0\0\0\xb7\x05\0\0\0\0\0\0\x85\0\0\0\x44\0\0\0\x67\0\0\0\x20\0\0\0\
+\x77\0\0\0\x20\0\0\0\x55\0\x11\0\0\0\0\0\xb7\x02\0\0\x10\0\0\0\x69\xa1\xd0\xff\
+\0\0\0\0\xbf\x13\0\0\0\0\0\0\xdc\x03\0\0\x10\0\0\0\x15\x03\x02\0\0\x81\0\0\x55\
+\x03\x0c\0\xa8\x88\0\0\xb7\x02\0\0\x14\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\
+\xd0\xff\xff\xff\xbf\x81\0\0\0\0\0\0\xb7\x04\0\0\x02\0\0\0\xb7\x05\0\0\0\0\0\0\
+\x85\0\0\0\x44\0\0\0\x69\xa1\xd0\xff\0\0\0\0\x67\0\0\0\x20\0\0\0\x77\0\0\0\x20\
+\0\0\0\x15\0\x01\0\0\0\0\0\x05\0\x2f\x02\0\0\0\0\x15\x01\x2e\x02\0\0\0\0\x7b\
+\x9a\x30\xff\0\0\0\0\x15\x01\x57\0\x86\xdd\0\0\x55\x01\x3b\0\x08\0\0\0\x7b\x7a\
+\x20\xff\0\0\0\0\xb7\x07\0\0\x01\0\0\0\x73\x7a\x50\xff\0\0\0\0\xb7\x01\0\0\0\0\
+\0\0\x63\x1a\xe0\xff\0\0\0\0\x7b\x1a\xd8\xff\0\0\0\0\x7b\x1a\xd0\xff\0\0\0\0\
+\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\xd0\xff\xff\xff\xbf\x81\0\0\0\0\0\0\xb7\x02\0\
+\0\0\0\0\0\xb7\x04\0\0\x14\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\0\0\0\x67\
+\0\0\0\x20\0\0\0\x77\0\0\0\x20\0\0\0\x55\0\x1a\x02\0\0\0\0\x69\xa1\xd6\xff\0\0\
+\0\0\x55\x01\x01\0\0\0\0\0\xb7\x07\0\0\0\0\0\0\x61\xa1\xdc\xff\0\0\0\0\x63\x1a\
+\x5c\xff\0\0\0\0\x61\xa1\xe0\xff\0\0\0\0\x63\x1a\x60\xff\0\0\0\0\x73\x7a\x56\
+\xff\0\0\0\0\x71\xa9\xd9\xff\0\0\0\0\x71\xa1\xd0\xff\0\0\0\0\x67\x01\0\0\x02\0\
+\0\0\x57\x01\0\0\x3c\0\0\0\x7b\x1a\x40\xff\0\0\0\0\x79\xa7\x20\xff\0\0\0\0\xbf\
+\x91\0\0\0\0\0\0\x57\x01\0\0\xff\0\0\0\x15\x01\x19\0\0\0\0\0\x71\xa1\x56\xff\0\
+\0\0\0\x55\x01\x17\0\0\0\0\0\x57\x09\0\0\xff\0\0\0\x15\x09\x7a\x01\x11\0\0\0\
+\x55\x09\x14\0\x06\0\0\0\xb7\x01\0\0\x01\0\0\0\x73\x1a\x53\xff\0\0\0\0\xb7\x01\
+\0\0\0\0\0\0\x63\x1a\xe0\xff\0\0\0\0\x7b\x1a\xd8\xff\0\0\0\0\x7b\x1a\xd0\xff\0\
+\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\xd0\xff\xff\xff\xbf\x81\0\0\0\0\0\0\x79\
+\xa2\x40\xff\0\0\0\0\xb7\x04\0\0\x14\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\
+\0\0\0\x67\0\0\0\x20\0\0\0\x77\0\0\0\x20\0\0\0\x55\0\xf4\x01\0\0\0\0\x69\xa1\
+\xd0\xff\0\0\0\0\x6b\x1a\x58\xff\0\0\0\0\x69\xa1\xd2\xff\0\0\0\0\x6b\x1a\x5a\
+\xff\0\0\0\0\x71\xa1\x50\xff\0\0\0\0\x15\x01\xd4\0\0\0\0\0\x71\x62\x03\0\0\0\0\
+\0\x67\x02\0\0\x08\0\0\0\x71\x61\x02\0\0\0\0\0\x4f\x12\0\0\0\0\0\0\x71\x63\x04\
+\0\0\0\0\0\x71\x61\x05\0\0\0\0\0\x67\x01\0\0\x08\0\0\0\x4f\x31\0\0\0\0\0\0\x67\
+\x01\0\0\x10\0\0\0\x4f\x21\0\0\0\0\0\0\x71\xa2\x53\xff\0\0\0\0\x79\xa0\x30\xff\
+\0\0\0\0\x15\x02\x06\x01\0\0\0\0\xbf\x12\0\0\0\0\0\0\x57\x02\0\0\x02\0\0\0\x15\
+\x02\x03\x01\0\0\0\0\x61\xa1\x5c\xff\0\0\0\0\x63\x1a\xa0\xff\0\0\0\0\x61\xa1\
+\x60\xff\0\0\0\0\x63\x1a\xa4\xff\0\0\0\0\x69\xa1\x58\xff\0\0\0\0\x6b\x1a\xa8\
+\xff\0\0\0\0\x69\xa1\x5a\xff\0\0\0\0\x6b\x1a\xaa\xff\0\0\0\0\x05\0\x65\x01\0\0\
+\0\0\xb7\x01\0\0\x01\0\0\0\x73\x1a\x51\xff\0\0\0\0\xb7\x01\0\0\0\0\0\0\x7b\x1a\
+\xf0\xff\0\0\0\0\x7b\x1a\xe8\xff\0\0\0\0\x7b\x1a\xe0\xff\0\0\0\0\x7b\x1a\xd8\
+\xff\0\0\0\0\x7b\x1a\xd0\xff\0\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\xd0\xff\
+\xff\xff\xb7\x01\0\0\x28\0\0\0\x7b\x1a\x40\xff\0\0\0\0\xbf\x81\0\0\0\0\0\0\xb7\
+\x02\0\0\0\0\0\0\xb7\x04\0\0\x28\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\0\0\
+\0\x67\0\0\0\x20\0\0\0\x77\0\0\0\x20\0\0\0\x55\0\x10\x01\0\0\0\0\x79\xa1\xe0\
+\xff\0\0\0\0\x63\x1a\x64\xff\0\0\0\0\x77\x01\0\0\x20\0\0\0\x63\x1a\x68\xff\0\0\
+\0\0\x79\xa1\xd8\xff\0\0\0\0\x63\x1a\x5c\xff\0\0\0\0\x77\x01\0\0\x20\0\0\0\x63\
+\x1a\x60\xff\0\0\0\0\x79\xa1\xe8\xff\0\0\0\0\x63\x1a\x6c\xff\0\0\0\0\x77\x01\0\
+\0\x20\0\0\0\x63\x1a\x70\xff\0\0\0\0\x79\xa1\xf0\xff\0\0\0\0\x63\x1a\x74\xff\0\
+\0\0\0\x77\x01\0\0\x20\0\0\0\x63\x1a\x78\xff\0\0\0\0\x71\xa9\xd6\xff\0\0\0\0\
+\x25\x09\xff\0\x3c\0\0\0\xb7\x01\0\0\x01\0\0\0\x6f\x91\0\0\0\0\0\0\x18\x02\0\0\
+\x01\0\0\0\0\0\0\0\0\x18\0\x1c\x5f\x21\0\0\0\0\0\0\x55\x01\x01\0\0\0\0\0\x05\0\
+\xf8\0\0\0\0\0\xb7\x01\0\0\0\0\0\0\x6b\x1a\xfe\xff\0\0\0\0\xb7\x01\0\0\x28\0\0\
+\0\x7b\x1a\x40\xff\0\0\0\0\xbf\xa1\0\0\0\0\0\0\x07\x01\0\0\x8c\xff\xff\xff\x7b\
+\x1a\x18\xff\0\0\0\0\xbf\xa1\0\0\0\0\0\0\x07\x01\0\0\x7c\xff\xff\xff\x7b\x1a\
+\x10\xff\0\0\0\0\xb7\x01\0\0\0\0\0\0\x7b\x1a\x28\xff\0\0\0\0\x7b\x7a\x20\xff\0\
+\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\xfe\xff\xff\xff\xbf\x81\0\0\0\0\0\0\x79\
+\xa2\x40\xff\0\0\0\0\xb7\x04\0\0\x02\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\
+\0\0\0\x67\0\0\0\x20\0\0\0\x77\0\0\0\x20\0\0\0\x15\0\x01\0\0\0\0\0\x05\0\x90\
+\x01\0\0\0\0\xbf\x91\0\0\0\0\0\0\x15\x01\x23\0\x3c\0\0\0\x15\x01\x59\0\x2c\0\0\
+\0\x55\x01\x5a\0\x2b\0\0\0\xb7\x01\0\0\0\0\0\0\x63\x1a\xf8\xff\0\0\0\0\xbf\xa3\
+\0\0\0\0\0\0\x07\x03\0\0\xf8\xff\xff\xff\xbf\x81\0\0\0\0\0\0\x79\xa2\x40\xff\0\
+\0\0\0\xb7\x04\0\0\x04\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\0\0\0\xbf\x01\
+\0\0\0\0\0\0\x67\x01\0\0\x20\0\0\0\x77\x01\0\0\x20\0\0\0\x55\x01\x03\x01\0\0\0\
+\0\x71\xa1\xfa\xff\0\0\0\0\x55\x01\x4b\0\x02\0\0\0\x71\xa1\xf9\xff\0\0\0\0\x55\
+\x01\x49\0\x02\0\0\0\x71\xa1\xfb\xff\0\0\0\0\x55\x01\x47\0\x01\0\0\0\x79\xa2\
+\x40\xff\0\0\0\0\x07\x02\0\0\x08\0\0\0\xbf\x81\0\0\0\0\0\0\x79\xa3\x18\xff\0\0\
+\0\0\xb7\x04\0\0\x10\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\0\0\0\xbf\x01\0\
+\0\0\0\0\0\x67\x01\0\0\x20\0\0\0\x77\x01\0\0\x20\0\0\0\x55\x01\xf2\0\0\0\0\0\
+\xb7\x01\0\0\x01\0\0\0\x73\x1a\x55\xff\0\0\0\0\x05\0\x39\0\0\0\0\0\xb7\x01\0\0\
+\0\0\0\0\x6b\x1a\xf8\xff\0\0\0\0\xb7\x09\0\0\x02\0\0\0\xb7\x07\0\0\x1e\0\0\0\
+\x05\0\x0e\0\0\0\0\0\x79\xa2\x38\xff\0\0\0\0\x0f\x29\0\0\0\0\0\0\xbf\x92\0\0\0\
+\0\0\0\x07\x02\0\0\x01\0\0\0\x71\xa3\xff\xff\0\0\0\0\x67\x03\0\0\x03\0\0\0\x2d\
+\x23\x02\0\0\0\0\0\x79\xa7\x20\xff\0\0\0\0\x05\0\x2b\0\0\0\0\0\x07\x07\0\0\xff\
+\xff\xff\xff\xbf\x72\0\0\0\0\0\0\x67\x02\0\0\x20\0\0\0\x77\x02\0\0\x20\0\0\0\
+\x15\x02\xf9\xff\0\0\0\0\x7b\x9a\x38\xff\0\0\0\0\x79\xa1\x40\xff\0\0\0\0\x0f\
+\x19\0\0\0\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\xf8\xff\xff\xff\xbf\x81\0\0\0\
+\0\0\0\xbf\x92\0\0\0\0\0\0\xb7\x04\0\0\x02\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\
+\0\x44\0\0\0\xbf\x01\0\0\0\0\0\0\x67\x01\0\0\x20\0\0\0\x77\x01\0\0\x20\0\0\0\
+\x55\x01\x94\0\0\0\0\0\x71\xa2\xf8\xff\0\0\0\0\x55\x02\x0f\0\xc9\0\0\0\x07\x09\
+\0\0\x02\0\0\0\xbf\x81\0\0\0\0\0\0\xbf\x92\0\0\0\0\0\0\x79\xa3\x10\xff\0\0\0\0\
+\xb7\x04\0\0\x10\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\0\0\0\xbf\x01\0\0\0\
+\0\0\0\x67\x01\0\0\x20\0\0\0\x77\x01\0\0\x20\0\0\0\x55\x01\x87\0\0\0\0\0\xb7\
+\x01\0\0\x01\0\0\0\x73\x1a\x54\xff\0\0\0\0\x79\xa7\x20\xff\0\0\0\0\x05\0\x07\0\
+\0\0\0\0\xb7\x09\0\0\x01\0\0\0\x15\x02\xd1\xff\0\0\0\0\x71\xa9\xf9\xff\0\0\0\0\
+\x07\x09\0\0\x02\0\0\0\x05\0\xce\xff\0\0\0\0\xb7\x01\0\0\x01\0\0\0\x73\x1a\x56\
+\xff\0\0\0\0\x71\xa1\xff\xff\0\0\0\0\x67\x01\0\0\x03\0\0\0\x79\xa2\x40\xff\0\0\
+\0\0\x0f\x12\0\0\0\0\0\0\x07\x02\0\0\x08\0\0\0\x7b\x2a\x40\xff\0\0\0\0\x71\xa9\
+\xfe\xff\0\0\0\0\x25\x09\x0e\0\x3c\0\0\0\xb7\x01\0\0\x01\0\0\0\x6f\x91\0\0\0\0\
+\0\0\x18\x02\0\0\x01\0\0\0\0\0\0\0\0\x18\0\x1c\x5f\x21\0\0\0\0\0\0\x55\x01\x01\
+\0\0\0\0\0\x05\0\x07\0\0\0\0\0\x79\xa1\x28\xff\0\0\0\0\x07\x01\0\0\x01\0\0\0\
+\x7b\x1a\x28\xff\0\0\0\0\x67\x01\0\0\x20\0\0\0\x77\x01\0\0\x20\0\0\0\x55\x01\
+\x82\xff\x0b\0\0\0\x05\0\x10\xff\0\0\0\0\x15\x09\xf8\xff\x87\0\0\0\x05\0\xfd\
+\xff\0\0\0\0\x71\xa1\x51\xff\0\0\0\0\x79\xa0\x30\xff\0\0\0\0\x15\x01\x17\x01\0\
+\0\0\0\x71\x62\x03\0\0\0\0\0\x67\x02\0\0\x08\0\0\0\x71\x61\x02\0\0\0\0\0\x4f\
+\x12\0\0\0\0\0\0\x71\x63\x04\0\0\0\0\0\x71\x61\x05\0\0\0\0\0\x67\x01\0\0\x08\0\
+\0\0\x4f\x31\0\0\0\0\0\0\x67\x01\0\0\x10\0\0\0\x4f\x21\0\0\0\0\0\0\x71\xa2\x53\
+\xff\0\0\0\0\x15\x02\x3d\0\0\0\0\0\xbf\x12\0\0\0\0\0\0\x57\x02\0\0\x10\0\0\0\
+\x15\x02\x3a\0\0\0\0\0\xbf\xa2\0\0\0\0\0\0\x07\x02\0\0\x5c\xff\xff\xff\x71\xa4\
+\x54\xff\0\0\0\0\xbf\x23\0\0\0\0\0\0\x15\x04\x02\0\0\0\0\0\xbf\xa3\0\0\0\0\0\0\
+\x07\x03\0\0\x7c\xff\xff\xff\x67\x01\0\0\x38\0\0\0\xc7\x01\0\0\x38\0\0\0\x65\
+\x01\x01\0\xff\xff\xff\xff\xbf\x32\0\0\0\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\
+\x6c\xff\xff\xff\x71\xa5\x55\xff\0\0\0\0\xbf\x34\0\0\0\0\0\0\x15\x05\x02\0\0\0\
+\0\0\xbf\xa4\0\0\0\0\0\0\x07\x04\0\0\x8c\xff\xff\xff\x65\x01\x01\0\xff\xff\xff\
+\xff\xbf\x43\0\0\0\0\0\0\x61\x21\x04\0\0\0\0\0\x67\x01\0\0\x20\0\0\0\x61\x24\0\
+\0\0\0\0\0\x4f\x41\0\0\0\0\0\0\x7b\x1a\xa0\xff\0\0\0\0\x61\x21\x08\0\0\0\0\0\
+\x61\x22\x0c\0\0\0\0\0\x67\x02\0\0\x20\0\0\0\x4f\x12\0\0\0\0\0\0\x7b\x2a\xa8\
+\xff\0\0\0\0\x61\x31\0\0\0\0\0\0\x61\x32\x04\0\0\0\0\0\x61\x34\x08\0\0\0\0\0\
+\x61\x33\x0c\0\0\0\0\0\x69\xa5\x5a\xff\0\0\0\0\x6b\x5a\xc2\xff\0\0\0\0\x69\xa5\
+\x58\xff\0\0\0\0\x6b\x5a\xc0\xff\0\0\0\0\x67\x03\0\0\x20\0\0\0\x4f\x43\0\0\0\0\
+\0\0\x7b\x3a\xb8\xff\0\0\0\0\x67\x02\0\0\x20\0\0\0\x4f\x12\0\0\0\0\0\0\x7b\x2a\
+\xb0\xff\0\0\0\0\x05\0\x6b\0\0\0\0\0\x71\xa2\x52\xff\0\0\0\0\x15\x02\x04\0\0\0\
+\0\0\xbf\x12\0\0\0\0\0\0\x57\x02\0\0\x04\0\0\0\x15\x02\x01\0\0\0\0\0\x05\0\xf7\
+\xfe\0\0\0\0\x57\x01\0\0\x01\0\0\0\x15\x01\xd3\0\0\0\0\0\x61\xa1\x5c\xff\0\0\0\
+\0\x63\x1a\xa0\xff\0\0\0\0\x61\xa1\x60\xff\0\0\0\0\x63\x1a\xa4\xff\0\0\0\0\x05\
+\0\x5e\0\0\0\0\0\x71\xa2\x52\xff\0\0\0\0\x15\x02\x1e\0\0\0\0\0\xbf\x12\0\0\0\0\
+\0\0\x57\x02\0\0\x20\0\0\0\x15\x02\x1b\0\0\0\0\0\xbf\xa2\0\0\0\0\0\0\x07\x02\0\
+\0\x5c\xff\xff\xff\x71\xa4\x54\xff\0\0\0\0\xbf\x23\0\0\0\0\0\0\x15\x04\x02\0\0\
+\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\x7c\xff\xff\xff\x57\x01\0\0\0\x01\0\0\
+\x15\x01\x01\0\0\0\0\0\xbf\x32\0\0\0\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\x6c\
+\xff\xff\xff\x71\xa5\x55\xff\0\0\0\0\xbf\x34\0\0\0\0\0\0\x15\x05\x02\0\0\0\0\0\
+\xbf\xa4\0\0\0\0\0\0\x07\x04\0\0\x8c\xff\xff\xff\x15\x01\xc3\xff\0\0\0\0\x05\0\
+\xc1\xff\0\0\0\0\xb7\x09\0\0\x3c\0\0\0\x79\xa7\x20\xff\0\0\0\0\x67\0\0\0\x20\0\
+\0\0\x77\0\0\0\x20\0\0\0\x15\0\xa5\xfe\0\0\0\0\x05\0\xb0\0\0\0\0\0\x15\x09\x07\
+\xff\x87\0\0\0\x05\0\xa2\xfe\0\0\0\0\xbf\x12\0\0\0\0\0\0\x57\x02\0\0\x08\0\0\0\
+\x15\x02\xab\0\0\0\0\0\xbf\xa2\0\0\0\0\0\0\x07\x02\0\0\x5c\xff\xff\xff\x71\xa4\
+\x54\xff\0\0\0\0\xbf\x23\0\0\0\0\0\0\x15\x04\x02\0\0\0\0\0\xbf\xa3\0\0\0\0\0\0\
+\x07\x03\0\0\x7c\xff\xff\xff\x57\x01\0\0\x40\0\0\0\x15\x01\x01\0\0\0\0\0\xbf\
+\x32\0\0\0\0\0\0\x61\x23\x04\0\0\0\0\0\x67\x03\0\0\x20\0\0\0\x61\x24\0\0\0\0\0\
+\0\x4f\x43\0\0\0\0\0\0\x7b\x3a\xa0\xff\0\0\0\0\x61\x23\x08\0\0\0\0\0\x61\x22\
+\x0c\0\0\0\0\0\x67\x02\0\0\x20\0\0\0\x4f\x32\0\0\0\0\0\0\x7b\x2a\xa8\xff\0\0\0\
+\0\x15\x01\x1c\0\0\0\0\0\x71\xa1\x55\xff\0\0\0\0\x15\x01\x1a\0\0\0\0\0\x61\xa1\
+\x98\xff\0\0\0\0\x67\x01\0\0\x20\0\0\0\x61\xa2\x94\xff\0\0\0\0\x4f\x21\0\0\0\0\
+\0\0\x7b\x1a\xb8\xff\0\0\0\0\x61\xa1\x90\xff\0\0\0\0\x67\x01\0\0\x20\0\0\0\x61\
+\xa2\x8c\xff\0\0\0\0\x05\0\x19\0\0\0\0\0\xb7\x01\0\0\x01\0\0\0\x73\x1a\x52\xff\
+\0\0\0\0\xb7\x01\0\0\0\0\0\0\x7b\x1a\xd0\xff\0\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\
+\x03\0\0\xd0\xff\xff\xff\xbf\x81\0\0\0\0\0\0\x79\xa2\x40\xff\0\0\0\0\xb7\x04\0\
+\0\x08\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\0\0\0\x67\0\0\0\x20\0\0\0\x77\
+\0\0\0\x20\0\0\0\x55\0\x7d\0\0\0\0\0\x05\0\x88\xfe\0\0\0\0\xb7\x09\0\0\x2b\0\0\
+\0\x05\0\xc6\xff\0\0\0\0\x61\xa1\x78\xff\0\0\0\0\x67\x01\0\0\x20\0\0\0\x61\xa2\
+\x74\xff\0\0\0\0\x4f\x21\0\0\0\0\0\0\x7b\x1a\xb8\xff\0\0\0\0\x61\xa1\x70\xff\0\
+\0\0\0\x67\x01\0\0\x20\0\0\0\x61\xa2\x6c\xff\0\0\0\0\x4f\x21\0\0\0\0\0\0\x7b\
+\x1a\xb0\xff\0\0\0\0\xb7\x01\0\0\0\0\0\0\x07\x07\0\0\x04\0\0\0\x61\x03\0\0\0\0\
+\0\0\xb7\x05\0\0\0\0\0\0\x05\0\x4e\0\0\0\0\0\xaf\x52\0\0\0\0\0\0\xbf\x75\0\0\0\
+\0\0\0\x0f\x15\0\0\0\0\0\0\x71\x55\0\0\0\0\0\0\x67\x03\0\0\x01\0\0\0\xbf\x50\0\
+\0\0\0\0\0\x77\0\0\0\x07\0\0\0\x4f\x03\0\0\0\0\0\0\xbf\x40\0\0\0\0\0\0\x67\0\0\
+\0\x39\0\0\0\xc7\0\0\0\x3f\0\0\0\x5f\x30\0\0\0\0\0\0\xaf\x02\0\0\0\0\0\0\xbf\
+\x50\0\0\0\0\0\0\x77\0\0\0\x06\0\0\0\x57\0\0\0\x01\0\0\0\x67\x03\0\0\x01\0\0\0\
+\x4f\x03\0\0\0\0\0\0\xbf\x40\0\0\0\0\0\0\x67\0\0\0\x3a\0\0\0\xc7\0\0\0\x3f\0\0\
+\0\x5f\x30\0\0\0\0\0\0\xaf\x02\0\0\0\0\0\0\x67\x03\0\0\x01\0\0\0\xbf\x50\0\0\0\
+\0\0\0\x77\0\0\0\x05\0\0\0\x57\0\0\0\x01\0\0\0\x4f\x03\0\0\0\0\0\0\xbf\x40\0\0\
+\0\0\0\0\x67\0\0\0\x3b\0\0\0\xc7\0\0\0\x3f\0\0\0\x5f\x30\0\0\0\0\0\0\xaf\x02\0\
+\0\0\0\0\0\x67\x03\0\0\x01\0\0\0\xbf\x50\0\0\0\0\0\0\x77\0\0\0\x04\0\0\0\x57\0\
+\0\0\x01\0\0\0\x4f\x03\0\0\0\0\0\0\xbf\x40\0\0\0\0\0\0\x67\0\0\0\x3c\0\0\0\xc7\
+\0\0\0\x3f\0\0\0\x5f\x30\0\0\0\0\0\0\xaf\x02\0\0\0\0\0\0\xbf\x50\0\0\0\0\0\0\
+\x77\0\0\0\x03\0\0\0\x57\0\0\0\x01\0\0\0\x67\x03\0\0\x01\0\0\0\x4f\x03\0\0\0\0\
+\0\0\xbf\x40\0\0\0\0\0\0\x67\0\0\0\x3d\0\0\0\xc7\0\0\0\x3f\0\0\0\x5f\x30\0\0\0\
+\0\0\0\xaf\x02\0\0\0\0\0\0\xbf\x50\0\0\0\0\0\0\x77\0\0\0\x02\0\0\0\x57\0\0\0\
+\x01\0\0\0\x67\x03\0\0\x01\0\0\0\x4f\x03\0\0\0\0\0\0\xbf\x40\0\0\0\0\0\0\x67\0\
+\0\0\x3e\0\0\0\xc7\0\0\0\x3f\0\0\0\x5f\x30\0\0\0\0\0\0\xaf\x02\0\0\0\0\0\0\xbf\
+\x50\0\0\0\0\0\0\x77\0\0\0\x01\0\0\0\x57\0\0\0\x01\0\0\0\x67\x03\0\0\x01\0\0\0\
+\x4f\x03\0\0\0\0\0\0\x57\x04\0\0\x01\0\0\0\x87\x04\0\0\0\0\0\0\x5f\x34\0\0\0\0\
+\0\0\xaf\x42\0\0\0\0\0\0\x57\x05\0\0\x01\0\0\0\x67\x03\0\0\x01\0\0\0\x4f\x53\0\
+\0\0\0\0\0\x07\x01\0\0\x01\0\0\0\xbf\x25\0\0\0\0\0\0\x15\x01\x0b\0\x24\0\0\0\
+\xbf\xa2\0\0\0\0\0\0\x07\x02\0\0\xa0\xff\xff\xff\x0f\x12\0\0\0\0\0\0\x71\x24\0\
+\0\0\0\0\0\xbf\x40\0\0\0\0\0\0\x67\0\0\0\x38\0\0\0\xc7\0\0\0\x38\0\0\0\xb7\x02\
+\0\0\0\0\0\0\x65\0\xa9\xff\xff\xff\xff\xff\xbf\x32\0\0\0\0\0\0\x05\0\xa7\xff\0\
+\0\0\0\xbf\x21\0\0\0\0\0\0\x67\x01\0\0\x20\0\0\0\x77\x01\0\0\x20\0\0\0\x15\x01\
+\x0e\0\0\0\0\0\x71\x63\x06\0\0\0\0\0\x71\x64\x07\0\0\0\0\0\x67\x04\0\0\x08\0\0\
+\0\x4f\x34\0\0\0\0\0\0\x3f\x41\0\0\0\0\0\0\x2f\x41\0\0\0\0\0\0\x1f\x12\0\0\0\0\
+\0\0\x63\x2a\x50\xff\0\0\0\0\xbf\xa2\0\0\0\0\0\0\x07\x02\0\0\x50\xff\xff\xff\
+\x18\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x85\0\0\0\x01\0\0\0\x55\0\x05\0\0\0\0\0\
+\x71\x61\x08\0\0\0\0\0\x71\x60\x09\0\0\0\0\0\x67\0\0\0\x08\0\0\0\x4f\x10\0\0\0\
+\0\0\0\x95\0\0\0\0\0\0\0\x69\0\0\0\0\0\0\0\x05\0\xfd\xff\0\0\0\0\x02\0\0\0\x04\
+\0\0\0\x0a\0\0\0\x01\0\0\0\0\0\0\0\x02\0\0\0\x04\0\0\0\x28\0\0\0\x01\0\0\0\0\0\
+\0\0\x02\0\0\0\x04\0\0\0\x02\0\0\0\x80\0\0\0\0\0\0\0\x47\x50\x4c\x20\x76\x32\0\
+\0\0\0\0\0\x10\0\0\0\0\0\0\0\x01\x7a\x52\0\x08\x7c\x0b\x01\x0c\0\0\0\x18\0\0\0\
+\x18\0\0\0\0\0\0\0\0\0\0\0\xd8\x13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
+\0\0\0\0\0\0\0\0\0\0\0\0\xa0\0\0\0\x04\0\xf1\xff\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
+\0\x60\x02\0\0\0\0\x03\0\x20\x02\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x3f\x02\0\0\0\0\
+\x03\0\xd0\x0f\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xed\x01\0\0\0\0\x03\0\x10\x10\0\0\0\
+\0\0\0\0\0\0\0\0\0\0\0\xd4\x01\0\0\0\0\x03\0\x20\x10\0\0\0\0\0\0\0\0\0\0\0\0\0\
+\0\xa3\x01\0\0\0\0\x03\0\xb8\x12\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x63\x01\0\0\0\0\
+\x03\0\x48\x10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x2a\x01\0\0\0\0\x03\0\x10\x13\0\0\0\
+\0\0\0\0\0\0\0\0\0\0\0\xe1\0\0\0\0\0\x03\0\xa0\x13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
+\x2e\x02\0\0\0\0\x03\0\x28\x02\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x68\x02\0\0\0\0\x03\
+\0\xc0\x13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x36\x02\0\0\0\0\x03\0\xc8\x13\0\0\0\0\0\
+\0\0\0\0\0\0\0\0\0\x22\x01\0\0\0\0\x03\0\xe8\x02\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
+\x02\x01\0\0\0\0\x03\0\x40\x03\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xd9\0\0\0\0\0\x03\0\
+\xf8\x04\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x26\x02\0\0\0\0\x03\0\x20\x0e\0\0\0\0\0\0\
+\0\0\0\0\0\0\0\0\xcc\x01\0\0\0\0\x03\0\x60\x06\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x9b\
+\x01\0\0\0\0\x03\0\xc8\x06\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x5b\x01\0\0\0\0\x03\0\
+\x20\x07\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x7c\x01\0\0\0\0\x03\0\x48\x08\0\0\0\0\0\0\
+\0\0\0\0\0\0\0\0\x53\x01\0\0\0\0\x03\0\xb8\x08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x1a\
+\x01\0\0\0\0\x03\0\xe0\x08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x84\x01\0\0\0\0\x03\0\
+\xb8\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x1e\x02\0\0\0\0\x03\0\xd8\x09\0\0\0\0\0\0\0\
+\0\0\0\0\0\0\0\xc4\x01\0\0\0\0\x03\0\x70\x08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x93\
+\x01\0\0\0\0\x03\0\xa8\x08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x74\x01\0\0\0\0\x03\0\
+\xf0\x0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x4b\x01\0\0\0\0\x03\0\0\x0a\0\0\0\0\0\0\0\
+\0\0\0\0\0\0\0\x12\x01\0\0\0\0\x03\0\x10\x0a\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xfa\0\
+\0\0\0\0\x03\0\xc0\x0a\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x58\x02\0\0\0\0\x03\0\x88\
+\x0a\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x16\x02\0\0\0\0\x03\0\xb8\x0a\0\0\0\0\0\0\0\0\
+\0\0\0\0\0\0\xe5\x01\0\0\0\0\x03\0\xc0\x0f\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xbc\x01\
+\0\0\0\0\x03\0\0\x0e\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x8b\x01\0\0\0\0\x03\0\x18\x0e\
+\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xd1\0\0\0\0\0\x03\0\0\x04\0\0\0\0\0\0\0\0\0\0\0\0\
+\0\0\x50\x02\0\0\0\0\x03\0\x20\x04\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x0e\x02\0\0\0\0\
+\x03\0\x48\x0f\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x6c\x01\0\0\0\0\x03\0\xb0\x04\0\0\0\
+\0\0\0\0\0\0\0\0\0\0\0\x43\x01\0\0\0\0\x03\0\xc8\x0c\0\0\0\0\0\0\0\0\0\0\0\0\0\
+\0\xc9\0\0\0\0\0\x03\0\xf8\x0c\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x06\x02\0\0\0\0\x03\
+\0\xd0\x0a\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x3b\x01\0\0\0\0\x03\0\x98\x0b\0\0\0\0\0\
+\0\0\0\0\0\0\0\0\0\xf2\0\0\0\0\0\x03\0\xb8\x0b\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x48\
+\x02\0\0\0\0\x03\0\xf0\x0b\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xfe\x01\0\0\0\0\x03\0\
+\xf8\x0b\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xdd\x01\0\0\0\0\x03\0\0\x0c\0\0\0\0\0\0\0\
+\0\0\0\0\0\0\0\xb4\x01\0\0\0\0\x03\0\x30\x0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x0a\
+\x01\0\0\0\0\x03\0\x90\x0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xc1\0\0\0\0\0\x03\0\xa8\
+\x0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xba\0\0\0\0\0\x03\0\xd0\x01\0\0\0\0\0\0\0\0\0\
+\0\0\0\0\0\xf6\x01\0\0\0\0\x03\0\xe0\x0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xac\x01\0\
+\0\0\0\x03\0\x30\x0e\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x33\x01\0\0\0\0\x03\0\x80\x0e\
+\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xea\0\0\0\0\0\x03\0\x98\x0e\0\0\0\0\0\0\0\0\0\0\0\
+\0\0\0\0\0\0\0\x03\0\x03\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x6b\0\0\0\x11\0\x06\
+\0\0\0\0\0\0\0\0\0\x07\0\0\0\0\0\0\0\x25\0\0\0\x11\0\x05\0\0\0\0\0\0\0\0\0\x14\
+\0\0\0\0\0\0\0\x82\0\0\0\x11\0\x05\0\x28\0\0\0\0\0\0\0\x14\0\0\0\0\0\0\0\x01\0\
+\0\0\x11\0\x05\0\x14\0\0\0\0\0\0\0\x14\0\0\0\0\0\0\0\x40\0\0\0\x12\0\x03\0\0\0\
+\0\0\0\0\0\0\xd8\x13\0\0\0\0\0\0\x28\0\0\0\0\0\0\0\x01\0\0\0\x3a\0\0\0\x50\0\0\
+\0\0\0\0\0\x01\0\0\0\x3c\0\0\0\x80\x13\0\0\0\0\0\0\x01\0\0\0\x3b\0\0\0\x1c\0\0\
+\0\0\0\0\0\x01\0\0\0\x38\0\0\0\0\x74\x61\x70\x5f\x72\x73\x73\x5f\x6d\x61\x70\
+\x5f\x74\x6f\x65\x70\x6c\x69\x74\x7a\x5f\x6b\x65\x79\0\x2e\x74\x65\x78\x74\0\
+\x6d\x61\x70\x73\0\x74\x61\x70\x5f\x72\x73\x73\x5f\x6d\x61\x70\x5f\x63\x6f\x6e\
+\x66\x69\x67\x75\x72\x61\x74\x69\x6f\x6e\x73\0\x74\x75\x6e\x5f\x72\x73\x73\x5f\
+\x73\x74\x65\x65\x72\x69\x6e\x67\x5f\x70\x72\x6f\x67\0\x2e\x72\x65\x6c\x74\x75\
+\x6e\x5f\x72\x73\x73\x5f\x73\x74\x65\x65\x72\x69\x6e\x67\0\x5f\x6c\x69\x63\x65\
+\x6e\x73\x65\0\x2e\x72\x65\x6c\x2e\x65\x68\x5f\x66\x72\x61\x6d\x65\0\x74\x61\
+\x70\x5f\x72\x73\x73\x5f\x6d\x61\x70\x5f\x69\x6e\x64\x69\x72\x65\x63\x74\x69\
+\x6f\x6e\x5f\x74\x61\x62\x6c\x65\0\x72\x73\x73\x2e\x62\x70\x66\x2e\x63\0\x2e\
+\x73\x74\x72\x74\x61\x62\0\x2e\x73\x79\x6d\x74\x61\x62\0\x4c\x42\x42\x30\x5f\
+\x39\0\x4c\x42\x42\x30\x5f\x38\x39\0\x4c\x42\x42\x30\x5f\x36\x39\0\x4c\x42\x42\
+\x30\x5f\x35\x39\0\x4c\x42\x42\x30\x5f\x31\x39\0\x4c\x42\x42\x30\x5f\x31\x30\
+\x39\0\x4c\x42\x42\x30\x5f\x39\x38\0\x4c\x42\x42\x30\x5f\x37\x38\0\x4c\x42\x42\
+\x30\x5f\x34\x38\0\x4c\x42\x42\x30\x5f\x31\x38\0\x4c\x42\x42\x30\x5f\x38\x37\0\
+\x4c\x42\x42\x30\x5f\x34\x37\0\x4c\x42\x42\x30\x5f\x33\x37\0\x4c\x42\x42\x30\
+\x5f\x31\x37\0\x4c\x42\x42\x30\x5f\x31\x30\x37\0\x4c\x42\x42\x30\x5f\x39\x36\0\
+\x4c\x42\x42\x30\x5f\x37\x36\0\x4c\x42\x42\x30\x5f\x36\x36\0\x4c\x42\x42\x30\
+\x5f\x34\x36\0\x4c\x42\x42\x30\x5f\x33\x36\0\x4c\x42\x42\x30\x5f\x32\x36\0\x4c\
+\x42\x42\x30\x5f\x31\x30\x36\0\x4c\x42\x42\x30\x5f\x36\x35\0\x4c\x42\x42\x30\
+\x5f\x34\x35\0\x4c\x42\x42\x30\x5f\x33\x35\0\x4c\x42\x42\x30\x5f\x34\0\x4c\x42\
+\x42\x30\x5f\x35\x34\0\x4c\x42\x42\x30\x5f\x34\x34\0\x4c\x42\x42\x30\x5f\x32\
+\x34\0\x4c\x42\x42\x30\x5f\x31\x30\x34\0\x4c\x42\x42\x30\x5f\x39\x33\0\x4c\x42\
+\x42\x30\x5f\x38\x33\0\x4c\x42\x42\x30\x5f\x35\x33\0\x4c\x42\x42\x30\x5f\x34\
+\x33\0\x4c\x42\x42\x30\x5f\x32\x33\0\x4c\x42\x42\x30\x5f\x31\x30\x33\0\x4c\x42\
+\x42\x30\x5f\x38\x32\0\x4c\x42\x42\x30\x5f\x35\x32\0\x4c\x42\x42\x30\x5f\x31\
+\x30\x32\0\x4c\x42\x42\x30\x5f\x39\x31\0\x4c\x42\x42\x30\x5f\x38\x31\0\x4c\x42\
+\x42\x30\x5f\x37\x31\0\x4c\x42\x42\x30\x5f\x36\x31\0\x4c\x42\x42\x30\x5f\x35\
+\x31\0\x4c\x42\x42\x30\x5f\x34\x31\0\x4c\x42\x42\x30\x5f\x32\x31\0\x4c\x42\x42\
+\x30\x5f\x31\x31\0\x4c\x42\x42\x30\x5f\x31\x31\x31\0\x4c\x42\x42\x30\x5f\x31\
+\x30\x31\0\x4c\x42\x42\x30\x5f\x38\x30\0\x4c\x42\x42\x30\x5f\x36\x30\0\x4c\x42\
+\x42\x30\x5f\x35\x30\0\x4c\x42\x42\x30\x5f\x31\x30\0\x4c\x42\x42\x30\x5f\x31\
+\x31\x30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
+\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xaa\
+\0\0\0\x03\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xa0\x1a\0\0\0\0\0\0\x71\x02\0\
+\0\0\0\0\0\0\0\0\0\0\0\0\0\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x1a\0\0\0\x01\0\0\
+\0\x06\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x40\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
+\0\0\0\0\x04\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x5a\0\0\0\x01\0\0\0\x06\0\0\0\0\0\0\
+\0\0\0\0\0\0\0\0\0\x40\0\0\0\0\0\0\0\xd8\x13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x08\0\
+\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x56\0\0\0\x09\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
+\0\x60\x1a\0\0\0\0\0\0\x30\0\0\0\0\0\0\0\x09\0\0\0\x03\0\0\0\x08\0\0\0\0\0\0\0\
+\x10\0\0\0\0\0\0\0\x20\0\0\0\x01\0\0\0\x03\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x18\
+\x14\0\0\0\0\0\0\x3c\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x04\0\0\0\0\0\0\0\0\0\0\0\0\
+\0\0\0\x6c\0\0\0\x01\0\0\0\x03\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x54\x14\0\0\0\0\0\
+\0\x07\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x78\0\0\
+\0\x01\0\0\0\x02\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x60\x14\0\0\0\0\0\0\x30\0\0\0\0\
+\0\0\0\0\0\0\0\0\0\0\0\x08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x74\0\0\0\x09\0\0\0\0\
+\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x90\x1a\0\0\0\0\0\0\x10\0\0\0\0\0\0\0\x09\0\0\0\
+\x07\0\0\0\x08\0\0\0\0\0\0\0\x10\0\0\0\0\0\0\0\xb2\0\0\0\x02\0\0\0\0\0\0\0\0\0\
+\0\0\0\0\0\0\0\0\0\0\x90\x14\0\0\0\0\0\0\xd0\x05\0\0\0\0\0\0\x01\0\0\0\x39\0\0\
+\0\x08\0\0\0\0\0\0\0\x18\0\0\0\0\0\0\0";
+
+	return 0;
+err:
+	bpf_object__destroy_skeleton(s);
+	return -1;
+}
+
+#endif /* __RSS_BPF_SKEL_H__ */
diff --git a/ebpf/trace-events b/ebpf/trace-events
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/ebpf/trace-events
@@ -XXX,XX +XXX,XX @@
+# See docs/devel/tracing.txt for syntax documentation.
+
+# ebpf-rss.c
+ebpf_error(const char *s1, const char *s2) "error in %s: %s"
diff --git a/ebpf/trace.h b/ebpf/trace.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/ebpf/trace.h
@@ -0,0 +1 @@
+#include "trace/trace-ebpf.h"
diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ if not get_option('fuse_lseek').disabled()
   endif
 endif
 
