Series comparison

-[PULL 0/7] Net patches
+[PULL V2 0/4] Net patches
-The following changes since commit 92f8c6fef13b31ba222c4d20ad8afd2b79c4c28e:
+The following changes since commit 187f35512106501fe9a11057f4d8705431e0026d:
-  Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20210525' into staging (2021-05-25 16:17:06 +0100)
+  Merge remote-tracking branch 'remotes/stsquad/tags/pull-testing-next-251019-3' into staging (2019-10-26 10:13:48 +0100)
 are available in the git repository at:
   https://github.com/jasowang/qemu.git tags/net-pull-request
-for you to fetch changes up to 90322e646e87c1440661cb3ddbc0cc94309d8a4f:
+for you to fetch changes up to 1e907a32b77e5d418538453df5945242e43224fa:
-  MAINTAINERS: Added eBPF maintainers information. (2021-06-04 15:25:46 +0800)
+  COLO-compare: Fix incorrect `if` logic (2019-10-29 10:28:07 +0800)
 ----------------------------------------------------------------
+Changes from V1:
+- Fix compling issue
 ----------------------------------------------------------------
-Andrew Melnychenko (7):
+Fan Yang (1):
-      net/tap: Added TUNSETSTEERINGEBPF code.
+      COLO-compare: Fix incorrect `if` logic
       net: Added SetSteeringEBPF method for NetClientState.
       ebpf: Added eBPF RSS program.
       ebpf: Added eBPF RSS loader.
       virtio-net: Added eBPF RSS to virtio-net.
       docs: Added eBPF documentation.
       MAINTAINERS: Added eBPF maintainers information.
- MAINTAINERS                    |   8 +
+Michael S. Tsirkin (1):
- configure                      |   8 +-
+      virtio: new post_load hook
- docs/devel/ebpf_rss.rst        | 125 +++++++++
- docs/devel/index.rst           |   1 +
+Mikhail Sennikovsky (1):
- ebpf/ebpf_rss-stub.c           |  40 +++
+      virtio-net: prevent offloads reset on migration
- ebpf/ebpf_rss.c                | 165 ++++++++++++
- ebpf/ebpf_rss.h                |  44 ++++
+Sven Schnelle (1):
- ebpf/meson.build               |   1 +
+      net: add tulip (dec21143) driver
- ebpf/rss.bpf.skeleton.h        | 431 +++++++++++++++++++++++++++++++
- ebpf/trace-events              |   4 +
+ MAINTAINERS                    |    6 +
- ebpf/trace.h                   |   1 +
+ hw/net/Kconfig                 |    5 +
- hw/net/vhost_net.c             |   3 +
+ hw/net/Makefile.objs           |    1 +
- hw/net/virtio-net.c            | 116 ++++++++-
+ hw/net/trace-events            |   14 +
- include/hw/virtio/virtio-net.h |   4 +
+ hw/net/tulip.c                 | 1029 ++++++++++++++++++++++++++++++++++++++++
- include/net/net.h              |   2 +
+ hw/net/tulip.h                 |  267 +++++++++++
- meson.build                    |  23 ++
+ hw/net/virtio-net.c            |   27 +-
- meson_options.txt              |   2 +
+ hw/virtio/virtio.c             |    7 +
- net/tap-bsd.c                  |   5 +
+ include/hw/pci/pci_ids.h       |    1 +
- net/tap-linux.c                |  13 +
+ include/hw/virtio/virtio-net.h |    2 +
- net/tap-linux.h                |   1 +
+ include/hw/virtio/virtio.h     |    6 +
- net/tap-solaris.c              |   5 +
+ net/colo-compare.c             |    6 +-
- net/tap-stub.c                 |   5 +
+files changed, 1365 insertions(+), 6 deletions(-)
- net/tap.c                      |   9 +
+ create mode 100644 hw/net/tulip.c
- net/tap_int.h                  |   1 +
+ create mode 100644 hw/net/tulip.h
  net/vhost-vdpa.c               |   2 +
  tools/ebpf/Makefile.ebpf       |  21 ++
  tools/ebpf/rss.bpf.c           | 571 +++++++++++++++++++++++++++++++++++++++++
 files changed, 1607 insertions(+), 4 deletions(-)
  create mode 100644 docs/devel/ebpf_rss.rst
  create mode 100644 ebpf/ebpf_rss-stub.c
  create mode 100644 ebpf/ebpf_rss.c
  create mode 100644 ebpf/ebpf_rss.h
  create mode 100644 ebpf/meson.build
  create mode 100644 ebpf/rss.bpf.skeleton.h
  create mode 100644 ebpf/trace-events
  create mode 100644 ebpf/trace.h
  create mode 100755 tools/ebpf/Makefile.ebpf
  create mode 100644 tools/ebpf/rss.bpf.c

-[PULL 1/7] net/tap: Added TUNSETSTEERINGEBPF code.
+Deleted patch
-From: Andrew Melnychenko <andrew@daynix.com>
-Additional code that will be used for eBPF setting steering routine.
-Signed-off-by: Andrew Melnychenko <andrew@daynix.com>
-Signed-off-by: Jason Wang <jasowang@redhat.com>
----
- net/tap-linux.h | 1 +
-file changed, 1 insertion(+)
-diff --git a/net/tap-linux.h b/net/tap-linux.h
-index XXXXXXX..XXXXXXX 100644
---- a/net/tap-linux.h
-+++ b/net/tap-linux.h
-@@ -XXX,XX +XXX,XX @@
- #define TUNSETQUEUE  _IOW('T', 217, int)
- #define TUNSETVNETLE _IOW('T', 220, int)
- #define TUNSETVNETBE _IOW('T', 222, int)
-+#define TUNSETSTEERINGEBPF _IOR('T', 224, int)
- #endif
---
-.7.4

-[PULL 2/7] net: Added SetSteeringEBPF method for NetClientState.
+Deleted patch
-From: Andrew Melnychenko <andrew@daynix.com>
-For now, that method supported only by Linux TAP.
-Linux TAP uses TUNSETSTEERINGEBPF ioctl.
-Signed-off-by: Andrew Melnychenko <andrew@daynix.com>
-Signed-off-by: Jason Wang <jasowang@redhat.com>
----
- include/net/net.h |  2 ++
- net/tap-bsd.c     |  5 +++++
- net/tap-linux.c   | 13 +++++++++++++
- net/tap-solaris.c |  5 +++++
- net/tap-stub.c    |  5 +++++
- net/tap.c         |  9 +++++++++
- net/tap_int.h     |  1 +
-files changed, 40 insertions(+)
-diff --git a/include/net/net.h b/include/net/net.h
-index XXXXXXX..XXXXXXX 100644
---- a/include/net/net.h
-+++ b/include/net/net.h
-@@ -XXX,XX +XXX,XX @@ typedef int (SetVnetBE)(NetClientState *, bool);
- typedef struct SocketReadState SocketReadState;
- typedef void (SocketReadStateFinalize)(SocketReadState *rs);
- typedef void (NetAnnounce)(NetClientState *);
-+typedef bool (SetSteeringEBPF)(NetClientState *, int);
- typedef struct NetClientInfo {
-     NetClientDriver type;
-@@ -XXX,XX +XXX,XX @@ typedef struct NetClientInfo {
-     SetVnetLE *set_vnet_le;
-     SetVnetBE *set_vnet_be;
-     NetAnnounce *announce;
-+    SetSteeringEBPF *set_steering_ebpf;
- } NetClientInfo;
- struct NetClientState {
-diff --git a/net/tap-bsd.c b/net/tap-bsd.c
-index XXXXXXX..XXXXXXX 100644
---- a/net/tap-bsd.c
-+++ b/net/tap-bsd.c
-@@ -XXX,XX +XXX,XX @@ int tap_fd_get_ifname(int fd, char *ifname)
- {
-     return -1;
- }
-+
-+int tap_fd_set_steering_ebpf(int fd, int prog_fd)
-+{
-+    return -1;
-+}
-diff --git a/net/tap-linux.c b/net/tap-linux.c
-index XXXXXXX..XXXXXXX 100644
---- a/net/tap-linux.c
-+++ b/net/tap-linux.c
-@@ -XXX,XX +XXX,XX @@ int tap_fd_get_ifname(int fd, char *ifname)
-     pstrcpy(ifname, sizeof(ifr.ifr_name), ifr.ifr_name);
-     return 0;
- }
-+
-+int tap_fd_set_steering_ebpf(int fd, int prog_fd)
-+{
-+    if (ioctl(fd, TUNSETSTEERINGEBPF, (void *) &prog_fd) != 0) {
-+        error_report("Issue while setting TUNSETSTEERINGEBPF:"
-+                    " %s with fd: %d, prog_fd: %d",
-+                    strerror(errno), fd, prog_fd);
-+
-+       return -1;
-+    }
-+
-+    return 0;
-+}
-diff --git a/net/tap-solaris.c b/net/tap-solaris.c
-index XXXXXXX..XXXXXXX 100644
---- a/net/tap-solaris.c
-+++ b/net/tap-solaris.c
-@@ -XXX,XX +XXX,XX @@ int tap_fd_get_ifname(int fd, char *ifname)
- {
-     return -1;
- }
-+
-+int tap_fd_set_steering_ebpf(int fd, int prog_fd)
-+{
-+    return -1;
-+}
-diff --git a/net/tap-stub.c b/net/tap-stub.c
-index XXXXXXX..XXXXXXX 100644
---- a/net/tap-stub.c
-+++ b/net/tap-stub.c
-@@ -XXX,XX +XXX,XX @@ int tap_fd_get_ifname(int fd, char *ifname)
- {
-     return -1;
- }
-+
-+int tap_fd_set_steering_ebpf(int fd, int prog_fd)
-+{
-+    return -1;
-+}
-diff --git a/net/tap.c b/net/tap.c
-index XXXXXXX..XXXXXXX 100644
---- a/net/tap.c
-+++ b/net/tap.c
-@@ -XXX,XX +XXX,XX @@ static void tap_poll(NetClientState *nc, bool enable)
-     tap_write_poll(s, enable);
- }
-+static bool tap_set_steering_ebpf(NetClientState *nc, int prog_fd)
-+{
-+    TAPState *s = DO_UPCAST(TAPState, nc, nc);
-+    assert(nc->info->type == NET_CLIENT_DRIVER_TAP);
-+
-+    return tap_fd_set_steering_ebpf(s->fd, prog_fd) == 0;
-+}
-+
- int tap_get_fd(NetClientState *nc)
- {
-     TAPState *s = DO_UPCAST(TAPState, nc, nc);
-@@ -XXX,XX +XXX,XX @@ static NetClientInfo net_tap_info = {
-     .set_vnet_hdr_len = tap_set_vnet_hdr_len,
-     .set_vnet_le = tap_set_vnet_le,
-     .set_vnet_be = tap_set_vnet_be,
-+    .set_steering_ebpf = tap_set_steering_ebpf,
- };
- static TAPState *net_tap_fd_init(NetClientState *peer,
-diff --git a/net/tap_int.h b/net/tap_int.h
-index XXXXXXX..XXXXXXX 100644
---- a/net/tap_int.h
-+++ b/net/tap_int.h
-@@ -XXX,XX +XXX,XX @@ int tap_fd_set_vnet_be(int fd, int vnet_is_be);
- int tap_fd_enable(int fd);
- int tap_fd_disable(int fd);
- int tap_fd_get_ifname(int fd, char *ifname);
-+int tap_fd_set_steering_ebpf(int fd, int prog_fd);
- #endif /* NET_TAP_INT_H */
---
-.7.4

