Series comparison

-[PULL 0/7] Net patches
+[PULL V2 00/14] Net patches
-The following changes since commit 92f8c6fef13b31ba222c4d20ad8afd2b79c4c28e:
+The following changes since commit 2a95551e8b1456aa53ce54fac573df18809340a6:
-  Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20210525' into staging (2021-05-25 16:17:06 +0100)
+  Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20200330' into staging (2020-03-31 11:20:21 +0100)
 are available in the git repository at:
   https://github.com/jasowang/qemu.git tags/net-pull-request
-for you to fetch changes up to 90322e646e87c1440661cb3ddbc0cc94309d8a4f:
+for you to fetch changes up to 1153cf9f5b67fad41ca6f8571e9a26e2c7c70759:
-  MAINTAINERS: Added eBPF maintainers information. (2021-06-04 15:25:46 +0800)
+  qtest: add tulip test case (2020-03-31 21:14:35 +0800)
 ----------------------------------------------------------------
+Changes from V1:
+- fix the compiling error
+- include qtest for tulip OOB
 ----------------------------------------------------------------
-Andrew Melnychenko (7):
+Andrew Melnychenko (1):
-      net/tap: Added TUNSETSTEERINGEBPF code.
+      Fixed integer overflow in e1000e
       net: Added SetSteeringEBPF method for NetClientState.
       ebpf: Added eBPF RSS program.
       ebpf: Added eBPF RSS loader.
       virtio-net: Added eBPF RSS to virtio-net.
       docs: Added eBPF documentation.
       MAINTAINERS: Added eBPF maintainers information.
- MAINTAINERS                    |   8 +
+Li Qiang (1):
- configure                      |   8 +-
+      qtest: add tulip test case
- docs/devel/ebpf_rss.rst        | 125 +++++++++
- docs/devel/index.rst           |   1 +
+Peter Maydell (2):
- ebpf/ebpf_rss-stub.c           |  40 +++
+      hw/net/i82596.c: Avoid reading off end of buffer in i82596_receive()
- ebpf/ebpf_rss.c                | 165 ++++++++++++
+      hw/net/allwinner-sun8i-emac.c: Fix REG_ADDR_HIGH/LOW reads
- ebpf/ebpf_rss.h                |  44 ++++
- ebpf/meson.build               |   1 +
+Philippe Mathieu-Daudé (7):
- ebpf/rss.bpf.skeleton.h        | 431 +++++++++++++++++++++++++++++++
+      hw/net/i82596: Correct command bitmask (CID 1419392)
- ebpf/trace-events              |   4 +
+      hw/net/e1000e_core: Let e1000e_can_receive() return a boolean
- ebpf/trace.h                   |   1 +
+      hw/net/smc91c111: Let smc91c111_can_receive() return a boolean
- hw/net/vhost_net.c             |   3 +
+      hw/net/rtl8139: Simplify if/else statement
- hw/net/virtio-net.c            | 116 ++++++++-
+      hw/net/rtl8139: Update coding style to make checkpatch.pl happy
- include/hw/virtio/virtio-net.h |   4 +
+      hw/net: Make NetCanReceive() return a boolean
- include/net/net.h              |   2 +
+      hw/net/can: Make CanBusClientInfo::can_receive() return a boolean
- meson.build                    |  23 ++
- meson_options.txt              |   2 +
+Prasad J Pandit (1):
- net/tap-bsd.c                  |   5 +
+      net: tulip: check frame size and r/w data length
- net/tap-linux.c                |  13 +
- net/tap-linux.h                |   1 +
+Zhang Chen (2):
- net/tap-solaris.c              |   5 +
+      net/colo-compare.c: Expose "compare_timeout" to users
- net/tap-stub.c                 |   5 +
+      net/colo-compare.c: Expose "expired_scan_cycle" to users
- net/tap.c                      |   9 +
- net/tap_int.h                  |   1 +
+ hw/net/allwinner-sun8i-emac.c | 14 +++----
- net/vhost-vdpa.c               |   2 +
+ hw/net/allwinner_emac.c       |  2 +-
- tools/ebpf/Makefile.ebpf       |  21 ++
+ hw/net/cadence_gem.c          |  8 ++--
- tools/ebpf/rss.bpf.c           | 571 +++++++++++++++++++++++++++++++++++++++++
+ hw/net/can/can_sja1000.c      |  8 ++--
-files changed, 1607 insertions(+), 4 deletions(-)
+ hw/net/can/can_sja1000.h      |  2 +-
- create mode 100644 docs/devel/ebpf_rss.rst
+ hw/net/dp8393x.c              |  8 ++--
- create mode 100644 ebpf/ebpf_rss-stub.c
+ hw/net/e1000.c                |  2 +-
- create mode 100644 ebpf/ebpf_rss.c
+ hw/net/e1000e.c               |  4 +-
- create mode 100644 ebpf/ebpf_rss.h
+ hw/net/e1000e_core.c          |  2 +-
- create mode 100644 ebpf/meson.build
+ hw/net/e1000e_core.h          |  2 +-
- create mode 100644 ebpf/rss.bpf.skeleton.h
+ hw/net/ftgmac100.c            |  6 +--
- create mode 100644 ebpf/trace-events
+ hw/net/i82596.c               | 66 ++++++++++++++++++++----------
- create mode 100644 ebpf/trace.h
+ hw/net/i82596.h               |  2 +-
- create mode 100755 tools/ebpf/Makefile.ebpf
+ hw/net/imx_fec.c              |  2 +-
- create mode 100644 tools/ebpf/rss.bpf.c
+ hw/net/opencores_eth.c        |  5 +--
  hw/net/rtl8139.c              | 22 +++++-----
  hw/net/smc91c111.c            | 10 ++---
  hw/net/spapr_llan.c           |  4 +-
  hw/net/sungem.c               |  6 +--
  hw/net/sunhme.c               |  4 +-
  hw/net/tulip.c                | 36 ++++++++++++----
  hw/net/virtio-net.c           | 10 ++---
  hw/net/xilinx_ethlite.c       |  2 +-
  include/net/can_emu.h         |  2 +-
  include/net/net.h             |  2 +-
  net/can/can_socketcan.c       |  4 +-
  net/colo-compare.c            | 95 ++++++++++++++++++++++++++++++++++++++++---
  net/filter-buffer.c           |  2 +-
  net/hub.c                     |  6 +--
  qemu-options.hx               | 10 +++--
  tests/qtest/Makefile.include  |  1 +
  tests/qtest/tulip-test.c      | 91 +++++++++++++++++++++++++++++++++++++++++
 files changed, 328 insertions(+), 112 deletions(-)
  create mode 100644 tests/qtest/tulip-test.c

-[PULL 7/7] MAINTAINERS: Added eBPF maintainers information.
+[PULL V2 01/14] hw/net/i82596: Correct command bitmask (CID 1419392)
-From: Andrew Melnychenko <andrew@daynix.com>
+From: Philippe Mathieu-Daudé <f4bug@amsat.org>
-Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
+The command is 32-bit, but we are loading the 16 upper bits with
-Signed-off-by: Andrew Melnychenko <andrew@daynix.com>
+the 'get_uint16(s->scb + 2)' call.
 Once shifted by 16, the command bits match the status bits:
 - Command
   Bit 31 ACK-CX   Acknowledges that the CU completed an Action Command.
   Bit 30 ACK-FR   Acknowledges that the RU received a frame.
   Bit 29 ACK-CNA  Acknowledges that the Command Unit became not active.
   Bit 28 ACK-RNR  Acknowledges that the Receive Unit became not ready.
 - Status
   Bit 15 CX       The CU finished executing a command with its I(interrupt) bit set.
   Bit 14 FR       The RU finished receiving a frame.
   Bit 13 CNA      The Command Unit left the Active state.
   Bit 12 RNR      The Receive Unit left the Ready state.
 Add the SCB_COMMAND_ACK_MASK definition to simplify the code.
 This fixes Coverity 1419392 (CONSTANT_EXPRESSION_RESULT):
   /hw/net/i82596.c: 352 in examine_scb()
 cuc = (command >> 8) & 0x7;
 ruc = (command >> 4) & 0x7;
 DBG(printf("MAIN COMMAND %04x  cuc %02x ruc %02x\n", command, cuc, ruc));
 /* and clear the scb command word */
 set_uint16(s->scb + 2, 0);
   >>>     CID 1419392:    (CONSTANT_EXPRESSION_RESULT)
   >>>     "command & (2147483648UL /* 1UL << 31 */)" is always 0 regardless of the values of its operands. This occurs as the logical operand of "if".
 if (command & BIT(31))      /* ACK-CX */
 s->scb_status &= ~SCB_STATUS_CX;
   >>>     CID 1419392:    (CONSTANT_EXPRESSION_RESULT)
   >>>     "command & (1073741824UL /* 1UL << 30 */)" is always 0 regardless of the values of its operands. This occurs as the logical operand of "if".
 if (command & BIT(30))      /*ACK-FR */
 s->scb_status &= ~SCB_STATUS_FR;
   >>>     CID 1419392:    (CONSTANT_EXPRESSION_RESULT)
   >>>     "command & (536870912UL /* 1UL << 29 */)" is always 0 regardless of the values of its operands. This occurs as the logical operand of "if".
 if (command & BIT(29))      /*ACK-CNA */
 s->scb_status &= ~SCB_STATUS_CNA;
   >>>     CID 1419392:    (CONSTANT_EXPRESSION_RESULT)
   >>>     "command & (268435456UL /* 1UL << 28 */)" is always 0 regardless of the values of its operands. This occurs as the logical operand of "if".
 if (command & BIT(28))      /*ACK-RNR */
 s->scb_status &= ~SCB_STATUS_RNR;
 Fixes: Covertiy CID 1419392 (commit 376b851909)
 Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
 Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- MAINTAINERS | 8 ++++++++
+ hw/net/i82596.c | 12 ++++--------
-file changed, 8 insertions(+)
+file changed, 4 insertions(+), 8 deletions(-)
-diff --git a/MAINTAINERS b/MAINTAINERS
+diff --git a/hw/net/i82596.c b/hw/net/i82596.c
 index XXXXXXX..XXXXXXX 100644
---- a/MAINTAINERS
+--- a/hw/net/i82596.c
-+++ b/MAINTAINERS
++++ b/hw/net/i82596.c
-@@ -XXX,XX +XXX,XX @@ F: include/hw/remote/proxy-memory-listener.h
+@@ -XXX,XX +XXX,XX @@
- F: hw/remote/iohub.c
+ #define SCB_STATUS_CNA  0x2000 /* CU left active state */
- F: include/hw/remote/iohub.h
+ #define SCB_STATUS_RNR  0x1000 /* RU left active state */
-+EBPF:
++#define SCB_COMMAND_ACK_MASK \
-+M: Jason Wang <jasowang@redhat.com>
++        (SCB_STATUS_CX | SCB_STATUS_FR | SCB_STATUS_CNA | SCB_STATUS_RNR)
 +R: Andrew Melnychenko <andrew@daynix.com>
 +R: Yuri Benditovich <yuri.benditovich@daynix.com>
 +S: Maintained
 +F: ebpf/*
 +F: tools/ebpf/*
 +
- Build and test automation
+ #define CU_IDLE         0
- -------------------------
+ #define CU_SUSPENDED    1
- Build and test automation, general continuous integration
+ #define CU_ACTIVE       2
@@ -XXX,XX +XXX,XX @@ static void examine_scb(I82596State *s)
      /* and clear the scb command word */
      set_uint16(s->scb + 2, 0);
 -    if (command & BIT(31))      /* ACK-CX */
 -        s->scb_status &= ~SCB_STATUS_CX;
 -    if (command & BIT(30))      /*ACK-FR */
 -        s->scb_status &= ~SCB_STATUS_FR;
 -    if (command & BIT(29))      /*ACK-CNA */
 -        s->scb_status &= ~SCB_STATUS_CNA;
 -    if (command & BIT(28))      /*ACK-RNR */
 -        s->scb_status &= ~SCB_STATUS_RNR;
 +    s->scb_status &= ~(command & SCB_COMMAND_ACK_MASK);
      switch (cuc) {
      case 0:     /* no change */
 --
-.7.4
+.5.0

-New patch
+[PULL V2 02/14] hw/net/i82596.c: Avoid reading off end of buffer in i82596_receive()
+From: Peter Maydell <peter.maydell@linaro.org>
+The i82596_receive() function attempts to pass the guest a buffer
+which is effectively the concatenation of the data it is passed and a
+byte CRC value.  However, rather than implementing this as "write
+the data; then write the CRC" it instead bumps the length value of
+the data by 4, and writes 4 extra bytes from beyond the end of the
+buffer, which it then overwrites with the CRC.  It also assumed that
+we could always fit all four bytes of the CRC into the final receive
+buffer, which might not be true if the CRC needs to be split over two
+receive buffers.
+Calculate separately how many bytes we need to transfer into the
+guest's receive buffer from the source buffer, and how many we need
+to transfer from the CRC work.
+We add a count 'bufsz' of the number of bytes left in the source
+buffer, which we use purely to assert() that we don't overrun.
+Spotted by Coverity (CID 1419396) for the specific case when we end
+up using a local array as the source buffer.
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ hw/net/i82596.c | 44 +++++++++++++++++++++++++++++++++++---------
+file changed, 35 insertions(+), 9 deletions(-)
+diff --git a/hw/net/i82596.c b/hw/net/i82596.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/i82596.c
++++ b/hw/net/i82596.c
+@@ -XXX,XX +XXX,XX @@ ssize_t i82596_receive(NetClientState *nc, const uint8_t *buf, size_t sz)
+     uint32_t rfd_p;
+     uint32_t rbd;
+     uint16_t is_broadcast = 0;
+-    size_t len = sz;
++    size_t len = sz; /* length of data for guest (including CRC) */
++    size_t bufsz = sz; /* length of data in buf */
+     uint32_t crc;
+     uint8_t *crc_ptr;
+     uint8_t buf1[MIN_BUF_SIZE + VLAN_HLEN];
+@@ -XXX,XX +XXX,XX @@ ssize_t i82596_receive(NetClientState *nc, const uint8_t *buf, size_t sz)
+         if (len < MIN_BUF_SIZE) {
+             len = MIN_BUF_SIZE;
+         }
++        bufsz = len;
+     }
+     /* Calculate the ethernet checksum (4 bytes) */
+@@ -XXX,XX +XXX,XX @@ ssize_t i82596_receive(NetClientState *nc, const uint8_t *buf, size_t sz)
+         while (len) {
+             uint16_t buffer_size, num;
+             uint32_t rba;
++            size_t bufcount, crccount;
+             /* printf("Receive: rbd is %08x\n", rbd); */
+             buffer_size = get_uint16(rbd + 12);
+@@ -XXX,XX +XXX,XX @@ ssize_t i82596_receive(NetClientState *nc, const uint8_t *buf, size_t sz)
+             }
+             rba = get_uint32(rbd + 8);
+             /* printf("rba is 0x%x\n", rba); */
+-            address_space_write(&address_space_memory, rba,
+-                                MEMTXATTRS_UNSPECIFIED, buf, num);
+-            rba += num;
+-            buf += num;
+-            len -= num;
+-            if (len == 0) { /* copy crc */
+-                address_space_write(&address_space_memory, rba - 4,
+-                                    MEMTXATTRS_UNSPECIFIED, crc_ptr, 4);
++            /*
++             * Calculate how many bytes we want from buf[] and how many
++             * from the CRC.
++             */
++            if ((len - num) >= 4) {
++                /* The whole guest buffer, we haven't hit the CRC yet */
++                bufcount = num;
++            } else {
++                /* All that's left of buf[] */
++                bufcount = len - 4;
++            }
++            crccount = num - bufcount;
++
++            if (bufcount > 0) {
++                /* Still some of the actual data buffer to transfer */
++                assert(bufsz >= bufcount);
++                bufsz -= bufcount;
++                address_space_write(&address_space_memory, rba,
++                                    MEMTXATTRS_UNSPECIFIED, buf, bufcount);
++                rba += bufcount;
++                buf += bufcount;
++                len -= bufcount;
++            }
++
++            /* Write as much of the CRC as fits */
++            if (crccount > 0) {
++                address_space_write(&address_space_memory, rba,
++                                    MEMTXATTRS_UNSPECIFIED, crc_ptr, crccount);
++                rba += crccount;
++                crc_ptr += crccount;
++                len -= crccount;
+             }
+             num |= 0x4000; /* set F BIT */
+--
+.5.0

-[PULL 6/7] docs: Added eBPF documentation.