+# libbpf
+libbpf = dependency('libbpf', required: get_option('bpf'))
+if libbpf.found() and not cc.links('''
+   #include <bpf/libbpf.h>
+   int main(void)
+   {
+     bpf_object__destroy_skeleton(NULL);
+     return 0;
+   }''', dependencies: libbpf)
+  libbpf = not_found
+  if get_option('bpf').enabled()
+    error('libbpf skeleton test failed')
+  else
+    warning('libbpf skeleton test failed, disabling')
+  endif
+endif
+
 if get_option('cfi')
   cfi_flags=[]
   # Check for dependency on LTO
@@ -XXX,XX +XXX,XX @@ endif
 config_host_data.set('CONFIG_GTK', gtk.found())
 config_host_data.set('CONFIG_LIBATTR', have_old_libattr)
 config_host_data.set('CONFIG_LIBCAP_NG', libcap_ng.found())
+config_host_data.set('CONFIG_EBPF', libbpf.found())
 config_host_data.set('CONFIG_LIBISCSI', libiscsi.found())
 config_host_data.set('CONFIG_LIBNFS', libnfs.found())
 config_host_data.set('CONFIG_RBD', rbd.found())
@@ -XXX,XX +XXX,XX @@ if have_system
     'backends',
     'backends/tpm',
     'chardev',
+    'ebpf',
     'hw/9pfs',
     'hw/acpi',
     'hw/adc',
@@ -XXX,XX +XXX,XX @@ subdir('accel')
 subdir('plugins')
 subdir('bsd-user')
 subdir('linux-user')
+subdir('ebpf')
+
+common_ss.add(libbpf)
 
 bsd_user_ss.add(files('gdbstub.c'))
 specific_ss.add_all(when: 'CONFIG_BSD_USER', if_true: bsd_user_ss)
@@ -XXX,XX +XXX,XX @@ summary_info += {'RDMA support':      config_host.has_key('CONFIG_RDMA')}
 summary_info += {'PVRDMA support':    config_host.has_key('CONFIG_PVRDMA')}
 summary_info += {'fdt support':       fdt_opt == 'disabled' ? false : fdt_opt}
 summary_info += {'libcap-ng support': libcap_ng.found()}
+summary_info += {'bpf support': libbpf.found()}
 # TODO: add back protocol and server version
 summary_info += {'spice support':     config_host.has_key('CONFIG_SPICE')}
 summary_info += {'rbd support':       rbd.found()}
diff --git a/meson_options.txt b/meson_options.txt
index XXXXXXX..XXXXXXX 100644
--- a/meson_options.txt
+++ b/meson_options.txt
@@ -XXX,XX +XXX,XX @@ option('bzip2', type : 'feature', value : 'auto',
        description: 'bzip2 support for DMG images')
 option('cap_ng', type : 'feature', value : 'auto',
        description: 'cap_ng support')
+option('bpf', type : 'feature', value : 'auto',
+        description: 'eBPF support')
 option('cocoa', type : 'feature', value : 'auto',
        description: 'Cocoa user interface (macOS only)')
 option('curl', type : 'feature', value : 'auto',
-- 
2.7.4

From: Andrew Melnychenko <andrew@daynix.com>

When RSS is enabled the device tries to load the eBPF program
to select RX virtqueue in the TUN. If eBPF can be loaded
the RSS will function also with vhost (works with kernel 5.8 and later).
Software RSS is used as a fallback with vhost=off when eBPF can't be loaded
or when hash population requested by the guest.

Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
Signed-off-by: Andrew Melnychenko <andrew@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/vhost_net.c             |   3 ++
 hw/net/virtio-net.c            | 115 +++++++++++++++++++++++++++++++++++++++--
 include/hw/virtio/virtio-net.h |   4 ++
 net/vhost-vdpa.c               |   2 +
 4 files changed, 121 insertions(+), 3 deletions(-)

diff --git a/hw/net/vhost_net.c b/hw/net/vhost_net.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/vhost_net.c
+++ b/hw/net/vhost_net.c
@@ -XXX,XX +XXX,XX @@ static const int kernel_feature_bits[] = {
     VIRTIO_NET_F_MTU,
     VIRTIO_F_IOMMU_PLATFORM,
     VIRTIO_F_RING_PACKED,
+    VIRTIO_NET_F_HASH_REPORT,
     VHOST_INVALID_FEATURE_BIT
 };
 
@@ -XXX,XX +XXX,XX @@ static const int user_feature_bits[] = {
     VIRTIO_NET_F_MTU,
     VIRTIO_F_IOMMU_PLATFORM,
     VIRTIO_F_RING_PACKED,
+    VIRTIO_NET_F_RSS,
+    VIRTIO_NET_F_HASH_REPORT,
 
     /* This bit implies RARP isn't sent by QEMU out of band */
     VIRTIO_NET_F_GUEST_ANNOUNCE,
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -XXX,XX +XXX,XX @@ static uint64_t virtio_net_get_features(VirtIODevice *vdev, uint64_t features,
         return features;
     }
 
-    virtio_clear_feature(&features, VIRTIO_NET_F_RSS);
-    virtio_clear_feature(&features, VIRTIO_NET_F_HASH_REPORT);
+    if (!ebpf_rss_is_loaded(&n->ebpf_rss)) {
+        virtio_clear_feature(&features, VIRTIO_NET_F_RSS);
+    }
     features = vhost_net_get_features(get_vhost_net(nc->peer), features);
     vdev->backend_features = features;
 
@@ -XXX,XX +XXX,XX @@ static int virtio_net_handle_announce(VirtIONet *n, uint8_t cmd,
     }
 }
 
+static void virtio_net_detach_epbf_rss(VirtIONet *n);
+
 static void virtio_net_disable_rss(VirtIONet *n)
 {
     if (n->rss_data.enabled) {
         trace_virtio_net_rss_disable();
     }
     n->rss_data.enabled = false;
+
+    virtio_net_detach_epbf_rss(n);
+}
+
+static bool virtio_net_attach_ebpf_to_backend(NICState *nic, int prog_fd)
+{
+    NetClientState *nc = qemu_get_peer(qemu_get_queue(nic), 0);
+    if (nc == NULL || nc->info->set_steering_ebpf == NULL) {
+        return false;
+    }
+
+    return nc->info->set_steering_ebpf(nc, prog_fd);
+}
+
+static void rss_data_to_rss_config(struct VirtioNetRssData *data,
+                                   struct EBPFRSSConfig *config)
+{
+    config->redirect = data->redirect;
+    config->populate_hash = data->populate_hash;
+    config->hash_types = data->hash_types;
+    config->indirections_len = data->indirections_len;
+    config->default_queue = data->default_queue;
+}
+
+static bool virtio_net_attach_epbf_rss(VirtIONet *n)
+{
+    struct EBPFRSSConfig config = {};
+
+    if (!ebpf_rss_is_loaded(&n->ebpf_rss)) {
+        return false;
+    }
+
+    rss_data_to_rss_config(&n->rss_data, &config);
+
+    if (!ebpf_rss_set_all(&n->ebpf_rss, &config,
+                          n->rss_data.indirections_table, n->rss_data.key)) {
+        return false;
+    }
+
+    if (!virtio_net_attach_ebpf_to_backend(n->nic, n->ebpf_rss.program_fd)) {
+        return false;
+    }
+
+    return true;
+}
+
+static void virtio_net_detach_epbf_rss(VirtIONet *n)
+{
+    virtio_net_attach_ebpf_to_backend(n->nic, -1);
+}
+
+static bool virtio_net_load_ebpf(VirtIONet *n)
+{
+    if (!virtio_net_attach_ebpf_to_backend(n->nic, -1)) {
+        /* backend does't support steering ebpf */
+        return false;
+    }
+
+    return ebpf_rss_load(&n->ebpf_rss);
+}
+
+static void virtio_net_unload_ebpf(VirtIONet *n)
+{
+    virtio_net_attach_ebpf_to_backend(n->nic, -1);
+    ebpf_rss_unload(&n->ebpf_rss);
 }
 
 static uint16_t virtio_net_handle_rss(VirtIONet *n,
@@ -XXX,XX +XXX,XX @@ static uint16_t virtio_net_handle_rss(VirtIONet *n,
         goto error;
     }
     n->rss_data.enabled = true;
+
+    if (!n->rss_data.populate_hash) {
+        if (!virtio_net_attach_epbf_rss(n)) {
+            /* EBPF must be loaded for vhost */
+            if (get_vhost_net(qemu_get_queue(n->nic)->peer)) {
+                warn_report("Can't load eBPF RSS for vhost");
+                goto error;
+            }
+            /* fallback to software RSS */
+            warn_report("Can't load eBPF RSS - fallback to software RSS");
+            n->rss_data.enabled_software_rss = true;
+        }
+    } else {
+        /* use software RSS for hash populating */
+        /* and detach eBPF if was loaded before */
+        virtio_net_detach_epbf_rss(n);
+        n->rss_data.enabled_software_rss = true;
+    }
+
     trace_virtio_net_rss_enable(n->rss_data.hash_types,
                                 n->rss_data.indirections_len,
                                 temp.b);
@@ -XXX,XX +XXX,XX @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
         return -1;
     }
 
-    if (!no_rss && n->rss_data.enabled) {
+    if (!no_rss && n->rss_data.enabled && n->rss_data.enabled_software_rss) {
         int index = virtio_net_process_rss(nc, buf, size);
         if (index >= 0) {
             NetClientState *nc2 = qemu_get_subqueue(n->nic, index);
@@ -XXX,XX +XXX,XX @@ static int virtio_net_post_load_device(void *opaque, int version_id)
     }
 
     if (n->rss_data.enabled) {
+        n->rss_data.enabled_software_rss = n->rss_data.populate_hash;
+        if (!n->rss_data.populate_hash) {
+            if (!virtio_net_attach_epbf_rss(n)) {
+                if (get_vhost_net(qemu_get_queue(n->nic)->peer)) {
+                    warn_report("Can't post-load eBPF RSS for vhost");
+                } else {
+                    warn_report("Can't post-load eBPF RSS - fallback to software RSS");
+                    n->rss_data.enabled_software_rss = true;
+                }
+            }
+        }
+
         trace_virtio_net_rss_enable(n->rss_data.hash_types,
                                     n->rss_data.indirections_len,
                                     sizeof(n->rss_data.key));
@@ -XXX,XX +XXX,XX @@ static void virtio_net_device_realize(DeviceState *dev, Error **errp)
     n->qdev = dev;
 
     net_rx_pkt_init(&n->rx_pkt, false);
+
+    if (virtio_has_feature(n->host_features, VIRTIO_NET_F_RSS)) {
+        virtio_net_load_ebpf(n);
+    }
 }
 
 static void virtio_net_device_unrealize(DeviceState *dev)
@@ -XXX,XX +XXX,XX @@ static void virtio_net_device_unrealize(DeviceState *dev)
     VirtIONet *n = VIRTIO_NET(dev);
     int i, max_queues;
 
+    if (virtio_has_feature(n->host_features, VIRTIO_NET_F_RSS)) {
+        virtio_net_unload_ebpf(n);
+    }
+
     /* This will stop vhost backend if appropriate. */
     virtio_net_set_status(vdev, 0);
 
@@ -XXX,XX +XXX,XX @@ static void virtio_net_instance_init(Object *obj)
     device_add_bootindex_property(obj, &n->nic_conf.bootindex,
                                   "bootindex", "/ethernet-phy@0",
                                   DEVICE(n));
+
+    ebpf_rss_init(&n->ebpf_rss);
 }
 
 static int virtio_net_pre_save(void *opaque)
diff --git a/include/hw/virtio/virtio-net.h b/include/hw/virtio/virtio-net.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/virtio/virtio-net.h
+++ b/include/hw/virtio/virtio-net.h
@@ -XXX,XX +XXX,XX @@
 #include "qemu/option_int.h"
 #include "qom/object.h"
 