-[PULL 3/7] ebpf: Added eBPF RSS program.
+[PULL V2 1/4] net: add tulip (dec21143) driver
-From: Andrew Melnychenko <andrew@daynix.com>
+From: Sven Schnelle <svens@stackframe.org>
-RSS program and Makefile to build it.
+This adds the basic functionality to emulate a Tulip NIC.
 The bpftool used to generate '.h' file.
 The data in that file may be loaded by libbpf.
 EBPF compilation is not required for building qemu.
 You can use Makefile if you need to regenerate rss.bpf.skeleton.h.
-Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
+Implemented are:
-Signed-off-by: Andrew Melnychenko <andrew@daynix.com>
 - RX and TX functionality
 - Perfect Frame Filtering
 - Big/Little Endian descriptor support
 - 93C46 EEPROM support
 - LXT970 PHY
 Not implemented, mostly because i had no OS using these functions:
 - Imperfect frame filtering
 - General Purpose Timer
 - Transmit automatic polling
 - Boot ROM support
 - SIA interface
 - Big/Little Endian data buffer conversion
 Successfully tested with the following Operating Systems:
 - MSDOS with Microsoft Network Client 3.0 and DEC ODI drivers
 - HPPA Linux
 - Windows XP
 - HP-UX
 Signed-off-by: Sven Schnelle <svens@stackframe.org>
 Message-Id: <20191022155413.4619-1-svens@stackframe.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- tools/ebpf/Makefile.ebpf |  21 ++
+ MAINTAINERS              |    6 +
- tools/ebpf/rss.bpf.c     | 571 +++++++++++++++++++++++++++++++++++++++++++++++
+ hw/net/Kconfig           |    5 +
-files changed, 592 insertions(+)
+ hw/net/Makefile.objs     |    1 +
- create mode 100755 tools/ebpf/Makefile.ebpf
+ hw/net/trace-events      |   14 +
- create mode 100644 tools/ebpf/rss.bpf.c
+ hw/net/tulip.c           | 1029 ++++++++++++++++++++++++++++++++++++++++++++++
  hw/net/tulip.h           |  267 ++++++++++++
  include/hw/pci/pci_ids.h |    1 +
 files changed, 1323 insertions(+)
  create mode 100644 hw/net/tulip.c
  create mode 100644 hw/net/tulip.h
-diff --git a/tools/ebpf/Makefile.ebpf b/tools/ebpf/Makefile.ebpf
+diff --git a/MAINTAINERS b/MAINTAINERS
-new file mode 100755
+index XXXXXXX..XXXXXXX 100644
-index XXXXXXX..XXXXXXX
+--- a/MAINTAINERS
---- /dev/null
++++ b/MAINTAINERS
-+++ b/tools/ebpf/Makefile.ebpf
+@@ -XXX,XX +XXX,XX @@ M: Stefan Weil <sw@weilnetz.de>
-@@ -XXX,XX +XXX,XX @@
+ S: Maintained
-+OBJS = rss.bpf.o
+ F: hw/net/eepro100.c
-+
-+LLC ?= llc
++tulip
-+CLANG ?= clang
++M: Sven Schnelle <svens@stackframe.org>
-+INC_FLAGS = `$(CLANG) -print-file-name=include`
++S: Maintained
-+EXTRA_CFLAGS ?= -O2 -emit-llvm -fno-stack-protector
++F: hw/net/tulip.c
-+
++F: hw/net/tulip.h
-+all: $(OBJS)
++
-+
+ Generic Loader
-+.PHONY: clean
+ M: Alistair Francis <alistair@alistair23.me>
-+
+ S: Maintained
-+clean:
+diff --git a/hw/net/Kconfig b/hw/net/Kconfig
-+    rm -f $(OBJS)
+index XXXXXXX..XXXXXXX 100644
-+
+--- a/hw/net/Kconfig
-+$(OBJS):  %.o:%.c
++++ b/hw/net/Kconfig
-+    $(CLANG) $(INC_FLAGS) \
+@@ -XXX,XX +XXX,XX @@ config PCNET_PCI
-+                -D__KERNEL__ -D__ASM_SYSREG_H \
+ config PCNET_COMMON
-+                -I../include $(LINUXINCLUDE) \
+     bool
-+                $(EXTRA_CFLAGS) -c $< -o -| $(LLC) -march=bpf -filetype=obj -o $@
-+    bpftool gen skeleton rss.bpf.o > rss.bpf.skeleton.h
++config TULIP
-+    cp rss.bpf.skeleton.h ../../ebpf/
++    bool
-diff --git a/tools/ebpf/rss.bpf.c b/tools/ebpf/rss.bpf.c
++    default y if PCI_DEVICES
 +    depends on PCI
 +
  config E1000_PCI
      bool
      default y if PCI_DEVICES
 diff --git a/hw/net/Makefile.objs b/hw/net/Makefile.objs
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/net/Makefile.objs
 +++ b/hw/net/Makefile.objs
@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_E1000E_PCI_EXPRESS) += e1000e.o e1000e_core.o e1000x_common.
  common-obj-$(CONFIG_RTL8139_PCI) += rtl8139.o
  common-obj-$(CONFIG_VMXNET3_PCI) += net_tx_pkt.o net_rx_pkt.o
  common-obj-$(CONFIG_VMXNET3_PCI) += vmxnet3.o
 +common-obj-$(CONFIG_TULIP) += tulip.o
  common-obj-$(CONFIG_SMC91C111) += smc91c111.o
  common-obj-$(CONFIG_LAN9118) += lan9118.o
 diff --git a/hw/net/trace-events b/hw/net/trace-events
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/net/trace-events
 +++ b/hw/net/trace-events
@@ -XXX,XX +XXX,XX @@ virtio_net_announce_notify(void) ""
  virtio_net_announce_timer(int round) "%d"
  virtio_net_handle_announce(int round) "%d"
  virtio_net_post_load_device(void)
 +
 +# tulip.c
 +tulip_reg_write(uint64_t addr, const char *name, int size, uint64_t val) "addr 0x%02"PRIx64" (%s) size %d value 0x%08"PRIx64
 +tulip_reg_read(uint64_t addr, const char *name, int size, uint64_t val) "addr 0x%02"PRIx64" (%s) size %d value 0x%08"PRIx64
 +tulip_receive(const uint8_t *buf, size_t len) "buf %p size %zu"
 +tulip_descriptor(const char *prefix, uint32_t addr, uint32_t status, uint32_t control, uint32_t len1, uint32_t len2, uint32_t buf1, uint32_t buf2) "%s 0x%08x: status 0x%08x control 0x%03x len1 %4d len2 %4d buf1 0x%08x buf2 0x%08x"
 +tulip_rx_state(const char *state) "RX %s"
 +tulip_tx_state(const char *state) "TX %s"
 +tulip_irq(uint32_t mask, uint32_t en, const char *state) "mask 0x%08x ie 0x%08x %s"
 +tulip_mii_write(int phy, int reg, uint16_t data) "phy 0x%x reg 0x%x data 0x%04x"
 +tulip_mii_read(int phy, int reg, uint16_t data) "phy 0x%x, reg 0x%x data 0x%04x"
 +tulip_reset(void) ""
 +tulip_setup_frame(void) ""
 +tulip_setup_filter(int n, uint8_t a, uint8_t b, uint8_t c, uint8_t d, uint8_t e, uint8_t f) "%d: %02x:%02x:%02x:%02x:%02x:%02x"
 diff --git a/hw/net/tulip.c b/hw/net/tulip.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/tools/ebpf/rss.bpf.c
++++ b/hw/net/tulip.c
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * eBPF RSS program
++ * QEMU TULIP Emulation
 + *
-+ * Developed by Daynix Computing LTD (http://www.daynix.com)
++ * Copyright (c) 2019 Sven Schnelle <svens@stackframe.org>
 + *
-+ * Authors:
++ * This work is licensed under the GNU GPL license version 2 or later.
 + *  Andrew Melnychenko <andrew@daynix.com>
 + *  Yuri Benditovich <yuri.benditovich@daynix.com>
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2.  See
 + * the COPYING file in the top-level directory.
 + *
 + * Prepare:
 + * Requires llvm, clang, bpftool, linux kernel tree
 + *
 + * Build rss.bpf.skeleton.h:
 + * make -f Makefile.ebpf clean all
 + */
 +
-+#include <stddef.h>
++#include "qemu/osdep.h"
-+#include <stdbool.h>
++#include "qemu/log.h"
-+#include <linux/bpf.h>
++#include "hw/irq.h"
-+
++#include "hw/pci/pci.h"
-+#include <linux/in.h>
++#include "hw/qdev-properties.h"
-+#include <linux/if_ether.h>
++#include "hw/nvram/eeprom93xx.h"
-+#include <linux/ip.h>
++#include "migration/vmstate.h"
-+#include <linux/ipv6.h>
++#include "sysemu/sysemu.h"
-+
++#include "tulip.h"
-+#include <linux/udp.h>
++#include "trace.h"
-+#include <linux/tcp.h>
++#include "net/eth.h"
 +
-+#include <bpf/bpf_helpers.h>
++typedef struct TULIPState {
-+#include <bpf/bpf_endian.h>
++    PCIDevice dev;
-+#include <linux/virtio_net.h>
++    MemoryRegion io;
-+
++    MemoryRegion memory;
-+#define INDIRECTION_TABLE_SIZE 128
++    NICConf c;
-+#define HASH_CALCULATION_BUFFER_SIZE 36
++    qemu_irq irq;
-+
++    NICState *nic;
-+struct rss_config_t {
++    eeprom_t *eeprom;
-+    __u8 redirect;
++    uint32_t csr[16];
-+    __u8 populate_hash;
++
-+    __u32 hash_types;
++    /* state for MII */
-+    __u16 indirections_len;
++    uint32_t old_csr9;
-+    __u16 default_queue;
++    uint32_t mii_word;
-+} __attribute__((packed));
++    uint32_t mii_bitcnt;
 +
-+struct toeplitz_key_data_t {
++    hwaddr current_rx_desc;
-+    __u32 leftmost_32_bits;
++    hwaddr current_tx_desc;
-+    __u8 next_byte[HASH_CALCULATION_BUFFER_SIZE];
++
 +    uint8_t rx_frame[2048];
 +    uint8_t tx_frame[2048];
 +    uint16_t tx_frame_len;
 +    uint16_t rx_frame_len;
 +    uint16_t rx_frame_size;
 +
 +    uint32_t rx_status;
 +    uint8_t filter[16][6];
 +} TULIPState;
 +
 +static const VMStateDescription vmstate_pci_tulip = {
 +    .name = "tulip",
 +    .fields = (VMStateField[]) {
 +        VMSTATE_PCI_DEVICE(dev, TULIPState),
 +        VMSTATE_UINT32_ARRAY(csr, TULIPState, 16),
 +        VMSTATE_UINT32(old_csr9, TULIPState),
 +        VMSTATE_UINT32(mii_word, TULIPState),
 +        VMSTATE_UINT32(mii_bitcnt, TULIPState),
 +        VMSTATE_UINT64(current_rx_desc, TULIPState),
 +        VMSTATE_UINT64(current_tx_desc, TULIPState),
 +        VMSTATE_BUFFER(rx_frame, TULIPState),
 +        VMSTATE_BUFFER(tx_frame, TULIPState),
 +        VMSTATE_UINT16(rx_frame_len, TULIPState),
 +        VMSTATE_UINT16(tx_frame_len, TULIPState),
 +        VMSTATE_UINT16(rx_frame_size, TULIPState),
 +        VMSTATE_UINT32(rx_status, TULIPState),
 +        VMSTATE_UINT8_2DARRAY(filter, TULIPState, 16, 6),
 +        VMSTATE_END_OF_LIST()
 +    }
 +};
 +
-+struct packet_hash_info_t {
++static void tulip_desc_read(TULIPState *s, hwaddr p,
-+    __u8 is_ipv4;
++        struct tulip_descriptor *desc)
-+    __u8 is_ipv6;
++{
-+    __u8 is_udp;
++    if (s->csr[0] & CSR0_DBO) {
-+    __u8 is_tcp;
++        desc->status = ldl_be_pci_dma(&s->dev, p);
-+    __u8 is_ipv6_ext_src;
++        desc->control = ldl_be_pci_dma(&s->dev, p + 4);
-+    __u8 is_ipv6_ext_dst;
++        desc->buf_addr1 = ldl_be_pci_dma(&s->dev, p + 8);
-+    __u8 is_fragmented;
++        desc->buf_addr2 = ldl_be_pci_dma(&s->dev, p + 12);
-+
++    } else {
-+    __u16 src_port;
++        desc->status = ldl_le_pci_dma(&s->dev, p);
-+    __u16 dst_port;
++        desc->control = ldl_le_pci_dma(&s->dev, p + 4);
-+
++        desc->buf_addr1 = ldl_le_pci_dma(&s->dev, p + 8);
-+    union {
++        desc->buf_addr2 = ldl_le_pci_dma(&s->dev, p + 12);
-+        struct {
++    }
-+            __be32 in_src;
++}
-+            __be32 in_dst;
++
-+        };
++static void tulip_desc_write(TULIPState *s, hwaddr p,
-+
++        struct tulip_descriptor *desc)
-+        struct {
++{
-+            struct in6_addr in6_src;
++    if (s->csr[0] & CSR0_DBO) {
-+            struct in6_addr in6_dst;
++        stl_be_pci_dma(&s->dev, p, desc->status);
-+            struct in6_addr in6_ext_src;
++        stl_be_pci_dma(&s->dev, p + 4, desc->control);
-+            struct in6_addr in6_ext_dst;
++        stl_be_pci_dma(&s->dev, p + 8, desc->buf_addr1);
-+        };
++        stl_be_pci_dma(&s->dev, p + 12, desc->buf_addr2);
-+    };
++    } else {
 +        stl_le_pci_dma(&s->dev, p, desc->status);
 +        stl_le_pci_dma(&s->dev, p + 4, desc->control);
 +        stl_le_pci_dma(&s->dev, p + 8, desc->buf_addr1);
 +        stl_le_pci_dma(&s->dev, p + 12, desc->buf_addr2);
 +    }
 +}
 +
 +static void tulip_update_int(TULIPState *s)
 +{
 +    uint32_t ie = s->csr[5] & s->csr[7];
 +    bool assert = false;
 +
 +    s->csr[5] &= ~(CSR5_AIS | CSR5_NIS);
 +
 +    if (ie & (CSR5_TI | CSR5_TU | CSR5_RI | CSR5_GTE | CSR5_ERI)) {
 +        s->csr[5] |= CSR5_NIS;
 +    }
 +
 +    if (ie & (CSR5_LC | CSR5_GPI | CSR5_FBE | CSR5_LNF | CSR5_ETI | CSR5_RWT |
 +              CSR5_RPS | CSR5_RU | CSR5_UNF | CSR5_LNP_ANC | CSR5_TJT |
 +              CSR5_TPS)) {
 +        s->csr[5] |= CSR5_AIS;
 +    }
 +
 +    assert = s->csr[5] & s->csr[7] & (CSR5_AIS | CSR5_NIS);
 +    trace_tulip_irq(s->csr[5], s->csr[7], assert ? "assert" : "deassert");
 +    qemu_set_irq(s->irq, assert);
 +}
 +
 +static bool tulip_rx_stopped(TULIPState *s)
 +{
 +    return ((s->csr[5] >> CSR5_RS_SHIFT) & CSR5_RS_MASK) == CSR5_RS_STOPPED;
 +}
 +
 +static void tulip_dump_tx_descriptor(TULIPState *s,
 +        struct tulip_descriptor *desc)
 +{
 +    trace_tulip_descriptor("TX ", s->current_tx_desc,
 +                desc->status, desc->control >> 22,
 +                desc->control & 0x7ff, (desc->control >> 11) & 0x7ff,
 +                desc->buf_addr1, desc->buf_addr2);
 +}
 +
 +static void tulip_dump_rx_descriptor(TULIPState *s,
 +        struct tulip_descriptor *desc)
 +{
 +    trace_tulip_descriptor("RX ", s->current_rx_desc,
 +                desc->status, desc->control >> 22,
 +                desc->control & 0x7ff, (desc->control >> 11) & 0x7ff,
 +                desc->buf_addr1, desc->buf_addr2);
 +}
 +
 +static void tulip_next_rx_descriptor(TULIPState *s,
 +    struct tulip_descriptor *desc)
 +{
 +    if (desc->control & RDES1_RER) {
 +        s->current_rx_desc = s->csr[3];
 +    } else if (desc->control & RDES1_RCH) {
 +        s->current_rx_desc = desc->buf_addr2;
 +    } else {
 +        s->current_rx_desc += sizeof(struct tulip_descriptor) +
 +                (((s->csr[0] >> CSR0_DSL_SHIFT) & CSR0_DSL_MASK) << 2);
 +    }
 +    s->current_rx_desc &= ~3ULL;
 +}
 +
 +static void tulip_copy_rx_bytes(TULIPState *s, struct tulip_descriptor *desc)
 +{
 +    int len1 = (desc->control >> RDES1_BUF1_SIZE_SHIFT) & RDES1_BUF1_SIZE_MASK;
 +    int len2 = (desc->control >> RDES1_BUF2_SIZE_SHIFT) & RDES1_BUF2_SIZE_MASK;
 +    int len;
 +
 +    if (s->rx_frame_len && len1) {
 +        if (s->rx_frame_len > len1) {
 +            len = len1;
 +        } else {
 +            len = s->rx_frame_len;
 +        }
 +        pci_dma_write(&s->dev, desc->buf_addr1, s->rx_frame +
 +            (s->rx_frame_size - s->rx_frame_len), len);
 +        s->rx_frame_len -= len;
 +    }
 +
 +    if (s->rx_frame_len && len2) {
 +        if (s->rx_frame_len > len2) {
 +            len = len2;
 +        } else {
 +            len = s->rx_frame_len;
 +        }
 +        pci_dma_write(&s->dev, desc->buf_addr2, s->rx_frame +
 +            (s->rx_frame_size - s->rx_frame_len), len);
 +        s->rx_frame_len -= len;
 +    }
 +}
 +
 +static bool tulip_filter_address(TULIPState *s, const uint8_t *addr)
 +{
 +    static const char broadcast[] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
 +    bool ret = false;
 +    int i;
 +
 +    for (i = 0; i < 16 && ret == false; i++) {
 +        if (!memcmp(&s->filter[i], addr, ETH_ALEN)) {
 +            ret = true;
 +        }
 +    }
 +
 +    if (!memcmp(addr, broadcast, ETH_ALEN)) {
 +        return true;
 +    }
 +
 +    if (s->csr[6] & (CSR6_PR | CSR6_RA)) {
 +        /* Promiscuous mode enabled */
 +        s->rx_status |= RDES0_FF;
 +        return true;
 +    }
 +
 +    if ((s->csr[6] & CSR6_PM) && (addr[0] & 1)) {
 +        /* Pass all Multicast enabled */
 +        s->rx_status |= RDES0_MF;
 +        return true;
 +    }
 +
 +    if (s->csr[6] & CSR6_IF) {
 +        ret ^= true;
 +    }
 +    return ret;
 +}
 +
 +static ssize_t tulip_receive(TULIPState *s, const uint8_t *buf, size_t size)
 +{
 +    struct tulip_descriptor desc;
 +
 +    trace_tulip_receive(buf, size);
 +
 +    if (size < 14 || size > 2048 || s->rx_frame_len || tulip_rx_stopped(s)) {
 +        return 0;
 +    }
 +
 +    if (!tulip_filter_address(s, buf)) {
 +        return size;
 +    }
 +
 +    do {
 +        tulip_desc_read(s, s->current_rx_desc, &desc);
 +        tulip_dump_rx_descriptor(s, &desc);
 +
 +        if (!(desc.status & RDES0_OWN)) {
 +            s->csr[5] |= CSR5_RU;
 +            tulip_update_int(s);
 +            return s->rx_frame_size - s->rx_frame_len;
 +        }
 +        desc.status = 0;
 +
 +        if (!s->rx_frame_len) {
 +            s->rx_frame_size = size + 4;
 +            s->rx_status = RDES0_LS |
 +                 ((s->rx_frame_size & RDES0_FL_MASK) << RDES0_FL_SHIFT);
 +            desc.status |= RDES0_FS;
 +            memcpy(s->rx_frame, buf, size);
 +            s->rx_frame_len = s->rx_frame_size;
 +        }
 +
 +        tulip_copy_rx_bytes(s, &desc);
 +
 +        if (!s->rx_frame_len) {
 +            desc.status |= s->rx_status;
 +            s->csr[5] |= CSR5_RI;
 +            tulip_update_int(s);
 +        }
 +        tulip_dump_rx_descriptor(s, &desc);
 +        tulip_desc_write(s, s->current_rx_desc, &desc);
 +        tulip_next_rx_descriptor(s, &desc);
 +    } while (s->rx_frame_len);
 +    return size;
 +}
 +
 +static ssize_t tulip_receive_nc(NetClientState *nc,
 +                             const uint8_t *buf, size_t size)
 +{
 +    return tulip_receive(qemu_get_nic_opaque(nc), buf, size);
 +}
 +
 +
 +static NetClientInfo net_tulip_info = {
 +    .type = NET_CLIENT_DRIVER_NIC,
 +    .size = sizeof(NICState),
 +    .receive = tulip_receive_nc,
 +};
 +
-+struct bpf_map_def SEC("maps")
++static const char *tulip_reg_name(const hwaddr addr)
-+tap_rss_map_configurations = {
++{
-+        .type        = BPF_MAP_TYPE_ARRAY,
++    switch (addr) {
-+        .key_size    = sizeof(__u32),
++    case CSR(0):
-+        .value_size  = sizeof(struct rss_config_t),
++        return "CSR0";
-+        .max_entries = 1,
++
 +    case CSR(1):
 +        return "CSR1";
 +
 +    case CSR(2):
 +        return "CSR2";
 +
 +    case CSR(3):
 +        return "CSR3";
 +
 +    case CSR(4):
 +        return "CSR4";
 +
 +    case CSR(5):
 +        return "CSR5";
 +
 +    case CSR(6):
 +        return "CSR6";
 +
 +    case CSR(7):
 +        return "CSR7";
 +
 +    case CSR(8):
 +        return "CSR8";
 +
 +    case CSR(9):
 +        return "CSR9";
 +
 +    case CSR(10):
 +        return "CSR10";
 +
 +    case CSR(11):
 +        return "CSR11";
 +
 +    case CSR(12):
 +        return "CSR12";
 +
 +    case CSR(13):
 +        return "CSR13";
 +
 +    case CSR(14):
 +        return "CSR14";
 +
 +    case CSR(15):
 +        return "CSR15";
 +
 +    default:
 +        break;
 +    }
 +    return "";
 +}
 +
 +static const char *tulip_rx_state_name(int state)
 +{
 +    switch (state) {
 +    case CSR5_RS_STOPPED:
 +        return "STOPPED";
 +
 +    case CSR5_RS_RUNNING_FETCH:
 +        return "RUNNING/FETCH";
 +
 +    case CSR5_RS_RUNNING_CHECK_EOR:
 +        return "RUNNING/CHECK EOR";
 +
 +    case CSR5_RS_RUNNING_WAIT_RECEIVE:
 +        return "WAIT RECEIVE";
 +
 +    case CSR5_RS_SUSPENDED:
 +        return "SUSPENDED";
 +
 +    case CSR5_RS_RUNNING_CLOSE:
 +        return "RUNNING/CLOSE";
 +
 +    case CSR5_RS_RUNNING_FLUSH:
 +        return "RUNNING/FLUSH";
 +
 +    case CSR5_RS_RUNNING_QUEUE:
 +        return "RUNNING/QUEUE";
 +
 +    default:
 +        break;
 +    }
 +    return "";
 +}
 +
 +static const char *tulip_tx_state_name(int state)
 +{
 +    switch (state) {
 +    case CSR5_TS_STOPPED:
 +        return "STOPPED";
 +
 +    case CSR5_TS_RUNNING_FETCH:
 +        return "RUNNING/FETCH";
 +
 +    case CSR5_TS_RUNNING_WAIT_EOT:
 +        return "RUNNING/WAIT EOT";
 +
 +    case CSR5_TS_RUNNING_READ_BUF:
 +        return "RUNNING/READ BUF";
 +
 +    case CSR5_TS_RUNNING_SETUP:
 +        return "RUNNING/SETUP";
 +
 +    case CSR5_TS_SUSPENDED:
 +        return "SUSPENDED";
 +
 +    case CSR5_TS_RUNNING_CLOSE:
 +        return "RUNNING/CLOSE";
 +
 +    default:
 +        break;
 +    }
 +    return "";
 +}
 +
 +static void tulip_update_rs(TULIPState *s, int state)
 +{
 +    s->csr[5] &= ~(CSR5_RS_MASK << CSR5_RS_SHIFT);
 +    s->csr[5] |= (state & CSR5_RS_MASK) << CSR5_RS_SHIFT;
 +    trace_tulip_rx_state(tulip_rx_state_name(state));
 +}
 +
 +static uint16_t tulip_mdi_default[] = {
 +    /* MDI Registers 0 - 6, 7 */
 +    0x3100, 0xf02c, 0x7810, 0x0000, 0x0501, 0x4181, 0x0000, 0x0000,
 +    /* MDI Registers 8 - 15 */
 +    0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
 +    /* MDI Registers 16 - 31 */
 +    0x0003, 0x0000, 0x0001, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
 +    0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
 +};
 +
-+struct bpf_map_def SEC("maps")
++/* Readonly mask for MDI (PHY) registers */
-+tap_rss_map_toeplitz_key = {
++static const uint16_t tulip_mdi_mask[] = {
-+        .type        = BPF_MAP_TYPE_ARRAY,
++    0x0000, 0xffff, 0xffff, 0xffff, 0xc01f, 0xffff, 0xffff, 0x0000,
-+        .key_size    = sizeof(__u32),
++    0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
-+        .value_size  = sizeof(struct toeplitz_key_data_t),
++    0x0fff, 0x0000, 0xffff, 0xffff, 0xffff, 0xffff, 0xffff, 0xffff,
-+        .max_entries = 1,
++    0xffff, 0xffff, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
 +};
 +
-+struct bpf_map_def SEC("maps")
++static uint16_t tulip_mii_read(TULIPState *s, int phy, int reg)
-+tap_rss_map_indirection_table = {
++{
-+        .type        = BPF_MAP_TYPE_ARRAY,
++    uint16_t ret = 0;
-+        .key_size    = sizeof(__u32),
++    if (phy == 1) {
-+        .value_size  = sizeof(__u16),
++        ret = tulip_mdi_default[reg];
-+        .max_entries = INDIRECTION_TABLE_SIZE,
++    }
 +    trace_tulip_mii_read(phy, reg, ret);
 +    return ret;
 +}
 +
 +static void tulip_mii_write(TULIPState *s, int phy, int reg, uint16_t data)
 +{
 +    trace_tulip_mii_write(phy, reg, data);
 +
 +    if (phy != 1) {
 +        return;
 +    }
 +
 +    tulip_mdi_default[reg] &= ~tulip_mdi_mask[reg];
 +    tulip_mdi_default[reg] |= (data & tulip_mdi_mask[reg]);
 +}
 +
 +static void tulip_mii(TULIPState *s)
 +{
 +    uint32_t changed = s->old_csr9 ^ s->csr[9];
 +    uint16_t data;
 +    int op, phy, reg;
 +
 +    if (!(changed & CSR9_MDC)) {
 +        return;
 +    }
 +
 +    if (!(s->csr[9] & CSR9_MDC)) {
 +        return;
 +    }
 +
 +    s->mii_bitcnt++;
 +    s->mii_word <<= 1;
 +
 +    if (s->csr[9] & CSR9_MDO && (s->mii_bitcnt < 16 ||
 +        !(s->csr[9] & CSR9_MII))) {
 +        /* write op or address bits */
 +        s->mii_word |= 1;
 +    }
 +
 +    if (s->mii_bitcnt >= 16 && (s->csr[9] & CSR9_MII)) {
 +        if (s->mii_word & 0x8000) {
 +            s->csr[9] |= CSR9_MDI;
 +        } else {
 +            s->csr[9] &= ~CSR9_MDI;
 +        }
 +    }
 +
 +    if (s->mii_word == 0xffffffff) {
 +        s->mii_bitcnt = 0;
 +    } else if (s->mii_bitcnt == 16) {
 +        op = (s->mii_word >> 12) & 0x0f;
 +        phy = (s->mii_word >> 7) & 0x1f;
 +        reg = (s->mii_word >> 2) & 0x1f;
 +
 +        if (op == 6) {
 +            s->mii_word = tulip_mii_read(s, phy, reg);
 +        }
 +    } else if (s->mii_bitcnt == 32) {
 +            op = (s->mii_word >> 28) & 0x0f;
 +            phy = (s->mii_word >> 23) & 0x1f;
 +            reg = (s->mii_word >> 18) & 0x1f;
 +            data = s->mii_word & 0xffff;
 +
 +        if (op == 5) {
 +            tulip_mii_write(s, phy, reg, data);
 +        }
 +    }
 +}
 +
 +static uint32_t tulip_csr9_read(TULIPState *s)
 +{
 +    if (s->csr[9] & CSR9_SR) {
 +        if (eeprom93xx_read(s->eeprom)) {
 +            s->csr[9] |= CSR9_SR_DO;
 +        } else {
 +            s->csr[9] &= ~CSR9_SR_DO;
 +        }
 +    }
 +
 +    tulip_mii(s);
 +    return s->csr[9];
 +}
 +
 +static void tulip_update_ts(TULIPState *s, int state)
 +{
 +        s->csr[5] &= ~(CSR5_TS_MASK << CSR5_TS_SHIFT);
 +        s->csr[5] |= (state & CSR5_TS_MASK) << CSR5_TS_SHIFT;
 +        trace_tulip_tx_state(tulip_tx_state_name(state));
 +}
 +
 +static uint64_t tulip_read(void *opaque, hwaddr addr,
 +                              unsigned size)
 +{
 +    TULIPState *s = opaque;
 +    uint64_t data = 0;
 +
 +    switch (addr) {
 +    case CSR(9):
 +        data = tulip_csr9_read(s);
 +        break;
 +
 +    case CSR(12):
 +        /* Fake autocompletion complete until we have PHY emulation */
 +        data = 5 << CSR12_ANS_SHIFT;
 +        break;
 +
 +    default:
 +        if (addr & 7) {
 +            qemu_log_mask(LOG_GUEST_ERROR, "%s: read access at unknown address"
 +                " 0x%"PRIx64"\n", __func__, addr);
 +        } else {
 +            data = s->csr[addr >> 3];
 +        }
 +        break;
 +    }
 +    trace_tulip_reg_read(addr, tulip_reg_name(addr), size, data);
 +    return data;
 +}
 +
 +static void tulip_tx(TULIPState *s, struct tulip_descriptor *desc)
 +{
 +    if (s->tx_frame_len) {
 +        if ((s->csr[6] >> CSR6_OM_SHIFT) & CSR6_OM_MASK) {
 +            /* Internal or external Loopback */
 +            tulip_receive(s, s->tx_frame, s->tx_frame_len);
 +        } else {
 +            qemu_send_packet(qemu_get_queue(s->nic),
 +                s->tx_frame, s->tx_frame_len);
 +        }
 +    }
 +
 +    if (desc->control & TDES1_IC) {
 +        s->csr[5] |= CSR5_TI;
 +        tulip_update_int(s);
 +    }
 +}
 +
 +static void tulip_copy_tx_buffers(TULIPState *s, struct tulip_descriptor *desc)
 +{
 +    int len1 = (desc->control >> TDES1_BUF1_SIZE_SHIFT) & TDES1_BUF1_SIZE_MASK;
 +    int len2 = (desc->control >> TDES1_BUF2_SIZE_SHIFT) & TDES1_BUF2_SIZE_MASK;
 +
 +    if (len1) {
 +        pci_dma_read(&s->dev, desc->buf_addr1,
 +            s->tx_frame + s->tx_frame_len, len1);
 +        s->tx_frame_len += len1;
 +    }
 +
 +    if (len2) {
 +        pci_dma_read(&s->dev, desc->buf_addr2,
 +            s->tx_frame + s->tx_frame_len, len2);
 +        s->tx_frame_len += len2;
 +    }
 +    desc->status = (len1 + len2) ? 0 : 0x7fffffff;
 +}
 +
 +static void tulip_setup_filter_addr(TULIPState *s, uint8_t *buf, int n)
 +{
 +    int offset = n * 12;
 +
 +    s->filter[n][0] = buf[offset];
 +    s->filter[n][1] = buf[offset + 1];
 +
 +    s->filter[n][2] = buf[offset + 4];
 +    s->filter[n][3] = buf[offset + 5];
 +
 +    s->filter[n][4] = buf[offset + 8];
 +    s->filter[n][5] = buf[offset + 9];
 +
 +    trace_tulip_setup_filter(n, s->filter[n][5], s->filter[n][4],
 +            s->filter[n][3], s->filter[n][2], s->filter[n][1], s->filter[n][0]);
 +}
 +
 +static void tulip_setup_frame(TULIPState *s,
 +        struct tulip_descriptor *desc)
 +{
 +    uint8_t buf[4096];
 +    int len = (desc->control >> TDES1_BUF1_SIZE_SHIFT) & TDES1_BUF1_SIZE_MASK;
 +    int i;
 +
 +    trace_tulip_setup_frame();
 +
 +    if (len == 192) {
 +        pci_dma_read(&s->dev, desc->buf_addr1, buf, len);
 +        for (i = 0; i < 16; i++) {
 +            tulip_setup_filter_addr(s, buf, i);
 +        }
 +    }
 +
 +    desc->status = 0x7fffffff;
 +
 +    if (desc->control & TDES1_IC) {
 +        s->csr[5] |= CSR5_TI;
 +        tulip_update_int(s);
 +    }
 +}
 +
 +static void tulip_next_tx_descriptor(TULIPState *s,
 +    struct tulip_descriptor *desc)
 +{
 +    if (desc->control & TDES1_TER) {
 +        s->current_tx_desc = s->csr[4];
 +    } else if (desc->control & TDES1_TCH) {
 +        s->current_tx_desc = desc->buf_addr2;
 +    } else {
 +        s->current_tx_desc += sizeof(struct tulip_descriptor) +
 +                (((s->csr[0] >> CSR0_DSL_SHIFT) & CSR0_DSL_MASK) << 2);
 +    }
 +    s->current_tx_desc &= ~3ULL;
 +}
 +
 +static uint32_t tulip_ts(TULIPState *s)
 +{
 +    return (s->csr[5] >> CSR5_TS_SHIFT) & CSR5_TS_MASK;
 +}
 +
 +static void tulip_xmit_list_update(TULIPState *s)
 +{
 +    struct tulip_descriptor desc;
 +
 +    if (tulip_ts(s) != CSR5_TS_SUSPENDED) {
 +        return;
 +    }
 +
 +    for (;;) {
 +        tulip_desc_read(s, s->current_tx_desc, &desc);
 +        tulip_dump_tx_descriptor(s, &desc);
 +
 +        if (!(desc.status & TDES0_OWN)) {
 +            tulip_update_ts(s, CSR5_TS_SUSPENDED);
 +            s->csr[5] |= CSR5_TU;
 +            tulip_update_int(s);
 +            return;
 +        }
 +
 +        if (desc.control & TDES1_SET) {
 +            tulip_setup_frame(s, &desc);
 +        } else {
 +            if (desc.control & TDES1_FS) {
 +                s->tx_frame_len = 0;
 +            }
 +
 +            tulip_copy_tx_buffers(s, &desc);
 +
 +            if (desc.control & TDES1_LS) {
 +                tulip_tx(s, &desc);
 +            }
 +        }
 +        tulip_desc_write(s, s->current_tx_desc, &desc);
 +        tulip_next_tx_descriptor(s, &desc);
 +    }
 +}
 +
 +static void tulip_csr9_write(TULIPState *s, uint32_t old_val,
 +        uint32_t new_val)
 +{
 +    if (new_val & CSR9_SR) {
 +        eeprom93xx_write(s->eeprom,
 +            !!(new_val & CSR9_SR_CS),
 +            !!(new_val & CSR9_SR_SK),
 +            !!(new_val & CSR9_SR_DI));
 +    }
 +}
 +
 +static void tulip_reset(TULIPState *s)
 +{
 +    trace_tulip_reset();
 +
 +    s->csr[0] = 0xfe000000;
 +    s->csr[1] = 0xffffffff;
 +    s->csr[2] = 0xffffffff;
 +    s->csr[5] = 0xf0000000;
 +    s->csr[6] = 0x32000040;
 +    s->csr[7] = 0xf3fe0000;
 +    s->csr[8] = 0xe0000000;
 +    s->csr[9] = 0xfff483ff;
 +    s->csr[11] = 0xfffe0000;
 +    s->csr[12] = 0x000000c6;
 +    s->csr[13] = 0xffff0000;
 +    s->csr[14] = 0xffffffff;
 +    s->csr[15] = 0x8ff00000;
 +}
 +
 +static void tulip_qdev_reset(DeviceState *dev)
 +{
 +    PCIDevice *d = PCI_DEVICE(dev);
 +    TULIPState *s = TULIP(d);
 +
 +    tulip_reset(s);
 +}
 +
 +static void tulip_write(void *opaque, hwaddr addr,
 +                           uint64_t data, unsigned size)
 +{
 +    TULIPState *s = opaque;
 +    trace_tulip_reg_write(addr, tulip_reg_name(addr), size, data);
 +
 +    switch (addr) {
 +    case CSR(0):
 +        s->csr[0] = data;
 +        if (data & CSR0_SWR) {
 +            tulip_reset(s);
 +            tulip_update_int(s);
 +        }
 +        break;
 +
 +    case CSR(1):
 +        tulip_xmit_list_update(s);
 +        break;
 +
 +    case CSR(2):
 +        qemu_flush_queued_packets(qemu_get_queue(s->nic));
 +        break;
 +
 +    case CSR(3):
 +        s->csr[3] = data & ~3ULL;
 +        s->current_rx_desc = s->csr[3];
 +        qemu_flush_queued_packets(qemu_get_queue(s->nic));
 +        break;
 +
 +    case CSR(4):
 +        s->csr[4] = data & ~3ULL;
 +        s->current_tx_desc = s->csr[4];
 +        tulip_xmit_list_update(s);
 +        break;
 +
 +    case CSR(5):
 +        /* Status register, write clears bit */
 +        s->csr[5] &= ~(data & (CSR5_TI | CSR5_TPS | CSR5_TU | CSR5_TJT |
 +                               CSR5_LNP_ANC | CSR5_UNF | CSR5_RI | CSR5_RU |
 +                               CSR5_RPS | CSR5_RWT | CSR5_ETI | CSR5_GTE |
 +                               CSR5_LNF | CSR5_FBE | CSR5_ERI | CSR5_AIS |
 +                               CSR5_NIS | CSR5_GPI | CSR5_LC));
 +        tulip_update_int(s);
 +        break;
 +
 +    case CSR(6):
 +        s->csr[6] = data;
 +        if (s->csr[6] & CSR6_SR) {
 +            tulip_update_rs(s, CSR5_RS_RUNNING_WAIT_RECEIVE);
 +            qemu_flush_queued_packets(qemu_get_queue(s->nic));
 +        } else {
 +            tulip_update_rs(s, CSR5_RS_STOPPED);
 +        }
 +
 +        if (s->csr[6] & CSR6_ST) {
 +            tulip_update_ts(s, CSR5_TS_SUSPENDED);
 +            tulip_xmit_list_update(s);
 +        } else {
 +            tulip_update_ts(s, CSR5_TS_STOPPED);
 +        }
 +        break;
 +
 +    case CSR(7):
 +        s->csr[7] = data;
 +        tulip_update_int(s);
 +        break;
 +
 +    case CSR(8):
 +        s->csr[9] = data;
 +        break;
 +
 +    case CSR(9):
 +        tulip_csr9_write(s, s->csr[9], data);
 +        /* don't clear MII read data */
 +        s->csr[9] &= CSR9_MDI;
 +        s->csr[9] |= (data & ~CSR9_MDI);
 +        tulip_mii(s);
 +        s->old_csr9 = s->csr[9];
 +        break;
 +
 +    case CSR(10):
 +        s->csr[10] = data;
 +        break;
 +
 +    case CSR(11):
 +        s->csr[11] = data;
 +        break;
 +
 +    case CSR(12):
 +        /* SIA Status register, some bits are cleared by writing 1 */
 +        s->csr[12] &= ~(data & (CSR12_MRA | CSR12_TRA | CSR12_ARA));
 +        break;
 +
 +    case CSR(13):
 +        s->csr[13] = data;
 +        break;
 +
 +    case CSR(14):
 +        s->csr[14] = data;
 +        break;
 +
 +    case CSR(15):
 +        s->csr[15] = data;
 +        break;
 +
 +    default:
 +        qemu_log_mask(LOG_GUEST_ERROR, "%s: write to CSR at unknown address "
 +                "0x%"PRIx64"\n", __func__, addr);
 +        break;
 +    }
 +}
 +
 +static const MemoryRegionOps tulip_ops = {
 +    .read = tulip_read,
 +    .write = tulip_write,
 +    .endianness = DEVICE_LITTLE_ENDIAN,
 +    .impl = {
 +        .min_access_size = 4,
 +        .max_access_size = 4,
 +    },
 +};
 +
-+static inline void net_rx_rss_add_chunk(__u8 *rss_input, size_t *bytes_written,
++static void tulip_idblock_crc(TULIPState *s, uint16_t *srom)
-+                                        const void *ptr, size_t size) {
++{
-+    __builtin_memcpy(&rss_input[*bytes_written], ptr, size);
++    int word, n;
-+    *bytes_written += size;
++    int bit;
-+}
++    unsigned char bitval, crc;
-+
++    const int len = 9;
-+static inline
++    n = 0;
-+void net_toeplitz_add(__u32 *result,
++    crc = -1;
-+                      __u8 *input,
++
-+                      __u32 len
++    for (word = 0; word < len; word++) {
-+        , struct toeplitz_key_data_t *key) {
++        for (bit = 15; bit >= 0; bit--) {
-+
++            if ((word == (len - 1)) && (bit == 7)) {
-+    __u32 accumulator = *result;
++                /*
-+    __u32 leftmost_32_bits = key->leftmost_32_bits;
++                 * Insert the correct CRC result into input data stream
-+    __u32 byte;
++                 * in place.
-+
++                 */
-+    for (byte = 0; byte < HASH_CALCULATION_BUFFER_SIZE; byte++) {
++                srom[len - 1] = (srom[len - 1] & 0xff00) | (unsigned short)crc;
-+        __u8 input_byte = input[byte];
++                break;
-+        __u8 key_byte = key->next_byte[byte];
++            }
-+        __u8 bit;
++            n++;
-+
++            bitval = ((srom[word] >> bit) & 1) ^ ((crc >> 7) & 1);
 +            crc = crc << 1;
 +            if (bitval == 1) {
 +                crc ^= 6;
 +                crc |= 0x01;
 +            }
 +        }
 +    }
 +}
 +
 +static uint16_t tulip_srom_crc(TULIPState *s, uint8_t *eeprom, size_t len)
 +{
 +    unsigned long crc = 0xffffffff;
 +    unsigned long flippedcrc = 0;
 +    unsigned char currentbyte;
 +    unsigned int msb, bit, i;
 +
 +    for (i = 0; i < len; i++) {
 +        currentbyte = eeprom[i];
 +        for (bit = 0; bit < 8; bit++) {
-+            if (input_byte & (1 << 7)) {
++            msb = (crc >> 31) & 1;
-+                accumulator ^= leftmost_32_bits;
++            crc <<= 1;
 +            if (msb ^ (currentbyte & 1)) {
 +                crc ^= 0x04c11db6;
 +                crc |= 0x00000001;
 +            }
-+
++            currentbyte >>= 1;
-+            leftmost_32_bits =
++        }
-+                    (leftmost_32_bits << 1) | ((key_byte & (1 << 7)) >> 7);
++    }
 +
-+            input_byte <<= 1;
++    for (i = 0; i < 32; i++) {
-+            key_byte <<= 1;
++        flippedcrc <<= 1;
-+        }
++        bit = crc & 1;
-+    }
++        crc >>= 1;
-+
++        flippedcrc += bit;
-+    *result = accumulator;
++    }
-+}
++    return (flippedcrc ^ 0xffffffff) & 0xffff;
-+
++}
 +
-+static inline int ip6_extension_header_type(__u8 hdr_type)
++static const uint8_t eeprom_default[128] = {
-+{
++    0x3c, 0x10, 0x4f, 0x10, 0x00, 0x00, 0x00, 0x00,
-+    switch (hdr_type) {
++    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-+    case IPPROTO_HOPOPTS:
++    0x56, 0x08, 0x04, 0x01, 0x00, 0x80, 0x48, 0xb3,
-+    case IPPROTO_ROUTING:
++    0x0e, 0xa7, 0x00, 0x1e, 0x00, 0x00, 0x00, 0x08,
-+    case IPPROTO_FRAGMENT:
++    0x01, 0x8d, 0x03, 0x00, 0x00, 0x00, 0x00, 0x78,
-+    case IPPROTO_ICMPV6:
++    0xe0, 0x01, 0x00, 0x50, 0x00, 0x18, 0x00, 0x00,
-+    case IPPROTO_NONE:
++    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-+    case IPPROTO_DSTOPTS:
++    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-+    case IPPROTO_MH:
++    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-+        return 1;
++    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-+    default:
++    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-+        return 0;
++    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xe8, 0x6b,
-+    }
++    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80,
-+}
++    0x48, 0xb3, 0x0e, 0xa7, 0x40, 0x00, 0x00, 0x00,
-+/*
++    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-+ * According to
++    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
-+ * https://www.iana.org/assignments/ipv6-parameters/ipv6-parameters.xhtml
++};
-+ * we expect that there are would be no more than 11 extensions in IPv6 header,
++
-+ * also there is 27 TLV options for Destination and Hop-by-hop extensions.
++static void tulip_fill_eeprom(TULIPState *s)
-+ * Need to choose reasonable amount of maximum extensions/options we may
++{
-+ * check to find ext src/dst.
++    uint16_t *eeprom = eeprom93xx_data(s->eeprom);
-+ */
++    memcpy(eeprom, eeprom_default, 128);
-+#define IP6_EXTENSIONS_COUNT 11
++
-+#define IP6_OPTIONS_COUNT 30
++    /* patch in our mac address */
-+
++    eeprom[10] = cpu_to_le16(s->c.macaddr.a[0] | (s->c.macaddr.a[1] << 8));
-+static inline int parse_ipv6_ext(struct __sk_buff *skb,
++    eeprom[11] = cpu_to_le16(s->c.macaddr.a[2] | (s->c.macaddr.a[3] << 8));
-+        struct packet_hash_info_t *info,
++    eeprom[12] = cpu_to_le16(s->c.macaddr.a[4] | (s->c.macaddr.a[5] << 8));
-+        __u8 *l4_protocol, size_t *l4_offset)
++    tulip_idblock_crc(s, eeprom);
-+{
++    eeprom[63] = cpu_to_le16(tulip_srom_crc(s, (uint8_t *)eeprom, 126));
-+    int err = 0;
++}
 +
-+    if (!ip6_extension_header_type(*l4_protocol)) {
++static void pci_tulip_realize(PCIDevice *pci_dev, Error **errp)
-+        return 0;
++{
-+    }
++    TULIPState *s = DO_UPCAST(TULIPState, dev, pci_dev);
-+
++    uint8_t *pci_conf;
-+    struct ipv6_opt_hdr ext_hdr = {};
++
-+
++    pci_conf = s->dev.config;
-+    for (unsigned int i = 0; i < IP6_EXTENSIONS_COUNT; ++i) {
++    pci_conf[PCI_INTERRUPT_PIN] = 1; /* interrupt pin A */
 +
-+        err = bpf_skb_load_bytes_relative(skb, *l4_offset, &ext_hdr,
++    s->eeprom = eeprom93xx_new(&pci_dev->qdev, 64);
-+                                    sizeof(ext_hdr), BPF_HDR_START_NET);
++    tulip_fill_eeprom(s);
-+        if (err) {
++
-+            goto error;
++    memory_region_init_io(&s->io, OBJECT(&s->dev), &tulip_ops, s,
-+        }
++            "tulip-io", 128);
 +
-+        if (*l4_protocol == IPPROTO_ROUTING) {
++    memory_region_init_io(&s->memory, OBJECT(&s->dev), &tulip_ops, s,
-+            struct ipv6_rt_hdr ext_rt = {};
++            "tulip-mem", 128);
 +
-+            err = bpf_skb_load_bytes_relative(skb, *l4_offset, &ext_rt,
++    pci_register_bar(&s->dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->io);
-+                                        sizeof(ext_rt), BPF_HDR_START_NET);
++    pci_register_bar(&s->dev, 1, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->memory);
-+            if (err) {
++
-+                goto error;
++    s->irq = pci_allocate_irq(&s->dev);
-+            }
++
-+
++    qemu_macaddr_default_if_unset(&s->c.macaddr);
-+            if ((ext_rt.type == IPV6_SRCRT_TYPE_2) &&
++
-+                    (ext_rt.hdrlen == sizeof(struct in6_addr) / 8) &&
++    s->nic = qemu_new_nic(&net_tulip_info, &s->c,
-+                    (ext_rt.segments_left == 1)) {
++                          object_get_typename(OBJECT(pci_dev)),
-+
++                          pci_dev->qdev.id, s);
-+                err = bpf_skb_load_bytes_relative(skb,
++    qemu_format_nic_info_str(qemu_get_queue(s->nic), s->c.macaddr.a);
-+                    *l4_offset + offsetof(struct rt2_hdr, addr),
++}
-+                    &info->in6_ext_dst, sizeof(info->in6_ext_dst),
++
-+                    BPF_HDR_START_NET);
++static void pci_tulip_exit(PCIDevice *pci_dev)
-+                if (err) {
++{
-+                    goto error;
++    TULIPState *s = DO_UPCAST(TULIPState, dev, pci_dev);
-+                }
++
-+
++    qemu_del_nic(s->nic);
-+                info->is_ipv6_ext_dst = 1;
++    qemu_free_irq(s->irq);
-+            }
++    eeprom93xx_free(&pci_dev->qdev, s->eeprom);
-+
++}
-+        } else if (*l4_protocol == IPPROTO_DSTOPTS) {
++
-+            struct ipv6_opt_t {
++static void tulip_instance_init(Object *obj)
-+                __u8 type;
++{
-+                __u8 length;
++    PCIDevice *pci_dev = PCI_DEVICE(obj);
-+            } __attribute__((packed)) opt = {};
++    TULIPState *d = DO_UPCAST(TULIPState, dev, pci_dev);
 +
-+            size_t opt_offset = sizeof(ext_hdr);
++    device_add_bootindex_property(obj, &d->c.bootindex,
-+
++                                  "bootindex", "/ethernet-phy@0",
-+            for (unsigned int j = 0; j < IP6_OPTIONS_COUNT; ++j) {
++                                  &pci_dev->qdev, NULL);
-+                err = bpf_skb_load_bytes_relative(skb, *l4_offset + opt_offset,
++}
-+                                        &opt, sizeof(opt), BPF_HDR_START_NET);
++
-+                if (err) {
++static Property tulip_properties[] = {
-+                    goto error;
++    DEFINE_NIC_PROPERTIES(TULIPState, c),
-+                }
++    DEFINE_PROP_END_OF_LIST(),
-+
++};
-+                if (opt.type == IPV6_TLV_HAO) {
++
-+                    err = bpf_skb_load_bytes_relative(skb,
++static void tulip_class_init(ObjectClass *klass, void *data)
-+                        *l4_offset + opt_offset
++{
-+                        + offsetof(struct ipv6_destopt_hao, addr),
++    DeviceClass *dc = DEVICE_CLASS(klass);
-+                        &info->in6_ext_src, sizeof(info->in6_ext_src),
++    PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
-+                        BPF_HDR_START_NET);
++
-+                    if (err) {
++    k->realize = pci_tulip_realize;
-+                        goto error;
++    k->exit = pci_tulip_exit;
-+                    }
++    k->vendor_id = PCI_VENDOR_ID_DEC;
-+
++    k->device_id = PCI_DEVICE_ID_DEC_21143;
-+                    info->is_ipv6_ext_src = 1;
++    k->subsystem_vendor_id = 0x103c;
-+                    break;
++    k->subsystem_id = 0x104f;
-+                }
++    k->class_id = PCI_CLASS_NETWORK_ETHERNET;
-+
++    dc->vmsd = &vmstate_pci_tulip;
-+                opt_offset += (opt.type == IPV6_TLV_PAD1) ?
++    dc->props = tulip_properties;
-+                              1 : opt.length + sizeof(opt);
++    dc->reset = tulip_qdev_reset;
-+
++    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
-+                if (opt_offset + 1 >= ext_hdr.hdrlen * 8) {
++}
-+                    break;
++
-+                }
++static const TypeInfo tulip_info = {
-+            }
++    .name          = TYPE_TULIP,
-+        } else if (*l4_protocol == IPPROTO_FRAGMENT) {
++    .parent        = TYPE_PCI_DEVICE,
-+            info->is_fragmented = true;
++    .instance_size = sizeof(TULIPState),
-+        }
++    .class_init    = tulip_class_init,
-+
++    .instance_init = tulip_instance_init,
-+        *l4_protocol = ext_hdr.nexthdr;
++    .interfaces = (InterfaceInfo[]) {
-+        *l4_offset += (ext_hdr.hdrlen + 1) * 8;
++        { INTERFACE_CONVENTIONAL_PCI_DEVICE },
-+
++        { },
-+        if (!ip6_extension_header_type(ext_hdr.nexthdr)) {
++    },
-+            return 0;
++};
-+        }
++
-+    }
++static void tulip_register_types(void)
-+
++{
-+    return 0;
++    type_register_static(&tulip_info);
-+error:
++}
-+    return err;
++
-+}
++type_init(tulip_register_types)
-+
+diff --git a/hw/net/tulip.h b/hw/net/tulip.h
-+static __be16 parse_eth_type(struct __sk_buff *skb)
+new file mode 100644
-+{
+index XXXXXXX..XXXXXXX
-+    unsigned int offset = 12;
+--- /dev/null
-+    __be16 ret = 0;
++++ b/hw/net/tulip.h
-+    int err = 0;
+@@ -XXX,XX +XXX,XX @@
-+
++#ifndef HW_TULIP_H
-+    err = bpf_skb_load_bytes_relative(skb, offset, &ret, sizeof(ret),
++#define HW_TULIP_H
-+                                BPF_HDR_START_MAC);
++
-+    if (err) {
++#include "qemu/units.h"
-+        return 0;
++#include "net/net.h"
-+    }
++
-+
++#define TYPE_TULIP "tulip"
-+    switch (bpf_ntohs(ret)) {
++#define TULIP(obj) OBJECT_CHECK(TULIPState, (obj), TYPE_TULIP)
-+    case ETH_P_8021AD:
++
-+        offset += 4;
++#define CSR(_x) ((_x) << 3)
-+    case ETH_P_8021Q:
++
-+        offset += 4;
++#define CSR0_SWR        BIT(0)
-+        err = bpf_skb_load_bytes_relative(skb, offset, &ret, sizeof(ret),
++#define CSR0_BAR        BIT(1)
-+                                    BPF_HDR_START_MAC);
++#define CSR0_DSL_SHIFT  2
-+    default:
++#define CSR0_DSL_MASK   0x1f
-+        break;
++#define CSR0_BLE        BIT(7)
-+    }
++#define CSR0_PBL_SHIFT  8
-+
++#define CSR0_PBL_MASK   0x3f
-+    if (err) {
++#define CSR0_CAC_SHIFT  14
-+        return 0;
++#define CSR0_CAC_MASK   0x3
-+    }
++#define CSR0_DAS        0x10000
-+
++#define CSR0_TAP_SHIFT  17
-+    return ret;
++#define CSR0_TAP_MASK   0x7
-+}
++#define CSR0_DBO        0x100000
-+
++#define CSR1_TPD        0x01
-+static inline int parse_packet(struct __sk_buff *skb,
++#define CSR0_RLE        BIT(23)
-+        struct packet_hash_info_t *info)
++#define CSR0_WIE        BIT(24)
-+{
++
-+    int err = 0;
++#define CSR2_RPD        0x01
 +
-+    if (!info || !skb) {
++#define CSR5_TI         BIT(0)
-+        return -1;
++#define CSR5_TPS        BIT(1)
-+    }
++#define CSR5_TU         BIT(2)
-+
++#define CSR5_TJT        BIT(3)
-+    size_t l4_offset = 0;
++#define CSR5_LNP_ANC    BIT(4)
-+    __u8 l4_protocol = 0;
++#define CSR5_UNF        BIT(5)
-+    __u16 l3_protocol = bpf_ntohs(parse_eth_type(skb));
++#define CSR5_RI         BIT(6)
-+    if (l3_protocol == 0) {
++#define CSR5_RU         BIT(7)
-+        err = -1;
++#define CSR5_RPS        BIT(8)
-+        goto error;
++#define CSR5_RWT        BIT(9)
-+    }
++#define CSR5_ETI        BIT(10)
-+
++#define CSR5_GTE        BIT(11)
-+    if (l3_protocol == ETH_P_IP) {
++#define CSR5_LNF        BIT(12)
-+        info->is_ipv4 = 1;
++#define CSR5_FBE        BIT(13)
-+
++#define CSR5_ERI        BIT(14)
-+        struct iphdr ip = {};
++#define CSR5_AIS        BIT(15)
-+        err = bpf_skb_load_bytes_relative(skb, 0, &ip, sizeof(ip),
++#define CSR5_NIS        BIT(16)
-+                                    BPF_HDR_START_NET);
++#define CSR5_RS_SHIFT   17
-+        if (err) {
++#define CSR5_RS_MASK    7
-+            goto error;
++#define CSR5_TS_SHIFT   20
-+        }
++#define CSR5_TS_MASK    7
 +
-+        info->in_src = ip.saddr;
++#define CSR5_TS_STOPPED                 0
-+        info->in_dst = ip.daddr;
++#define CSR5_TS_RUNNING_FETCH           1
-+        info->is_fragmented = !!ip.frag_off;
++#define CSR5_TS_RUNNING_WAIT_EOT        2
-+
++#define CSR5_TS_RUNNING_READ_BUF        3
-+        l4_protocol = ip.protocol;
++#define CSR5_TS_RUNNING_SETUP           5
-+        l4_offset = ip.ihl * 4;
++#define CSR5_TS_SUSPENDED               6
-+    } else if (l3_protocol == ETH_P_IPV6) {
++#define CSR5_TS_RUNNING_CLOSE           7
-+        info->is_ipv6 = 1;
++
-+
++#define CSR5_RS_STOPPED                 0
-+        struct ipv6hdr ip6 = {};
++#define CSR5_RS_RUNNING_FETCH           1
-+        err = bpf_skb_load_bytes_relative(skb, 0, &ip6, sizeof(ip6),
++#define CSR5_RS_RUNNING_CHECK_EOR       2
-+                                    BPF_HDR_START_NET);
++#define CSR5_RS_RUNNING_WAIT_RECEIVE    3
-+        if (err) {
++#define CSR5_RS_SUSPENDED               4
-+            goto error;
++#define CSR5_RS_RUNNING_CLOSE           5
-+        }
++#define CSR5_RS_RUNNING_FLUSH           6
-+
++#define CSR5_RS_RUNNING_QUEUE           7
-+        info->in6_src = ip6.saddr;
++
-+        info->in6_dst = ip6.daddr;
++#define CSR5_EB_SHIFT   23
-+
++#define CSR5_EB_MASK    7
-+        l4_protocol = ip6.nexthdr;
++
-+        l4_offset = sizeof(ip6);
++#define CSR5_GPI        BIT(26)
-+
++#define CSR5_LC         BIT(27)
-+        err = parse_ipv6_ext(skb, info, &l4_protocol, &l4_offset);
++
-+        if (err) {
++#define CSR6_HP         BIT(0)
-+            goto error;
++#define CSR6_SR         BIT(1)
-+        }
++#define CSR6_HO         BIT(2)
-+    }
++#define CSR6_PB         BIT(3)
-+
++#define CSR6_IF         BIT(4)
-+    if (l4_protocol != 0 && !info->is_fragmented) {
++#define CSR6_SB         BIT(5)
-+        if (l4_protocol == IPPROTO_TCP) {
++#define CSR6_PR         BIT(6)
-+            info->is_tcp = 1;
++#define CSR6_PM         BIT(7)
-+
++#define CSR6_FKD        BIT(8)
-+            struct tcphdr tcp = {};
++#define CSR6_FD         BIT(9)
-+            err = bpf_skb_load_bytes_relative(skb, l4_offset, &tcp, sizeof(tcp),
++
-+                                        BPF_HDR_START_NET);
++#define CSR6_OM_SHIFT   10
-+            if (err) {
++#define CSR6_OM_MASK    3
-+                goto error;
++#define CSR6_OM_NORMAL          0
-+            }
++#define CSR6_OM_INT_LOOPBACK    1
-+
++#define CSR6_OM_EXT_LOOPBACK    2
-+            info->src_port = tcp.source;
++
-+            info->dst_port = tcp.dest;
++#define CSR6_FC         BIT(12)
-+        } else if (l4_protocol == IPPROTO_UDP) { /* TODO: add udplite? */
++#define CSR6_ST         BIT(13)
-+            info->is_udp = 1;
++
 +
-+            struct udphdr udp = {};
++#define CSR6_TR_SHIFT   14
-+            err = bpf_skb_load_bytes_relative(skb, l4_offset, &udp, sizeof(udp),
++#define CSR6_TR_MASK    3
-+                                        BPF_HDR_START_NET);
++#define CSR6_TR_72      0
-+            if (err) {
++#define CSR6_TR_96      1
-+                goto error;
++#define CSR6_TR_128     2
-+            }
++#define CSR6_TR_160     3
 +
-+            info->src_port = udp.source;
++#define CSR6_CA         BIT(17)
-+            info->dst_port = udp.dest;
++#define CSR6_RA         BIT(30)
-+        }
++#define CSR6_SC         BIT(31)
-+    }
++
-+
++#define CSR7_TIM        BIT(0)
-+    return 0;
++#define CSR7_TSM        BIT(1)
-+
++#define CSR7_TUM        BIT(2)
-+error:
++#define CSR7_TJM        BIT(3)
-+    return err;
++#define CSR7_LPM        BIT(4)
-+}
++#define CSR7_UNM        BIT(5)
-+
++#define CSR7_RIM        BIT(6)
-+static inline __u32 calculate_rss_hash(struct __sk_buff *skb,
++#define CSR7_RUM        BIT(7)
-+        struct rss_config_t *config, struct toeplitz_key_data_t *toe)
++#define CSR7_RSM        BIT(8)
-+{
++#define CSR7_RWM        BIT(9)
-+    __u8 rss_input[HASH_CALCULATION_BUFFER_SIZE] = {};
++#define CSR7_TMM        BIT(11)
-+    size_t bytes_written = 0;
++#define CSR7_LFM        BIT(12)
-+    __u32 result = 0;
++#define CSR7_SEM        BIT(13)
-+    int err = 0;
++#define CSR7_ERM        BIT(14)
-+    struct packet_hash_info_t packet_info = {};
++#define CSR7_AIM        BIT(15)
-+
++#define CSR7_NIM        BIT(16)
-+    err = parse_packet(skb, &packet_info);
++
-+    if (err) {
++#define CSR8_MISSED_FRAME_OVL           BIT(16)
-+        return 0;
++#define CSR8_MISSED_FRAME_CNT_MASK      0xffff
-+    }
++
-+
++#define CSR9_DATA_MASK  0xff
-+    if (packet_info.is_ipv4) {
++#define CSR9_SR_CS      BIT(0)
-+        if (packet_info.is_tcp &&
++#define CSR9_SR_SK      BIT(1)
-+            config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_TCPv4) {
++#define CSR9_SR_DI      BIT(2)
-+
++#define CSR9_SR_DO      BIT(3)
-+            net_rx_rss_add_chunk(rss_input, &bytes_written,
++#define CSR9_REG        BIT(10)
-+                                 &packet_info.in_src,
++#define CSR9_SR         BIT(11)
-+                                 sizeof(packet_info.in_src));
++#define CSR9_BR         BIT(12)
-+            net_rx_rss_add_chunk(rss_input, &bytes_written,
++#define CSR9_WR         BIT(13)
-+                                 &packet_info.in_dst,
++#define CSR9_RD         BIT(14)
-+                                 sizeof(packet_info.in_dst));
++#define CSR9_MOD        BIT(15)
-+            net_rx_rss_add_chunk(rss_input, &bytes_written,
++#define CSR9_MDC        BIT(16)
-+                                 &packet_info.src_port,
++#define CSR9_MDO        BIT(17)
-+                                 sizeof(packet_info.src_port));
++#define CSR9_MII        BIT(18)
-+            net_rx_rss_add_chunk(rss_input, &bytes_written,
++#define CSR9_MDI        BIT(19)
-+                                 &packet_info.dst_port,
++
-+                                 sizeof(packet_info.dst_port));
++#define CSR11_CON       BIT(16)
-+        } else if (packet_info.is_udp &&
++#define CSR11_TIMER_MASK 0xffff
-+                   config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_UDPv4) {
++
-+
++#define CSR12_MRA       BIT(0)
-+            net_rx_rss_add_chunk(rss_input, &bytes_written,
++#define CSR12_LS100     BIT(1)
-+                                 &packet_info.in_src,
++#define CSR12_LS10      BIT(2)
-+                                 sizeof(packet_info.in_src));
++#define CSR12_APS       BIT(3)
-+            net_rx_rss_add_chunk(rss_input, &bytes_written,
++#define CSR12_ARA       BIT(8)
-+                                 &packet_info.in_dst,
++#define CSR12_TRA       BIT(9)
-+                                 sizeof(packet_info.in_dst));
++#define CSR12_NSN       BIT(10)
-+            net_rx_rss_add_chunk(rss_input, &bytes_written,
++#define CSR12_TRF       BIT(11)
-+                                 &packet_info.src_port,
++#define CSR12_ANS_SHIFT 12
-+                                 sizeof(packet_info.src_port));
++#define CSR12_ANS_MASK  7
-+            net_rx_rss_add_chunk(rss_input, &bytes_written,
++#define CSR12_LPN       BIT(15)
-+                                 &packet_info.dst_port,
++#define CSR12_LPC_SHIFT 16
-+                                 sizeof(packet_info.dst_port));
++#define CSR12_LPC_MASK  0xffff
-+        } else if (config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_IPv4) {
++
-+            net_rx_rss_add_chunk(rss_input, &bytes_written,
++#define CSR13_SRL       BIT(0)
-+                                 &packet_info.in_src,
++#define CSR13_CAC       BIT(2)
-+                                 sizeof(packet_info.in_src));
++#define CSR13_AUI       BIT(3)
-+            net_rx_rss_add_chunk(rss_input, &bytes_written,
++#define CSR13_SDM_SHIFT 4
-+                                 &packet_info.in_dst,
++#define CSR13_SDM_MASK  0xfff
-+                                 sizeof(packet_info.in_dst));
++
-+        }
++#define CSR14_ECEN      BIT(0)
-+    } else if (packet_info.is_ipv6) {
++#define CSR14_LBK       BIT(1)
-+        if (packet_info.is_tcp &&
++#define CSR14_DREN      BIT(2)
-+            config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_TCPv6) {
++#define CSR14_LSE       BIT(3)
-+
++#define CSR14_CPEN_SHIFT 4
-+            if (packet_info.is_ipv6_ext_src &&
++#define CSR14_CPEN_MASK 3
-+                config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_TCP_EX) {
++#define CSR14_MBO       BIT(6)
-+
++#define CSR14_ANE       BIT(7)
-+                net_rx_rss_add_chunk(rss_input, &bytes_written,
++#define CSR14_RSQ       BIT(8)
-+                                     &packet_info.in6_ext_src,
++#define CSR14_CSQ       BIT(9)
-+                                     sizeof(packet_info.in6_ext_src));
++#define CSR14_CLD       BIT(10)
-+            } else {
++#define CSR14_SQE       BIT(11)
-+                net_rx_rss_add_chunk(rss_input, &bytes_written,
++#define CSR14_LTE       BIT(12)
-+                                     &packet_info.in6_src,
++#define CSR14_APE       BIT(13)
-+                                     sizeof(packet_info.in6_src));
++#define CSR14_SPP       BIT(14)
-+            }
++#define CSR14_TAS       BIT(15)
-+            if (packet_info.is_ipv6_ext_dst &&
++
-+                config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_TCP_EX) {
++#define CSR15_JBD       BIT(0)
-+
++#define CSR15_HUJ       BIT(1)
-+                net_rx_rss_add_chunk(rss_input, &bytes_written,
++#define CSR15_JCK       BIT(2)
-+                                     &packet_info.in6_ext_dst,
++#define CSR15_ABM       BIT(3)
-+                                     sizeof(packet_info.in6_ext_dst));
++#define CSR15_RWD       BIT(4)
-+            } else {
++#define CSR15_RWR       BIT(5)
-+                net_rx_rss_add_chunk(rss_input, &bytes_written,
++#define CSR15_LE1       BIT(6)
-+                                     &packet_info.in6_dst,
++#define CSR15_LV1       BIT(7)
-+                                     sizeof(packet_info.in6_dst));
++#define CSR15_TSCK      BIT(8)
-+            }
++#define CSR15_FUSQ      BIT(9)
-+            net_rx_rss_add_chunk(rss_input, &bytes_written,
++#define CSR15_FLF       BIT(10)
-+                                 &packet_info.src_port,
++#define CSR15_LSD       BIT(11)
-+                                 sizeof(packet_info.src_port));
++#define CSR15_DPST      BIT(12)
-+            net_rx_rss_add_chunk(rss_input, &bytes_written,
++#define CSR15_FRL       BIT(13)
-+                                 &packet_info.dst_port,
++#define CSR15_LE2       BIT(14)
-+                                 sizeof(packet_info.dst_port));
++#define CSR15_LV2       BIT(15)
-+        } else if (packet_info.is_udp &&
++
-+                   config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_UDPv6) {
++#define RDES0_OF         BIT(0)
-+
++#define RDES0_CE         BIT(1)
-+            if (packet_info.is_ipv6_ext_src &&
++#define RDES0_DB         BIT(2)
-+               config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_UDP_EX) {
++#define RDES0_RJ         BIT(4)
-+
++#define RDES0_FT         BIT(5)
-+                net_rx_rss_add_chunk(rss_input, &bytes_written,
++#define RDES0_CS         BIT(6)
-+                                     &packet_info.in6_ext_src,
++#define RDES0_TL         BIT(7)
-+                                     sizeof(packet_info.in6_ext_src));
++#define RDES0_LS         BIT(8)
-+            } else {
++#define RDES0_FS         BIT(9)
-+                net_rx_rss_add_chunk(rss_input, &bytes_written,
++#define RDES0_MF         BIT(10)
-+                                     &packet_info.in6_src,
++#define RDES0_RF         BIT(11)
-+                                     sizeof(packet_info.in6_src));
++#define RDES0_DT_SHIFT   12
-+            }
++#define RDES0_DT_MASK    3
-+            if (packet_info.is_ipv6_ext_dst &&
++#define RDES0_LE         BIT(14)
-+               config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_UDP_EX) {
++#define RDES0_ES         BIT(15)
-+
++#define RDES0_FL_SHIFT   16
-+                net_rx_rss_add_chunk(rss_input, &bytes_written,
++#define RDES0_FL_MASK    0x3fff
-+                                     &packet_info.in6_ext_dst,
++#define RDES0_FF         BIT(30)
-+                                     sizeof(packet_info.in6_ext_dst));
++#define RDES0_OWN        BIT(31)
-+            } else {
++
-+                net_rx_rss_add_chunk(rss_input, &bytes_written,
++#define RDES1_BUF1_SIZE_SHIFT 0
-+                                     &packet_info.in6_dst,
++#define RDES1_BUF1_SIZE_MASK 0x7ff
-+                                     sizeof(packet_info.in6_dst));
++
-+            }
++#define RDES1_BUF2_SIZE_SHIFT 11
-+
++#define RDES1_BUF2_SIZE_MASK 0x7ff
-+            net_rx_rss_add_chunk(rss_input, &bytes_written,
++#define RDES1_RCH       BIT(24)
-+                                 &packet_info.src_port,
++#define RDES1_RER       BIT(25)
-+                                 sizeof(packet_info.src_port));
++
-+            net_rx_rss_add_chunk(rss_input, &bytes_written,
++#define TDES0_DE        BIT(0)
-+                                 &packet_info.dst_port,
++#define TDES0_UF        BIT(1)
-+                                 sizeof(packet_info.dst_port));
++#define TDES0_LF        BIT(2)
-+
++#define TDES0_CC_SHIFT  3
-+        } else if (config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_IPv6) {
++#define TDES0_CC_MASK   0xf
-+            if (packet_info.is_ipv6_ext_src &&
++#define TDES0_HF        BIT(7)
-+               config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_IP_EX) {
++#define TDES0_EC        BIT(8)
-+
++#define TDES0_LC        BIT(9)
-+                net_rx_rss_add_chunk(rss_input, &bytes_written,
++#define TDES0_NC        BIT(10)
-+                                     &packet_info.in6_ext_src,
++#define TDES0_LO        BIT(11)
-+                                     sizeof(packet_info.in6_ext_src));
++#define TDES0_TO        BIT(14)
-+            } else {
++#define TDES0_ES        BIT(15)
-+                net_rx_rss_add_chunk(rss_input, &bytes_written,
++#define TDES0_OWN       BIT(31)
-+                                     &packet_info.in6_src,
++
-+                                     sizeof(packet_info.in6_src));
++#define TDES1_BUF1_SIZE_SHIFT 0
-+            }
++#define TDES1_BUF1_SIZE_MASK 0x7ff
-+            if (packet_info.is_ipv6_ext_dst &&
++
-+                config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_IP_EX) {
++#define TDES1_BUF2_SIZE_SHIFT 11
-+
++#define TDES1_BUF2_SIZE_MASK 0x7ff
-+                net_rx_rss_add_chunk(rss_input, &bytes_written,
++
-+                                     &packet_info.in6_ext_dst,
++#define TDES1_FT0       BIT(22)
-+                                     sizeof(packet_info.in6_ext_dst));
++#define TDES1_DPD       BIT(23)
-+            } else {
++#define TDES1_TCH       BIT(24)
-+                net_rx_rss_add_chunk(rss_input, &bytes_written,
++#define TDES1_TER       BIT(25)
-+                                     &packet_info.in6_dst,
++#define TDES1_AC        BIT(26)
-+                                     sizeof(packet_info.in6_dst));
++#define TDES1_SET       BIT(27)
-+            }
++#define TDES1_FT1       BIT(28)
-+        }
++#define TDES1_FS        BIT(29)
-+    }
++#define TDES1_LS        BIT(30)
-+
++#define TDES1_IC        BIT(31)
-+    if (bytes_written) {
++
-+        net_toeplitz_add(&result, rss_input, bytes_written, toe);
++struct tulip_descriptor {
-+    }
++    uint32_t status;
-+
++    uint32_t control;
-+    return result;
++    uint32_t buf_addr1;
-+}
++    uint32_t buf_addr2;
-+
++};
-+SEC("tun_rss_steering")
++
-+int tun_rss_steering_prog(struct __sk_buff *skb)
++#endif
-+{
+diff --git a/include/hw/pci/pci_ids.h b/include/hw/pci/pci_ids.h
-+
+index XXXXXXX..XXXXXXX 100644
-+    struct rss_config_t *config;
+--- a/include/hw/pci/pci_ids.h
-+    struct toeplitz_key_data_t *toe;
++++ b/include/hw/pci/pci_ids.h
-+
+@@ -XXX,XX +XXX,XX @@
-+    __u32 key = 0;
+ #define PCI_DEVICE_ID_LSI_SAS0079        0x0079
-+    __u32 hash = 0;
-+
+ #define PCI_VENDOR_ID_DEC                0x1011
-+    config = bpf_map_lookup_elem(&tap_rss_map_configurations, &key);
++#define PCI_DEVICE_ID_DEC_21143          0x0019
-+    toe = bpf_map_lookup_elem(&tap_rss_map_toeplitz_key, &key);
+ #define PCI_DEVICE_ID_DEC_21154          0x0026
-+
-+    if (config && toe) {
+ #define PCI_VENDOR_ID_CIRRUS             0x1013
 +        if (!config->redirect) {
 +            return config->default_queue;
 +        }
 +
 +        hash = calculate_rss_hash(skb, config, toe);
 +        if (hash) {
 +            __u32 table_idx = hash % config->indirections_len;
 +            __u16 *queue = 0;
 +
 +            queue = bpf_map_lookup_elem(&tap_rss_map_indirection_table,
 +                                        &table_idx);
 +
 +            if (queue) {
 +                return *queue;
 +            }
 +        }
 +
 +        return config->default_queue;
 +    }
 +
 +    return -1;
 +}
 +
 +char _license[] SEC("license") = "GPL v2";
 --
-.7.4
+.5.0