+[PULL V2 03/14] Fixed integer overflow in e1000e
 From: Andrew Melnychenko <andrew@daynix.com>
-Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
+Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1737400
 Fixed setting max_queue_num if there are no peers in
 NICConf. qemu_new_nic() creates NICState with 1 NetClientState(index
 ) without peers, set max_queue_num to 0 - It prevents undefined
 behavior and possible crashes, especially during pcie hotplug.
 Fixes: 6f3fbe4ed06 ("net: Introduce e1000e device emulation")
 Signed-off-by: Andrew Melnychenko <andrew@daynix.com>
+Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Dmitry Fleytman <dmitry.fleytman@gmail.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- docs/devel/ebpf_rss.rst | 125 ++++++++++++++++++++++++++++++++++++++++++++++++
+ hw/net/e1000e.c | 2 +-
- docs/devel/index.rst    |   1 +
+file changed, 1 insertion(+), 1 deletion(-)
 files changed, 126 insertions(+)
  create mode 100644 docs/devel/ebpf_rss.rst
-diff --git a/docs/devel/ebpf_rss.rst b/docs/devel/ebpf_rss.rst
+diff --git a/hw/net/e1000e.c b/hw/net/e1000e.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/docs/devel/ebpf_rss.rst
@@ -XXX,XX +XXX,XX @@
 +===========================
 +eBPF RSS virtio-net support
 +===========================
 +
 +RSS(Receive Side Scaling) is used to distribute network packets to guest virtqueues
 +by calculating packet hash. Usually every queue is processed then by a specific guest CPU core.
 +
 +For now there are 2 RSS implementations in qemu:
 +- 'in-qemu' RSS (functions if qemu receives network packets, i.e. vhost=off)
 +- eBPF RSS (can function with also with vhost=on)
 +
 +eBPF support (CONFIG_EBPF) is enabled by 'configure' script.
 +To enable eBPF RSS support use './configure --enable-bpf'.
 +
 +If steering BPF is not set for kernel's TUN module, the TUN uses automatic selection
 +of rx virtqueue based on lookup table built according to calculated symmetric hash
 +of transmitted packets.
 +If steering BPF is set for TUN the BPF code calculates the hash of packet header and
 +returns the virtqueue number to place the packet to.
 +
 +Simplified decision formula:
 +
 +.. code:: C
 +
 +    queue_index = indirection_table[hash(<packet data>)%<indirection_table size>]
 +
 +
 +Not for all packets, the hash can/should be calculated.
 +
 +Note: currently, eBPF RSS does not support hash reporting.
 +
 +eBPF RSS turned on by different combinations of vhost-net, vitrio-net and tap configurations:
 +
 +- eBPF is used:
 +
 +        tap,vhost=off & virtio-net-pci,rss=on,hash=off
 +
 +- eBPF is used:
 +
 +        tap,vhost=on & virtio-net-pci,rss=on,hash=off
 +
 +- 'in-qemu' RSS is used:
 +
 +        tap,vhost=off & virtio-net-pci,rss=on,hash=on
 +
 +- eBPF is used, hash population feature is not reported to the guest:
 +
 +        tap,vhost=on & virtio-net-pci,rss=on,hash=on
 +
 +If CONFIG_EBPF is not set then only 'in-qemu' RSS is supported.
 +Also 'in-qemu' RSS, as a fallback, is used if the eBPF program failed to load or set to TUN.
 +
 +RSS eBPF program
 +----------------
 +
 +RSS program located in ebpf/rss.bpf.skeleton.h generated by bpftool.
 +So the program is part of the qemu binary.
 +Initially, the eBPF program was compiled by clang and source code located at tools/ebpf/rss.bpf.c.
 +Prerequisites to recompile the eBPF program (regenerate ebpf/rss.bpf.skeleton.h):
 +
 +        llvm, clang, kernel source tree, bpftool
 +        Adjust Makefile.ebpf to reflect the location of the kernel source tree
 +
 +        $ cd tools/ebpf
 +        $ make -f Makefile.ebpf
 +
 +Current eBPF RSS implementation uses 'bounded loops' with 'backward jump instructions' which present in the last kernels.
 +Overall eBPF RSS works on kernels 5.8+.
 +
 +eBPF RSS implementation
 +-----------------------
 +
 +eBPF RSS loading functionality located in ebpf/ebpf_rss.c and ebpf/ebpf_rss.h.
 +
 +The `struct EBPFRSSContext` structure that holds 4 file descriptors:
 +
 +- ctx - pointer of the libbpf context.
 +- program_fd - file descriptor of the eBPF RSS program.
 +- map_configuration - file descriptor of the 'configuration' map. This map contains one element of 'struct EBPFRSSConfig'. This configuration determines eBPF program behavior.
 +- map_toeplitz_key - file descriptor of the 'Toeplitz key' map. One element of the 40byte key prepared for the hashing algorithm.
 +- map_indirections_table - 128 elements of queue indexes.
 +
 +`struct EBPFRSSConfig` fields:
 +
 +- redirect - "boolean" value, should the hash be calculated, on false  - `default_queue` would be used as the final decision.
 +- populate_hash - for now, not used. eBPF RSS doesn't support hash reporting.
 +- hash_types - binary mask of different hash types. See `VIRTIO_NET_RSS_HASH_TYPE_*` defines. If for packet hash should not be calculated - `default_queue` would be used.
 +- indirections_len - length of the indirections table, maximum 128.
 +- default_queue - the queue index that used for packet that shouldn't be hashed. For some packets, the hash can't be calculated(g.e ARP).
 +
 +Functions:
 +
 +- `ebpf_rss_init()` - sets ctx to NULL, which indicates that EBPFRSSContext is not loaded.
 +- `ebpf_rss_load()` - creates 3 maps and loads eBPF program from the rss.bpf.skeleton.h. Returns 'true' on success. After that, program_fd can be used to set steering for TAP.
 +- `ebpf_rss_set_all()` - sets values for eBPF maps. `indirections_table` length is in EBPFRSSConfig. `toeplitz_key` is VIRTIO_NET_RSS_MAX_KEY_SIZE aka 40 bytes array.
 +- `ebpf_rss_unload()` - close all file descriptors and set ctx to NULL.
 +
 +Simplified eBPF RSS workflow:
 +
 +.. code:: C
 +
 +    struct EBPFRSSConfig config;
 +    config.redirect = 1;
 +    config.hash_types = VIRTIO_NET_RSS_HASH_TYPE_UDPv4 | VIRTIO_NET_RSS_HASH_TYPE_TCPv4;
 +    config.indirections_len = VIRTIO_NET_RSS_MAX_TABLE_LEN;
 +    config.default_queue = 0;
 +
 +    uint16_t table[VIRTIO_NET_RSS_MAX_TABLE_LEN] = {...};
 +    uint8_t key[VIRTIO_NET_RSS_MAX_KEY_SIZE] = {...};
 +
 +    struct EBPFRSSContext ctx;
 +    ebpf_rss_init(&ctx);
 +    ebpf_rss_load(&ctx);
 +    ebpf_rss_set_all(&ctx, &config, table, key);
 +    if (net_client->info->set_steering_ebpf != NULL) {
 +        net_client->info->set_steering_ebpf(net_client, ctx->program_fd);
 +    }
 +    ...
 +    ebpf_unload(&ctx);
 +
 +
 +NetClientState SetSteeringEBPF()
 +~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
 +
 +For now, `set_steering_ebpf()` method supported by Linux TAP NetClientState. The method requires an eBPF program file descriptor as an argument.
 diff --git a/docs/devel/index.rst b/docs/devel/index.rst
 index XXXXXXX..XXXXXXX 100644
---- a/docs/devel/index.rst
+--- a/hw/net/e1000e.c
-+++ b/docs/devel/index.rst
++++ b/hw/net/e1000e.c
-@@ -XXX,XX +XXX,XX @@ Contents:
+@@ -XXX,XX +XXX,XX @@ e1000e_init_net_peer(E1000EState *s, PCIDevice *pci_dev, uint8_t *macaddr)
-    qom
+     s->nic = qemu_new_nic(&net_e1000e_info, &s->conf,
-    block-coroutine-wrapper
+         object_get_typename(OBJECT(s)), dev->id, s);
-    multi-process
-+   ebpf_rss
+-    s->core.max_queue_num = s->conf.peers.queues - 1;
 +    s->core.max_queue_num = s->conf.peers.queues ? s->conf.peers.queues - 1 : 0;
      trace_e1000e_mac_set_permanent(MAC_ARG(macaddr));
      memcpy(s->core.permanent_mac, macaddr, sizeof(s->core.permanent_mac));
 --
-.7.4
+.5.0

-New patch
+[PULL V2 04/14] hw/net/e1000e_core: Let e1000e_can_receive() return a boolean
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
+The e1000e_can_receive() function simply returns a boolean value.
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Paolo Bonzini <pbonzini@redhat.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ hw/net/e1000e_core.c | 2 +-
+ hw/net/e1000e_core.h | 2 +-
+files changed, 2 insertions(+), 2 deletions(-)
+diff --git a/hw/net/e1000e_core.c b/hw/net/e1000e_core.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/e1000e_core.c
++++ b/hw/net/e1000e_core.c
+@@ -XXX,XX +XXX,XX @@ e1000e_start_recv(E1000ECore *core)
+     }
+ }
+-int
++bool
+ e1000e_can_receive(E1000ECore *core)
+ {
+     int i;
+diff --git a/hw/net/e1000e_core.h b/hw/net/e1000e_core.h
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/e1000e_core.h
++++ b/hw/net/e1000e_core.h
+@@ -XXX,XX +XXX,XX @@ e1000e_core_set_link_status(E1000ECore *core);
+ void
+ e1000e_core_pci_uninit(E1000ECore *core);
+-int
++bool
+ e1000e_can_receive(E1000ECore *core);
+ ssize_t
+--
+.5.0

-New patch
+[PULL V2 05/14] hw/net/smc91c111: Let smc91c111_can_receive() return a boolean
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
+The smc91c111_can_receive() function simply returns a boolean value.
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Cédric Le Goater <clg@kaod.org>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ hw/net/smc91c111.c | 8 ++++----
+file changed, 4 insertions(+), 4 deletions(-)
+diff --git a/hw/net/smc91c111.c b/hw/net/smc91c111.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/smc91c111.c
++++ b/hw/net/smc91c111.c
+@@ -XXX,XX +XXX,XX @@ static void smc91c111_update(smc91c111_state *s)
+     qemu_set_irq(s->irq, level);
+ }
+-static int smc91c111_can_receive(smc91c111_state *s)
++static bool smc91c111_can_receive(smc91c111_state *s)
+ {
+     if ((s->rcr & RCR_RXEN) == 0 || (s->rcr & RCR_SOFT_RST)) {
+-        return 1;
++        return true;
+     }
+     if (s->allocated == (1 << NUM_PACKETS) - 1 ||
+         s->rx_fifo_len == NUM_PACKETS) {
+-        return 0;
++        return false;
+     }
+-    return 1;
++    return true;
+ }
+ static inline void smc91c111_flush_queued_packets(smc91c111_state *s)
+--
+.5.0

-New patch
+[PULL V2 06/14] hw/net/rtl8139: Simplify if/else statement
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
+Rewrite:
+      if (E) {
+          return A;
+      } else {
+          return B;
+      }
+      /* EOF */
+  }
+as:
+      if (E) {
+          return A;
+      }
+      return B;
+  }
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Cédric Le Goater <clg@kaod.org>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ hw/net/rtl8139.c | 8 ++++----
+file changed, 4 insertions(+), 4 deletions(-)
+diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/rtl8139.c
++++ b/hw/net/rtl8139.c
+@@ -XXX,XX +XXX,XX @@ static int rtl8139_can_receive(NetClientState *nc)
+         /* ??? Flow control not implemented in c+ mode.
+            This is a hack to work around slirp deficiencies anyway.  */
+         return 1;
+-    } else {
+-        avail = MOD2(s->RxBufferSize + s->RxBufPtr - s->RxBufAddr,
+-                     s->RxBufferSize);
+-        return (avail == 0 || avail >= 1514 || (s->IntrMask & RxOverflow));
+     }
++
++    avail = MOD2(s->RxBufferSize + s->RxBufPtr - s->RxBufAddr,
++                 s->RxBufferSize);
++    return avail == 0 || avail >= 1514 || (s->IntrMask & RxOverflow);
+ }
+ static ssize_t rtl8139_do_receive(NetClientState *nc, const uint8_t *buf, size_t size_, int do_interrupt)
+--
+.5.0

-New patch
+[PULL V2 07/14] hw/net/rtl8139: Update coding style to make checkpatch.pl happy
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
+We will modify this code in the next commit. Clean it up
+first to avoid checkpatch.pl errors.
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
+Reviewed-by: Cédric Le Goater <clg@kaod.org>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ hw/net/rtl8139.c | 10 ++++++----
+file changed, 6 insertions(+), 4 deletions(-)
+diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/rtl8139.c
++++ b/hw/net/rtl8139.c
+@@ -XXX,XX +XXX,XX @@ static int rtl8139_can_receive(NetClientState *nc)
+     int avail;
+     /* Receive (drop) packets if card is disabled.  */
+-    if (!s->clock_enabled)
+-      return 1;
+-    if (!rtl8139_receiver_enabled(s))
+-      return 1;
++    if (!s->clock_enabled) {
++        return 1;
++    }
++    if (!rtl8139_receiver_enabled(s)) {
++        return 1;
++    }
+     if (rtl8139_cp_receiver_enabled(s) && rtl8139_cp_rx_valid(s)) {
+         /* ??? Flow control not implemented in c+ mode.
+--
+.5.0

-[PULL 2/7] net: Added SetSteeringEBPF method for NetClientState.
+[PULL V2 08/14] hw/net: Make NetCanReceive() return a boolean
-From: Andrew Melnychenko <andrew@daynix.com>
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
-For now, that method supported only by Linux TAP.
+The NetCanReceive handler return whether the device can or
-Linux TAP uses TUNSETSTEERINGEBPF ioctl.
+can not receive new packets. Make it obvious by returning
 a boolean type.