+#include "ebpf/ebpf_rss.h"
+
 #define TYPE_VIRTIO_NET "virtio-net-device"
 OBJECT_DECLARE_SIMPLE_TYPE(VirtIONet, VIRTIO_NET)
 
@@ -XXX,XX +XXX,XX @@ typedef struct VirtioNetRscChain {
 
 typedef struct VirtioNetRssData {
     bool    enabled;
+    bool    enabled_software_rss;
     bool    redirect;
     bool    populate_hash;
     uint32_t hash_types;
@@ -XXX,XX +XXX,XX @@ struct VirtIONet {
     Notifier migration_state;
     VirtioNetRssData rss_data;
     struct NetRxPkt *rx_pkt;
+    struct EBPFRSSContext ebpf_rss;
 };
 
 void virtio_net_set_netclient_name(VirtIONet *n, const char *name,
diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index XXXXXXX..XXXXXXX 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -XXX,XX +XXX,XX @@ const int vdpa_feature_bits[] = {
     VIRTIO_NET_F_MTU,
     VIRTIO_F_IOMMU_PLATFORM,
     VIRTIO_F_RING_PACKED,
+    VIRTIO_NET_F_RSS,
+    VIRTIO_NET_F_HASH_REPORT,
     VIRTIO_NET_F_GUEST_ANNOUNCE,
     VIRTIO_NET_F_STATUS,
     VHOST_INVALID_FEATURE_BIT
-- 
2.7.4

From: Andrew Melnychenko <andrew@daynix.com>

Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
Signed-off-by: Andrew Melnychenko <andrew@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 docs/devel/ebpf_rss.rst | 125 ++++++++++++++++++++++++++++++++++++++++++++++++
 docs/devel/index.rst    |   1 +
 2 files changed, 126 insertions(+)
 create mode 100644 docs/devel/ebpf_rss.rst

diff --git a/docs/devel/ebpf_rss.rst b/docs/devel/ebpf_rss.rst
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/devel/ebpf_rss.rst
@@ -XXX,XX +XXX,XX @@
+===========================
+eBPF RSS virtio-net support
+===========================
+
+RSS(Receive Side Scaling) is used to distribute network packets to guest virtqueues
+by calculating packet hash. Usually every queue is processed then by a specific guest CPU core.
+
+For now there are 2 RSS implementations in qemu:
+- 'in-qemu' RSS (functions if qemu receives network packets, i.e. vhost=off)
+- eBPF RSS (can function with also with vhost=on)
+
+eBPF support (CONFIG_EBPF) is enabled by 'configure' script.
+To enable eBPF RSS support use './configure --enable-bpf'.
+
+If steering BPF is not set for kernel's TUN module, the TUN uses automatic selection
+of rx virtqueue based on lookup table built according to calculated symmetric hash
+of transmitted packets.
+If steering BPF is set for TUN the BPF code calculates the hash of packet header and
+returns the virtqueue number to place the packet to.
+
+Simplified decision formula:
+
+.. code:: C
+
+    queue_index = indirection_table[hash(<packet data>)%<indirection_table size>]
+
+
+Not for all packets, the hash can/should be calculated.
+
+Note: currently, eBPF RSS does not support hash reporting.
+
+eBPF RSS turned on by different combinations of vhost-net, vitrio-net and tap configurations:
+
+- eBPF is used:
+
+        tap,vhost=off & virtio-net-pci,rss=on,hash=off
+
+- eBPF is used:
+
+        tap,vhost=on & virtio-net-pci,rss=on,hash=off
+
+- 'in-qemu' RSS is used:
+
+        tap,vhost=off & virtio-net-pci,rss=on,hash=on
+
+- eBPF is used, hash population feature is not reported to the guest:
+
+        tap,vhost=on & virtio-net-pci,rss=on,hash=on
+
+If CONFIG_EBPF is not set then only 'in-qemu' RSS is supported.
+Also 'in-qemu' RSS, as a fallback, is used if the eBPF program failed to load or set to TUN.
+
+RSS eBPF program
+----------------
+
+RSS program located in ebpf/rss.bpf.skeleton.h generated by bpftool.
+So the program is part of the qemu binary.
+Initially, the eBPF program was compiled by clang and source code located at tools/ebpf/rss.bpf.c.
+Prerequisites to recompile the eBPF program (regenerate ebpf/rss.bpf.skeleton.h):
+
+        llvm, clang, kernel source tree, bpftool
+        Adjust Makefile.ebpf to reflect the location of the kernel source tree
+
+        $ cd tools/ebpf
+        $ make -f Makefile.ebpf
+
+Current eBPF RSS implementation uses 'bounded loops' with 'backward jump instructions' which present in the last kernels.
+Overall eBPF RSS works on kernels 5.8+.
+
+eBPF RSS implementation
+-----------------------
+
+eBPF RSS loading functionality located in ebpf/ebpf_rss.c and ebpf/ebpf_rss.h.
+
+The `struct EBPFRSSContext` structure that holds 4 file descriptors:
+
+- ctx - pointer of the libbpf context.
+- program_fd - file descriptor of the eBPF RSS program.
+- map_configuration - file descriptor of the 'configuration' map. This map contains one element of 'struct EBPFRSSConfig'. This configuration determines eBPF program behavior.
+- map_toeplitz_key - file descriptor of the 'Toeplitz key' map. One element of the 40byte key prepared for the hashing algorithm.
+- map_indirections_table - 128 elements of queue indexes.
+
+`struct EBPFRSSConfig` fields:
+
+- redirect - "boolean" value, should the hash be calculated, on false  - `default_queue` would be used as the final decision.
+- populate_hash - for now, not used. eBPF RSS doesn't support hash reporting.
+- hash_types - binary mask of different hash types. See `VIRTIO_NET_RSS_HASH_TYPE_*` defines. If for packet hash should not be calculated - `default_queue` would be used.
+- indirections_len - length of the indirections table, maximum 128.
+- default_queue - the queue index that used for packet that shouldn't be hashed. For some packets, the hash can't be calculated(g.e ARP).
+
+Functions:
+
+- `ebpf_rss_init()` - sets ctx to NULL, which indicates that EBPFRSSContext is not loaded.
+- `ebpf_rss_load()` - creates 3 maps and loads eBPF program from the rss.bpf.skeleton.h. Returns 'true' on success. After that, program_fd can be used to set steering for TAP.
+- `ebpf_rss_set_all()` - sets values for eBPF maps. `indirections_table` length is in EBPFRSSConfig. `toeplitz_key` is VIRTIO_NET_RSS_MAX_KEY_SIZE aka 40 bytes array.
+- `ebpf_rss_unload()` - close all file descriptors and set ctx to NULL.
+
+Simplified eBPF RSS workflow:
+
+.. code:: C
+
+    struct EBPFRSSConfig config;
+    config.redirect = 1;
+    config.hash_types = VIRTIO_NET_RSS_HASH_TYPE_UDPv4 | VIRTIO_NET_RSS_HASH_TYPE_TCPv4;
+    config.indirections_len = VIRTIO_NET_RSS_MAX_TABLE_LEN;
+    config.default_queue = 0;
+
+    uint16_t table[VIRTIO_NET_RSS_MAX_TABLE_LEN] = {...};
+    uint8_t key[VIRTIO_NET_RSS_MAX_KEY_SIZE] = {...};
+
+    struct EBPFRSSContext ctx;
+    ebpf_rss_init(&ctx);
+    ebpf_rss_load(&ctx);
+    ebpf_rss_set_all(&ctx, &config, table, key);
+    if (net_client->info->set_steering_ebpf != NULL) {
+        net_client->info->set_steering_ebpf(net_client, ctx->program_fd);
+    }
+    ...
+    ebpf_unload(&ctx);
+
+
+NetClientState SetSteeringEBPF()
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+For now, `set_steering_ebpf()` method supported by Linux TAP NetClientState. The method requires an eBPF program file descriptor as an argument.
diff --git a/docs/devel/index.rst b/docs/devel/index.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/devel/index.rst
+++ b/docs/devel/index.rst
@@ -XXX,XX +XXX,XX @@ Contents:
    qom
    block-coroutine-wrapper
    multi-process
+   ebpf_rss
-- 
2.7.4

From: Guenter Roeck <linux@roeck-us.net>

If a PHY does not exist, attempts to read from it should return 0xffff.
Otherwise the Linux kernel will believe that a PHY is there and select
the non-existing PHY. This in turn will result in network errors later
on since the real PHY is not selected or configured.

Since reading from or writing to a non-existing PHY is not an emulation
error, replace guest error messages with traces.

Fixes: 461c51ad4275 ("Add a phy-num property to the i.MX FEC emulator")
Cc: Jean-Christophe Dubois <jcd@tribudubois.net>
Reviewed-by: Bin Meng <bmeng.cn@gmail.com>
Tested-by: Bin Meng <bmeng.cn@gmail.com>
Reviewed-by: Philippe Mathieu-Daud茅 <f4bug@amsat.org>
Signed-off-by: Guenter Roeck <linux@roeck-us.net>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/imx_fec.c    | 8 +++-----
 hw/net/trace-events | 2 ++
 2 files changed, 5 insertions(+), 5 deletions(-)

diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/imx_fec.c
+++ b/hw/net/imx_fec.c
@@ -XXX,XX +XXX,XX @@ static uint32_t imx_phy_read(IMXFECState *s, int reg)
     uint32_t phy = reg / 32;
 
     if (phy != s->phy_num) {
-        qemu_log_mask(LOG_GUEST_ERROR, "[%s.phy]%s: Bad phy num %u\n",
-                      TYPE_IMX_FEC, __func__, phy);
-        return 0;
+        trace_imx_phy_read_num(phy, s->phy_num);
+        return 0xffff;
     }
 
     reg %= 32;
@@ -XXX,XX +XXX,XX @@ static void imx_phy_write(IMXFECState *s, int reg, uint32_t val)
     uint32_t phy = reg / 32;
 
     if (phy != s->phy_num) {
-        qemu_log_mask(LOG_GUEST_ERROR, "[%s.phy]%s: Bad phy num %u\n",
-                      TYPE_IMX_FEC, __func__, phy);
+        trace_imx_phy_write_num(phy, s->phy_num);
         return;
     }
 
diff --git a/hw/net/trace-events b/hw/net/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/trace-events
+++ b/hw/net/trace-events
@@ -XXX,XX +XXX,XX @@ i82596_channel_attention(void *s) "%p: Received CHANNEL ATTENTION"
 
 # imx_fec.c
 imx_phy_read(uint32_t val, int phy, int reg) "0x%04"PRIx32" <= phy[%d].reg[%d]"
+imx_phy_read_num(int phy, int configured) "read request from unconfigured phy %d (configured %d)"
 imx_phy_write(uint32_t val, int phy, int reg) "0x%04"PRIx32" => phy[%d].reg[%d]"
+imx_phy_write_num(int phy, int configured) "write request to unconfigured phy %d (configured %d)"
 imx_phy_update_link(const char *s) "%s"
 imx_phy_reset(void) ""
 imx_fec_read_bd(uint64_t addr, int flags, int len, int data) "tx_bd 0x%"PRIx64" flags 0x%04x len %d data 0x%08x"
-- 
2.7.4

From: Laurent Vivier <lvivier@redhat.com>

In the failover case configuration, virtio_net_device_realize() uses an
add_migration_state_change_notifier() to add a state notifier, but this
notifier is not removed by the unrealize function when the virtio-net
card is unplugged.

If the card is unplugged and a migration is started, the notifier is
called and as it is not valid anymore QEMU crashes.

This patch fixes the problem by adding the
remove_migration_state_change_notifier() in virtio_net_device_unrealize().

The problem can be reproduced with:

$ qemu-system-x86_64 -enable-kvm -m 1g -M q35 \
    -device pcie-root-port,slot=4,id=root1 \
    -device pcie-root-port,slot=5,id=root2 \
    -device virtio-net-pci,id=net1,mac=52:54:00:6f:55:cc,failover=on,bus=root1 \
    -monitor stdio disk.qcow2
  (qemu) device_del net1
  (qemu) migrate "exec:gzip -c > STATEFILE.gz"

Thread 1 "qemu-system-x86" received signal SIGSEGV, Segmentation fault.
  0x0000000000000000 in ?? ()
  (gdb) bt
  #0  0x0000000000000000 in  ()
  #1  0x0000555555d726d7 in notifier_list_notify (...)
      at .../util/notify.c:39
  #2  0x0000555555842c1a in migrate_fd_connect (...)
      at .../migration/migration.c:3975
  #3  0x0000555555950f7d in migration_channel_connect (...)
      error@entry=0x0) at .../migration/channel.c:107
  #4  0x0000555555910922 in exec_start_outgoing_migration (...)
      at .../migration/exec.c:42

Reported-by: Igor Mammedov <imammedo@redhat.com>
Reviewed-by: Dr. David Alan Gilbert <dgilbert@redhat.com>
Reviewed-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Laurent Vivier <lvivier@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/virtio-net.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -XXX,XX +XXX,XX @@ static void virtio_net_device_unrealize(DeviceState *dev)
 
     if (n->failover) {
         device_listener_unregister(&n->primary_listener);
+        remove_migration_state_change_notifier(&n->migration_state);
     }
 
     max_queues = n->multiqueue ? n->max_queues : 1;
-- 
2.7.4

From: Brad Smith <brad@comstyle.com>

OpenBSD added support for tap(4) 10 releases ago.

Remove the special casing for older releases.

Signed-off-by: Brad Smith <brad@comstyle.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/tap-bsd.c | 8 --------
 1 file changed, 8 deletions(-)

diff --git a/net/tap-bsd.c b/net/tap-bsd.c
index XXXXXXX..XXXXXXX 100644
--- a/net/tap-bsd.c
+++ b/net/tap-bsd.c
@@ -XXX,XX +XXX,XX @@
 #include <net/if_tap.h>
 #endif
 
-#if defined(__OpenBSD__)
-#include <sys/param.h>
-#endif
-
 #ifndef __FreeBSD__
 int tap_open(char *ifname, int ifname_size, int *vnet_hdr,
              int vnet_hdr_required, int mq_required, Error **errp)
@@ -XXX,XX +XXX,XX @@ int tap_open(char *ifname, int ifname_size, int *vnet_hdr,
         if (*ifname) {
             snprintf(dname, sizeof dname, "/dev/%s", ifname);
         } else {
-#if defined(__OpenBSD__) && OpenBSD < 201605
-            snprintf(dname, sizeof dname, "/dev/tun%d", i);
-#else
             snprintf(dname, sizeof dname, "/dev/tap%d", i);
-#endif
         }
         TFR(fd = open(dname, O_RDWR));
         if (fd >= 0) {
-- 
2.7.4

The following changes since commit 3f429a3400822141651486193d6af625eeab05a5:

Merge remote-tracking branch 'remotes/kraxel/tags/microvm-20200617-pull-request' into staging (2020-06-18 11:23:15 +0100)

are available in the git repository at:

https://github.com/jasowang/qemu.git tags/net-pull-request

for you to fetch changes up to 71830d8430e65dd20aec4765d87e60336148e1a6:

net: Drop the NetLegacy structure, always use Netdev instead (2020-06-18 21:05:52 +0800)

----------------------------------------------------------------

Changes from V1:
- Fix build failure for virtio-net

----------------------------------------------------------------
Derek Su (1):
      colo-compare: Fix memory leak in packet_enqueue()

Helge Deller (1):
      Fix tulip breakage

Jason Wang (1):
      net: use peer when purging queue in qemu_flush_or_purge_queue_packets()

Lukas Straub (6):
      net/colo-compare.c: Create event_bh with the right AioContext
      chardev/char.c: Use qemu_co_sleep_ns if in coroutine
      net/colo-compare.c: Fix deadlock in compare_chr_send
      net/colo-compare.c: Only hexdump packets if tracing is enabled
      net/colo-compare.c: Check that colo-compare is active
      net/colo-compare.c: Correct ordering in complete and finalize

Philippe Mathieu-Daudé (3):
      hw/net/tulip: Fix 'Descriptor Error' definition
      hw/net/tulip: Log descriptor overflows
      hw/net/e1000e: Do not abort() on invalid PSRCTL register value

Sai Pavan Boddu (11):
      net: cadence_gem: Fix debug statements
      net: cadence_gem: Fix the queue address update during wrap around
      net: cadence_gem: Fix irq update w.r.t queue
      net: cadence_gem: Define access permission for interrupt registers
      net: cadence_gem: Set ISR according to queue in use
      net: cadence_gem: Move tx/rx packet buffert to CadenceGEMState
      net: cadence_gem: Fix up code style
      net: cadence_gem: Add support for jumbo frames
      net: cadnece_gem: Update irq_read_clear field of designcfg_debug1 reg
      net: cadence_gem: Update the reset value for interrupt mask register
      net: cadence_gem: TX_LAST bit should be set by guest

Thomas Huth (2):
      net: Drop the legacy "name" parameter from the -net option
      net: Drop the NetLegacy structure, always use Netdev instead

Tong Ho (1):
      net: cadence_gem: Fix RX address filtering

Yuri Benditovich (7):
      virtio-net: implement RSS configuration command
      virtio-net: implement RX RSS processing
      tap: allow extended virtio header with hash info
      virtio-net: reference implementation of hash report
      vmstate.h: provide VMSTATE_VARRAY_UINT16_ALLOC macro
      virtio-net: add migration support for RSS and hash report
      virtio-net: align RSC fields with updated virtio-net header

From: Yuri Benditovich <yuri.benditovich@daynix.com>

Optionally report RSS feature.
Handle RSS configuration command and keep RSS parameters
in virtio-net device context.

Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/trace-events            |   3 +
 hw/net/virtio-net.c            | 167 ++++++++++++++++++++++++++++++++++++++---
 include/hw/virtio/virtio-net.h |  13 ++++
 3 files changed, 174 insertions(+), 9 deletions(-)

diff --git a/hw/net/trace-events b/hw/net/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/trace-events
+++ b/hw/net/trace-events
@@ -XXX,XX +XXX,XX @@ virtio_net_announce_notify(void) ""
 virtio_net_announce_timer(int round) "%d"
 virtio_net_handle_announce(int round) "%d"
 virtio_net_post_load_device(void)
+virtio_net_rss_disable(void)
+virtio_net_rss_error(const char *msg, uint32_t value) "%s, value 0x%08x"
+virtio_net_rss_enable(uint32_t p1, uint16_t p2, uint8_t p3) "hashes 0x%x, table of %d, key of %d"
 
 # tulip.c
 tulip_reg_write(uint64_t addr, const char *name, int size, uint64_t val) "addr 0x%02"PRIx64" (%s) size %d value 0x%08"PRIx64
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -XXX,XX +XXX,XX @@
    tso/gso/gro 'off'. */
 #define VIRTIO_NET_RSC_DEFAULT_INTERVAL 300000
 
+#define VIRTIO_NET_RSS_SUPPORTED_HASHES (VIRTIO_NET_RSS_HASH_TYPE_IPv4 | \
+                                         VIRTIO_NET_RSS_HASH_TYPE_TCPv4 | \
+                                         VIRTIO_NET_RSS_HASH_TYPE_UDPv4 | \
+                                         VIRTIO_NET_RSS_HASH_TYPE_IPv6 | \
+                                         VIRTIO_NET_RSS_HASH_TYPE_TCPv6 | \
+                                         VIRTIO_NET_RSS_HASH_TYPE_UDPv6 | \
+                                         VIRTIO_NET_RSS_HASH_TYPE_IP_EX | \
+                                         VIRTIO_NET_RSS_HASH_TYPE_TCP_EX | \
+                                         VIRTIO_NET_RSS_HASH_TYPE_UDP_EX)
+
 /* temporary until standard header include it */
 #if !defined(VIRTIO_NET_HDR_F_RSC_INFO)
 
@@ -XXX,XX +XXX,XX @@ static VirtIOFeature feature_sizes[] = {
      .end = endof(struct virtio_net_config, mtu)},
     {.flags = 1ULL << VIRTIO_NET_F_SPEED_DUPLEX,
      .end = endof(struct virtio_net_config, duplex)},
+    {.flags = 1ULL << VIRTIO_NET_F_RSS,
+     .end = endof(struct virtio_net_config, supported_hash_types)},
     {}
 };
 
@@ -XXX,XX +XXX,XX @@ static void virtio_net_get_config(VirtIODevice *vdev, uint8_t *config)
     memcpy(netcfg.mac, n->mac, ETH_ALEN);
     virtio_stl_p(vdev, &netcfg.speed, n->net_conf.speed);
     netcfg.duplex = n->net_conf.duplex;
+    netcfg.rss_max_key_size = VIRTIO_NET_RSS_MAX_KEY_SIZE;
+    virtio_stw_p(vdev, &netcfg.rss_max_indirection_table_length,
+                 VIRTIO_NET_RSS_MAX_TABLE_LEN);
+    virtio_stl_p(vdev, &netcfg.supported_hash_types,
+                 VIRTIO_NET_RSS_SUPPORTED_HASHES);
     memcpy(config, &netcfg, n->config_size);
 }
 
@@ -XXX,XX +XXX,XX @@ static uint64_t virtio_net_get_features(VirtIODevice *vdev, uint64_t features,
         return features;
     }
 
+    virtio_clear_feature(&features, VIRTIO_NET_F_RSS);
     features = vhost_net_get_features(get_vhost_net(nc->peer), features);
     vdev->backend_features = features;
 
@@ -XXX,XX +XXX,XX @@ static void virtio_net_set_features(VirtIODevice *vdev, uint64_t features)
     }
 
     virtio_net_set_multiqueue(n,
+                              virtio_has_feature(features, VIRTIO_NET_F_RSS) ||
                               virtio_has_feature(features, VIRTIO_NET_F_MQ));
 
     virtio_net_set_mrg_rx_bufs(n,
@@ -XXX,XX +XXX,XX @@ static int virtio_net_handle_announce(VirtIONet *n, uint8_t cmd,
     }
 }
 
+static void virtio_net_disable_rss(VirtIONet *n)
+{
+    if (n->rss_data.enabled) {
+        trace_virtio_net_rss_disable();
+    }
+    n->rss_data.enabled = false;
+}
+
+static uint16_t virtio_net_handle_rss(VirtIONet *n,
+                                      struct iovec *iov, unsigned int iov_cnt)
+{
+    VirtIODevice *vdev = VIRTIO_DEVICE(n);
+    struct virtio_net_rss_config cfg;
+    size_t s, offset = 0, size_get;
+    uint16_t queues, i;
+    struct {
+        uint16_t us;
+        uint8_t b;
+    } QEMU_PACKED temp;
+    const char *err_msg = "";
+    uint32_t err_value = 0;
+
+    if (!virtio_vdev_has_feature(vdev, VIRTIO_NET_F_RSS)) {
+        err_msg = "RSS is not negotiated";
+        goto error;
+    }
+    size_get = offsetof(struct virtio_net_rss_config, indirection_table);
+    s = iov_to_buf(iov, iov_cnt, offset, &cfg, size_get);
+    if (s != size_get) {
+        err_msg = "Short command buffer";
+        err_value = (uint32_t)s;
+        goto error;
+    }
+    n->rss_data.hash_types = virtio_ldl_p(vdev, &cfg.hash_types);
+    n->rss_data.indirections_len =
+        virtio_lduw_p(vdev, &cfg.indirection_table_mask);
+    n->rss_data.indirections_len++;
+    if (!is_power_of_2(n->rss_data.indirections_len)) {
+        err_msg = "Invalid size of indirection table";
+        err_value = n->rss_data.indirections_len;
+        goto error;
+    }
+    if (n->rss_data.indirections_len > VIRTIO_NET_RSS_MAX_TABLE_LEN) {
+        err_msg = "Too large indirection table";
+        err_value = n->rss_data.indirections_len;
+        goto error;
+    }
+    n->rss_data.default_queue =
+        virtio_lduw_p(vdev, &cfg.unclassified_queue);
+    if (n->rss_data.default_queue >= n->max_queues) {
+        err_msg = "Invalid default queue";
+        err_value = n->rss_data.default_queue;
+        goto error;
+    }
+    offset += size_get;
+    size_get = sizeof(uint16_t) * n->rss_data.indirections_len;
+    g_free(n->rss_data.indirections_table);
+    n->rss_data.indirections_table = g_malloc(size_get);
+    if (!n->rss_data.indirections_table) {
+        err_msg = "Can't allocate indirections table";
+        err_value = n->rss_data.indirections_len;
+        goto error;
+    }
+    s = iov_to_buf(iov, iov_cnt, offset,
+                   n->rss_data.indirections_table, size_get);
+    if (s != size_get) {
+        err_msg = "Short indirection table buffer";
+        err_value = (uint32_t)s;
+        goto error;
+    }
+    for (i = 0; i < n->rss_data.indirections_len; ++i) {
+        uint16_t val = n->rss_data.indirections_table[i];
+        n->rss_data.indirections_table[i] = virtio_lduw_p(vdev, &val);
+    }
+    offset += size_get;
+    size_get = sizeof(temp);
+    s = iov_to_buf(iov, iov_cnt, offset, &temp, size_get);
+    if (s != size_get) {
+        err_msg = "Can't get queues";
+        err_value = (uint32_t)s;
+        goto error;
+    }
+    queues = virtio_lduw_p(vdev, &temp.us);
+    if (queues == 0 || queues > n->max_queues) {
+        err_msg = "Invalid number of queues";
+        err_value = queues;
+        goto error;
+    }
+    if (temp.b > VIRTIO_NET_RSS_MAX_KEY_SIZE) {
+        err_msg = "Invalid key size";
+        err_value = temp.b;
+        goto error;
+    }
+    if (!temp.b && n->rss_data.hash_types) {
+        err_msg = "No key provided";
+        err_value = 0;
+        goto error;
+    }
+    if (!temp.b && !n->rss_data.hash_types) {
+        virtio_net_disable_rss(n);
+        return queues;
+    }
+    offset += size_get;
+    size_get = temp.b;
+    s = iov_to_buf(iov, iov_cnt, offset, n->rss_data.key, size_get);
+    if (s != size_get) {
+        err_msg = "Can get key buffer";
+        err_value = (uint32_t)s;
+        goto error;
+    }
+    n->rss_data.enabled = true;
+    trace_virtio_net_rss_enable(n->rss_data.hash_types,
+                                n->rss_data.indirections_len,
+                                temp.b);
+    return queues;
+error:
+    trace_virtio_net_rss_error(err_msg, err_value);
+    virtio_net_disable_rss(n);
+    return 0;
+}
+
 static int virtio_net_handle_mq(VirtIONet *n, uint8_t cmd,
                                 struct iovec *iov, unsigned int iov_cnt)
 {
     VirtIODevice *vdev = VIRTIO_DEVICE(n);
-    struct virtio_net_ctrl_mq mq;
-    size_t s;
     uint16_t queues;
 
-    s = iov_to_buf(iov, iov_cnt, 0, &mq, sizeof(mq));
-    if (s != sizeof(mq)) {
-        return VIRTIO_NET_ERR;
-    }
+    virtio_net_disable_rss(n);
+    if (cmd == VIRTIO_NET_CTRL_MQ_RSS_CONFIG) {
+        queues = virtio_net_handle_rss(n, iov, iov_cnt);
+    } else if (cmd == VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET) {
+        struct virtio_net_ctrl_mq mq;
+        size_t s;
+        if (!virtio_vdev_has_feature(vdev, VIRTIO_NET_F_MQ)) {
+            return VIRTIO_NET_ERR;
+        }
+        s = iov_to_buf(iov, iov_cnt, 0, &mq, sizeof(mq));
+        if (s != sizeof(mq)) {
+            return VIRTIO_NET_ERR;
+        }
+        queues = virtio_lduw_p(vdev, &mq.virtqueue_pairs);
 
-    if (cmd != VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET) {
+    } else {
         return VIRTIO_NET_ERR;
     }
 
-    queues = virtio_lduw_p(vdev, &mq.virtqueue_pairs);
-
     if (queues < VIRTIO_NET_CTRL_MQ_VQ_PAIRS_MIN ||
         queues > VIRTIO_NET_CTRL_MQ_VQ_PAIRS_MAX ||
         queues > n->max_queues ||
@@ -XXX,XX +XXX,XX @@ static void virtio_net_device_unrealize(DeviceState *dev)
     g_free(n->vqs);
     qemu_del_nic(n->nic);
     virtio_net_rsc_cleanup(n);
+    g_free(n->rss_data.indirections_table);
     virtio_cleanup(vdev);
 }
 
@@ -XXX,XX +XXX,XX @@ static Property virtio_net_properties[] = {
     DEFINE_PROP_BIT64("ctrl_guest_offloads", VirtIONet, host_features,
                     VIRTIO_NET_F_CTRL_GUEST_OFFLOADS, true),
     DEFINE_PROP_BIT64("mq", VirtIONet, host_features, VIRTIO_NET_F_MQ, false),
+    DEFINE_PROP_BIT64("rss", VirtIONet, host_features,
+                    VIRTIO_NET_F_RSS, false),
     DEFINE_PROP_BIT64("guest_rsc_ext", VirtIONet, host_features,
                     VIRTIO_NET_F_RSC_EXT, false),
     DEFINE_PROP_UINT32("rsc_interval", VirtIONet, rsc_timeout,
diff --git a/include/hw/virtio/virtio-net.h b/include/hw/virtio/virtio-net.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/virtio/virtio-net.h
+++ b/include/hw/virtio/virtio-net.h
@@ -XXX,XX +XXX,XX @@ typedef struct VirtioNetRscChain {
 /* Maximum packet size we can receive from tap device: header + 64k */
 #define VIRTIO_NET_MAX_BUFSIZE (sizeof(struct virtio_net_hdr) + (64 * KiB))
 
+#define VIRTIO_NET_RSS_MAX_KEY_SIZE     40
+#define VIRTIO_NET_RSS_MAX_TABLE_LEN    128
+
+typedef struct VirtioNetRssData {
+    bool    enabled;
+    uint32_t hash_types;
+    uint8_t key[VIRTIO_NET_RSS_MAX_KEY_SIZE];
+    uint16_t indirections_len;
+    uint16_t *indirections_table;
+    uint16_t default_queue;
+} VirtioNetRssData;
+
 typedef struct VirtIONetQueue {
     VirtQueue *rx_vq;
     VirtQueue *tx_vq;
@@ -XXX,XX +XXX,XX @@ struct VirtIONet {
     bool failover;
     DeviceListener primary_listener;
     Notifier migration_state;
+    VirtioNetRssData rss_data;
 };
 
 void virtio_net_set_netclient_name(VirtIONet *n, const char *name,
-- 
2.5.0

From: Yuri Benditovich <yuri.benditovich@daynix.com>

If VIRTIO_NET_F_RSS negotiated and RSS is enabled, process
incoming packets, calculate packet's hash and place the
packet into respective RX virtqueue.

Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/Makefile.objs           |  1 +
 hw/net/virtio-net.c            | 88 +++++++++++++++++++++++++++++++++++++++++-
 include/hw/virtio/virtio-net.h |  1 +
 3 files changed, 88 insertions(+), 2 deletions(-)

diff --git a/hw/net/Makefile.objs b/hw/net/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/Makefile.objs
+++ b/hw/net/Makefile.objs
@@ -XXX,XX +XXX,XX @@ obj-$(CONFIG_MILKYMIST) += milkymist-minimac2.o
 obj-$(CONFIG_PSERIES) += spapr_llan.o
 obj-$(CONFIG_XILINX_ETHLITE) += xilinx_ethlite.o
 
+common-obj-$(CONFIG_VIRTIO_NET) += net_rx_pkt.o
 obj-$(CONFIG_VIRTIO_NET) += virtio-net.o
 common-obj-$(call land,$(CONFIG_VIRTIO_NET),$(CONFIG_VHOST_NET)) += vhost_net.o
 common-obj-$(call lnot,$(call land,$(CONFIG_VIRTIO_NET),$(CONFIG_VHOST_NET))) += vhost_net-stub.o
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -XXX,XX +XXX,XX @@
 #include "trace.h"
 #include "monitor/qdev.h"
 #include "hw/pci/pci.h"
+#include "net_rx_pkt.h"
 
 #define VIRTIO_NET_VM_VERSION    11
 
@@ -XXX,XX +XXX,XX @@ static int receive_filter(VirtIONet *n, const uint8_t *buf, int size)
     return 0;
 }
 
+static uint8_t virtio_net_get_hash_type(bool isip4,
+                                        bool isip6,
+                                        bool isudp,
+                                        bool istcp,
+                                        uint32_t types)
+{
+    if (isip4) {
+        if (istcp && (types & VIRTIO_NET_RSS_HASH_TYPE_TCPv4)) {
+            return NetPktRssIpV4Tcp;
+        }
+        if (isudp && (types & VIRTIO_NET_RSS_HASH_TYPE_UDPv4)) {
+            return NetPktRssIpV4Udp;
+        }
+        if (types & VIRTIO_NET_RSS_HASH_TYPE_IPv4) {
+            return NetPktRssIpV4;
+        }
+    } else if (isip6) {
+        uint32_t mask = VIRTIO_NET_RSS_HASH_TYPE_TCP_EX |
+                        VIRTIO_NET_RSS_HASH_TYPE_TCPv6;
+
+        if (istcp && (types & mask)) {
+            return (types & VIRTIO_NET_RSS_HASH_TYPE_TCP_EX) ?
+                NetPktRssIpV6TcpEx : NetPktRssIpV6Tcp;
+        }
+        mask = VIRTIO_NET_RSS_HASH_TYPE_UDP_EX | VIRTIO_NET_RSS_HASH_TYPE_UDPv6;
+        if (isudp && (types & mask)) {
+            return (types & VIRTIO_NET_RSS_HASH_TYPE_UDP_EX) ?
+                NetPktRssIpV6UdpEx : NetPktRssIpV6Udp;
+        }
+        mask = VIRTIO_NET_RSS_HASH_TYPE_IP_EX | VIRTIO_NET_RSS_HASH_TYPE_IPv6;
+        if (types & mask) {
+            return (types & VIRTIO_NET_RSS_HASH_TYPE_IP_EX) ?
+                NetPktRssIpV6Ex : NetPktRssIpV6;
+        }
+    }
+    return 0xff;
+}
+
+static int virtio_net_process_rss(NetClientState *nc, const uint8_t *buf,
+                                  size_t size)
+{
+    VirtIONet *n = qemu_get_nic_opaque(nc);
+    unsigned int index = nc->queue_index, new_index;
+    struct NetRxPkt *pkt = n->rx_pkt;
+    uint8_t net_hash_type;
+    uint32_t hash;
+    bool isip4, isip6, isudp, istcp;
+
+    net_rx_pkt_set_protocols(pkt, buf + n->host_hdr_len,
+                             size - n->host_hdr_len);
+    net_rx_pkt_get_protocols(pkt, &isip4, &isip6, &isudp, &istcp);
+    if (isip4 && (net_rx_pkt_get_ip4_info(pkt)->fragment)) {
+        istcp = isudp = false;
+    }
+    if (isip6 && (net_rx_pkt_get_ip6_info(pkt)->fragment)) {
+        istcp = isudp = false;
+    }
+    net_hash_type = virtio_net_get_hash_type(isip4, isip6, isudp, istcp,
+                                             n->rss_data.hash_types);
+    if (net_hash_type > NetPktRssIpV6UdpEx) {
+        return n->rss_data.default_queue;
+    }
+
+    hash = net_rx_pkt_calc_rss_hash(pkt, net_hash_type, n->rss_data.key);
+    new_index = hash & (n->rss_data.indirections_len - 1);
+    new_index = n->rss_data.indirections_table[new_index];
+    if (index == new_index) {
+        return -1;
+    }
+    return new_index;
+}
+
 static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
-                                      size_t size)
+                                      size_t size, bool no_rss)
 {
     VirtIONet *n = qemu_get_nic_opaque(nc);
     VirtIONetQueue *q = virtio_net_get_subqueue(nc);
@@ -XXX,XX +XXX,XX @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
         return -1;
     }
 
+    if (!no_rss && n->rss_data.enabled) {
+        int index = virtio_net_process_rss(nc, buf, size);
+        if (index >= 0) {
+            NetClientState *nc2 = qemu_get_subqueue(n->nic, index);
+            return virtio_net_receive_rcu(nc2, buf, size, true);
+        }
+    }
+
     /* hdr_len refers to the header we supply to the guest */
     if (!virtio_net_has_buffers(q, size + n->guest_hdr_len - n->host_hdr_len)) {
         return 0;
@@ -XXX,XX +XXX,XX @@ static ssize_t virtio_net_do_receive(NetClientState *nc, const uint8_t *buf,
 {
     RCU_READ_LOCK_GUARD();
 
-    return virtio_net_receive_rcu(nc, buf, size);
+    return virtio_net_receive_rcu(nc, buf, size, false);
 }
 
 static void virtio_net_rsc_extract_unit4(VirtioNetRscChain *chain,
@@ -XXX,XX +XXX,XX @@ static void virtio_net_device_realize(DeviceState *dev, Error **errp)
 
     QTAILQ_INIT(&n->rsc_chains);
     n->qdev = dev;
+
+    net_rx_pkt_init(&n->rx_pkt, false);
 }
 
 static void virtio_net_device_unrealize(DeviceState *dev)
@@ -XXX,XX +XXX,XX @@ static void virtio_net_device_unrealize(DeviceState *dev)
     qemu_del_nic(n->nic);
     virtio_net_rsc_cleanup(n);
     g_free(n->rss_data.indirections_table);
+    net_rx_pkt_uninit(n->rx_pkt);
     virtio_cleanup(vdev);
 }
 
diff --git a/include/hw/virtio/virtio-net.h b/include/hw/virtio/virtio-net.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/virtio/virtio-net.h
+++ b/include/hw/virtio/virtio-net.h
@@ -XXX,XX +XXX,XX @@ struct VirtIONet {
     DeviceListener primary_listener;
     Notifier migration_state;
     VirtioNetRssData rss_data;
+    struct NetRxPkt *rx_pkt;
 };
 
 void virtio_net_set_netclient_name(VirtIONet *n, const char *name,
-- 
2.5.0

From: Yuri Benditovich <yuri.benditovich@daynix.com>

Suggest VIRTIO_NET_F_HASH_REPORT if specified in device
parameters.
If the VIRTIO_NET_F_HASH_REPORT is set,
the device extends configuration space. If the feature
is negotiated, the packet layout is extended to
accomodate the hash information. In this case deliver
packet's hash value and report type in virtio header
extension.
Use for configuration the same procedure as already
used for RSS. We add two fields in rss_data that
controls what the device does with the calculated hash
if rss_data.enabled is set. If field 'populate' is set
the hash is set in the packet, if field 'redirect' is
set the hash is used to decide the queue to place the
packet to.

Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/virtio-net.c            | 99 +++++++++++++++++++++++++++++++++---------
 include/hw/virtio/virtio-net.h |  2 +
 2 files changed, 81 insertions(+), 20 deletions(-)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -XXX,XX +XXX,XX @@ static VirtIOFeature feature_sizes[] = {
      .end = endof(struct virtio_net_config, mtu)},
     {.flags = 1ULL << VIRTIO_NET_F_SPEED_DUPLEX,
      .end = endof(struct virtio_net_config, duplex)},
-    {.flags = 1ULL << VIRTIO_NET_F_RSS,
+    {.flags = (1ULL << VIRTIO_NET_F_RSS) | (1ULL << VIRTIO_NET_F_HASH_REPORT),
      .end = endof(struct virtio_net_config, supported_hash_types)},
     {}
 };
@@ -XXX,XX +XXX,XX @@ static void virtio_net_get_config(VirtIODevice *vdev, uint8_t *config)
     netcfg.duplex = n->net_conf.duplex;
     netcfg.rss_max_key_size = VIRTIO_NET_RSS_MAX_KEY_SIZE;
     virtio_stw_p(vdev, &netcfg.rss_max_indirection_table_length,
-                 VIRTIO_NET_RSS_MAX_TABLE_LEN);
+                 virtio_host_has_feature(vdev, VIRTIO_NET_F_RSS) ?
+                 VIRTIO_NET_RSS_MAX_TABLE_LEN : 1);
     virtio_stl_p(vdev, &netcfg.supported_hash_types,
                  VIRTIO_NET_RSS_SUPPORTED_HASHES);
     memcpy(config, &netcfg, n->config_size);
@@ -XXX,XX +XXX,XX @@ static int peer_has_ufo(VirtIONet *n)
 }
 
 static void virtio_net_set_mrg_rx_bufs(VirtIONet *n, int mergeable_rx_bufs,
-                                       int version_1)
+                                       int version_1, int hash_report)
 {
     int i;
     NetClientState *nc;
@@ -XXX,XX +XXX,XX @@ static void virtio_net_set_mrg_rx_bufs(VirtIONet *n, int mergeable_rx_bufs,
     n->mergeable_rx_bufs = mergeable_rx_bufs;
 
     if (version_1) {
-        n->guest_hdr_len = sizeof(struct virtio_net_hdr_mrg_rxbuf);
+        n->guest_hdr_len = hash_report ?
+            sizeof(struct virtio_net_hdr_v1_hash) :
+            sizeof(struct virtio_net_hdr_mrg_rxbuf);
+        n->rss_data.populate_hash = !!hash_report;
     } else {
         n->guest_hdr_len = n->mergeable_rx_bufs ?
             sizeof(struct virtio_net_hdr_mrg_rxbuf) :
@@ -XXX,XX +XXX,XX @@ static uint64_t virtio_net_get_features(VirtIODevice *vdev, uint64_t features,
         virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_TSO4);
         virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_TSO6);
         virtio_clear_feature(&features, VIRTIO_NET_F_GUEST_ECN);
+
+        virtio_clear_feature(&features, VIRTIO_NET_F_HASH_REPORT);
     }
 
     if (!peer_has_vnet_hdr(n) || !peer_has_ufo(n)) {
@@ -XXX,XX +XXX,XX @@ static uint64_t virtio_net_get_features(VirtIODevice *vdev, uint64_t features,
     }
 
     virtio_clear_feature(&features, VIRTIO_NET_F_RSS);
+    virtio_clear_feature(&features, VIRTIO_NET_F_HASH_REPORT);
     features = vhost_net_get_features(get_vhost_net(nc->peer), features);
     vdev->backend_features = features;
 
@@ -XXX,XX +XXX,XX @@ static void virtio_net_set_features(VirtIODevice *vdev, uint64_t features)
                                virtio_has_feature(features,
                                                   VIRTIO_NET_F_MRG_RXBUF),
                                virtio_has_feature(features,
-                                                  VIRTIO_F_VERSION_1));
+                                                  VIRTIO_F_VERSION_1),
+                               virtio_has_feature(features,
+                                                  VIRTIO_NET_F_HASH_REPORT));
 
     n->rsc4_enabled = virtio_has_feature(features, VIRTIO_NET_F_RSC_EXT) &&
         virtio_has_feature(features, VIRTIO_NET_F_GUEST_TSO4);
     n->rsc6_enabled = virtio_has_feature(features, VIRTIO_NET_F_RSC_EXT) &&
         virtio_has_feature(features, VIRTIO_NET_F_GUEST_TSO6);
+    n->rss_data.redirect = virtio_has_feature(features, VIRTIO_NET_F_RSS);
 
     if (n->has_vnet_hdr) {
         n->curr_guest_offloads =
@@ -XXX,XX +XXX,XX @@ static void virtio_net_disable_rss(VirtIONet *n)
 }
 
 static uint16_t virtio_net_handle_rss(VirtIONet *n,
-                                      struct iovec *iov, unsigned int iov_cnt)
+                                      struct iovec *iov,
+                                      unsigned int iov_cnt,
+                                      bool do_rss)
 {
     VirtIODevice *vdev = VIRTIO_DEVICE(n);
     struct virtio_net_rss_config cfg;
@@ -XXX,XX +XXX,XX @@ static uint16_t virtio_net_handle_rss(VirtIONet *n,
     const char *err_msg = "";
     uint32_t err_value = 0;
 
-    if (!virtio_vdev_has_feature(vdev, VIRTIO_NET_F_RSS)) {
+    if (do_rss && !virtio_vdev_has_feature(vdev, VIRTIO_NET_F_RSS)) {
         err_msg = "RSS is not negotiated";
         goto error;
     }
+    if (!do_rss && !virtio_vdev_has_feature(vdev, VIRTIO_NET_F_HASH_REPORT)) {
+        err_msg = "Hash report is not negotiated";
+        goto error;
+    }
     size_get = offsetof(struct virtio_net_rss_config, indirection_table);
     s = iov_to_buf(iov, iov_cnt, offset, &cfg, size_get);
     if (s != size_get) {
@@ -XXX,XX +XXX,XX @@ static uint16_t virtio_net_handle_rss(VirtIONet *n,
     n->rss_data.indirections_len =
         virtio_lduw_p(vdev, &cfg.indirection_table_mask);
     n->rss_data.indirections_len++;
+    if (!do_rss) {
+        n->rss_data.indirections_len = 1;
+    }
     if (!is_power_of_2(n->rss_data.indirections_len)) {
         err_msg = "Invalid size of indirection table";
         err_value = n->rss_data.indirections_len;
@@ -XXX,XX +XXX,XX @@ static uint16_t virtio_net_handle_rss(VirtIONet *n,
         err_value = n->rss_data.indirections_len;
         goto error;
     }
-    n->rss_data.default_queue =
-        virtio_lduw_p(vdev, &cfg.unclassified_queue);
+    n->rss_data.default_queue = do_rss ?
+        virtio_lduw_p(vdev, &cfg.unclassified_queue) : 0;
     if (n->rss_data.default_queue >= n->max_queues) {
         err_msg = "Invalid default queue";
         err_value = n->rss_data.default_queue;
@@ -XXX,XX +XXX,XX @@ static uint16_t virtio_net_handle_rss(VirtIONet *n,
         err_value = (uint32_t)s;
         goto error;
     }
-    queues = virtio_lduw_p(vdev, &temp.us);
+    queues = do_rss ? virtio_lduw_p(vdev, &temp.us) : n->curr_queues;
     if (queues == 0 || queues > n->max_queues) {
         err_msg = "Invalid number of queues";
         err_value = queues;
@@ -XXX,XX +XXX,XX @@ static int virtio_net_handle_mq(VirtIONet *n, uint8_t cmd,
     uint16_t queues;
 
     virtio_net_disable_rss(n);
+    if (cmd == VIRTIO_NET_CTRL_MQ_HASH_CONFIG) {
+        queues = virtio_net_handle_rss(n, iov, iov_cnt, false);
+        return queues ? VIRTIO_NET_OK : VIRTIO_NET_ERR;
+    }
     if (cmd == VIRTIO_NET_CTRL_MQ_RSS_CONFIG) {
-        queues = virtio_net_handle_rss(n, iov, iov_cnt);
+        queues = virtio_net_handle_rss(n, iov, iov_cnt, true);
     } else if (cmd == VIRTIO_NET_CTRL_MQ_VQ_PAIRS_SET) {
         struct virtio_net_ctrl_mq mq;
         size_t s;
@@ -XXX,XX +XXX,XX @@ static uint8_t virtio_net_get_hash_type(bool isip4,
     return 0xff;
 }
 
+static void virtio_set_packet_hash(const uint8_t *buf, uint8_t report,
+                                   uint32_t hash)
+{
+    struct virtio_net_hdr_v1_hash *hdr = (void *)buf;
+    hdr->hash_value = hash;
+    hdr->hash_report = report;
+}
+
 static int virtio_net_process_rss(NetClientState *nc, const uint8_t *buf,
                                   size_t size)
 {
     VirtIONet *n = qemu_get_nic_opaque(nc);
-    unsigned int index = nc->queue_index, new_index;
+    unsigned int index = nc->queue_index, new_index = index;
     struct NetRxPkt *pkt = n->rx_pkt;
     uint8_t net_hash_type;
     uint32_t hash;
     bool isip4, isip6, isudp, istcp;
+    static const uint8_t reports[NetPktRssIpV6UdpEx + 1] = {
+        VIRTIO_NET_HASH_REPORT_IPv4,
+        VIRTIO_NET_HASH_REPORT_TCPv4,
+        VIRTIO_NET_HASH_REPORT_TCPv6,
+        VIRTIO_NET_HASH_REPORT_IPv6,
+        VIRTIO_NET_HASH_REPORT_IPv6_EX,
+        VIRTIO_NET_HASH_REPORT_TCPv6_EX,
+        VIRTIO_NET_HASH_REPORT_UDPv4,
+        VIRTIO_NET_HASH_REPORT_UDPv6,
+        VIRTIO_NET_HASH_REPORT_UDPv6_EX
+    };
 
     net_rx_pkt_set_protocols(pkt, buf + n->host_hdr_len,
                              size - n->host_hdr_len);
@@ -XXX,XX +XXX,XX @@ static int virtio_net_process_rss(NetClientState *nc, const uint8_t *buf,
     net_hash_type = virtio_net_get_hash_type(isip4, isip6, isudp, istcp,
                                              n->rss_data.hash_types);
     if (net_hash_type > NetPktRssIpV6UdpEx) {
-        return n->rss_data.default_queue;
+        if (n->rss_data.populate_hash) {
+            virtio_set_packet_hash(buf, VIRTIO_NET_HASH_REPORT_NONE, 0);
+        }
+        return n->rss_data.redirect ? n->rss_data.default_queue : -1;
     }
 
     hash = net_rx_pkt_calc_rss_hash(pkt, net_hash_type, n->rss_data.key);
-    new_index = hash & (n->rss_data.indirections_len - 1);
-    new_index = n->rss_data.indirections_table[new_index];
-    if (index == new_index) {
-        return -1;
+
+    if (n->rss_data.populate_hash) {
+        virtio_set_packet_hash(buf, reports[net_hash_type], hash);
     }
-    return new_index;
+
+    if (n->rss_data.redirect) {
+        new_index = hash & (n->rss_data.indirections_len - 1);
+        new_index = n->rss_data.indirections_table[new_index];
+    }
+
+    return (index == new_index) ? -1 : new_index;
 }
 
 static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
@@ -XXX,XX +XXX,XX @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
             }
 
             receive_header(n, sg, elem->in_num, buf, size);
+            if (n->rss_data.populate_hash) {
+                offset = sizeof(mhdr);
+                iov_from_buf(sg, elem->in_num, offset,
+                             buf + offset, n->host_hdr_len - sizeof(mhdr));
+            }
             offset = n->host_hdr_len;
             total += n->guest_hdr_len;
             guest_offset = n->guest_hdr_len;
@@ -XXX,XX +XXX,XX @@ static int virtio_net_post_load_device(void *opaque, int version_id)
     trace_virtio_net_post_load_device();
     virtio_net_set_mrg_rx_bufs(n, n->mergeable_rx_bufs,
                                virtio_vdev_has_feature(vdev,
-                                                       VIRTIO_F_VERSION_1));
+                                                       VIRTIO_F_VERSION_1),
+                               virtio_vdev_has_feature(vdev,
+                                                       VIRTIO_NET_F_HASH_REPORT));
 
     /* MAC_TABLE_ENTRIES may be different from the saved image */
     if (n->mac_table.in_use > MAC_TABLE_ENTRIES) {
@@ -XXX,XX +XXX,XX @@ static void virtio_net_device_realize(DeviceState *dev, Error **errp)
 
     n->vqs[0].tx_waiting = 0;
     n->tx_burst = n->net_conf.txburst;
-    virtio_net_set_mrg_rx_bufs(n, 0, 0);
+    virtio_net_set_mrg_rx_bufs(n, 0, 0, 0);
     n->promisc = 1; /* for compatibility */
 
     n->mac_table.macs = g_malloc0(MAC_TABLE_ENTRIES * ETH_ALEN);
@@ -XXX,XX +XXX,XX @@ static Property virtio_net_properties[] = {
     DEFINE_PROP_BIT64("mq", VirtIONet, host_features, VIRTIO_NET_F_MQ, false),
     DEFINE_PROP_BIT64("rss", VirtIONet, host_features,
                     VIRTIO_NET_F_RSS, false),
+    DEFINE_PROP_BIT64("hash", VirtIONet, host_features,
+                    VIRTIO_NET_F_HASH_REPORT, false),
     DEFINE_PROP_BIT64("guest_rsc_ext", VirtIONet, host_features,
                     VIRTIO_NET_F_RSC_EXT, false),
     DEFINE_PROP_UINT32("rsc_interval", VirtIONet, rsc_timeout,
diff --git a/include/hw/virtio/virtio-net.h b/include/hw/virtio/virtio-net.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/virtio/virtio-net.h
+++ b/include/hw/virtio/virtio-net.h
@@ -XXX,XX +XXX,XX @@ typedef struct VirtioNetRscChain {
 
 typedef struct VirtioNetRssData {
     bool    enabled;
+    bool    redirect;
+    bool    populate_hash;
     uint32_t hash_types;
     uint8_t key[VIRTIO_NET_RSS_MAX_KEY_SIZE];
     uint16_t indirections_len;
-- 
2.5.0

From: Yuri Benditovich <yuri.benditovich@daynix.com>

Similar to VMSTATE_VARRAY_UINT32_ALLOC, but the size is
16-bit field.

Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 include/migration/vmstate.h | 10 ++++++++++
 1 file changed, 10 insertions(+)

diff --git a/include/migration/vmstate.h b/include/migration/vmstate.h
index XXXXXXX..XXXXXXX 100644
--- a/include/migration/vmstate.h
+++ b/include/migration/vmstate.h
@@ -XXX,XX +XXX,XX @@ extern const VMStateInfo vmstate_info_qlist;
     .offset     = vmstate_offset_pointer(_state, _field, _type),     \
 }
 
+#define VMSTATE_VARRAY_UINT16_ALLOC(_field, _state, _field_num, _version, _info, _type) {\
+    .name       = (stringify(_field)),                               \
+    .version_id = (_version),                                        \
+    .num_offset = vmstate_offset_value(_state, _field_num, uint16_t),\
+    .info       = &(_info),                                          \
+    .size       = sizeof(_type),                                     \
+    .flags      = VMS_VARRAY_UINT16 | VMS_POINTER | VMS_ALLOC,       \
+    .offset     = vmstate_offset_pointer(_state, _field, _type),     \
+}
+
 #define VMSTATE_VARRAY_UINT16_UNSAFE(_field, _state, _field_num, _version, _info, _type) {\
     .name       = (stringify(_field)),                               \
     .version_id = (_version),                                        \
-- 
2.5.0

From: Yuri Benditovich <yuri.benditovich@daynix.com>

Save and restore RSS/hash report configuration.

Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/virtio-net.c | 37 +++++++++++++++++++++++++++++++++++++
 1 file changed, 37 insertions(+)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -XXX,XX +XXX,XX @@ static int virtio_net_post_load_device(void *opaque, int version_id)
         }
     }
 
+    if (n->rss_data.enabled) {
+        trace_virtio_net_rss_enable(n->rss_data.hash_types,
+                                    n->rss_data.indirections_len,
+                                    sizeof(n->rss_data.key));
+    } else {
+        trace_virtio_net_rss_disable();
+    }
     return 0;
 }
 
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_virtio_net_has_vnet = {
     },
 };
 
+static bool virtio_net_rss_needed(void *opaque)
+{
+    return VIRTIO_NET(opaque)->rss_data.enabled;
+}
+
+static const VMStateDescription vmstate_virtio_net_rss = {
+    .name      = "virtio-net-device/rss",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .needed = virtio_net_rss_needed,
+    .fields = (VMStateField[]) {
+        VMSTATE_BOOL(rss_data.enabled, VirtIONet),
+        VMSTATE_BOOL(rss_data.redirect, VirtIONet),
+        VMSTATE_BOOL(rss_data.populate_hash, VirtIONet),
+        VMSTATE_UINT32(rss_data.hash_types, VirtIONet),
+        VMSTATE_UINT16(rss_data.indirections_len, VirtIONet),
+        VMSTATE_UINT16(rss_data.default_queue, VirtIONet),
+        VMSTATE_UINT8_ARRAY(rss_data.key, VirtIONet,
+                            VIRTIO_NET_RSS_MAX_KEY_SIZE),
+        VMSTATE_VARRAY_UINT16_ALLOC(rss_data.indirections_table, VirtIONet,
+                                    rss_data.indirections_len, 0,
+                                    vmstate_info_uint16, uint16_t),
+        VMSTATE_END_OF_LIST()
+    },
+};
+
 static const VMStateDescription vmstate_virtio_net_device = {
     .name = "virtio-net-device",
     .version_id = VIRTIO_NET_VM_VERSION,
@@ -XXX,XX +XXX,XX @@ static const VMStateDescription vmstate_virtio_net_device = {
                             has_ctrl_guest_offloads),
         VMSTATE_END_OF_LIST()
    },
+    .subsections = (const VMStateDescription * []) {
+        &vmstate_virtio_net_rss,
+        NULL
+    }
 };
 
 static NetClientInfo net_virtio_info = {
-- 
2.5.0

From: Yuri Benditovich <yuri.benditovich@daynix.com>

Removal of duplicated RSC definitions. Changing names of the
fields to ones defined in the Linux header.

Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/virtio-net.c | 28 ++++------------------------
 1 file changed, 4 insertions(+), 24 deletions(-)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -XXX,XX +XXX,XX @@
                                          VIRTIO_NET_RSS_HASH_TYPE_TCP_EX | \
                                          VIRTIO_NET_RSS_HASH_TYPE_UDP_EX)
 
-/* temporary until standard header include it */
-#if !defined(VIRTIO_NET_HDR_F_RSC_INFO)
-
-#define VIRTIO_NET_HDR_F_RSC_INFO  4 /* rsc_ext data in csum_ fields */
-#define VIRTIO_NET_F_RSC_EXT       61
-
-#endif
-
-static inline __virtio16 *virtio_net_rsc_ext_num_packets(
-    struct virtio_net_hdr *hdr)
-{
-    return &hdr->csum_start;
-}
-
-static inline __virtio16 *virtio_net_rsc_ext_num_dupacks(
-    struct virtio_net_hdr *hdr)
-{
-    return &hdr->csum_offset;
-}
-
 static VirtIOFeature feature_sizes[] = {
     {.flags = 1ULL << VIRTIO_NET_F_MAC,
      .end = endof(struct virtio_net_config, mac)},
@@ -XXX,XX +XXX,XX @@ static size_t virtio_net_rsc_drain_seg(VirtioNetRscChain *chain,
                                        VirtioNetRscSeg *seg)
 {
     int ret;
-    struct virtio_net_hdr *h;
+    struct virtio_net_hdr_v1 *h;
 
-    h = (struct virtio_net_hdr *)seg->buf;
+    h = (struct virtio_net_hdr_v1 *)seg->buf;
     h->flags = 0;
     h->gso_type = VIRTIO_NET_HDR_GSO_NONE;
 
     if (seg->is_coalesced) {
-        *virtio_net_rsc_ext_num_packets(h) = seg->packets;
-        *virtio_net_rsc_ext_num_dupacks(h) = seg->dup_ack;
+        h->rsc.segments = seg->packets;
+        h->rsc.dup_acks = seg->dup_ack;
         h->flags = VIRTIO_NET_HDR_F_RSC_INFO;
         if (chain->proto == ETH_P_IP) {
             h->gso_type = VIRTIO_NET_HDR_GSO_TCPV4;
-- 
2.5.0

From: Helge Deller <deller@gmx.de>

The tulip network driver in a qemu-system-hppa emulation is broken in
the sense that bigger network packages aren't received any longer and
thus even running e.g. "apt update" inside the VM fails.

The breakage was introduced by commit 8ffb7265af ("check frame size and
r/w data length") which added checks to prevent accesses outside of the
rx/tx buffers.

But the new checks were implemented wrong. The variable rx_frame_len
counts backwards, from rx_frame_size down to zero, and the variable len
is never bigger than rx_frame_len, so accesses just can't happen and the
checks are unnecessary.
On the contrary the checks now prevented bigger packages to be moved
into the rx buffers.

This patch reverts the wrong checks and were sucessfully tested with a
qemu-system-hppa emulation.

Fixes: 8ffb7265af ("check frame size and r/w data length")
Buglink: https://bugs.launchpad.net/bugs/1874539
Signed-off-by: Helge Deller <deller@gmx.de>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/tulip.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/hw/net/tulip.c b/hw/net/tulip.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/tulip.c
+++ b/hw/net/tulip.c
@@ -XXX,XX +XXX,XX @@ static void tulip_copy_rx_bytes(TULIPState *s, struct tulip_descriptor *desc)
             len = s->rx_frame_len;
         }
 
-        if (s->rx_frame_len + len > sizeof(s->rx_frame)) {
-            return;
-        }
         pci_dma_write(&s->dev, desc->buf_addr1, s->rx_frame +
             (s->rx_frame_size - s->rx_frame_len), len);
         s->rx_frame_len -= len;
@@ -XXX,XX +XXX,XX @@ static void tulip_copy_rx_bytes(TULIPState *s, struct tulip_descriptor *desc)
             len = s->rx_frame_len;
         }
 
-        if (s->rx_frame_len + len > sizeof(s->rx_frame)) {
-            return;
-        }
         pci_dma_write(&s->dev, desc->buf_addr2, s->rx_frame +
             (s->rx_frame_size - s->rx_frame_len), len);
         s->rx_frame_len -= len;
-- 
2.5.0

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

Log with GUEST_ERROR what the guest is doing wrong.

Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/tulip.c | 6 ++++++
 1 file changed, 6 insertions(+)

diff --git a/hw/net/tulip.c b/hw/net/tulip.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/tulip.c
+++ b/hw/net/tulip.c
@@ -XXX,XX +XXX,XX @@ static int tulip_copy_tx_buffers(TULIPState *s, struct tulip_descriptor *desc)
     int len2 = (desc->control >> TDES1_BUF2_SIZE_SHIFT) & TDES1_BUF2_SIZE_MASK;
 
     if (s->tx_frame_len + len1 > sizeof(s->tx_frame)) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: descriptor overflow (ofs: %u, len:%d, size:%zu)\n",
+                      __func__, s->tx_frame_len, len1, sizeof(s->tx_frame));
         return -1;
     }
     if (len1) {
@@ -XXX,XX +XXX,XX @@ static int tulip_copy_tx_buffers(TULIPState *s, struct tulip_descriptor *desc)
     }
 
     if (s->tx_frame_len + len2 > sizeof(s->tx_frame)) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: descriptor overflow (ofs: %u, len:%d, size:%zu)\n",
+                      __func__, s->tx_frame_len, len2, sizeof(s->tx_frame));
         return -1;
     }
     if (len2) {
-- 
2.5.0

From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>

Enabling debug breaks the build, Fix them and make debug statements
always compilable. Fix few statements to use sized integer casting.

Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/cadence_gem.c | 27 +++++++++++++--------------
 1 file changed, 13 insertions(+), 14 deletions(-)

diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -XXX,XX +XXX,XX @@
 #include "sysemu/dma.h"
 #include "net/checksum.h"
 
-#ifdef CADENCE_GEM_ERR_DEBUG
-#define DB_PRINT(...) do { \
-    fprintf(stderr,  ": %s: ", __func__); \
-    fprintf(stderr, ## __VA_ARGS__); \
-    } while (0)
-#else
-    #define DB_PRINT(...)
-#endif
+#define CADENCE_GEM_ERR_DEBUG 0
+#define DB_PRINT(...) do {\
+    if (CADENCE_GEM_ERR_DEBUG) {   \
+        qemu_log(": %s: ", __func__); \
+        qemu_log(__VA_ARGS__); \
+    } \
+} while (0)
 
 #define GEM_NWCTRL        (0x00000000/4) /* Network Control reg */
 #define GEM_NWCFG         (0x00000004/4) /* Network Config reg */
@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
         size += 4;
     }
 
-    DB_PRINT("config bufsize: %d packet size: %ld\n", rxbufsize, size);
+    DB_PRINT("config bufsize: %u packet size: %zd\n", rxbufsize, size);
 
     /* Find which queue we are targeting */
     q = get_queue_from_screen(s, rxbuf_ptr, rxbufsize);
@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
             return -1;
         }
 
-        DB_PRINT("copy %u bytes to 0x%" PRIx64 "\n",
-                 MIN(bytes_to_copy, rxbufsize),
-                 rx_desc_get_buffer(s, s->rx_desc[q]));
+        DB_PRINT("copy %" PRIu32 " bytes to 0x%" PRIx64 "\n",
+                MIN(bytes_to_copy, rxbufsize),
+                rx_desc_get_buffer(s, s->rx_desc[q]));
 
         /* Copy packet data to emulated DMA buffer */
         address_space_write(&s->dma_as, rx_desc_get_buffer(s, s->rx_desc[q]) +
@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
              */
             if ((tx_desc_get_buffer(s, desc) == 0) ||
                 (tx_desc_get_length(desc) == 0)) {
-                DB_PRINT("Invalid TX descriptor @ 0x%x\n",
-                         (unsigned)packet_desc_addr);
+                DB_PRINT("Invalid TX descriptor @ 0x%" HWADDR_PRIx "\n",
+                         packet_desc_addr);
                 break;
             }
 
-- 
2.5.0

From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>

During wrap around and reset, queues are pointing to initial base
address of queue 0, irrespective of what queue we are dealing with.
Fix it by assigning proper base address every time.

Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/cadence_gem.c | 37 +++++++++++++++++++++++++++++++++----
 1 file changed, 33 insertions(+), 4 deletions(-)

diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -XXX,XX +XXX,XX @@ static int get_queue_from_screen(CadenceGEMState *s, uint8_t *rxbuf_ptr,
     return 0;
 }
 
+static uint32_t gem_get_queue_base_addr(CadenceGEMState *s, bool tx, int q)
+{
+    uint32_t base_addr = 0;
+
+    switch (q) {
+    case 0:
+        base_addr = s->regs[tx ? GEM_TXQBASE : GEM_RXQBASE];
+        break;
+    case 1 ... (MAX_PRIORITY_QUEUES - 1):
+        base_addr = s->regs[(tx ? GEM_TRANSMIT_Q1_PTR :
+                                 GEM_RECEIVE_Q1_PTR) + q - 1];
+        break;
+    default:
+        g_assert_not_reached();
+    };
+
+    return base_addr;
+}
+
+static inline uint32_t gem_get_tx_queue_base_addr(CadenceGEMState *s, int q)
+{
+    return gem_get_queue_base_addr(s, true, q);
+}
+
+static inline uint32_t gem_get_rx_queue_base_addr(CadenceGEMState *s, int q)
+{
+    return gem_get_queue_base_addr(s, false, q);
+}
+
 static hwaddr gem_get_desc_addr(CadenceGEMState *s, bool tx, int q)
 {
     hwaddr desc_addr = 0;
@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
         /* Next descriptor */
         if (rx_desc_get_wrap(s->rx_desc[q])) {
             DB_PRINT("wrapping RX descriptor list\n");
-            s->rx_desc_addr[q] = s->regs[GEM_RXQBASE];
+            s->rx_desc_addr[q] = gem_get_rx_queue_base_addr(s, q);
         } else {
             DB_PRINT("incrementing RX descriptor list\n");
             s->rx_desc_addr[q] += 4 * gem_get_desc_len(s, true);
@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
                                     sizeof(desc_first));
                 /* Advance the hardware current descriptor past this packet */
                 if (tx_desc_get_wrap(desc)) {
-                    s->tx_desc_addr[q] = s->regs[GEM_TXQBASE];
+                    s->tx_desc_addr[q] = gem_get_tx_queue_base_addr(s, q);
                 } else {
                     s->tx_desc_addr[q] = packet_desc_addr +
                                          4 * gem_get_desc_len(s, false);
@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
                 } else {
                     packet_desc_addr = 0;
                 }
-                packet_desc_addr |= s->regs[GEM_TXQBASE];
+                packet_desc_addr |= gem_get_tx_queue_base_addr(s, q);
             } else {
                 packet_desc_addr += 4 * gem_get_desc_len(s, false);
             }
@@ -XXX,XX +XXX,XX @@ static void gem_write(void *opaque, hwaddr offset, uint64_t val,
         if (!(val & GEM_NWCTRL_TXENA)) {
             /* Reset to start of Q when transmit disabled. */
             for (i = 0; i < s->num_priority_queues; i++) {
-                s->tx_desc_addr[i] = s->regs[GEM_TXQBASE];
+                s->tx_desc_addr[i] = gem_get_tx_queue_base_addr(s, i);
             }
         }
         if (gem_can_receive(qemu_get_queue(s->nic))) {
-- 
2.5.0

From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>

Set irq's specific to a queue, present implementation is setting q1 irq
based on q0 status.

Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/cadence_gem.c | 25 +++----------------------
 1 file changed, 3 insertions(+), 22 deletions(-)

diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -XXX,XX +XXX,XX @@ static void gem_update_int_status(CadenceGEMState *s)
 {
     int i;
 
-    if (!s->regs[GEM_ISR]) {
-        /* ISR isn't set, clear all the interrupts */
-        for (i = 0; i < s->num_priority_queues; ++i) {
-            qemu_set_irq(s->irq[i], 0);
-        }
-        return;
-    }
+    qemu_set_irq(s->irq[0], !!s->regs[GEM_ISR]);
 
-    /* If we get here we know s->regs[GEM_ISR] is set, so we don't need to
-     * check it again.
-     */
-    if (s->num_priority_queues == 1) {
-        /* No priority queues, just trigger the interrupt */
-        DB_PRINT("asserting int.\n");
-        qemu_set_irq(s->irq[0], 1);
-        return;
-    }
-
-    for (i = 0; i < s->num_priority_queues; ++i) {
-        if (s->regs[GEM_INT_Q1_STATUS + i]) {
-            DB_PRINT("asserting int. (q=%d)\n", i);
-            qemu_set_irq(s->irq[i], 1);
-        }
+    for (i = 1; i < s->num_priority_queues; ++i) {
+        qemu_set_irq(s->irq[i], !!s->regs[GEM_INT_Q1_STATUS + i - 1]);
     }
 }
 
-- 
2.5.0

From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>

Q1 to Q7 ISR's are clear-on-read, IER/IDR registers
are write-only, mask reg are read-only.

Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/cadence_gem.c | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -XXX,XX +XXX,XX @@ static const uint8_t broadcast_addr[] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
  */
 static void gem_init_register_masks(CadenceGEMState *s)
 {
+    unsigned int i;
     /* Mask of register bits which are read only */
     memset(&s->regs_ro[0], 0, sizeof(s->regs_ro));
     s->regs_ro[GEM_NWCTRL]   = 0xFFF80000;
@@ -XXX,XX +XXX,XX @@ static void gem_init_register_masks(CadenceGEMState *s)
     s->regs_ro[GEM_ISR]      = 0xFFFFFFFF;
     s->regs_ro[GEM_IMR]      = 0xFFFFFFFF;
     s->regs_ro[GEM_MODID]    = 0xFFFFFFFF;
+    for (i = 0; i < s->num_priority_queues; i++) {
+        s->regs_ro[GEM_INT_Q1_STATUS + i] = 0xFFFFFFFF;
+        s->regs_ro[GEM_INT_Q1_ENABLE + i] = 0xFFFFF319;
+        s->regs_ro[GEM_INT_Q1_DISABLE + i] = 0xFFFFF319;
+        s->regs_ro[GEM_INT_Q1_MASK + i] = 0xFFFFFFFF;
+    }
 
     /* Mask of register bits which are clear on read */
     memset(&s->regs_rtc[0], 0, sizeof(s->regs_rtc));
     s->regs_rtc[GEM_ISR]      = 0xFFFFFFFF;
+    for (i = 0; i < s->num_priority_queues; i++) {
+        s->regs_rtc[GEM_INT_Q1_STATUS + i] = 0x00000CE6;
+    }
 
     /* Mask of register bits which are write 1 to clear */
     memset(&s->regs_w1c[0], 0, sizeof(s->regs_w1c));
@@ -XXX,XX +XXX,XX @@ static void gem_init_register_masks(CadenceGEMState *s)
     s->regs_wo[GEM_NWCTRL]   = 0x00073E60;
     s->regs_wo[GEM_IER]      = 0x07FFFFFF;
     s->regs_wo[GEM_IDR]      = 0x07FFFFFF;
+    for (i = 0; i < s->num_priority_queues; i++) {
+        s->regs_wo[GEM_INT_Q1_ENABLE + i] = 0x00000CE6;
+        s->regs_wo[GEM_INT_Q1_DISABLE + i] = 0x00000CE6;
+    }
 }
 
 /*
-- 
2.5.0

From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>

Set ISR according to queue in use, added interrupt support for
all queues.

Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/cadence_gem.c | 27 +++++++++++++++++----------
 1 file changed, 17 insertions(+), 10 deletions(-)

diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -XXX,XX +XXX,XX @@ static inline void rx_desc_set_sar(uint32_t *desc, int sar_idx)
 /* The broadcast MAC address: 0xFFFFFFFFFFFF */
 static const uint8_t broadcast_addr[] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
 
+static void gem_set_isr(CadenceGEMState *s, int q, uint32_t flag)
+{
+    if (q == 0) {
+        s->regs[GEM_ISR] |= flag & ~(s->regs[GEM_IMR]);
+    } else {
+        s->regs[GEM_INT_Q1_STATUS + q - 1] |= flag &
+                                      ~(s->regs[GEM_INT_Q1_MASK + q - 1]);
+    }
+}
+
 /*
  * gem_init_register_masks:
  * One time initialization.
@@ -XXX,XX +XXX,XX @@ static void gem_get_rx_desc(CadenceGEMState *s, int q)
     if (rx_desc_get_ownership(s->rx_desc[q]) == 1) {
         DB_PRINT("descriptor 0x%" HWADDR_PRIx " owned by sw.\n", desc_addr);
         s->regs[GEM_RXSTATUS] |= GEM_RXSTATUS_NOBUF;
-        s->regs[GEM_ISR] |= GEM_INT_RXUSED & ~(s->regs[GEM_IMR]);
+        gem_set_isr(s, q, GEM_INT_RXUSED);
         /* Handle interrupt consequences */
         gem_update_int_status(s);
     }
@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
     gem_receive_updatestats(s, buf, size);
 
     s->regs[GEM_RXSTATUS] |= GEM_RXSTATUS_FRMRCVD;
-    s->regs[GEM_ISR] |= GEM_INT_RXCMPL & ~(s->regs[GEM_IMR]);
+    gem_set_isr(s, q, GEM_INT_RXCMPL);
 
     /* Handle interrupt consequences */
     gem_update_int_status(s);
@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
                 DB_PRINT("TX descriptor next: 0x%08x\n", s->tx_desc_addr[q]);
 
                 s->regs[GEM_TXSTATUS] |= GEM_TXSTATUS_TXCMPL;
-                s->regs[GEM_ISR] |= GEM_INT_TXCMPL & ~(s->regs[GEM_IMR]);
-
-                /* Update queue interrupt status */
-                if (s->num_priority_queues > 1) {
-                    s->regs[GEM_INT_Q1_STATUS + q] |=
-                            GEM_INT_TXCMPL & ~(s->regs[GEM_INT_Q1_MASK + q]);
-                }
+                gem_set_isr(s, q, GEM_INT_TXCMPL);
 
                 /* Handle interrupt consequences */
                 gem_update_int_status(s);
@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
 
         if (tx_desc_get_used(desc)) {
             s->regs[GEM_TXSTATUS] |= GEM_TXSTATUS_USED;
-            s->regs[GEM_ISR] |= GEM_INT_TXUSED & ~(s->regs[GEM_IMR]);
+            /* IRQ TXUSED is defined only for queue 0 */
+            if (q == 0) {
+                gem_set_isr(s, 0, GEM_INT_TXUSED);
+            }
             gem_update_int_status(s);
         }
     }
-- 
2.5.0

From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>

Moving this buffers to CadenceGEMState, as their size will be increased
more when JUMBO frames support is added.

Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/cadence_gem.c         | 38 +++++++++++++++++---------------------
 include/hw/net/cadence_gem.h |  4 ++++
 2 files changed, 21 insertions(+), 21 deletions(-)

diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -XXX,XX +XXX,XX @@ static void gem_get_rx_desc(CadenceGEMState *s, int q)
  */
 static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
 {
-    CadenceGEMState *s;
+    CadenceGEMState *s = qemu_get_nic_opaque(nc);
     unsigned   rxbufsize, bytes_to_copy;
     unsigned   rxbuf_offset;
-    uint8_t    rxbuf[2048];
     uint8_t   *rxbuf_ptr;
     bool first_desc = true;
     int maf;
     int q = 0;
 
-    s = qemu_get_nic_opaque(nc);
-
     /* Is this destination MAC address "for us" ? */
     maf = gem_mac_address_filter(s, buf);
     if (maf == GEM_RX_REJECT) {
@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
     } else {
         unsigned crc_val;
 
-        if (size > sizeof(rxbuf) - sizeof(crc_val)) {
-            size = sizeof(rxbuf) - sizeof(crc_val);
+        if (size > MAX_FRAME_SIZE - sizeof(crc_val)) {
+            size = MAX_FRAME_SIZE - sizeof(crc_val);
         }
         bytes_to_copy = size;
         /* The application wants the FCS field, which QEMU does not provide.
          * We must try and calculate one.
          */
 
-        memcpy(rxbuf, buf, size);
-        memset(rxbuf + size, 0, sizeof(rxbuf) - size);
-        rxbuf_ptr = rxbuf;
-        crc_val = cpu_to_le32(crc32(0, rxbuf, MAX(size, 60)));
-        memcpy(rxbuf + size, &crc_val, sizeof(crc_val));
+        memcpy(s->rx_packet, buf, size);
+        memset(s->rx_packet + size, 0, MAX_FRAME_SIZE - size);
+        rxbuf_ptr = s->rx_packet;
+        crc_val = cpu_to_le32(crc32(0, s->rx_packet, MAX(size, 60)));
+        memcpy(s->rx_packet + size, &crc_val, sizeof(crc_val));
 
         bytes_to_copy += 4;
         size += 4;
@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
 {
     uint32_t desc[DESC_MAX_NUM_WORDS];
     hwaddr packet_desc_addr;
-    uint8_t     tx_packet[2048];
     uint8_t     *p;
     unsigned    total_bytes;
     int q = 0;
@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
      * Packets scattered across multiple descriptors are gathered to this
      * one contiguous buffer first.
      */
-    p = tx_packet;
+    p = s->tx_packet;
     total_bytes = 0;
 
     for (q = s->num_priority_queues - 1; q >= 0; q--) {
@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
                 break;
             }
 
-            if (tx_desc_get_length(desc) > sizeof(tx_packet) -
-                                               (p - tx_packet)) {
+            if (tx_desc_get_length(desc) > MAX_FRAME_SIZE -
+                                               (p - s->tx_packet)) {
                 DB_PRINT("TX descriptor @ 0x%" HWADDR_PRIx \
                          " too large: size 0x%x space 0x%zx\n",
                          packet_desc_addr, tx_desc_get_length(desc),
-                         sizeof(tx_packet) - (p - tx_packet));
+                         MAX_FRAME_SIZE - (p - s->tx_packet));
                 break;
             }
 
@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
 
                 /* Is checksum offload enabled? */
                 if (s->regs[GEM_DMACFG] & GEM_DMACFG_TXCSUM_OFFL) {
-                    net_checksum_calculate(tx_packet, total_bytes);
+                    net_checksum_calculate(s->tx_packet, total_bytes);
                 }
 
                 /* Update MAC statistics */
-                gem_transmit_updatestats(s, tx_packet, total_bytes);
+                gem_transmit_updatestats(s, s->tx_packet, total_bytes);
 
                 /* Send the packet somewhere */
                 if (s->phy_loop || (s->regs[GEM_NWCTRL] &
                                     GEM_NWCTRL_LOCALLOOP)) {
-                    gem_receive(qemu_get_queue(s->nic), tx_packet,
+                    gem_receive(qemu_get_queue(s->nic), s->tx_packet,
                                 total_bytes);
                 } else {
-                    qemu_send_packet(qemu_get_queue(s->nic), tx_packet,
+                    qemu_send_packet(qemu_get_queue(s->nic), s->tx_packet,
                                      total_bytes);
                 }
 
                 /* Prepare for next packet */
-                p = tx_packet;
+                p = s->tx_packet;
                 total_bytes = 0;
             }
 
diff --git a/include/hw/net/cadence_gem.h b/include/hw/net/cadence_gem.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/net/cadence_gem.h
+++ b/include/hw/net/cadence_gem.h
@@ -XXX,XX +XXX,XX @@
 #define MAX_TYPE1_SCREENERS             16
 #define MAX_TYPE2_SCREENERS             16
 
+#define MAX_FRAME_SIZE 2048
+
 typedef struct CadenceGEMState {
     /*< private >*/
     SysBusDevice parent_obj;
@@ -XXX,XX +XXX,XX @@ typedef struct CadenceGEMState {
 
     uint8_t can_rx_state; /* Debug only */
 
+    uint8_t tx_packet[MAX_FRAME_SIZE];
+    uint8_t rx_packet[MAX_FRAME_SIZE];
     uint32_t rx_desc[MAX_PRIORITY_QUEUES][DESC_MAX_NUM_WORDS];
 
     bool sar_active[4];
-- 
2.5.0

From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>

Fix the code style for register definitions.

Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/cadence_gem.c | 204 ++++++++++++++++++++++++++-------------------------
 1 file changed, 103 insertions(+), 101 deletions(-)

diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -XXX,XX +XXX,XX @@
     } \
 } while (0)
 
-#define GEM_NWCTRL        (0x00000000/4) /* Network Control reg */
-#define GEM_NWCFG         (0x00000004/4) /* Network Config reg */
-#define GEM_NWSTATUS      (0x00000008/4) /* Network Status reg */
-#define GEM_USERIO        (0x0000000C/4) /* User IO reg */
-#define GEM_DMACFG        (0x00000010/4) /* DMA Control reg */
-#define GEM_TXSTATUS      (0x00000014/4) /* TX Status reg */
-#define GEM_RXQBASE       (0x00000018/4) /* RX Q Base address reg */
-#define GEM_TXQBASE       (0x0000001C/4) /* TX Q Base address reg */
-#define GEM_RXSTATUS      (0x00000020/4) /* RX Status reg */
-#define GEM_ISR           (0x00000024/4) /* Interrupt Status reg */
-#define GEM_IER           (0x00000028/4) /* Interrupt Enable reg */
-#define GEM_IDR           (0x0000002C/4) /* Interrupt Disable reg */
-#define GEM_IMR           (0x00000030/4) /* Interrupt Mask reg */
-#define GEM_PHYMNTNC      (0x00000034/4) /* Phy Maintenance reg */
-#define GEM_RXPAUSE       (0x00000038/4) /* RX Pause Time reg */
-#define GEM_TXPAUSE       (0x0000003C/4) /* TX Pause Time reg */
-#define GEM_TXPARTIALSF   (0x00000040/4) /* TX Partial Store and Forward */
-#define GEM_RXPARTIALSF   (0x00000044/4) /* RX Partial Store and Forward */
-#define GEM_HASHLO        (0x00000080/4) /* Hash Low address reg */
-#define GEM_HASHHI        (0x00000084/4) /* Hash High address reg */
-#define GEM_SPADDR1LO     (0x00000088/4) /* Specific addr 1 low reg */
-#define GEM_SPADDR1HI     (0x0000008C/4) /* Specific addr 1 high reg */
-#define GEM_SPADDR2LO     (0x00000090/4) /* Specific addr 2 low reg */
-#define GEM_SPADDR2HI     (0x00000094/4) /* Specific addr 2 high reg */
-#define GEM_SPADDR3LO     (0x00000098/4) /* Specific addr 3 low reg */
-#define GEM_SPADDR3HI     (0x0000009C/4) /* Specific addr 3 high reg */
-#define GEM_SPADDR4LO     (0x000000A0/4) /* Specific addr 4 low reg */
-#define GEM_SPADDR4HI     (0x000000A4/4) /* Specific addr 4 high reg */
-#define GEM_TIDMATCH1     (0x000000A8/4) /* Type ID1 Match reg */
-#define GEM_TIDMATCH2     (0x000000AC/4) /* Type ID2 Match reg */
-#define GEM_TIDMATCH3     (0x000000B0/4) /* Type ID3 Match reg */
-#define GEM_TIDMATCH4     (0x000000B4/4) /* Type ID4 Match reg */
-#define GEM_WOLAN         (0x000000B8/4) /* Wake on LAN reg */
-#define GEM_IPGSTRETCH    (0x000000BC/4) /* IPG Stretch reg */
-#define GEM_SVLAN         (0x000000C0/4) /* Stacked VLAN reg */
-#define GEM_MODID         (0x000000FC/4) /* Module ID reg */
-#define GEM_OCTTXLO       (0x00000100/4) /* Octects transmitted Low reg */
-#define GEM_OCTTXHI       (0x00000104/4) /* Octects transmitted High reg */
-#define GEM_TXCNT         (0x00000108/4) /* Error-free Frames transmitted */
-#define GEM_TXBCNT        (0x0000010C/4) /* Error-free Broadcast Frames */
-#define GEM_TXMCNT        (0x00000110/4) /* Error-free Multicast Frame */
-#define GEM_TXPAUSECNT    (0x00000114/4) /* Pause Frames Transmitted */
-#define GEM_TX64CNT       (0x00000118/4) /* Error-free 64 TX */
-#define GEM_TX65CNT       (0x0000011C/4) /* Error-free 65-127 TX */
-#define GEM_TX128CNT      (0x00000120/4) /* Error-free 128-255 TX */
-#define GEM_TX256CNT      (0x00000124/4) /* Error-free 256-511 */
-#define GEM_TX512CNT      (0x00000128/4) /* Error-free 512-1023 TX */
-#define GEM_TX1024CNT     (0x0000012C/4) /* Error-free 1024-1518 TX */
-#define GEM_TX1519CNT     (0x00000130/4) /* Error-free larger than 1519 TX */
-#define GEM_TXURUNCNT     (0x00000134/4) /* TX under run error counter */
-#define GEM_SINGLECOLLCNT (0x00000138/4) /* Single Collision Frames */
-#define GEM_MULTCOLLCNT   (0x0000013C/4) /* Multiple Collision Frames */
-#define GEM_EXCESSCOLLCNT (0x00000140/4) /* Excessive Collision Frames */
-#define GEM_LATECOLLCNT   (0x00000144/4) /* Late Collision Frames */
-#define GEM_DEFERTXCNT    (0x00000148/4) /* Deferred Transmission Frames */
-#define GEM_CSENSECNT     (0x0000014C/4) /* Carrier Sense Error Counter */
-#define GEM_OCTRXLO       (0x00000150/4) /* Octects Received register Low */
-#define GEM_OCTRXHI       (0x00000154/4) /* Octects Received register High */
-#define GEM_RXCNT         (0x00000158/4) /* Error-free Frames Received */
-#define GEM_RXBROADCNT    (0x0000015C/4) /* Error-free Broadcast Frames RX */
-#define GEM_RXMULTICNT    (0x00000160/4) /* Error-free Multicast Frames RX */
-#define GEM_RXPAUSECNT    (0x00000164/4) /* Pause Frames Received Counter */
-#define GEM_RX64CNT       (0x00000168/4) /* Error-free 64 byte Frames RX */
-#define GEM_RX65CNT       (0x0000016C/4) /* Error-free 65-127B Frames RX */
-#define GEM_RX128CNT      (0x00000170/4) /* Error-free 128-255B Frames RX */
-#define GEM_RX256CNT      (0x00000174/4) /* Error-free 256-512B Frames RX */
-#define GEM_RX512CNT      (0x00000178/4) /* Error-free 512-1023B Frames RX */
-#define GEM_RX1024CNT     (0x0000017C/4) /* Error-free 1024-1518B Frames RX */
-#define GEM_RX1519CNT     (0x00000180/4) /* Error-free 1519-max Frames RX */
-#define GEM_RXUNDERCNT    (0x00000184/4) /* Undersize Frames Received */
-#define GEM_RXOVERCNT     (0x00000188/4) /* Oversize Frames Received */
-#define GEM_RXJABCNT      (0x0000018C/4) /* Jabbers Received Counter */
-#define GEM_RXFCSCNT      (0x00000190/4) /* Frame Check seq. Error Counter */
-#define GEM_RXLENERRCNT   (0x00000194/4) /* Length Field Error Counter */
-#define GEM_RXSYMERRCNT   (0x00000198/4) /* Symbol Error Counter */
-#define GEM_RXALIGNERRCNT (0x0000019C/4) /* Alignment Error Counter */
-#define GEM_RXRSCERRCNT   (0x000001A0/4) /* Receive Resource Error Counter */
-#define GEM_RXORUNCNT     (0x000001A4/4) /* Receive Overrun Counter */
-#define GEM_RXIPCSERRCNT  (0x000001A8/4) /* IP header Checksum Error Counter */
-#define GEM_RXTCPCCNT     (0x000001AC/4) /* TCP Checksum Error Counter */
-#define GEM_RXUDPCCNT     (0x000001B0/4) /* UDP Checksum Error Counter */
-
-#define GEM_1588S         (0x000001D0/4) /* 1588 Timer Seconds */
-#define GEM_1588NS        (0x000001D4/4) /* 1588 Timer Nanoseconds */
-#define GEM_1588ADJ       (0x000001D8/4) /* 1588 Timer Adjust */
-#define GEM_1588INC       (0x000001DC/4) /* 1588 Timer Increment */
-#define GEM_PTPETXS       (0x000001E0/4) /* PTP Event Frame Transmitted (s) */
-#define GEM_PTPETXNS      (0x000001E4/4) /* PTP Event Frame Transmitted (ns) */
-#define GEM_PTPERXS       (0x000001E8/4) /* PTP Event Frame Received (s) */
-#define GEM_PTPERXNS      (0x000001EC/4) /* PTP Event Frame Received (ns) */
-#define GEM_PTPPTXS       (0x000001E0/4) /* PTP Peer Frame Transmitted (s) */
-#define GEM_PTPPTXNS      (0x000001E4/4) /* PTP Peer Frame Transmitted (ns) */
-#define GEM_PTPPRXS       (0x000001E8/4) /* PTP Peer Frame Received (s) */
-#define GEM_PTPPRXNS      (0x000001EC/4) /* PTP Peer Frame Received (ns) */
+#define GEM_NWCTRL        (0x00000000 / 4) /* Network Control reg */
+#define GEM_NWCFG         (0x00000004 / 4) /* Network Config reg */
+#define GEM_NWSTATUS      (0x00000008 / 4) /* Network Status reg */
+#define GEM_USERIO        (0x0000000C / 4) /* User IO reg */
+#define GEM_DMACFG        (0x00000010 / 4) /* DMA Control reg */
+#define GEM_TXSTATUS      (0x00000014 / 4) /* TX Status reg */
+#define GEM_RXQBASE       (0x00000018 / 4) /* RX Q Base address reg */
+#define GEM_TXQBASE       (0x0000001C / 4) /* TX Q Base address reg */
+#define GEM_RXSTATUS      (0x00000020 / 4) /* RX Status reg */
+#define GEM_ISR           (0x00000024 / 4) /* Interrupt Status reg */
+#define GEM_IER           (0x00000028 / 4) /* Interrupt Enable reg */
+#define GEM_IDR           (0x0000002C / 4) /* Interrupt Disable reg */
+#define GEM_IMR           (0x00000030 / 4) /* Interrupt Mask reg */
+#define GEM_PHYMNTNC      (0x00000034 / 4) /* Phy Maintenance reg */
+#define GEM_RXPAUSE       (0x00000038 / 4) /* RX Pause Time reg */
+#define GEM_TXPAUSE       (0x0000003C / 4) /* TX Pause Time reg */
+#define GEM_TXPARTIALSF   (0x00000040 / 4) /* TX Partial Store and Forward */
+#define GEM_RXPARTIALSF   (0x00000044 / 4) /* RX Partial Store and Forward */
+#define GEM_HASHLO        (0x00000080 / 4) /* Hash Low address reg */
+#define GEM_HASHHI        (0x00000084 / 4) /* Hash High address reg */
+#define GEM_SPADDR1LO     (0x00000088 / 4) /* Specific addr 1 low reg */
+#define GEM_SPADDR1HI     (0x0000008C / 4) /* Specific addr 1 high reg */
+#define GEM_SPADDR2LO     (0x00000090 / 4) /* Specific addr 2 low reg */
+#define GEM_SPADDR2HI     (0x00000094 / 4) /* Specific addr 2 high reg */
+#define GEM_SPADDR3LO     (0x00000098 / 4) /* Specific addr 3 low reg */
+#define GEM_SPADDR3HI     (0x0000009C / 4) /* Specific addr 3 high reg */
+#define GEM_SPADDR4LO     (0x000000A0 / 4) /* Specific addr 4 low reg */
+#define GEM_SPADDR4HI     (0x000000A4 / 4) /* Specific addr 4 high reg */
+#define GEM_TIDMATCH1     (0x000000A8 / 4) /* Type ID1 Match reg */
+#define GEM_TIDMATCH2     (0x000000AC / 4) /* Type ID2 Match reg */
+#define GEM_TIDMATCH3     (0x000000B0 / 4) /* Type ID3 Match reg */
+#define GEM_TIDMATCH4     (0x000000B4 / 4) /* Type ID4 Match reg */
+#define GEM_WOLAN         (0x000000B8 / 4) /* Wake on LAN reg */
+#define GEM_IPGSTRETCH    (0x000000BC / 4) /* IPG Stretch reg */
+#define GEM_SVLAN         (0x000000C0 / 4) /* Stacked VLAN reg */
+#define GEM_MODID         (0x000000FC / 4) /* Module ID reg */
+#define GEM_OCTTXLO       (0x00000100 / 4) /* Octects transmitted Low reg */
+#define GEM_OCTTXHI       (0x00000104 / 4) /* Octects transmitted High reg */
+#define GEM_TXCNT         (0x00000108 / 4) /* Error-free Frames transmitted */
+#define GEM_TXBCNT        (0x0000010C / 4) /* Error-free Broadcast Frames */
+#define GEM_TXMCNT        (0x00000110 / 4) /* Error-free Multicast Frame */
+#define GEM_TXPAUSECNT    (0x00000114 / 4) /* Pause Frames Transmitted */
+#define GEM_TX64CNT       (0x00000118 / 4) /* Error-free 64 TX */
+#define GEM_TX65CNT       (0x0000011C / 4) /* Error-free 65-127 TX */
+#define GEM_TX128CNT      (0x00000120 / 4) /* Error-free 128-255 TX */
+#define GEM_TX256CNT      (0x00000124 / 4) /* Error-free 256-511 */
+#define GEM_TX512CNT      (0x00000128 / 4) /* Error-free 512-1023 TX */
+#define GEM_TX1024CNT     (0x0000012C / 4) /* Error-free 1024-1518 TX */
+#define GEM_TX1519CNT     (0x00000130 / 4) /* Error-free larger than 1519 TX */
+#define GEM_TXURUNCNT     (0x00000134 / 4) /* TX under run error counter */
+#define GEM_SINGLECOLLCNT (0x00000138 / 4) /* Single Collision Frames */
+#define GEM_MULTCOLLCNT   (0x0000013C / 4) /* Multiple Collision Frames */
+#define GEM_EXCESSCOLLCNT (0x00000140 / 4) /* Excessive Collision Frames */
+#define GEM_LATECOLLCNT   (0x00000144 / 4) /* Late Collision Frames */
+#define GEM_DEFERTXCNT    (0x00000148 / 4) /* Deferred Transmission Frames */
+#define GEM_CSENSECNT     (0x0000014C / 4) /* Carrier Sense Error Counter */
+#define GEM_OCTRXLO       (0x00000150 / 4) /* Octects Received register Low */
+#define GEM_OCTRXHI       (0x00000154 / 4) /* Octects Received register High */
+#define GEM_RXCNT         (0x00000158 / 4) /* Error-free Frames Received */
+#define GEM_RXBROADCNT    (0x0000015C / 4) /* Error-free Broadcast Frames RX */
+#define GEM_RXMULTICNT    (0x00000160 / 4) /* Error-free Multicast Frames RX */
+#define GEM_RXPAUSECNT    (0x00000164 / 4) /* Pause Frames Received Counter */
+#define GEM_RX64CNT       (0x00000168 / 4) /* Error-free 64 byte Frames RX */
+#define GEM_RX65CNT       (0x0000016C / 4) /* Error-free 65-127B Frames RX */
+#define GEM_RX128CNT      (0x00000170 / 4) /* Error-free 128-255B Frames RX */
+#define GEM_RX256CNT      (0x00000174 / 4) /* Error-free 256-512B Frames RX */
+#define GEM_RX512CNT      (0x00000178 / 4) /* Error-free 512-1023B Frames RX */
+#define GEM_RX1024CNT     (0x0000017C / 4) /* Error-free 1024-1518B Frames RX */
+#define GEM_RX1519CNT     (0x00000180 / 4) /* Error-free 1519-max Frames RX */
+#define GEM_RXUNDERCNT    (0x00000184 / 4) /* Undersize Frames Received */
+#define GEM_RXOVERCNT     (0x00000188 / 4) /* Oversize Frames Received */
+#define GEM_RXJABCNT      (0x0000018C / 4) /* Jabbers Received Counter */
+#define GEM_RXFCSCNT      (0x00000190 / 4) /* Frame Check seq. Error Counter */
+#define GEM_RXLENERRCNT   (0x00000194 / 4) /* Length Field Error Counter */
+#define GEM_RXSYMERRCNT   (0x00000198 / 4) /* Symbol Error Counter */
+#define GEM_RXALIGNERRCNT (0x0000019C / 4) /* Alignment Error Counter */
+#define GEM_RXRSCERRCNT   (0x000001A0 / 4) /* Receive Resource Error Counter */
+#define GEM_RXORUNCNT     (0x000001A4 / 4) /* Receive Overrun Counter */
+#define GEM_RXIPCSERRCNT  (0x000001A8 / 4) /* IP header Checksum Err Counter */
+#define GEM_RXTCPCCNT     (0x000001AC / 4) /* TCP Checksum Error Counter */
+#define GEM_RXUDPCCNT     (0x000001B0 / 4) /* UDP Checksum Error Counter */
+
+#define GEM_1588S         (0x000001D0 / 4) /* 1588 Timer Seconds */
+#define GEM_1588NS        (0x000001D4 / 4) /* 1588 Timer Nanoseconds */
+#define GEM_1588ADJ       (0x000001D8 / 4) /* 1588 Timer Adjust */
+#define GEM_1588INC       (0x000001DC / 4) /* 1588 Timer Increment */
+#define GEM_PTPETXS       (0x000001E0 / 4) /* PTP Event Frame Transmitted (s) */
+#define GEM_PTPETXNS      (0x000001E4 / 4) /*
+                                            * PTP Event Frame Transmitted (ns)
+                                            */
+#define GEM_PTPERXS       (0x000001E8 / 4) /* PTP Event Frame Received (s) */
+#define GEM_PTPERXNS      (0x000001EC / 4) /* PTP Event Frame Received (ns) */
+#define GEM_PTPPTXS       (0x000001E0 / 4) /* PTP Peer Frame Transmitted (s) */
+#define GEM_PTPPTXNS      (0x000001E4 / 4) /* PTP Peer Frame Transmitted (ns) */
+#define GEM_PTPPRXS       (0x000001E8 / 4) /* PTP Peer Frame Received (s) */
+#define GEM_PTPPRXNS      (0x000001EC / 4) /* PTP Peer Frame Received (ns) */
 
 /* Design Configuration Registers */
-#define GEM_DESCONF       (0x00000280/4)
-#define GEM_DESCONF2      (0x00000284/4)
-#define GEM_DESCONF3      (0x00000288/4)
-#define GEM_DESCONF4      (0x0000028C/4)
-#define GEM_DESCONF5      (0x00000290/4)
-#define GEM_DESCONF6      (0x00000294/4)
+#define GEM_DESCONF       (0x00000280 / 4)
+#define GEM_DESCONF2      (0x00000284 / 4)
+#define GEM_DESCONF3      (0x00000288 / 4)
+#define GEM_DESCONF4      (0x0000028C / 4)
+#define GEM_DESCONF5      (0x00000290 / 4)
+#define GEM_DESCONF6      (0x00000294 / 4)
 #define GEM_DESCONF6_64B_MASK (1U << 23)
-#define GEM_DESCONF7      (0x00000298/4)
+#define GEM_DESCONF7      (0x00000298 / 4)
 
 #define GEM_INT_Q1_STATUS               (0x00000400 / 4)
 #define GEM_INT_Q1_MASK                 (0x00000640 / 4)
-- 
2.5.0

From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>

Add a property "jumbo-max-len", which sets default value of jumbo frames
up to 16,383 bytes. Add Frame length checks for standard and jumbo
frames.

Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/cadence_gem.c         | 51 +++++++++++++++++++++++++++++++++++++++-----
 include/hw/net/cadence_gem.h |  4 +++-
 2 files changed, 49 insertions(+), 6 deletions(-)

diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -XXX,XX +XXX,XX @@
 #define GEM_TXPAUSE       (0x0000003C / 4) /* TX Pause Time reg */
 #define GEM_TXPARTIALSF   (0x00000040 / 4) /* TX Partial Store and Forward */
 #define GEM_RXPARTIALSF   (0x00000044 / 4) /* RX Partial Store and Forward */
+#define GEM_JUMBO_MAX_LEN (0x00000048 / 4) /* Max Jumbo Frame Size */
 #define GEM_HASHLO        (0x00000080 / 4) /* Hash Low address reg */
 #define GEM_HASHHI        (0x00000084 / 4) /* Hash High address reg */
 #define GEM_SPADDR1LO     (0x00000088 / 4) /* Specific addr 1 low reg */
@@ -XXX,XX +XXX,XX @@
 #define GEM_NWCFG_LERR_DISC    0x00010000 /* Discard RX frames with len err */
 #define GEM_NWCFG_BUFF_OFST_M  0x0000C000 /* Receive buffer offset mask */
 #define GEM_NWCFG_BUFF_OFST_S  14         /* Receive buffer offset shift */
+#define GEM_NWCFG_RCV_1538     0x00000100 /* Receive 1538 bytes frame */
 #define GEM_NWCFG_UCAST_HASH   0x00000080 /* accept unicast if hash match */
 #define GEM_NWCFG_MCAST_HASH   0x00000040 /* accept multicast if hash match */
 #define GEM_NWCFG_BCAST_REJ    0x00000020 /* Reject broadcast packets */
 #define GEM_NWCFG_PROMISC      0x00000010 /* Accept all packets */
+#define GEM_NWCFG_JUMBO_FRAME  0x00000008 /* Jumbo Frames enable */
 
 #define GEM_DMACFG_ADDR_64B    (1U << 30)
 #define GEM_DMACFG_TX_BD_EXT   (1U << 29)
@@ -XXX,XX +XXX,XX @@
 
 /* GEM_ISR GEM_IER GEM_IDR GEM_IMR */
 #define GEM_INT_TXCMPL        0x00000080 /* Transmit Complete */
+#define GEM_INT_AMBA_ERR      0x00000040
 #define GEM_INT_TXUSED         0x00000008
 #define GEM_INT_RXUSED         0x00000004
 #define GEM_INT_RXCMPL        0x00000002
@@ -XXX,XX +XXX,XX @@ static inline void rx_desc_set_sar(uint32_t *desc, int sar_idx)
 /* The broadcast MAC address: 0xFFFFFFFFFFFF */
 static const uint8_t broadcast_addr[] = { 0xFF, 0xFF, 0xFF, 0xFF, 0xFF, 0xFF };
 
+static uint32_t gem_get_max_buf_len(CadenceGEMState *s, bool tx)
+{
+    uint32_t size;
+    if (s->regs[GEM_NWCFG] & GEM_NWCFG_JUMBO_FRAME) {
+        size = s->regs[GEM_JUMBO_MAX_LEN];
+        if (size > s->jumbo_max_len) {
+            size = s->jumbo_max_len;
+            qemu_log_mask(LOG_GUEST_ERROR, "GEM_JUMBO_MAX_LEN reg cannot be"
+                " greater than 0x%" PRIx32 "\n", s->jumbo_max_len);
+        }
+    } else if (tx) {
+        size = 1518;
+    } else {
+        size = s->regs[GEM_NWCFG] & GEM_NWCFG_RCV_1538 ? 1538 : 1518;
+    }
+    return size;
+}
+
 static void gem_set_isr(CadenceGEMState *s, int q, uint32_t flag)
 {
     if (q == 0) {
@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
     /* Find which queue we are targeting */
     q = get_queue_from_screen(s, rxbuf_ptr, rxbufsize);
 
+    if (size > gem_get_max_buf_len(s, false)) {
+        qemu_log_mask(LOG_GUEST_ERROR, "rx frame too long\n");
+        gem_set_isr(s, q, GEM_INT_AMBA_ERR);
+        return -1;
+    }
+
     while (bytes_to_copy) {
         hwaddr desc_addr;
 
@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
                 break;
             }
 
-            if (tx_desc_get_length(desc) > MAX_FRAME_SIZE -
+            if (tx_desc_get_length(desc) > gem_get_max_buf_len(s, true) -
                                                (p - s->tx_packet)) {
-                DB_PRINT("TX descriptor @ 0x%" HWADDR_PRIx \
-                         " too large: size 0x%x space 0x%zx\n",
+                qemu_log_mask(LOG_GUEST_ERROR, "TX descriptor @ 0x%" \
+                         HWADDR_PRIx " too large: size 0x%x space 0x%zx\n",
                          packet_desc_addr, tx_desc_get_length(desc),
-                         MAX_FRAME_SIZE - (p - s->tx_packet));
+                         gem_get_max_buf_len(s, true) - (p - s->tx_packet));
+                gem_set_isr(s, q, GEM_INT_AMBA_ERR);
                 break;
             }
 
@@ -XXX,XX +XXX,XX @@ static void gem_reset(DeviceState *d)
     s->regs[GEM_RXPARTIALSF] = 0x000003ff;
     s->regs[GEM_MODID] = s->revision;
     s->regs[GEM_DESCONF] = 0x02500111;
-    s->regs[GEM_DESCONF2] = 0x2ab13fff;
+    s->regs[GEM_DESCONF2] = 0x2ab10000 | s->jumbo_max_len;
     s->regs[GEM_DESCONF5] = 0x002f2045;
     s->regs[GEM_DESCONF6] = GEM_DESCONF6_64B_MASK;
+    s->regs[GEM_JUMBO_MAX_LEN] = s->jumbo_max_len;
 
     if (s->num_priority_queues > 1) {
         queues_mask = MAKE_64BIT_MASK(1, s->num_priority_queues - 1);
@@ -XXX,XX +XXX,XX @@ static void gem_write(void *opaque, hwaddr offset, uint64_t val,
         s->regs[GEM_IMR] &= ~val;
         gem_update_int_status(s);
         break;
+    case GEM_JUMBO_MAX_LEN:
+        s->regs[GEM_JUMBO_MAX_LEN] = val & MAX_JUMBO_FRAME_SIZE_MASK;
+        break;
     case GEM_INT_Q1_ENABLE ... GEM_INT_Q7_ENABLE:
         s->regs[GEM_INT_Q1_MASK + offset - GEM_INT_Q1_ENABLE] &= ~val;
         gem_update_int_status(s);
@@ -XXX,XX +XXX,XX @@ static void gem_realize(DeviceState *dev, Error **errp)
 
     s->nic = qemu_new_nic(&net_gem_info, &s->conf,
                           object_get_typename(OBJECT(dev)), dev->id, s);
+
+    if (s->jumbo_max_len > MAX_FRAME_SIZE) {
+        error_setg(errp, "jumbo-max-len is greater than %d",
+                  MAX_FRAME_SIZE);
+        return;
+    }
 }
 
 static void gem_init(Object *obj)
@@ -XXX,XX +XXX,XX @@ static Property gem_properties[] = {
                       num_type1_screeners, 4),
     DEFINE_PROP_UINT8("num-type2-screeners", CadenceGEMState,
                       num_type2_screeners, 4),
+    DEFINE_PROP_UINT16("jumbo-max-len", CadenceGEMState,
+                       jumbo_max_len, 10240),
     DEFINE_PROP_END_OF_LIST(),
 };
 
diff --git a/include/hw/net/cadence_gem.h b/include/hw/net/cadence_gem.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/net/cadence_gem.h
+++ b/include/hw/net/cadence_gem.h
@@ -XXX,XX +XXX,XX @@
 #define MAX_TYPE1_SCREENERS             16
 #define MAX_TYPE2_SCREENERS             16
 
-#define MAX_FRAME_SIZE 2048
+#define MAX_JUMBO_FRAME_SIZE_MASK 0x3FFF
+#define MAX_FRAME_SIZE MAX_JUMBO_FRAME_SIZE_MASK
 
 typedef struct CadenceGEMState {
     /*< private >*/
@@ -XXX,XX +XXX,XX @@ typedef struct CadenceGEMState {
     uint8_t num_type1_screeners;
     uint8_t num_type2_screeners;
     uint32_t revision;
+    uint16_t jumbo_max_len;
 
     /* GEM registers backing store */
     uint32_t regs[CADENCE_GEM_MAXREG];
-- 
2.5.0

From: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>

TX_LAST bit should not be set by hardware, its set by guest to inform
the last bd of the frame.

Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/cadence_gem.c | 6 ------
 1 file changed, 6 deletions(-)

diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -XXX,XX +XXX,XX @@ static inline unsigned tx_desc_get_last(uint32_t *desc)
     return (desc[1] & DESC_1_TX_LAST) ? 1 : 0;
 }
 
-static inline void tx_desc_set_last(uint32_t *desc)
-{
-    desc[1] |= DESC_1_TX_LAST;
-}
-
 static inline unsigned tx_desc_get_length(uint32_t *desc)
 {
     return desc[1] & DESC_1_LENGTH;
@@ -XXX,XX +XXX,XX @@ static void gem_transmit(CadenceGEMState *s)
 
             /* read next descriptor */
             if (tx_desc_get_wrap(desc)) {
-                tx_desc_set_last(desc);
 
                 if (s->regs[GEM_DMACFG] & GEM_DMACFG_ADDR_64B) {
                     packet_desc_addr = s->regs[GEM_TBQPH];
-- 
2.5.0

From: Tong Ho <tong.ho@xilinx.com>

Two defects are fixed:

1/ Detection of multicast frames
2/ Treating drop of mis-addressed frames as non-error

Signed-off-by: Tong Ho <tong.ho@xilinx.com>
Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Sai Pavan Boddu <sai.pavan.boddu@xilinx.com>
Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/cadence_gem.c | 26 +++++++++++---------------
 1 file changed, 11 insertions(+), 15 deletions(-)

diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/cadence_gem.c
+++ b/hw/net/cadence_gem.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/module.h"
 #include "sysemu/dma.h"
 #include "net/checksum.h"
+#include "net/eth.h"
 
 #define CADENCE_GEM_ERR_DEBUG 0
 #define DB_PRINT(...) do {\
@@ -XXX,XX +XXX,XX @@ static unsigned calc_mac_hash(const uint8_t *mac)
 static int gem_mac_address_filter(CadenceGEMState *s, const uint8_t *packet)
 {
     uint8_t *gem_spaddr;
-    int i;
+    int i, is_mc;
 
     /* Promiscuous mode? */
     if (s->regs[GEM_NWCFG] & GEM_NWCFG_PROMISC) {
@@ -XXX,XX +XXX,XX @@ static int gem_mac_address_filter(CadenceGEMState *s, const uint8_t *packet)
     }
 
     /* Accept packets -w- hash match? */
-    if ((packet[0] == 0x01 && (s->regs[GEM_NWCFG] & GEM_NWCFG_MCAST_HASH)) ||
-        (packet[0] != 0x01 && (s->regs[GEM_NWCFG] & GEM_NWCFG_UCAST_HASH))) {
+    is_mc = is_multicast_ether_addr(packet);
+    if ((is_mc && (s->regs[GEM_NWCFG] & GEM_NWCFG_MCAST_HASH)) ||
+        (!is_mc && (s->regs[GEM_NWCFG] & GEM_NWCFG_UCAST_HASH))) {
+        uint64_t buckets;
         unsigned hash_index;
 
         hash_index = calc_mac_hash(packet);
-        if (hash_index < 32) {
-            if (s->regs[GEM_HASHLO] & (1<<hash_index)) {
-                return packet[0] == 0x01 ? GEM_RX_MULTICAST_HASH_ACCEPT :
-                                           GEM_RX_UNICAST_HASH_ACCEPT;
-            }
-        } else {
-            hash_index -= 32;
-            if (s->regs[GEM_HASHHI] & (1<<hash_index)) {
-                return packet[0] == 0x01 ? GEM_RX_MULTICAST_HASH_ACCEPT :
-                                           GEM_RX_UNICAST_HASH_ACCEPT;
-            }
+        buckets = ((uint64_t)s->regs[GEM_HASHHI] << 32) | s->regs[GEM_HASHLO];
+        if ((buckets >> hash_index) & 1) {
+            return is_mc ? GEM_RX_MULTICAST_HASH_ACCEPT
+                         : GEM_RX_UNICAST_HASH_ACCEPT;
         }
     }
 
@@ -XXX,XX +XXX,XX @@ static ssize_t gem_receive(NetClientState *nc, const uint8_t *buf, size_t size)
     /* Is this destination MAC address "for us" ? */
     maf = gem_mac_address_filter(s, buf);
     if (maf == GEM_RX_REJECT) {
-        return -1;
+        return size;  /* no, drop siliently b/c it's not an error */
     }
 
     /* Discard packets with receive length error enabled ? */
-- 
2.5.0

The sender of packet will be checked in the qemu_net_queue_purge() but
we use NetClientState not its peer when trying to purge the incoming
queue in qemu_flush_or_purge_packets(). This will trigger the assert
in virtio_net_reset since we can't pass the sender check:

hw/net/virtio-net.c:533: void virtio_net_reset(VirtIODevice *): Assertion
`!virtio_net_get_subqueue(nc)->async_tx.elem' failed.
#9 0x55a33fa31b78 in virtio_net_reset hw/net/virtio-net.c:533:13
#10 0x55a33fc88412 in virtio_reset hw/virtio/virtio.c:1919:9
#11 0x55a341d82764 in virtio_bus_reset hw/virtio/virtio-bus.c:95:9
#12 0x55a341dba2de in virtio_pci_reset hw/virtio/virtio-pci.c:1824:5
#13 0x55a341db3e02 in virtio_pci_common_write hw/virtio/virtio-pci.c:1252:13
#14 0x55a33f62117b in memory_region_write_accessor memory.c:496:5
#15 0x55a33f6205e4 in access_with_adjusted_size memory.c:557:18
#16 0x55a33f61e177 in memory_region_dispatch_write memory.c:1488:16

Reproducer:
https://www.mail-archive.com/qemu-devel@nongnu.org/msg701914.html

Fix by using the peer.

Reported-by: "Alexander Bulekov" <alxndr@bu.edu>
Acked-by: Alexander Bulekov <alxndr@bu.edu>
Fixes: ca77d85e1dbf9 ("net: complete all queued packets on VM stop")
Cc: qemu-stable@nongnu.org
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/net.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/net/net.c b/net/net.c
index XXXXXXX..XXXXXXX 100644
--- a/net/net.c
+++ b/net/net.c
@@ -XXX,XX +XXX,XX @@ void qemu_flush_or_purge_queued_packets(NetClientState *nc, bool purge)
         qemu_notify_event();
     } else if (purge) {
         /* Unable to empty the queue, purge remaining packets */
-        qemu_net_queue_purge(nc->incoming_queue, nc);
+        qemu_net_queue_purge(nc->incoming_queue, nc->peer);
     }
 }
 
-- 
2.5.0

From: Lukas Straub <lukasstraub2@web.de>

qemu_bh_new will set the bh to be executed in the main
loop. This causes crashes as colo_compare_handle_event assumes
that it has exclusive access the queues, which are also
concurrently accessed in the iothread.

Create the bh with the AioContext of the iothread to fulfill
these assumptions and fix the crashes. This is safe, because
the bh already takes the appropriate locks.

Signed-off-by: Lukas Straub <lukasstraub2@web.de>
Reviewed-by: Zhang Chen <chen.zhang@intel.com>
Reviewed-by: Derek Su <dereksu@qnap.com>
Tested-by: Derek Su <dereksu@qnap.com>
Signed-off-by: Zhang Chen <chen.zhang@intel.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/colo-compare.c | 3 ++-
 1 file changed, 2 insertions(+), 1 deletion(-)

diff --git a/net/colo-compare.c b/net/colo-compare.c
index XXXXXXX..XXXXXXX 100644
--- a/net/colo-compare.c
+++ b/net/colo-compare.c
@@ -XXX,XX +XXX,XX @@ static void colo_compare_handle_event(void *opaque)
 
 static void colo_compare_iothread(CompareState *s)
 {
+    AioContext *ctx = iothread_get_aio_context(s->iothread);
     object_ref(OBJECT(s->iothread));
     s->worker_context = iothread_get_g_main_context(s->iothread);
 
@@ -XXX,XX +XXX,XX @@ static void colo_compare_iothread(CompareState *s)
     }
 
     colo_compare_timer_init(s);
-    s->event_bh = qemu_bh_new(colo_compare_handle_event, s);
+    s->event_bh = aio_bh_new(ctx, colo_compare_handle_event, s);
 }
 
 static char *compare_get_pri_indev(Object *obj, Error **errp)
-- 
2.5.0

From: Lukas Straub <lukasstraub2@web.de>

To be able to convert compare_chr_send to a coroutine in the
next commit, use qemu_co_sleep_ns if in coroutine.

Signed-off-by: Lukas Straub <lukasstraub2@web.de>
Reviewed-by: Marc-André Lureau <marcandre.lureau@redhat.com>
Reviewed-by: Zhang Chen <chen.zhang@intel.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Zhang Chen <chen.zhang@intel.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 chardev/char.c | 7 ++++++-
 1 file changed, 6 insertions(+), 1 deletion(-)

diff --git a/chardev/char.c b/chardev/char.c
index XXXXXXX..XXXXXXX 100644
--- a/chardev/char.c
+++ b/chardev/char.c
@@ -XXX,XX +XXX,XX @@
 #include "qemu/module.h"
 #include "qemu/option.h"
 #include "qemu/id.h"
+#include "qemu/coroutine.h"
 
 #include "chardev/char-mux.h"
 
@@ -XXX,XX +XXX,XX @@ static int qemu_chr_write_buffer(Chardev *s,
     retry:
         res = cc->chr_write(s, buf + *offset, len - *offset);
         if (res < 0 && errno == EAGAIN && write_all) {
-            g_usleep(100);
+            if (qemu_in_coroutine()) {
+                qemu_co_sleep_ns(QEMU_CLOCK_REALTIME, 100000);
+            } else {
+                g_usleep(100);
+            }
             goto retry;
         }
 
-- 
2.5.0

From: Lukas Straub <lukasstraub2@web.de>

The chr_out chardev is connected to a filter-redirector
running in the main loop. qemu_chr_fe_write_all might block
here in compare_chr_send if the (socket-)buffer is full.
If another filter-redirector in the main loop want's to
send data to chr_pri_in it might also block if the buffer
is full. This leads to a deadlock because both event loops
get blocked.

Fix this by converting compare_chr_send to a coroutine and
putting the packets in a send queue.

Signed-off-by: Lukas Straub <lukasstraub2@web.de>
Reviewed-by: Zhang Chen <chen.zhang@intel.com>
Tested-by: Zhang Chen <chen.zhang@intel.com>
Signed-off-by: Zhang Chen <chen.zhang@intel.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/colo-compare.c | 193 ++++++++++++++++++++++++++++++++++++++++-------------
 net/colo.c         |   7 ++
 net/colo.h         |   1 +
 3 files changed, 156 insertions(+), 45 deletions(-)

diff --git a/net/colo-compare.c b/net/colo-compare.c
index XXXXXXX..XXXXXXX 100644
--- a/net/colo-compare.c
+++ b/net/colo-compare.c
@@ -XXX,XX +XXX,XX @@
 #include "migration/migration.h"
 #include "util.h"
 
+#include "block/aio-wait.h"
+#include "qemu/coroutine.h"
+
 #define TYPE_COLO_COMPARE "colo-compare"
 #define COLO_COMPARE(obj) \
     OBJECT_CHECK(CompareState, (obj), TYPE_COLO_COMPARE)
@@ -XXX,XX +XXX,XX @@ static int event_unhandled_count;
  *                    |packet  |  |packet  +    |packet  | |packet  +
  *                    +--------+  +--------+    +--------+ +--------+
  */
+
+typedef struct SendCo {
+    Coroutine *co;
+    struct CompareState *s;
+    CharBackend *chr;
+    GQueue send_list;
+    bool notify_remote_frame;
+    bool done;
+    int ret;
+} SendCo;
+
+typedef struct SendEntry {
+    uint32_t size;
+    uint32_t vnet_hdr_len;
+    uint8_t *buf;
+} SendEntry;
+
 typedef struct CompareState {
     Object parent;
 
@@ -XXX,XX +XXX,XX @@ typedef struct CompareState {
     SocketReadState pri_rs;
     SocketReadState sec_rs;
     SocketReadState notify_rs;
+    SendCo out_sendco;
+    SendCo notify_sendco;
     bool vnet_hdr;
     uint32_t compare_timeout;
     uint32_t expired_scan_cycle;
@@ -XXX,XX +XXX,XX @@ enum {
 
 
 static int compare_chr_send(CompareState *s,
-                            const uint8_t *buf,
+                            uint8_t *buf,
                             uint32_t size,
                             uint32_t vnet_hdr_len,
-                            bool notify_remote_frame);
+                            bool notify_remote_frame,
+                            bool zero_copy);
 
 static bool packet_matches_str(const char *str,
                                const uint8_t *buf,
@@ -XXX,XX +XXX,XX @@ static void notify_remote_frame(CompareState *s)
     char msg[] = "DO_CHECKPOINT";
     int ret = 0;
 
-    ret = compare_chr_send(s, (uint8_t *)msg, strlen(msg), 0, true);
+    ret = compare_chr_send(s, (uint8_t *)msg, strlen(msg), 0, true, false);
     if (ret < 0) {
         error_report("Notify Xen COLO-frame failed");
     }
@@ -XXX,XX +XXX,XX @@ static void colo_release_primary_pkt(CompareState *s, Packet *pkt)
                            pkt->data,
                            pkt->size,
                            pkt->vnet_hdr_len,
-                           false);
+                           false,
+                           true);
     if (ret < 0) {
         error_report("colo send primary packet failed");
     }
     trace_colo_compare_main("packet same and release packet");
-    packet_destroy(pkt, NULL);
+    packet_destroy_partial(pkt, NULL);
 }
 
 /*
@@ -XXX,XX +XXX,XX @@ static void colo_compare_connection(void *opaque, void *user_data)
     }
 }
 
-static int compare_chr_send(CompareState *s,
-                            const uint8_t *buf,
-                            uint32_t size,
-                            uint32_t vnet_hdr_len,
-                            bool notify_remote_frame)
+static void coroutine_fn _compare_chr_send(void *opaque)
 {
+    SendCo *sendco = opaque;
+    CompareState *s = sendco->s;
     int ret = 0;
-    uint32_t len = htonl(size);
 
-    if (!size) {
-        return 0;
-    }
+    while (!g_queue_is_empty(&sendco->send_list)) {
+        SendEntry *entry = g_queue_pop_tail(&sendco->send_list);
+        uint32_t len = htonl(entry->size);
 
-    if (notify_remote_frame) {
-        ret = qemu_chr_fe_write_all(&s->chr_notify_dev,
-                                    (uint8_t *)&len,
-                                    sizeof(len));
-    } else {
-        ret = qemu_chr_fe_write_all(&s->chr_out, (uint8_t *)&len, sizeof(len));
-    }
+        ret = qemu_chr_fe_write_all(sendco->chr, (uint8_t *)&len, sizeof(len));
 
-    if (ret != sizeof(len)) {
-        goto err;
-    }
+        if (ret != sizeof(len)) {
+            g_free(entry->buf);
+            g_slice_free(SendEntry, entry);
+            goto err;
+        }
 
-    if (s->vnet_hdr) {
-        /*
-         * We send vnet header len make other module(like filter-redirector)
-         * know how to parse net packet correctly.
-         */
-        len = htonl(vnet_hdr_len);
+        if (!sendco->notify_remote_frame && s->vnet_hdr) {
+            /*
+             * We send vnet header len make other module(like filter-redirector)
+             * know how to parse net packet correctly.
+             */
+            len = htonl(entry->vnet_hdr_len);
 
-        if (!notify_remote_frame) {
-            ret = qemu_chr_fe_write_all(&s->chr_out,
+            ret = qemu_chr_fe_write_all(sendco->chr,
                                         (uint8_t *)&len,
                                         sizeof(len));
+
+            if (ret != sizeof(len)) {
+                g_free(entry->buf);
+                g_slice_free(SendEntry, entry);
+                goto err;
+            }
         }
 
-        if (ret != sizeof(len)) {
+        ret = qemu_chr_fe_write_all(sendco->chr,
+                                    (uint8_t *)entry->buf,
+                                    entry->size);
+
+        if (ret != entry->size) {
+            g_free(entry->buf);
+            g_slice_free(SendEntry, entry);
             goto err;
         }
+
+        g_free(entry->buf);
+        g_slice_free(SendEntry, entry);
     }
 
+    sendco->ret = 0;
+    goto out;
+
+err:
+    while (!g_queue_is_empty(&sendco->send_list)) {
+        SendEntry *entry = g_queue_pop_tail(&sendco->send_list);
+        g_free(entry->buf);
+        g_slice_free(SendEntry, entry);
+    }
+    sendco->ret = ret < 0 ? ret : -EIO;
+out:
+    sendco->co = NULL;
+    sendco->done = true;
+    aio_wait_kick();
+}
+
+static int compare_chr_send(CompareState *s,
+                            uint8_t *buf,
+                            uint32_t size,
+                            uint32_t vnet_hdr_len,
+                            bool notify_remote_frame,
+                            bool zero_copy)
+{
+    SendCo *sendco;
+    SendEntry *entry;
+
     if (notify_remote_frame) {
-        ret = qemu_chr_fe_write_all(&s->chr_notify_dev,
-                                    (uint8_t *)buf,
-                                    size);
+        sendco = &s->notify_sendco;
     } else {
-        ret = qemu_chr_fe_write_all(&s->chr_out, (uint8_t *)buf, size);
+        sendco = &s->out_sendco;
     }
 
-    if (ret != size) {
-        goto err;
+    if (!size) {
+        return 0;
     }
 
-    return 0;
+    entry = g_slice_new(SendEntry);
+    entry->size = size;
+    entry->vnet_hdr_len = vnet_hdr_len;
+    if (zero_copy) {
+        entry->buf = buf;
+    } else {
+        entry->buf = g_malloc(size);
+        memcpy(entry->buf, buf, size);
+    }
+    g_queue_push_head(&sendco->send_list, entry);
+
+    if (sendco->done) {
+        sendco->co = qemu_coroutine_create(_compare_chr_send, sendco);
+        sendco->done = false;
+        qemu_coroutine_enter(sendco->co);
+        if (sendco->done) {
+            /* report early errors */
+            return sendco->ret;
+        }
+    }
 
-err:
-    return ret < 0 ? ret : -EIO;
+    /* assume success */
+    return 0;
 }
 
 static int compare_chr_can_read(void *opaque)
@@ -XXX,XX +XXX,XX @@ static void compare_pri_rs_finalize(SocketReadState *pri_rs)
                          pri_rs->buf,
                          pri_rs->packet_len,
                          pri_rs->vnet_hdr_len,
+                         false,
                          false);
     } else {
         /* compare packet in the specified connection */
@@ -XXX,XX +XXX,XX @@ static void compare_notify_rs_finalize(SocketReadState *notify_rs)
     if (packet_matches_str("COLO_USERSPACE_PROXY_INIT",
                            notify_rs->buf,
                            notify_rs->packet_len)) {
-        ret = compare_chr_send(s, (uint8_t *)msg, strlen(msg), 0, true);
+        ret = compare_chr_send(s, (uint8_t *)msg, strlen(msg), 0, true, false);
         if (ret < 0) {
             error_report("Notify Xen COLO-frame INIT failed");
         }
@@ -XXX,XX +XXX,XX @@ static void colo_compare_complete(UserCreatable *uc, Error **errp)
 
     QTAILQ_INSERT_TAIL(&net_compares, s, next);
 
+    s->out_sendco.s = s;
+    s->out_sendco.chr = &s->chr_out;
+    s->out_sendco.notify_remote_frame = false;
+    s->out_sendco.done = true;
+    g_queue_init(&s->out_sendco.send_list);
+
+    if (s->notify_dev) {
+        s->notify_sendco.s = s;
+        s->notify_sendco.chr = &s->chr_notify_dev;
+        s->notify_sendco.notify_remote_frame = true;
+        s->notify_sendco.done = true;
+        g_queue_init(&s->notify_sendco.send_list);
+    }
+
     g_queue_init(&s->conn_list);
 
     qemu_mutex_init(&event_mtx);
@@ -XXX,XX +XXX,XX @@ static void colo_flush_packets(void *opaque, void *user_data)
                          pkt->data,
                          pkt->size,
                          pkt->vnet_hdr_len,
-                         false);
-        packet_destroy(pkt, NULL);
+                         false,
+                         true);
+        packet_destroy_partial(pkt, NULL);
     }
     while (!g_queue_is_empty(&conn->secondary_list)) {
         pkt = g_queue_pop_head(&conn->secondary_list);
@@ -XXX,XX +XXX,XX @@ static void colo_compare_finalize(Object *obj)
         }
     }
 
+    AioContext *ctx = iothread_get_aio_context(s->iothread);
+    aio_context_acquire(ctx);
+    AIO_WAIT_WHILE(ctx, !s->out_sendco.done);
+    if (s->notify_dev) {
+        AIO_WAIT_WHILE(ctx, !s->notify_sendco.done);
+    }
+    aio_context_release(ctx);
+
     /* Release all unhandled packets after compare thead exited */
     g_queue_foreach(&s->conn_list, colo_flush_packets, s);
+    AIO_WAIT_WHILE(NULL, !s->out_sendco.done);
 
     g_queue_clear(&s->conn_list);
+    g_queue_clear(&s->out_sendco.send_list);
+    if (s->notify_dev) {
+        g_queue_clear(&s->notify_sendco.send_list);
+    }
 
     if (s->connection_track_table) {
         g_hash_table_destroy(s->connection_track_table);
diff --git a/net/colo.c b/net/colo.c
index XXXXXXX..XXXXXXX 100644
--- a/net/colo.c
+++ b/net/colo.c
@@ -XXX,XX +XXX,XX @@ void packet_destroy(void *opaque, void *user_data)
     g_slice_free(Packet, pkt);
 }
 
+void packet_destroy_partial(void *opaque, void *user_data)
+{
+    Packet *pkt = opaque;
+
+    g_slice_free(Packet, pkt);
+}
+
 /*
  * Clear hashtable, stop this hash growing really huge
  */
diff --git a/net/colo.h b/net/colo.h
index XXXXXXX..XXXXXXX 100644
--- a/net/colo.h
+++ b/net/colo.h
@@ -XXX,XX +XXX,XX @@ bool connection_has_tracked(GHashTable *connection_track_table,
 void connection_hashtable_reset(GHashTable *connection_track_table);
 Packet *packet_new(const void *data, int size, int vnet_hdr_len);
 void packet_destroy(void *opaque, void *user_data);
+void packet_destroy_partial(void *opaque, void *user_data);
 
 #endif /* NET_COLO_H */
-- 
2.5.0

From: Lukas Straub <lukasstraub2@web.de>

Else the log will be flooded if there is a lot of network
traffic.

Signed-off-by: Lukas Straub <lukasstraub2@web.de>
Reviewed-by: Zhang Chen <chen.zhang@intel.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Tested-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Zhang Chen <chen.zhang@intel.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/colo-compare.c | 10 ++++++----
 1 file changed, 6 insertions(+), 4 deletions(-)

diff --git a/net/colo-compare.c b/net/colo-compare.c
index XXXXXXX..XXXXXXX 100644
--- a/net/colo-compare.c
+++ b/net/colo-compare.c
@@ -XXX,XX +XXX,XX @@ sec:
         g_queue_push_head(&conn->primary_list, ppkt);
         g_queue_push_head(&conn->secondary_list, spkt);
 
-        qemu_hexdump((char *)ppkt->data, stderr,
-                     "colo-compare ppkt", ppkt->size);
-        qemu_hexdump((char *)spkt->data, stderr,
-                     "colo-compare spkt", spkt->size);
+        if (trace_event_get_state_backends(TRACE_COLO_COMPARE_MISCOMPARE)) {
+            qemu_hexdump((char *)ppkt->data, stderr,
+                        "colo-compare ppkt", ppkt->size);
+            qemu_hexdump((char *)spkt->data, stderr,
+                        "colo-compare spkt", spkt->size);
+        }
 
         colo_compare_inconsistency_notify(s);
     }
-- 
2.5.0

From: Lukas Straub <lukasstraub2@web.de>

If the colo-compare object is removed before failover and a
checkpoint happens, qemu crashes because it tries to lock
the destroyed event_mtx in colo_notify_compares_event.

Fix this by checking if everything is initialized by
introducing a new variable colo_compare_active which
is protected by a new mutex colo_compare_mutex. The new mutex
also protects against concurrent access of the net_compares
list and makes sure that colo_notify_compares_event isn't
active while we destroy event_mtx and event_complete_cond.

With this it also is again possible to use colo without
colo-compare (periodic mode) and to use multiple colo-compare
for multiple network interfaces.