-[PULL 4/7] ebpf: Added eBPF RSS loader.
+[PULL V2 2/4] virtio: new post_load hook
-From: Andrew Melnychenko <andrew@daynix.com>
+From: "Michael S. Tsirkin" <mst@redhat.com>
-Added function that loads RSS eBPF program.
+Post load hook in virtio vmsd is called early while device is processed,
-Added stub functions for RSS eBPF loader.
+and when VirtIODevice core isn't fully initialized.  Most device
-Added meson and configuration options.
+specific code isn't ready to deal with a device in such state, and
 behaves weirdly.
-By default, eBPF feature enabled if libbpf is present in the build system.
+Add a new post_load hook in a device class instead.  Devices should use
-libbpf checked in configuration shell script and meson script.
+this unless they specifically want to verify the migration stream as
 it's processed, e.g. for bounds checking.
-Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
+Cc: qemu-stable@nongnu.org
-Signed-off-by: Andrew Melnychenko <andrew@daynix.com>
+Suggested-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
 Cc: Mikhail Sennikovsky <mikhail.sennikovskii@cloud.ionos.com>
 Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- configure               |   8 +-
+ hw/virtio/virtio.c         | 7 +++++++
- ebpf/ebpf_rss-stub.c    |  40 +++++
+ include/hw/virtio/virtio.h | 6 ++++++
- ebpf/ebpf_rss.c         | 165 ++++++++++++++++++
+files changed, 13 insertions(+)
  ebpf/ebpf_rss.h         |  44 +++++
  ebpf/meson.build        |   1 +
  ebpf/rss.bpf.skeleton.h | 431 ++++++++++++++++++++++++++++++++++++++++++++++++
  ebpf/trace-events       |   4 +
  ebpf/trace.h            |   1 +
  meson.build             |  23 +++
  meson_options.txt       |   2 +
 files changed, 718 insertions(+), 1 deletion(-)
  create mode 100644 ebpf/ebpf_rss-stub.c
  create mode 100644 ebpf/ebpf_rss.c
  create mode 100644 ebpf/ebpf_rss.h
  create mode 100644 ebpf/meson.build
  create mode 100644 ebpf/rss.bpf.skeleton.h
  create mode 100644 ebpf/trace-events
  create mode 100644 ebpf/trace.h
-diff --git a/configure b/configure
+diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
-index XXXXXXX..XXXXXXX 100755
+index XXXXXXX..XXXXXXX 100644
---- a/configure
+--- a/hw/virtio/virtio.c
-+++ b/configure
++++ b/hw/virtio/virtio.c
-@@ -XXX,XX +XXX,XX @@ vhost_vsock="$default_feature"
+@@ -XXX,XX +XXX,XX @@ int virtio_load(VirtIODevice *vdev, QEMUFile *f, int version_id)
- vhost_user="no"
+     }
- vhost_user_blk_server="auto"
+     rcu_read_unlock();
- vhost_user_fs="$default_feature"
-+bpf="auto"
++    if (vdc->post_load) {
- kvm="auto"
++        ret = vdc->post_load(vdev);
- hax="auto"
++        if (ret) {
- hvf="auto"
++            return ret;
-@@ -XXX,XX +XXX,XX @@ for opt do
++        }
    ;;
    --enable-membarrier) membarrier="yes"
    ;;
 +  --disable-bpf) bpf="disabled"
 +  ;;
 +  --enable-bpf) bpf="enabled"
 +  ;;
    --disable-blobs) blobs="false"
    ;;
    --with-pkgversion=*) pkgversion="$optarg"
@@ -XXX,XX +XXX,XX @@ disabled with --disable-FEATURE, default is enabled if available
    vhost-user      vhost-user backend support
    vhost-user-blk-server    vhost-user-blk server support
    vhost-vdpa      vhost-vdpa kernel backend support
 +  bpf             BPF kernel support
    spice           spice
    spice-protocol  spice-protocol
    rbd             rados block device (rbd)
@@ -XXX,XX +XXX,XX @@ if test "$skip_meson" = no; then
          -Dattr=$attr -Ddefault_devices=$default_devices \
          -Ddocs=$docs -Dsphinx_build=$sphinx_build -Dinstall_blobs=$blobs \
          -Dvhost_user_blk_server=$vhost_user_blk_server -Dmultiprocess=$multiprocess \
 -        -Dfuse=$fuse -Dfuse_lseek=$fuse_lseek -Dguest_agent_msi=$guest_agent_msi \
 +        -Dfuse=$fuse -Dfuse_lseek=$fuse_lseek -Dguest_agent_msi=$guest_agent_msi -Dbpf=$bpf\
          $(if test "$default_features" = no; then echo "-Dauto_features=disabled"; fi) \
      -Dtcg_interpreter=$tcg_interpreter \
          $cross_arg \
 diff --git a/ebpf/ebpf_rss-stub.c b/ebpf/ebpf_rss-stub.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/ebpf/ebpf_rss-stub.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * eBPF RSS stub file
 + *
 + * Developed by Daynix Computing LTD (http://www.daynix.com)
 + *
 + * Authors:
 + *  Yuri Benditovich <yuri.benditovich@daynix.com>
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2.  See
 + * the COPYING file in the top-level directory.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "ebpf/ebpf_rss.h"
 +
 +void ebpf_rss_init(struct EBPFRSSContext *ctx)
 +{
 +
 +}
 +
 +bool ebpf_rss_is_loaded(struct EBPFRSSContext *ctx)
 +{
 +    return false;
 +}
 +
 +bool ebpf_rss_load(struct EBPFRSSContext *ctx)
 +{
 +    return false;
 +}
 +
 +bool ebpf_rss_set_all(struct EBPFRSSContext *ctx, struct EBPFRSSConfig *config,
 +                      uint16_t *indirections_table, uint8_t *toeplitz_key)
 +{
 +    return false;
 +}
 +
 +void ebpf_rss_unload(struct EBPFRSSContext *ctx)
 +{
 +
 +}
 diff --git a/ebpf/ebpf_rss.c b/ebpf/ebpf_rss.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/ebpf/ebpf_rss.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * eBPF RSS loader
 + *
 + * Developed by Daynix Computing LTD (http://www.daynix.com)
 + *
 + * Authors:
 + *  Andrew Melnychenko <andrew@daynix.com>
 + *  Yuri Benditovich <yuri.benditovich@daynix.com>
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2.  See
 + * the COPYING file in the top-level directory.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qemu/error-report.h"
 +
 +#include <bpf/libbpf.h>
 +#include <bpf/bpf.h>
 +
 +#include "hw/virtio/virtio-net.h" /* VIRTIO_NET_RSS_MAX_TABLE_LEN */
 +
 +#include "ebpf/ebpf_rss.h"
 +#include "ebpf/rss.bpf.skeleton.h"
 +#include "trace.h"
 +
 +void ebpf_rss_init(struct EBPFRSSContext *ctx)
 +{
 +    if (ctx != NULL) {
 +        ctx->obj = NULL;
 +    }
 +}
 +
 +bool ebpf_rss_is_loaded(struct EBPFRSSContext *ctx)
 +{
 +    return ctx != NULL && ctx->obj != NULL;
 +}
 +
 +bool ebpf_rss_load(struct EBPFRSSContext *ctx)
 +{
 +    struct rss_bpf *rss_bpf_ctx;
 +
 +    if (ctx == NULL) {
 +        return false;
 +    }
 +
-+    rss_bpf_ctx = rss_bpf__open();
+     return 0;
-+    if (rss_bpf_ctx == NULL) {
+ }
-+        trace_ebpf_error("eBPF RSS", "can not open eBPF RSS object");
-+        goto error;
+diff --git a/include/hw/virtio/virtio.h b/include/hw/virtio/virtio.h
 +    }
 +
 +    bpf_program__set_socket_filter(rss_bpf_ctx->progs.tun_rss_steering_prog);
 +
 +    if (rss_bpf__load(rss_bpf_ctx)) {
 +        trace_ebpf_error("eBPF RSS", "can not load RSS program");
 +        goto error;
 +    }
 +
 +    ctx->obj = rss_bpf_ctx;
 +    ctx->program_fd = bpf_program__fd(
 +            rss_bpf_ctx->progs.tun_rss_steering_prog);
 +    ctx->map_configuration = bpf_map__fd(
 +            rss_bpf_ctx->maps.tap_rss_map_configurations);
 +    ctx->map_indirections_table = bpf_map__fd(
 +            rss_bpf_ctx->maps.tap_rss_map_indirection_table);
 +    ctx->map_toeplitz_key = bpf_map__fd(
 +            rss_bpf_ctx->maps.tap_rss_map_toeplitz_key);
 +
 +    return true;
 +error:
 +    rss_bpf__destroy(rss_bpf_ctx);
 +    ctx->obj = NULL;
 +
 +    return false;
 +}
 +
 +static bool ebpf_rss_set_config(struct EBPFRSSContext *ctx,
 +                                struct EBPFRSSConfig *config)
 +{
 +    uint32_t map_key = 0;
 +
 +    if (!ebpf_rss_is_loaded(ctx)) {
 +        return false;
 +    }
 +    if (bpf_map_update_elem(ctx->map_configuration,
 +                            &map_key, config, 0) < 0) {
 +        return false;
 +    }
 +    return true;
 +}
 +
 +static bool ebpf_rss_set_indirections_table(struct EBPFRSSContext *ctx,
 +                                            uint16_t *indirections_table,
 +                                            size_t len)
 +{
 +    uint32_t i = 0;
 +
 +    if (!ebpf_rss_is_loaded(ctx) || indirections_table == NULL ||
 +       len > VIRTIO_NET_RSS_MAX_TABLE_LEN) {
 +        return false;
 +    }
 +
 +    for (; i < len; ++i) {
 +        if (bpf_map_update_elem(ctx->map_indirections_table, &i,
 +                                indirections_table + i, 0) < 0) {
 +            return false;
 +        }
 +    }
 +    return true;
 +}
 +
 +static bool ebpf_rss_set_toepliz_key(struct EBPFRSSContext *ctx,
 +                                     uint8_t *toeplitz_key)
 +{
 +    uint32_t map_key = 0;
 +
 +    /* prepare toeplitz key */
 +    uint8_t toe[VIRTIO_NET_RSS_MAX_KEY_SIZE] = {};
 +
 +    if (!ebpf_rss_is_loaded(ctx) || toeplitz_key == NULL) {
 +        return false;
 +    }
 +    memcpy(toe, toeplitz_key, VIRTIO_NET_RSS_MAX_KEY_SIZE);
 +    *(uint32_t *)toe = ntohl(*(uint32_t *)toe);
 +
 +    if (bpf_map_update_elem(ctx->map_toeplitz_key, &map_key, toe,
 +                            0) < 0) {
 +        return false;
 +    }
 +    return true;
 +}
 +
 +bool ebpf_rss_set_all(struct EBPFRSSContext *ctx, struct EBPFRSSConfig *config,
 +                      uint16_t *indirections_table, uint8_t *toeplitz_key)
 +{
 +    if (!ebpf_rss_is_loaded(ctx) || config == NULL ||
 +        indirections_table == NULL || toeplitz_key == NULL) {
 +        return false;
 +    }
 +
 +    if (!ebpf_rss_set_config(ctx, config)) {
 +        return false;
 +    }
 +
 +    if (!ebpf_rss_set_indirections_table(ctx, indirections_table,
 +                                      config->indirections_len)) {
 +        return false;
 +    }
 +
 +    if (!ebpf_rss_set_toepliz_key(ctx, toeplitz_key)) {
 +        return false;
 +    }
 +
 +    return true;
 +}
 +
 +void ebpf_rss_unload(struct EBPFRSSContext *ctx)
 +{
 +    if (!ebpf_rss_is_loaded(ctx)) {
 +        return;
 +    }
 +
 +    rss_bpf__destroy(ctx->obj);
 +    ctx->obj = NULL;
 +}
 diff --git a/ebpf/ebpf_rss.h b/ebpf/ebpf_rss.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/ebpf/ebpf_rss.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * eBPF RSS header
 + *
 + * Developed by Daynix Computing LTD (http://www.daynix.com)
 + *
 + * Authors:
 + *  Andrew Melnychenko <andrew@daynix.com>
 + *  Yuri Benditovich <yuri.benditovich@daynix.com>
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2.  See
 + * the COPYING file in the top-level directory.
 + */
 +
 +#ifndef QEMU_EBPF_RSS_H
 +#define QEMU_EBPF_RSS_H
 +
 +struct EBPFRSSContext {
 +    void *obj;
 +    int program_fd;
 +    int map_configuration;
 +    int map_toeplitz_key;
 +    int map_indirections_table;
 +};
 +
 +struct EBPFRSSConfig {
 +    uint8_t redirect;
 +    uint8_t populate_hash;
 +    uint32_t hash_types;
 +    uint16_t indirections_len;
 +    uint16_t default_queue;
 +} __attribute__((packed));
 +
 +void ebpf_rss_init(struct EBPFRSSContext *ctx);
 +
 +bool ebpf_rss_is_loaded(struct EBPFRSSContext *ctx);
 +
 +bool ebpf_rss_load(struct EBPFRSSContext *ctx);
 +
 +bool ebpf_rss_set_all(struct EBPFRSSContext *ctx, struct EBPFRSSConfig *config,
 +                      uint16_t *indirections_table, uint8_t *toeplitz_key);
 +
 +void ebpf_rss_unload(struct EBPFRSSContext *ctx);
 +
 +#endif /* QEMU_EBPF_RSS_H */
 diff --git a/ebpf/meson.build b/ebpf/meson.build
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/ebpf/meson.build
@@ -0,0 +1 @@
 +common_ss.add(when: libbpf, if_true: files('ebpf_rss.c'), if_false: files('ebpf_rss-stub.c'))
 diff --git a/ebpf/rss.bpf.skeleton.h b/ebpf/rss.bpf.skeleton.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/ebpf/rss.bpf.skeleton.h
@@ -XXX,XX +XXX,XX @@
 +/* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */
 +
 +/* THIS FILE IS AUTOGENERATED! */
 +#ifndef __RSS_BPF_SKEL_H__
 +#define __RSS_BPF_SKEL_H__
 +
 +#include <stdlib.h>
 +#include <bpf/libbpf.h>
 +
 +struct rss_bpf {
 +    struct bpf_object_skeleton *skeleton;
 +    struct bpf_object *obj;
 +    struct {
 +        struct bpf_map *tap_rss_map_configurations;
 +        struct bpf_map *tap_rss_map_indirection_table;
 +        struct bpf_map *tap_rss_map_toeplitz_key;
 +    } maps;
 +    struct {
 +        struct bpf_program *tun_rss_steering_prog;
 +    } progs;
 +    struct {
 +        struct bpf_link *tun_rss_steering_prog;
 +    } links;
 +};
 +
 +static void
 +rss_bpf__destroy(struct rss_bpf *obj)
 +{
 +    if (!obj)
 +        return;
 +    if (obj->skeleton)
 +        bpf_object__destroy_skeleton(obj->skeleton);
 +    free(obj);
 +}
 +
 +static inline int
 +rss_bpf__create_skeleton(struct rss_bpf *obj);
 +
 +static inline struct rss_bpf *
 +rss_bpf__open_opts(const struct bpf_object_open_opts *opts)
 +{
 +    struct rss_bpf *obj;
 +
 +    obj = (struct rss_bpf *)calloc(1, sizeof(*obj));
 +    if (!obj)
 +        return NULL;
 +    if (rss_bpf__create_skeleton(obj))
 +        goto err;
 +    if (bpf_object__open_skeleton(obj->skeleton, opts))
 +        goto err;
 +
 +    return obj;
 +err:
 +    rss_bpf__destroy(obj);
 +    return NULL;
 +}
 +
 +static inline struct rss_bpf *
 +rss_bpf__open(void)
 +{
 +    return rss_bpf__open_opts(NULL);
 +}
 +
 +static inline int
 +rss_bpf__load(struct rss_bpf *obj)
 +{
 +    return bpf_object__load_skeleton(obj->skeleton);
 +}
 +
 +static inline struct rss_bpf *
 +rss_bpf__open_and_load(void)
 +{
 +    struct rss_bpf *obj;
 +
 +    obj = rss_bpf__open();
 +    if (!obj)
 +        return NULL;
 +    if (rss_bpf__load(obj)) {
 +        rss_bpf__destroy(obj);
 +        return NULL;
 +    }
 +    return obj;
 +}
 +
 +static inline int
 +rss_bpf__attach(struct rss_bpf *obj)
 +{
 +    return bpf_object__attach_skeleton(obj->skeleton);
 +}
 +
 +static inline void
 +rss_bpf__detach(struct rss_bpf *obj)
 +{
 +    return bpf_object__detach_skeleton(obj->skeleton);
 +}
 +
 +static inline int
 +rss_bpf__create_skeleton(struct rss_bpf *obj)
 +{
 +    struct bpf_object_skeleton *s;
 +
 +    s = (struct bpf_object_skeleton *)calloc(1, sizeof(*s));
 +    if (!s)
 +        return -1;
 +    obj->skeleton = s;
 +
 +    s->sz = sizeof(*s);
 +    s->name = "rss_bpf";
 +    s->obj = &obj->obj;
 +
 +    /* maps */
 +    s->map_cnt = 3;
 +    s->map_skel_sz = sizeof(*s->maps);
 +    s->maps = (struct bpf_map_skeleton *)calloc(s->map_cnt, s->map_skel_sz);
 +    if (!s->maps)
 +        goto err;
 +
 +    s->maps[0].name = "tap_rss_map_configurations";
 +    s->maps[0].map = &obj->maps.tap_rss_map_configurations;
 +
 +    s->maps[1].name = "tap_rss_map_indirection_table";
 +    s->maps[1].map = &obj->maps.tap_rss_map_indirection_table;
 +
 +    s->maps[2].name = "tap_rss_map_toeplitz_key";
 +    s->maps[2].map = &obj->maps.tap_rss_map_toeplitz_key;
 +
 +    /* programs */
 +    s->prog_cnt = 1;
 +    s->prog_skel_sz = sizeof(*s->progs);
 +    s->progs = (struct bpf_prog_skeleton *)calloc(s->prog_cnt, s->prog_skel_sz);
 +    if (!s->progs)
 +        goto err;
 +
 +    s->progs[0].name = "tun_rss_steering_prog";
 +    s->progs[0].prog = &obj->progs.tun_rss_steering_prog;
 +    s->progs[0].link = &obj->links.tun_rss_steering_prog;
 +
 +    s->data_sz = 8088;
 +    s->data = (void *)"\
 +\x7f\x45\x4c\x46\x02\x01\x01\0\0\0\0\0\0\0\0\0\x01\0\xf7\0\x01\0\0\0\0\0\0\0\0\
 +\0\0\0\0\0\0\0\0\0\0\0\x18\x1d\0\0\0\0\0\0\0\0\0\0\x40\0\0\0\0\0\x40\0\x0a\0\
 +\x01\0\xbf\x18\0\0\0\0\0\0\xb7\x01\0\0\0\0\0\0\x63\x1a\x4c\xff\0\0\0\0\xbf\xa7\
 +\0\0\0\0\0\0\x07\x07\0\0\x4c\xff\xff\xff\x18\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
 +\xbf\x72\0\0\0\0\0\0\x85\0\0\0\x01\0\0\0\xbf\x06\0\0\0\0\0\0\x18\x01\0\0\0\0\0\
 +\0\0\0\0\0\0\0\0\0\xbf\x72\0\0\0\0\0\0\x85\0\0\0\x01\0\0\0\xbf\x07\0\0\0\0\0\0\
 +\x18\0\0\0\xff\xff\xff\xff\0\0\0\0\0\0\0\0\x15\x06\x66\x02\0\0\0\0\xbf\x79\0\0\
 +\0\0\0\0\x15\x09\x64\x02\0\0\0\0\x71\x61\0\0\0\0\0\0\x55\x01\x01\0\0\0\0\0\x05\
 +\0\x5d\x02\0\0\0\0\xb7\x01\0\0\0\0\0\0\x63\x1a\xc0\xff\0\0\0\0\x7b\x1a\xb8\xff\
 +\0\0\0\0\x7b\x1a\xb0\xff\0\0\0\0\x7b\x1a\xa8\xff\0\0\0\0\x7b\x1a\xa0\xff\0\0\0\
 +\0\x63\x1a\x98\xff\0\0\0\0\x7b\x1a\x90\xff\0\0\0\0\x7b\x1a\x88\xff\0\0\0\0\x7b\
 +\x1a\x80\xff\0\0\0\0\x7b\x1a\x78\xff\0\0\0\0\x7b\x1a\x70\xff\0\0\0\0\x7b\x1a\
 +\x68\xff\0\0\0\0\x7b\x1a\x60\xff\0\0\0\0\x7b\x1a\x58\xff\0\0\0\0\x7b\x1a\x50\
 +\xff\0\0\0\0\x15\x08\x4c\x02\0\0\0\0\x6b\x1a\xd0\xff\0\0\0\0\xbf\xa3\0\0\0\0\0\
 +\0\x07\x03\0\0\xd0\xff\xff\xff\xbf\x81\0\0\0\0\0\0\xb7\x02\0\0\x0c\0\0\0\xb7\
 +\x04\0\0\x02\0\0\0\xb7\x05\0\0\0\0\0\0\x85\0\0\0\x44\0\0\0\x67\0\0\0\x20\0\0\0\
 +\x77\0\0\0\x20\0\0\0\x55\0\x11\0\0\0\0\0\xb7\x02\0\0\x10\0\0\0\x69\xa1\xd0\xff\
 +\0\0\0\0\xbf\x13\0\0\0\0\0\0\xdc\x03\0\0\x10\0\0\0\x15\x03\x02\0\0\x81\0\0\x55\
 +\x03\x0c\0\xa8\x88\0\0\xb7\x02\0\0\x14\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\
 +\xd0\xff\xff\xff\xbf\x81\0\0\0\0\0\0\xb7\x04\0\0\x02\0\0\0\xb7\x05\0\0\0\0\0\0\
 +\x85\0\0\0\x44\0\0\0\x69\xa1\xd0\xff\0\0\0\0\x67\0\0\0\x20\0\0\0\x77\0\0\0\x20\
 +\0\0\0\x15\0\x01\0\0\0\0\0\x05\0\x2f\x02\0\0\0\0\x15\x01\x2e\x02\0\0\0\0\x7b\
 +\x9a\x30\xff\0\0\0\0\x15\x01\x57\0\x86\xdd\0\0\x55\x01\x3b\0\x08\0\0\0\x7b\x7a\
 +\x20\xff\0\0\0\0\xb7\x07\0\0\x01\0\0\0\x73\x7a\x50\xff\0\0\0\0\xb7\x01\0\0\0\0\
 +\0\0\x63\x1a\xe0\xff\0\0\0\0\x7b\x1a\xd8\xff\0\0\0\0\x7b\x1a\xd0\xff\0\0\0\0\
 +\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\xd0\xff\xff\xff\xbf\x81\0\0\0\0\0\0\xb7\x02\0\
 +\0\0\0\0\0\xb7\x04\0\0\x14\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\0\0\0\x67\
 +\0\0\0\x20\0\0\0\x77\0\0\0\x20\0\0\0\x55\0\x1a\x02\0\0\0\0\x69\xa1\xd6\xff\0\0\
 +\0\0\x55\x01\x01\0\0\0\0\0\xb7\x07\0\0\0\0\0\0\x61\xa1\xdc\xff\0\0\0\0\x63\x1a\
 +\x5c\xff\0\0\0\0\x61\xa1\xe0\xff\0\0\0\0\x63\x1a\x60\xff\0\0\0\0\x73\x7a\x56\
 +\xff\0\0\0\0\x71\xa9\xd9\xff\0\0\0\0\x71\xa1\xd0\xff\0\0\0\0\x67\x01\0\0\x02\0\
 +\0\0\x57\x01\0\0\x3c\0\0\0\x7b\x1a\x40\xff\0\0\0\0\x79\xa7\x20\xff\0\0\0\0\xbf\
 +\x91\0\0\0\0\0\0\x57\x01\0\0\xff\0\0\0\x15\x01\x19\0\0\0\0\0\x71\xa1\x56\xff\0\
 +\0\0\0\x55\x01\x17\0\0\0\0\0\x57\x09\0\0\xff\0\0\0\x15\x09\x7a\x01\x11\0\0\0\
 +\x55\x09\x14\0\x06\0\0\0\xb7\x01\0\0\x01\0\0\0\x73\x1a\x53\xff\0\0\0\0\xb7\x01\
 +\0\0\0\0\0\0\x63\x1a\xe0\xff\0\0\0\0\x7b\x1a\xd8\xff\0\0\0\0\x7b\x1a\xd0\xff\0\
 +\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\xd0\xff\xff\xff\xbf\x81\0\0\0\0\0\0\x79\
 +\xa2\x40\xff\0\0\0\0\xb7\x04\0\0\x14\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\
 +\0\0\0\x67\0\0\0\x20\0\0\0\x77\0\0\0\x20\0\0\0\x55\0\xf4\x01\0\0\0\0\x69\xa1\
 +\xd0\xff\0\0\0\0\x6b\x1a\x58\xff\0\0\0\0\x69\xa1\xd2\xff\0\0\0\0\x6b\x1a\x5a\
 +\xff\0\0\0\0\x71\xa1\x50\xff\0\0\0\0\x15\x01\xd4\0\0\0\0\0\x71\x62\x03\0\0\0\0\
 +\0\x67\x02\0\0\x08\0\0\0\x71\x61\x02\0\0\0\0\0\x4f\x12\0\0\0\0\0\0\x71\x63\x04\
 +\0\0\0\0\0\x71\x61\x05\0\0\0\0\0\x67\x01\0\0\x08\0\0\0\x4f\x31\0\0\0\0\0\0\x67\
 +\x01\0\0\x10\0\0\0\x4f\x21\0\0\0\0\0\0\x71\xa2\x53\xff\0\0\0\0\x79\xa0\x30\xff\
 +\0\0\0\0\x15\x02\x06\x01\0\0\0\0\xbf\x12\0\0\0\0\0\0\x57\x02\0\0\x02\0\0\0\x15\
 +\x02\x03\x01\0\0\0\0\x61\xa1\x5c\xff\0\0\0\0\x63\x1a\xa0\xff\0\0\0\0\x61\xa1\
 +\x60\xff\0\0\0\0\x63\x1a\xa4\xff\0\0\0\0\x69\xa1\x58\xff\0\0\0\0\x6b\x1a\xa8\
 +\xff\0\0\0\0\x69\xa1\x5a\xff\0\0\0\0\x6b\x1a\xaa\xff\0\0\0\0\x05\0\x65\x01\0\0\
 +\0\0\xb7\x01\0\0\x01\0\0\0\x73\x1a\x51\xff\0\0\0\0\xb7\x01\0\0\0\0\0\0\x7b\x1a\
 +\xf0\xff\0\0\0\0\x7b\x1a\xe8\xff\0\0\0\0\x7b\x1a\xe0\xff\0\0\0\0\x7b\x1a\xd8\
 +\xff\0\0\0\0\x7b\x1a\xd0\xff\0\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\xd0\xff\
 +\xff\xff\xb7\x01\0\0\x28\0\0\0\x7b\x1a\x40\xff\0\0\0\0\xbf\x81\0\0\0\0\0\0\xb7\
 +\x02\0\0\0\0\0\0\xb7\x04\0\0\x28\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\0\0\
 +\0\x67\0\0\0\x20\0\0\0\x77\0\0\0\x20\0\0\0\x55\0\x10\x01\0\0\0\0\x79\xa1\xe0\
 +\xff\0\0\0\0\x63\x1a\x64\xff\0\0\0\0\x77\x01\0\0\x20\0\0\0\x63\x1a\x68\xff\0\0\
 +\0\0\x79\xa1\xd8\xff\0\0\0\0\x63\x1a\x5c\xff\0\0\0\0\x77\x01\0\0\x20\0\0\0\x63\
 +\x1a\x60\xff\0\0\0\0\x79\xa1\xe8\xff\0\0\0\0\x63\x1a\x6c\xff\0\0\0\0\x77\x01\0\
 +\0\x20\0\0\0\x63\x1a\x70\xff\0\0\0\0\x79\xa1\xf0\xff\0\0\0\0\x63\x1a\x74\xff\0\
 +\0\0\0\x77\x01\0\0\x20\0\0\0\x63\x1a\x78\xff\0\0\0\0\x71\xa9\xd6\xff\0\0\0\0\
 +\x25\x09\xff\0\x3c\0\0\0\xb7\x01\0\0\x01\0\0\0\x6f\x91\0\0\0\0\0\0\x18\x02\0\0\
 +\x01\0\0\0\0\0\0\0\0\x18\0\x1c\x5f\x21\0\0\0\0\0\0\x55\x01\x01\0\0\0\0\0\x05\0\
 +\xf8\0\0\0\0\0\xb7\x01\0\0\0\0\0\0\x6b\x1a\xfe\xff\0\0\0\0\xb7\x01\0\0\x28\0\0\
 +\0\x7b\x1a\x40\xff\0\0\0\0\xbf\xa1\0\0\0\0\0\0\x07\x01\0\0\x8c\xff\xff\xff\x7b\
 +\x1a\x18\xff\0\0\0\0\xbf\xa1\0\0\0\0\0\0\x07\x01\0\0\x7c\xff\xff\xff\x7b\x1a\
 +\x10\xff\0\0\0\0\xb7\x01\0\0\0\0\0\0\x7b\x1a\x28\xff\0\0\0\0\x7b\x7a\x20\xff\0\
 +\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\xfe\xff\xff\xff\xbf\x81\0\0\0\0\0\0\x79\
 +\xa2\x40\xff\0\0\0\0\xb7\x04\0\0\x02\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\
 +\0\0\0\x67\0\0\0\x20\0\0\0\x77\0\0\0\x20\0\0\0\x15\0\x01\0\0\0\0\0\x05\0\x90\
 +\x01\0\0\0\0\xbf\x91\0\0\0\0\0\0\x15\x01\x23\0\x3c\0\0\0\x15\x01\x59\0\x2c\0\0\
 +\0\x55\x01\x5a\0\x2b\0\0\0\xb7\x01\0\0\0\0\0\0\x63\x1a\xf8\xff\0\0\0\0\xbf\xa3\
 +\0\0\0\0\0\0\x07\x03\0\0\xf8\xff\xff\xff\xbf\x81\0\0\0\0\0\0\x79\xa2\x40\xff\0\
 +\0\0\0\xb7\x04\0\0\x04\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\0\0\0\xbf\x01\
 +\0\0\0\0\0\0\x67\x01\0\0\x20\0\0\0\x77\x01\0\0\x20\0\0\0\x55\x01\x03\x01\0\0\0\
 +\0\x71\xa1\xfa\xff\0\0\0\0\x55\x01\x4b\0\x02\0\0\0\x71\xa1\xf9\xff\0\0\0\0\x55\
 +\x01\x49\0\x02\0\0\0\x71\xa1\xfb\xff\0\0\0\0\x55\x01\x47\0\x01\0\0\0\x79\xa2\
 +\x40\xff\0\0\0\0\x07\x02\0\0\x08\0\0\0\xbf\x81\0\0\0\0\0\0\x79\xa3\x18\xff\0\0\
 +\0\0\xb7\x04\0\0\x10\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\0\0\0\xbf\x01\0\
 +\0\0\0\0\0\x67\x01\0\0\x20\0\0\0\x77\x01\0\0\x20\0\0\0\x55\x01\xf2\0\0\0\0\0\
 +\xb7\x01\0\0\x01\0\0\0\x73\x1a\x55\xff\0\0\0\0\x05\0\x39\0\0\0\0\0\xb7\x01\0\0\
 +\0\0\0\0\x6b\x1a\xf8\xff\0\0\0\0\xb7\x09\0\0\x02\0\0\0\xb7\x07\0\0\x1e\0\0\0\
 +\x05\0\x0e\0\0\0\0\0\x79\xa2\x38\xff\0\0\0\0\x0f\x29\0\0\0\0\0\0\xbf\x92\0\0\0\
 +\0\0\0\x07\x02\0\0\x01\0\0\0\x71\xa3\xff\xff\0\0\0\0\x67\x03\0\0\x03\0\0\0\x2d\
 +\x23\x02\0\0\0\0\0\x79\xa7\x20\xff\0\0\0\0\x05\0\x2b\0\0\0\0\0\x07\x07\0\0\xff\
 +\xff\xff\xff\xbf\x72\0\0\0\0\0\0\x67\x02\0\0\x20\0\0\0\x77\x02\0\0\x20\0\0\0\
 +\x15\x02\xf9\xff\0\0\0\0\x7b\x9a\x38\xff\0\0\0\0\x79\xa1\x40\xff\0\0\0\0\x0f\
 +\x19\0\0\0\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\xf8\xff\xff\xff\xbf\x81\0\0\0\
 +\0\0\0\xbf\x92\0\0\0\0\0\0\xb7\x04\0\0\x02\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\
 +\0\x44\0\0\0\xbf\x01\0\0\0\0\0\0\x67\x01\0\0\x20\0\0\0\x77\x01\0\0\x20\0\0\0\
 +\x55\x01\x94\0\0\0\0\0\x71\xa2\xf8\xff\0\0\0\0\x55\x02\x0f\0\xc9\0\0\0\x07\x09\
 +\0\0\x02\0\0\0\xbf\x81\0\0\0\0\0\0\xbf\x92\0\0\0\0\0\0\x79\xa3\x10\xff\0\0\0\0\
 +\xb7\x04\0\0\x10\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\0\0\0\xbf\x01\0\0\0\
 +\0\0\0\x67\x01\0\0\x20\0\0\0\x77\x01\0\0\x20\0\0\0\x55\x01\x87\0\0\0\0\0\xb7\
 +\x01\0\0\x01\0\0\0\x73\x1a\x54\xff\0\0\0\0\x79\xa7\x20\xff\0\0\0\0\x05\0\x07\0\
 +\0\0\0\0\xb7\x09\0\0\x01\0\0\0\x15\x02\xd1\xff\0\0\0\0\x71\xa9\xf9\xff\0\0\0\0\
 +\x07\x09\0\0\x02\0\0\0\x05\0\xce\xff\0\0\0\0\xb7\x01\0\0\x01\0\0\0\x73\x1a\x56\
 +\xff\0\0\0\0\x71\xa1\xff\xff\0\0\0\0\x67\x01\0\0\x03\0\0\0\x79\xa2\x40\xff\0\0\
 +\0\0\x0f\x12\0\0\0\0\0\0\x07\x02\0\0\x08\0\0\0\x7b\x2a\x40\xff\0\0\0\0\x71\xa9\
 +\xfe\xff\0\0\0\0\x25\x09\x0e\0\x3c\0\0\0\xb7\x01\0\0\x01\0\0\0\x6f\x91\0\0\0\0\
 +\0\0\x18\x02\0\0\x01\0\0\0\0\0\0\0\0\x18\0\x1c\x5f\x21\0\0\0\0\0\0\x55\x01\x01\
 +\0\0\0\0\0\x05\0\x07\0\0\0\0\0\x79\xa1\x28\xff\0\0\0\0\x07\x01\0\0\x01\0\0\0\
 +\x7b\x1a\x28\xff\0\0\0\0\x67\x01\0\0\x20\0\0\0\x77\x01\0\0\x20\0\0\0\x55\x01\
 +\x82\xff\x0b\0\0\0\x05\0\x10\xff\0\0\0\0\x15\x09\xf8\xff\x87\0\0\0\x05\0\xfd\
 +\xff\0\0\0\0\x71\xa1\x51\xff\0\0\0\0\x79\xa0\x30\xff\0\0\0\0\x15\x01\x17\x01\0\
 +\0\0\0\x71\x62\x03\0\0\0\0\0\x67\x02\0\0\x08\0\0\0\x71\x61\x02\0\0\0\0\0\x4f\
 +\x12\0\0\0\0\0\0\x71\x63\x04\0\0\0\0\0\x71\x61\x05\0\0\0\0\0\x67\x01\0\0\x08\0\
 +\0\0\x4f\x31\0\0\0\0\0\0\x67\x01\0\0\x10\0\0\0\x4f\x21\0\0\0\0\0\0\x71\xa2\x53\
 +\xff\0\0\0\0\x15\x02\x3d\0\0\0\0\0\xbf\x12\0\0\0\0\0\0\x57\x02\0\0\x10\0\0\0\
 +\x15\x02\x3a\0\0\0\0\0\xbf\xa2\0\0\0\0\0\0\x07\x02\0\0\x5c\xff\xff\xff\x71\xa4\
 +\x54\xff\0\0\0\0\xbf\x23\0\0\0\0\0\0\x15\x04\x02\0\0\0\0\0\xbf\xa3\0\0\0\0\0\0\
 +\x07\x03\0\0\x7c\xff\xff\xff\x67\x01\0\0\x38\0\0\0\xc7\x01\0\0\x38\0\0\0\x65\
 +\x01\x01\0\xff\xff\xff\xff\xbf\x32\0\0\0\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\
 +\x6c\xff\xff\xff\x71\xa5\x55\xff\0\0\0\0\xbf\x34\0\0\0\0\0\0\x15\x05\x02\0\0\0\
 +\0\0\xbf\xa4\0\0\0\0\0\0\x07\x04\0\0\x8c\xff\xff\xff\x65\x01\x01\0\xff\xff\xff\
 +\xff\xbf\x43\0\0\0\0\0\0\x61\x21\x04\0\0\0\0\0\x67\x01\0\0\x20\0\0\0\x61\x24\0\
 +\0\0\0\0\0\x4f\x41\0\0\0\0\0\0\x7b\x1a\xa0\xff\0\0\0\0\x61\x21\x08\0\0\0\0\0\
 +\x61\x22\x0c\0\0\0\0\0\x67\x02\0\0\x20\0\0\0\x4f\x12\0\0\0\0\0\0\x7b\x2a\xa8\
 +\xff\0\0\0\0\x61\x31\0\0\0\0\0\0\x61\x32\x04\0\0\0\0\0\x61\x34\x08\0\0\0\0\0\
 +\x61\x33\x0c\0\0\0\0\0\x69\xa5\x5a\xff\0\0\0\0\x6b\x5a\xc2\xff\0\0\0\0\x69\xa5\
 +\x58\xff\0\0\0\0\x6b\x5a\xc0\xff\0\0\0\0\x67\x03\0\0\x20\0\0\0\x4f\x43\0\0\0\0\
 +\0\0\x7b\x3a\xb8\xff\0\0\0\0\x67\x02\0\0\x20\0\0\0\x4f\x12\0\0\0\0\0\0\x7b\x2a\
 +\xb0\xff\0\0\0\0\x05\0\x6b\0\0\0\0\0\x71\xa2\x52\xff\0\0\0\0\x15\x02\x04\0\0\0\
 +\0\0\xbf\x12\0\0\0\0\0\0\x57\x02\0\0\x04\0\0\0\x15\x02\x01\0\0\0\0\0\x05\0\xf7\
 +\xfe\0\0\0\0\x57\x01\0\0\x01\0\0\0\x15\x01\xd3\0\0\0\0\0\x61\xa1\x5c\xff\0\0\0\
 +\0\x63\x1a\xa0\xff\0\0\0\0\x61\xa1\x60\xff\0\0\0\0\x63\x1a\xa4\xff\0\0\0\0\x05\
 +\0\x5e\0\0\0\0\0\x71\xa2\x52\xff\0\0\0\0\x15\x02\x1e\0\0\0\0\0\xbf\x12\0\0\0\0\
 +\0\0\x57\x02\0\0\x20\0\0\0\x15\x02\x1b\0\0\0\0\0\xbf\xa2\0\0\0\0\0\0\x07\x02\0\
 +\0\x5c\xff\xff\xff\x71\xa4\x54\xff\0\0\0\0\xbf\x23\0\0\0\0\0\0\x15\x04\x02\0\0\
 +\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\x7c\xff\xff\xff\x57\x01\0\0\0\x01\0\0\
 +\x15\x01\x01\0\0\0\0\0\xbf\x32\0\0\0\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\x6c\
 +\xff\xff\xff\x71\xa5\x55\xff\0\0\0\0\xbf\x34\0\0\0\0\0\0\x15\x05\x02\0\0\0\0\0\
 +\xbf\xa4\0\0\0\0\0\0\x07\x04\0\0\x8c\xff\xff\xff\x15\x01\xc3\xff\0\0\0\0\x05\0\
 +\xc1\xff\0\0\0\0\xb7\x09\0\0\x3c\0\0\0\x79\xa7\x20\xff\0\0\0\0\x67\0\0\0\x20\0\
 +\0\0\x77\0\0\0\x20\0\0\0\x15\0\xa5\xfe\0\0\0\0\x05\0\xb0\0\0\0\0\0\x15\x09\x07\
 +\xff\x87\0\0\0\x05\0\xa2\xfe\0\0\0\0\xbf\x12\0\0\0\0\0\0\x57\x02\0\0\x08\0\0\0\
 +\x15\x02\xab\0\0\0\0\0\xbf\xa2\0\0\0\0\0\0\x07\x02\0\0\x5c\xff\xff\xff\x71\xa4\
 +\x54\xff\0\0\0\0\xbf\x23\0\0\0\0\0\0\x15\x04\x02\0\0\0\0\0\xbf\xa3\0\0\0\0\0\0\
 +\x07\x03\0\0\x7c\xff\xff\xff\x57\x01\0\0\x40\0\0\0\x15\x01\x01\0\0\0\0\0\xbf\
 +\x32\0\0\0\0\0\0\x61\x23\x04\0\0\0\0\0\x67\x03\0\0\x20\0\0\0\x61\x24\0\0\0\0\0\
 +\0\x4f\x43\0\0\0\0\0\0\x7b\x3a\xa0\xff\0\0\0\0\x61\x23\x08\0\0\0\0\0\x61\x22\
 +\x0c\0\0\0\0\0\x67\x02\0\0\x20\0\0\0\x4f\x32\0\0\0\0\0\0\x7b\x2a\xa8\xff\0\0\0\
 +\0\x15\x01\x1c\0\0\0\0\0\x71\xa1\x55\xff\0\0\0\0\x15\x01\x1a\0\0\0\0\0\x61\xa1\
 +\x98\xff\0\0\0\0\x67\x01\0\0\x20\0\0\0\x61\xa2\x94\xff\0\0\0\0\x4f\x21\0\0\0\0\
 +\0\0\x7b\x1a\xb8\xff\0\0\0\0\x61\xa1\x90\xff\0\0\0\0\x67\x01\0\0\x20\0\0\0\x61\
 +\xa2\x8c\xff\0\0\0\0\x05\0\x19\0\0\0\0\0\xb7\x01\0\0\x01\0\0\0\x73\x1a\x52\xff\
 +\0\0\0\0\xb7\x01\0\0\0\0\0\0\x7b\x1a\xd0\xff\0\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\
 +\x03\0\0\xd0\xff\xff\xff\xbf\x81\0\0\0\0\0\0\x79\xa2\x40\xff\0\0\0\0\xb7\x04\0\
 +\0\x08\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\0\0\0\x67\0\0\0\x20\0\0\0\x77\
 +\0\0\0\x20\0\0\0\x55\0\x7d\0\0\0\0\0\x05\0\x88\xfe\0\0\0\0\xb7\x09\0\0\x2b\0\0\
 +\0\x05\0\xc6\xff\0\0\0\0\x61\xa1\x78\xff\0\0\0\0\x67\x01\0\0\x20\0\0\0\x61\xa2\
 +\x74\xff\0\0\0\0\x4f\x21\0\0\0\0\0\0\x7b\x1a\xb8\xff\0\0\0\0\x61\xa1\x70\xff\0\
 +\0\0\0\x67\x01\0\0\x20\0\0\0\x61\xa2\x6c\xff\0\0\0\0\x4f\x21\0\0\0\0\0\0\x7b\
 +\x1a\xb0\xff\0\0\0\0\xb7\x01\0\0\0\0\0\0\x07\x07\0\0\x04\0\0\0\x61\x03\0\0\0\0\
 +\0\0\xb7\x05\0\0\0\0\0\0\x05\0\x4e\0\0\0\0\0\xaf\x52\0\0\0\0\0\0\xbf\x75\0\0\0\
 +\0\0\0\x0f\x15\0\0\0\0\0\0\x71\x55\0\0\0\0\0\0\x67\x03\0\0\x01\0\0\0\xbf\x50\0\
 +\0\0\0\0\0\x77\0\0\0\x07\0\0\0\x4f\x03\0\0\0\0\0\0\xbf\x40\0\0\0\0\0\0\x67\0\0\
 +\0\x39\0\0\0\xc7\0\0\0\x3f\0\0\0\x5f\x30\0\0\0\0\0\0\xaf\x02\0\0\0\0\0\0\xbf\
 +\x50\0\0\0\0\0\0\x77\0\0\0\x06\0\0\0\x57\0\0\0\x01\0\0\0\x67\x03\0\0\x01\0\0\0\
 +\x4f\x03\0\0\0\0\0\0\xbf\x40\0\0\0\0\0\0\x67\0\0\0\x3a\0\0\0\xc7\0\0\0\x3f\0\0\
 +\0\x5f\x30\0\0\0\0\0\0\xaf\x02\0\0\0\0\0\0\x67\x03\0\0\x01\0\0\0\xbf\x50\0\0\0\
 +\0\0\0\x77\0\0\0\x05\0\0\0\x57\0\0\0\x01\0\0\0\x4f\x03\0\0\0\0\0\0\xbf\x40\0\0\
 +\0\0\0\0\x67\0\0\0\x3b\0\0\0\xc7\0\0\0\x3f\0\0\0\x5f\x30\0\0\0\0\0\0\xaf\x02\0\
 +\0\0\0\0\0\x67\x03\0\0\x01\0\0\0\xbf\x50\0\0\0\0\0\0\x77\0\0\0\x04\0\0\0\x57\0\
 +\0\0\x01\0\0\0\x4f\x03\0\0\0\0\0\0\xbf\x40\0\0\0\0\0\0\x67\0\0\0\x3c\0\0\0\xc7\
 +\0\0\0\x3f\0\0\0\x5f\x30\0\0\0\0\0\0\xaf\x02\0\0\0\0\0\0\xbf\x50\0\0\0\0\0\0\
 +\x77\0\0\0\x03\0\0\0\x57\0\0\0\x01\0\0\0\x67\x03\0\0\x01\0\0\0\x4f\x03\0\0\0\0\
 +\0\0\xbf\x40\0\0\0\0\0\0\x67\0\0\0\x3d\0\0\0\xc7\0\0\0\x3f\0\0\0\x5f\x30\0\0\0\
 +\0\0\0\xaf\x02\0\0\0\0\0\0\xbf\x50\0\0\0\0\0\0\x77\0\0\0\x02\0\0\0\x57\0\0\0\
 +\x01\0\0\0\x67\x03\0\0\x01\0\0\0\x4f\x03\0\0\0\0\0\0\xbf\x40\0\0\0\0\0\0\x67\0\
 +\0\0\x3e\0\0\0\xc7\0\0\0\x3f\0\0\0\x5f\x30\0\0\0\0\0\0\xaf\x02\0\0\0\0\0\0\xbf\
 +\x50\0\0\0\0\0\0\x77\0\0\0\x01\0\0\0\x57\0\0\0\x01\0\0\0\x67\x03\0\0\x01\0\0\0\
 +\x4f\x03\0\0\0\0\0\0\x57\x04\0\0\x01\0\0\0\x87\x04\0\0\0\0\0\0\x5f\x34\0\0\0\0\
 +\0\0\xaf\x42\0\0\0\0\0\0\x57\x05\0\0\x01\0\0\0\x67\x03\0\0\x01\0\0\0\x4f\x53\0\
 +\0\0\0\0\0\x07\x01\0\0\x01\0\0\0\xbf\x25\0\0\0\0\0\0\x15\x01\x0b\0\x24\0\0\0\
 +\xbf\xa2\0\0\0\0\0\0\x07\x02\0\0\xa0\xff\xff\xff\x0f\x12\0\0\0\0\0\0\x71\x24\0\
 +\0\0\0\0\0\xbf\x40\0\0\0\0\0\0\x67\0\0\0\x38\0\0\0\xc7\0\0\0\x38\0\0\0\xb7\x02\
 +\0\0\0\0\0\0\x65\0\xa9\xff\xff\xff\xff\xff\xbf\x32\0\0\0\0\0\0\x05\0\xa7\xff\0\
 +\0\0\0\xbf\x21\0\0\0\0\0\0\x67\x01\0\0\x20\0\0\0\x77\x01\0\0\x20\0\0\0\x15\x01\
 +\x0e\0\0\0\0\0\x71\x63\x06\0\0\0\0\0\x71\x64\x07\0\0\0\0\0\x67\x04\0\0\x08\0\0\
 +\0\x4f\x34\0\0\0\0\0\0\x3f\x41\0\0\0\0\0\0\x2f\x41\0\0\0\0\0\0\x1f\x12\0\0\0\0\
 +\0\0\x63\x2a\x50\xff\0\0\0\0\xbf\xa2\0\0\0\0\0\0\x07\x02\0\0\x50\xff\xff\xff\
 +\x18\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x85\0\0\0\x01\0\0\0\x55\0\x05\0\0\0\0\0\
 +\x71\x61\x08\0\0\0\0\0\x71\x60\x09\0\0\0\0\0\x67\0\0\0\x08\0\0\0\x4f\x10\0\0\0\
 +\0\0\0\x95\0\0\0\0\0\0\0\x69\0\0\0\0\0\0\0\x05\0\xfd\xff\0\0\0\0\x02\0\0\0\x04\
 +\0\0\0\x0a\0\0\0\x01\0\0\0\0\0\0\0\x02\0\0\0\x04\0\0\0\x28\0\0\0\x01\0\0\0\0\0\
 +\0\0\x02\0\0\0\x04\0\0\0\x02\0\0\0\x80\0\0\0\0\0\0\0\x47\x50\x4c\x20\x76\x32\0\
 +\0\0\0\0\0\x10\0\0\0\0\0\0\0\x01\x7a\x52\0\x08\x7c\x0b\x01\x0c\0\0\0\x18\0\0\0\
 +\x18\0\0\0\0\0\0\0\0\0\0\0\xd8\x13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
 +\0\0\0\0\0\0\0\0\0\0\0\0\xa0\0\0\0\x04\0\xf1\xff\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
 +\0\x60\x02\0\0\0\0\x03\0\x20\x02\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x3f\x02\0\0\0\0\
 +\x03\0\xd0\x0f\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xed\x01\0\0\0\0\x03\0\x10\x10\0\0\0\
 +\0\0\0\0\0\0\0\0\0\0\0\xd4\x01\0\0\0\0\x03\0\x20\x10\0\0\0\0\0\0\0\0\0\0\0\0\0\
 +\0\xa3\x01\0\0\0\0\x03\0\xb8\x12\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x63\x01\0\0\0\0\
 +\x03\0\x48\x10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x2a\x01\0\0\0\0\x03\0\x10\x13\0\0\0\
 +\0\0\0\0\0\0\0\0\0\0\0\xe1\0\0\0\0\0\x03\0\xa0\x13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
 +\x2e\x02\0\0\0\0\x03\0\x28\x02\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x68\x02\0\0\0\0\x03\
 +\0\xc0\x13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x36\x02\0\0\0\0\x03\0\xc8\x13\0\0\0\0\0\
 +\0\0\0\0\0\0\0\0\0\x22\x01\0\0\0\0\x03\0\xe8\x02\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
 +\x02\x01\0\0\0\0\x03\0\x40\x03\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xd9\0\0\0\0\0\x03\0\
 +\xf8\x04\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x26\x02\0\0\0\0\x03\0\x20\x0e\0\0\0\0\0\0\
 +\0\0\0\0\0\0\0\0\xcc\x01\0\0\0\0\x03\0\x60\x06\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x9b\
 +\x01\0\0\0\0\x03\0\xc8\x06\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x5b\x01\0\0\0\0\x03\0\
 +\x20\x07\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x7c\x01\0\0\0\0\x03\0\x48\x08\0\0\0\0\0\0\
 +\0\0\0\0\0\0\0\0\x53\x01\0\0\0\0\x03\0\xb8\x08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x1a\
 +\x01\0\0\0\0\x03\0\xe0\x08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x84\x01\0\0\0\0\x03\0\
 +\xb8\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x1e\x02\0\0\0\0\x03\0\xd8\x09\0\0\0\0\0\0\0\
 +\0\0\0\0\0\0\0\xc4\x01\0\0\0\0\x03\0\x70\x08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x93\
 +\x01\0\0\0\0\x03\0\xa8\x08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x74\x01\0\0\0\0\x03\0\
 +\xf0\x0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x4b\x01\0\0\0\0\x03\0\0\x0a\0\0\0\0\0\0\0\
 +\0\0\0\0\0\0\0\x12\x01\0\0\0\0\x03\0\x10\x0a\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xfa\0\
 +\0\0\0\0\x03\0\xc0\x0a\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x58\x02\0\0\0\0\x03\0\x88\
 +\x0a\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x16\x02\0\0\0\0\x03\0\xb8\x0a\0\0\0\0\0\0\0\0\
 +\0\0\0\0\0\0\xe5\x01\0\0\0\0\x03\0\xc0\x0f\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xbc\x01\
 +\0\0\0\0\x03\0\0\x0e\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x8b\x01\0\0\0\0\x03\0\x18\x0e\
 +\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xd1\0\0\0\0\0\x03\0\0\x04\0\0\0\0\0\0\0\0\0\0\0\0\
 +\0\0\x50\x02\0\0\0\0\x03\0\x20\x04\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x0e\x02\0\0\0\0\
 +\x03\0\x48\x0f\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x6c\x01\0\0\0\0\x03\0\xb0\x04\0\0\0\
 +\0\0\0\0\0\0\0\0\0\0\0\x43\x01\0\0\0\0\x03\0\xc8\x0c\0\0\0\0\0\0\0\0\0\0\0\0\0\
 +\0\xc9\0\0\0\0\0\x03\0\xf8\x0c\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x06\x02\0\0\0\0\x03\
 +\0\xd0\x0a\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x3b\x01\0\0\0\0\x03\0\x98\x0b\0\0\0\0\0\
 +\0\0\0\0\0\0\0\0\0\xf2\0\0\0\0\0\x03\0\xb8\x0b\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x48\
 +\x02\0\0\0\0\x03\0\xf0\x0b\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xfe\x01\0\0\0\0\x03\0\
 +\xf8\x0b\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xdd\x01\0\0\0\0\x03\0\0\x0c\0\0\0\0\0\0\0\
 +\0\0\0\0\0\0\0\xb4\x01\0\0\0\0\x03\0\x30\x0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x0a\
 +\x01\0\0\0\0\x03\0\x90\x0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xc1\0\0\0\0\0\x03\0\xa8\
 +\x0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xba\0\0\0\0\0\x03\0\xd0\x01\0\0\0\0\0\0\0\0\0\
 +\0\0\0\0\0\xf6\x01\0\0\0\0\x03\0\xe0\x0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xac\x01\0\
 +\0\0\0\x03\0\x30\x0e\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x33\x01\0\0\0\0\x03\0\x80\x0e\
 +\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xea\0\0\0\0\0\x03\0\x98\x0e\0\0\0\0\0\0\0\0\0\0\0\
 +\0\0\0\0\0\0\0\x03\0\x03\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x6b\0\0\0\x11\0\x06\
 +\0\0\0\0\0\0\0\0\0\x07\0\0\0\0\0\0\0\x25\0\0\0\x11\0\x05\0\0\0\0\0\0\0\0\0\x14\
 +\0\0\0\0\0\0\0\x82\0\0\0\x11\0\x05\0\x28\0\0\0\0\0\0\0\x14\0\0\0\0\0\0\0\x01\0\
 +\0\0\x11\0\x05\0\x14\0\0\0\0\0\0\0\x14\0\0\0\0\0\0\0\x40\0\0\0\x12\0\x03\0\0\0\
 +\0\0\0\0\0\0\xd8\x13\0\0\0\0\0\0\x28\0\0\0\0\0\0\0\x01\0\0\0\x3a\0\0\0\x50\0\0\
 +\0\0\0\0\0\x01\0\0\0\x3c\0\0\0\x80\x13\0\0\0\0\0\0\x01\0\0\0\x3b\0\0\0\x1c\0\0\
 +\0\0\0\0\0\x01\0\0\0\x38\0\0\0\0\x74\x61\x70\x5f\x72\x73\x73\x5f\x6d\x61\x70\
 +\x5f\x74\x6f\x65\x70\x6c\x69\x74\x7a\x5f\x6b\x65\x79\0\x2e\x74\x65\x78\x74\0\
 +\x6d\x61\x70\x73\0\x74\x61\x70\x5f\x72\x73\x73\x5f\x6d\x61\x70\x5f\x63\x6f\x6e\
 +\x66\x69\x67\x75\x72\x61\x74\x69\x6f\x6e\x73\0\x74\x75\x6e\x5f\x72\x73\x73\x5f\
 +\x73\x74\x65\x65\x72\x69\x6e\x67\x5f\x70\x72\x6f\x67\0\x2e\x72\x65\x6c\x74\x75\
 +\x6e\x5f\x72\x73\x73\x5f\x73\x74\x65\x65\x72\x69\x6e\x67\0\x5f\x6c\x69\x63\x65\
 +\x6e\x73\x65\0\x2e\x72\x65\x6c\x2e\x65\x68\x5f\x66\x72\x61\x6d\x65\0\x74\x61\
 +\x70\x5f\x72\x73\x73\x5f\x6d\x61\x70\x5f\x69\x6e\x64\x69\x72\x65\x63\x74\x69\
 +\x6f\x6e\x5f\x74\x61\x62\x6c\x65\0\x72\x73\x73\x2e\x62\x70\x66\x2e\x63\0\x2e\
 +\x73\x74\x72\x74\x61\x62\0\x2e\x73\x79\x6d\x74\x61\x62\0\x4c\x42\x42\x30\x5f\
 +\x39\0\x4c\x42\x42\x30\x5f\x38\x39\0\x4c\x42\x42\x30\x5f\x36\x39\0\x4c\x42\x42\
 +\x30\x5f\x35\x39\0\x4c\x42\x42\x30\x5f\x31\x39\0\x4c\x42\x42\x30\x5f\x31\x30\
 +\x39\0\x4c\x42\x42\x30\x5f\x39\x38\0\x4c\x42\x42\x30\x5f\x37\x38\0\x4c\x42\x42\
 +\x30\x5f\x34\x38\0\x4c\x42\x42\x30\x5f\x31\x38\0\x4c\x42\x42\x30\x5f\x38\x37\0\
 +\x4c\x42\x42\x30\x5f\x34\x37\0\x4c\x42\x42\x30\x5f\x33\x37\0\x4c\x42\x42\x30\
 +\x5f\x31\x37\0\x4c\x42\x42\x30\x5f\x31\x30\x37\0\x4c\x42\x42\x30\x5f\x39\x36\0\
 +\x4c\x42\x42\x30\x5f\x37\x36\0\x4c\x42\x42\x30\x5f\x36\x36\0\x4c\x42\x42\x30\
 +\x5f\x34\x36\0\x4c\x42\x42\x30\x5f\x33\x36\0\x4c\x42\x42\x30\x5f\x32\x36\0\x4c\
 +\x42\x42\x30\x5f\x31\x30\x36\0\x4c\x42\x42\x30\x5f\x36\x35\0\x4c\x42\x42\x30\
 +\x5f\x34\x35\0\x4c\x42\x42\x30\x5f\x33\x35\0\x4c\x42\x42\x30\x5f\x34\0\x4c\x42\
 +\x42\x30\x5f\x35\x34\0\x4c\x42\x42\x30\x5f\x34\x34\0\x4c\x42\x42\x30\x5f\x32\
 +\x34\0\x4c\x42\x42\x30\x5f\x31\x30\x34\0\x4c\x42\x42\x30\x5f\x39\x33\0\x4c\x42\
 +\x42\x30\x5f\x38\x33\0\x4c\x42\x42\x30\x5f\x35\x33\0\x4c\x42\x42\x30\x5f\x34\
 +\x33\0\x4c\x42\x42\x30\x5f\x32\x33\0\x4c\x42\x42\x30\x5f\x31\x30\x33\0\x4c\x42\
 +\x42\x30\x5f\x38\x32\0\x4c\x42\x42\x30\x5f\x35\x32\0\x4c\x42\x42\x30\x5f\x31\
 +\x30\x32\0\x4c\x42\x42\x30\x5f\x39\x31\0\x4c\x42\x42\x30\x5f\x38\x31\0\x4c\x42\
 +\x42\x30\x5f\x37\x31\0\x4c\x42\x42\x30\x5f\x36\x31\0\x4c\x42\x42\x30\x5f\x35\
 +\x31\0\x4c\x42\x42\x30\x5f\x34\x31\0\x4c\x42\x42\x30\x5f\x32\x31\0\x4c\x42\x42\
 +\x30\x5f\x31\x31\0\x4c\x42\x42\x30\x5f\x31\x31\x31\0\x4c\x42\x42\x30\x5f\x31\
 +\x30\x31\0\x4c\x42\x42\x30\x5f\x38\x30\0\x4c\x42\x42\x30\x5f\x36\x30\0\x4c\x42\
 +\x42\x30\x5f\x35\x30\0\x4c\x42\x42\x30\x5f\x31\x30\0\x4c\x42\x42\x30\x5f\x31\
 +\x31\x30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
 +\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xaa\
 +\0\0\0\x03\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xa0\x1a\0\0\0\0\0\0\x71\x02\0\
 +\0\0\0\0\0\0\0\0\0\0\0\0\0\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x1a\0\0\0\x01\0\0\
 +\0\x06\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x40\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
 +\0\0\0\0\x04\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x5a\0\0\0\x01\0\0\0\x06\0\0\0\0\0\0\
 +\0\0\0\0\0\0\0\0\0\x40\0\0\0\0\0\0\0\xd8\x13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x08\0\
 +\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x56\0\0\0\x09\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
 +\0\x60\x1a\0\0\0\0\0\0\x30\0\0\0\0\0\0\0\x09\0\0\0\x03\0\0\0\x08\0\0\0\0\0\0\0\
 +\x10\0\0\0\0\0\0\0\x20\0\0\0\x01\0\0\0\x03\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x18\
 +\x14\0\0\0\0\0\0\x3c\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x04\0\0\0\0\0\0\0\0\0\0\0\0\
 +\0\0\0\x6c\0\0\0\x01\0\0\0\x03\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x54\x14\0\0\0\0\0\
 +\0\x07\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x78\0\0\
 +\0\x01\0\0\0\x02\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x60\x14\0\0\0\0\0\0\x30\0\0\0\0\
 +\0\0\0\0\0\0\0\0\0\0\0\x08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x74\0\0\0\x09\0\0\0\0\
 +\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x90\x1a\0\0\0\0\0\0\x10\0\0\0\0\0\0\0\x09\0\0\0\
 +\x07\0\0\0\x08\0\0\0\0\0\0\0\x10\0\0\0\0\0\0\0\xb2\0\0\0\x02\0\0\0\0\0\0\0\0\0\
 +\0\0\0\0\0\0\0\0\0\0\x90\x14\0\0\0\0\0\0\xd0\x05\0\0\0\0\0\0\x01\0\0\0\x39\0\0\
 +\0\x08\0\0\0\0\0\0\0\x18\0\0\0\0\0\0\0";
 +
 +    return 0;
 +err:
 +    bpf_object__destroy_skeleton(s);
 +    return -1;
 +}
 +
 +#endif /* __RSS_BPF_SKEL_H__ */
 diff --git a/ebpf/trace-events b/ebpf/trace-events
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/ebpf/trace-events
@@ -XXX,XX +XXX,XX @@
 +# See docs/devel/tracing.txt for syntax documentation.
 +
 +# ebpf-rss.c
 +ebpf_error(const char *s1, const char *s2) "error in %s: %s"
 diff --git a/ebpf/trace.h b/ebpf/trace.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/ebpf/trace.h
@@ -0,0 +1 @@
 +#include "trace/trace-ebpf.h"
 diff --git a/meson.build b/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/meson.build
+--- a/include/hw/virtio/virtio.h
-+++ b/meson.build
++++ b/include/hw/virtio/virtio.h
-@@ -XXX,XX +XXX,XX @@ if not get_option('fuse_lseek').disabled()
+@@ -XXX,XX +XXX,XX @@ typedef struct VirtioDeviceClass {
-   endif
+      */
- endif
+     void (*save)(VirtIODevice *vdev, QEMUFile *f);
+     int (*load)(VirtIODevice *vdev, QEMUFile *f, int version_id);
-+# libbpf
++    /* Post load hook in vmsd is called early while device is processed, and
-+libbpf = dependency('libbpf', required: get_option('bpf'), method: 'pkg-config')
++     * when VirtIODevice isn't fully initialized.  Devices should use this instead,
-+if libbpf.found() and not cc.links('''
++     * unless they specifically want to verify the migration stream as it's
-+   #include <bpf/libbpf.h>
++     * processed, e.g. for bounds checking.
-+   int main(void)
++     */
-+   {
++    int (*post_load)(VirtIODevice *vdev);
-+     bpf_object__destroy_skeleton(NULL);
+     const VMStateDescription *vmsd;
-+     return 0;
+ } VirtioDeviceClass;
-+   }''', dependencies: libbpf)
 +  libbpf = not_found
 +  if get_option('bpf').enabled()
 +    error('libbpf skeleton test failed')
 +  else
 +    warning('libbpf skeleton test failed, disabling')
 +  endif
 +endif
 +
  if get_option('cfi')
    cfi_flags=[]
    # Check for dependency on LTO
@@ -XXX,XX +XXX,XX @@ endif
  config_host_data.set('CONFIG_GTK', gtk.found())
  config_host_data.set('CONFIG_LIBATTR', have_old_libattr)
  config_host_data.set('CONFIG_LIBCAP_NG', libcap_ng.found())
 +config_host_data.set('CONFIG_EBPF', libbpf.found())
  config_host_data.set('CONFIG_LIBISCSI', libiscsi.found())
  config_host_data.set('CONFIG_LIBNFS', libnfs.found())
  config_host_data.set('CONFIG_RBD', rbd.found())
@@ -XXX,XX +XXX,XX @@ if have_system
      'backends',
      'backends/tpm',
      'chardev',
 +    'ebpf',
      'hw/9pfs',
      'hw/acpi',
      'hw/adc',
@@ -XXX,XX +XXX,XX @@ subdir('accel')
  subdir('plugins')
  subdir('bsd-user')
  subdir('linux-user')
 +subdir('ebpf')
 +
 +common_ss.add(libbpf)
  bsd_user_ss.add(files('gdbstub.c'))
  specific_ss.add_all(when: 'CONFIG_BSD_USER', if_true: bsd_user_ss)
@@ -XXX,XX +XXX,XX @@ summary_info += {'RDMA support':      config_host.has_key('CONFIG_RDMA')}
  summary_info += {'PVRDMA support':    config_host.has_key('CONFIG_PVRDMA')}
  summary_info += {'fdt support':       fdt_opt == 'disabled' ? false : fdt_opt}
  summary_info += {'libcap-ng support': libcap_ng.found()}
 +summary_info += {'bpf support': libbpf.found()}
  # TODO: add back protocol and server version
  summary_info += {'spice support':     config_host.has_key('CONFIG_SPICE')}
  summary_info += {'rbd support':       rbd.found()}
 diff --git a/meson_options.txt b/meson_options.txt
 index XXXXXXX..XXXXXXX 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
@@ -XXX,XX +XXX,XX @@ option('bzip2', type : 'feature', value : 'auto',
         description: 'bzip2 support for DMG images')
  option('cap_ng', type : 'feature', value : 'auto',
         description: 'cap_ng support')
 +option('bpf', type : 'feature', value : 'auto',
 +        description: 'eBPF support')
  option('cocoa', type : 'feature', value : 'auto',
         description: 'Cocoa user interface (macOS only)')
  option('curl', type : 'feature', value : 'auto',
 --
-.7.4
+.5.0