-Signed-off-by: Andrew Melnychenko <andrew@daynix.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
 Acked-by: David Gibson <david@gibson.dropbear.id.au>
 Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Cédric Le Goater <clg@kaod.org>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- include/net/net.h |  2 ++
+ hw/net/allwinner_emac.c |  2 +-
- net/tap-bsd.c     |  5 +++++
+ hw/net/cadence_gem.c    |  8 ++++----
- net/tap-linux.c   | 13 +++++++++++++
+ hw/net/dp8393x.c        |  8 +++-----
- net/tap-solaris.c |  5 +++++
+ hw/net/e1000.c          |  2 +-
- net/tap-stub.c    |  5 +++++
+ hw/net/e1000e.c         |  2 +-
- net/tap.c         |  9 +++++++++
+ hw/net/ftgmac100.c      |  6 +++---
- net/tap_int.h     |  1 +
+ hw/net/i82596.c         | 10 +++++-----
-files changed, 40 insertions(+)
+ hw/net/i82596.h         |  2 +-
  hw/net/imx_fec.c        |  2 +-
  hw/net/opencores_eth.c  |  5 ++---
  hw/net/rtl8139.c        |  8 ++++----
  hw/net/smc91c111.c      |  2 +-
  hw/net/spapr_llan.c     |  4 ++--
  hw/net/sungem.c         |  6 +++---
  hw/net/sunhme.c         |  4 ++--
  hw/net/virtio-net.c     | 10 +++++-----
  hw/net/xilinx_ethlite.c |  2 +-
  include/net/net.h       |  2 +-
  net/filter-buffer.c     |  2 +-
  net/hub.c               |  6 +++---
 files changed, 45 insertions(+), 48 deletions(-)
+diff --git a/hw/net/allwinner_emac.c b/hw/net/allwinner_emac.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/allwinner_emac.c
++++ b/hw/net/allwinner_emac.c
+@@ -XXX,XX +XXX,XX @@ static uint32_t fifo8_pop_word(Fifo8 *fifo)
+     return ret;
+ }
+-static int aw_emac_can_receive(NetClientState *nc)
++static bool aw_emac_can_receive(NetClientState *nc)
+ {
+     AwEmacState *s = qemu_get_nic_opaque(nc);
+diff --git a/hw/net/cadence_gem.c b/hw/net/cadence_gem.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/cadence_gem.c
++++ b/hw/net/cadence_gem.c
+@@ -XXX,XX +XXX,XX @@ static void phy_update_link(CadenceGEMState *s)
+     }
+ }
+-static int gem_can_receive(NetClientState *nc)
++static bool gem_can_receive(NetClientState *nc)
+ {
+     CadenceGEMState *s;
+     int i;
+@@ -XXX,XX +XXX,XX @@ static int gem_can_receive(NetClientState *nc)
+             s->can_rx_state = 1;
+             DB_PRINT("can't receive - no enable\n");
+         }
+-        return 0;
++        return false;
+     }
+     for (i = 0; i < s->num_priority_queues; i++) {
+@@ -XXX,XX +XXX,XX @@ static int gem_can_receive(NetClientState *nc)
+             s->can_rx_state = 2;
+             DB_PRINT("can't receive - all the buffer descriptors are busy\n");
+         }
+-        return 0;
++        return false;
+     }
+     if (s->can_rx_state != 0) {
+         s->can_rx_state = 0;
+         DB_PRINT("can receive\n");
+     }
+-    return 1;
++    return true;
+ }
+ /*
+diff --git a/hw/net/dp8393x.c b/hw/net/dp8393x.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/dp8393x.c
++++ b/hw/net/dp8393x.c
+@@ -XXX,XX +XXX,XX @@ static void dp8393x_do_stop_timer(dp8393xState *s)
+     dp8393x_update_wt_regs(s);
+ }
+-static int dp8393x_can_receive(NetClientState *nc);
++static bool dp8393x_can_receive(NetClientState *nc);
+ static void dp8393x_do_receiver_enable(dp8393xState *s)
+ {
+@@ -XXX,XX +XXX,XX @@ static void dp8393x_watchdog(void *opaque)
+     dp8393x_update_irq(s);
+ }
+-static int dp8393x_can_receive(NetClientState *nc)
++static bool dp8393x_can_receive(NetClientState *nc)
+ {
+     dp8393xState *s = qemu_get_nic_opaque(nc);
+-    if (!(s->regs[SONIC_CR] & SONIC_CR_RXEN))
+-        return 0;
+-    return 1;
++    return !!(s->regs[SONIC_CR] & SONIC_CR_RXEN);
+ }
+ static int dp8393x_receive_filter(dp8393xState *s, const uint8_t * buf,
+diff --git a/hw/net/e1000.c b/hw/net/e1000.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/e1000.c
++++ b/hw/net/e1000.c
+@@ -XXX,XX +XXX,XX @@ static bool e1000_has_rxbufs(E1000State *s, size_t total_size)
+     return total_size <= bufs * s->rxbuf_size;
+ }
+-static int
++static bool
+ e1000_can_receive(NetClientState *nc)
+ {
+     E1000State *s = qemu_get_nic_opaque(nc);
+diff --git a/hw/net/e1000e.c b/hw/net/e1000e.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/e1000e.c
++++ b/hw/net/e1000e.c
+@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps io_ops = {
+     },
+ };
+-static int
++static bool
+ e1000e_nc_can_receive(NetClientState *nc)
+ {
+     E1000EState *s = qemu_get_nic_opaque(nc);
+diff --git a/hw/net/ftgmac100.c b/hw/net/ftgmac100.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/ftgmac100.c
++++ b/hw/net/ftgmac100.c
+@@ -XXX,XX +XXX,XX @@ static void ftgmac100_do_tx(FTGMAC100State *s, uint32_t tx_ring,
+     ftgmac100_update_irq(s);
+ }
+-static int ftgmac100_can_receive(NetClientState *nc)
++static bool ftgmac100_can_receive(NetClientState *nc)
+ {
+     FTGMAC100State *s = FTGMAC100(qemu_get_nic_opaque(nc));
+     FTGMAC100Desc bd;
+     if ((s->maccr & (FTGMAC100_MACCR_RXDMA_EN | FTGMAC100_MACCR_RXMAC_EN))
+          != (FTGMAC100_MACCR_RXDMA_EN | FTGMAC100_MACCR_RXMAC_EN)) {
+-        return 0;
++        return false;
+     }
+     if (ftgmac100_read_bd(&bd, s->rx_descriptor)) {
+-        return 0;
++        return false;
+     }
+     return !(bd.des0 & FTGMAC100_RXDES0_RXPKT_RDY);
+ }
+diff --git a/hw/net/i82596.c b/hw/net/i82596.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/i82596.c
++++ b/hw/net/i82596.c
+@@ -XXX,XX +XXX,XX @@ void i82596_h_reset(void *opaque)
+     i82596_s_reset(s);
+ }
+-int i82596_can_receive(NetClientState *nc)
++bool i82596_can_receive(NetClientState *nc)
+ {
+     I82596State *s = qemu_get_nic_opaque(nc);
+     if (s->rx_status == RX_SUSPENDED) {
+-        return 0;
++        return false;
+     }
+     if (!s->lnkst) {
+-        return 0;
++        return false;
+     }
+     if (USE_TIMER && !timer_pending(s->flush_queue_timer)) {
+-        return 1;
++        return true;
+     }
+-    return 1;
++    return true;
+ }
+ #define MIN_BUF_SIZE 60
+diff --git a/hw/net/i82596.h b/hw/net/i82596.h
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/i82596.h
++++ b/hw/net/i82596.h
+@@ -XXX,XX +XXX,XX @@ void i82596_ioport_writel(void *opaque, uint32_t addr, uint32_t val);
+ uint32_t i82596_ioport_readl(void *opaque, uint32_t addr);
+ uint32_t i82596_bcr_readw(I82596State *s, uint32_t rap);
+ ssize_t i82596_receive(NetClientState *nc, const uint8_t *buf, size_t size_);
+-int i82596_can_receive(NetClientState *nc);
++bool i82596_can_receive(NetClientState *nc);
+ void i82596_set_link_status(NetClientState *nc);
+ void i82596_common_init(DeviceState *dev, I82596State *s, NetClientInfo *info);
+ extern const VMStateDescription vmstate_i82596;
+diff --git a/hw/net/imx_fec.c b/hw/net/imx_fec.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/imx_fec.c
++++ b/hw/net/imx_fec.c
+@@ -XXX,XX +XXX,XX @@ static void imx_eth_write(void *opaque, hwaddr offset, uint64_t value,
+     imx_eth_update(s);
+ }
+-static int imx_eth_can_receive(NetClientState *nc)
++static bool imx_eth_can_receive(NetClientState *nc)
+ {
+     IMXFECState *s = IMX_FEC(qemu_get_nic_opaque(nc));
+diff --git a/hw/net/opencores_eth.c b/hw/net/opencores_eth.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/opencores_eth.c
++++ b/hw/net/opencores_eth.c
+@@ -XXX,XX +XXX,XX @@ static void open_eth_reset(void *opaque)
+     open_eth_set_link_status(qemu_get_queue(s->nic));
+ }
+-static int open_eth_can_receive(NetClientState *nc)
++static bool open_eth_can_receive(NetClientState *nc)
+ {
+     OpenEthState *s = qemu_get_nic_opaque(nc);
+-    return GET_REGBIT(s, MODER, RXEN) &&
+-        (s->regs[TX_BD_NUM] < 0x80);
++    return GET_REGBIT(s, MODER, RXEN) && (s->regs[TX_BD_NUM] < 0x80);
+ }
+ static ssize_t open_eth_receive(NetClientState *nc,
+diff --git a/hw/net/rtl8139.c b/hw/net/rtl8139.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/rtl8139.c
++++ b/hw/net/rtl8139.c
+@@ -XXX,XX +XXX,XX @@ static bool rtl8139_cp_rx_valid(RTL8139State *s)
+     return !(s->RxRingAddrLO == 0 && s->RxRingAddrHI == 0);
+ }
+-static int rtl8139_can_receive(NetClientState *nc)
++static bool rtl8139_can_receive(NetClientState *nc)
+ {
+     RTL8139State *s = qemu_get_nic_opaque(nc);
+     int avail;
+     /* Receive (drop) packets if card is disabled.  */
+     if (!s->clock_enabled) {
+-        return 1;
++        return true;
+     }
+     if (!rtl8139_receiver_enabled(s)) {
+-        return 1;
++        return true;
+     }
+     if (rtl8139_cp_receiver_enabled(s) && rtl8139_cp_rx_valid(s)) {
+         /* ??? Flow control not implemented in c+ mode.
+            This is a hack to work around slirp deficiencies anyway.  */
+-        return 1;
++        return true;
+     }
+     avail = MOD2(s->RxBufferSize + s->RxBufPtr - s->RxBufAddr,
+diff --git a/hw/net/smc91c111.c b/hw/net/smc91c111.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/smc91c111.c
++++ b/hw/net/smc91c111.c
+@@ -XXX,XX +XXX,XX @@ static void smc91c111_writefn(void *opaque, hwaddr addr,
+     }
+ }
+-static int smc91c111_can_receive_nc(NetClientState *nc)
++static bool smc91c111_can_receive_nc(NetClientState *nc)
+ {
+     smc91c111_state *s = qemu_get_nic_opaque(nc);
+diff --git a/hw/net/spapr_llan.c b/hw/net/spapr_llan.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/spapr_llan.c
++++ b/hw/net/spapr_llan.c
+@@ -XXX,XX +XXX,XX @@ typedef struct SpaprVioVlan {
+     RxBufPool *rx_pool[RX_MAX_POOLS];  /* Receive buffer descriptor pools */
+ } SpaprVioVlan;
+-static int spapr_vlan_can_receive(NetClientState *nc)
++static bool spapr_vlan_can_receive(NetClientState *nc)
+ {
+     SpaprVioVlan *dev = qemu_get_nic_opaque(nc);
+-    return (dev->isopen && dev->rx_bufs > 0);
++    return dev->isopen && dev->rx_bufs > 0;
+ }
+ /**
+diff --git a/hw/net/sungem.c b/hw/net/sungem.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/sungem.c
++++ b/hw/net/sungem.c
+@@ -XXX,XX +XXX,XX @@ static bool sungem_rx_full(SunGEMState *s, uint32_t kick, uint32_t done)
+     return kick == ((done + 1) & s->rx_mask);
+ }
+-static int sungem_can_receive(NetClientState *nc)
++static bool sungem_can_receive(NetClientState *nc)
+ {
+     SunGEMState *s = qemu_get_nic_opaque(nc);
+     uint32_t kick, done, rxdma_cfg, rxmac_cfg;
+@@ -XXX,XX +XXX,XX @@ static int sungem_can_receive(NetClientState *nc)
+     /* If MAC disabled, can't receive */
+     if ((rxmac_cfg & MAC_RXCFG_ENAB) == 0) {
+         trace_sungem_rx_mac_disabled();
+-        return 0;
++        return false;
+     }
+     if ((rxdma_cfg & RXDMA_CFG_ENABLE) == 0) {
+         trace_sungem_rx_txdma_disabled();
+-        return 0;
++        return false;
+     }
+     /* Check RX availability */
+diff --git a/hw/net/sunhme.c b/hw/net/sunhme.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/sunhme.c
++++ b/hw/net/sunhme.c
+@@ -XXX,XX +XXX,XX @@ static void sunhme_transmit(SunHMEState *s)
+     sunhme_update_irq(s);
+ }
+-static int sunhme_can_receive(NetClientState *nc)
++static bool sunhme_can_receive(NetClientState *nc)
+ {
+     SunHMEState *s = qemu_get_nic_opaque(nc);
+-    return s->macregs[HME_MACI_RXCFG >> 2] & HME_MAC_RXCFG_ENABLE;
++    return !!(s->macregs[HME_MACI_RXCFG >> 2] & HME_MAC_RXCFG_ENABLE);
+ }
+ static void sunhme_link_status_changed(NetClientState *nc)
+diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/virtio-net.c
++++ b/hw/net/virtio-net.c
+@@ -XXX,XX +XXX,XX @@ static void virtio_net_handle_rx(VirtIODevice *vdev, VirtQueue *vq)
+     qemu_flush_queued_packets(qemu_get_subqueue(n->nic, queue_index));
+ }
+-static int virtio_net_can_receive(NetClientState *nc)
++static bool virtio_net_can_receive(NetClientState *nc)
+ {
+     VirtIONet *n = qemu_get_nic_opaque(nc);
+     VirtIODevice *vdev = VIRTIO_DEVICE(n);
+     VirtIONetQueue *q = virtio_net_get_subqueue(nc);
+     if (!vdev->vm_running) {
+-        return 0;
++        return false;
+     }
+     if (nc->queue_index >= n->curr_queues) {
+-        return 0;
++        return false;
+     }
+     if (!virtio_queue_ready(q->rx_vq) ||
+         !(vdev->status & VIRTIO_CONFIG_S_DRIVER_OK)) {
+-        return 0;
++        return false;
+     }
+-    return 1;
++    return true;
+ }
+ static int virtio_net_has_buffers(VirtIONetQueue *q, int bufsize)
+diff --git a/hw/net/xilinx_ethlite.c b/hw/net/xilinx_ethlite.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/xilinx_ethlite.c
++++ b/hw/net/xilinx_ethlite.c
+@@ -XXX,XX +XXX,XX @@ static const MemoryRegionOps eth_ops = {
+     }
+ };
+-static int eth_can_rx(NetClientState *nc)
++static bool eth_can_rx(NetClientState *nc)
+ {
+     struct xlx_ethlite *s = qemu_get_nic_opaque(nc);
+     unsigned int rxbase = s->rxbuf * (0x800 / 4);
 diff --git a/include/net/net.h b/include/net/net.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/net/net.h
 +++ b/include/net/net.h
-@@ -XXX,XX +XXX,XX @@ typedef int (SetVnetBE)(NetClientState *, bool);
+@@ -XXX,XX +XXX,XX @@ typedef struct NICConf {
- typedef struct SocketReadState SocketReadState;
+ /* Net clients */
- typedef void (SocketReadStateFinalize)(SocketReadState *rs);
- typedef void (NetAnnounce)(NetClientState *);
+ typedef void (NetPoll)(NetClientState *, bool enable);
-+typedef bool (SetSteeringEBPF)(NetClientState *, int);
+-typedef int (NetCanReceive)(NetClientState *);
++typedef bool (NetCanReceive)(NetClientState *);
- typedef struct NetClientInfo {
+ typedef ssize_t (NetReceive)(NetClientState *, const uint8_t *, size_t);
-     NetClientDriver type;
+ typedef ssize_t (NetReceiveIOV)(NetClientState *, const struct iovec *, int);
-@@ -XXX,XX +XXX,XX @@ typedef struct NetClientInfo {
+ typedef void (NetCleanup) (NetClientState *);
-     SetVnetLE *set_vnet_le;
+diff --git a/net/filter-buffer.c b/net/filter-buffer.c
-     SetVnetBE *set_vnet_be;
+index XXXXXXX..XXXXXXX 100644
-     NetAnnounce *announce;
+--- a/net/filter-buffer.c
-+    SetSteeringEBPF *set_steering_ebpf;
++++ b/net/filter-buffer.c
- } NetClientInfo;
+@@ -XXX,XX +XXX,XX @@ static ssize_t filter_buffer_receive_iov(NetFilterState *nf,
+      * the filter can still accept packets until its internal queue is full.
- struct NetClientState {
+      * For example:
-diff --git a/net/tap-bsd.c b/net/tap-bsd.c
+      *   For some reason, receiver could not receive more packets
-index XXXXXXX..XXXXXXX 100644
+-     * (.can_receive() returns zero). Without a filter, at most one packet
---- a/net/tap-bsd.c
++     * (.can_receive() returns false). Without a filter, at most one packet
-+++ b/net/tap-bsd.c
+      * will be queued in incoming queue and sender's poll will be disabled
-@@ -XXX,XX +XXX,XX @@ int tap_fd_get_ifname(int fd, char *ifname)
+      * unit its sent_cb() was called. With a filter, it will keep receiving
- {
+      * the packets without caring about the receiver. This is suboptimal.