Signed-off-by: Lukas Straub <lukasstraub2@web.de>
Tested-by: Lukas Straub <lukasstraub2@web.de>
Reviewed-by: Zhang Chen <chen.zhang@intel.com>
Signed-off-by: Zhang Chen <chen.zhang@intel.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/colo-compare.c | 35 +++++++++++++++++++++++++++++------
 1 file changed, 29 insertions(+), 6 deletions(-)

diff --git a/net/colo-compare.c b/net/colo-compare.c
index XXXXXXX..XXXXXXX 100644
--- a/net/colo-compare.c
+++ b/net/colo-compare.c
@@ -XXX,XX +XXX,XX @@ static NotifierList colo_compare_notifiers =
 #define REGULAR_PACKET_CHECK_MS 3000
 #define DEFAULT_TIME_OUT_MS 3000
 
+static QemuMutex colo_compare_mutex;
+static bool colo_compare_active;
 static QemuMutex event_mtx;
 static QemuCond event_complete_cond;
 static int event_unhandled_count;
@@ -XXX,XX +XXX,XX @@ static void check_old_packet_regular(void *opaque)
 void colo_notify_compares_event(void *opaque, int event, Error **errp)
 {
     CompareState *s;
+    qemu_mutex_lock(&colo_compare_mutex);
+
+    if (!colo_compare_active) {
+        qemu_mutex_unlock(&colo_compare_mutex);
+        return;
+    }
 
     qemu_mutex_lock(&event_mtx);
     QTAILQ_FOREACH(s, &net_compares, next) {
@@ -XXX,XX +XXX,XX @@ void colo_notify_compares_event(void *opaque, int event, Error **errp)
     }
 
     qemu_mutex_unlock(&event_mtx);
+    qemu_mutex_unlock(&colo_compare_mutex);
 }
 
 static void colo_compare_timer_init(CompareState *s)
@@ -XXX,XX +XXX,XX @@ static void colo_compare_complete(UserCreatable *uc, Error **errp)
                            s->vnet_hdr);
     }
 
+    qemu_mutex_lock(&colo_compare_mutex);
+    if (!colo_compare_active) {
+        qemu_mutex_init(&event_mtx);
+        qemu_cond_init(&event_complete_cond);
+        colo_compare_active = true;
+    }
     QTAILQ_INSERT_TAIL(&net_compares, s, next);
+    qemu_mutex_unlock(&colo_compare_mutex);
 
     s->out_sendco.s = s;
     s->out_sendco.chr = &s->chr_out;
@@ -XXX,XX +XXX,XX @@ static void colo_compare_complete(UserCreatable *uc, Error **errp)
 
     g_queue_init(&s->conn_list);
 
-    qemu_mutex_init(&event_mtx);
-    qemu_cond_init(&event_complete_cond);
-
     s->connection_track_table = g_hash_table_new_full(connection_key_hash,
                                                       connection_key_equal,
                                                       g_free,
@@ -XXX,XX +XXX,XX @@ static void colo_compare_finalize(Object *obj)
 
     qemu_bh_delete(s->event_bh);
 
+    qemu_mutex_lock(&colo_compare_mutex);
     QTAILQ_FOREACH(tmp, &net_compares, next) {
         if (tmp == s) {
             QTAILQ_REMOVE(&net_compares, s, next);
             break;
         }
     }
+    if (QTAILQ_EMPTY(&net_compares)) {
+        colo_compare_active = false;
+        qemu_mutex_destroy(&event_mtx);
+        qemu_cond_destroy(&event_complete_cond);
+    }
+    qemu_mutex_unlock(&colo_compare_mutex);
 
     AioContext *ctx = iothread_get_aio_context(s->iothread);
     aio_context_acquire(ctx);
@@ -XXX,XX +XXX,XX @@ static void colo_compare_finalize(Object *obj)
         object_unref(OBJECT(s->iothread));
     }
 
-    qemu_mutex_destroy(&event_mtx);
-    qemu_cond_destroy(&event_complete_cond);
-
     g_free(s->pri_indev);
     g_free(s->sec_indev);
     g_free(s->outdev);
     g_free(s->notify_dev);
 }
 
+static void __attribute__((__constructor__)) colo_compare_init_globals(void)
+{
+    colo_compare_active = false;
+    qemu_mutex_init(&colo_compare_mutex);
+}
+
 static const TypeInfo colo_compare_info = {
     .name = TYPE_COLO_COMPARE,
     .parent = TYPE_OBJECT,
-- 
2.5.0

From: Lukas Straub <lukasstraub2@web.de>

In colo_compare_complete, insert CompareState into net_compares
only after everything has been initialized.
In colo_compare_finalize, remove CompareState from net_compares
before anything is deinitialized.

Signed-off-by: Lukas Straub <lukasstraub2@web.de>
Reviewed-by: Zhang Chen <chen.zhang@intel.com>
Signed-off-by: Zhang Chen <chen.zhang@intel.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/colo-compare.c | 45 +++++++++++++++++++++++----------------------
 1 file changed, 23 insertions(+), 22 deletions(-)

diff --git a/net/colo-compare.c b/net/colo-compare.c
index XXXXXXX..XXXXXXX 100644
--- a/net/colo-compare.c
+++ b/net/colo-compare.c
@@ -XXX,XX +XXX,XX @@ static void colo_compare_complete(UserCreatable *uc, Error **errp)
                            s->vnet_hdr);
     }
 
-    qemu_mutex_lock(&colo_compare_mutex);
-    if (!colo_compare_active) {
-        qemu_mutex_init(&event_mtx);
-        qemu_cond_init(&event_complete_cond);
-        colo_compare_active = true;
-    }
-    QTAILQ_INSERT_TAIL(&net_compares, s, next);
-    qemu_mutex_unlock(&colo_compare_mutex);
-
     s->out_sendco.s = s;
     s->out_sendco.chr = &s->chr_out;
     s->out_sendco.notify_remote_frame = false;
@@ -XXX,XX +XXX,XX @@ static void colo_compare_complete(UserCreatable *uc, Error **errp)
                                                       connection_destroy);
 
     colo_compare_iothread(s);
+
+    qemu_mutex_lock(&colo_compare_mutex);
+    if (!colo_compare_active) {
+        qemu_mutex_init(&event_mtx);
+        qemu_cond_init(&event_complete_cond);
+        colo_compare_active = true;
+    }
+    QTAILQ_INSERT_TAIL(&net_compares, s, next);
+    qemu_mutex_unlock(&colo_compare_mutex);
+
     return;
 }
 
@@ -XXX,XX +XXX,XX @@ static void colo_compare_finalize(Object *obj)
     CompareState *s = COLO_COMPARE(obj);
     CompareState *tmp = NULL;
 
-    qemu_chr_fe_deinit(&s->chr_pri_in, false);
-    qemu_chr_fe_deinit(&s->chr_sec_in, false);
-    qemu_chr_fe_deinit(&s->chr_out, false);
-    if (s->notify_dev) {
-        qemu_chr_fe_deinit(&s->chr_notify_dev, false);
-    }
-
-    if (s->iothread) {
-        colo_compare_timer_del(s);
-    }
-
-    qemu_bh_delete(s->event_bh);
-
     qemu_mutex_lock(&colo_compare_mutex);
     QTAILQ_FOREACH(tmp, &net_compares, next) {
         if (tmp == s) {
@@ -XXX,XX +XXX,XX @@ static void colo_compare_finalize(Object *obj)
     }
     qemu_mutex_unlock(&colo_compare_mutex);
 
+    qemu_chr_fe_deinit(&s->chr_pri_in, false);
+    qemu_chr_fe_deinit(&s->chr_sec_in, false);
+    qemu_chr_fe_deinit(&s->chr_out, false);
+    if (s->notify_dev) {
+        qemu_chr_fe_deinit(&s->chr_notify_dev, false);
+    }
+
+    if (s->iothread) {
+        colo_compare_timer_del(s);
+    }
+
+    qemu_bh_delete(s->event_bh);
+
     AioContext *ctx = iothread_get_aio_context(s->iothread);
     aio_context_acquire(ctx);
     AIO_WAIT_WHILE(ctx, !s->out_sendco.done);
-- 
2.5.0

From: Derek Su <dereksu@qnap.com>

The patch is to fix the "pkt" memory leak in packet_enqueue().
The allocated "pkt" needs to be freed if the colo compare
primary or secondary queue is too big.

Replace the error_report of full queue with a trace event.

Signed-off-by: Derek Su <dereksu@qnap.com>
Reviewed-by: Zhang Chen <chen.zhang@intel.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Zhang Chen <chen.zhang@intel.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/colo-compare.c | 23 +++++++++++++++--------
 net/trace-events   |  1 +
 2 files changed, 16 insertions(+), 8 deletions(-)

diff --git a/net/colo-compare.c b/net/colo-compare.c
index XXXXXXX..XXXXXXX 100644
--- a/net/colo-compare.c
+++ b/net/colo-compare.c
@@ -XXX,XX +XXX,XX @@ enum {
     SECONDARY_IN,
 };
 
+static const char *colo_mode[] = {
+    [PRIMARY_IN] = "primary",
+    [SECONDARY_IN] = "secondary",
+};
 
 static int compare_chr_send(CompareState *s,
                             uint8_t *buf,
@@ -XXX,XX +XXX,XX @@ static int packet_enqueue(CompareState *s, int mode, Connection **con)
     ConnectionKey key;
     Packet *pkt = NULL;
     Connection *conn;
+    int ret;
 
     if (mode == PRIMARY_IN) {
         pkt = packet_new(s->pri_rs.buf,
@@ -XXX,XX +XXX,XX @@ static int packet_enqueue(CompareState *s, int mode, Connection **con)
     }
 
     if (mode == PRIMARY_IN) {
-        if (!colo_insert_packet(&conn->primary_list, pkt, &conn->pack)) {
-            error_report("colo compare primary queue size too big,"
-                         "drop packet");
-        }
+        ret = colo_insert_packet(&conn->primary_list, pkt, &conn->pack);
     } else {
-        if (!colo_insert_packet(&conn->secondary_list, pkt, &conn->sack)) {
-            error_report("colo compare secondary queue size too big,"
-                         "drop packet");
-        }
+        ret = colo_insert_packet(&conn->secondary_list, pkt, &conn->sack);
     }
+
+    if (!ret) {
+        trace_colo_compare_drop_packet(colo_mode[mode],
+            "queue size too big, drop packet");
+        packet_destroy(pkt, NULL);
+        pkt = NULL;
+    }
+
     *con = conn;
 
     return 0;
diff --git a/net/trace-events b/net/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/net/trace-events
+++ b/net/trace-events
@@ -XXX,XX +XXX,XX @@ colo_proxy_main(const char *chr) ": %s"
 
 # colo-compare.c
 colo_compare_main(const char *chr) ": %s"
+colo_compare_drop_packet(const char *queue, const char *chr) ": %s: %s"
 colo_compare_udp_miscompare(const char *sta, int size) ": %s = %d"
 colo_compare_icmp_miscompare(const char *sta, int size) ": %s = %d"
 colo_compare_ip_info(int psize, const char *sta, const char *stb, int ssize, const char *stc, const char *std) "ppkt size = %d, ip_src = %s, ip_dst = %s, spkt size = %d, ip_src = %s, ip_dst = %s"
-- 
2.5.0

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

libFuzzer found using 'qemu-system-i386 -M q35':

qemu: hardware error: e1000e: PSRCTL.BSIZE0 cannot be zero
CPU #0:
EAX=00000000 EBX=00000000 ECX=00000000 EDX=00000663
ESI=00000000 EDI=00000000 EBP=00000000 ESP=00000000
EIP=0000fff0 EFL=00000002 [-------] CPL=0 II=0 A20=1 SMM=0 HLT=0
ES =0000 00000000 0000ffff 00009300
CS =f000 ffff0000 0000ffff 00009b00
SS =0000 00000000 0000ffff 00009300
DS =0000 00000000 0000ffff 00009300
FS =0000 00000000 0000ffff 00009300
GS =0000 00000000 0000ffff 00009300
LDT=0000 00000000 0000ffff 00008200
TR =0000 00000000 0000ffff 00008b00
GDT=     00000000 0000ffff
IDT=     00000000 0000ffff
CR0=60000010 CR2=00000000 CR3=00000000 CR4=00000000
DR0=00000000 DR1=00000000 DR2=00000000 DR3=00000000
DR6=ffff0ff0 DR7=00000400
EFER=0000000000000000
FCW=037f FSW=0000 [ST=0] FTW=00 MXCSR=00001f80
FPR0=0000000000000000 0000 FPR1=0000000000000000 0000
FPR2=0000000000000000 0000 FPR3=0000000000000000 0000
FPR4=0000000000000000 0000 FPR5=0000000000000000 0000
FPR6=0000000000000000 0000 FPR7=0000000000000000 0000
XMM00=00000000000000000000000000000000 XMM01=00000000000000000000000000000000
XMM02=00000000000000000000000000000000 XMM03=00000000000000000000000000000000
XMM04=00000000000000000000000000000000 XMM05=00000000000000000000000000000000
XMM06=00000000000000000000000000000000 XMM07=00000000000000000000000000000000
==1988== ERROR: libFuzzer: deadly signal
    #6 0x7fae4d3ea894 in __GI_abort (/lib64/libc.so.6+0x22894)
    #7 0x563f4cc59a1d in hw_error (qemu-fuzz-i386+0xe8ca1d)
    #8 0x563f4d7c93f2 in e1000e_set_psrctl (qemu-fuzz-i386+0x19fc3f2)
    #9 0x563f4d7b798f in e1000e_core_write (qemu-fuzz-i386+0x19ea98f)
    #10 0x563f4d7afc46 in e1000e_mmio_write (qemu-fuzz-i386+0x19e2c46)
    #11 0x563f4cc9a0a7 in memory_region_write_accessor (qemu-fuzz-i386+0xecd0a7)
    #12 0x563f4cc99c13 in access_with_adjusted_size (qemu-fuzz-i386+0xeccc13)
    #13 0x563f4cc987b4 in memory_region_dispatch_write (qemu-fuzz-i386+0xecb7b4)

It simply sent the following 2 I/O command to the e1000e
PCI BAR #2 I/O region:

writew 0x0100 0x0c00 # RCTL =   E1000_RCTL_DTYP_MASK
  writeb 0x2170 0x00   # PSRCTL = 0

2813 static void
2814 e1000e_set_psrctl(E1000ECore *core, int index, uint32_t val)
2815 {
2816     if (core->mac[RCTL] & E1000_RCTL_DTYP_MASK) {
2817
2818         if ((val & E1000_PSRCTL_BSIZE0_MASK) == 0) {
2819             hw_error("e1000e: PSRCTL.BSIZE0 cannot be zero");
2820         }

Instead of calling hw_error() which abort the process (it is
meant for CPU fatal error condition, not for device logging),
log the invalid request with qemu_log_mask(LOG_GUEST_ERROR)
and return, ignoring the request.

Cc: qemu-stable@nongnu.org
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/e1000e_core.c | 10 +++++++---
 1 file changed, 7 insertions(+), 3 deletions(-)

diff --git a/hw/net/e1000e_core.c b/hw/net/e1000e_core.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/e1000e_core.c
+++ b/hw/net/e1000e_core.c
@@ -XXX,XX +XXX,XX @@
 */
 
 #include "qemu/osdep.h"
+#include "qemu/log.h"
 #include "net/net.h"
 #include "net/tap.h"
-#include "hw/hw.h"
 #include "hw/pci/msi.h"
 #include "hw/pci/msix.h"
 #include "sysemu/runstate.h"
@@ -XXX,XX +XXX,XX @@ e1000e_set_psrctl(E1000ECore *core, int index, uint32_t val)
     if (core->mac[RCTL] & E1000_RCTL_DTYP_MASK) {
 
         if ((val & E1000_PSRCTL_BSIZE0_MASK) == 0) {
-            hw_error("e1000e: PSRCTL.BSIZE0 cannot be zero");
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "e1000e: PSRCTL.BSIZE0 cannot be zero");
+            return;
         }
 
         if ((val & E1000_PSRCTL_BSIZE1_MASK) == 0) {
-            hw_error("e1000e: PSRCTL.BSIZE1 cannot be zero");
+            qemu_log_mask(LOG_GUEST_ERROR,
+                          "e1000e: PSRCTL.BSIZE1 cannot be zero");
+            return;
         }
     }
 
-- 
2.5.0

From: Thomas Huth <thuth@redhat.com>

It's been deprecated since QEMU v3.1, so it's time to finally
remove it. The "id" parameter can simply be used instead.

Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Thomas Huth <thuth@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 docs/system/deprecated.rst | 15 +++++++++------
 net/net.c                  | 10 +---------
 qapi/net.json              |  3 ---
 3 files changed, 10 insertions(+), 18 deletions(-)

diff --git a/docs/system/deprecated.rst b/docs/system/deprecated.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/system/deprecated.rst
+++ b/docs/system/deprecated.rst
@@ -XXX,XX +XXX,XX @@ The 'file' driver for drives is no longer appropriate for character or host
 devices and will only accept regular files (S_IFREG). The correct driver
 for these file types is 'host_cdrom' or 'host_device' as appropriate.
 
-``-net ...,name=``\ *name* (since 3.1)
-''''''''''''''''''''''''''''''''''''''
-
-The ``name`` parameter of the ``-net`` option is a synonym
-for the ``id`` parameter, which should now be used instead.
-
 ``-smp`` (invalid topologies) (since 3.1)
 '''''''''''''''''''''''''''''''''''''''''
 
@@ -XXX,XX +XXX,XX @@ What follows is a record of recently removed, formerly deprecated
 features that serves as a record for users who have encountered
 trouble after a recent upgrade.
 
+System emulator command line arguments
+--------------------------------------
+
+``-net ...,name=``\ *name* (removed in 5.1)
+'''''''''''''''''''''''''''''''''''''''''''
+
+The ``name`` parameter of the ``-net`` option was a synonym
+for the ``id`` parameter, which should now be used instead.
+
 QEMU Machine Protocol (QMP) commands
 ------------------------------------
 
diff --git a/net/net.c b/net/net.c
index XXXXXXX..XXXXXXX 100644
--- a/net/net.c
+++ b/net/net.c
@@ -XXX,XX +XXX,XX @@ static int net_client_init1(const void *object, bool is_netdev, Error **errp)
 {
     Netdev legacy = {0};
     const Netdev *netdev;
-    const char *name;
     NetClientState *peer = NULL;
 
     if (is_netdev) {
         netdev = object;
-        name = netdev->id;
 
         if (netdev->type == NET_CLIENT_DRIVER_NIC ||
             !net_client_init_fun[netdev->type]) {
@@ -XXX,XX +XXX,XX @@ static int net_client_init1(const void *object, bool is_netdev, Error **errp)
         const NetLegacyOptions *opts = net->opts;
         legacy.id = net->id;
         netdev = &legacy;
-        /* missing optional values have been initialized to "all bits zero" */
-        name = net->has_id ? net->id : net->name;
-
-        if (net->has_name) {
-            warn_report("The 'name' parameter is deprecated, use 'id' instead");
-        }
 
         /* Map the old options to the new flat type */
         switch (opts->type) {
@@ -XXX,XX +XXX,XX @@ static int net_client_init1(const void *object, bool is_netdev, Error **errp)
         }
     }
 
-    if (net_client_init_fun[netdev->type](netdev, name, peer, errp) < 0) {
+    if (net_client_init_fun[netdev->type](netdev, netdev->id, peer, errp) < 0) {
         /* FIXME drop when all init functions store an Error */
         if (errp && !*errp) {
             error_setg(errp, QERR_DEVICE_INIT_FAILED,
diff --git a/qapi/net.json b/qapi/net.json
index XXXXXXX..XXXXXXX 100644
--- a/qapi/net.json
+++ b/qapi/net.json
@@ -XXX,XX +XXX,XX @@
 #
 # @id: identifier for monitor commands
 #
-# @name: identifier for monitor commands, ignored if @id is present
-#
 # @opts: device type specific properties (legacy)
 #
 # Since: 1.2
@@ -XXX,XX +XXX,XX @@
 { 'struct': 'NetLegacy',
   'data': {
     '*id':   'str',
-    '*name': 'str',
     'opts':  'NetLegacyOptions' } }
 
 ##
-- 
2.5.0

From: Thomas Huth <thuth@redhat.com>

Now that the "name" parameter is gone, there is hardly any difference
between NetLegacy and Netdev anymore, so we can drop NetLegacy and always
use Netdev to simplify the code quite a bit.

The only two differences that were really left between Netdev and NetLegacy:

1) NetLegacy does not allow a "hubport" type. We can continue to block
   this with a simple check in net_client_init1() for this type.

2) The "id" parameter was optional in NetLegacy (and an internal id
   was chosen via assign_name() during initialization), but it is mandatory
   for Netdev. To avoid that the visitor code bails out here, we have to
   add an internal id to the QemuOpts already earlier now.

Signed-off-by: Thomas Huth <thuth@redhat.com>
Reviewed-by: Eric Blake <eblake@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/net.c     | 77 ++++++++++-------------------------------------------------
 qapi/net.json | 46 -----------------------------------
 2 files changed, 13 insertions(+), 110 deletions(-)

diff --git a/net/net.c b/net/net.c
index XXXXXXX..XXXXXXX 100644
--- a/net/net.c
+++ b/net/net.c
@@ -XXX,XX +XXX,XX @@ static int (* const net_client_init_fun[NET_CLIENT_DRIVER__MAX])(
 };
 
 
-static int net_client_init1(const void *object, bool is_netdev, Error **errp)
+static int net_client_init1(const Netdev *netdev, bool is_netdev, Error **errp)
 {
-    Netdev legacy = {0};
-    const Netdev *netdev;
     NetClientState *peer = NULL;
 
     if (is_netdev) {
-        netdev = object;
-
         if (netdev->type == NET_CLIENT_DRIVER_NIC ||
             !net_client_init_fun[netdev->type]) {
             error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "type",
@@ -XXX,XX +XXX,XX @@ static int net_client_init1(const void *object, bool is_netdev, Error **errp)
             return -1;
         }
     } else {
-        const NetLegacy *net = object;
-        const NetLegacyOptions *opts = net->opts;
-        legacy.id = net->id;
-        netdev = &legacy;
-
-        /* Map the old options to the new flat type */
-        switch (opts->type) {
-        case NET_LEGACY_OPTIONS_TYPE_NONE:
+        if (netdev->type == NET_CLIENT_DRIVER_NONE) {
             return 0; /* nothing to do */
-        case NET_LEGACY_OPTIONS_TYPE_NIC:
-            legacy.type = NET_CLIENT_DRIVER_NIC;
-            legacy.u.nic = opts->u.nic;
-            break;
-        case NET_LEGACY_OPTIONS_TYPE_USER:
-            legacy.type = NET_CLIENT_DRIVER_USER;
-            legacy.u.user = opts->u.user;
-            break;
-        case NET_LEGACY_OPTIONS_TYPE_TAP:
-            legacy.type = NET_CLIENT_DRIVER_TAP;
-            legacy.u.tap = opts->u.tap;
-            break;
-        case NET_LEGACY_OPTIONS_TYPE_L2TPV3:
-            legacy.type = NET_CLIENT_DRIVER_L2TPV3;
-            legacy.u.l2tpv3 = opts->u.l2tpv3;
-            break;
-        case NET_LEGACY_OPTIONS_TYPE_SOCKET:
-            legacy.type = NET_CLIENT_DRIVER_SOCKET;
-            legacy.u.socket = opts->u.socket;
-            break;
-        case NET_LEGACY_OPTIONS_TYPE_VDE:
-            legacy.type = NET_CLIENT_DRIVER_VDE;
-            legacy.u.vde = opts->u.vde;
-            break;
-        case NET_LEGACY_OPTIONS_TYPE_BRIDGE:
-            legacy.type = NET_CLIENT_DRIVER_BRIDGE;
-            legacy.u.bridge = opts->u.bridge;
-            break;
-        case NET_LEGACY_OPTIONS_TYPE_NETMAP:
-            legacy.type = NET_CLIENT_DRIVER_NETMAP;
-            legacy.u.netmap = opts->u.netmap;
-            break;
-        case NET_LEGACY_OPTIONS_TYPE_VHOST_USER:
-            legacy.type = NET_CLIENT_DRIVER_VHOST_USER;
-            legacy.u.vhost_user = opts->u.vhost_user;
-            break;
-        default:
-            abort();
         }
-
-        if (!net_client_init_fun[netdev->type]) {
+        if (netdev->type == NET_CLIENT_DRIVER_HUBPORT ||
+            !net_client_init_fun[netdev->type]) {
             error_setg(errp, QERR_INVALID_PARAMETER_VALUE, "type",
                        "a net backend type (maybe it is not compiled "
                        "into this binary)");
@@ -XXX,XX +XXX,XX @@ static int net_client_init1(const void *object, bool is_netdev, Error **errp)
 
         /* Do not add to a hub if it's a nic with a netdev= parameter. */
         if (netdev->type != NET_CLIENT_DRIVER_NIC ||
-            !opts->u.nic.has_netdev) {
+            !netdev->u.nic.has_netdev) {
             peer = net_hub_add_port(0, NULL, NULL);
         }
     }
@@ -XXX,XX +XXX,XX @@ static void show_netdevs(void)
 static int net_client_init(QemuOpts *opts, bool is_netdev, Error **errp)
 {
     gchar **substrings = NULL;
-    void *object = NULL;
+    Netdev *object = NULL;
     Error *err = NULL;
     int ret = -1;
     Visitor *v = opts_visitor_new(opts);
@@ -XXX,XX +XXX,XX @@ static int net_client_init(QemuOpts *opts, bool is_netdev, Error **errp)
         }
     }
 
-    if (is_netdev) {
-        visit_type_Netdev(v, NULL, (Netdev **)&object, &err);
-    } else {
-        visit_type_NetLegacy(v, NULL, (NetLegacy **)&object, &err);
+    /* Create an ID for -net if the user did not specify one */
+    if (!is_netdev && !qemu_opts_id(opts)) {
+        static int idx;
+        qemu_opts_set_id(opts, g_strdup_printf("__org.qemu.net%i", idx++));
     }
 
+    visit_type_Netdev(v, NULL, &object, &err);
+
     if (!err) {
         ret = net_client_init1(object, is_netdev, &err);
     }
 
-    if (is_netdev) {
-        qapi_free_Netdev(object);
-    } else {
-        qapi_free_NetLegacy(object);
-    }
+    qapi_free_Netdev(object);
 
 out:
     error_propagate(errp, err);
diff --git a/qapi/net.json b/qapi/net.json
index XXXXXXX..XXXXXXX 100644
--- a/qapi/net.json
+++ b/qapi/net.json
@@ -XXX,XX +XXX,XX @@
     'vhost-user': 'NetdevVhostUserOptions' } }
 
 ##
-# @NetLegacy:
-#
-# Captures the configuration of a network device; legacy.
-#
-# @id: identifier for monitor commands
-#
-# @opts: device type specific properties (legacy)
-#
-# Since: 1.2
-##
-{ 'struct': 'NetLegacy',
-  'data': {
-    '*id':   'str',
-    'opts':  'NetLegacyOptions' } }
-
-##
-# @NetLegacyOptionsType:
-#
-# Since: 1.2
-##
-{ 'enum': 'NetLegacyOptionsType',
-  'data': ['none', 'nic', 'user', 'tap', 'l2tpv3', 'socket', 'vde',
-           'bridge', 'netmap', 'vhost-user'] }
-
-##
-# @NetLegacyOptions:
-#
-# Like Netdev, but for use only by the legacy command line options
-#
-# Since: 1.2
-##
-{ 'union': 'NetLegacyOptions',
-  'base': { 'type': 'NetLegacyOptionsType' },
-  'discriminator': 'type',
-  'data': {
-    'nic':      'NetLegacyNicOptions',
-    'user':     'NetdevUserOptions',
-    'tap':      'NetdevTapOptions',
-    'l2tpv3':   'NetdevL2TPv3Options',
-    'socket':   'NetdevSocketOptions',
-    'vde':      'NetdevVdeOptions',
-    'bridge':   'NetdevBridgeOptions',
-    'netmap':   'NetdevNetmapOptions',
-    'vhost-user': 'NetdevVhostUserOptions' } }
-
-##
 # @NetFilterDirection:
 #
 # Indicates whether a netfilter is attached to a netdev's transmit queue or
-- 
2.5.0