-[PULL 5/7] virtio-net: Added eBPF RSS to virtio-net.
+[PULL V2 3/4] virtio-net: prevent offloads reset on migration
-From: Andrew Melnychenko <andrew@daynix.com>
+From: Mikhail Sennikovsky <mikhail.sennikovskii@cloud.ionos.com>
-When RSS is enabled the device tries to load the eBPF program
+Currently offloads disabled by guest via the VIRTIO_NET_CTRL_GUEST_OFFLOADS_SET
-to select RX virtqueue in the TUN. If eBPF can be loaded
+command are not preserved on VM migration.
-the RSS will function also with vhost (works with kernel 5.8 and later).
+Instead all offloads reported by guest features (via VIRTIO_PCI_GUEST_FEATURES)
-Software RSS is used as a fallback with vhost=off when eBPF can't be loaded
+get enabled.
-or when hash population requested by the guest.
+What happens is: first the VirtIONet::curr_guest_offloads gets restored and offloads
 are getting set correctly:
-Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
+ #0  qemu_set_offload (nc=0x555556a11400, csum=1, tso4=0, tso6=0, ecn=0, ufo=0) at net/net.c:474
-Signed-off-by: Andrew Melnychenko <andrew@daynix.com>
+ #1  virtio_net_apply_guest_offloads (n=0x555557701ca0) at hw/net/virtio-net.c:720
  #2  virtio_net_post_load_device (opaque=0x555557701ca0, version_id=11) at hw/net/virtio-net.c:2334
  #3  vmstate_load_state (f=0x5555569dc010, vmsd=0x555556577c80 <vmstate_virtio_net_device>, opaque=0x555557701ca0, version_id=11)
      at migration/vmstate.c:168
  #4  virtio_load (vdev=0x555557701ca0, f=0x5555569dc010, version_id=11) at hw/virtio/virtio.c:2197
  #5  virtio_device_get (f=0x5555569dc010, opaque=0x555557701ca0, size=0, field=0x55555668cd00 <__compound_literal.5>) at hw/virtio/virtio.c:2036
  #6  vmstate_load_state (f=0x5555569dc010, vmsd=0x555556577ce0 <vmstate_virtio_net>, opaque=0x555557701ca0, version_id=11) at migration/vmstate.c:143
  #7  vmstate_load (f=0x5555569dc010, se=0x5555578189e0) at migration/savevm.c:829
  #8  qemu_loadvm_section_start_full (f=0x5555569dc010, mis=0x5555569eee20) at migration/savevm.c:2211
  #9  qemu_loadvm_state_main (f=0x5555569dc010, mis=0x5555569eee20) at migration/savevm.c:2395
  #10 qemu_loadvm_state (f=0x5555569dc010) at migration/savevm.c:2467
  #11 process_incoming_migration_co (opaque=0x0) at migration/migration.c:449
 However later on the features are getting restored, and offloads get reset to
 everything supported by features:
  #0  qemu_set_offload (nc=0x555556a11400, csum=1, tso4=1, tso6=1, ecn=0, ufo=0) at net/net.c:474
  #1  virtio_net_apply_guest_offloads (n=0x555557701ca0) at hw/net/virtio-net.c:720
  #2  virtio_net_set_features (vdev=0x555557701ca0, features=5104441767) at hw/net/virtio-net.c:773
  #3  virtio_set_features_nocheck (vdev=0x555557701ca0, val=5104441767) at hw/virtio/virtio.c:2052
  #4  virtio_load (vdev=0x555557701ca0, f=0x5555569dc010, version_id=11) at hw/virtio/virtio.c:2220
  #5  virtio_device_get (f=0x5555569dc010, opaque=0x555557701ca0, size=0, field=0x55555668cd00 <__compound_literal.5>) at hw/virtio/virtio.c:2036
  #6  vmstate_load_state (f=0x5555569dc010, vmsd=0x555556577ce0 <vmstate_virtio_net>, opaque=0x555557701ca0, version_id=11) at migration/vmstate.c:143
  #7  vmstate_load (f=0x5555569dc010, se=0x5555578189e0) at migration/savevm.c:829
  #8  qemu_loadvm_section_start_full (f=0x5555569dc010, mis=0x5555569eee20) at migration/savevm.c:2211
  #9  qemu_loadvm_state_main (f=0x5555569dc010, mis=0x5555569eee20) at migration/savevm.c:2395
  #10 qemu_loadvm_state (f=0x5555569dc010) at migration/savevm.c:2467
  #11 process_incoming_migration_co (opaque=0x0) at migration/migration.c:449
 Fix this by preserving the state in saved_guest_offloads field and
 pushing out offload initialization to the new post load hook.
 Cc: qemu-stable@nongnu.org
 Signed-off-by: Mikhail Sennikovsky <mikhail.sennikovskii@cloud.ionos.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- hw/net/vhost_net.c             |   3 ++
+ hw/net/virtio-net.c            | 27 ++++++++++++++++++++++++---
- hw/net/virtio-net.c            | 116 +++++++++++++++++++++++++++++++++++++++--
+ include/hw/virtio/virtio-net.h |  2 ++
- include/hw/virtio/virtio-net.h |   4 ++
+files changed, 26 insertions(+), 3 deletions(-)
  net/vhost-vdpa.c               |   2 +
 files changed, 122 insertions(+), 3 deletions(-)
-diff --git a/hw/net/vhost_net.c b/hw/net/vhost_net.c
-index XXXXXXX..XXXXXXX 100644
---- a/hw/net/vhost_net.c
-+++ b/hw/net/vhost_net.c
-@@ -XXX,XX +XXX,XX @@ static const int kernel_feature_bits[] = {
-     VIRTIO_NET_F_MTU,
-     VIRTIO_F_IOMMU_PLATFORM,
-     VIRTIO_F_RING_PACKED,
-+    VIRTIO_NET_F_HASH_REPORT,
-     VHOST_INVALID_FEATURE_BIT
- };
-@@ -XXX,XX +XXX,XX @@ static const int user_feature_bits[] = {
-     VIRTIO_NET_F_MTU,
-     VIRTIO_F_IOMMU_PLATFORM,
-     VIRTIO_F_RING_PACKED,
-+    VIRTIO_NET_F_RSS,
-+    VIRTIO_NET_F_HASH_REPORT,
-     /* This bit implies RARP isn't sent by QEMU out of band */
-     VIRTIO_NET_F_GUEST_ANNOUNCE,
 diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
 index XXXXXXX..XXXXXXX 100644
 --- a/hw/net/virtio-net.c
 +++ b/hw/net/virtio-net.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t virtio_net_get_features(VirtIODevice *vdev, uint64_t features,
+@@ -XXX,XX +XXX,XX @@ static int virtio_net_post_load_device(void *opaque, int version_id)
-         return features;
+         n->curr_guest_offloads = virtio_net_supported_guest_offloads(n);
      }
--    virtio_clear_feature(&features, VIRTIO_NET_F_RSS);
+-    if (peer_has_vnet_hdr(n)) {
--    virtio_clear_feature(&features, VIRTIO_NET_F_HASH_REPORT);
+-        virtio_net_apply_guest_offloads(n);
-+    if (!ebpf_rss_is_loaded(&n->ebpf_rss)) {
+-    }
-+        virtio_clear_feature(&features, VIRTIO_NET_F_RSS);
++    /*
 +     * curr_guest_offloads will be later overwritten by the
 +     * virtio_set_features_nocheck call done from the virtio_load.
 +     * Here we make sure it is preserved and restored accordingly
 +     * in the virtio_net_post_load_virtio callback.
 +     */
 +    n->saved_guest_offloads = n->curr_guest_offloads;
      virtio_net_set_queues(n);
@@ -XXX,XX +XXX,XX @@ static int virtio_net_post_load_device(void *opaque, int version_id)
      return 0;
  }
 +static int virtio_net_post_load_virtio(VirtIODevice *vdev)
 +{
 +    VirtIONet *n = VIRTIO_NET(vdev);
 +    /*
 +     * The actual needed state is now in saved_guest_offloads,
 +     * see virtio_net_post_load_device for detail.
 +     * Restore it back and apply the desired offloads.
 +     */
 +    n->curr_guest_offloads = n->saved_guest_offloads;
 +    if (peer_has_vnet_hdr(n)) {
 +        virtio_net_apply_guest_offloads(n);
 +    }
-     features = vhost_net_get_features(get_vhost_net(nc->peer), features);
-     vdev->backend_features = features;
-@@ -XXX,XX +XXX,XX @@ static int virtio_net_handle_announce(VirtIONet *n, uint8_t cmd,
-     }
- }
-+static void virtio_net_detach_epbf_rss(VirtIONet *n);
 +
- static void virtio_net_disable_rss(VirtIONet *n)
++    return 0;
  {
      if (n->rss_data.enabled) {
          trace_virtio_net_rss_disable();
      }
      n->rss_data.enabled = false;
 +
 +    virtio_net_detach_epbf_rss(n);
 +}
 +
-+static bool virtio_net_attach_ebpf_to_backend(NICState *nic, int prog_fd)
+ /* tx_waiting field of a VirtIONetQueue */
-+{
+ static const VMStateDescription vmstate_virtio_net_queue_tx_waiting = {
-+    NetClientState *nc = qemu_get_peer(qemu_get_queue(nic), 0);
+     .name = "virtio-net-queue-tx_waiting",
-+    if (nc == NULL || nc->info->set_steering_ebpf == NULL) {
+@@ -XXX,XX +XXX,XX @@ static void virtio_net_class_init(ObjectClass *klass, void *data)
-+        return false;
+     vdc->guest_notifier_mask = virtio_net_guest_notifier_mask;
-+    }
+     vdc->guest_notifier_pending = virtio_net_guest_notifier_pending;
-+
+     vdc->legacy_features |= (0x1 << VIRTIO_NET_F_GSO);
-+    return nc->info->set_steering_ebpf(nc, prog_fd);
++    vdc->post_load = virtio_net_post_load_virtio;
-+}
+     vdc->vmsd = &vmstate_virtio_net_device;
 +
 +static void rss_data_to_rss_config(struct VirtioNetRssData *data,
 +                                   struct EBPFRSSConfig *config)
 +{
 +    config->redirect = data->redirect;
 +    config->populate_hash = data->populate_hash;
 +    config->hash_types = data->hash_types;
 +    config->indirections_len = data->indirections_len;
 +    config->default_queue = data->default_queue;
 +}
 +
 +static bool virtio_net_attach_epbf_rss(VirtIONet *n)
 +{
 +    struct EBPFRSSConfig config = {};
 +
 +    if (!ebpf_rss_is_loaded(&n->ebpf_rss)) {
 +        return false;
 +    }
 +
 +    rss_data_to_rss_config(&n->rss_data, &config);
 +
 +    if (!ebpf_rss_set_all(&n->ebpf_rss, &config,
 +                          n->rss_data.indirections_table, n->rss_data.key)) {
 +        return false;
 +    }
 +
 +    if (!virtio_net_attach_ebpf_to_backend(n->nic, n->ebpf_rss.program_fd)) {
 +        return false;
 +    }
 +
 +    return true;
 +}
 +
 +static void virtio_net_detach_epbf_rss(VirtIONet *n)
 +{
 +    virtio_net_attach_ebpf_to_backend(n->nic, -1);
 +}
 +
 +static bool virtio_net_load_ebpf(VirtIONet *n)
 +{
 +    if (!virtio_net_attach_ebpf_to_backend(n->nic, -1)) {
 +        /* backend does't support steering ebpf */
 +        return false;
 +    }
 +
 +    return ebpf_rss_load(&n->ebpf_rss);
 +}
 +
 +static void virtio_net_unload_ebpf(VirtIONet *n)
 +{
 +    virtio_net_attach_ebpf_to_backend(n->nic, -1);
 +    ebpf_rss_unload(&n->ebpf_rss);
  }
- static uint16_t virtio_net_handle_rss(VirtIONet *n,
-@@ -XXX,XX +XXX,XX @@ static uint16_t virtio_net_handle_rss(VirtIONet *n,
-         goto error;
-     }
-     n->rss_data.enabled = true;
-+
-+    if (!n->rss_data.populate_hash) {
-+        if (!virtio_net_attach_epbf_rss(n)) {
-+            /* EBPF must be loaded for vhost */
-+            if (get_vhost_net(qemu_get_queue(n->nic)->peer)) {
-+                warn_report("Can't load eBPF RSS for vhost");
-+                goto error;
-+            }
-+            /* fallback to software RSS */
-+            warn_report("Can't load eBPF RSS - fallback to software RSS");
-+            n->rss_data.enabled_software_rss = true;
-+        }
-+    } else {
-+        /* use software RSS for hash populating */
-+        /* and detach eBPF if was loaded before */
-+        virtio_net_detach_epbf_rss(n);
-+        n->rss_data.enabled_software_rss = true;
-+    }
-+
-     trace_virtio_net_rss_enable(n->rss_data.hash_types,
-                                 n->rss_data.indirections_len,
-                                 temp.b);
-@@ -XXX,XX +XXX,XX @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
-         return -1;
-     }
--    if (!no_rss && n->rss_data.enabled) {
-+    if (!no_rss && n->rss_data.enabled && n->rss_data.enabled_software_rss) {
-         int index = virtio_net_process_rss(nc, buf, size);
-         if (index >= 0) {
-             NetClientState *nc2 = qemu_get_subqueue(n->nic, index);
-@@ -XXX,XX +XXX,XX @@ static int virtio_net_post_load_device(void *opaque, int version_id)
-     }
-     if (n->rss_data.enabled) {
-+        n->rss_data.enabled_software_rss = n->rss_data.populate_hash;
-+        if (!n->rss_data.populate_hash) {
-+            if (!virtio_net_attach_epbf_rss(n)) {
-+                if (get_vhost_net(qemu_get_queue(n->nic)->peer)) {
-+                    warn_report("Can't post-load eBPF RSS for vhost");
-+                } else {
-+                    warn_report("Can't post-load eBPF RSS - "
-+                                "fallback to software RSS");
-+                    n->rss_data.enabled_software_rss = true;
-+                }
-+            }
-+        }
-+
-         trace_virtio_net_rss_enable(n->rss_data.hash_types,
-                                     n->rss_data.indirections_len,
-                                     sizeof(n->rss_data.key));
-@@ -XXX,XX +XXX,XX @@ static void virtio_net_device_realize(DeviceState *dev, Error **errp)
-     n->qdev = dev;
-     net_rx_pkt_init(&n->rx_pkt, false);
-+
-+    if (virtio_has_feature(n->host_features, VIRTIO_NET_F_RSS)) {
-+        virtio_net_load_ebpf(n);
-+    }
- }
- static void virtio_net_device_unrealize(DeviceState *dev)
-@@ -XXX,XX +XXX,XX @@ static void virtio_net_device_unrealize(DeviceState *dev)
-     VirtIONet *n = VIRTIO_NET(dev);
-     int i, max_queues;
-+    if (virtio_has_feature(n->host_features, VIRTIO_NET_F_RSS)) {
-+        virtio_net_unload_ebpf(n);
-+    }
-+
-     /* This will stop vhost backend if appropriate. */
-     virtio_net_set_status(vdev, 0);
-@@ -XXX,XX +XXX,XX @@ static void virtio_net_instance_init(Object *obj)
-     device_add_bootindex_property(obj, &n->nic_conf.bootindex,
-                                   "bootindex", "/ethernet-phy@0",
-                                   DEVICE(n));
-+
-+    ebpf_rss_init(&n->ebpf_rss);
- }
- static int virtio_net_pre_save(void *opaque)
 diff --git a/include/hw/virtio/virtio-net.h b/include/hw/virtio/virtio-net.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/virtio/virtio-net.h
 +++ b/include/hw/virtio/virtio-net.h
-@@ -XXX,XX +XXX,XX @@
- #include "qemu/option_int.h"
- #include "qom/object.h"
-+#include "ebpf/ebpf_rss.h"
-+
- #define TYPE_VIRTIO_NET "virtio-net-device"
- OBJECT_DECLARE_SIMPLE_TYPE(VirtIONet, VIRTIO_NET)
-@@ -XXX,XX +XXX,XX @@ typedef struct VirtioNetRscChain {
- typedef struct VirtioNetRssData {
-     bool    enabled;
-+    bool    enabled_software_rss;
-     bool    redirect;
-     bool    populate_hash;
-     uint32_t hash_types;
 @@ -XXX,XX +XXX,XX @@ struct VirtIONet {
-     Notifier migration_state;
+     char *netclient_name;
-     VirtioNetRssData rss_data;
+     char *netclient_type;
-     struct NetRxPkt *rx_pkt;
+     uint64_t curr_guest_offloads;
-+    struct EBPFRSSContext ebpf_rss;
++    /* used on saved state restore phase to preserve the curr_guest_offloads */
- };
++    uint64_t saved_guest_offloads;
+     AnnounceTimer announce_timer;
- void virtio_net_set_netclient_name(VirtIONet *n, const char *name,
+     bool needs_vnet_hdr_swap;
-diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
+     bool mtu_bypass_backend;
 index XXXXXXX..XXXXXXX 100644
 --- a/net/vhost-vdpa.c
 +++ b/net/vhost-vdpa.c
@@ -XXX,XX +XXX,XX @@ const int vdpa_feature_bits[] = {
      VIRTIO_NET_F_MTU,
      VIRTIO_F_IOMMU_PLATFORM,
      VIRTIO_F_RING_PACKED,
 +    VIRTIO_NET_F_RSS,
 +    VIRTIO_NET_F_HASH_REPORT,
      VIRTIO_NET_F_GUEST_ANNOUNCE,
      VIRTIO_NET_F_STATUS,
      VHOST_INVALID_FEATURE_BIT
 --
-.7.4
+.5.0

-[PULL 6/7] docs: Added eBPF documentation.
+Deleted patch
-From: Andrew Melnychenko <andrew@daynix.com>
-Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
-Signed-off-by: Andrew Melnychenko <andrew@daynix.com>
-Signed-off-by: Jason Wang <jasowang@redhat.com>
----
- docs/devel/ebpf_rss.rst | 125 ++++++++++++++++++++++++++++++++++++++++++++++++
- docs/devel/index.rst    |   1 +
-files changed, 126 insertions(+)
- create mode 100644 docs/devel/ebpf_rss.rst
-diff --git a/docs/devel/ebpf_rss.rst b/docs/devel/ebpf_rss.rst
-new file mode 100644
-index XXXXXXX..XXXXXXX
---- /dev/null
-+++ b/docs/devel/ebpf_rss.rst
-@@ -XXX,XX +XXX,XX @@
-+===========================
-+eBPF RSS virtio-net support
-+===========================
-+
-+RSS(Receive Side Scaling) is used to distribute network packets to guest virtqueues
-+by calculating packet hash. Usually every queue is processed then by a specific guest CPU core.
-+
-+For now there are 2 RSS implementations in qemu:
-+- 'in-qemu' RSS (functions if qemu receives network packets, i.e. vhost=off)
-+- eBPF RSS (can function with also with vhost=on)
-+
-+eBPF support (CONFIG_EBPF) is enabled by 'configure' script.
-+To enable eBPF RSS support use './configure --enable-bpf'.
-+
-+If steering BPF is not set for kernel's TUN module, the TUN uses automatic selection
-+of rx virtqueue based on lookup table built according to calculated symmetric hash
-+of transmitted packets.
-+If steering BPF is set for TUN the BPF code calculates the hash of packet header and
-+returns the virtqueue number to place the packet to.
-+
-+Simplified decision formula:
-+
-+.. code:: C
-+
-+    queue_index = indirection_table[hash(<packet data>)%<indirection_table size>]
-+
-+
-+Not for all packets, the hash can/should be calculated.
-+
-+Note: currently, eBPF RSS does not support hash reporting.
-+
-+eBPF RSS turned on by different combinations of vhost-net, vitrio-net and tap configurations:
-+
-+- eBPF is used:
-+
-+        tap,vhost=off & virtio-net-pci,rss=on,hash=off
-+
-+- eBPF is used:
-+
-+        tap,vhost=on & virtio-net-pci,rss=on,hash=off
-+
-+- 'in-qemu' RSS is used:
-+
-+        tap,vhost=off & virtio-net-pci,rss=on,hash=on
-+
-+- eBPF is used, hash population feature is not reported to the guest:
-+
-+        tap,vhost=on & virtio-net-pci,rss=on,hash=on
-+
-+If CONFIG_EBPF is not set then only 'in-qemu' RSS is supported.
-+Also 'in-qemu' RSS, as a fallback, is used if the eBPF program failed to load or set to TUN.
-+
-+RSS eBPF program
-+----------------
-+
-+RSS program located in ebpf/rss.bpf.skeleton.h generated by bpftool.
-+So the program is part of the qemu binary.
-+Initially, the eBPF program was compiled by clang and source code located at tools/ebpf/rss.bpf.c.
-+Prerequisites to recompile the eBPF program (regenerate ebpf/rss.bpf.skeleton.h):
-+
-+        llvm, clang, kernel source tree, bpftool
-+        Adjust Makefile.ebpf to reflect the location of the kernel source tree
-+
-+        $ cd tools/ebpf
-+        $ make -f Makefile.ebpf
-+
-+Current eBPF RSS implementation uses 'bounded loops' with 'backward jump instructions' which present in the last kernels.
-+Overall eBPF RSS works on kernels 5.8+.
-+
-+eBPF RSS implementation
-+-----------------------
-+
-+eBPF RSS loading functionality located in ebpf/ebpf_rss.c and ebpf/ebpf_rss.h.
-+
-+The `struct EBPFRSSContext` structure that holds 4 file descriptors:
-+
-+- ctx - pointer of the libbpf context.
-+- program_fd - file descriptor of the eBPF RSS program.
-+- map_configuration - file descriptor of the 'configuration' map. This map contains one element of 'struct EBPFRSSConfig'. This configuration determines eBPF program behavior.
-+- map_toeplitz_key - file descriptor of the 'Toeplitz key' map. One element of the 40byte key prepared for the hashing algorithm.
-+- map_indirections_table - 128 elements of queue indexes.
-+
-+`struct EBPFRSSConfig` fields:
-+
-+- redirect - "boolean" value, should the hash be calculated, on false  - `default_queue` would be used as the final decision.
-+- populate_hash - for now, not used. eBPF RSS doesn't support hash reporting.
-+- hash_types - binary mask of different hash types. See `VIRTIO_NET_RSS_HASH_TYPE_*` defines. If for packet hash should not be calculated - `default_queue` would be used.
-+- indirections_len - length of the indirections table, maximum 128.
-+- default_queue - the queue index that used for packet that shouldn't be hashed. For some packets, the hash can't be calculated(g.e ARP).
-+
-+Functions:
-+
-+- `ebpf_rss_init()` - sets ctx to NULL, which indicates that EBPFRSSContext is not loaded.
-+- `ebpf_rss_load()` - creates 3 maps and loads eBPF program from the rss.bpf.skeleton.h. Returns 'true' on success. After that, program_fd can be used to set steering for TAP.
-+- `ebpf_rss_set_all()` - sets values for eBPF maps. `indirections_table` length is in EBPFRSSConfig. `toeplitz_key` is VIRTIO_NET_RSS_MAX_KEY_SIZE aka 40 bytes array.
-+- `ebpf_rss_unload()` - close all file descriptors and set ctx to NULL.
-+
-+Simplified eBPF RSS workflow:
-+
-+.. code:: C
-+
-+    struct EBPFRSSConfig config;
-+    config.redirect = 1;
-+    config.hash_types = VIRTIO_NET_RSS_HASH_TYPE_UDPv4 | VIRTIO_NET_RSS_HASH_TYPE_TCPv4;
-+    config.indirections_len = VIRTIO_NET_RSS_MAX_TABLE_LEN;
-+    config.default_queue = 0;
-+
-+    uint16_t table[VIRTIO_NET_RSS_MAX_TABLE_LEN] = {...};
-+    uint8_t key[VIRTIO_NET_RSS_MAX_KEY_SIZE] = {...};
-+
-+    struct EBPFRSSContext ctx;
-+    ebpf_rss_init(&ctx);
-+    ebpf_rss_load(&ctx);
-+    ebpf_rss_set_all(&ctx, &config, table, key);
-+    if (net_client->info->set_steering_ebpf != NULL) {
-+        net_client->info->set_steering_ebpf(net_client, ctx->program_fd);
-+    }
-+    ...
-+    ebpf_unload(&ctx);
-+
-+
-+NetClientState SetSteeringEBPF()
-+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
-+
-+For now, `set_steering_ebpf()` method supported by Linux TAP NetClientState. The method requires an eBPF program file descriptor as an argument.
-diff --git a/docs/devel/index.rst b/docs/devel/index.rst
-index XXXXXXX..XXXXXXX 100644
---- a/docs/devel/index.rst
-+++ b/docs/devel/index.rst
-@@ -XXX,XX +XXX,XX @@ Contents:
-    qom
-    block-coroutine-wrapper
-    multi-process
-+   ebpf_rss
---
-.7.4