-     return -1;
+diff --git a/net/hub.c b/net/hub.c
- }
+index XXXXXXX..XXXXXXX 100644
-+
+--- a/net/hub.c
-+int tap_fd_set_steering_ebpf(int fd, int prog_fd)
++++ b/net/hub.c
-+{
+@@ -XXX,XX +XXX,XX @@ static NetHub *net_hub_new(int id)
-+    return -1;
+     return hub;
-+}
+ }
-diff --git a/net/tap-linux.c b/net/tap-linux.c
-index XXXXXXX..XXXXXXX 100644
+-static int net_hub_port_can_receive(NetClientState *nc)
---- a/net/tap-linux.c
++static bool net_hub_port_can_receive(NetClientState *nc)
-+++ b/net/tap-linux.c
+ {
-@@ -XXX,XX +XXX,XX @@ int tap_fd_get_ifname(int fd, char *ifname)
+     NetHubPort *port;
-     pstrcpy(ifname, sizeof(ifr.ifr_name), ifr.ifr_name);
+     NetHubPort *src_port = DO_UPCAST(NetHubPort, nc, nc);
-     return 0;
+@@ -XXX,XX +XXX,XX @@ static int net_hub_port_can_receive(NetClientState *nc)
- }
+         }
-+
-+int tap_fd_set_steering_ebpf(int fd, int prog_fd)
+         if (qemu_can_send_packet(&port->nc)) {
-+{
+-            return 1;
-+    if (ioctl(fd, TUNSETSTEERINGEBPF, (void *) &prog_fd) != 0) {
++            return true;
-+        error_report("Issue while setting TUNSETSTEERINGEBPF:"
+         }
-+                    " %s with fd: %d, prog_fd: %d",
+     }
-+                    strerror(errno), fd, prog_fd);
-+
+-    return 0;
-+       return -1;
++    return false;
-+    }
+ }
-+
-+    return 0;
+ static ssize_t net_hub_port_receive(NetClientState *nc,
 +}
 diff --git a/net/tap-solaris.c b/net/tap-solaris.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/tap-solaris.c
 +++ b/net/tap-solaris.c
@@ -XXX,XX +XXX,XX @@ int tap_fd_get_ifname(int fd, char *ifname)
  {
      return -1;
  }
 +
 +int tap_fd_set_steering_ebpf(int fd, int prog_fd)
 +{
 +    return -1;
 +}
 diff --git a/net/tap-stub.c b/net/tap-stub.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/tap-stub.c
 +++ b/net/tap-stub.c
@@ -XXX,XX +XXX,XX @@ int tap_fd_get_ifname(int fd, char *ifname)
  {
      return -1;
  }
 +
 +int tap_fd_set_steering_ebpf(int fd, int prog_fd)
 +{
 +    return -1;
 +}
 diff --git a/net/tap.c b/net/tap.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/tap.c
 +++ b/net/tap.c
@@ -XXX,XX +XXX,XX @@ static void tap_poll(NetClientState *nc, bool enable)
      tap_write_poll(s, enable);
  }
 +static bool tap_set_steering_ebpf(NetClientState *nc, int prog_fd)
 +{
 +    TAPState *s = DO_UPCAST(TAPState, nc, nc);
 +    assert(nc->info->type == NET_CLIENT_DRIVER_TAP);
 +
 +    return tap_fd_set_steering_ebpf(s->fd, prog_fd) == 0;
 +}
 +
  int tap_get_fd(NetClientState *nc)
  {
      TAPState *s = DO_UPCAST(TAPState, nc, nc);
@@ -XXX,XX +XXX,XX @@ static NetClientInfo net_tap_info = {
      .set_vnet_hdr_len = tap_set_vnet_hdr_len,
      .set_vnet_le = tap_set_vnet_le,
      .set_vnet_be = tap_set_vnet_be,
 +    .set_steering_ebpf = tap_set_steering_ebpf,
  };
  static TAPState *net_tap_fd_init(NetClientState *peer,
 diff --git a/net/tap_int.h b/net/tap_int.h
 index XXXXXXX..XXXXXXX 100644
 --- a/net/tap_int.h
 +++ b/net/tap_int.h
@@ -XXX,XX +XXX,XX @@ int tap_fd_set_vnet_be(int fd, int vnet_is_be);
  int tap_fd_enable(int fd);
  int tap_fd_disable(int fd);
  int tap_fd_get_ifname(int fd, char *ifname);
 +int tap_fd_set_steering_ebpf(int fd, int prog_fd);
  #endif /* NET_TAP_INT_H */
 --
-.7.4
+.5.0

-[PULL 5/7] virtio-net: Added eBPF RSS to virtio-net.
+[PULL V2 09/14] hw/net/can: Make CanBusClientInfo::can_receive() return a boolean
-From: Andrew Melnychenko <andrew@daynix.com>
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
-When RSS is enabled the device tries to load the eBPF program
+The CanBusClientInfo::can_receive handler return whether the
-to select RX virtqueue in the TUN. If eBPF can be loaded
+device can or can not receive new frames. Make it obvious by
-the RSS will function also with vhost (works with kernel 5.8 and later).
+returning a boolean type.
 Software RSS is used as a fallback with vhost=off when eBPF can't be loaded
 or when hash population requested by the guest.
-Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
-Signed-off-by: Andrew Melnychenko <andrew@daynix.com>
+Reviewed-by: Alistair Francis <alistair.francis@wdc.com>
 Reviewed-by: Cédric Le Goater <clg@kaod.org>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- hw/net/vhost_net.c             |   3 ++
+ hw/net/allwinner-sun8i-emac.c | 2 +-
- hw/net/virtio-net.c            | 116 +++++++++++++++++++++++++++++++++++++++--
+ hw/net/can/can_sja1000.c      | 8 ++++----
- include/hw/virtio/virtio-net.h |   4 ++
+ hw/net/can/can_sja1000.h      | 2 +-
- net/vhost-vdpa.c               |   2 +
+ include/net/can_emu.h         | 2 +-
-files changed, 122 insertions(+), 3 deletions(-)
+ net/can/can_socketcan.c       | 4 ++--
 files changed, 9 insertions(+), 9 deletions(-)
-diff --git a/hw/net/vhost_net.c b/hw/net/vhost_net.c
+diff --git a/hw/net/allwinner-sun8i-emac.c b/hw/net/allwinner-sun8i-emac.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/vhost_net.c
+--- a/hw/net/allwinner-sun8i-emac.c
-+++ b/hw/net/vhost_net.c
++++ b/hw/net/allwinner-sun8i-emac.c
-@@ -XXX,XX +XXX,XX @@ static const int kernel_feature_bits[] = {
+@@ -XXX,XX +XXX,XX @@ static void allwinner_sun8i_emac_flush_desc(FrameDescriptor *desc,
-     VIRTIO_NET_F_MTU,
+     cpu_physical_memory_write(phys_addr, desc, sizeof(*desc));
-     VIRTIO_F_IOMMU_PLATFORM,
+ }
-     VIRTIO_F_RING_PACKED,
-+    VIRTIO_NET_F_HASH_REPORT,
+-static int allwinner_sun8i_emac_can_receive(NetClientState *nc)
-     VHOST_INVALID_FEATURE_BIT
++static bool allwinner_sun8i_emac_can_receive(NetClientState *nc)
- };
+ {
+     AwSun8iEmacState *s = qemu_get_nic_opaque(nc);
-@@ -XXX,XX +XXX,XX @@ static const int user_feature_bits[] = {
+     FrameDescriptor desc;
-     VIRTIO_NET_F_MTU,
+diff --git a/hw/net/can/can_sja1000.c b/hw/net/can/can_sja1000.c
      VIRTIO_F_IOMMU_PLATFORM,
      VIRTIO_F_RING_PACKED,
 +    VIRTIO_NET_F_RSS,
 +    VIRTIO_NET_F_HASH_REPORT,
      /* This bit implies RARP isn't sent by QEMU out of band */
      VIRTIO_NET_F_GUEST_ANNOUNCE,
 diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/virtio-net.c
+--- a/hw/net/can/can_sja1000.c
-+++ b/hw/net/virtio-net.c
++++ b/hw/net/can/can_sja1000.c
-@@ -XXX,XX +XXX,XX @@ static uint64_t virtio_net_get_features(VirtIODevice *vdev, uint64_t features,
+@@ -XXX,XX +XXX,XX @@ uint64_t can_sja_mem_read(CanSJA1000State *s, hwaddr addr, unsigned size)
-         return features;
+     return temp;
  }
 -int can_sja_can_receive(CanBusClientState *client)
 +bool can_sja_can_receive(CanBusClientState *client)
  {
      CanSJA1000State *s = container_of(client, CanSJA1000State, bus_client);
      if (s->clock & 0x80) { /* PeliCAN Mode */
          if (s->mode & 0x01) { /* reset mode. */
 -            return 0;
 +            return false;
          }
      } else { /* BasicCAN mode */
          if (s->control & 0x01) {
 -            return 0;
 +            return false;
          }
      }
--    virtio_clear_feature(&features, VIRTIO_NET_F_RSS);
+-    return 1; /* always return 1, when operation mode */
--    virtio_clear_feature(&features, VIRTIO_NET_F_HASH_REPORT);
++    return true; /* always return true, when operation mode */
-+    if (!ebpf_rss_is_loaded(&n->ebpf_rss)) {
+ }
-+        virtio_clear_feature(&features, VIRTIO_NET_F_RSS);
-+    }
+ ssize_t can_sja_receive(CanBusClientState *client, const qemu_can_frame *frames,
-     features = vhost_net_get_features(get_vhost_net(nc->peer), features);
+diff --git a/hw/net/can/can_sja1000.h b/hw/net/can/can_sja1000.h
-     vdev->backend_features = features;
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/can/can_sja1000.h
-@@ -XXX,XX +XXX,XX @@ static int virtio_net_handle_announce(VirtIONet *n, uint8_t cmd,
++++ b/hw/net/can/can_sja1000.h
@@ -XXX,XX +XXX,XX @@ void can_sja_disconnect(CanSJA1000State *s);
  int can_sja_init(CanSJA1000State *s, qemu_irq irq);
 -int can_sja_can_receive(CanBusClientState *client);
 +bool can_sja_can_receive(CanBusClientState *client);
  ssize_t can_sja_receive(CanBusClientState *client,
                          const qemu_can_frame *frames, size_t frames_cnt);
 diff --git a/include/net/can_emu.h b/include/net/can_emu.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/net/can_emu.h
 +++ b/include/net/can_emu.h
@@ -XXX,XX +XXX,XX @@ typedef struct CanBusClientState CanBusClientState;
  typedef struct CanBusState CanBusState;
  typedef struct CanBusClientInfo {
 -    int (*can_receive)(CanBusClientState *);
 +    bool (*can_receive)(CanBusClientState *);
      ssize_t (*receive)(CanBusClientState *,
          const struct qemu_can_frame *frames, size_t frames_cnt);
  } CanBusClientInfo;
 diff --git a/net/can/can_socketcan.c b/net/can/can_socketcan.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/can/can_socketcan.c
 +++ b/net/can/can_socketcan.c
@@ -XXX,XX +XXX,XX @@ static void can_host_socketcan_read(void *opaque)
      }
  }
-+static void virtio_net_detach_epbf_rss(VirtIONet *n);
+-static int can_host_socketcan_can_receive(CanBusClientState *client)
-+
++static bool can_host_socketcan_can_receive(CanBusClientState *client)
  static void virtio_net_disable_rss(VirtIONet *n)
  {
-     if (n->rss_data.enabled) {
+-    return 1;
          trace_virtio_net_rss_disable();
      }
      n->rss_data.enabled = false;
 +
 +    virtio_net_detach_epbf_rss(n);
 +}
 +
 +static bool virtio_net_attach_ebpf_to_backend(NICState *nic, int prog_fd)
 +{
 +    NetClientState *nc = qemu_get_peer(qemu_get_queue(nic), 0);
 +    if (nc == NULL || nc->info->set_steering_ebpf == NULL) {
 +        return false;
 +    }
 +
 +    return nc->info->set_steering_ebpf(nc, prog_fd);
 +}
 +
 +static void rss_data_to_rss_config(struct VirtioNetRssData *data,
 +                                   struct EBPFRSSConfig *config)
 +{
 +    config->redirect = data->redirect;
 +    config->populate_hash = data->populate_hash;
 +    config->hash_types = data->hash_types;
 +    config->indirections_len = data->indirections_len;
 +    config->default_queue = data->default_queue;
 +}
 +
 +static bool virtio_net_attach_epbf_rss(VirtIONet *n)
 +{
 +    struct EBPFRSSConfig config = {};
 +
 +    if (!ebpf_rss_is_loaded(&n->ebpf_rss)) {
 +        return false;
 +    }
 +
 +    rss_data_to_rss_config(&n->rss_data, &config);
 +
 +    if (!ebpf_rss_set_all(&n->ebpf_rss, &config,
 +                          n->rss_data.indirections_table, n->rss_data.key)) {
 +        return false;
 +    }
 +
 +    if (!virtio_net_attach_ebpf_to_backend(n->nic, n->ebpf_rss.program_fd)) {
 +        return false;
 +    }
 +
 +    return true;
-+}
-+
-+static void virtio_net_detach_epbf_rss(VirtIONet *n)
-+{
-+    virtio_net_attach_ebpf_to_backend(n->nic, -1);
-+}
-+
-+static bool virtio_net_load_ebpf(VirtIONet *n)
-+{
-+    if (!virtio_net_attach_ebpf_to_backend(n->nic, -1)) {
-+        /* backend does't support steering ebpf */
-+        return false;
-+    }
-+
-+    return ebpf_rss_load(&n->ebpf_rss);
-+}
-+
-+static void virtio_net_unload_ebpf(VirtIONet *n)
-+{
-+    virtio_net_attach_ebpf_to_backend(n->nic, -1);
-+    ebpf_rss_unload(&n->ebpf_rss);
  }
- static uint16_t virtio_net_handle_rss(VirtIONet *n,
+ static ssize_t can_host_socketcan_receive(CanBusClientState *client,
@@ -XXX,XX +XXX,XX @@ static uint16_t virtio_net_handle_rss(VirtIONet *n,
          goto error;
      }
      n->rss_data.enabled = true;
 +
 +    if (!n->rss_data.populate_hash) {
 +        if (!virtio_net_attach_epbf_rss(n)) {
 +            /* EBPF must be loaded for vhost */
 +            if (get_vhost_net(qemu_get_queue(n->nic)->peer)) {
 +                warn_report("Can't load eBPF RSS for vhost");
 +                goto error;
 +            }
 +            /* fallback to software RSS */
 +            warn_report("Can't load eBPF RSS - fallback to software RSS");
 +            n->rss_data.enabled_software_rss = true;
 +        }
 +    } else {
 +        /* use software RSS for hash populating */
 +        /* and detach eBPF if was loaded before */
 +        virtio_net_detach_epbf_rss(n);
 +        n->rss_data.enabled_software_rss = true;
 +    }
 +
      trace_virtio_net_rss_enable(n->rss_data.hash_types,
                                  n->rss_data.indirections_len,
                                  temp.b);
@@ -XXX,XX +XXX,XX @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
          return -1;
      }
 -    if (!no_rss && n->rss_data.enabled) {
 +    if (!no_rss && n->rss_data.enabled && n->rss_data.enabled_software_rss) {
          int index = virtio_net_process_rss(nc, buf, size);
          if (index >= 0) {
              NetClientState *nc2 = qemu_get_subqueue(n->nic, index);
@@ -XXX,XX +XXX,XX @@ static int virtio_net_post_load_device(void *opaque, int version_id)
      }
      if (n->rss_data.enabled) {
 +        n->rss_data.enabled_software_rss = n->rss_data.populate_hash;
 +        if (!n->rss_data.populate_hash) {
 +            if (!virtio_net_attach_epbf_rss(n)) {
 +                if (get_vhost_net(qemu_get_queue(n->nic)->peer)) {
 +                    warn_report("Can't post-load eBPF RSS for vhost");
 +                } else {
 +                    warn_report("Can't post-load eBPF RSS - "
 +                                "fallback to software RSS");
 +                    n->rss_data.enabled_software_rss = true;
 +                }
 +            }
 +        }
 +
          trace_virtio_net_rss_enable(n->rss_data.hash_types,
                                      n->rss_data.indirections_len,
                                      sizeof(n->rss_data.key));
@@ -XXX,XX +XXX,XX @@ static void virtio_net_device_realize(DeviceState *dev, Error **errp)
      n->qdev = dev;
      net_rx_pkt_init(&n->rx_pkt, false);
 +
 +    if (virtio_has_feature(n->host_features, VIRTIO_NET_F_RSS)) {
 +        virtio_net_load_ebpf(n);
 +    }
  }
  static void virtio_net_device_unrealize(DeviceState *dev)
@@ -XXX,XX +XXX,XX @@ static void virtio_net_device_unrealize(DeviceState *dev)
      VirtIONet *n = VIRTIO_NET(dev);
      int i, max_queues;
 +    if (virtio_has_feature(n->host_features, VIRTIO_NET_F_RSS)) {
 +        virtio_net_unload_ebpf(n);
 +    }
 +
      /* This will stop vhost backend if appropriate. */
      virtio_net_set_status(vdev, 0);
@@ -XXX,XX +XXX,XX @@ static void virtio_net_instance_init(Object *obj)
      device_add_bootindex_property(obj, &n->nic_conf.bootindex,
                                    "bootindex", "/ethernet-phy@0",
                                    DEVICE(n));
 +
 +    ebpf_rss_init(&n->ebpf_rss);
  }
  static int virtio_net_pre_save(void *opaque)
 diff --git a/include/hw/virtio/virtio-net.h b/include/hw/virtio/virtio-net.h
 index XXXXXXX..XXXXXXX 100644
 --- a/include/hw/virtio/virtio-net.h
 +++ b/include/hw/virtio/virtio-net.h
@@ -XXX,XX +XXX,XX @@
  #include "qemu/option_int.h"
  #include "qom/object.h"
 +#include "ebpf/ebpf_rss.h"
 +
  #define TYPE_VIRTIO_NET "virtio-net-device"
  OBJECT_DECLARE_SIMPLE_TYPE(VirtIONet, VIRTIO_NET)
@@ -XXX,XX +XXX,XX @@ typedef struct VirtioNetRscChain {
  typedef struct VirtioNetRssData {
      bool    enabled;
 +    bool    enabled_software_rss;
      bool    redirect;
      bool    populate_hash;
      uint32_t hash_types;
@@ -XXX,XX +XXX,XX @@ struct VirtIONet {
      Notifier migration_state;
      VirtioNetRssData rss_data;
      struct NetRxPkt *rx_pkt;
 +    struct EBPFRSSContext ebpf_rss;
  };
  void virtio_net_set_netclient_name(VirtIONet *n, const char *name,
 diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/vhost-vdpa.c
 +++ b/net/vhost-vdpa.c
@@ -XXX,XX +XXX,XX @@ const int vdpa_feature_bits[] = {
      VIRTIO_NET_F_MTU,
      VIRTIO_F_IOMMU_PLATFORM,
      VIRTIO_F_RING_PACKED,
 +    VIRTIO_NET_F_RSS,
 +    VIRTIO_NET_F_HASH_REPORT,
      VIRTIO_NET_F_GUEST_ANNOUNCE,
      VIRTIO_NET_F_STATUS,
      VHOST_INVALID_FEATURE_BIT
 --
-.7.4
+.5.0

-[PULL 4/7] ebpf: Added eBPF RSS loader.