-[PULL 7/7] MAINTAINERS: Added eBPF maintainers information.
+[PULL V2 4/4] COLO-compare: Fix incorrect `if` logic
-From: Andrew Melnychenko <andrew@daynix.com>
+From: Fan Yang <Fan_Yang@sjtu.edu.cn>
-Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
+'colo_mark_tcp_pkt' should return 'true' when packets are the same, and
-Signed-off-by: Andrew Melnychenko <andrew@daynix.com>
+'false' otherwise.  However, it returns 'true' when
 'colo_compare_packet_payload' returns non-zero while
 'colo_compare_packet_payload' is just a 'memcmp'.  The result is that
 COLO-compare reports inconsistent TCP packets when they are actually
 the same.
 Fixes: f449c9e549c ("colo: compare the packet based on the tcp sequence number")
 Cc: qemu-stable@nongnu.org
 Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Signed-off-by: Fan Yang <Fan_Yang@sjtu.edu.cn>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- MAINTAINERS | 8 ++++++++
+ net/colo-compare.c | 6 +++---
-file changed, 8 insertions(+)
+file changed, 3 insertions(+), 3 deletions(-)
-diff --git a/MAINTAINERS b/MAINTAINERS
+diff --git a/net/colo-compare.c b/net/colo-compare.c
 index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
+--- a/net/colo-compare.c
-+++ b/MAINTAINERS
++++ b/net/colo-compare.c
-@@ -XXX,XX +XXX,XX @@ F: include/hw/remote/proxy-memory-listener.h
+@@ -XXX,XX +XXX,XX @@ static bool colo_mark_tcp_pkt(Packet *ppkt, Packet *spkt,
- F: hw/remote/iohub.c
+     *mark = 0;
- F: include/hw/remote/iohub.h
+     if (ppkt->tcp_seq == spkt->tcp_seq && ppkt->seq_end == spkt->seq_end) {
-+EBPF:
+-        if (colo_compare_packet_payload(ppkt, spkt,
-+M: Jason Wang <jasowang@redhat.com>
++        if (!colo_compare_packet_payload(ppkt, spkt,
-+R: Andrew Melnychenko <andrew@daynix.com>
+                                         ppkt->header_size, spkt->header_size,
-+R: Yuri Benditovich <yuri.benditovich@daynix.com>
+                                         ppkt->payload_size)) {
-+S: Maintained
+             *mark = COLO_COMPARE_FREE_SECONDARY | COLO_COMPARE_FREE_PRIMARY;
-+F: ebpf/*
+@@ -XXX,XX +XXX,XX @@ static bool colo_mark_tcp_pkt(Packet *ppkt, Packet *spkt,
-+F: tools/ebpf/*
-+
+     /* one part of secondary packet payload still need to be compared */
- Build and test automation
+     if (!after(ppkt->seq_end, spkt->seq_end)) {
- -------------------------
+-        if (colo_compare_packet_payload(ppkt, spkt,
- Build and test automation, general continuous integration
++        if (!colo_compare_packet_payload(ppkt, spkt,
                                          ppkt->header_size + ppkt->offset,
                                          spkt->header_size + spkt->offset,
                                          ppkt->payload_size - ppkt->offset)) {
@@ -XXX,XX +XXX,XX @@ static bool colo_mark_tcp_pkt(Packet *ppkt, Packet *spkt,
          /* primary packet is longer than secondary packet, compare
           * the same part and mark the primary packet offset
           */
 -        if (colo_compare_packet_payload(ppkt, spkt,
 +        if (!colo_compare_packet_payload(ppkt, spkt,
                                          ppkt->header_size + ppkt->offset,
                                          spkt->header_size + spkt->offset,
                                          spkt->payload_size - spkt->offset)) {
 --
-.7.4
+.5.0

The following changes since commit 92f8c6fef13b31ba222c4d20ad8afd2b79c4c28e:

Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20210525' into staging (2021-05-25 16:17:06 +0100)

are available in the git repository at:

https://github.com/jasowang/qemu.git tags/net-pull-request

for you to fetch changes up to 90322e646e87c1440661cb3ddbc0cc94309d8a4f:

MAINTAINERS: Added eBPF maintainers information. (2021-06-04 15:25:46 +0800)

----------------------------------------------------------------

----------------------------------------------------------------
Andrew Melnychenko (7):
      net/tap: Added TUNSETSTEERINGEBPF code.
      net: Added SetSteeringEBPF method for NetClientState.
      ebpf: Added eBPF RSS program.
      ebpf: Added eBPF RSS loader.
      virtio-net: Added eBPF RSS to virtio-net.
      docs: Added eBPF documentation.
      MAINTAINERS: Added eBPF maintainers information.

MAINTAINERS                    |   8 +
 configure                      |   8 +-
 docs/devel/ebpf_rss.rst        | 125 +++++++++
 docs/devel/index.rst           |   1 +
 ebpf/ebpf_rss-stub.c           |  40 +++
 ebpf/ebpf_rss.c                | 165 ++++++++++++
 ebpf/ebpf_rss.h                |  44 ++++
 ebpf/meson.build               |   1 +
 ebpf/rss.bpf.skeleton.h        | 431 +++++++++++++++++++++++++++++++
 ebpf/trace-events              |   4 +
 ebpf/trace.h                   |   1 +
 hw/net/vhost_net.c             |   3 +
 hw/net/virtio-net.c            | 116 ++++++++-
 include/hw/virtio/virtio-net.h |   4 +
 include/net/net.h              |   2 +
 meson.build                    |  23 ++
 meson_options.txt              |   2 +
 net/tap-bsd.c                  |   5 +
 net/tap-linux.c                |  13 +
 net/tap-linux.h                |   1 +
 net/tap-solaris.c              |   5 +
 net/tap-stub.c                 |   5 +
 net/tap.c                      |   9 +
 net/tap_int.h                  |   1 +
 net/vhost-vdpa.c               |   2 +
 tools/ebpf/Makefile.ebpf       |  21 ++
 tools/ebpf/rss.bpf.c           | 571 +++++++++++++++++++++++++++++++++++++++++
 27 files changed, 1607 insertions(+), 4 deletions(-)
 create mode 100644 docs/devel/ebpf_rss.rst
 create mode 100644 ebpf/ebpf_rss-stub.c
 create mode 100644 ebpf/ebpf_rss.c
 create mode 100644 ebpf/ebpf_rss.h
 create mode 100644 ebpf/meson.build
 create mode 100644 ebpf/rss.bpf.skeleton.h
 create mode 100644 ebpf/trace-events
 create mode 100644 ebpf/trace.h
 create mode 100755 tools/ebpf/Makefile.ebpf
 create mode 100644 tools/ebpf/rss.bpf.c

From: Andrew Melnychenko <andrew@daynix.com>

For now, that method supported only by Linux TAP.
Linux TAP uses TUNSETSTEERINGEBPF ioctl.

diff --git a/include/net/net.h b/include/net/net.h
index XXXXXXX..XXXXXXX 100644
--- a/include/net/net.h
+++ b/include/net/net.h
@@ -XXX,XX +XXX,XX @@ typedef int (SetVnetBE)(NetClientState *, bool);
 typedef struct SocketReadState SocketReadState;
 typedef void (SocketReadStateFinalize)(SocketReadState *rs);
 typedef void (NetAnnounce)(NetClientState *);
+typedef bool (SetSteeringEBPF)(NetClientState *, int);
 
 typedef struct NetClientInfo {
     NetClientDriver type;
@@ -XXX,XX +XXX,XX @@ typedef struct NetClientInfo {
     SetVnetLE *set_vnet_le;
     SetVnetBE *set_vnet_be;
     NetAnnounce *announce;
+    SetSteeringEBPF *set_steering_ebpf;
 } NetClientInfo;
 
 struct NetClientState {
diff --git a/net/tap-bsd.c b/net/tap-bsd.c
index XXXXXXX..XXXXXXX 100644
--- a/net/tap-bsd.c
+++ b/net/tap-bsd.c
@@ -XXX,XX +XXX,XX @@ int tap_fd_get_ifname(int fd, char *ifname)
 {
     return -1;
 }
+
+int tap_fd_set_steering_ebpf(int fd, int prog_fd)
+{
+    return -1;
+}
diff --git a/net/tap-linux.c b/net/tap-linux.c
index XXXXXXX..XXXXXXX 100644
--- a/net/tap-linux.c
+++ b/net/tap-linux.c
@@ -XXX,XX +XXX,XX @@ int tap_fd_get_ifname(int fd, char *ifname)
     pstrcpy(ifname, sizeof(ifr.ifr_name), ifr.ifr_name);
     return 0;
 }
+
+int tap_fd_set_steering_ebpf(int fd, int prog_fd)
+{
+    if (ioctl(fd, TUNSETSTEERINGEBPF, (void *) &prog_fd) != 0) {
+        error_report("Issue while setting TUNSETSTEERINGEBPF:"
+                    " %s with fd: %d, prog_fd: %d",
+                    strerror(errno), fd, prog_fd);
+
+       return -1;
+    }
+
+    return 0;
+}
diff --git a/net/tap-solaris.c b/net/tap-solaris.c
index XXXXXXX..XXXXXXX 100644
--- a/net/tap-solaris.c
+++ b/net/tap-solaris.c
@@ -XXX,XX +XXX,XX @@ int tap_fd_get_ifname(int fd, char *ifname)
 {
     return -1;
 }
+
+int tap_fd_set_steering_ebpf(int fd, int prog_fd)
+{
+    return -1;
+}
diff --git a/net/tap-stub.c b/net/tap-stub.c
index XXXXXXX..XXXXXXX 100644
--- a/net/tap-stub.c
+++ b/net/tap-stub.c
@@ -XXX,XX +XXX,XX @@ int tap_fd_get_ifname(int fd, char *ifname)
 {
     return -1;
 }
+
+int tap_fd_set_steering_ebpf(int fd, int prog_fd)
+{
+    return -1;
+}
diff --git a/net/tap.c b/net/tap.c
index XXXXXXX..XXXXXXX 100644
--- a/net/tap.c
+++ b/net/tap.c
@@ -XXX,XX +XXX,XX @@ static void tap_poll(NetClientState *nc, bool enable)
     tap_write_poll(s, enable);
 }
 
+static bool tap_set_steering_ebpf(NetClientState *nc, int prog_fd)
+{
+    TAPState *s = DO_UPCAST(TAPState, nc, nc);
+    assert(nc->info->type == NET_CLIENT_DRIVER_TAP);
+
+    return tap_fd_set_steering_ebpf(s->fd, prog_fd) == 0;
+}
+
 int tap_get_fd(NetClientState *nc)
 {
     TAPState *s = DO_UPCAST(TAPState, nc, nc);
@@ -XXX,XX +XXX,XX @@ static NetClientInfo net_tap_info = {
     .set_vnet_hdr_len = tap_set_vnet_hdr_len,
     .set_vnet_le = tap_set_vnet_le,
     .set_vnet_be = tap_set_vnet_be,
+    .set_steering_ebpf = tap_set_steering_ebpf,
 };
 
 static TAPState *net_tap_fd_init(NetClientState *peer,
diff --git a/net/tap_int.h b/net/tap_int.h
index XXXXXXX..XXXXXXX 100644
--- a/net/tap_int.h
+++ b/net/tap_int.h
@@ -XXX,XX +XXX,XX @@ int tap_fd_set_vnet_be(int fd, int vnet_is_be);
 int tap_fd_enable(int fd);
 int tap_fd_disable(int fd);
 int tap_fd_get_ifname(int fd, char *ifname);
+int tap_fd_set_steering_ebpf(int fd, int prog_fd);
 
 #endif /* NET_TAP_INT_H */
-- 
2.7.4

From: Andrew Melnychenko <andrew@daynix.com>

RSS program and Makefile to build it.
The bpftool used to generate '.h' file.
The data in that file may be loaded by libbpf.
EBPF compilation is not required for building qemu.
You can use Makefile if you need to regenerate rss.bpf.skeleton.h.

Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
Signed-off-by: Andrew Melnychenko <andrew@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 tools/ebpf/Makefile.ebpf |  21 ++
 tools/ebpf/rss.bpf.c     | 571 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 592 insertions(+)
 create mode 100755 tools/ebpf/Makefile.ebpf
 create mode 100644 tools/ebpf/rss.bpf.c

diff --git a/tools/ebpf/Makefile.ebpf b/tools/ebpf/Makefile.ebpf
new file mode 100755
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tools/ebpf/Makefile.ebpf
@@ -XXX,XX +XXX,XX @@
+OBJS = rss.bpf.o
+
+LLC ?= llc
+CLANG ?= clang
+INC_FLAGS = `$(CLANG) -print-file-name=include`
+EXTRA_CFLAGS ?= -O2 -emit-llvm -fno-stack-protector
+
+all: $(OBJS)
+
+.PHONY: clean
+
+clean:
+	rm -f $(OBJS)
+
+$(OBJS):  %.o:%.c
+	$(CLANG) $(INC_FLAGS) \
+                -D__KERNEL__ -D__ASM_SYSREG_H \
+                -I../include $(LINUXINCLUDE) \
+                $(EXTRA_CFLAGS) -c $< -o -| $(LLC) -march=bpf -filetype=obj -o $@
+	bpftool gen skeleton rss.bpf.o > rss.bpf.skeleton.h
+	cp rss.bpf.skeleton.h ../../ebpf/
diff --git a/tools/ebpf/rss.bpf.c b/tools/ebpf/rss.bpf.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tools/ebpf/rss.bpf.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * eBPF RSS program
+ *
+ * Developed by Daynix Computing LTD (http://www.daynix.com)
+ *
+ * Authors:
+ *  Andrew Melnychenko <andrew@daynix.com>
+ *  Yuri Benditovich <yuri.benditovich@daynix.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.  See
+ * the COPYING file in the top-level directory.
+ *
+ * Prepare:
+ * Requires llvm, clang, bpftool, linux kernel tree
+ *
+ * Build rss.bpf.skeleton.h:
+ * make -f Makefile.ebpf clean all
+ */
+
+#include <stddef.h>
+#include <stdbool.h>
+#include <linux/bpf.h>
+
+#include <linux/in.h>
+#include <linux/if_ether.h>
+#include <linux/ip.h>
+#include <linux/ipv6.h>
+
+#include <linux/udp.h>
+#include <linux/tcp.h>
+
+#include <bpf/bpf_helpers.h>
+#include <bpf/bpf_endian.h>
+#include <linux/virtio_net.h>
+
+#define INDIRECTION_TABLE_SIZE 128
+#define HASH_CALCULATION_BUFFER_SIZE 36
+
+struct rss_config_t {
+    __u8 redirect;
+    __u8 populate_hash;
+    __u32 hash_types;
+    __u16 indirections_len;
+    __u16 default_queue;
+} __attribute__((packed));
+
+struct toeplitz_key_data_t {
+    __u32 leftmost_32_bits;
+    __u8 next_byte[HASH_CALCULATION_BUFFER_SIZE];
+};
+
+struct packet_hash_info_t {
+    __u8 is_ipv4;
+    __u8 is_ipv6;
+    __u8 is_udp;
+    __u8 is_tcp;
+    __u8 is_ipv6_ext_src;
+    __u8 is_ipv6_ext_dst;
+    __u8 is_fragmented;
+
+    __u16 src_port;
+    __u16 dst_port;
+
+    union {
+        struct {
+            __be32 in_src;
+            __be32 in_dst;
+        };
+
+        struct {
+            struct in6_addr in6_src;
+            struct in6_addr in6_dst;
+            struct in6_addr in6_ext_src;
+            struct in6_addr in6_ext_dst;
+        };
+    };
+};
+
+struct bpf_map_def SEC("maps")
+tap_rss_map_configurations = {
+        .type        = BPF_MAP_TYPE_ARRAY,
+        .key_size    = sizeof(__u32),
+        .value_size  = sizeof(struct rss_config_t),
+        .max_entries = 1,
+};
+
+struct bpf_map_def SEC("maps")
+tap_rss_map_toeplitz_key = {
+        .type        = BPF_MAP_TYPE_ARRAY,
+        .key_size    = sizeof(__u32),
+        .value_size  = sizeof(struct toeplitz_key_data_t),
+        .max_entries = 1,
+};
+
+struct bpf_map_def SEC("maps")
+tap_rss_map_indirection_table = {
+        .type        = BPF_MAP_TYPE_ARRAY,
+        .key_size    = sizeof(__u32),
+        .value_size  = sizeof(__u16),
+        .max_entries = INDIRECTION_TABLE_SIZE,
+};
+
+static inline void net_rx_rss_add_chunk(__u8 *rss_input, size_t *bytes_written,
+                                        const void *ptr, size_t size) {
+    __builtin_memcpy(&rss_input[*bytes_written], ptr, size);
+    *bytes_written += size;
+}
+
+static inline
+void net_toeplitz_add(__u32 *result,
+                      __u8 *input,
+                      __u32 len
+        , struct toeplitz_key_data_t *key) {
+
+    __u32 accumulator = *result;
+    __u32 leftmost_32_bits = key->leftmost_32_bits;
+    __u32 byte;
+
+    for (byte = 0; byte < HASH_CALCULATION_BUFFER_SIZE; byte++) {
+        __u8 input_byte = input[byte];
+        __u8 key_byte = key->next_byte[byte];
+        __u8 bit;
+
+        for (bit = 0; bit < 8; bit++) {
+            if (input_byte & (1 << 7)) {
+                accumulator ^= leftmost_32_bits;
+            }
+
+            leftmost_32_bits =
+                    (leftmost_32_bits << 1) | ((key_byte & (1 << 7)) >> 7);
+
+            input_byte <<= 1;
+            key_byte <<= 1;
+        }
+    }
+
+    *result = accumulator;
+}
+
+
+static inline int ip6_extension_header_type(__u8 hdr_type)
+{
+    switch (hdr_type) {
+    case IPPROTO_HOPOPTS:
+    case IPPROTO_ROUTING:
+    case IPPROTO_FRAGMENT:
+    case IPPROTO_ICMPV6:
+    case IPPROTO_NONE:
+    case IPPROTO_DSTOPTS:
+    case IPPROTO_MH:
+        return 1;
+    default:
+        return 0;
+    }
+}
+/*
+ * According to
+ * https://www.iana.org/assignments/ipv6-parameters/ipv6-parameters.xhtml
+ * we expect that there are would be no more than 11 extensions in IPv6 header,
+ * also there is 27 TLV options for Destination and Hop-by-hop extensions.
+ * Need to choose reasonable amount of maximum extensions/options we may
+ * check to find ext src/dst.
+ */
+#define IP6_EXTENSIONS_COUNT 11
+#define IP6_OPTIONS_COUNT 30
+
+static inline int parse_ipv6_ext(struct __sk_buff *skb,
+        struct packet_hash_info_t *info,
+        __u8 *l4_protocol, size_t *l4_offset)
+{
+    int err = 0;
+
+    if (!ip6_extension_header_type(*l4_protocol)) {
+        return 0;
+    }
+
+    struct ipv6_opt_hdr ext_hdr = {};
+
+    for (unsigned int i = 0; i < IP6_EXTENSIONS_COUNT; ++i) {
+
+        err = bpf_skb_load_bytes_relative(skb, *l4_offset, &ext_hdr,
+                                    sizeof(ext_hdr), BPF_HDR_START_NET);
+        if (err) {
+            goto error;
+        }
+
+        if (*l4_protocol == IPPROTO_ROUTING) {
+            struct ipv6_rt_hdr ext_rt = {};
+
+            err = bpf_skb_load_bytes_relative(skb, *l4_offset, &ext_rt,
+                                        sizeof(ext_rt), BPF_HDR_START_NET);
+            if (err) {
+                goto error;
+            }
+
+            if ((ext_rt.type == IPV6_SRCRT_TYPE_2) &&
+                    (ext_rt.hdrlen == sizeof(struct in6_addr) / 8) &&
+                    (ext_rt.segments_left == 1)) {
+
+                err = bpf_skb_load_bytes_relative(skb,
+                    *l4_offset + offsetof(struct rt2_hdr, addr),
+                    &info->in6_ext_dst, sizeof(info->in6_ext_dst),
+                    BPF_HDR_START_NET);
+                if (err) {
+                    goto error;
+                }
+
+                info->is_ipv6_ext_dst = 1;
+            }
+
+        } else if (*l4_protocol == IPPROTO_DSTOPTS) {
+            struct ipv6_opt_t {
+                __u8 type;
+                __u8 length;
+            } __attribute__((packed)) opt = {};
+
+            size_t opt_offset = sizeof(ext_hdr);
+
+            for (unsigned int j = 0; j < IP6_OPTIONS_COUNT; ++j) {
+                err = bpf_skb_load_bytes_relative(skb, *l4_offset + opt_offset,
+                                        &opt, sizeof(opt), BPF_HDR_START_NET);
+                if (err) {
+                    goto error;
+                }
+
+                if (opt.type == IPV6_TLV_HAO) {
+                    err = bpf_skb_load_bytes_relative(skb,
+                        *l4_offset + opt_offset
+                        + offsetof(struct ipv6_destopt_hao, addr),
+                        &info->in6_ext_src, sizeof(info->in6_ext_src),
+                        BPF_HDR_START_NET);
+                    if (err) {
+                        goto error;
+                    }
+
+                    info->is_ipv6_ext_src = 1;
+                    break;
+                }
+
+                opt_offset += (opt.type == IPV6_TLV_PAD1) ?
+                              1 : opt.length + sizeof(opt);
+
+                if (opt_offset + 1 >= ext_hdr.hdrlen * 8) {
+                    break;
+                }
+            }
+        } else if (*l4_protocol == IPPROTO_FRAGMENT) {
+            info->is_fragmented = true;
+        }
+
+        *l4_protocol = ext_hdr.nexthdr;
+        *l4_offset += (ext_hdr.hdrlen + 1) * 8;
+
+        if (!ip6_extension_header_type(ext_hdr.nexthdr)) {
+            return 0;
+        }
+    }
+
+    return 0;
+error:
+    return err;
+}
+
+static __be16 parse_eth_type(struct __sk_buff *skb)
+{
+    unsigned int offset = 12;
+    __be16 ret = 0;
+    int err = 0;
+
+    err = bpf_skb_load_bytes_relative(skb, offset, &ret, sizeof(ret),
+                                BPF_HDR_START_MAC);
+    if (err) {
+        return 0;
+    }
+
+    switch (bpf_ntohs(ret)) {
+    case ETH_P_8021AD:
+        offset += 4;
+    case ETH_P_8021Q:
+        offset += 4;
+        err = bpf_skb_load_bytes_relative(skb, offset, &ret, sizeof(ret),
+                                    BPF_HDR_START_MAC);
+    default:
+        break;
+    }
+
+    if (err) {
+        return 0;
+    }
+
+    return ret;
+}
+
+static inline int parse_packet(struct __sk_buff *skb,
+        struct packet_hash_info_t *info)
+{
+    int err = 0;
+
+    if (!info || !skb) {
+        return -1;
+    }
+
+    size_t l4_offset = 0;
+    __u8 l4_protocol = 0;
+    __u16 l3_protocol = bpf_ntohs(parse_eth_type(skb));
+    if (l3_protocol == 0) {
+        err = -1;
+        goto error;
+    }
+
+    if (l3_protocol == ETH_P_IP) {
+        info->is_ipv4 = 1;
+
+        struct iphdr ip = {};
+        err = bpf_skb_load_bytes_relative(skb, 0, &ip, sizeof(ip),
+                                    BPF_HDR_START_NET);
+        if (err) {
+            goto error;
+        }
+
+        info->in_src = ip.saddr;
+        info->in_dst = ip.daddr;
+        info->is_fragmented = !!ip.frag_off;
+
+        l4_protocol = ip.protocol;
+        l4_offset = ip.ihl * 4;
+    } else if (l3_protocol == ETH_P_IPV6) {
+        info->is_ipv6 = 1;
+
+        struct ipv6hdr ip6 = {};
+        err = bpf_skb_load_bytes_relative(skb, 0, &ip6, sizeof(ip6),
+                                    BPF_HDR_START_NET);
+        if (err) {
+            goto error;
+        }
+
+        info->in6_src = ip6.saddr;
+        info->in6_dst = ip6.daddr;
+
+        l4_protocol = ip6.nexthdr;
+        l4_offset = sizeof(ip6);
+
+        err = parse_ipv6_ext(skb, info, &l4_protocol, &l4_offset);
+        if (err) {
+            goto error;
+        }
+    }
+
+    if (l4_protocol != 0 && !info->is_fragmented) {
+        if (l4_protocol == IPPROTO_TCP) {
+            info->is_tcp = 1;
+
+            struct tcphdr tcp = {};
+            err = bpf_skb_load_bytes_relative(skb, l4_offset, &tcp, sizeof(tcp),
+                                        BPF_HDR_START_NET);
+            if (err) {
+                goto error;
+            }
+
+            info->src_port = tcp.source;
+            info->dst_port = tcp.dest;
+        } else if (l4_protocol == IPPROTO_UDP) { /* TODO: add udplite? */
+            info->is_udp = 1;
+
+            struct udphdr udp = {};
+            err = bpf_skb_load_bytes_relative(skb, l4_offset, &udp, sizeof(udp),
+                                        BPF_HDR_START_NET);
+            if (err) {
+                goto error;
+            }
+
+            info->src_port = udp.source;
+            info->dst_port = udp.dest;
+        }
+    }
+
+    return 0;
+
+error:
+    return err;
+}
+
+static inline __u32 calculate_rss_hash(struct __sk_buff *skb,
+        struct rss_config_t *config, struct toeplitz_key_data_t *toe)
+{
+    __u8 rss_input[HASH_CALCULATION_BUFFER_SIZE] = {};
+    size_t bytes_written = 0;
+    __u32 result = 0;
+    int err = 0;
+    struct packet_hash_info_t packet_info = {};
+
+    err = parse_packet(skb, &packet_info);
+    if (err) {
+        return 0;
+    }
+
+    if (packet_info.is_ipv4) {
+        if (packet_info.is_tcp &&
+            config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_TCPv4) {
+
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.in_src,
+                                 sizeof(packet_info.in_src));
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.in_dst,
+                                 sizeof(packet_info.in_dst));
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.src_port,
+                                 sizeof(packet_info.src_port));
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.dst_port,
+                                 sizeof(packet_info.dst_port));
+        } else if (packet_info.is_udp &&
+                   config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_UDPv4) {
+
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.in_src,
+                                 sizeof(packet_info.in_src));
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.in_dst,
+                                 sizeof(packet_info.in_dst));
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.src_port,
+                                 sizeof(packet_info.src_port));
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.dst_port,
+                                 sizeof(packet_info.dst_port));
+        } else if (config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_IPv4) {
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.in_src,
+                                 sizeof(packet_info.in_src));
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.in_dst,
+                                 sizeof(packet_info.in_dst));
+        }
+    } else if (packet_info.is_ipv6) {
+        if (packet_info.is_tcp &&
+            config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_TCPv6) {
+
+            if (packet_info.is_ipv6_ext_src &&
+                config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_TCP_EX) {
+
+                net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                     &packet_info.in6_ext_src,
+                                     sizeof(packet_info.in6_ext_src));
+            } else {
+                net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                     &packet_info.in6_src,
+                                     sizeof(packet_info.in6_src));
+            }
+            if (packet_info.is_ipv6_ext_dst &&
+                config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_TCP_EX) {
+
+                net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                     &packet_info.in6_ext_dst,
+                                     sizeof(packet_info.in6_ext_dst));
+            } else {
+                net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                     &packet_info.in6_dst,
+                                     sizeof(packet_info.in6_dst));
+            }
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.src_port,
+                                 sizeof(packet_info.src_port));
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.dst_port,
+                                 sizeof(packet_info.dst_port));
+        } else if (packet_info.is_udp &&
+                   config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_UDPv6) {
+
+            if (packet_info.is_ipv6_ext_src &&
+               config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_UDP_EX) {
+
+                net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                     &packet_info.in6_ext_src,
+                                     sizeof(packet_info.in6_ext_src));
+            } else {
+                net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                     &packet_info.in6_src,
+                                     sizeof(packet_info.in6_src));
+            }
+            if (packet_info.is_ipv6_ext_dst &&
+               config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_UDP_EX) {
+
+                net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                     &packet_info.in6_ext_dst,
+                                     sizeof(packet_info.in6_ext_dst));
+            } else {
+                net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                     &packet_info.in6_dst,
+                                     sizeof(packet_info.in6_dst));
+            }
+
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.src_port,
+                                 sizeof(packet_info.src_port));
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.dst_port,
+                                 sizeof(packet_info.dst_port));
+
+        } else if (config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_IPv6) {
+            if (packet_info.is_ipv6_ext_src &&
+               config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_IP_EX) {
+
+                net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                     &packet_info.in6_ext_src,
+                                     sizeof(packet_info.in6_ext_src));
+            } else {
+                net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                     &packet_info.in6_src,
+                                     sizeof(packet_info.in6_src));
+            }
+            if (packet_info.is_ipv6_ext_dst &&
+                config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_IP_EX) {
+
+                net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                     &packet_info.in6_ext_dst,
+                                     sizeof(packet_info.in6_ext_dst));
+            } else {
+                net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                     &packet_info.in6_dst,
+                                     sizeof(packet_info.in6_dst));
+            }
+        }
+    }
+
+    if (bytes_written) {
+        net_toeplitz_add(&result, rss_input, bytes_written, toe);
+    }
+
+    return result;
+}
+
+SEC("tun_rss_steering")
+int tun_rss_steering_prog(struct __sk_buff *skb)
+{
+
+    struct rss_config_t *config;
+    struct toeplitz_key_data_t *toe;
+
+    __u32 key = 0;
+    __u32 hash = 0;
+
+    config = bpf_map_lookup_elem(&tap_rss_map_configurations, &key);
+    toe = bpf_map_lookup_elem(&tap_rss_map_toeplitz_key, &key);
+
+    if (config && toe) {
+        if (!config->redirect) {
+            return config->default_queue;
+        }
+
+        hash = calculate_rss_hash(skb, config, toe);
+        if (hash) {
+            __u32 table_idx = hash % config->indirections_len;
+            __u16 *queue = 0;
+
+            queue = bpf_map_lookup_elem(&tap_rss_map_indirection_table,
+                                        &table_idx);
+
+            if (queue) {
+                return *queue;
+            }
+        }
+
+        return config->default_queue;
+    }
+
+    return -1;
+}
+
+char _license[] SEC("license") = "GPL v2";
-- 
2.7.4

From: Andrew Melnychenko <andrew@daynix.com>

Added function that loads RSS eBPF program.
Added stub functions for RSS eBPF loader.
Added meson and configuration options.

By default, eBPF feature enabled if libbpf is present in the build system.
libbpf checked in configuration shell script and meson script.

Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
Signed-off-by: Andrew Melnychenko <andrew@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 configure               |   8 +-
 ebpf/ebpf_rss-stub.c    |  40 +++++
 ebpf/ebpf_rss.c         | 165 ++++++++++++++++++
 ebpf/ebpf_rss.h         |  44 +++++
 ebpf/meson.build        |   1 +
 ebpf/rss.bpf.skeleton.h | 431 ++++++++++++++++++++++++++++++++++++++++++++++++
 ebpf/trace-events       |   4 +
 ebpf/trace.h            |   1 +
 meson.build             |  23 +++
 meson_options.txt       |   2 +
 10 files changed, 718 insertions(+), 1 deletion(-)
 create mode 100644 ebpf/ebpf_rss-stub.c
 create mode 100644 ebpf/ebpf_rss.c
 create mode 100644 ebpf/ebpf_rss.h
 create mode 100644 ebpf/meson.build
 create mode 100644 ebpf/rss.bpf.skeleton.h
 create mode 100644 ebpf/trace-events
 create mode 100644 ebpf/trace.h

diff --git a/configure b/configure
index XXXXXXX..XXXXXXX 100755
--- a/configure
+++ b/configure
@@ -XXX,XX +XXX,XX @@ vhost_vsock="$default_feature"
 vhost_user="no"
 vhost_user_blk_server="auto"
 vhost_user_fs="$default_feature"
+bpf="auto"
 kvm="auto"
 hax="auto"
 hvf="auto"
@@ -XXX,XX +XXX,XX @@ for opt do
   ;;
   --enable-membarrier) membarrier="yes"
   ;;
+  --disable-bpf) bpf="disabled"
+  ;;
+  --enable-bpf) bpf="enabled"
+  ;;
   --disable-blobs) blobs="false"
   ;;
   --with-pkgversion=*) pkgversion="$optarg"
@@ -XXX,XX +XXX,XX @@ disabled with --disable-FEATURE, default is enabled if available
   vhost-user      vhost-user backend support
   vhost-user-blk-server    vhost-user-blk server support
   vhost-vdpa      vhost-vdpa kernel backend support
+  bpf             BPF kernel support
   spice           spice
   spice-protocol  spice-protocol
   rbd             rados block device (rbd)
@@ -XXX,XX +XXX,XX @@ if test "$skip_meson" = no; then
         -Dattr=$attr -Ddefault_devices=$default_devices \
         -Ddocs=$docs -Dsphinx_build=$sphinx_build -Dinstall_blobs=$blobs \
         -Dvhost_user_blk_server=$vhost_user_blk_server -Dmultiprocess=$multiprocess \
-        -Dfuse=$fuse -Dfuse_lseek=$fuse_lseek -Dguest_agent_msi=$guest_agent_msi \
+        -Dfuse=$fuse -Dfuse_lseek=$fuse_lseek -Dguest_agent_msi=$guest_agent_msi -Dbpf=$bpf\
         $(if test "$default_features" = no; then echo "-Dauto_features=disabled"; fi) \
 	-Dtcg_interpreter=$tcg_interpreter \
         $cross_arg \
diff --git a/ebpf/ebpf_rss-stub.c b/ebpf/ebpf_rss-stub.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/ebpf/ebpf_rss-stub.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * eBPF RSS stub file
+ *
+ * Developed by Daynix Computing LTD (http://www.daynix.com)
+ *
+ * Authors:
+ *  Yuri Benditovich <yuri.benditovich@daynix.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.  See
+ * the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "ebpf/ebpf_rss.h"
+
+void ebpf_rss_init(struct EBPFRSSContext *ctx)
+{
+
+}
+
+bool ebpf_rss_is_loaded(struct EBPFRSSContext *ctx)
+{
+    return false;
+}
+
+bool ebpf_rss_load(struct EBPFRSSContext *ctx)
+{
+    return false;
+}
+
+bool ebpf_rss_set_all(struct EBPFRSSContext *ctx, struct EBPFRSSConfig *config,
+                      uint16_t *indirections_table, uint8_t *toeplitz_key)
+{
+    return false;
+}
+
+void ebpf_rss_unload(struct EBPFRSSContext *ctx)
+{
+
+}
diff --git a/ebpf/ebpf_rss.c b/ebpf/ebpf_rss.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/ebpf/ebpf_rss.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * eBPF RSS loader
+ *
+ * Developed by Daynix Computing LTD (http://www.daynix.com)
+ *
+ * Authors:
+ *  Andrew Melnychenko <andrew@daynix.com>
+ *  Yuri Benditovich <yuri.benditovich@daynix.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.  See
+ * the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/error-report.h"
+
+#include <bpf/libbpf.h>
+#include <bpf/bpf.h>
+
+#include "hw/virtio/virtio-net.h" /* VIRTIO_NET_RSS_MAX_TABLE_LEN */
+
+#include "ebpf/ebpf_rss.h"
+#include "ebpf/rss.bpf.skeleton.h"
+#include "trace.h"
+
+void ebpf_rss_init(struct EBPFRSSContext *ctx)
+{
+    if (ctx != NULL) {
+        ctx->obj = NULL;
+    }
+}
+
+bool ebpf_rss_is_loaded(struct EBPFRSSContext *ctx)
+{
+    return ctx != NULL && ctx->obj != NULL;
+}
+
+bool ebpf_rss_load(struct EBPFRSSContext *ctx)
+{
+    struct rss_bpf *rss_bpf_ctx;
+
+    if (ctx == NULL) {
+        return false;
+    }
+
+    rss_bpf_ctx = rss_bpf__open();
+    if (rss_bpf_ctx == NULL) {
+        trace_ebpf_error("eBPF RSS", "can not open eBPF RSS object");
+        goto error;
+    }
+
+    bpf_program__set_socket_filter(rss_bpf_ctx->progs.tun_rss_steering_prog);
+
+    if (rss_bpf__load(rss_bpf_ctx)) {
+        trace_ebpf_error("eBPF RSS", "can not load RSS program");
+        goto error;
+    }
+
+    ctx->obj = rss_bpf_ctx;
+    ctx->program_fd = bpf_program__fd(
+            rss_bpf_ctx->progs.tun_rss_steering_prog);
+    ctx->map_configuration = bpf_map__fd(
+            rss_bpf_ctx->maps.tap_rss_map_configurations);
+    ctx->map_indirections_table = bpf_map__fd(
+            rss_bpf_ctx->maps.tap_rss_map_indirection_table);
+    ctx->map_toeplitz_key = bpf_map__fd(
+            rss_bpf_ctx->maps.tap_rss_map_toeplitz_key);
+
+    return true;
+error:
+    rss_bpf__destroy(rss_bpf_ctx);
+    ctx->obj = NULL;
+
+    return false;
+}
+
+static bool ebpf_rss_set_config(struct EBPFRSSContext *ctx,
+                                struct EBPFRSSConfig *config)
+{
+    uint32_t map_key = 0;
+
+    if (!ebpf_rss_is_loaded(ctx)) {
+        return false;
+    }
+    if (bpf_map_update_elem(ctx->map_configuration,
+                            &map_key, config, 0) < 0) {
+        return false;
+    }
+    return true;
+}
+
+static bool ebpf_rss_set_indirections_table(struct EBPFRSSContext *ctx,
+                                            uint16_t *indirections_table,
+                                            size_t len)
+{
+    uint32_t i = 0;
+
+    if (!ebpf_rss_is_loaded(ctx) || indirections_table == NULL ||
+       len > VIRTIO_NET_RSS_MAX_TABLE_LEN) {
+        return false;
+    }
+
+    for (; i < len; ++i) {
+        if (bpf_map_update_elem(ctx->map_indirections_table, &i,
+                                indirections_table + i, 0) < 0) {
+            return false;
+        }
+    }
+    return true;
+}
+
+static bool ebpf_rss_set_toepliz_key(struct EBPFRSSContext *ctx,
+                                     uint8_t *toeplitz_key)
+{
+    uint32_t map_key = 0;
+
+    /* prepare toeplitz key */
+    uint8_t toe[VIRTIO_NET_RSS_MAX_KEY_SIZE] = {};
+
+    if (!ebpf_rss_is_loaded(ctx) || toeplitz_key == NULL) {
+        return false;
+    }
+    memcpy(toe, toeplitz_key, VIRTIO_NET_RSS_MAX_KEY_SIZE);
+    *(uint32_t *)toe = ntohl(*(uint32_t *)toe);
+
+    if (bpf_map_update_elem(ctx->map_toeplitz_key, &map_key, toe,
+                            0) < 0) {
+        return false;
+    }
+    return true;
+}
+
+bool ebpf_rss_set_all(struct EBPFRSSContext *ctx, struct EBPFRSSConfig *config,
+                      uint16_t *indirections_table, uint8_t *toeplitz_key)
+{
+    if (!ebpf_rss_is_loaded(ctx) || config == NULL ||
+        indirections_table == NULL || toeplitz_key == NULL) {
+        return false;
+    }
+
+    if (!ebpf_rss_set_config(ctx, config)) {
+        return false;
+    }
+
+    if (!ebpf_rss_set_indirections_table(ctx, indirections_table,
+                                      config->indirections_len)) {
+        return false;
+    }
+
+    if (!ebpf_rss_set_toepliz_key(ctx, toeplitz_key)) {
+        return false;
+    }
+
+    return true;
+}
+
+void ebpf_rss_unload(struct EBPFRSSContext *ctx)
+{
+    if (!ebpf_rss_is_loaded(ctx)) {
+        return;
+    }
+
+    rss_bpf__destroy(ctx->obj);
+    ctx->obj = NULL;
+}
diff --git a/ebpf/ebpf_rss.h b/ebpf/ebpf_rss.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/ebpf/ebpf_rss.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * eBPF RSS header
+ *
+ * Developed by Daynix Computing LTD (http://www.daynix.com)
+ *
+ * Authors:
+ *  Andrew Melnychenko <andrew@daynix.com>
+ *  Yuri Benditovich <yuri.benditovich@daynix.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.  See
+ * the COPYING file in the top-level directory.
+ */
+
+#ifndef QEMU_EBPF_RSS_H
+#define QEMU_EBPF_RSS_H
+
+struct EBPFRSSContext {
+    void *obj;
+    int program_fd;
+    int map_configuration;
+    int map_toeplitz_key;
+    int map_indirections_table;
+};
+
+struct EBPFRSSConfig {
+    uint8_t redirect;
+    uint8_t populate_hash;
+    uint32_t hash_types;
+    uint16_t indirections_len;
+    uint16_t default_queue;
+} __attribute__((packed));
+
+void ebpf_rss_init(struct EBPFRSSContext *ctx);
+
+bool ebpf_rss_is_loaded(struct EBPFRSSContext *ctx);
+
+bool ebpf_rss_load(struct EBPFRSSContext *ctx);
+
+bool ebpf_rss_set_all(struct EBPFRSSContext *ctx, struct EBPFRSSConfig *config,
+                      uint16_t *indirections_table, uint8_t *toeplitz_key);
+
+void ebpf_rss_unload(struct EBPFRSSContext *ctx);
+
+#endif /* QEMU_EBPF_RSS_H */
diff --git a/ebpf/meson.build b/ebpf/meson.build
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/ebpf/meson.build
@@ -0,0 +1 @@
+common_ss.add(when: libbpf, if_true: files('ebpf_rss.c'), if_false: files('ebpf_rss-stub.c'))
diff --git a/ebpf/rss.bpf.skeleton.h b/ebpf/rss.bpf.skeleton.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/ebpf/rss.bpf.skeleton.h
@@ -XXX,XX +XXX,XX @@
+/* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */
+
+/* THIS FILE IS AUTOGENERATED! */
+#ifndef __RSS_BPF_SKEL_H__
+#define __RSS_BPF_SKEL_H__
+
+#include <stdlib.h>
+#include <bpf/libbpf.h>
+
+struct rss_bpf {
+	struct bpf_object_skeleton *skeleton;
+	struct bpf_object *obj;
+	struct {
+		struct bpf_map *tap_rss_map_configurations;
+		struct bpf_map *tap_rss_map_indirection_table;
+		struct bpf_map *tap_rss_map_toeplitz_key;
+	} maps;
+	struct {
+		struct bpf_program *tun_rss_steering_prog;
+	} progs;
+	struct {
+		struct bpf_link *tun_rss_steering_prog;
+	} links;
+};
+
+static void
+rss_bpf__destroy(struct rss_bpf *obj)
+{
+	if (!obj)
+		return;
+	if (obj->skeleton)
+		bpf_object__destroy_skeleton(obj->skeleton);
+	free(obj);
+}
+
+static inline int
+rss_bpf__create_skeleton(struct rss_bpf *obj);
+
+static inline struct rss_bpf *
+rss_bpf__open_opts(const struct bpf_object_open_opts *opts)
+{
+	struct rss_bpf *obj;
+
+	obj = (struct rss_bpf *)calloc(1, sizeof(*obj));
+	if (!obj)
+		return NULL;
+	if (rss_bpf__create_skeleton(obj))
+		goto err;
+	if (bpf_object__open_skeleton(obj->skeleton, opts))
+		goto err;
+
+	return obj;
+err:
+	rss_bpf__destroy(obj);
+	return NULL;
+}
+
+static inline struct rss_bpf *
+rss_bpf__open(void)
+{
+	return rss_bpf__open_opts(NULL);
+}
+
+static inline int
+rss_bpf__load(struct rss_bpf *obj)
+{
+	return bpf_object__load_skeleton(obj->skeleton);
+}
+
+static inline struct rss_bpf *
+rss_bpf__open_and_load(void)
+{
+	struct rss_bpf *obj;
+
+	obj = rss_bpf__open();
+	if (!obj)
+		return NULL;
+	if (rss_bpf__load(obj)) {
+		rss_bpf__destroy(obj);
+		return NULL;
+	}
+	return obj;
+}
+
+static inline int
+rss_bpf__attach(struct rss_bpf *obj)
+{
+	return bpf_object__attach_skeleton(obj->skeleton);
+}
+
+static inline void
+rss_bpf__detach(struct rss_bpf *obj)
+{
+	return bpf_object__detach_skeleton(obj->skeleton);
+}
+
+static inline int
+rss_bpf__create_skeleton(struct rss_bpf *obj)
+{
+	struct bpf_object_skeleton *s;
+
+	s = (struct bpf_object_skeleton *)calloc(1, sizeof(*s));
+	if (!s)
+		return -1;
+	obj->skeleton = s;
+
+	s->sz = sizeof(*s);
+	s->name = "rss_bpf";
+	s->obj = &obj->obj;
+
+	/* maps */
+	s->map_cnt = 3;
+	s->map_skel_sz = sizeof(*s->maps);
+	s->maps = (struct bpf_map_skeleton *)calloc(s->map_cnt, s->map_skel_sz);
+	if (!s->maps)
+		goto err;
+
+	s->maps[0].name = "tap_rss_map_configurations";
+	s->maps[0].map = &obj->maps.tap_rss_map_configurations;
+
+	s->maps[1].name = "tap_rss_map_indirection_table";
+	s->maps[1].map = &obj->maps.tap_rss_map_indirection_table;
+
+	s->maps[2].name = "tap_rss_map_toeplitz_key";
+	s->maps[2].map = &obj->maps.tap_rss_map_toeplitz_key;
+
+	/* programs */
+	s->prog_cnt = 1;
+	s->prog_skel_sz = sizeof(*s->progs);
+	s->progs = (struct bpf_prog_skeleton *)calloc(s->prog_cnt, s->prog_skel_sz);
+	if (!s->progs)
+		goto err;
+
+	s->progs[0].name = "tun_rss_steering_prog";
+	s->progs[0].prog = &obj->progs.tun_rss_steering_prog;
+	s->progs[0].link = &obj->links.tun_rss_steering_prog;
+
+	s->data_sz = 8088;
+	s->data = (void *)"\
+\x7f\x45\x4c\x46\x02\x01\x01\0\0\0\0\0\0\0\0\0\x01\0\xf7\0\x01\0\0\0\0\0\0\0\0\
+\0\0\0\0\0\0\0\0\0\0\0\x18\x1d\0\0\0\0\0\0\0\0\0\0\x40\0\0\0\0\0\x40\0\x0a\0\
+\x01\0\xbf\x18\0\0\0\0\0\0\xb7\x01\0\0\0\0\0\0\x63\x1a\x4c\xff\0\0\0\0\xbf\xa7\
+\0\0\0\0\0\0\x07\x07\0\0\x4c\xff\xff\xff\x18\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
+\xbf\x72\0\0\0\0\0\0\x85\0\0\0\x01\0\0\0\xbf\x06\0\0\0\0\0\0\x18\x01\0\0\0\0\0\
+\0\0\0\0\0\0\0\0\0\xbf\x72\0\0\0\0\0\0\x85\0\0\0\x01\0\0\0\xbf\x07\0\0\0\0\0\0\
+\x18\0\0\0\xff\xff\xff\xff\0\0\0\0\0\0\0\0\x15\x06\x66\x02\0\0\0\0\xbf\x79\0\0\
+\0\0\0\0\x15\x09\x64\x02\0\0\0\0\x71\x61\0\0\0\0\0\0\x55\x01\x01\0\0\0\0\0\x05\
+\0\x5d\x02\0\0\0\0\xb7\x01\0\0\0\0\0\0\x63\x1a\xc0\xff\0\0\0\0\x7b\x1a\xb8\xff\
+\0\0\0\0\x7b\x1a\xb0\xff\0\0\0\0\x7b\x1a\xa8\xff\0\0\0\0\x7b\x1a\xa0\xff\0\0\0\
+\0\x63\x1a\x98\xff\0\0\0\0\x7b\x1a\x90\xff\0\0\0\0\x7b\x1a\x88\xff\0\0\0\0\x7b\
+\x1a\x80\xff\0\0\0\0\x7b\x1a\x78\xff\0\0\0\0\x7b\x1a\x70\xff\0\0\0\0\x7b\x1a\
+\x68\xff\0\0\0\0\x7b\x1a\x60\xff\0\0\0\0\x7b\x1a\x58\xff\0\0\0\0\x7b\x1a\x50\
+\xff\0\0\0\0\x15\x08\x4c\x02\0\0\0\0\x6b\x1a\xd0\xff\0\0\0\0\xbf\xa3\0\0\0\0\0\
+\0\x07\x03\0\0\xd0\xff\xff\xff\xbf\x81\0\0\0\0\0\0\xb7\x02\0\0\x0c\0\0\0\xb7\
+\x04\0\0\x02\0\0\0\xb7\x05\0\0\0\0\0\0\x85\0\0\0\x44\0\0\0\x67\0\0\0\x20\0\0\0\
+\x77\0\0\0\x20\0\0\0\x55\0\x11\0\0\0\0\0\xb7\x02\0\0\x10\0\0\0\x69\xa1\xd0\xff\
+\0\0\0\0\xbf\x13\0\0\0\0\0\0\xdc\x03\0\0\x10\0\0\0\x15\x03\x02\0\0\x81\0\0\x55\
+\x03\x0c\0\xa8\x88\0\0\xb7\x02\0\0\x14\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\
+\xd0\xff\xff\xff\xbf\x81\0\0\0\0\0\0\xb7\x04\0\0\x02\0\0\0\xb7\x05\0\0\0\0\0\0\
+\x85\0\0\0\x44\0\0\0\x69\xa1\xd0\xff\0\0\0\0\x67\0\0\0\x20\0\0\0\x77\0\0\0\x20\
+\0\0\0\x15\0\x01\0\0\0\0\0\x05\0\x2f\x02\0\0\0\0\x15\x01\x2e\x02\0\0\0\0\x7b\
+\x9a\x30\xff\0\0\0\0\x15\x01\x57\0\x86\xdd\0\0\x55\x01\x3b\0\x08\0\0\0\x7b\x7a\
+\x20\xff\0\0\0\0\xb7\x07\0\0\x01\0\0\0\x73\x7a\x50\xff\0\0\0\0\xb7\x01\0\0\0\0\
+\0\0\x63\x1a\xe0\xff\0\0\0\0\x7b\x1a\xd8\xff\0\0\0\0\x7b\x1a\xd0\xff\0\0\0\0\
+\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\xd0\xff\xff\xff\xbf\x81\0\0\0\0\0\0\xb7\x02\0\
+\0\0\0\0\0\xb7\x04\0\0\x14\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\0\0\0\x67\
+\0\0\0\x20\0\0\0\x77\0\0\0\x20\0\0\0\x55\0\x1a\x02\0\0\0\0\x69\xa1\xd6\xff\0\0\
+\0\0\x55\x01\x01\0\0\0\0\0\xb7\x07\0\0\0\0\0\0\x61\xa1\xdc\xff\0\0\0\0\x63\x1a\
+\x5c\xff\0\0\0\0\x61\xa1\xe0\xff\0\0\0\0\x63\x1a\x60\xff\0\0\0\0\x73\x7a\x56\
+\xff\0\0\0\0\x71\xa9\xd9\xff\0\0\0\0\x71\xa1\xd0\xff\0\0\0\0\x67\x01\0\0\x02\0\
+\0\0\x57\x01\0\0\x3c\0\0\0\x7b\x1a\x40\xff\0\0\0\0\x79\xa7\x20\xff\0\0\0\0\xbf\
+\x91\0\0\0\0\0\0\x57\x01\0\0\xff\0\0\0\x15\x01\x19\0\0\0\0\0\x71\xa1\x56\xff\0\
+\0\0\0\x55\x01\x17\0\0\0\0\0\x57\x09\0\0\xff\0\0\0\x15\x09\x7a\x01\x11\0\0\0\
+\x55\x09\x14\0\x06\0\0\0\xb7\x01\0\0\x01\0\0\0\x73\x1a\x53\xff\0\0\0\0\xb7\x01\
+\0\0\0\0\0\0\x63\x1a\xe0\xff\0\0\0\0\x7b\x1a\xd8\xff\0\0\0\0\x7b\x1a\xd0\xff\0\
+\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\xd0\xff\xff\xff\xbf\x81\0\0\0\0\0\0\x79\
+\xa2\x40\xff\0\0\0\0\xb7\x04\0\0\x14\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\
+\0\0\0\x67\0\0\0\x20\0\0\0\x77\0\0\0\x20\0\0\0\x55\0\xf4\x01\0\0\0\0\x69\xa1\
+\xd0\xff\0\0\0\0\x6b\x1a\x58\xff\0\0\0\0\x69\xa1\xd2\xff\0\0\0\0\x6b\x1a\x5a\
+\xff\0\0\0\0\x71\xa1\x50\xff\0\0\0\0\x15\x01\xd4\0\0\0\0\0\x71\x62\x03\0\0\0\0\
+\0\x67\x02\0\0\x08\0\0\0\x71\x61\x02\0\0\0\0\0\x4f\x12\0\0\0\0\0\0\x71\x63\x04\
+\0\0\0\0\0\x71\x61\x05\0\0\0\0\0\x67\x01\0\0\x08\0\0\0\x4f\x31\0\0\0\0\0\0\x67\
+\x01\0\0\x10\0\0\0\x4f\x21\0\0\0\0\0\0\x71\xa2\x53\xff\0\0\0\0\x79\xa0\x30\xff\
+\0\0\0\0\x15\x02\x06\x01\0\0\0\0\xbf\x12\0\0\0\0\0\0\x57\x02\0\0\x02\0\0\0\x15\
+\x02\x03\x01\0\0\0\0\x61\xa1\x5c\xff\0\0\0\0\x63\x1a\xa0\xff\0\0\0\0\x61\xa1\
+\x60\xff\0\0\0\0\x63\x1a\xa4\xff\0\0\0\0\x69\xa1\x58\xff\0\0\0\0\x6b\x1a\xa8\
+\xff\0\0\0\0\x69\xa1\x5a\xff\0\0\0\0\x6b\x1a\xaa\xff\0\0\0\0\x05\0\x65\x01\0\0\
+\0\0\xb7\x01\0\0\x01\0\0\0\x73\x1a\x51\xff\0\0\0\0\xb7\x01\0\0\0\0\0\0\x7b\x1a\
+\xf0\xff\0\0\0\0\x7b\x1a\xe8\xff\0\0\0\0\x7b\x1a\xe0\xff\0\0\0\0\x7b\x1a\xd8\
+\xff\0\0\0\0\x7b\x1a\xd0\xff\0\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\xd0\xff\
+\xff\xff\xb7\x01\0\0\x28\0\0\0\x7b\x1a\x40\xff\0\0\0\0\xbf\x81\0\0\0\0\0\0\xb7\
+\x02\0\0\0\0\0\0\xb7\x04\0\0\x28\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\0\0\
+\0\x67\0\0\0\x20\0\0\0\x77\0\0\0\x20\0\0\0\x55\0\x10\x01\0\0\0\0\x79\xa1\xe0\
+\xff\0\0\0\0\x63\x1a\x64\xff\0\0\0\0\x77\x01\0\0\x20\0\0\0\x63\x1a\x68\xff\0\0\
+\0\0\x79\xa1\xd8\xff\0\0\0\0\x63\x1a\x5c\xff\0\0\0\0\x77\x01\0\0\x20\0\0\0\x63\
+\x1a\x60\xff\0\0\0\0\x79\xa1\xe8\xff\0\0\0\0\x63\x1a\x6c\xff\0\0\0\0\x77\x01\0\
+\0\x20\0\0\0\x63\x1a\x70\xff\0\0\0\0\x79\xa1\xf0\xff\0\0\0\0\x63\x1a\x74\xff\0\
+\0\0\0\x77\x01\0\0\x20\0\0\0\x63\x1a\x78\xff\0\0\0\0\x71\xa9\xd6\xff\0\0\0\0\
+\x25\x09\xff\0\x3c\0\0\0\xb7\x01\0\0\x01\0\0\0\x6f\x91\0\0\0\0\0\0\x18\x02\0\0\
+\x01\0\0\0\0\0\0\0\0\x18\0\x1c\x5f\x21\0\0\0\0\0\0\x55\x01\x01\0\0\0\0\0\x05\0\
+\xf8\0\0\0\0\0\xb7\x01\0\0\0\0\0\0\x6b\x1a\xfe\xff\0\0\0\0\xb7\x01\0\0\x28\0\0\
+\0\x7b\x1a\x40\xff\0\0\0\0\xbf\xa1\0\0\0\0\0\0\x07\x01\0\0\x8c\xff\xff\xff\x7b\
+\x1a\x18\xff\0\0\0\0\xbf\xa1\0\0\0\0\0\0\x07\x01\0\0\x7c\xff\xff\xff\x7b\x1a\
+\x10\xff\0\0\0\0\xb7\x01\0\0\0\0\0\0\x7b\x1a\x28\xff\0\0\0\0\x7b\x7a\x20\xff\0\
+\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\xfe\xff\xff\xff\xbf\x81\0\0\0\0\0\0\x79\
+\xa2\x40\xff\0\0\0\0\xb7\x04\0\0\x02\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\
+\0\0\0\x67\0\0\0\x20\0\0\0\x77\0\0\0\x20\0\0\0\x15\0\x01\0\0\0\0\0\x05\0\x90\
+\x01\0\0\0\0\xbf\x91\0\0\0\0\0\0\x15\x01\x23\0\x3c\0\0\0\x15\x01\x59\0\x2c\0\0\
+\0\x55\x01\x5a\0\x2b\0\0\0\xb7\x01\0\0\0\0\0\0\x63\x1a\xf8\xff\0\0\0\0\xbf\xa3\
+\0\0\0\0\0\0\x07\x03\0\0\xf8\xff\xff\xff\xbf\x81\0\0\0\0\0\0\x79\xa2\x40\xff\0\
+\0\0\0\xb7\x04\0\0\x04\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\0\0\0\xbf\x01\
+\0\0\0\0\0\0\x67\x01\0\0\x20\0\0\0\x77\x01\0\0\x20\0\0\0\x55\x01\x03\x01\0\0\0\
+\0\x71\xa1\xfa\xff\0\0\0\0\x55\x01\x4b\0\x02\0\0\0\x71\xa1\xf9\xff\0\0\0\0\x55\
+\x01\x49\0\x02\0\0\0\x71\xa1\xfb\xff\0\0\0\0\x55\x01\x47\0\x01\0\0\0\x79\xa2\
+\x40\xff\0\0\0\0\x07\x02\0\0\x08\0\0\0\xbf\x81\0\0\0\0\0\0\x79\xa3\x18\xff\0\0\
+\0\0\xb7\x04\0\0\x10\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\0\0\0\xbf\x01\0\
+\0\0\0\0\0\x67\x01\0\0\x20\0\0\0\x77\x01\0\0\x20\0\0\0\x55\x01\xf2\0\0\0\0\0\
+\xb7\x01\0\0\x01\0\0\0\x73\x1a\x55\xff\0\0\0\0\x05\0\x39\0\0\0\0\0\xb7\x01\0\0\
+\0\0\0\0\x6b\x1a\xf8\xff\0\0\0\0\xb7\x09\0\0\x02\0\0\0\xb7\x07\0\0\x1e\0\0\0\
+\x05\0\x0e\0\0\0\0\0\x79\xa2\x38\xff\0\0\0\0\x0f\x29\0\0\0\0\0\0\xbf\x92\0\0\0\
+\0\0\0\x07\x02\0\0\x01\0\0\0\x71\xa3\xff\xff\0\0\0\0\x67\x03\0\0\x03\0\0\0\x2d\
+\x23\x02\0\0\0\0\0\x79\xa7\x20\xff\0\0\0\0\x05\0\x2b\0\0\0\0\0\x07\x07\0\0\xff\
+\xff\xff\xff\xbf\x72\0\0\0\0\0\0\x67\x02\0\0\x20\0\0\0\x77\x02\0\0\x20\0\0\0\
+\x15\x02\xf9\xff\0\0\0\0\x7b\x9a\x38\xff\0\0\0\0\x79\xa1\x40\xff\0\0\0\0\x0f\
+\x19\0\0\0\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\xf8\xff\xff\xff\xbf\x81\0\0\0\
+\0\0\0\xbf\x92\0\0\0\0\0\0\xb7\x04\0\0\x02\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\
+\0\x44\0\0\0\xbf\x01\0\0\0\0\0\0\x67\x01\0\0\x20\0\0\0\x77\x01\0\0\x20\0\0\0\
+\x55\x01\x94\0\0\0\0\0\x71\xa2\xf8\xff\0\0\0\0\x55\x02\x0f\0\xc9\0\0\0\x07\x09\
+\0\0\x02\0\0\0\xbf\x81\0\0\0\0\0\0\xbf\x92\0\0\0\0\0\0\x79\xa3\x10\xff\0\0\0\0\
+\xb7\x04\0\0\x10\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\0\0\0\xbf\x01\0\0\0\
+\0\0\0\x67\x01\0\0\x20\0\0\0\x77\x01\0\0\x20\0\0\0\x55\x01\x87\0\0\0\0\0\xb7\
+\x01\0\0\x01\0\0\0\x73\x1a\x54\xff\0\0\0\0\x79\xa7\x20\xff\0\0\0\0\x05\0\x07\0\
+\0\0\0\0\xb7\x09\0\0\x01\0\0\0\x15\x02\xd1\xff\0\0\0\0\x71\xa9\xf9\xff\0\0\0\0\
+\x07\x09\0\0\x02\0\0\0\x05\0\xce\xff\0\0\0\0\xb7\x01\0\0\x01\0\0\0\x73\x1a\x56\
+\xff\0\0\0\0\x71\xa1\xff\xff\0\0\0\0\x67\x01\0\0\x03\0\0\0\x79\xa2\x40\xff\0\0\
+\0\0\x0f\x12\0\0\0\0\0\0\x07\x02\0\0\x08\0\0\0\x7b\x2a\x40\xff\0\0\0\0\x71\xa9\
+\xfe\xff\0\0\0\0\x25\x09\x0e\0\x3c\0\0\0\xb7\x01\0\0\x01\0\0\0\x6f\x91\0\0\0\0\
+\0\0\x18\x02\0\0\x01\0\0\0\0\0\0\0\0\x18\0\x1c\x5f\x21\0\0\0\0\0\0\x55\x01\x01\
+\0\0\0\0\0\x05\0\x07\0\0\0\0\0\x79\xa1\x28\xff\0\0\0\0\x07\x01\0\0\x01\0\0\0\
+\x7b\x1a\x28\xff\0\0\0\0\x67\x01\0\0\x20\0\0\0\x77\x01\0\0\x20\0\0\0\x55\x01\
+\x82\xff\x0b\0\0\0\x05\0\x10\xff\0\0\0\0\x15\x09\xf8\xff\x87\0\0\0\x05\0\xfd\
+\xff\0\0\0\0\x71\xa1\x51\xff\0\0\0\0\x79\xa0\x30\xff\0\0\0\0\x15\x01\x17\x01\0\
+\0\0\0\x71\x62\x03\0\0\0\0\0\x67\x02\0\0\x08\0\0\0\x71\x61\x02\0\0\0\0\0\x4f\
+\x12\0\0\0\0\0\0\x71\x63\x04\0\0\0\0\0\x71\x61\x05\0\0\0\0\0\x67\x01\0\0\x08\0\
+\0\0\x4f\x31\0\0\0\0\0\0\x67\x01\0\0\x10\0\0\0\x4f\x21\0\0\0\0\0\0\x71\xa2\x53\
+\xff\0\0\0\0\x15\x02\x3d\0\0\0\0\0\xbf\x12\0\0\0\0\0\0\x57\x02\0\0\x10\0\0\0\
+\x15\x02\x3a\0\0\0\0\0\xbf\xa2\0\0\0\0\0\0\x07\x02\0\0\x5c\xff\xff\xff\x71\xa4\
+\x54\xff\0\0\0\0\xbf\x23\0\0\0\0\0\0\x15\x04\x02\0\0\0\0\0\xbf\xa3\0\0\0\0\0\0\
+\x07\x03\0\0\x7c\xff\xff\xff\x67\x01\0\0\x38\0\0\0\xc7\x01\0\0\x38\0\0\0\x65\
+\x01\x01\0\xff\xff\xff\xff\xbf\x32\0\0\0\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\
+\x6c\xff\xff\xff\x71\xa5\x55\xff\0\0\0\0\xbf\x34\0\0\0\0\0\0\x15\x05\x02\0\0\0\
+\0\0\xbf\xa4\0\0\0\0\0\0\x07\x04\0\0\x8c\xff\xff\xff\x65\x01\x01\0\xff\xff\xff\
+\xff\xbf\x43\0\0\0\0\0\0\x61\x21\x04\0\0\0\0\0\x67\x01\0\0\x20\0\0\0\x61\x24\0\
+\0\0\0\0\0\x4f\x41\0\0\0\0\0\0\x7b\x1a\xa0\xff\0\0\0\0\x61\x21\x08\0\0\0\0\0\
+\x61\x22\x0c\0\0\0\0\0\x67\x02\0\0\x20\0\0\0\x4f\x12\0\0\0\0\0\0\x7b\x2a\xa8\
+\xff\0\0\0\0\x61\x31\0\0\0\0\0\0\x61\x32\x04\0\0\0\0\0\x61\x34\x08\0\0\0\0\0\
+\x61\x33\x0c\0\0\0\0\0\x69\xa5\x5a\xff\0\0\0\0\x6b\x5a\xc2\xff\0\0\0\0\x69\xa5\
+\x58\xff\0\0\0\0\x6b\x5a\xc0\xff\0\0\0\0\x67\x03\0\0\x20\0\0\0\x4f\x43\0\0\0\0\
+\0\0\x7b\x3a\xb8\xff\0\0\0\0\x67\x02\0\0\x20\0\0\0\x4f\x12\0\0\0\0\0\0\x7b\x2a\
+\xb0\xff\0\0\0\0\x05\0\x6b\0\0\0\0\0\x71\xa2\x52\xff\0\0\0\0\x15\x02\x04\0\0\0\
+\0\0\xbf\x12\0\0\0\0\0\0\x57\x02\0\0\x04\0\0\0\x15\x02\x01\0\0\0\0\0\x05\0\xf7\
+\xfe\0\0\0\0\x57\x01\0\0\x01\0\0\0\x15\x01\xd3\0\0\0\0\0\x61\xa1\x5c\xff\0\0\0\
+\0\x63\x1a\xa0\xff\0\0\0\0\x61\xa1\x60\xff\0\0\0\0\x63\x1a\xa4\xff\0\0\0\0\x05\
+\0\x5e\0\0\0\0\0\x71\xa2\x52\xff\0\0\0\0\x15\x02\x1e\0\0\0\0\0\xbf\x12\0\0\0\0\
+\0\0\x57\x02\0\0\x20\0\0\0\x15\x02\x1b\0\0\0\0\0\xbf\xa2\0\0\0\0\0\0\x07\x02\0\
+\0\x5c\xff\xff\xff\x71\xa4\x54\xff\0\0\0\0\xbf\x23\0\0\0\0\0\0\x15\x04\x02\0\0\
+\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\x7c\xff\xff\xff\x57\x01\0\0\0\x01\0\0\
+\x15\x01\x01\0\0\0\0\0\xbf\x32\0\0\0\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\x6c\
+\xff\xff\xff\x71\xa5\x55\xff\0\0\0\0\xbf\x34\0\0\0\0\0\0\x15\x05\x02\0\0\0\0\0\
+\xbf\xa4\0\0\0\0\0\0\x07\x04\0\0\x8c\xff\xff\xff\x15\x01\xc3\xff\0\0\0\0\x05\0\
+\xc1\xff\0\0\0\0\xb7\x09\0\0\x3c\0\0\0\x79\xa7\x20\xff\0\0\0\0\x67\0\0\0\x20\0\
+\0\0\x77\0\0\0\x20\0\0\0\x15\0\xa5\xfe\0\0\0\0\x05\0\xb0\0\0\0\0\0\x15\x09\x07\
+\xff\x87\0\0\0\x05\0\xa2\xfe\0\0\0\0\xbf\x12\0\0\0\0\0\0\x57\x02\0\0\x08\0\0\0\
+\x15\x02\xab\0\0\0\0\0\xbf\xa2\0\0\0\0\0\0\x07\x02\0\0\x5c\xff\xff\xff\x71\xa4\
+\x54\xff\0\0\0\0\xbf\x23\0\0\0\0\0\0\x15\x04\x02\0\0\0\0\0\xbf\xa3\0\0\0\0\0\0\
+\x07\x03\0\0\x7c\xff\xff\xff\x57\x01\0\0\x40\0\0\0\x15\x01\x01\0\0\0\0\0\xbf\
+\x32\0\0\0\0\0\0\x61\x23\x04\0\0\0\0\0\x67\x03\0\0\x20\0\0\0\x61\x24\0\0\0\0\0\
+\0\x4f\x43\0\0\0\0\0\0\x7b\x3a\xa0\xff\0\0\0\0\x61\x23\x08\0\0\0\0\0\x61\x22\
+\x0c\0\0\0\0\0\x67\x02\0\0\x20\0\0\0\x4f\x32\0\0\0\0\0\0\x7b\x2a\xa8\xff\0\0\0\
+\0\x15\x01\x1c\0\0\0\0\0\x71\xa1\x55\xff\0\0\0\0\x15\x01\x1a\0\0\0\0\0\x61\xa1\
+\x98\xff\0\0\0\0\x67\x01\0\0\x20\0\0\0\x61\xa2\x94\xff\0\0\0\0\x4f\x21\0\0\0\0\
+\0\0\x7b\x1a\xb8\xff\0\0\0\0\x61\xa1\x90\xff\0\0\0\0\x67\x01\0\0\x20\0\0\0\x61\
+\xa2\x8c\xff\0\0\0\0\x05\0\x19\0\0\0\0\0\xb7\x01\0\0\x01\0\0\0\x73\x1a\x52\xff\
+\0\0\0\0\xb7\x01\0\0\0\0\0\0\x7b\x1a\xd0\xff\0\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\
+\x03\0\0\xd0\xff\xff\xff\xbf\x81\0\0\0\0\0\0\x79\xa2\x40\xff\0\0\0\0\xb7\x04\0\
+\0\x08\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\0\0\0\x67\0\0\0\x20\0\0\0\x77\
+\0\0\0\x20\0\0\0\x55\0\x7d\0\0\0\0\0\x05\0\x88\xfe\0\0\0\0\xb7\x09\0\0\x2b\0\0\
+\0\x05\0\xc6\xff\0\0\0\0\x61\xa1\x78\xff\0\0\0\0\x67\x01\0\0\x20\0\0\0\x61\xa2\
+\x74\xff\0\0\0\0\x4f\x21\0\0\0\0\0\0\x7b\x1a\xb8\xff\0\0\0\0\x61\xa1\x70\xff\0\
+\0\0\0\x67\x01\0\0\x20\0\0\0\x61\xa2\x6c\xff\0\0\0\0\x4f\x21\0\0\0\0\0\0\x7b\
+\x1a\xb0\xff\0\0\0\0\xb7\x01\0\0\0\0\0\0\x07\x07\0\0\x04\0\0\0\x61\x03\0\0\0\0\
+\0\0\xb7\x05\0\0\0\0\0\0\x05\0\x4e\0\0\0\0\0\xaf\x52\0\0\0\0\0\0\xbf\x75\0\0\0\
+\0\0\0\x0f\x15\0\0\0\0\0\0\x71\x55\0\0\0\0\0\0\x67\x03\0\0\x01\0\0\0\xbf\x50\0\
+\0\0\0\0\0\x77\0\0\0\x07\0\0\0\x4f\x03\0\0\0\0\0\0\xbf\x40\0\0\0\0\0\0\x67\0\0\
+\0\x39\0\0\0\xc7\0\0\0\x3f\0\0\0\x5f\x30\0\0\0\0\0\0\xaf\x02\0\0\0\0\0\0\xbf\
+\x50\0\0\0\0\0\0\x77\0\0\0\x06\0\0\0\x57\0\0\0\x01\0\0\0\x67\x03\0\0\x01\0\0\0\
+\x4f\x03\0\0\0\0\0\0\xbf\x40\0\0\0\0\0\0\x67\0\0\0\x3a\0\0\0\xc7\0\0\0\x3f\0\0\
+\0\x5f\x30\0\0\0\0\0\0\xaf\x02\0\0\0\0\0\0\x67\x03\0\0\x01\0\0\0\xbf\x50\0\0\0\
+\0\0\0\x77\0\0\0\x05\0\0\0\x57\0\0\0\x01\0\0\0\x4f\x03\0\0\0\0\0\0\xbf\x40\0\0\
+\0\0\0\0\x67\0\0\0\x3b\0\0\0\xc7\0\0\0\x3f\0\0\0\x5f\x30\0\0\0\0\0\0\xaf\x02\0\
+\0\0\0\0\0\x67\x03\0\0\x01\0\0\0\xbf\x50\0\0\0\0\0\0\x77\0\0\0\x04\0\0\0\x57\0\
+\0\0\x01\0\0\0\x4f\x03\0\0\0\0\0\0\xbf\x40\0\0\0\0\0\0\x67\0\0\0\x3c\0\0\0\xc7\
+\0\0\0\x3f\0\0\0\x5f\x30\0\0\0\0\0\0\xaf\x02\0\0\0\0\0\0\xbf\x50\0\0\0\0\0\0\
+\x77\0\0\0\x03\0\0\0\x57\0\0\0\x01\0\0\0\x67\x03\0\0\x01\0\0\0\x4f\x03\0\0\0\0\
+\0\0\xbf\x40\0\0\0\0\0\0\x67\0\0\0\x3d\0\0\0\xc7\0\0\0\x3f\0\0\0\x5f\x30\0\0\0\
+\0\0\0\xaf\x02\0\0\0\0\0\0\xbf\x50\0\0\0\0\0\0\x77\0\0\0\x02\0\0\0\x57\0\0\0\
+\x01\0\0\0\x67\x03\0\0\x01\0\0\0\x4f\x03\0\0\0\0\0\0\xbf\x40\0\0\0\0\0\0\x67\0\
+\0\0\x3e\0\0\0\xc7\0\0\0\x3f\0\0\0\x5f\x30\0\0\0\0\0\0\xaf\x02\0\0\0\0\0\0\xbf\
+\x50\0\0\0\0\0\0\x77\0\0\0\x01\0\0\0\x57\0\0\0\x01\0\0\0\x67\x03\0\0\x01\0\0\0\
+\x4f\x03\0\0\0\0\0\0\x57\x04\0\0\x01\0\0\0\x87\x04\0\0\0\0\0\0\x5f\x34\0\0\0\0\
+\0\0\xaf\x42\0\0\0\0\0\0\x57\x05\0\0\x01\0\0\0\x67\x03\0\0\x01\0\0\0\x4f\x53\0\
+\0\0\0\0\0\x07\x01\0\0\x01\0\0\0\xbf\x25\0\0\0\0\0\0\x15\x01\x0b\0\x24\0\0\0\
+\xbf\xa2\0\0\0\0\0\0\x07\x02\0\0\xa0\xff\xff\xff\x0f\x12\0\0\0\0\0\0\x71\x24\0\
+\0\0\0\0\0\xbf\x40\0\0\0\0\0\0\x67\0\0\0\x38\0\0\0\xc7\0\0\0\x38\0\0\0\xb7\x02\
+\0\0\0\0\0\0\x65\0\xa9\xff\xff\xff\xff\xff\xbf\x32\0\0\0\0\0\0\x05\0\xa7\xff\0\
+\0\0\0\xbf\x21\0\0\0\0\0\0\x67\x01\0\0\x20\0\0\0\x77\x01\0\0\x20\0\0\0\x15\x01\
+\x0e\0\0\0\0\0\x71\x63\x06\0\0\0\0\0\x71\x64\x07\0\0\0\0\0\x67\x04\0\0\x08\0\0\
+\0\x4f\x34\0\0\0\0\0\0\x3f\x41\0\0\0\0\0\0\x2f\x41\0\0\0\0\0\0\x1f\x12\0\0\0\0\
+\0\0\x63\x2a\x50\xff\0\0\0\0\xbf\xa2\0\0\0\0\0\0\x07\x02\0\0\x50\xff\xff\xff\
+\x18\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x85\0\0\0\x01\0\0\0\x55\0\x05\0\0\0\0\0\
+\x71\x61\x08\0\0\0\0\0\x71\x60\x09\0\0\0\0\0\x67\0\0\0\x08\0\0\0\x4f\x10\0\0\0\
+\0\0\0\x95\0\0\0\0\0\0\0\x69\0\0\0\0\0\0\0\x05\0\xfd\xff\0\0\0\0\x02\0\0\0\x04\
+\0\0\0\x0a\0\0\0\x01\0\0\0\0\0\0\0\x02\0\0\0\x04\0\0\0\x28\0\0\0\x01\0\0\0\0\0\
+\0\0\x02\0\0\0\x04\0\0\0\x02\0\0\0\x80\0\0\0\0\0\0\0\x47\x50\x4c\x20\x76\x32\0\
+\0\0\0\0\0\x10\0\0\0\0\0\0\0\x01\x7a\x52\0\x08\x7c\x0b\x01\x0c\0\0\0\x18\0\0\0\
+\x18\0\0\0\0\0\0\0\0\0\0\0\xd8\x13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
+\0\0\0\0\0\0\0\0\0\0\0\0\xa0\0\0\0\x04\0\xf1\xff\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
+\0\x60\x02\0\0\0\0\x03\0\x20\x02\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x3f\x02\0\0\0\0\
+\x03\0\xd0\x0f\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xed\x01\0\0\0\0\x03\0\x10\x10\0\0\0\
+\0\0\0\0\0\0\0\0\0\0\0\xd4\x01\0\0\0\0\x03\0\x20\x10\0\0\0\0\0\0\0\0\0\0\0\0\0\
+\0\xa3\x01\0\0\0\0\x03\0\xb8\x12\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x63\x01\0\0\0\0\
+\x03\0\x48\x10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x2a\x01\0\0\0\0\x03\0\x10\x13\0\0\0\
+\0\0\0\0\0\0\0\0\0\0\0\xe1\0\0\0\0\0\x03\0\xa0\x13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
+\x2e\x02\0\0\0\0\x03\0\x28\x02\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x68\x02\0\0\0\0\x03\
+\0\xc0\x13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x36\x02\0\0\0\0\x03\0\xc8\x13\0\0\0\0\0\
+\0\0\0\0\0\0\0\0\0\x22\x01\0\0\0\0\x03\0\xe8\x02\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
+\x02\x01\0\0\0\0\x03\0\x40\x03\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xd9\0\0\0\0\0\x03\0\
+\xf8\x04\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x26\x02\0\0\0\0\x03\0\x20\x0e\0\0\0\0\0\0\
+\0\0\0\0\0\0\0\0\xcc\x01\0\0\0\0\x03\0\x60\x06\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x9b\
+\x01\0\0\0\0\x03\0\xc8\x06\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x5b\x01\0\0\0\0\x03\0\
+\x20\x07\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x7c\x01\0\0\0\0\x03\0\x48\x08\0\0\0\0\0\0\
+\0\0\0\0\0\0\0\0\x53\x01\0\0\0\0\x03\0\xb8\x08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x1a\
+\x01\0\0\0\0\x03\0\xe0\x08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x84\x01\0\0\0\0\x03\0\
+\xb8\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x1e\x02\0\0\0\0\x03\0\xd8\x09\0\0\0\0\0\0\0\
+\0\0\0\0\0\0\0\xc4\x01\0\0\0\0\x03\0\x70\x08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x93\
+\x01\0\0\0\0\x03\0\xa8\x08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x74\x01\0\0\0\0\x03\0\
+\xf0\x0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x4b\x01\0\0\0\0\x03\0\0\x0a\0\0\0\0\0\0\0\
+\0\0\0\0\0\0\0\x12\x01\0\0\0\0\x03\0\x10\x0a\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xfa\0\
+\0\0\0\0\x03\0\xc0\x0a\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x58\x02\0\0\0\0\x03\0\x88\
+\x0a\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x16\x02\0\0\0\0\x03\0\xb8\x0a\0\0\0\0\0\0\0\0\
+\0\0\0\0\0\0\xe5\x01\0\0\0\0\x03\0\xc0\x0f\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xbc\x01\
+\0\0\0\0\x03\0\0\x0e\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x8b\x01\0\0\0\0\x03\0\x18\x0e\
+\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xd1\0\0\0\0\0\x03\0\0\x04\0\0\0\0\0\0\0\0\0\0\0\0\
+\0\0\x50\x02\0\0\0\0\x03\0\x20\x04\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x0e\x02\0\0\0\0\
+\x03\0\x48\x0f\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x6c\x01\0\0\0\0\x03\0\xb0\x04\0\0\0\
+\0\0\0\0\0\0\0\0\0\0\0\x43\x01\0\0\0\0\x03\0\xc8\x0c\0\0\0\0\0\0\0\0\0\0\0\0\0\
+\0\xc9\0\0\0\0\0\x03\0\xf8\x0c\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x06\x02\0\0\0\0\x03\
+\0\xd0\x0a\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x3b\x01\0\0\0\0\x03\0\x98\x0b\0\0\0\0\0\
+\0\0\0\0\0\0\0\0\0\xf2\0\0\0\0\0\x03\0\xb8\x0b\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x48\
+\x02\0\0\0\0\x03\0\xf0\x0b\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xfe\x01\0\0\0\0\x03\0\
+\xf8\x0b\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xdd\x01\0\0\0\0\x03\0\0\x0c\0\0\0\0\0\0\0\
+\0\0\0\0\0\0\0\xb4\x01\0\0\0\0\x03\0\x30\x0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x0a\
+\x01\0\0\0\0\x03\0\x90\x0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xc1\0\0\0\0\0\x03\0\xa8\
+\x0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xba\0\0\0\0\0\x03\0\xd0\x01\0\0\0\0\0\0\0\0\0\
+\0\0\0\0\0\xf6\x01\0\0\0\0\x03\0\xe0\x0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xac\x01\0\
+\0\0\0\x03\0\x30\x0e\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x33\x01\0\0\0\0\x03\0\x80\x0e\
+\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xea\0\0\0\0\0\x03\0\x98\x0e\0\0\0\0\0\0\0\0\0\0\0\
+\0\0\0\0\0\0\0\x03\0\x03\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x6b\0\0\0\x11\0\x06\
+\0\0\0\0\0\0\0\0\0\x07\0\0\0\0\0\0\0\x25\0\0\0\x11\0\x05\0\0\0\0\0\0\0\0\0\x14\
+\0\0\0\0\0\0\0\x82\0\0\0\x11\0\x05\0\x28\0\0\0\0\0\0\0\x14\0\0\0\0\0\0\0\x01\0\
+\0\0\x11\0\x05\0\x14\0\0\0\0\0\0\0\x14\0\0\0\0\0\0\0\x40\0\0\0\x12\0\x03\0\0\0\
+\0\0\0\0\0\0\xd8\x13\0\0\0\0\0\0\x28\0\0\0\0\0\0\0\x01\0\0\0\x3a\0\0\0\x50\0\0\
+\0\0\0\0\0\x01\0\0\0\x3c\0\0\0\x80\x13\0\0\0\0\0\0\x01\0\0\0\x3b\0\0\0\x1c\0\0\
+\0\0\0\0\0\x01\0\0\0\x38\0\0\0\0\x74\x61\x70\x5f\x72\x73\x73\x5f\x6d\x61\x70\
+\x5f\x74\x6f\x65\x70\x6c\x69\x74\x7a\x5f\x6b\x65\x79\0\x2e\x74\x65\x78\x74\0\
+\x6d\x61\x70\x73\0\x74\x61\x70\x5f\x72\x73\x73\x5f\x6d\x61\x70\x5f\x63\x6f\x6e\
+\x66\x69\x67\x75\x72\x61\x74\x69\x6f\x6e\x73\0\x74\x75\x6e\x5f\x72\x73\x73\x5f\
+\x73\x74\x65\x65\x72\x69\x6e\x67\x5f\x70\x72\x6f\x67\0\x2e\x72\x65\x6c\x74\x75\
+\x6e\x5f\x72\x73\x73\x5f\x73\x74\x65\x65\x72\x69\x6e\x67\0\x5f\x6c\x69\x63\x65\
+\x6e\x73\x65\0\x2e\x72\x65\x6c\x2e\x65\x68\x5f\x66\x72\x61\x6d\x65\0\x74\x61\
+\x70\x5f\x72\x73\x73\x5f\x6d\x61\x70\x5f\x69\x6e\x64\x69\x72\x65\x63\x74\x69\
+\x6f\x6e\x5f\x74\x61\x62\x6c\x65\0\x72\x73\x73\x2e\x62\x70\x66\x2e\x63\0\x2e\
+\x73\x74\x72\x74\x61\x62\0\x2e\x73\x79\x6d\x74\x61\x62\0\x4c\x42\x42\x30\x5f\
+\x39\0\x4c\x42\x42\x30\x5f\x38\x39\0\x4c\x42\x42\x30\x5f\x36\x39\0\x4c\x42\x42\
+\x30\x5f\x35\x39\0\x4c\x42\x42\x30\x5f\x31\x39\0\x4c\x42\x42\x30\x5f\x31\x30\
+\x39\0\x4c\x42\x42\x30\x5f\x39\x38\0\x4c\x42\x42\x30\x5f\x37\x38\0\x4c\x42\x42\
+\x30\x5f\x34\x38\0\x4c\x42\x42\x30\x5f\x31\x38\0\x4c\x42\x42\x30\x5f\x38\x37\0\
+\x4c\x42\x42\x30\x5f\x34\x37\0\x4c\x42\x42\x30\x5f\x33\x37\0\x4c\x42\x42\x30\
+\x5f\x31\x37\0\x4c\x42\x42\x30\x5f\x31\x30\x37\0\x4c\x42\x42\x30\x5f\x39\x36\0\
+\x4c\x42\x42\x30\x5f\x37\x36\0\x4c\x42\x42\x30\x5f\x36\x36\0\x4c\x42\x42\x30\
+\x5f\x34\x36\0\x4c\x42\x42\x30\x5f\x33\x36\0\x4c\x42\x42\x30\x5f\x32\x36\0\x4c\
+\x42\x42\x30\x5f\x31\x30\x36\0\x4c\x42\x42\x30\x5f\x36\x35\0\x4c\x42\x42\x30\
+\x5f\x34\x35\0\x4c\x42\x42\x30\x5f\x33\x35\0\x4c\x42\x42\x30\x5f\x34\0\x4c\x42\
+\x42\x30\x5f\x35\x34\0\x4c\x42\x42\x30\x5f\x34\x34\0\x4c\x42\x42\x30\x5f\x32\
+\x34\0\x4c\x42\x42\x30\x5f\x31\x30\x34\0\x4c\x42\x42\x30\x5f\x39\x33\0\x4c\x42\
+\x42\x30\x5f\x38\x33\0\x4c\x42\x42\x30\x5f\x35\x33\0\x4c\x42\x42\x30\x5f\x34\
+\x33\0\x4c\x42\x42\x30\x5f\x32\x33\0\x4c\x42\x42\x30\x5f\x31\x30\x33\0\x4c\x42\
+\x42\x30\x5f\x38\x32\0\x4c\x42\x42\x30\x5f\x35\x32\0\x4c\x42\x42\x30\x5f\x31\
+\x30\x32\0\x4c\x42\x42\x30\x5f\x39\x31\0\x4c\x42\x42\x30\x5f\x38\x31\0\x4c\x42\
+\x42\x30\x5f\x37\x31\0\x4c\x42\x42\x30\x5f\x36\x31\0\x4c\x42\x42\x30\x5f\x35\
+\x31\0\x4c\x42\x42\x30\x5f\x34\x31\0\x4c\x42\x42\x30\x5f\x32\x31\0\x4c\x42\x42\
+\x30\x5f\x31\x31\0\x4c\x42\x42\x30\x5f\x31\x31\x31\0\x4c\x42\x42\x30\x5f\x31\
+\x30\x31\0\x4c\x42\x42\x30\x5f\x38\x30\0\x4c\x42\x42\x30\x5f\x36\x30\0\x4c\x42\
+\x42\x30\x5f\x35\x30\0\x4c\x42\x42\x30\x5f\x31\x30\0\x4c\x42\x42\x30\x5f\x31\
+\x31\x30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
+\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xaa\
+\0\0\0\x03\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xa0\x1a\0\0\0\0\0\0\x71\x02\0\
+\0\0\0\0\0\0\0\0\0\0\0\0\0\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x1a\0\0\0\x01\0\0\
+\0\x06\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x40\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
+\0\0\0\0\x04\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x5a\0\0\0\x01\0\0\0\x06\0\0\0\0\0\0\
+\0\0\0\0\0\0\0\0\0\x40\0\0\0\0\0\0\0\xd8\x13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x08\0\
+\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x56\0\0\0\x09\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
+\0\x60\x1a\0\0\0\0\0\0\x30\0\0\0\0\0\0\0\x09\0\0\0\x03\0\0\0\x08\0\0\0\0\0\0\0\
+\x10\0\0\0\0\0\0\0\x20\0\0\0\x01\0\0\0\x03\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x18\
+\x14\0\0\0\0\0\0\x3c\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x04\0\0\0\0\0\0\0\0\0\0\0\0\
+\0\0\0\x6c\0\0\0\x01\0\0\0\x03\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x54\x14\0\0\0\0\0\
+\0\x07\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x78\0\0\
+\0\x01\0\0\0\x02\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x60\x14\0\0\0\0\0\0\x30\0\0\0\0\
+\0\0\0\0\0\0\0\0\0\0\0\x08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x74\0\0\0\x09\0\0\0\0\
+\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x90\x1a\0\0\0\0\0\0\x10\0\0\0\0\0\0\0\x09\0\0\0\
+\x07\0\0\0\x08\0\0\0\0\0\0\0\x10\0\0\0\0\0\0\0\xb2\0\0\0\x02\0\0\0\0\0\0\0\0\0\
+\0\0\0\0\0\0\0\0\0\0\x90\x14\0\0\0\0\0\0\xd0\x05\0\0\0\0\0\0\x01\0\0\0\x39\0\0\
+\0\x08\0\0\0\0\0\0\0\x18\0\0\0\0\0\0\0";
+
+	return 0;
+err:
+	bpf_object__destroy_skeleton(s);
+	return -1;
+}
+
+#endif /* __RSS_BPF_SKEL_H__ */
diff --git a/ebpf/trace-events b/ebpf/trace-events
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/ebpf/trace-events
@@ -XXX,XX +XXX,XX @@
+# See docs/devel/tracing.txt for syntax documentation.
+
+# ebpf-rss.c
+ebpf_error(const char *s1, const char *s2) "error in %s: %s"
diff --git a/ebpf/trace.h b/ebpf/trace.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/ebpf/trace.h
@@ -0,0 +1 @@
+#include "trace/trace-ebpf.h"
diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ if not get_option('fuse_lseek').disabled()
   endif
 endif
 