+[PULL V2 10/14] net/colo-compare.c: Expose "compare_timeout" to users
-From: Andrew Melnychenko <andrew@daynix.com>
+From: Zhang Chen <chen.zhang@intel.com>
-Added function that loads RSS eBPF program.
+The "compare_timeout" determines the maximum time to hold the primary net packet.
-Added stub functions for RSS eBPF loader.
+This patch expose the "compare_timeout", make user have ability to
-Added meson and configuration options.
+adjest the value according to application scenarios.
-By default, eBPF feature enabled if libbpf is present in the build system.
+QMP command demo:
-libbpf checked in configuration shell script and meson script.
+    { "execute": "qom-get",
          "arguments": { "path": "/objects/comp0",
                         "property": "compare_timeout" } }
-Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
+    { "execute": "qom-set",
-Signed-off-by: Andrew Melnychenko <andrew@daynix.com>
+         "arguments": { "path": "/objects/comp0",
                         "property": "compare_timeout",
                         "value": 5000} }
 Signed-off-by: Zhang Chen <chen.zhang@intel.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- configure               |   8 +-
+ net/colo-compare.c | 47 +++++++++++++++++++++++++++++++++++++++++++++--
- ebpf/ebpf_rss-stub.c    |  40 +++++
+ qemu-options.hx    |  8 +++++---
- ebpf/ebpf_rss.c         | 165 ++++++++++++++++++
+files changed, 50 insertions(+), 5 deletions(-)
  ebpf/ebpf_rss.h         |  44 +++++
  ebpf/meson.build        |   1 +
  ebpf/rss.bpf.skeleton.h | 431 ++++++++++++++++++++++++++++++++++++++++++++++++
  ebpf/trace-events       |   4 +
  ebpf/trace.h            |   1 +
  meson.build             |  23 +++
  meson_options.txt       |   2 +
 files changed, 718 insertions(+), 1 deletion(-)
  create mode 100644 ebpf/ebpf_rss-stub.c
  create mode 100644 ebpf/ebpf_rss.c
  create mode 100644 ebpf/ebpf_rss.h
  create mode 100644 ebpf/meson.build
  create mode 100644 ebpf/rss.bpf.skeleton.h
  create mode 100644 ebpf/trace-events
  create mode 100644 ebpf/trace.h
-diff --git a/configure b/configure
+diff --git a/net/colo-compare.c b/net/colo-compare.c
-index XXXXXXX..XXXXXXX 100755
+index XXXXXXX..XXXXXXX 100644
---- a/configure
+--- a/net/colo-compare.c
-+++ b/configure
++++ b/net/colo-compare.c
-@@ -XXX,XX +XXX,XX @@ vhost_vsock="$default_feature"
+@@ -XXX,XX +XXX,XX @@ static NotifierList colo_compare_notifiers =
- vhost_user="no"
- vhost_user_blk_server="auto"
+ /* TODO: Should be configurable */
- vhost_user_fs="$default_feature"
+ #define REGULAR_PACKET_CHECK_MS 3000
-+bpf="auto"
++#define DEFAULT_TIME_OUT_MS 3000
- kvm="auto"
- hax="auto"
+ static QemuMutex event_mtx;
- hvf="auto"
+ static QemuCond event_complete_cond;
-@@ -XXX,XX +XXX,XX @@ for opt do
+@@ -XXX,XX +XXX,XX @@ typedef struct CompareState {
-   ;;
+     SocketReadState sec_rs;
-   --enable-membarrier) membarrier="yes"
+     SocketReadState notify_rs;
-   ;;
+     bool vnet_hdr;
-+  --disable-bpf) bpf="disabled"
++    uint32_t compare_timeout;
-+  ;;
-+  --enable-bpf) bpf="enabled"
+     /*
-+  ;;
+      * Record the connection that through the NIC
-   --disable-blobs) blobs="false"
+@@ -XXX,XX +XXX,XX @@ static int colo_old_packet_check_one_conn(Connection *conn,
-   ;;
+                                           CompareState *s)
-   --with-pkgversion=*) pkgversion="$optarg"
+ {
-@@ -XXX,XX +XXX,XX @@ disabled with --disable-FEATURE, default is enabled if available
+     GList *result = NULL;
-   vhost-user      vhost-user backend support
+-    int64_t check_time = REGULAR_PACKET_CHECK_MS;
-   vhost-user-blk-server    vhost-user-blk server support
-   vhost-vdpa      vhost-vdpa kernel backend support
+     result = g_queue_find_custom(&conn->primary_list,
-+  bpf             BPF kernel support
+-                                 &check_time,
-   spice           spice
++                                 &s->compare_timeout,
-   spice-protocol  spice-protocol
+                                  (GCompareFunc)colo_old_packet_check_one);
-   rbd             rados block device (rbd)
-@@ -XXX,XX +XXX,XX @@ if test "$skip_meson" = no; then
+     if (result) {
-         -Dattr=$attr -Ddefault_devices=$default_devices \
+@@ -XXX,XX +XXX,XX @@ static void compare_set_notify_dev(Object *obj, const char *value, Error **errp)
-         -Ddocs=$docs -Dsphinx_build=$sphinx_build -Dinstall_blobs=$blobs \
+     s->notify_dev = g_strdup(value);
-         -Dvhost_user_blk_server=$vhost_user_blk_server -Dmultiprocess=$multiprocess \
+ }
--        -Dfuse=$fuse -Dfuse_lseek=$fuse_lseek -Dguest_agent_msi=$guest_agent_msi \
-+        -Dfuse=$fuse -Dfuse_lseek=$fuse_lseek -Dguest_agent_msi=$guest_agent_msi -Dbpf=$bpf\
++static void compare_get_timeout(Object *obj, Visitor *v,
-         $(if test "$default_features" = no; then echo "-Dauto_features=disabled"; fi) \
++                                const char *name, void *opaque,
-     -Dtcg_interpreter=$tcg_interpreter \
++                                Error **errp)
-         $cross_arg \
++{
-diff --git a/ebpf/ebpf_rss-stub.c b/ebpf/ebpf_rss-stub.c
++    CompareState *s = COLO_COMPARE(obj);
-new file mode 100644
++    uint32_t value = s->compare_timeout;
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/ebpf/ebpf_rss-stub.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * eBPF RSS stub file
 + *
 + * Developed by Daynix Computing LTD (http://www.daynix.com)
 + *
 + * Authors:
 + *  Yuri Benditovich <yuri.benditovich@daynix.com>
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2.  See
 + * the COPYING file in the top-level directory.
 + */
 +
-+#include "qemu/osdep.h"
++    visit_type_uint32(v, name, &value, errp);
 +#include "ebpf/ebpf_rss.h"
 +
 +void ebpf_rss_init(struct EBPFRSSContext *ctx)
 +{
 +
 +}
 +
-+bool ebpf_rss_is_loaded(struct EBPFRSSContext *ctx)
++static void compare_set_timeout(Object *obj, Visitor *v,
 +                                const char *name, void *opaque,
 +                                Error **errp)
 +{
-+    return false;
++    CompareState *s = COLO_COMPARE(obj);
 +    Error *local_err = NULL;
 +    uint32_t value;
 +
 +    visit_type_uint32(v, name, &value, &local_err);
 +    if (local_err) {
 +        goto out;
 +    }
 +    if (!value) {
 +        error_setg(&local_err, "Property '%s.%s' requires a positive value",
 +                   object_get_typename(obj), name);
 +        goto out;
 +    }
 +    s->compare_timeout = value;
 +
 +out:
 +    error_propagate(errp, local_err);
 +}
 +
-+bool ebpf_rss_load(struct EBPFRSSContext *ctx)
+ static void compare_pri_rs_finalize(SocketReadState *pri_rs)
-+{
+ {
-+    return false;
+     CompareState *s = container_of(pri_rs, CompareState, pri_rs);
-+}
+@@ -XXX,XX +XXX,XX @@ static void colo_compare_complete(UserCreatable *uc, Error **errp)
-+
+         return;
-+bool ebpf_rss_set_all(struct EBPFRSSContext *ctx, struct EBPFRSSConfig *config,
+     }
-+                      uint16_t *indirections_table, uint8_t *toeplitz_key)
-+{
++    if (!s->compare_timeout) {
-+    return false;
++        /* Set default value to 3000 MS */
-+}
++        s->compare_timeout = DEFAULT_TIME_OUT_MS;
 +
 +void ebpf_rss_unload(struct EBPFRSSContext *ctx)
 +{
 +
 +}
 diff --git a/ebpf/ebpf_rss.c b/ebpf/ebpf_rss.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/ebpf/ebpf_rss.c
@@ -XXX,XX +XXX,XX @@
 +/*
 + * eBPF RSS loader
 + *
 + * Developed by Daynix Computing LTD (http://www.daynix.com)
 + *
 + * Authors:
 + *  Andrew Melnychenko <andrew@daynix.com>
 + *  Yuri Benditovich <yuri.benditovich@daynix.com>
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2.  See
 + * the COPYING file in the top-level directory.
 + */
 +
 +#include "qemu/osdep.h"
 +#include "qemu/error-report.h"
 +
 +#include <bpf/libbpf.h>
 +#include <bpf/bpf.h>
 +
 +#include "hw/virtio/virtio-net.h" /* VIRTIO_NET_RSS_MAX_TABLE_LEN */
 +
 +#include "ebpf/ebpf_rss.h"
 +#include "ebpf/rss.bpf.skeleton.h"
 +#include "trace.h"
 +
 +void ebpf_rss_init(struct EBPFRSSContext *ctx)
 +{
 +    if (ctx != NULL) {
 +        ctx->obj = NULL;
 +    }
 +}
 +
 +bool ebpf_rss_is_loaded(struct EBPFRSSContext *ctx)
 +{
 +    return ctx != NULL && ctx->obj != NULL;
 +}
 +
 +bool ebpf_rss_load(struct EBPFRSSContext *ctx)
 +{
 +    struct rss_bpf *rss_bpf_ctx;
 +
 +    if (ctx == NULL) {
 +        return false;
 +    }
 +
-+    rss_bpf_ctx = rss_bpf__open();
+     if (find_and_check_chardev(&chr, s->pri_indev, errp) ||
-+    if (rss_bpf_ctx == NULL) {
+         !qemu_chr_fe_init(&s->chr_pri_in, chr, errp)) {
-+        trace_ebpf_error("eBPF RSS", "can not open eBPF RSS object");
+         return;
-+        goto error;
+@@ -XXX,XX +XXX,XX @@ static void colo_compare_init(Object *obj)
-+    }
+                             compare_get_notify_dev, compare_set_notify_dev,
                              NULL);
 +    object_property_add(obj, "compare_timeout", "uint32",
 +                        compare_get_timeout,
 +                        compare_set_timeout, NULL, NULL, NULL);
 +
-+    bpf_program__set_socket_filter(rss_bpf_ctx->progs.tun_rss_steering_prog);
+     s->vnet_hdr = false;
-+
+     object_property_add_bool(obj, "vnet_hdr_support", compare_get_vnet_hdr,
-+    if (rss_bpf__load(rss_bpf_ctx)) {
+                              compare_set_vnet_hdr, NULL);
-+        trace_ebpf_error("eBPF RSS", "can not load RSS program");
+diff --git a/qemu-options.hx b/qemu-options.hx
 +        goto error;
 +    }
 +
 +    ctx->obj = rss_bpf_ctx;
 +    ctx->program_fd = bpf_program__fd(
 +            rss_bpf_ctx->progs.tun_rss_steering_prog);
 +    ctx->map_configuration = bpf_map__fd(
 +            rss_bpf_ctx->maps.tap_rss_map_configurations);
 +    ctx->map_indirections_table = bpf_map__fd(
 +            rss_bpf_ctx->maps.tap_rss_map_indirection_table);
 +    ctx->map_toeplitz_key = bpf_map__fd(
 +            rss_bpf_ctx->maps.tap_rss_map_toeplitz_key);
 +
 +    return true;
 +error:
 +    rss_bpf__destroy(rss_bpf_ctx);
 +    ctx->obj = NULL;
 +
 +    return false;
 +}
 +
 +static bool ebpf_rss_set_config(struct EBPFRSSContext *ctx,
 +                                struct EBPFRSSConfig *config)
 +{
 +    uint32_t map_key = 0;
 +
 +    if (!ebpf_rss_is_loaded(ctx)) {
 +        return false;
 +    }
 +    if (bpf_map_update_elem(ctx->map_configuration,
 +                            &map_key, config, 0) < 0) {
 +        return false;
 +    }
 +    return true;
 +}
 +
 +static bool ebpf_rss_set_indirections_table(struct EBPFRSSContext *ctx,
 +                                            uint16_t *indirections_table,
 +                                            size_t len)
 +{
 +    uint32_t i = 0;
 +
 +    if (!ebpf_rss_is_loaded(ctx) || indirections_table == NULL ||
 +       len > VIRTIO_NET_RSS_MAX_TABLE_LEN) {
 +        return false;
 +    }
 +
 +    for (; i < len; ++i) {
 +        if (bpf_map_update_elem(ctx->map_indirections_table, &i,
 +                                indirections_table + i, 0) < 0) {
 +            return false;
 +        }
 +    }
 +    return true;
 +}
 +
 +static bool ebpf_rss_set_toepliz_key(struct EBPFRSSContext *ctx,
 +                                     uint8_t *toeplitz_key)
 +{
 +    uint32_t map_key = 0;
 +
 +    /* prepare toeplitz key */
 +    uint8_t toe[VIRTIO_NET_RSS_MAX_KEY_SIZE] = {};
 +
 +    if (!ebpf_rss_is_loaded(ctx) || toeplitz_key == NULL) {
 +        return false;
 +    }
 +    memcpy(toe, toeplitz_key, VIRTIO_NET_RSS_MAX_KEY_SIZE);
 +    *(uint32_t *)toe = ntohl(*(uint32_t *)toe);
 +
 +    if (bpf_map_update_elem(ctx->map_toeplitz_key, &map_key, toe,
 +                            0) < 0) {
 +        return false;
 +    }
 +    return true;
 +}
 +
 +bool ebpf_rss_set_all(struct EBPFRSSContext *ctx, struct EBPFRSSConfig *config,
 +                      uint16_t *indirections_table, uint8_t *toeplitz_key)
 +{
 +    if (!ebpf_rss_is_loaded(ctx) || config == NULL ||
 +        indirections_table == NULL || toeplitz_key == NULL) {
 +        return false;
 +    }
 +
 +    if (!ebpf_rss_set_config(ctx, config)) {
 +        return false;
 +    }
 +
 +    if (!ebpf_rss_set_indirections_table(ctx, indirections_table,
 +                                      config->indirections_len)) {
 +        return false;
 +    }
 +
 +    if (!ebpf_rss_set_toepliz_key(ctx, toeplitz_key)) {
 +        return false;
 +    }
 +
 +    return true;
 +}
 +
 +void ebpf_rss_unload(struct EBPFRSSContext *ctx)
 +{
 +    if (!ebpf_rss_is_loaded(ctx)) {
 +        return;
 +    }
 +
 +    rss_bpf__destroy(ctx->obj);
 +    ctx->obj = NULL;
 +}
 diff --git a/ebpf/ebpf_rss.h b/ebpf/ebpf_rss.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/ebpf/ebpf_rss.h
@@ -XXX,XX +XXX,XX @@
 +/*
 + * eBPF RSS header
 + *
 + * Developed by Daynix Computing LTD (http://www.daynix.com)
 + *
 + * Authors:
 + *  Andrew Melnychenko <andrew@daynix.com>
 + *  Yuri Benditovich <yuri.benditovich@daynix.com>
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2.  See
 + * the COPYING file in the top-level directory.
 + */
 +
 +#ifndef QEMU_EBPF_RSS_H
 +#define QEMU_EBPF_RSS_H
 +
 +struct EBPFRSSContext {
 +    void *obj;
 +    int program_fd;
 +    int map_configuration;
 +    int map_toeplitz_key;
 +    int map_indirections_table;
 +};
 +
 +struct EBPFRSSConfig {
 +    uint8_t redirect;
 +    uint8_t populate_hash;
 +    uint32_t hash_types;
 +    uint16_t indirections_len;
 +    uint16_t default_queue;
 +} __attribute__((packed));
 +
 +void ebpf_rss_init(struct EBPFRSSContext *ctx);
 +
 +bool ebpf_rss_is_loaded(struct EBPFRSSContext *ctx);
 +
 +bool ebpf_rss_load(struct EBPFRSSContext *ctx);
 +
 +bool ebpf_rss_set_all(struct EBPFRSSContext *ctx, struct EBPFRSSConfig *config,
 +                      uint16_t *indirections_table, uint8_t *toeplitz_key);
 +
 +void ebpf_rss_unload(struct EBPFRSSContext *ctx);
 +
 +#endif /* QEMU_EBPF_RSS_H */
 diff --git a/ebpf/meson.build b/ebpf/meson.build
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/ebpf/meson.build
@@ -0,0 +1 @@
 +common_ss.add(when: libbpf, if_true: files('ebpf_rss.c'), if_false: files('ebpf_rss-stub.c'))
 diff --git a/ebpf/rss.bpf.skeleton.h b/ebpf/rss.bpf.skeleton.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/ebpf/rss.bpf.skeleton.h
@@ -XXX,XX +XXX,XX @@
 +/* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */
 +
 +/* THIS FILE IS AUTOGENERATED! */
 +#ifndef __RSS_BPF_SKEL_H__
 +#define __RSS_BPF_SKEL_H__
 +
 +#include <stdlib.h>
 +#include <bpf/libbpf.h>
 +
 +struct rss_bpf {
 +    struct bpf_object_skeleton *skeleton;
 +    struct bpf_object *obj;
 +    struct {
 +        struct bpf_map *tap_rss_map_configurations;
 +        struct bpf_map *tap_rss_map_indirection_table;
 +        struct bpf_map *tap_rss_map_toeplitz_key;
 +    } maps;
 +    struct {
 +        struct bpf_program *tun_rss_steering_prog;
 +    } progs;
 +    struct {
 +        struct bpf_link *tun_rss_steering_prog;
 +    } links;
 +};
 +
 +static void
 +rss_bpf__destroy(struct rss_bpf *obj)
 +{
 +    if (!obj)
 +        return;
 +    if (obj->skeleton)
 +        bpf_object__destroy_skeleton(obj->skeleton);
 +    free(obj);
 +}
 +
 +static inline int
 +rss_bpf__create_skeleton(struct rss_bpf *obj);
 +
 +static inline struct rss_bpf *
 +rss_bpf__open_opts(const struct bpf_object_open_opts *opts)
 +{
 +    struct rss_bpf *obj;
 +
 +    obj = (struct rss_bpf *)calloc(1, sizeof(*obj));
 +    if (!obj)
 +        return NULL;
 +    if (rss_bpf__create_skeleton(obj))
 +        goto err;
 +    if (bpf_object__open_skeleton(obj->skeleton, opts))
 +        goto err;
 +
 +    return obj;
 +err:
 +    rss_bpf__destroy(obj);
 +    return NULL;
 +}
 +
 +static inline struct rss_bpf *
 +rss_bpf__open(void)
 +{
 +    return rss_bpf__open_opts(NULL);
 +}
 +
 +static inline int
 +rss_bpf__load(struct rss_bpf *obj)
 +{
 +    return bpf_object__load_skeleton(obj->skeleton);
 +}
 +
 +static inline struct rss_bpf *
 +rss_bpf__open_and_load(void)
 +{
 +    struct rss_bpf *obj;
 +
 +    obj = rss_bpf__open();
 +    if (!obj)
 +        return NULL;
 +    if (rss_bpf__load(obj)) {
 +        rss_bpf__destroy(obj);
 +        return NULL;
 +    }
 +    return obj;
 +}
 +
 +static inline int
 +rss_bpf__attach(struct rss_bpf *obj)
 +{
 +    return bpf_object__attach_skeleton(obj->skeleton);
 +}
 +
 +static inline void
 +rss_bpf__detach(struct rss_bpf *obj)
 +{
 +    return bpf_object__detach_skeleton(obj->skeleton);
 +}
 +
 +static inline int
 +rss_bpf__create_skeleton(struct rss_bpf *obj)
 +{
 +    struct bpf_object_skeleton *s;
 +
 +    s = (struct bpf_object_skeleton *)calloc(1, sizeof(*s));
 +    if (!s)
 +        return -1;
 +    obj->skeleton = s;
 +
 +    s->sz = sizeof(*s);
 +    s->name = "rss_bpf";
 +    s->obj = &obj->obj;
 +
 +    /* maps */
 +    s->map_cnt = 3;
 +    s->map_skel_sz = sizeof(*s->maps);
 +    s->maps = (struct bpf_map_skeleton *)calloc(s->map_cnt, s->map_skel_sz);
 +    if (!s->maps)
 +        goto err;
 +
 +    s->maps[0].name = "tap_rss_map_configurations";
 +    s->maps[0].map = &obj->maps.tap_rss_map_configurations;
 +
 +    s->maps[1].name = "tap_rss_map_indirection_table";
 +    s->maps[1].map = &obj->maps.tap_rss_map_indirection_table;
 +
 +    s->maps[2].name = "tap_rss_map_toeplitz_key";
 +    s->maps[2].map = &obj->maps.tap_rss_map_toeplitz_key;
 +
 +    /* programs */
 +    s->prog_cnt = 1;
 +    s->prog_skel_sz = sizeof(*s->progs);
 +    s->progs = (struct bpf_prog_skeleton *)calloc(s->prog_cnt, s->prog_skel_sz);
 +    if (!s->progs)
 +        goto err;
 +
 +    s->progs[0].name = "tun_rss_steering_prog";
 +    s->progs[0].prog = &obj->progs.tun_rss_steering_prog;
 +    s->progs[0].link = &obj->links.tun_rss_steering_prog;
 +
 +    s->data_sz = 8088;
 +    s->data = (void *)"\
 +\x7f\x45\x4c\x46\x02\x01\x01\0\0\0\0\0\0\0\0\0\x01\0\xf7\0\x01\0\0\0\0\0\0\0\0\
 +\0\0\0\0\0\0\0\0\0\0\0\x18\x1d\0\0\0\0\0\0\0\0\0\0\x40\0\0\0\0\0\x40\0\x0a\0\
 +\x01\0\xbf\x18\0\0\0\0\0\0\xb7\x01\0\0\0\0\0\0\x63\x1a\x4c\xff\0\0\0\0\xbf\xa7\
 +\0\0\0\0\0\0\x07\x07\0\0\x4c\xff\xff\xff\x18\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
 +\xbf\x72\0\0\0\0\0\0\x85\0\0\0\x01\0\0\0\xbf\x06\0\0\0\0\0\0\x18\x01\0\0\0\0\0\
 +\0\0\0\0\0\0\0\0\0\xbf\x72\0\0\0\0\0\0\x85\0\0\0\x01\0\0\0\xbf\x07\0\0\0\0\0\0\
 +\x18\0\0\0\xff\xff\xff\xff\0\0\0\0\0\0\0\0\x15\x06\x66\x02\0\0\0\0\xbf\x79\0\0\
 +\0\0\0\0\x15\x09\x64\x02\0\0\0\0\x71\x61\0\0\0\0\0\0\x55\x01\x01\0\0\0\0\0\x05\
 +\0\x5d\x02\0\0\0\0\xb7\x01\0\0\0\0\0\0\x63\x1a\xc0\xff\0\0\0\0\x7b\x1a\xb8\xff\
 +\0\0\0\0\x7b\x1a\xb0\xff\0\0\0\0\x7b\x1a\xa8\xff\0\0\0\0\x7b\x1a\xa0\xff\0\0\0\
 +\0\x63\x1a\x98\xff\0\0\0\0\x7b\x1a\x90\xff\0\0\0\0\x7b\x1a\x88\xff\0\0\0\0\x7b\
 +\x1a\x80\xff\0\0\0\0\x7b\x1a\x78\xff\0\0\0\0\x7b\x1a\x70\xff\0\0\0\0\x7b\x1a\
 +\x68\xff\0\0\0\0\x7b\x1a\x60\xff\0\0\0\0\x7b\x1a\x58\xff\0\0\0\0\x7b\x1a\x50\
 +\xff\0\0\0\0\x15\x08\x4c\x02\0\0\0\0\x6b\x1a\xd0\xff\0\0\0\0\xbf\xa3\0\0\0\0\0\
 +\0\x07\x03\0\0\xd0\xff\xff\xff\xbf\x81\0\0\0\0\0\0\xb7\x02\0\0\x0c\0\0\0\xb7\
 +\x04\0\0\x02\0\0\0\xb7\x05\0\0\0\0\0\0\x85\0\0\0\x44\0\0\0\x67\0\0\0\x20\0\0\0\
 +\x77\0\0\0\x20\0\0\0\x55\0\x11\0\0\0\0\0\xb7\x02\0\0\x10\0\0\0\x69\xa1\xd0\xff\
 +\0\0\0\0\xbf\x13\0\0\0\0\0\0\xdc\x03\0\0\x10\0\0\0\x15\x03\x02\0\0\x81\0\0\x55\
 +\x03\x0c\0\xa8\x88\0\0\xb7\x02\0\0\x14\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\
 +\xd0\xff\xff\xff\xbf\x81\0\0\0\0\0\0\xb7\x04\0\0\x02\0\0\0\xb7\x05\0\0\0\0\0\0\
 +\x85\0\0\0\x44\0\0\0\x69\xa1\xd0\xff\0\0\0\0\x67\0\0\0\x20\0\0\0\x77\0\0\0\x20\
 +\0\0\0\x15\0\x01\0\0\0\0\0\x05\0\x2f\x02\0\0\0\0\x15\x01\x2e\x02\0\0\0\0\x7b\
 +\x9a\x30\xff\0\0\0\0\x15\x01\x57\0\x86\xdd\0\0\x55\x01\x3b\0\x08\0\0\0\x7b\x7a\
 +\x20\xff\0\0\0\0\xb7\x07\0\0\x01\0\0\0\x73\x7a\x50\xff\0\0\0\0\xb7\x01\0\0\0\0\
 +\0\0\x63\x1a\xe0\xff\0\0\0\0\x7b\x1a\xd8\xff\0\0\0\0\x7b\x1a\xd0\xff\0\0\0\0\
 +\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\xd0\xff\xff\xff\xbf\x81\0\0\0\0\0\0\xb7\x02\0\
 +\0\0\0\0\0\xb7\x04\0\0\x14\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\0\0\0\x67\
 +\0\0\0\x20\0\0\0\x77\0\0\0\x20\0\0\0\x55\0\x1a\x02\0\0\0\0\x69\xa1\xd6\xff\0\0\
 +\0\0\x55\x01\x01\0\0\0\0\0\xb7\x07\0\0\0\0\0\0\x61\xa1\xdc\xff\0\0\0\0\x63\x1a\
 +\x5c\xff\0\0\0\0\x61\xa1\xe0\xff\0\0\0\0\x63\x1a\x60\xff\0\0\0\0\x73\x7a\x56\
 +\xff\0\0\0\0\x71\xa9\xd9\xff\0\0\0\0\x71\xa1\xd0\xff\0\0\0\0\x67\x01\0\0\x02\0\
 +\0\0\x57\x01\0\0\x3c\0\0\0\x7b\x1a\x40\xff\0\0\0\0\x79\xa7\x20\xff\0\0\0\0\xbf\
 +\x91\0\0\0\0\0\0\x57\x01\0\0\xff\0\0\0\x15\x01\x19\0\0\0\0\0\x71\xa1\x56\xff\0\
 +\0\0\0\x55\x01\x17\0\0\0\0\0\x57\x09\0\0\xff\0\0\0\x15\x09\x7a\x01\x11\0\0\0\
 +\x55\x09\x14\0\x06\0\0\0\xb7\x01\0\0\x01\0\0\0\x73\x1a\x53\xff\0\0\0\0\xb7\x01\
 +\0\0\0\0\0\0\x63\x1a\xe0\xff\0\0\0\0\x7b\x1a\xd8\xff\0\0\0\0\x7b\x1a\xd0\xff\0\
 +\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\xd0\xff\xff\xff\xbf\x81\0\0\0\0\0\0\x79\
 +\xa2\x40\xff\0\0\0\0\xb7\x04\0\0\x14\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\
 +\0\0\0\x67\0\0\0\x20\0\0\0\x77\0\0\0\x20\0\0\0\x55\0\xf4\x01\0\0\0\0\x69\xa1\
 +\xd0\xff\0\0\0\0\x6b\x1a\x58\xff\0\0\0\0\x69\xa1\xd2\xff\0\0\0\0\x6b\x1a\x5a\
 +\xff\0\0\0\0\x71\xa1\x50\xff\0\0\0\0\x15\x01\xd4\0\0\0\0\0\x71\x62\x03\0\0\0\0\
 +\0\x67\x02\0\0\x08\0\0\0\x71\x61\x02\0\0\0\0\0\x4f\x12\0\0\0\0\0\0\x71\x63\x04\
 +\0\0\0\0\0\x71\x61\x05\0\0\0\0\0\x67\x01\0\0\x08\0\0\0\x4f\x31\0\0\0\0\0\0\x67\
 +\x01\0\0\x10\0\0\0\x4f\x21\0\0\0\0\0\0\x71\xa2\x53\xff\0\0\0\0\x79\xa0\x30\xff\
 +\0\0\0\0\x15\x02\x06\x01\0\0\0\0\xbf\x12\0\0\0\0\0\0\x57\x02\0\0\x02\0\0\0\x15\
 +\x02\x03\x01\0\0\0\0\x61\xa1\x5c\xff\0\0\0\0\x63\x1a\xa0\xff\0\0\0\0\x61\xa1\
 +\x60\xff\0\0\0\0\x63\x1a\xa4\xff\0\0\0\0\x69\xa1\x58\xff\0\0\0\0\x6b\x1a\xa8\
 +\xff\0\0\0\0\x69\xa1\x5a\xff\0\0\0\0\x6b\x1a\xaa\xff\0\0\0\0\x05\0\x65\x01\0\0\
 +\0\0\xb7\x01\0\0\x01\0\0\0\x73\x1a\x51\xff\0\0\0\0\xb7\x01\0\0\0\0\0\0\x7b\x1a\
 +\xf0\xff\0\0\0\0\x7b\x1a\xe8\xff\0\0\0\0\x7b\x1a\xe0\xff\0\0\0\0\x7b\x1a\xd8\
 +\xff\0\0\0\0\x7b\x1a\xd0\xff\0\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\xd0\xff\
 +\xff\xff\xb7\x01\0\0\x28\0\0\0\x7b\x1a\x40\xff\0\0\0\0\xbf\x81\0\0\0\0\0\0\xb7\
 +\x02\0\0\0\0\0\0\xb7\x04\0\0\x28\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\0\0\