+# libbpf
+libbpf = dependency('libbpf', required: get_option('bpf'), method: 'pkg-config')
+if libbpf.found() and not cc.links('''
+   #include <bpf/libbpf.h>
+   int main(void)
+   {
+     bpf_object__destroy_skeleton(NULL);
+     return 0;
+   }''', dependencies: libbpf)
+  libbpf = not_found
+  if get_option('bpf').enabled()
+    error('libbpf skeleton test failed')
+  else
+    warning('libbpf skeleton test failed, disabling')
+  endif
+endif
+
 if get_option('cfi')
   cfi_flags=[]
   # Check for dependency on LTO
@@ -XXX,XX +XXX,XX @@ endif
 config_host_data.set('CONFIG_GTK', gtk.found())
 config_host_data.set('CONFIG_LIBATTR', have_old_libattr)
 config_host_data.set('CONFIG_LIBCAP_NG', libcap_ng.found())
+config_host_data.set('CONFIG_EBPF', libbpf.found())
 config_host_data.set('CONFIG_LIBISCSI', libiscsi.found())
 config_host_data.set('CONFIG_LIBNFS', libnfs.found())
 config_host_data.set('CONFIG_RBD', rbd.found())
@@ -XXX,XX +XXX,XX @@ if have_system
     'backends',
     'backends/tpm',
     'chardev',
+    'ebpf',
     'hw/9pfs',
     'hw/acpi',
     'hw/adc',
@@ -XXX,XX +XXX,XX @@ subdir('accel')
 subdir('plugins')
 subdir('bsd-user')
 subdir('linux-user')
+subdir('ebpf')
+
+common_ss.add(libbpf)
 
 bsd_user_ss.add(files('gdbstub.c'))
 specific_ss.add_all(when: 'CONFIG_BSD_USER', if_true: bsd_user_ss)
@@ -XXX,XX +XXX,XX @@ summary_info += {'RDMA support':      config_host.has_key('CONFIG_RDMA')}
 summary_info += {'PVRDMA support':    config_host.has_key('CONFIG_PVRDMA')}
 summary_info += {'fdt support':       fdt_opt == 'disabled' ? false : fdt_opt}
 summary_info += {'libcap-ng support': libcap_ng.found()}
+summary_info += {'bpf support': libbpf.found()}
 # TODO: add back protocol and server version
 summary_info += {'spice support':     config_host.has_key('CONFIG_SPICE')}
 summary_info += {'rbd support':       rbd.found()}
diff --git a/meson_options.txt b/meson_options.txt
index XXXXXXX..XXXXXXX 100644
--- a/meson_options.txt
+++ b/meson_options.txt
@@ -XXX,XX +XXX,XX @@ option('bzip2', type : 'feature', value : 'auto',
        description: 'bzip2 support for DMG images')
 option('cap_ng', type : 'feature', value : 'auto',
        description: 'cap_ng support')
+option('bpf', type : 'feature', value : 'auto',
+        description: 'eBPF support')
 option('cocoa', type : 'feature', value : 'auto',
        description: 'Cocoa user interface (macOS only)')
 option('curl', type : 'feature', value : 'auto',
-- 
2.7.4

From: Andrew Melnychenko <andrew@daynix.com>

When RSS is enabled the device tries to load the eBPF program
to select RX virtqueue in the TUN. If eBPF can be loaded
the RSS will function also with vhost (works with kernel 5.8 and later).
Software RSS is used as a fallback with vhost=off when eBPF can't be loaded
or when hash population requested by the guest.

Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
Signed-off-by: Andrew Melnychenko <andrew@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/vhost_net.c             |   3 ++
 hw/net/virtio-net.c            | 116 +++++++++++++++++++++++++++++++++++++++--
 include/hw/virtio/virtio-net.h |   4 ++
 net/vhost-vdpa.c               |   2 +
 4 files changed, 122 insertions(+), 3 deletions(-)

diff --git a/hw/net/vhost_net.c b/hw/net/vhost_net.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/vhost_net.c
+++ b/hw/net/vhost_net.c
@@ -XXX,XX +XXX,XX @@ static const int kernel_feature_bits[] = {
     VIRTIO_NET_F_MTU,
     VIRTIO_F_IOMMU_PLATFORM,
     VIRTIO_F_RING_PACKED,
+    VIRTIO_NET_F_HASH_REPORT,
     VHOST_INVALID_FEATURE_BIT
 };
 
@@ -XXX,XX +XXX,XX @@ static const int user_feature_bits[] = {
     VIRTIO_NET_F_MTU,
     VIRTIO_F_IOMMU_PLATFORM,
     VIRTIO_F_RING_PACKED,
+    VIRTIO_NET_F_RSS,
+    VIRTIO_NET_F_HASH_REPORT,
 
     /* This bit implies RARP isn't sent by QEMU out of band */
     VIRTIO_NET_F_GUEST_ANNOUNCE,
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -XXX,XX +XXX,XX @@ static uint64_t virtio_net_get_features(VirtIODevice *vdev, uint64_t features,
         return features;
     }
 
-    virtio_clear_feature(&features, VIRTIO_NET_F_RSS);
-    virtio_clear_feature(&features, VIRTIO_NET_F_HASH_REPORT);
+    if (!ebpf_rss_is_loaded(&n->ebpf_rss)) {
+        virtio_clear_feature(&features, VIRTIO_NET_F_RSS);
+    }
     features = vhost_net_get_features(get_vhost_net(nc->peer), features);
     vdev->backend_features = features;
 
@@ -XXX,XX +XXX,XX @@ static int virtio_net_handle_announce(VirtIONet *n, uint8_t cmd,
     }
 }
 
+static void virtio_net_detach_epbf_rss(VirtIONet *n);
+
 static void virtio_net_disable_rss(VirtIONet *n)
 {
     if (n->rss_data.enabled) {
         trace_virtio_net_rss_disable();
     }
     n->rss_data.enabled = false;
+
+    virtio_net_detach_epbf_rss(n);
+}
+
+static bool virtio_net_attach_ebpf_to_backend(NICState *nic, int prog_fd)
+{
+    NetClientState *nc = qemu_get_peer(qemu_get_queue(nic), 0);
+    if (nc == NULL || nc->info->set_steering_ebpf == NULL) {
+        return false;
+    }
+
+    return nc->info->set_steering_ebpf(nc, prog_fd);
+}
+
+static void rss_data_to_rss_config(struct VirtioNetRssData *data,
+                                   struct EBPFRSSConfig *config)
+{
+    config->redirect = data->redirect;
+    config->populate_hash = data->populate_hash;
+    config->hash_types = data->hash_types;
+    config->indirections_len = data->indirections_len;
+    config->default_queue = data->default_queue;
+}
+
+static bool virtio_net_attach_epbf_rss(VirtIONet *n)
+{
+    struct EBPFRSSConfig config = {};
+
+    if (!ebpf_rss_is_loaded(&n->ebpf_rss)) {
+        return false;
+    }
+
+    rss_data_to_rss_config(&n->rss_data, &config);
+
+    if (!ebpf_rss_set_all(&n->ebpf_rss, &config,
+                          n->rss_data.indirections_table, n->rss_data.key)) {
+        return false;
+    }
+
+    if (!virtio_net_attach_ebpf_to_backend(n->nic, n->ebpf_rss.program_fd)) {
+        return false;
+    }
+
+    return true;
+}
+
+static void virtio_net_detach_epbf_rss(VirtIONet *n)
+{
+    virtio_net_attach_ebpf_to_backend(n->nic, -1);
+}
+
+static bool virtio_net_load_ebpf(VirtIONet *n)
+{
+    if (!virtio_net_attach_ebpf_to_backend(n->nic, -1)) {
+        /* backend does't support steering ebpf */
+        return false;
+    }
+
+    return ebpf_rss_load(&n->ebpf_rss);
+}
+
+static void virtio_net_unload_ebpf(VirtIONet *n)
+{
+    virtio_net_attach_ebpf_to_backend(n->nic, -1);
+    ebpf_rss_unload(&n->ebpf_rss);
 }
 
 static uint16_t virtio_net_handle_rss(VirtIONet *n,
@@ -XXX,XX +XXX,XX @@ static uint16_t virtio_net_handle_rss(VirtIONet *n,
         goto error;
     }
     n->rss_data.enabled = true;
+
+    if (!n->rss_data.populate_hash) {
+        if (!virtio_net_attach_epbf_rss(n)) {
+            /* EBPF must be loaded for vhost */
+            if (get_vhost_net(qemu_get_queue(n->nic)->peer)) {
+                warn_report("Can't load eBPF RSS for vhost");
+                goto error;
+            }
+            /* fallback to software RSS */
+            warn_report("Can't load eBPF RSS - fallback to software RSS");
+            n->rss_data.enabled_software_rss = true;
+        }
+    } else {
+        /* use software RSS for hash populating */
+        /* and detach eBPF if was loaded before */
+        virtio_net_detach_epbf_rss(n);
+        n->rss_data.enabled_software_rss = true;
+    }
+
     trace_virtio_net_rss_enable(n->rss_data.hash_types,
                                 n->rss_data.indirections_len,
                                 temp.b);
@@ -XXX,XX +XXX,XX @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
         return -1;
     }
 
-    if (!no_rss && n->rss_data.enabled) {
+    if (!no_rss && n->rss_data.enabled && n->rss_data.enabled_software_rss) {
         int index = virtio_net_process_rss(nc, buf, size);
         if (index >= 0) {
             NetClientState *nc2 = qemu_get_subqueue(n->nic, index);
@@ -XXX,XX +XXX,XX @@ static int virtio_net_post_load_device(void *opaque, int version_id)
     }
 
     if (n->rss_data.enabled) {
+        n->rss_data.enabled_software_rss = n->rss_data.populate_hash;
+        if (!n->rss_data.populate_hash) {
+            if (!virtio_net_attach_epbf_rss(n)) {
+                if (get_vhost_net(qemu_get_queue(n->nic)->peer)) {
+                    warn_report("Can't post-load eBPF RSS for vhost");
+                } else {
+                    warn_report("Can't post-load eBPF RSS - "
+                                "fallback to software RSS");
+                    n->rss_data.enabled_software_rss = true;
+                }
+            }
+        }
+
         trace_virtio_net_rss_enable(n->rss_data.hash_types,
                                     n->rss_data.indirections_len,
                                     sizeof(n->rss_data.key));
@@ -XXX,XX +XXX,XX @@ static void virtio_net_device_realize(DeviceState *dev, Error **errp)
     n->qdev = dev;
 
     net_rx_pkt_init(&n->rx_pkt, false);
+
+    if (virtio_has_feature(n->host_features, VIRTIO_NET_F_RSS)) {
+        virtio_net_load_ebpf(n);
+    }
 }
 
 static void virtio_net_device_unrealize(DeviceState *dev)
@@ -XXX,XX +XXX,XX @@ static void virtio_net_device_unrealize(DeviceState *dev)
     VirtIONet *n = VIRTIO_NET(dev);
     int i, max_queues;
 
+    if (virtio_has_feature(n->host_features, VIRTIO_NET_F_RSS)) {
+        virtio_net_unload_ebpf(n);
+    }
+
     /* This will stop vhost backend if appropriate. */
     virtio_net_set_status(vdev, 0);
 
@@ -XXX,XX +XXX,XX @@ static void virtio_net_instance_init(Object *obj)
     device_add_bootindex_property(obj, &n->nic_conf.bootindex,
                                   "bootindex", "/ethernet-phy@0",
                                   DEVICE(n));
+
+    ebpf_rss_init(&n->ebpf_rss);
 }
 
 static int virtio_net_pre_save(void *opaque)
diff --git a/include/hw/virtio/virtio-net.h b/include/hw/virtio/virtio-net.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/virtio/virtio-net.h
+++ b/include/hw/virtio/virtio-net.h
@@ -XXX,XX +XXX,XX @@
 #include "qemu/option_int.h"
 #include "qom/object.h"
 
+#include "ebpf/ebpf_rss.h"
+
 #define TYPE_VIRTIO_NET "virtio-net-device"
 OBJECT_DECLARE_SIMPLE_TYPE(VirtIONet, VIRTIO_NET)
 
@@ -XXX,XX +XXX,XX @@ typedef struct VirtioNetRscChain {
 
 typedef struct VirtioNetRssData {
     bool    enabled;
+    bool    enabled_software_rss;
     bool    redirect;
     bool    populate_hash;
     uint32_t hash_types;
@@ -XXX,XX +XXX,XX @@ struct VirtIONet {
     Notifier migration_state;
     VirtioNetRssData rss_data;
     struct NetRxPkt *rx_pkt;
+    struct EBPFRSSContext ebpf_rss;
 };
 
 void virtio_net_set_netclient_name(VirtIONet *n, const char *name,
diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index XXXXXXX..XXXXXXX 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -XXX,XX +XXX,XX @@ const int vdpa_feature_bits[] = {
     VIRTIO_NET_F_MTU,
     VIRTIO_F_IOMMU_PLATFORM,
     VIRTIO_F_RING_PACKED,
+    VIRTIO_NET_F_RSS,
+    VIRTIO_NET_F_HASH_REPORT,
     VIRTIO_NET_F_GUEST_ANNOUNCE,
     VIRTIO_NET_F_STATUS,
     VHOST_INVALID_FEATURE_BIT
-- 
2.7.4

From: Andrew Melnychenko <andrew@daynix.com>

Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
Signed-off-by: Andrew Melnychenko <andrew@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 docs/devel/ebpf_rss.rst | 125 ++++++++++++++++++++++++++++++++++++++++++++++++
 docs/devel/index.rst    |   1 +
 2 files changed, 126 insertions(+)
 create mode 100644 docs/devel/ebpf_rss.rst

diff --git a/docs/devel/ebpf_rss.rst b/docs/devel/ebpf_rss.rst
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/devel/ebpf_rss.rst
@@ -XXX,XX +XXX,XX @@
+===========================
+eBPF RSS virtio-net support
+===========================
+
+RSS(Receive Side Scaling) is used to distribute network packets to guest virtqueues
+by calculating packet hash. Usually every queue is processed then by a specific guest CPU core.
+
+For now there are 2 RSS implementations in qemu:
+- 'in-qemu' RSS (functions if qemu receives network packets, i.e. vhost=off)
+- eBPF RSS (can function with also with vhost=on)
+
+eBPF support (CONFIG_EBPF) is enabled by 'configure' script.
+To enable eBPF RSS support use './configure --enable-bpf'.
+
+If steering BPF is not set for kernel's TUN module, the TUN uses automatic selection
+of rx virtqueue based on lookup table built according to calculated symmetric hash
+of transmitted packets.
+If steering BPF is set for TUN the BPF code calculates the hash of packet header and
+returns the virtqueue number to place the packet to.
+
+Simplified decision formula:
+
+.. code:: C
+
+    queue_index = indirection_table[hash(<packet data>)%<indirection_table size>]
+
+
+Not for all packets, the hash can/should be calculated.
+
+Note: currently, eBPF RSS does not support hash reporting.
+
+eBPF RSS turned on by different combinations of vhost-net, vitrio-net and tap configurations:
+
+- eBPF is used:
+
+        tap,vhost=off & virtio-net-pci,rss=on,hash=off
+
+- eBPF is used:
+
+        tap,vhost=on & virtio-net-pci,rss=on,hash=off
+
+- 'in-qemu' RSS is used:
+
+        tap,vhost=off & virtio-net-pci,rss=on,hash=on
+
+- eBPF is used, hash population feature is not reported to the guest:
+
+        tap,vhost=on & virtio-net-pci,rss=on,hash=on
+
+If CONFIG_EBPF is not set then only 'in-qemu' RSS is supported.
+Also 'in-qemu' RSS, as a fallback, is used if the eBPF program failed to load or set to TUN.
+
+RSS eBPF program
+----------------
+
+RSS program located in ebpf/rss.bpf.skeleton.h generated by bpftool.
+So the program is part of the qemu binary.
+Initially, the eBPF program was compiled by clang and source code located at tools/ebpf/rss.bpf.c.
+Prerequisites to recompile the eBPF program (regenerate ebpf/rss.bpf.skeleton.h):
+
+        llvm, clang, kernel source tree, bpftool
+        Adjust Makefile.ebpf to reflect the location of the kernel source tree
+
+        $ cd tools/ebpf
+        $ make -f Makefile.ebpf
+
+Current eBPF RSS implementation uses 'bounded loops' with 'backward jump instructions' which present in the last kernels.
+Overall eBPF RSS works on kernels 5.8+.
+
+eBPF RSS implementation
+-----------------------
+
+eBPF RSS loading functionality located in ebpf/ebpf_rss.c and ebpf/ebpf_rss.h.
+
+The `struct EBPFRSSContext` structure that holds 4 file descriptors:
+
+- ctx - pointer of the libbpf context.
+- program_fd - file descriptor of the eBPF RSS program.
+- map_configuration - file descriptor of the 'configuration' map. This map contains one element of 'struct EBPFRSSConfig'. This configuration determines eBPF program behavior.
+- map_toeplitz_key - file descriptor of the 'Toeplitz key' map. One element of the 40byte key prepared for the hashing algorithm.
+- map_indirections_table - 128 elements of queue indexes.
+
+`struct EBPFRSSConfig` fields:
+
+- redirect - "boolean" value, should the hash be calculated, on false  - `default_queue` would be used as the final decision.
+- populate_hash - for now, not used. eBPF RSS doesn't support hash reporting.
+- hash_types - binary mask of different hash types. See `VIRTIO_NET_RSS_HASH_TYPE_*` defines. If for packet hash should not be calculated - `default_queue` would be used.
+- indirections_len - length of the indirections table, maximum 128.
+- default_queue - the queue index that used for packet that shouldn't be hashed. For some packets, the hash can't be calculated(g.e ARP).
+
+Functions:
+
+- `ebpf_rss_init()` - sets ctx to NULL, which indicates that EBPFRSSContext is not loaded.
+- `ebpf_rss_load()` - creates 3 maps and loads eBPF program from the rss.bpf.skeleton.h. Returns 'true' on success. After that, program_fd can be used to set steering for TAP.
+- `ebpf_rss_set_all()` - sets values for eBPF maps. `indirections_table` length is in EBPFRSSConfig. `toeplitz_key` is VIRTIO_NET_RSS_MAX_KEY_SIZE aka 40 bytes array.
+- `ebpf_rss_unload()` - close all file descriptors and set ctx to NULL.
+
+Simplified eBPF RSS workflow:
+
+.. code:: C
+
+    struct EBPFRSSConfig config;
+    config.redirect = 1;
+    config.hash_types = VIRTIO_NET_RSS_HASH_TYPE_UDPv4 | VIRTIO_NET_RSS_HASH_TYPE_TCPv4;
+    config.indirections_len = VIRTIO_NET_RSS_MAX_TABLE_LEN;
+    config.default_queue = 0;
+
+    uint16_t table[VIRTIO_NET_RSS_MAX_TABLE_LEN] = {...};
+    uint8_t key[VIRTIO_NET_RSS_MAX_KEY_SIZE] = {...};
+
+    struct EBPFRSSContext ctx;
+    ebpf_rss_init(&ctx);
+    ebpf_rss_load(&ctx);
+    ebpf_rss_set_all(&ctx, &config, table, key);
+    if (net_client->info->set_steering_ebpf != NULL) {
+        net_client->info->set_steering_ebpf(net_client, ctx->program_fd);
+    }
+    ...
+    ebpf_unload(&ctx);
+
+
+NetClientState SetSteeringEBPF()
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+For now, `set_steering_ebpf()` method supported by Linux TAP NetClientState. The method requires an eBPF program file descriptor as an argument.
diff --git a/docs/devel/index.rst b/docs/devel/index.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/devel/index.rst
+++ b/docs/devel/index.rst
@@ -XXX,XX +XXX,XX @@ Contents:
    qom
    block-coroutine-wrapper
    multi-process
+   ebpf_rss
-- 
2.7.4

The following changes since commit 187f35512106501fe9a11057f4d8705431e0026d:

Merge remote-tracking branch 'remotes/stsquad/tags/pull-testing-next-251019-3' into staging (2019-10-26 10:13:48 +0100)

are available in the git repository at:

https://github.com/jasowang/qemu.git tags/net-pull-request

for you to fetch changes up to 1e907a32b77e5d418538453df5945242e43224fa:

COLO-compare: Fix incorrect `if` logic (2019-10-29 10:28:07 +0800)

----------------------------------------------------------------

Changes from V1:

- Fix compling issue

----------------------------------------------------------------
Fan Yang (1):
      COLO-compare: Fix incorrect `if` logic

Michael S. Tsirkin (1):
      virtio: new post_load hook

Mikhail Sennikovsky (1):
      virtio-net: prevent offloads reset on migration

Sven Schnelle (1):
      net: add tulip (dec21143) driver

From: Sven Schnelle <svens@stackframe.org>

This adds the basic functionality to emulate a Tulip NIC.

Implemented are:

- RX and TX functionality
- Perfect Frame Filtering
- Big/Little Endian descriptor support
- 93C46 EEPROM support
- LXT970 PHY

Not implemented, mostly because i had no OS using these functions:

- Imperfect frame filtering
- General Purpose Timer
- Transmit automatic polling
- Boot ROM support
- SIA interface
- Big/Little Endian data buffer conversion

Successfully tested with the following Operating Systems:

- MSDOS with Microsoft Network Client 3.0 and DEC ODI drivers
- HPPA Linux
- Windows XP
- HP-UX

Signed-off-by: Sven Schnelle <svens@stackframe.org>
Message-Id: <20191022155413.4619-1-svens@stackframe.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 MAINTAINERS              |    6 +
 hw/net/Kconfig           |    5 +
 hw/net/Makefile.objs     |    1 +
 hw/net/trace-events      |   14 +
 hw/net/tulip.c           | 1029 ++++++++++++++++++++++++++++++++++++++++++++++
 hw/net/tulip.h           |  267 ++++++++++++
 include/hw/pci/pci_ids.h |    1 +
 7 files changed, 1323 insertions(+)
 create mode 100644 hw/net/tulip.c
 create mode 100644 hw/net/tulip.h

diff --git a/MAINTAINERS b/MAINTAINERS
index XXXXXXX..XXXXXXX 100644
--- a/MAINTAINERS
+++ b/MAINTAINERS
@@ -XXX,XX +XXX,XX @@ M: Stefan Weil <sw@weilnetz.de>
 S: Maintained
 F: hw/net/eepro100.c
 
+tulip
+M: Sven Schnelle <svens@stackframe.org>
+S: Maintained
+F: hw/net/tulip.c
+F: hw/net/tulip.h
+
 Generic Loader
 M: Alistair Francis <alistair@alistair23.me>
 S: Maintained
diff --git a/hw/net/Kconfig b/hw/net/Kconfig
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/Kconfig
+++ b/hw/net/Kconfig
@@ -XXX,XX +XXX,XX @@ config PCNET_PCI
 config PCNET_COMMON
     bool
 
+config TULIP
+    bool
+    default y if PCI_DEVICES
+    depends on PCI
+
 config E1000_PCI
     bool
     default y if PCI_DEVICES
diff --git a/hw/net/Makefile.objs b/hw/net/Makefile.objs
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/Makefile.objs
+++ b/hw/net/Makefile.objs
@@ -XXX,XX +XXX,XX @@ common-obj-$(CONFIG_E1000E_PCI_EXPRESS) += e1000e.o e1000e_core.o e1000x_common.
 common-obj-$(CONFIG_RTL8139_PCI) += rtl8139.o
 common-obj-$(CONFIG_VMXNET3_PCI) += net_tx_pkt.o net_rx_pkt.o
 common-obj-$(CONFIG_VMXNET3_PCI) += vmxnet3.o
+common-obj-$(CONFIG_TULIP) += tulip.o
 