 +\0\x67\0\0\0\x20\0\0\0\x77\0\0\0\x20\0\0\0\x55\0\x10\x01\0\0\0\0\x79\xa1\xe0\
 +\xff\0\0\0\0\x63\x1a\x64\xff\0\0\0\0\x77\x01\0\0\x20\0\0\0\x63\x1a\x68\xff\0\0\
 +\0\0\x79\xa1\xd8\xff\0\0\0\0\x63\x1a\x5c\xff\0\0\0\0\x77\x01\0\0\x20\0\0\0\x63\
 +\x1a\x60\xff\0\0\0\0\x79\xa1\xe8\xff\0\0\0\0\x63\x1a\x6c\xff\0\0\0\0\x77\x01\0\
 +\0\x20\0\0\0\x63\x1a\x70\xff\0\0\0\0\x79\xa1\xf0\xff\0\0\0\0\x63\x1a\x74\xff\0\
 +\0\0\0\x77\x01\0\0\x20\0\0\0\x63\x1a\x78\xff\0\0\0\0\x71\xa9\xd6\xff\0\0\0\0\
 +\x25\x09\xff\0\x3c\0\0\0\xb7\x01\0\0\x01\0\0\0\x6f\x91\0\0\0\0\0\0\x18\x02\0\0\
 +\x01\0\0\0\0\0\0\0\0\x18\0\x1c\x5f\x21\0\0\0\0\0\0\x55\x01\x01\0\0\0\0\0\x05\0\
 +\xf8\0\0\0\0\0\xb7\x01\0\0\0\0\0\0\x6b\x1a\xfe\xff\0\0\0\0\xb7\x01\0\0\x28\0\0\
 +\0\x7b\x1a\x40\xff\0\0\0\0\xbf\xa1\0\0\0\0\0\0\x07\x01\0\0\x8c\xff\xff\xff\x7b\
 +\x1a\x18\xff\0\0\0\0\xbf\xa1\0\0\0\0\0\0\x07\x01\0\0\x7c\xff\xff\xff\x7b\x1a\
 +\x10\xff\0\0\0\0\xb7\x01\0\0\0\0\0\0\x7b\x1a\x28\xff\0\0\0\0\x7b\x7a\x20\xff\0\
 +\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\xfe\xff\xff\xff\xbf\x81\0\0\0\0\0\0\x79\
 +\xa2\x40\xff\0\0\0\0\xb7\x04\0\0\x02\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\
 +\0\0\0\x67\0\0\0\x20\0\0\0\x77\0\0\0\x20\0\0\0\x15\0\x01\0\0\0\0\0\x05\0\x90\
 +\x01\0\0\0\0\xbf\x91\0\0\0\0\0\0\x15\x01\x23\0\x3c\0\0\0\x15\x01\x59\0\x2c\0\0\
 +\0\x55\x01\x5a\0\x2b\0\0\0\xb7\x01\0\0\0\0\0\0\x63\x1a\xf8\xff\0\0\0\0\xbf\xa3\
 +\0\0\0\0\0\0\x07\x03\0\0\xf8\xff\xff\xff\xbf\x81\0\0\0\0\0\0\x79\xa2\x40\xff\0\
 +\0\0\0\xb7\x04\0\0\x04\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\0\0\0\xbf\x01\
 +\0\0\0\0\0\0\x67\x01\0\0\x20\0\0\0\x77\x01\0\0\x20\0\0\0\x55\x01\x03\x01\0\0\0\
 +\0\x71\xa1\xfa\xff\0\0\0\0\x55\x01\x4b\0\x02\0\0\0\x71\xa1\xf9\xff\0\0\0\0\x55\
 +\x01\x49\0\x02\0\0\0\x71\xa1\xfb\xff\0\0\0\0\x55\x01\x47\0\x01\0\0\0\x79\xa2\
 +\x40\xff\0\0\0\0\x07\x02\0\0\x08\0\0\0\xbf\x81\0\0\0\0\0\0\x79\xa3\x18\xff\0\0\
 +\0\0\xb7\x04\0\0\x10\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\0\0\0\xbf\x01\0\
 +\0\0\0\0\0\x67\x01\0\0\x20\0\0\0\x77\x01\0\0\x20\0\0\0\x55\x01\xf2\0\0\0\0\0\
 +\xb7\x01\0\0\x01\0\0\0\x73\x1a\x55\xff\0\0\0\0\x05\0\x39\0\0\0\0\0\xb7\x01\0\0\
 +\0\0\0\0\x6b\x1a\xf8\xff\0\0\0\0\xb7\x09\0\0\x02\0\0\0\xb7\x07\0\0\x1e\0\0\0\
 +\x05\0\x0e\0\0\0\0\0\x79\xa2\x38\xff\0\0\0\0\x0f\x29\0\0\0\0\0\0\xbf\x92\0\0\0\
 +\0\0\0\x07\x02\0\0\x01\0\0\0\x71\xa3\xff\xff\0\0\0\0\x67\x03\0\0\x03\0\0\0\x2d\
 +\x23\x02\0\0\0\0\0\x79\xa7\x20\xff\0\0\0\0\x05\0\x2b\0\0\0\0\0\x07\x07\0\0\xff\
 +\xff\xff\xff\xbf\x72\0\0\0\0\0\0\x67\x02\0\0\x20\0\0\0\x77\x02\0\0\x20\0\0\0\
 +\x15\x02\xf9\xff\0\0\0\0\x7b\x9a\x38\xff\0\0\0\0\x79\xa1\x40\xff\0\0\0\0\x0f\
 +\x19\0\0\0\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\xf8\xff\xff\xff\xbf\x81\0\0\0\
 +\0\0\0\xbf\x92\0\0\0\0\0\0\xb7\x04\0\0\x02\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\
 +\0\x44\0\0\0\xbf\x01\0\0\0\0\0\0\x67\x01\0\0\x20\0\0\0\x77\x01\0\0\x20\0\0\0\
 +\x55\x01\x94\0\0\0\0\0\x71\xa2\xf8\xff\0\0\0\0\x55\x02\x0f\0\xc9\0\0\0\x07\x09\
 +\0\0\x02\0\0\0\xbf\x81\0\0\0\0\0\0\xbf\x92\0\0\0\0\0\0\x79\xa3\x10\xff\0\0\0\0\
 +\xb7\x04\0\0\x10\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\0\0\0\xbf\x01\0\0\0\
 +\0\0\0\x67\x01\0\0\x20\0\0\0\x77\x01\0\0\x20\0\0\0\x55\x01\x87\0\0\0\0\0\xb7\
 +\x01\0\0\x01\0\0\0\x73\x1a\x54\xff\0\0\0\0\x79\xa7\x20\xff\0\0\0\0\x05\0\x07\0\
 +\0\0\0\0\xb7\x09\0\0\x01\0\0\0\x15\x02\xd1\xff\0\0\0\0\x71\xa9\xf9\xff\0\0\0\0\
 +\x07\x09\0\0\x02\0\0\0\x05\0\xce\xff\0\0\0\0\xb7\x01\0\0\x01\0\0\0\x73\x1a\x56\
 +\xff\0\0\0\0\x71\xa1\xff\xff\0\0\0\0\x67\x01\0\0\x03\0\0\0\x79\xa2\x40\xff\0\0\
 +\0\0\x0f\x12\0\0\0\0\0\0\x07\x02\0\0\x08\0\0\0\x7b\x2a\x40\xff\0\0\0\0\x71\xa9\
 +\xfe\xff\0\0\0\0\x25\x09\x0e\0\x3c\0\0\0\xb7\x01\0\0\x01\0\0\0\x6f\x91\0\0\0\0\
 +\0\0\x18\x02\0\0\x01\0\0\0\0\0\0\0\0\x18\0\x1c\x5f\x21\0\0\0\0\0\0\x55\x01\x01\
 +\0\0\0\0\0\x05\0\x07\0\0\0\0\0\x79\xa1\x28\xff\0\0\0\0\x07\x01\0\0\x01\0\0\0\
 +\x7b\x1a\x28\xff\0\0\0\0\x67\x01\0\0\x20\0\0\0\x77\x01\0\0\x20\0\0\0\x55\x01\
 +\x82\xff\x0b\0\0\0\x05\0\x10\xff\0\0\0\0\x15\x09\xf8\xff\x87\0\0\0\x05\0\xfd\
 +\xff\0\0\0\0\x71\xa1\x51\xff\0\0\0\0\x79\xa0\x30\xff\0\0\0\0\x15\x01\x17\x01\0\
 +\0\0\0\x71\x62\x03\0\0\0\0\0\x67\x02\0\0\x08\0\0\0\x71\x61\x02\0\0\0\0\0\x4f\
 +\x12\0\0\0\0\0\0\x71\x63\x04\0\0\0\0\0\x71\x61\x05\0\0\0\0\0\x67\x01\0\0\x08\0\
 +\0\0\x4f\x31\0\0\0\0\0\0\x67\x01\0\0\x10\0\0\0\x4f\x21\0\0\0\0\0\0\x71\xa2\x53\
 +\xff\0\0\0\0\x15\x02\x3d\0\0\0\0\0\xbf\x12\0\0\0\0\0\0\x57\x02\0\0\x10\0\0\0\
 +\x15\x02\x3a\0\0\0\0\0\xbf\xa2\0\0\0\0\0\0\x07\x02\0\0\x5c\xff\xff\xff\x71\xa4\
 +\x54\xff\0\0\0\0\xbf\x23\0\0\0\0\0\0\x15\x04\x02\0\0\0\0\0\xbf\xa3\0\0\0\0\0\0\
 +\x07\x03\0\0\x7c\xff\xff\xff\x67\x01\0\0\x38\0\0\0\xc7\x01\0\0\x38\0\0\0\x65\
 +\x01\x01\0\xff\xff\xff\xff\xbf\x32\0\0\0\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\
 +\x6c\xff\xff\xff\x71\xa5\x55\xff\0\0\0\0\xbf\x34\0\0\0\0\0\0\x15\x05\x02\0\0\0\
 +\0\0\xbf\xa4\0\0\0\0\0\0\x07\x04\0\0\x8c\xff\xff\xff\x65\x01\x01\0\xff\xff\xff\
 +\xff\xbf\x43\0\0\0\0\0\0\x61\x21\x04\0\0\0\0\0\x67\x01\0\0\x20\0\0\0\x61\x24\0\
 +\0\0\0\0\0\x4f\x41\0\0\0\0\0\0\x7b\x1a\xa0\xff\0\0\0\0\x61\x21\x08\0\0\0\0\0\
 +\x61\x22\x0c\0\0\0\0\0\x67\x02\0\0\x20\0\0\0\x4f\x12\0\0\0\0\0\0\x7b\x2a\xa8\
 +\xff\0\0\0\0\x61\x31\0\0\0\0\0\0\x61\x32\x04\0\0\0\0\0\x61\x34\x08\0\0\0\0\0\
 +\x61\x33\x0c\0\0\0\0\0\x69\xa5\x5a\xff\0\0\0\0\x6b\x5a\xc2\xff\0\0\0\0\x69\xa5\
 +\x58\xff\0\0\0\0\x6b\x5a\xc0\xff\0\0\0\0\x67\x03\0\0\x20\0\0\0\x4f\x43\0\0\0\0\
 +\0\0\x7b\x3a\xb8\xff\0\0\0\0\x67\x02\0\0\x20\0\0\0\x4f\x12\0\0\0\0\0\0\x7b\x2a\
 +\xb0\xff\0\0\0\0\x05\0\x6b\0\0\0\0\0\x71\xa2\x52\xff\0\0\0\0\x15\x02\x04\0\0\0\
 +\0\0\xbf\x12\0\0\0\0\0\0\x57\x02\0\0\x04\0\0\0\x15\x02\x01\0\0\0\0\0\x05\0\xf7\
 +\xfe\0\0\0\0\x57\x01\0\0\x01\0\0\0\x15\x01\xd3\0\0\0\0\0\x61\xa1\x5c\xff\0\0\0\
 +\0\x63\x1a\xa0\xff\0\0\0\0\x61\xa1\x60\xff\0\0\0\0\x63\x1a\xa4\xff\0\0\0\0\x05\
 +\0\x5e\0\0\0\0\0\x71\xa2\x52\xff\0\0\0\0\x15\x02\x1e\0\0\0\0\0\xbf\x12\0\0\0\0\
 +\0\0\x57\x02\0\0\x20\0\0\0\x15\x02\x1b\0\0\0\0\0\xbf\xa2\0\0\0\0\0\0\x07\x02\0\
 +\0\x5c\xff\xff\xff\x71\xa4\x54\xff\0\0\0\0\xbf\x23\0\0\0\0\0\0\x15\x04\x02\0\0\
 +\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\x7c\xff\xff\xff\x57\x01\0\0\0\x01\0\0\
 +\x15\x01\x01\0\0\0\0\0\xbf\x32\0\0\0\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\x6c\
 +\xff\xff\xff\x71\xa5\x55\xff\0\0\0\0\xbf\x34\0\0\0\0\0\0\x15\x05\x02\0\0\0\0\0\
 +\xbf\xa4\0\0\0\0\0\0\x07\x04\0\0\x8c\xff\xff\xff\x15\x01\xc3\xff\0\0\0\0\x05\0\
 +\xc1\xff\0\0\0\0\xb7\x09\0\0\x3c\0\0\0\x79\xa7\x20\xff\0\0\0\0\x67\0\0\0\x20\0\
 +\0\0\x77\0\0\0\x20\0\0\0\x15\0\xa5\xfe\0\0\0\0\x05\0\xb0\0\0\0\0\0\x15\x09\x07\
 +\xff\x87\0\0\0\x05\0\xa2\xfe\0\0\0\0\xbf\x12\0\0\0\0\0\0\x57\x02\0\0\x08\0\0\0\
 +\x15\x02\xab\0\0\0\0\0\xbf\xa2\0\0\0\0\0\0\x07\x02\0\0\x5c\xff\xff\xff\x71\xa4\
 +\x54\xff\0\0\0\0\xbf\x23\0\0\0\0\0\0\x15\x04\x02\0\0\0\0\0\xbf\xa3\0\0\0\0\0\0\
 +\x07\x03\0\0\x7c\xff\xff\xff\x57\x01\0\0\x40\0\0\0\x15\x01\x01\0\0\0\0\0\xbf\
 +\x32\0\0\0\0\0\0\x61\x23\x04\0\0\0\0\0\x67\x03\0\0\x20\0\0\0\x61\x24\0\0\0\0\0\
 +\0\x4f\x43\0\0\0\0\0\0\x7b\x3a\xa0\xff\0\0\0\0\x61\x23\x08\0\0\0\0\0\x61\x22\
 +\x0c\0\0\0\0\0\x67\x02\0\0\x20\0\0\0\x4f\x32\0\0\0\0\0\0\x7b\x2a\xa8\xff\0\0\0\
 +\0\x15\x01\x1c\0\0\0\0\0\x71\xa1\x55\xff\0\0\0\0\x15\x01\x1a\0\0\0\0\0\x61\xa1\
 +\x98\xff\0\0\0\0\x67\x01\0\0\x20\0\0\0\x61\xa2\x94\xff\0\0\0\0\x4f\x21\0\0\0\0\
 +\0\0\x7b\x1a\xb8\xff\0\0\0\0\x61\xa1\x90\xff\0\0\0\0\x67\x01\0\0\x20\0\0\0\x61\
 +\xa2\x8c\xff\0\0\0\0\x05\0\x19\0\0\0\0\0\xb7\x01\0\0\x01\0\0\0\x73\x1a\x52\xff\
 +\0\0\0\0\xb7\x01\0\0\0\0\0\0\x7b\x1a\xd0\xff\0\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\
 +\x03\0\0\xd0\xff\xff\xff\xbf\x81\0\0\0\0\0\0\x79\xa2\x40\xff\0\0\0\0\xb7\x04\0\
 +\0\x08\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\0\0\0\x67\0\0\0\x20\0\0\0\x77\
 +\0\0\0\x20\0\0\0\x55\0\x7d\0\0\0\0\0\x05\0\x88\xfe\0\0\0\0\xb7\x09\0\0\x2b\0\0\
 +\0\x05\0\xc6\xff\0\0\0\0\x61\xa1\x78\xff\0\0\0\0\x67\x01\0\0\x20\0\0\0\x61\xa2\
 +\x74\xff\0\0\0\0\x4f\x21\0\0\0\0\0\0\x7b\x1a\xb8\xff\0\0\0\0\x61\xa1\x70\xff\0\
 +\0\0\0\x67\x01\0\0\x20\0\0\0\x61\xa2\x6c\xff\0\0\0\0\x4f\x21\0\0\0\0\0\0\x7b\
 +\x1a\xb0\xff\0\0\0\0\xb7\x01\0\0\0\0\0\0\x07\x07\0\0\x04\0\0\0\x61\x03\0\0\0\0\
 +\0\0\xb7\x05\0\0\0\0\0\0\x05\0\x4e\0\0\0\0\0\xaf\x52\0\0\0\0\0\0\xbf\x75\0\0\0\
 +\0\0\0\x0f\x15\0\0\0\0\0\0\x71\x55\0\0\0\0\0\0\x67\x03\0\0\x01\0\0\0\xbf\x50\0\
 +\0\0\0\0\0\x77\0\0\0\x07\0\0\0\x4f\x03\0\0\0\0\0\0\xbf\x40\0\0\0\0\0\0\x67\0\0\
 +\0\x39\0\0\0\xc7\0\0\0\x3f\0\0\0\x5f\x30\0\0\0\0\0\0\xaf\x02\0\0\0\0\0\0\xbf\
 +\x50\0\0\0\0\0\0\x77\0\0\0\x06\0\0\0\x57\0\0\0\x01\0\0\0\x67\x03\0\0\x01\0\0\0\
 +\x4f\x03\0\0\0\0\0\0\xbf\x40\0\0\0\0\0\0\x67\0\0\0\x3a\0\0\0\xc7\0\0\0\x3f\0\0\
 +\0\x5f\x30\0\0\0\0\0\0\xaf\x02\0\0\0\0\0\0\x67\x03\0\0\x01\0\0\0\xbf\x50\0\0\0\
 +\0\0\0\x77\0\0\0\x05\0\0\0\x57\0\0\0\x01\0\0\0\x4f\x03\0\0\0\0\0\0\xbf\x40\0\0\
 +\0\0\0\0\x67\0\0\0\x3b\0\0\0\xc7\0\0\0\x3f\0\0\0\x5f\x30\0\0\0\0\0\0\xaf\x02\0\
 +\0\0\0\0\0\x67\x03\0\0\x01\0\0\0\xbf\x50\0\0\0\0\0\0\x77\0\0\0\x04\0\0\0\x57\0\