 common-obj-$(CONFIG_SMC91C111) += smc91c111.o
 common-obj-$(CONFIG_LAN9118) += lan9118.o
diff --git a/hw/net/trace-events b/hw/net/trace-events
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/trace-events
+++ b/hw/net/trace-events
@@ -XXX,XX +XXX,XX @@ virtio_net_announce_notify(void) ""
 virtio_net_announce_timer(int round) "%d"
 virtio_net_handle_announce(int round) "%d"
 virtio_net_post_load_device(void)
+
+# tulip.c
+tulip_reg_write(uint64_t addr, const char *name, int size, uint64_t val) "addr 0x%02"PRIx64" (%s) size %d value 0x%08"PRIx64
+tulip_reg_read(uint64_t addr, const char *name, int size, uint64_t val) "addr 0x%02"PRIx64" (%s) size %d value 0x%08"PRIx64
+tulip_receive(const uint8_t *buf, size_t len) "buf %p size %zu"
+tulip_descriptor(const char *prefix, uint32_t addr, uint32_t status, uint32_t control, uint32_t len1, uint32_t len2, uint32_t buf1, uint32_t buf2) "%s 0x%08x: status 0x%08x control 0x%03x len1 %4d len2 %4d buf1 0x%08x buf2 0x%08x"
+tulip_rx_state(const char *state) "RX %s"
+tulip_tx_state(const char *state) "TX %s"
+tulip_irq(uint32_t mask, uint32_t en, const char *state) "mask 0x%08x ie 0x%08x %s"
+tulip_mii_write(int phy, int reg, uint16_t data) "phy 0x%x reg 0x%x data 0x%04x"
+tulip_mii_read(int phy, int reg, uint16_t data) "phy 0x%x, reg 0x%x data 0x%04x"
+tulip_reset(void) ""
+tulip_setup_frame(void) ""
+tulip_setup_filter(int n, uint8_t a, uint8_t b, uint8_t c, uint8_t d, uint8_t e, uint8_t f) "%d: %02x:%02x:%02x:%02x:%02x:%02x"
diff --git a/hw/net/tulip.c b/hw/net/tulip.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/net/tulip.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * QEMU TULIP Emulation
+ *
+ * Copyright (c) 2019 Sven Schnelle <svens@stackframe.org>
+ *
+ * This work is licensed under the GNU GPL license version 2 or later.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/log.h"
+#include "hw/irq.h"
+#include "hw/pci/pci.h"
+#include "hw/qdev-properties.h"
+#include "hw/nvram/eeprom93xx.h"
+#include "migration/vmstate.h"
+#include "sysemu/sysemu.h"
+#include "tulip.h"
+#include "trace.h"
+#include "net/eth.h"
+
+typedef struct TULIPState {
+    PCIDevice dev;
+    MemoryRegion io;
+    MemoryRegion memory;
+    NICConf c;
+    qemu_irq irq;
+    NICState *nic;
+    eeprom_t *eeprom;
+    uint32_t csr[16];
+
+    /* state for MII */
+    uint32_t old_csr9;
+    uint32_t mii_word;
+    uint32_t mii_bitcnt;
+
+    hwaddr current_rx_desc;
+    hwaddr current_tx_desc;
+
+    uint8_t rx_frame[2048];
+    uint8_t tx_frame[2048];
+    uint16_t tx_frame_len;
+    uint16_t rx_frame_len;
+    uint16_t rx_frame_size;
+
+    uint32_t rx_status;
+    uint8_t filter[16][6];
+} TULIPState;
+
+static const VMStateDescription vmstate_pci_tulip = {
+    .name = "tulip",
+    .fields = (VMStateField[]) {
+        VMSTATE_PCI_DEVICE(dev, TULIPState),
+        VMSTATE_UINT32_ARRAY(csr, TULIPState, 16),
+        VMSTATE_UINT32(old_csr9, TULIPState),
+        VMSTATE_UINT32(mii_word, TULIPState),
+        VMSTATE_UINT32(mii_bitcnt, TULIPState),
+        VMSTATE_UINT64(current_rx_desc, TULIPState),
+        VMSTATE_UINT64(current_tx_desc, TULIPState),
+        VMSTATE_BUFFER(rx_frame, TULIPState),
+        VMSTATE_BUFFER(tx_frame, TULIPState),
+        VMSTATE_UINT16(rx_frame_len, TULIPState),
+        VMSTATE_UINT16(tx_frame_len, TULIPState),
+        VMSTATE_UINT16(rx_frame_size, TULIPState),
+        VMSTATE_UINT32(rx_status, TULIPState),
+        VMSTATE_UINT8_2DARRAY(filter, TULIPState, 16, 6),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void tulip_desc_read(TULIPState *s, hwaddr p,
+        struct tulip_descriptor *desc)
+{
+    if (s->csr[0] & CSR0_DBO) {
+        desc->status = ldl_be_pci_dma(&s->dev, p);
+        desc->control = ldl_be_pci_dma(&s->dev, p + 4);
+        desc->buf_addr1 = ldl_be_pci_dma(&s->dev, p + 8);
+        desc->buf_addr2 = ldl_be_pci_dma(&s->dev, p + 12);
+    } else {
+        desc->status = ldl_le_pci_dma(&s->dev, p);
+        desc->control = ldl_le_pci_dma(&s->dev, p + 4);
+        desc->buf_addr1 = ldl_le_pci_dma(&s->dev, p + 8);
+        desc->buf_addr2 = ldl_le_pci_dma(&s->dev, p + 12);
+    }
+}
+
+static void tulip_desc_write(TULIPState *s, hwaddr p,
+        struct tulip_descriptor *desc)
+{
+    if (s->csr[0] & CSR0_DBO) {
+        stl_be_pci_dma(&s->dev, p, desc->status);
+        stl_be_pci_dma(&s->dev, p + 4, desc->control);
+        stl_be_pci_dma(&s->dev, p + 8, desc->buf_addr1);
+        stl_be_pci_dma(&s->dev, p + 12, desc->buf_addr2);
+    } else {
+        stl_le_pci_dma(&s->dev, p, desc->status);
+        stl_le_pci_dma(&s->dev, p + 4, desc->control);
+        stl_le_pci_dma(&s->dev, p + 8, desc->buf_addr1);
+        stl_le_pci_dma(&s->dev, p + 12, desc->buf_addr2);
+    }
+}
+
+static void tulip_update_int(TULIPState *s)
+{
+    uint32_t ie = s->csr[5] & s->csr[7];
+    bool assert = false;
+
+    s->csr[5] &= ~(CSR5_AIS | CSR5_NIS);
+
+    if (ie & (CSR5_TI | CSR5_TU | CSR5_RI | CSR5_GTE | CSR5_ERI)) {
+        s->csr[5] |= CSR5_NIS;
+    }
+
+    if (ie & (CSR5_LC | CSR5_GPI | CSR5_FBE | CSR5_LNF | CSR5_ETI | CSR5_RWT |
+              CSR5_RPS | CSR5_RU | CSR5_UNF | CSR5_LNP_ANC | CSR5_TJT |
+              CSR5_TPS)) {
+        s->csr[5] |= CSR5_AIS;
+    }
+
+    assert = s->csr[5] & s->csr[7] & (CSR5_AIS | CSR5_NIS);
+    trace_tulip_irq(s->csr[5], s->csr[7], assert ? "assert" : "deassert");
+    qemu_set_irq(s->irq, assert);
+}
+
+static bool tulip_rx_stopped(TULIPState *s)
+{
+    return ((s->csr[5] >> CSR5_RS_SHIFT) & CSR5_RS_MASK) == CSR5_RS_STOPPED;
+}
+
+static void tulip_dump_tx_descriptor(TULIPState *s,
+        struct tulip_descriptor *desc)
+{
+    trace_tulip_descriptor("TX ", s->current_tx_desc,
+                desc->status, desc->control >> 22,
+                desc->control & 0x7ff, (desc->control >> 11) & 0x7ff,
+                desc->buf_addr1, desc->buf_addr2);
+}
+
+static void tulip_dump_rx_descriptor(TULIPState *s,
+        struct tulip_descriptor *desc)
+{
+    trace_tulip_descriptor("RX ", s->current_rx_desc,
+                desc->status, desc->control >> 22,
+                desc->control & 0x7ff, (desc->control >> 11) & 0x7ff,
+                desc->buf_addr1, desc->buf_addr2);
+}
+
+static void tulip_next_rx_descriptor(TULIPState *s,
+    struct tulip_descriptor *desc)
+{
+    if (desc->control & RDES1_RER) {
+        s->current_rx_desc = s->csr[3];
+    } else if (desc->control & RDES1_RCH) {
+        s->current_rx_desc = desc->buf_addr2;
+    } else {
+        s->current_rx_desc += sizeof(struct tulip_descriptor) +
+                (((s->csr[0] >> CSR0_DSL_SHIFT) & CSR0_DSL_MASK) << 2);
+    }
+    s->current_rx_desc &= ~3ULL;
+}
+
+static void tulip_copy_rx_bytes(TULIPState *s, struct tulip_descriptor *desc)
+{
+    int len1 = (desc->control >> RDES1_BUF1_SIZE_SHIFT) & RDES1_BUF1_SIZE_MASK;
+    int len2 = (desc->control >> RDES1_BUF2_SIZE_SHIFT) & RDES1_BUF2_SIZE_MASK;
+    int len;
+
+    if (s->rx_frame_len && len1) {
+        if (s->rx_frame_len > len1) {
+            len = len1;
+        } else {
+            len = s->rx_frame_len;
+        }
+        pci_dma_write(&s->dev, desc->buf_addr1, s->rx_frame +
+            (s->rx_frame_size - s->rx_frame_len), len);
+        s->rx_frame_len -= len;
+    }
+
+    if (s->rx_frame_len && len2) {
+        if (s->rx_frame_len > len2) {
+            len = len2;
+        } else {
+            len = s->rx_frame_len;
+        }
+        pci_dma_write(&s->dev, desc->buf_addr2, s->rx_frame +
+            (s->rx_frame_size - s->rx_frame_len), len);
+        s->rx_frame_len -= len;
+    }
+}
+
+static bool tulip_filter_address(TULIPState *s, const uint8_t *addr)
+{
+    static const char broadcast[] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
+    bool ret = false;
+    int i;
+
+    for (i = 0; i < 16 && ret == false; i++) {
+        if (!memcmp(&s->filter[i], addr, ETH_ALEN)) {
+            ret = true;
+        }
+    }
+
+    if (!memcmp(addr, broadcast, ETH_ALEN)) {
+        return true;
+    }
+
+    if (s->csr[6] & (CSR6_PR | CSR6_RA)) {
+        /* Promiscuous mode enabled */
+        s->rx_status |= RDES0_FF;
+        return true;
+    }
+
+    if ((s->csr[6] & CSR6_PM) && (addr[0] & 1)) {
+        /* Pass all Multicast enabled */
+        s->rx_status |= RDES0_MF;
+        return true;
+    }
+
+    if (s->csr[6] & CSR6_IF) {
+        ret ^= true;
+    }
+    return ret;
+}
+
+static ssize_t tulip_receive(TULIPState *s, const uint8_t *buf, size_t size)
+{
+    struct tulip_descriptor desc;
+
+    trace_tulip_receive(buf, size);
+
+    if (size < 14 || size > 2048 || s->rx_frame_len || tulip_rx_stopped(s)) {
+        return 0;
+    }
+
+    if (!tulip_filter_address(s, buf)) {
+        return size;
+    }
+
+    do {
+        tulip_desc_read(s, s->current_rx_desc, &desc);
+        tulip_dump_rx_descriptor(s, &desc);
+
+        if (!(desc.status & RDES0_OWN)) {
+            s->csr[5] |= CSR5_RU;
+            tulip_update_int(s);
+            return s->rx_frame_size - s->rx_frame_len;
+        }
+        desc.status = 0;
+
+        if (!s->rx_frame_len) {
+            s->rx_frame_size = size + 4;
+            s->rx_status = RDES0_LS |
+                 ((s->rx_frame_size & RDES0_FL_MASK) << RDES0_FL_SHIFT);
+            desc.status |= RDES0_FS;
+            memcpy(s->rx_frame, buf, size);
+            s->rx_frame_len = s->rx_frame_size;
+        }
+
+        tulip_copy_rx_bytes(s, &desc);
+
+        if (!s->rx_frame_len) {
+            desc.status |= s->rx_status;
+            s->csr[5] |= CSR5_RI;
+            tulip_update_int(s);
+        }
+        tulip_dump_rx_descriptor(s, &desc);
+        tulip_desc_write(s, s->current_rx_desc, &desc);
+        tulip_next_rx_descriptor(s, &desc);
+    } while (s->rx_frame_len);
+    return size;
+}
+
+static ssize_t tulip_receive_nc(NetClientState *nc,
+                             const uint8_t *buf, size_t size)
+{
+    return tulip_receive(qemu_get_nic_opaque(nc), buf, size);
+}
+
+
+static NetClientInfo net_tulip_info = {
+    .type = NET_CLIENT_DRIVER_NIC,
+    .size = sizeof(NICState),
+    .receive = tulip_receive_nc,
+};
+
+static const char *tulip_reg_name(const hwaddr addr)
+{
+    switch (addr) {
+    case CSR(0):
+        return "CSR0";
+
+    case CSR(1):
+        return "CSR1";
+
+    case CSR(2):
+        return "CSR2";
+
+    case CSR(3):
+        return "CSR3";
+
+    case CSR(4):
+        return "CSR4";
+
+    case CSR(5):
+        return "CSR5";
+
+    case CSR(6):
+        return "CSR6";
+
+    case CSR(7):
+        return "CSR7";
+
+    case CSR(8):
+        return "CSR8";
+
+    case CSR(9):
+        return "CSR9";
+
+    case CSR(10):
+        return "CSR10";
+
+    case CSR(11):
+        return "CSR11";
+
+    case CSR(12):
+        return "CSR12";
+
+    case CSR(13):
+        return "CSR13";
+
+    case CSR(14):
+        return "CSR14";
+
+    case CSR(15):
+        return "CSR15";
+
+    default:
+        break;
+    }
+    return "";
+}
+
+static const char *tulip_rx_state_name(int state)
+{
+    switch (state) {
+    case CSR5_RS_STOPPED:
+        return "STOPPED";
+
+    case CSR5_RS_RUNNING_FETCH:
+        return "RUNNING/FETCH";
+
+    case CSR5_RS_RUNNING_CHECK_EOR:
+        return "RUNNING/CHECK EOR";
+
+    case CSR5_RS_RUNNING_WAIT_RECEIVE:
+        return "WAIT RECEIVE";
+
+    case CSR5_RS_SUSPENDED:
+        return "SUSPENDED";
+
+    case CSR5_RS_RUNNING_CLOSE:
+        return "RUNNING/CLOSE";
+
+    case CSR5_RS_RUNNING_FLUSH:
+        return "RUNNING/FLUSH";
+
+    case CSR5_RS_RUNNING_QUEUE:
+        return "RUNNING/QUEUE";
+
+    default:
+        break;
+    }
+    return "";
+}
+
+static const char *tulip_tx_state_name(int state)
+{
+    switch (state) {
+    case CSR5_TS_STOPPED:
+        return "STOPPED";
+
+    case CSR5_TS_RUNNING_FETCH:
+        return "RUNNING/FETCH";
+
+    case CSR5_TS_RUNNING_WAIT_EOT:
+        return "RUNNING/WAIT EOT";
+
+    case CSR5_TS_RUNNING_READ_BUF:
+        return "RUNNING/READ BUF";
+
+    case CSR5_TS_RUNNING_SETUP:
+        return "RUNNING/SETUP";
+
+    case CSR5_TS_SUSPENDED:
+        return "SUSPENDED";
+
+    case CSR5_TS_RUNNING_CLOSE:
+        return "RUNNING/CLOSE";
+
+    default:
+        break;
+    }
+    return "";
+}
+
+static void tulip_update_rs(TULIPState *s, int state)
+{
+    s->csr[5] &= ~(CSR5_RS_MASK << CSR5_RS_SHIFT);
+    s->csr[5] |= (state & CSR5_RS_MASK) << CSR5_RS_SHIFT;
+    trace_tulip_rx_state(tulip_rx_state_name(state));
+}
+
+static uint16_t tulip_mdi_default[] = {
+    /* MDI Registers 0 - 6, 7 */
+    0x3100, 0xf02c, 0x7810, 0x0000, 0x0501, 0x4181, 0x0000, 0x0000,
+    /* MDI Registers 8 - 15 */
+    0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+    /* MDI Registers 16 - 31 */
+    0x0003, 0x0000, 0x0001, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+    0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+};
+
+/* Readonly mask for MDI (PHY) registers */
+static const uint16_t tulip_mdi_mask[] = {
+    0x0000, 0xffff, 0xffff, 0xffff, 0xc01f, 0xffff, 0xffff, 0x0000,
+    0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+    0x0fff, 0x0000, 0xffff, 0xffff, 0xffff, 0xffff, 0xffff, 0xffff,
+    0xffff, 0xffff, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
+};
+
+static uint16_t tulip_mii_read(TULIPState *s, int phy, int reg)
+{
+    uint16_t ret = 0;
+    if (phy == 1) {
+        ret = tulip_mdi_default[reg];
+    }
+    trace_tulip_mii_read(phy, reg, ret);
+    return ret;
+}
+
+static void tulip_mii_write(TULIPState *s, int phy, int reg, uint16_t data)
+{
+    trace_tulip_mii_write(phy, reg, data);
+
+    if (phy != 1) {
+        return;
+    }
+
+    tulip_mdi_default[reg] &= ~tulip_mdi_mask[reg];
+    tulip_mdi_default[reg] |= (data & tulip_mdi_mask[reg]);
+}
+
+static void tulip_mii(TULIPState *s)
+{
+    uint32_t changed = s->old_csr9 ^ s->csr[9];
+    uint16_t data;
+    int op, phy, reg;
+
+    if (!(changed & CSR9_MDC)) {
+        return;
+    }
+
+    if (!(s->csr[9] & CSR9_MDC)) {
+        return;
+    }
+
+    s->mii_bitcnt++;
+    s->mii_word <<= 1;
+
+    if (s->csr[9] & CSR9_MDO && (s->mii_bitcnt < 16 ||
+        !(s->csr[9] & CSR9_MII))) {
+        /* write op or address bits */
+        s->mii_word |= 1;
+    }
+
+    if (s->mii_bitcnt >= 16 && (s->csr[9] & CSR9_MII)) {
+        if (s->mii_word & 0x8000) {
+            s->csr[9] |= CSR9_MDI;
+        } else {
+            s->csr[9] &= ~CSR9_MDI;
+        }
+    }
+
+    if (s->mii_word == 0xffffffff) {
+        s->mii_bitcnt = 0;
+    } else if (s->mii_bitcnt == 16) {
+        op = (s->mii_word >> 12) & 0x0f;
+        phy = (s->mii_word >> 7) & 0x1f;
+        reg = (s->mii_word >> 2) & 0x1f;
+
+        if (op == 6) {
+            s->mii_word = tulip_mii_read(s, phy, reg);
+        }
+    } else if (s->mii_bitcnt == 32) {
+            op = (s->mii_word >> 28) & 0x0f;
+            phy = (s->mii_word >> 23) & 0x1f;
+            reg = (s->mii_word >> 18) & 0x1f;
+            data = s->mii_word & 0xffff;
+
+        if (op == 5) {
+            tulip_mii_write(s, phy, reg, data);
+        }
+    }
+}
+
+static uint32_t tulip_csr9_read(TULIPState *s)
+{
+    if (s->csr[9] & CSR9_SR) {
+        if (eeprom93xx_read(s->eeprom)) {
+            s->csr[9] |= CSR9_SR_DO;
+        } else {
+            s->csr[9] &= ~CSR9_SR_DO;
+        }
+    }
+
+    tulip_mii(s);
+    return s->csr[9];
+}
+
+static void tulip_update_ts(TULIPState *s, int state)
+{
+        s->csr[5] &= ~(CSR5_TS_MASK << CSR5_TS_SHIFT);
+        s->csr[5] |= (state & CSR5_TS_MASK) << CSR5_TS_SHIFT;
+        trace_tulip_tx_state(tulip_tx_state_name(state));
+}
+
+static uint64_t tulip_read(void *opaque, hwaddr addr,
+                              unsigned size)
+{
+    TULIPState *s = opaque;
+    uint64_t data = 0;
+
+    switch (addr) {
+    case CSR(9):
+        data = tulip_csr9_read(s);
+        break;
+
+    case CSR(12):
+        /* Fake autocompletion complete until we have PHY emulation */
+        data = 5 << CSR12_ANS_SHIFT;
+        break;
+
+    default:
+        if (addr & 7) {
+            qemu_log_mask(LOG_GUEST_ERROR, "%s: read access at unknown address"
+                " 0x%"PRIx64"\n", __func__, addr);
+        } else {
+            data = s->csr[addr >> 3];
+        }
+        break;
+    }
+    trace_tulip_reg_read(addr, tulip_reg_name(addr), size, data);
+    return data;
+}
+
+static void tulip_tx(TULIPState *s, struct tulip_descriptor *desc)
+{
+    if (s->tx_frame_len) {
+        if ((s->csr[6] >> CSR6_OM_SHIFT) & CSR6_OM_MASK) {
+            /* Internal or external Loopback */
+            tulip_receive(s, s->tx_frame, s->tx_frame_len);
+        } else {
+            qemu_send_packet(qemu_get_queue(s->nic),
+                s->tx_frame, s->tx_frame_len);
+        }
+    }
+
+    if (desc->control & TDES1_IC) {
+        s->csr[5] |= CSR5_TI;
+        tulip_update_int(s);
+    }
+}
+
+static void tulip_copy_tx_buffers(TULIPState *s, struct tulip_descriptor *desc)
+{
+    int len1 = (desc->control >> TDES1_BUF1_SIZE_SHIFT) & TDES1_BUF1_SIZE_MASK;
+    int len2 = (desc->control >> TDES1_BUF2_SIZE_SHIFT) & TDES1_BUF2_SIZE_MASK;
+
+    if (len1) {
+        pci_dma_read(&s->dev, desc->buf_addr1,
+            s->tx_frame + s->tx_frame_len, len1);
+        s->tx_frame_len += len1;
+    }
+
+    if (len2) {
+        pci_dma_read(&s->dev, desc->buf_addr2,
+            s->tx_frame + s->tx_frame_len, len2);
+        s->tx_frame_len += len2;
+    }
+    desc->status = (len1 + len2) ? 0 : 0x7fffffff;
+}
+
+static void tulip_setup_filter_addr(TULIPState *s, uint8_t *buf, int n)
+{
+    int offset = n * 12;
+
+    s->filter[n][0] = buf[offset];
+    s->filter[n][1] = buf[offset + 1];
+
+    s->filter[n][2] = buf[offset + 4];
+    s->filter[n][3] = buf[offset + 5];
+
+    s->filter[n][4] = buf[offset + 8];
+    s->filter[n][5] = buf[offset + 9];
+
+    trace_tulip_setup_filter(n, s->filter[n][5], s->filter[n][4],
+            s->filter[n][3], s->filter[n][2], s->filter[n][1], s->filter[n][0]);
+}
+
+static void tulip_setup_frame(TULIPState *s,
+        struct tulip_descriptor *desc)
+{
+    uint8_t buf[4096];
+    int len = (desc->control >> TDES1_BUF1_SIZE_SHIFT) & TDES1_BUF1_SIZE_MASK;
+    int i;
+
+    trace_tulip_setup_frame();
+
+    if (len == 192) {
+        pci_dma_read(&s->dev, desc->buf_addr1, buf, len);
+        for (i = 0; i < 16; i++) {
+            tulip_setup_filter_addr(s, buf, i);
+        }
+    }
+
+    desc->status = 0x7fffffff;
+
+    if (desc->control & TDES1_IC) {
+        s->csr[5] |= CSR5_TI;
+        tulip_update_int(s);
+    }
+}
+
+static void tulip_next_tx_descriptor(TULIPState *s,
+    struct tulip_descriptor *desc)
+{
+    if (desc->control & TDES1_TER) {
+        s->current_tx_desc = s->csr[4];
+    } else if (desc->control & TDES1_TCH) {
+        s->current_tx_desc = desc->buf_addr2;
+    } else {
+        s->current_tx_desc += sizeof(struct tulip_descriptor) +
+                (((s->csr[0] >> CSR0_DSL_SHIFT) & CSR0_DSL_MASK) << 2);
+    }
+    s->current_tx_desc &= ~3ULL;
+}
+
+static uint32_t tulip_ts(TULIPState *s)
+{
+    return (s->csr[5] >> CSR5_TS_SHIFT) & CSR5_TS_MASK;
+}
+
+static void tulip_xmit_list_update(TULIPState *s)
+{
+    struct tulip_descriptor desc;
+
+    if (tulip_ts(s) != CSR5_TS_SUSPENDED) {
+        return;
+    }
+
+    for (;;) {
+        tulip_desc_read(s, s->current_tx_desc, &desc);
+        tulip_dump_tx_descriptor(s, &desc);
+
+        if (!(desc.status & TDES0_OWN)) {
+            tulip_update_ts(s, CSR5_TS_SUSPENDED);
+            s->csr[5] |= CSR5_TU;
+            tulip_update_int(s);
+            return;
+        }
+
+        if (desc.control & TDES1_SET) {
+            tulip_setup_frame(s, &desc);
+        } else {
+            if (desc.control & TDES1_FS) {
+                s->tx_frame_len = 0;
+            }
+
+            tulip_copy_tx_buffers(s, &desc);
+
+            if (desc.control & TDES1_LS) {
+                tulip_tx(s, &desc);
+            }
+        }
+        tulip_desc_write(s, s->current_tx_desc, &desc);
+        tulip_next_tx_descriptor(s, &desc);
+    }
+}
+
+static void tulip_csr9_write(TULIPState *s, uint32_t old_val,
+        uint32_t new_val)
+{
+    if (new_val & CSR9_SR) {
+        eeprom93xx_write(s->eeprom,
+            !!(new_val & CSR9_SR_CS),
+            !!(new_val & CSR9_SR_SK),
+            !!(new_val & CSR9_SR_DI));
+    }
+}
+
+static void tulip_reset(TULIPState *s)
+{
+    trace_tulip_reset();
+
+    s->csr[0] = 0xfe000000;
+    s->csr[1] = 0xffffffff;
+    s->csr[2] = 0xffffffff;
+    s->csr[5] = 0xf0000000;
+    s->csr[6] = 0x32000040;
+    s->csr[7] = 0xf3fe0000;
+    s->csr[8] = 0xe0000000;
+    s->csr[9] = 0xfff483ff;
+    s->csr[11] = 0xfffe0000;
+    s->csr[12] = 0x000000c6;
+    s->csr[13] = 0xffff0000;
+    s->csr[14] = 0xffffffff;
+    s->csr[15] = 0x8ff00000;
+}
+
+static void tulip_qdev_reset(DeviceState *dev)
+{
+    PCIDevice *d = PCI_DEVICE(dev);
+    TULIPState *s = TULIP(d);
+
+    tulip_reset(s);
+}
+
+static void tulip_write(void *opaque, hwaddr addr,
+                           uint64_t data, unsigned size)
+{
+    TULIPState *s = opaque;
+    trace_tulip_reg_write(addr, tulip_reg_name(addr), size, data);
+
+    switch (addr) {
+    case CSR(0):
+        s->csr[0] = data;
+        if (data & CSR0_SWR) {
+            tulip_reset(s);
+            tulip_update_int(s);
+        }
+        break;
+
+    case CSR(1):
+        tulip_xmit_list_update(s);
+        break;
+
+    case CSR(2):
+        qemu_flush_queued_packets(qemu_get_queue(s->nic));
+        break;
+
+    case CSR(3):
+        s->csr[3] = data & ~3ULL;
+        s->current_rx_desc = s->csr[3];
+        qemu_flush_queued_packets(qemu_get_queue(s->nic));
+        break;
+
+    case CSR(4):
+        s->csr[4] = data & ~3ULL;
+        s->current_tx_desc = s->csr[4];
+        tulip_xmit_list_update(s);
+        break;
+
+    case CSR(5):
+        /* Status register, write clears bit */
+        s->csr[5] &= ~(data & (CSR5_TI | CSR5_TPS | CSR5_TU | CSR5_TJT |
+                               CSR5_LNP_ANC | CSR5_UNF | CSR5_RI | CSR5_RU |
+                               CSR5_RPS | CSR5_RWT | CSR5_ETI | CSR5_GTE |
+                               CSR5_LNF | CSR5_FBE | CSR5_ERI | CSR5_AIS |
+                               CSR5_NIS | CSR5_GPI | CSR5_LC));
+        tulip_update_int(s);
+        break;
+
+    case CSR(6):
+        s->csr[6] = data;
+        if (s->csr[6] & CSR6_SR) {
+            tulip_update_rs(s, CSR5_RS_RUNNING_WAIT_RECEIVE);
+            qemu_flush_queued_packets(qemu_get_queue(s->nic));
+        } else {
+            tulip_update_rs(s, CSR5_RS_STOPPED);
+        }
+
+        if (s->csr[6] & CSR6_ST) {
+            tulip_update_ts(s, CSR5_TS_SUSPENDED);
+            tulip_xmit_list_update(s);
+        } else {
+            tulip_update_ts(s, CSR5_TS_STOPPED);
+        }
+        break;
+
+    case CSR(7):
+        s->csr[7] = data;
+        tulip_update_int(s);
+        break;
+
+    case CSR(8):
+        s->csr[9] = data;
+        break;
+
+    case CSR(9):
+        tulip_csr9_write(s, s->csr[9], data);
+        /* don't clear MII read data */
+        s->csr[9] &= CSR9_MDI;
+        s->csr[9] |= (data & ~CSR9_MDI);
+        tulip_mii(s);
+        s->old_csr9 = s->csr[9];
+        break;
+
+    case CSR(10):
+        s->csr[10] = data;
+        break;
+
+    case CSR(11):
+        s->csr[11] = data;
+        break;
+
+    case CSR(12):
+        /* SIA Status register, some bits are cleared by writing 1 */
+        s->csr[12] &= ~(data & (CSR12_MRA | CSR12_TRA | CSR12_ARA));
+        break;
+
+    case CSR(13):
+        s->csr[13] = data;
+        break;
+
+    case CSR(14):
+        s->csr[14] = data;
+        break;
+
+    case CSR(15):
+        s->csr[15] = data;
+        break;
+
+    default:
+        qemu_log_mask(LOG_GUEST_ERROR, "%s: write to CSR at unknown address "
+                "0x%"PRIx64"\n", __func__, addr);
+        break;
+    }
+}
+
+static const MemoryRegionOps tulip_ops = {
+    .read = tulip_read,
+    .write = tulip_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .impl = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    },
+};
+
+static void tulip_idblock_crc(TULIPState *s, uint16_t *srom)
+{
+    int word, n;
+    int bit;
+    unsigned char bitval, crc;
+    const int len = 9;
+    n = 0;
+    crc = -1;
+
+    for (word = 0; word < len; word++) {
+        for (bit = 15; bit >= 0; bit--) {
+            if ((word == (len - 1)) && (bit == 7)) {
+                /*
+                 * Insert the correct CRC result into input data stream
+                 * in place.
+                 */
+                srom[len - 1] = (srom[len - 1] & 0xff00) | (unsigned short)crc;
+                break;
+            }
+            n++;
+            bitval = ((srom[word] >> bit) & 1) ^ ((crc >> 7) & 1);
+            crc = crc << 1;
+            if (bitval == 1) {
+                crc ^= 6;
+                crc |= 0x01;
+            }
+        }
+    }
+}
+
+static uint16_t tulip_srom_crc(TULIPState *s, uint8_t *eeprom, size_t len)
+{
+    unsigned long crc = 0xffffffff;
+    unsigned long flippedcrc = 0;
+    unsigned char currentbyte;
+    unsigned int msb, bit, i;
+
+    for (i = 0; i < len; i++) {
+        currentbyte = eeprom[i];
+        for (bit = 0; bit < 8; bit++) {
+            msb = (crc >> 31) & 1;
+            crc <<= 1;
+            if (msb ^ (currentbyte & 1)) {
+                crc ^= 0x04c11db6;
+                crc |= 0x00000001;
+            }
+            currentbyte >>= 1;
+        }
+    }
+
+    for (i = 0; i < 32; i++) {
+        flippedcrc <<= 1;
+        bit = crc & 1;
+        crc >>= 1;
+        flippedcrc += bit;
+    }
+    return (flippedcrc ^ 0xffffffff) & 0xffff;
+}
+
+static const uint8_t eeprom_default[128] = {
+    0x3c, 0x10, 0x4f, 0x10, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x56, 0x08, 0x04, 0x01, 0x00, 0x80, 0x48, 0xb3,
+    0x0e, 0xa7, 0x00, 0x1e, 0x00, 0x00, 0x00, 0x08,
+    0x01, 0x8d, 0x03, 0x00, 0x00, 0x00, 0x00, 0x78,
+    0xe0, 0x01, 0x00, 0x50, 0x00, 0x18, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xe8, 0x6b,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80,
+    0x48, 0xb3, 0x0e, 0xa7, 0x40, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+    0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00,
+};
+
+static void tulip_fill_eeprom(TULIPState *s)
+{
+    uint16_t *eeprom = eeprom93xx_data(s->eeprom);
+    memcpy(eeprom, eeprom_default, 128);
+
+    /* patch in our mac address */
+    eeprom[10] = cpu_to_le16(s->c.macaddr.a[0] | (s->c.macaddr.a[1] << 8));
+    eeprom[11] = cpu_to_le16(s->c.macaddr.a[2] | (s->c.macaddr.a[3] << 8));
+    eeprom[12] = cpu_to_le16(s->c.macaddr.a[4] | (s->c.macaddr.a[5] << 8));
+    tulip_idblock_crc(s, eeprom);
+    eeprom[63] = cpu_to_le16(tulip_srom_crc(s, (uint8_t *)eeprom, 126));
+}
+
+static void pci_tulip_realize(PCIDevice *pci_dev, Error **errp)
+{
+    TULIPState *s = DO_UPCAST(TULIPState, dev, pci_dev);
+    uint8_t *pci_conf;
+
+    pci_conf = s->dev.config;
+    pci_conf[PCI_INTERRUPT_PIN] = 1; /* interrupt pin A */
+
+    s->eeprom = eeprom93xx_new(&pci_dev->qdev, 64);
+    tulip_fill_eeprom(s);
+
+    memory_region_init_io(&s->io, OBJECT(&s->dev), &tulip_ops, s,
+            "tulip-io", 128);
+
+    memory_region_init_io(&s->memory, OBJECT(&s->dev), &tulip_ops, s,
+            "tulip-mem", 128);
+
+    pci_register_bar(&s->dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->io);
+    pci_register_bar(&s->dev, 1, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->memory);
+
+    s->irq = pci_allocate_irq(&s->dev);
+
+    qemu_macaddr_default_if_unset(&s->c.macaddr);
+
+    s->nic = qemu_new_nic(&net_tulip_info, &s->c,
+                          object_get_typename(OBJECT(pci_dev)),
+                          pci_dev->qdev.id, s);
+    qemu_format_nic_info_str(qemu_get_queue(s->nic), s->c.macaddr.a);
+}
+
+static void pci_tulip_exit(PCIDevice *pci_dev)
+{
+    TULIPState *s = DO_UPCAST(TULIPState, dev, pci_dev);
+
+    qemu_del_nic(s->nic);
+    qemu_free_irq(s->irq);
+    eeprom93xx_free(&pci_dev->qdev, s->eeprom);
+}
+
+static void tulip_instance_init(Object *obj)
+{
+    PCIDevice *pci_dev = PCI_DEVICE(obj);
+    TULIPState *d = DO_UPCAST(TULIPState, dev, pci_dev);
+
+    device_add_bootindex_property(obj, &d->c.bootindex,
+                                  "bootindex", "/ethernet-phy@0",
+                                  &pci_dev->qdev, NULL);
+}
+
+static Property tulip_properties[] = {
+    DEFINE_NIC_PROPERTIES(TULIPState, c),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void tulip_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+
+    k->realize = pci_tulip_realize;
+    k->exit = pci_tulip_exit;
+    k->vendor_id = PCI_VENDOR_ID_DEC;
+    k->device_id = PCI_DEVICE_ID_DEC_21143;
+    k->subsystem_vendor_id = 0x103c;
+    k->subsystem_id = 0x104f;
+    k->class_id = PCI_CLASS_NETWORK_ETHERNET;
+    dc->vmsd = &vmstate_pci_tulip;
+    dc->props = tulip_properties;
+    dc->reset = tulip_qdev_reset;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
+}
+
+static const TypeInfo tulip_info = {
+    .name          = TYPE_TULIP,
+    .parent        = TYPE_PCI_DEVICE,
+    .instance_size = sizeof(TULIPState),
+    .class_init    = tulip_class_init,
+    .instance_init = tulip_instance_init,
+    .interfaces = (InterfaceInfo[]) {
+        { INTERFACE_CONVENTIONAL_PCI_DEVICE },
+        { },
+    },
+};
+
+static void tulip_register_types(void)
+{
+    type_register_static(&tulip_info);
+}
+
+type_init(tulip_register_types)
diff --git a/hw/net/tulip.h b/hw/net/tulip.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/hw/net/tulip.h
@@ -XXX,XX +XXX,XX @@
+#ifndef HW_TULIP_H
+#define HW_TULIP_H
+
+#include "qemu/units.h"
+#include "net/net.h"
+
+#define TYPE_TULIP "tulip"
+#define TULIP(obj) OBJECT_CHECK(TULIPState, (obj), TYPE_TULIP)
+
+#define CSR(_x) ((_x) << 3)
+
+#define CSR0_SWR        BIT(0)
+#define CSR0_BAR        BIT(1)
+#define CSR0_DSL_SHIFT  2
+#define CSR0_DSL_MASK   0x1f
+#define CSR0_BLE        BIT(7)
+#define CSR0_PBL_SHIFT  8
+#define CSR0_PBL_MASK   0x3f
+#define CSR0_CAC_SHIFT  14
+#define CSR0_CAC_MASK   0x3
+#define CSR0_DAS        0x10000
+#define CSR0_TAP_SHIFT  17
+#define CSR0_TAP_MASK   0x7
+#define CSR0_DBO        0x100000
+#define CSR1_TPD        0x01
+#define CSR0_RLE        BIT(23)
+#define CSR0_WIE        BIT(24)
+
+#define CSR2_RPD        0x01
+
+#define CSR5_TI         BIT(0)
+#define CSR5_TPS        BIT(1)
+#define CSR5_TU         BIT(2)
+#define CSR5_TJT        BIT(3)
+#define CSR5_LNP_ANC    BIT(4)
+#define CSR5_UNF        BIT(5)
+#define CSR5_RI         BIT(6)
+#define CSR5_RU         BIT(7)
+#define CSR5_RPS        BIT(8)
+#define CSR5_RWT        BIT(9)
+#define CSR5_ETI        BIT(10)
+#define CSR5_GTE        BIT(11)
+#define CSR5_LNF        BIT(12)
+#define CSR5_FBE        BIT(13)
+#define CSR5_ERI        BIT(14)
+#define CSR5_AIS        BIT(15)
+#define CSR5_NIS        BIT(16)
+#define CSR5_RS_SHIFT   17
+#define CSR5_RS_MASK    7
+#define CSR5_TS_SHIFT   20
+#define CSR5_TS_MASK    7
+
+#define CSR5_TS_STOPPED                 0
+#define CSR5_TS_RUNNING_FETCH           1
+#define CSR5_TS_RUNNING_WAIT_EOT        2
+#define CSR5_TS_RUNNING_READ_BUF        3
+#define CSR5_TS_RUNNING_SETUP           5
+#define CSR5_TS_SUSPENDED               6
+#define CSR5_TS_RUNNING_CLOSE           7
+
+#define CSR5_RS_STOPPED                 0
+#define CSR5_RS_RUNNING_FETCH           1
+#define CSR5_RS_RUNNING_CHECK_EOR       2
+#define CSR5_RS_RUNNING_WAIT_RECEIVE    3
+#define CSR5_RS_SUSPENDED               4
+#define CSR5_RS_RUNNING_CLOSE           5
+#define CSR5_RS_RUNNING_FLUSH           6
+#define CSR5_RS_RUNNING_QUEUE           7
+
+#define CSR5_EB_SHIFT   23
+#define CSR5_EB_MASK    7
+
+#define CSR5_GPI        BIT(26)
+#define CSR5_LC         BIT(27)
+
+#define CSR6_HP         BIT(0)
+#define CSR6_SR         BIT(1)
+#define CSR6_HO         BIT(2)
+#define CSR6_PB         BIT(3)
+#define CSR6_IF         BIT(4)
+#define CSR6_SB         BIT(5)
+#define CSR6_PR         BIT(6)
+#define CSR6_PM         BIT(7)
+#define CSR6_FKD        BIT(8)
+#define CSR6_FD         BIT(9)
+
+#define CSR6_OM_SHIFT   10
+#define CSR6_OM_MASK    3
+#define CSR6_OM_NORMAL          0
+#define CSR6_OM_INT_LOOPBACK    1
+#define CSR6_OM_EXT_LOOPBACK    2
+
+#define CSR6_FC         BIT(12)
+#define CSR6_ST         BIT(13)
+
+
+#define CSR6_TR_SHIFT   14
+#define CSR6_TR_MASK    3
+#define CSR6_TR_72      0
+#define CSR6_TR_96      1
+#define CSR6_TR_128     2
+#define CSR6_TR_160     3
+
+#define CSR6_CA         BIT(17)
+#define CSR6_RA         BIT(30)
+#define CSR6_SC         BIT(31)
+
+#define CSR7_TIM        BIT(0)
+#define CSR7_TSM        BIT(1)
+#define CSR7_TUM        BIT(2)
+#define CSR7_TJM        BIT(3)
+#define CSR7_LPM        BIT(4)
+#define CSR7_UNM        BIT(5)
+#define CSR7_RIM        BIT(6)
+#define CSR7_RUM        BIT(7)
+#define CSR7_RSM        BIT(8)
+#define CSR7_RWM        BIT(9)
+#define CSR7_TMM        BIT(11)
+#define CSR7_LFM        BIT(12)
+#define CSR7_SEM        BIT(13)
+#define CSR7_ERM        BIT(14)
+#define CSR7_AIM        BIT(15)
+#define CSR7_NIM        BIT(16)
+
+#define CSR8_MISSED_FRAME_OVL           BIT(16)
+#define CSR8_MISSED_FRAME_CNT_MASK      0xffff
+
+#define CSR9_DATA_MASK  0xff
+#define CSR9_SR_CS      BIT(0)
+#define CSR9_SR_SK      BIT(1)
+#define CSR9_SR_DI      BIT(2)
+#define CSR9_SR_DO      BIT(3)
+#define CSR9_REG        BIT(10)
+#define CSR9_SR         BIT(11)
+#define CSR9_BR         BIT(12)
+#define CSR9_WR         BIT(13)
+#define CSR9_RD         BIT(14)
+#define CSR9_MOD        BIT(15)
+#define CSR9_MDC        BIT(16)
+#define CSR9_MDO        BIT(17)
+#define CSR9_MII        BIT(18)
+#define CSR9_MDI        BIT(19)
+
+#define CSR11_CON       BIT(16)
+#define CSR11_TIMER_MASK 0xffff
+
+#define CSR12_MRA       BIT(0)
+#define CSR12_LS100     BIT(1)
+#define CSR12_LS10      BIT(2)
+#define CSR12_APS       BIT(3)
+#define CSR12_ARA       BIT(8)
+#define CSR12_TRA       BIT(9)
+#define CSR12_NSN       BIT(10)
+#define CSR12_TRF       BIT(11)
+#define CSR12_ANS_SHIFT 12
+#define CSR12_ANS_MASK  7
+#define CSR12_LPN       BIT(15)
+#define CSR12_LPC_SHIFT 16
+#define CSR12_LPC_MASK  0xffff
+
+#define CSR13_SRL       BIT(0)
+#define CSR13_CAC       BIT(2)
+#define CSR13_AUI       BIT(3)
+#define CSR13_SDM_SHIFT 4
+#define CSR13_SDM_MASK  0xfff
+
+#define CSR14_ECEN      BIT(0)
+#define CSR14_LBK       BIT(1)
+#define CSR14_DREN      BIT(2)
+#define CSR14_LSE       BIT(3)
+#define CSR14_CPEN_SHIFT 4
+#define CSR14_CPEN_MASK 3
+#define CSR14_MBO       BIT(6)
+#define CSR14_ANE       BIT(7)
+#define CSR14_RSQ       BIT(8)
+#define CSR14_CSQ       BIT(9)
+#define CSR14_CLD       BIT(10)
+#define CSR14_SQE       BIT(11)
+#define CSR14_LTE       BIT(12)
+#define CSR14_APE       BIT(13)
+#define CSR14_SPP       BIT(14)
+#define CSR14_TAS       BIT(15)
+
+#define CSR15_JBD       BIT(0)
+#define CSR15_HUJ       BIT(1)
+#define CSR15_JCK       BIT(2)
+#define CSR15_ABM       BIT(3)
+#define CSR15_RWD       BIT(4)
+#define CSR15_RWR       BIT(5)
+#define CSR15_LE1       BIT(6)
+#define CSR15_LV1       BIT(7)
+#define CSR15_TSCK      BIT(8)
+#define CSR15_FUSQ      BIT(9)
+#define CSR15_FLF       BIT(10)
+#define CSR15_LSD       BIT(11)
+#define CSR15_DPST      BIT(12)
+#define CSR15_FRL       BIT(13)
+#define CSR15_LE2       BIT(14)
+#define CSR15_LV2       BIT(15)
+
+#define RDES0_OF         BIT(0)
+#define RDES0_CE         BIT(1)
+#define RDES0_DB         BIT(2)
+#define RDES0_RJ         BIT(4)
+#define RDES0_FT         BIT(5)
+#define RDES0_CS         BIT(6)
+#define RDES0_TL         BIT(7)
+#define RDES0_LS         BIT(8)
+#define RDES0_FS         BIT(9)
+#define RDES0_MF         BIT(10)
+#define RDES0_RF         BIT(11)
+#define RDES0_DT_SHIFT   12
+#define RDES0_DT_MASK    3
+#define RDES0_LE         BIT(14)
+#define RDES0_ES         BIT(15)
+#define RDES0_FL_SHIFT   16
+#define RDES0_FL_MASK    0x3fff
+#define RDES0_FF         BIT(30)
+#define RDES0_OWN        BIT(31)
+
+#define RDES1_BUF1_SIZE_SHIFT 0
+#define RDES1_BUF1_SIZE_MASK 0x7ff
+
+#define RDES1_BUF2_SIZE_SHIFT 11
+#define RDES1_BUF2_SIZE_MASK 0x7ff
+#define RDES1_RCH       BIT(24)
+#define RDES1_RER       BIT(25)
+
+#define TDES0_DE        BIT(0)
+#define TDES0_UF        BIT(1)
+#define TDES0_LF        BIT(2)
+#define TDES0_CC_SHIFT  3
+#define TDES0_CC_MASK   0xf
+#define TDES0_HF        BIT(7)
+#define TDES0_EC        BIT(8)
+#define TDES0_LC        BIT(9)
+#define TDES0_NC        BIT(10)
+#define TDES0_LO        BIT(11)
+#define TDES0_TO        BIT(14)
+#define TDES0_ES        BIT(15)
+#define TDES0_OWN       BIT(31)
+
+#define TDES1_BUF1_SIZE_SHIFT 0
+#define TDES1_BUF1_SIZE_MASK 0x7ff
+
+#define TDES1_BUF2_SIZE_SHIFT 11
+#define TDES1_BUF2_SIZE_MASK 0x7ff
+
+#define TDES1_FT0       BIT(22)
+#define TDES1_DPD       BIT(23)
+#define TDES1_TCH       BIT(24)
+#define TDES1_TER       BIT(25)
+#define TDES1_AC        BIT(26)
+#define TDES1_SET       BIT(27)
+#define TDES1_FT1       BIT(28)
+#define TDES1_FS        BIT(29)
+#define TDES1_LS        BIT(30)
+#define TDES1_IC        BIT(31)
+
+struct tulip_descriptor {
+    uint32_t status;
+    uint32_t control;
+    uint32_t buf_addr1;
+    uint32_t buf_addr2;
+};
+
+#endif
diff --git a/include/hw/pci/pci_ids.h b/include/hw/pci/pci_ids.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/pci/pci_ids.h
+++ b/include/hw/pci/pci_ids.h
@@ -XXX,XX +XXX,XX @@
 #define PCI_DEVICE_ID_LSI_SAS0079        0x0079
 
 #define PCI_VENDOR_ID_DEC                0x1011
+#define PCI_DEVICE_ID_DEC_21143          0x0019
 #define PCI_DEVICE_ID_DEC_21154          0x0026
 
 #define PCI_VENDOR_ID_CIRRUS             0x1013
-- 
2.5.0

From: "Michael S. Tsirkin" <mst@redhat.com>

Post load hook in virtio vmsd is called early while device is processed,
and when VirtIODevice core isn't fully initialized.  Most device
specific code isn't ready to deal with a device in such state, and
behaves weirdly.

Add a new post_load hook in a device class instead.  Devices should use
this unless they specifically want to verify the migration stream as
it's processed, e.g. for bounds checking.

Cc: qemu-stable@nongnu.org
Suggested-by: "Dr. David Alan Gilbert" <dgilbert@redhat.com>
Cc: Mikhail Sennikovsky <mikhail.sennikovskii@cloud.ionos.com>
Signed-off-by: Michael S. Tsirkin <mst@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/virtio/virtio.c         | 7 +++++++
 include/hw/virtio/virtio.h | 6 ++++++
 2 files changed, 13 insertions(+)

diff --git a/hw/virtio/virtio.c b/hw/virtio/virtio.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/virtio/virtio.c
+++ b/hw/virtio/virtio.c
@@ -XXX,XX +XXX,XX @@ int virtio_load(VirtIODevice *vdev, QEMUFile *f, int version_id)
     }
     rcu_read_unlock();
 
+    if (vdc->post_load) {
+        ret = vdc->post_load(vdev);
+        if (ret) {
+            return ret;
+        }
+    }
+
     return 0;
 }
 
diff --git a/include/hw/virtio/virtio.h b/include/hw/virtio/virtio.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/virtio/virtio.h
+++ b/include/hw/virtio/virtio.h
@@ -XXX,XX +XXX,XX @@ typedef struct VirtioDeviceClass {
      */
     void (*save)(VirtIODevice *vdev, QEMUFile *f);
     int (*load)(VirtIODevice *vdev, QEMUFile *f, int version_id);
+    /* Post load hook in vmsd is called early while device is processed, and
+     * when VirtIODevice isn't fully initialized.  Devices should use this instead,
+     * unless they specifically want to verify the migration stream as it's
+     * processed, e.g. for bounds checking.
+     */
+    int (*post_load)(VirtIODevice *vdev);
     const VMStateDescription *vmsd;
 } VirtioDeviceClass;
 
-- 
2.5.0

From: Mikhail Sennikovsky <mikhail.sennikovskii@cloud.ionos.com>

Currently offloads disabled by guest via the VIRTIO_NET_CTRL_GUEST_OFFLOADS_SET
command are not preserved on VM migration.
Instead all offloads reported by guest features (via VIRTIO_PCI_GUEST_FEATURES)
get enabled.
What happens is: first the VirtIONet::curr_guest_offloads gets restored and offloads
are getting set correctly:

#0  qemu_set_offload (nc=0x555556a11400, csum=1, tso4=0, tso6=0, ecn=0, ufo=0) at net/net.c:474
 #1  virtio_net_apply_guest_offloads (n=0x555557701ca0) at hw/net/virtio-net.c:720
 #2  virtio_net_post_load_device (opaque=0x555557701ca0, version_id=11) at hw/net/virtio-net.c:2334
 #3  vmstate_load_state (f=0x5555569dc010, vmsd=0x555556577c80 <vmstate_virtio_net_device>, opaque=0x555557701ca0, version_id=11)
     at migration/vmstate.c:168
 #4  virtio_load (vdev=0x555557701ca0, f=0x5555569dc010, version_id=11) at hw/virtio/virtio.c:2197
 #5  virtio_device_get (f=0x5555569dc010, opaque=0x555557701ca0, size=0, field=0x55555668cd00 <__compound_literal.5>) at hw/virtio/virtio.c:2036
 #6  vmstate_load_state (f=0x5555569dc010, vmsd=0x555556577ce0 <vmstate_virtio_net>, opaque=0x555557701ca0, version_id=11) at migration/vmstate.c:143
 #7  vmstate_load (f=0x5555569dc010, se=0x5555578189e0) at migration/savevm.c:829
 #8  qemu_loadvm_section_start_full (f=0x5555569dc010, mis=0x5555569eee20) at migration/savevm.c:2211
 #9  qemu_loadvm_state_main (f=0x5555569dc010, mis=0x5555569eee20) at migration/savevm.c:2395
 #10 qemu_loadvm_state (f=0x5555569dc010) at migration/savevm.c:2467
 #11 process_incoming_migration_co (opaque=0x0) at migration/migration.c:449

However later on the features are getting restored, and offloads get reset to
everything supported by features:

#0  qemu_set_offload (nc=0x555556a11400, csum=1, tso4=1, tso6=1, ecn=0, ufo=0) at net/net.c:474
 #1  virtio_net_apply_guest_offloads (n=0x555557701ca0) at hw/net/virtio-net.c:720
 #2  virtio_net_set_features (vdev=0x555557701ca0, features=5104441767) at hw/net/virtio-net.c:773
 #3  virtio_set_features_nocheck (vdev=0x555557701ca0, val=5104441767) at hw/virtio/virtio.c:2052
 #4  virtio_load (vdev=0x555557701ca0, f=0x5555569dc010, version_id=11) at hw/virtio/virtio.c:2220
 #5  virtio_device_get (f=0x5555569dc010, opaque=0x555557701ca0, size=0, field=0x55555668cd00 <__compound_literal.5>) at hw/virtio/virtio.c:2036
 #6  vmstate_load_state (f=0x5555569dc010, vmsd=0x555556577ce0 <vmstate_virtio_net>, opaque=0x555557701ca0, version_id=11) at migration/vmstate.c:143
 #7  vmstate_load (f=0x5555569dc010, se=0x5555578189e0) at migration/savevm.c:829
 #8  qemu_loadvm_section_start_full (f=0x5555569dc010, mis=0x5555569eee20) at migration/savevm.c:2211
 #9  qemu_loadvm_state_main (f=0x5555569dc010, mis=0x5555569eee20) at migration/savevm.c:2395
 #10 qemu_loadvm_state (f=0x5555569dc010) at migration/savevm.c:2467
 #11 process_incoming_migration_co (opaque=0x0) at migration/migration.c:449

Fix this by preserving the state in saved_guest_offloads field and
pushing out offload initialization to the new post load hook.

Cc: qemu-stable@nongnu.org
Signed-off-by: Mikhail Sennikovsky <mikhail.sennikovskii@cloud.ionos.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/virtio-net.c            | 27 ++++++++++++++++++++++++---
 include/hw/virtio/virtio-net.h |  2 ++
 2 files changed, 26 insertions(+), 3 deletions(-)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -XXX,XX +XXX,XX @@ static int virtio_net_post_load_device(void *opaque, int version_id)
         n->curr_guest_offloads = virtio_net_supported_guest_offloads(n);
     }
 
-    if (peer_has_vnet_hdr(n)) {
-        virtio_net_apply_guest_offloads(n);
-    }
+    /*
+     * curr_guest_offloads will be later overwritten by the
+     * virtio_set_features_nocheck call done from the virtio_load.
+     * Here we make sure it is preserved and restored accordingly
+     * in the virtio_net_post_load_virtio callback.
+     */
+    n->saved_guest_offloads = n->curr_guest_offloads;
 
     virtio_net_set_queues(n);
 
@@ -XXX,XX +XXX,XX @@ static int virtio_net_post_load_device(void *opaque, int version_id)
     return 0;
 }
 
+static int virtio_net_post_load_virtio(VirtIODevice *vdev)
+{
+    VirtIONet *n = VIRTIO_NET(vdev);
+    /*
+     * The actual needed state is now in saved_guest_offloads,
+     * see virtio_net_post_load_device for detail.
+     * Restore it back and apply the desired offloads.
+     */
+    n->curr_guest_offloads = n->saved_guest_offloads;
+    if (peer_has_vnet_hdr(n)) {
+        virtio_net_apply_guest_offloads(n);
+    }
+
+    return 0;
+}
+
 /* tx_waiting field of a VirtIONetQueue */
 static const VMStateDescription vmstate_virtio_net_queue_tx_waiting = {
     .name = "virtio-net-queue-tx_waiting",
@@ -XXX,XX +XXX,XX @@ static void virtio_net_class_init(ObjectClass *klass, void *data)
     vdc->guest_notifier_mask = virtio_net_guest_notifier_mask;
     vdc->guest_notifier_pending = virtio_net_guest_notifier_pending;
     vdc->legacy_features |= (0x1 << VIRTIO_NET_F_GSO);
+    vdc->post_load = virtio_net_post_load_virtio;
     vdc->vmsd = &vmstate_virtio_net_device;
 }
 
diff --git a/include/hw/virtio/virtio-net.h b/include/hw/virtio/virtio-net.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/virtio/virtio-net.h
+++ b/include/hw/virtio/virtio-net.h
@@ -XXX,XX +XXX,XX @@ struct VirtIONet {
     char *netclient_name;
     char *netclient_type;
     uint64_t curr_guest_offloads;
+    /* used on saved state restore phase to preserve the curr_guest_offloads */
+    uint64_t saved_guest_offloads;
     AnnounceTimer announce_timer;
     bool needs_vnet_hdr_swap;
     bool mtu_bypass_backend;
-- 
2.5.0

From: Fan Yang <Fan_Yang@sjtu.edu.cn>

'colo_mark_tcp_pkt' should return 'true' when packets are the same, and
'false' otherwise.  However, it returns 'true' when
'colo_compare_packet_payload' returns non-zero while
'colo_compare_packet_payload' is just a 'memcmp'.  The result is that
COLO-compare reports inconsistent TCP packets when they are actually
the same.

Fixes: f449c9e549c ("colo: compare the packet based on the tcp sequence number")
Cc: qemu-stable@nongnu.org
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Fan Yang <Fan_Yang@sjtu.edu.cn>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/colo-compare.c | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/net/colo-compare.c b/net/colo-compare.c
index XXXXXXX..XXXXXXX 100644
--- a/net/colo-compare.c
+++ b/net/colo-compare.c
@@ -XXX,XX +XXX,XX @@ static bool colo_mark_tcp_pkt(Packet *ppkt, Packet *spkt,
     *mark = 0;
 
     if (ppkt->tcp_seq == spkt->tcp_seq && ppkt->seq_end == spkt->seq_end) {
-        if (colo_compare_packet_payload(ppkt, spkt,
+        if (!colo_compare_packet_payload(ppkt, spkt,
                                         ppkt->header_size, spkt->header_size,
                                         ppkt->payload_size)) {
             *mark = COLO_COMPARE_FREE_SECONDARY | COLO_COMPARE_FREE_PRIMARY;
@@ -XXX,XX +XXX,XX @@ static bool colo_mark_tcp_pkt(Packet *ppkt, Packet *spkt,
 
     /* one part of secondary packet payload still need to be compared */
     if (!after(ppkt->seq_end, spkt->seq_end)) {
-        if (colo_compare_packet_payload(ppkt, spkt,
+        if (!colo_compare_packet_payload(ppkt, spkt,
                                         ppkt->header_size + ppkt->offset,
                                         spkt->header_size + spkt->offset,
                                         ppkt->payload_size - ppkt->offset)) {
@@ -XXX,XX +XXX,XX @@ static bool colo_mark_tcp_pkt(Packet *ppkt, Packet *spkt,
         /* primary packet is longer than secondary packet, compare
          * the same part and mark the primary packet offset
          */
-        if (colo_compare_packet_payload(ppkt, spkt,
+        if (!colo_compare_packet_payload(ppkt, spkt,
                                         ppkt->header_size + ppkt->offset,
                                         spkt->header_size + spkt->offset,
                                         spkt->payload_size - spkt->offset)) {
-- 
2.5.0