 +\0\0\x01\0\0\0\x4f\x03\0\0\0\0\0\0\xbf\x40\0\0\0\0\0\0\x67\0\0\0\x3c\0\0\0\xc7\
 +\0\0\0\x3f\0\0\0\x5f\x30\0\0\0\0\0\0\xaf\x02\0\0\0\0\0\0\xbf\x50\0\0\0\0\0\0\
 +\x77\0\0\0\x03\0\0\0\x57\0\0\0\x01\0\0\0\x67\x03\0\0\x01\0\0\0\x4f\x03\0\0\0\0\
 +\0\0\xbf\x40\0\0\0\0\0\0\x67\0\0\0\x3d\0\0\0\xc7\0\0\0\x3f\0\0\0\x5f\x30\0\0\0\
 +\0\0\0\xaf\x02\0\0\0\0\0\0\xbf\x50\0\0\0\0\0\0\x77\0\0\0\x02\0\0\0\x57\0\0\0\
 +\x01\0\0\0\x67\x03\0\0\x01\0\0\0\x4f\x03\0\0\0\0\0\0\xbf\x40\0\0\0\0\0\0\x67\0\
 +\0\0\x3e\0\0\0\xc7\0\0\0\x3f\0\0\0\x5f\x30\0\0\0\0\0\0\xaf\x02\0\0\0\0\0\0\xbf\
 +\x50\0\0\0\0\0\0\x77\0\0\0\x01\0\0\0\x57\0\0\0\x01\0\0\0\x67\x03\0\0\x01\0\0\0\
 +\x4f\x03\0\0\0\0\0\0\x57\x04\0\0\x01\0\0\0\x87\x04\0\0\0\0\0\0\x5f\x34\0\0\0\0\
 +\0\0\xaf\x42\0\0\0\0\0\0\x57\x05\0\0\x01\0\0\0\x67\x03\0\0\x01\0\0\0\x4f\x53\0\
 +\0\0\0\0\0\x07\x01\0\0\x01\0\0\0\xbf\x25\0\0\0\0\0\0\x15\x01\x0b\0\x24\0\0\0\
 +\xbf\xa2\0\0\0\0\0\0\x07\x02\0\0\xa0\xff\xff\xff\x0f\x12\0\0\0\0\0\0\x71\x24\0\
 +\0\0\0\0\0\xbf\x40\0\0\0\0\0\0\x67\0\0\0\x38\0\0\0\xc7\0\0\0\x38\0\0\0\xb7\x02\
 +\0\0\0\0\0\0\x65\0\xa9\xff\xff\xff\xff\xff\xbf\x32\0\0\0\0\0\0\x05\0\xa7\xff\0\
 +\0\0\0\xbf\x21\0\0\0\0\0\0\x67\x01\0\0\x20\0\0\0\x77\x01\0\0\x20\0\0\0\x15\x01\
 +\x0e\0\0\0\0\0\x71\x63\x06\0\0\0\0\0\x71\x64\x07\0\0\0\0\0\x67\x04\0\0\x08\0\0\
 +\0\x4f\x34\0\0\0\0\0\0\x3f\x41\0\0\0\0\0\0\x2f\x41\0\0\0\0\0\0\x1f\x12\0\0\0\0\
 +\0\0\x63\x2a\x50\xff\0\0\0\0\xbf\xa2\0\0\0\0\0\0\x07\x02\0\0\x50\xff\xff\xff\
 +\x18\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x85\0\0\0\x01\0\0\0\x55\0\x05\0\0\0\0\0\
 +\x71\x61\x08\0\0\0\0\0\x71\x60\x09\0\0\0\0\0\x67\0\0\0\x08\0\0\0\x4f\x10\0\0\0\
 +\0\0\0\x95\0\0\0\0\0\0\0\x69\0\0\0\0\0\0\0\x05\0\xfd\xff\0\0\0\0\x02\0\0\0\x04\
 +\0\0\0\x0a\0\0\0\x01\0\0\0\0\0\0\0\x02\0\0\0\x04\0\0\0\x28\0\0\0\x01\0\0\0\0\0\
 +\0\0\x02\0\0\0\x04\0\0\0\x02\0\0\0\x80\0\0\0\0\0\0\0\x47\x50\x4c\x20\x76\x32\0\
 +\0\0\0\0\0\x10\0\0\0\0\0\0\0\x01\x7a\x52\0\x08\x7c\x0b\x01\x0c\0\0\0\x18\0\0\0\
 +\x18\0\0\0\0\0\0\0\0\0\0\0\xd8\x13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
 +\0\0\0\0\0\0\0\0\0\0\0\0\xa0\0\0\0\x04\0\xf1\xff\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
 +\0\x60\x02\0\0\0\0\x03\0\x20\x02\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x3f\x02\0\0\0\0\
 +\x03\0\xd0\x0f\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xed\x01\0\0\0\0\x03\0\x10\x10\0\0\0\
 +\0\0\0\0\0\0\0\0\0\0\0\xd4\x01\0\0\0\0\x03\0\x20\x10\0\0\0\0\0\0\0\0\0\0\0\0\0\
 +\0\xa3\x01\0\0\0\0\x03\0\xb8\x12\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x63\x01\0\0\0\0\
 +\x03\0\x48\x10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x2a\x01\0\0\0\0\x03\0\x10\x13\0\0\0\
 +\0\0\0\0\0\0\0\0\0\0\0\xe1\0\0\0\0\0\x03\0\xa0\x13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
 +\x2e\x02\0\0\0\0\x03\0\x28\x02\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x68\x02\0\0\0\0\x03\
 +\0\xc0\x13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x36\x02\0\0\0\0\x03\0\xc8\x13\0\0\0\0\0\
 +\0\0\0\0\0\0\0\0\0\x22\x01\0\0\0\0\x03\0\xe8\x02\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
 +\x02\x01\0\0\0\0\x03\0\x40\x03\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xd9\0\0\0\0\0\x03\0\
 +\xf8\x04\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x26\x02\0\0\0\0\x03\0\x20\x0e\0\0\0\0\0\0\
 +\0\0\0\0\0\0\0\0\xcc\x01\0\0\0\0\x03\0\x60\x06\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x9b\
 +\x01\0\0\0\0\x03\0\xc8\x06\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x5b\x01\0\0\0\0\x03\0\
 +\x20\x07\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x7c\x01\0\0\0\0\x03\0\x48\x08\0\0\0\0\0\0\
 +\0\0\0\0\0\0\0\0\x53\x01\0\0\0\0\x03\0\xb8\x08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x1a\
 +\x01\0\0\0\0\x03\0\xe0\x08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x84\x01\0\0\0\0\x03\0\
 +\xb8\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x1e\x02\0\0\0\0\x03\0\xd8\x09\0\0\0\0\0\0\0\
 +\0\0\0\0\0\0\0\xc4\x01\0\0\0\0\x03\0\x70\x08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x93\
 +\x01\0\0\0\0\x03\0\xa8\x08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x74\x01\0\0\0\0\x03\0\
 +\xf0\x0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x4b\x01\0\0\0\0\x03\0\0\x0a\0\0\0\0\0\0\0\
 +\0\0\0\0\0\0\0\x12\x01\0\0\0\0\x03\0\x10\x0a\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xfa\0\
 +\0\0\0\0\x03\0\xc0\x0a\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x58\x02\0\0\0\0\x03\0\x88\
 +\x0a\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x16\x02\0\0\0\0\x03\0\xb8\x0a\0\0\0\0\0\0\0\0\
 +\0\0\0\0\0\0\xe5\x01\0\0\0\0\x03\0\xc0\x0f\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xbc\x01\
 +\0\0\0\0\x03\0\0\x0e\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x8b\x01\0\0\0\0\x03\0\x18\x0e\
 +\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xd1\0\0\0\0\0\x03\0\0\x04\0\0\0\0\0\0\0\0\0\0\0\0\
 +\0\0\x50\x02\0\0\0\0\x03\0\x20\x04\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x0e\x02\0\0\0\0\
 +\x03\0\x48\x0f\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x6c\x01\0\0\0\0\x03\0\xb0\x04\0\0\0\
 +\0\0\0\0\0\0\0\0\0\0\0\x43\x01\0\0\0\0\x03\0\xc8\x0c\0\0\0\0\0\0\0\0\0\0\0\0\0\
 +\0\xc9\0\0\0\0\0\x03\0\xf8\x0c\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x06\x02\0\0\0\0\x03\
 +\0\xd0\x0a\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x3b\x01\0\0\0\0\x03\0\x98\x0b\0\0\0\0\0\
 +\0\0\0\0\0\0\0\0\0\xf2\0\0\0\0\0\x03\0\xb8\x0b\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x48\
 +\x02\0\0\0\0\x03\0\xf0\x0b\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xfe\x01\0\0\0\0\x03\0\
 +\xf8\x0b\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xdd\x01\0\0\0\0\x03\0\0\x0c\0\0\0\0\0\0\0\
 +\0\0\0\0\0\0\0\xb4\x01\0\0\0\0\x03\0\x30\x0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x0a\
 +\x01\0\0\0\0\x03\0\x90\x0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xc1\0\0\0\0\0\x03\0\xa8\
 +\x0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xba\0\0\0\0\0\x03\0\xd0\x01\0\0\0\0\0\0\0\0\0\
 +\0\0\0\0\0\xf6\x01\0\0\0\0\x03\0\xe0\x0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xac\x01\0\
 +\0\0\0\x03\0\x30\x0e\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x33\x01\0\0\0\0\x03\0\x80\x0e\
 +\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xea\0\0\0\0\0\x03\0\x98\x0e\0\0\0\0\0\0\0\0\0\0\0\
 +\0\0\0\0\0\0\0\x03\0\x03\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x6b\0\0\0\x11\0\x06\
 +\0\0\0\0\0\0\0\0\0\x07\0\0\0\0\0\0\0\x25\0\0\0\x11\0\x05\0\0\0\0\0\0\0\0\0\x14\
 +\0\0\0\0\0\0\0\x82\0\0\0\x11\0\x05\0\x28\0\0\0\0\0\0\0\x14\0\0\0\0\0\0\0\x01\0\
 +\0\0\x11\0\x05\0\x14\0\0\0\0\0\0\0\x14\0\0\0\0\0\0\0\x40\0\0\0\x12\0\x03\0\0\0\
 +\0\0\0\0\0\0\xd8\x13\0\0\0\0\0\0\x28\0\0\0\0\0\0\0\x01\0\0\0\x3a\0\0\0\x50\0\0\
 +\0\0\0\0\0\x01\0\0\0\x3c\0\0\0\x80\x13\0\0\0\0\0\0\x01\0\0\0\x3b\0\0\0\x1c\0\0\
 +\0\0\0\0\0\x01\0\0\0\x38\0\0\0\0\x74\x61\x70\x5f\x72\x73\x73\x5f\x6d\x61\x70\
 +\x5f\x74\x6f\x65\x70\x6c\x69\x74\x7a\x5f\x6b\x65\x79\0\x2e\x74\x65\x78\x74\0\
 +\x6d\x61\x70\x73\0\x74\x61\x70\x5f\x72\x73\x73\x5f\x6d\x61\x70\x5f\x63\x6f\x6e\
 +\x66\x69\x67\x75\x72\x61\x74\x69\x6f\x6e\x73\0\x74\x75\x6e\x5f\x72\x73\x73\x5f\
 +\x73\x74\x65\x65\x72\x69\x6e\x67\x5f\x70\x72\x6f\x67\0\x2e\x72\x65\x6c\x74\x75\
 +\x6e\x5f\x72\x73\x73\x5f\x73\x74\x65\x65\x72\x69\x6e\x67\0\x5f\x6c\x69\x63\x65\
 +\x6e\x73\x65\0\x2e\x72\x65\x6c\x2e\x65\x68\x5f\x66\x72\x61\x6d\x65\0\x74\x61\
 +\x70\x5f\x72\x73\x73\x5f\x6d\x61\x70\x5f\x69\x6e\x64\x69\x72\x65\x63\x74\x69\
 +\x6f\x6e\x5f\x74\x61\x62\x6c\x65\0\x72\x73\x73\x2e\x62\x70\x66\x2e\x63\0\x2e\
 +\x73\x74\x72\x74\x61\x62\0\x2e\x73\x79\x6d\x74\x61\x62\0\x4c\x42\x42\x30\x5f\
 +\x39\0\x4c\x42\x42\x30\x5f\x38\x39\0\x4c\x42\x42\x30\x5f\x36\x39\0\x4c\x42\x42\
 +\x30\x5f\x35\x39\0\x4c\x42\x42\x30\x5f\x31\x39\0\x4c\x42\x42\x30\x5f\x31\x30\
 +\x39\0\x4c\x42\x42\x30\x5f\x39\x38\0\x4c\x42\x42\x30\x5f\x37\x38\0\x4c\x42\x42\
 +\x30\x5f\x34\x38\0\x4c\x42\x42\x30\x5f\x31\x38\0\x4c\x42\x42\x30\x5f\x38\x37\0\
 +\x4c\x42\x42\x30\x5f\x34\x37\0\x4c\x42\x42\x30\x5f\x33\x37\0\x4c\x42\x42\x30\
 +\x5f\x31\x37\0\x4c\x42\x42\x30\x5f\x31\x30\x37\0\x4c\x42\x42\x30\x5f\x39\x36\0\
 +\x4c\x42\x42\x30\x5f\x37\x36\0\x4c\x42\x42\x30\x5f\x36\x36\0\x4c\x42\x42\x30\
 +\x5f\x34\x36\0\x4c\x42\x42\x30\x5f\x33\x36\0\x4c\x42\x42\x30\x5f\x32\x36\0\x4c\
 +\x42\x42\x30\x5f\x31\x30\x36\0\x4c\x42\x42\x30\x5f\x36\x35\0\x4c\x42\x42\x30\
 +\x5f\x34\x35\0\x4c\x42\x42\x30\x5f\x33\x35\0\x4c\x42\x42\x30\x5f\x34\0\x4c\x42\
 +\x42\x30\x5f\x35\x34\0\x4c\x42\x42\x30\x5f\x34\x34\0\x4c\x42\x42\x30\x5f\x32\
 +\x34\0\x4c\x42\x42\x30\x5f\x31\x30\x34\0\x4c\x42\x42\x30\x5f\x39\x33\0\x4c\x42\
 +\x42\x30\x5f\x38\x33\0\x4c\x42\x42\x30\x5f\x35\x33\0\x4c\x42\x42\x30\x5f\x34\
 +\x33\0\x4c\x42\x42\x30\x5f\x32\x33\0\x4c\x42\x42\x30\x5f\x31\x30\x33\0\x4c\x42\
 +\x42\x30\x5f\x38\x32\0\x4c\x42\x42\x30\x5f\x35\x32\0\x4c\x42\x42\x30\x5f\x31\
 +\x30\x32\0\x4c\x42\x42\x30\x5f\x39\x31\0\x4c\x42\x42\x30\x5f\x38\x31\0\x4c\x42\
 +\x42\x30\x5f\x37\x31\0\x4c\x42\x42\x30\x5f\x36\x31\0\x4c\x42\x42\x30\x5f\x35\
 +\x31\0\x4c\x42\x42\x30\x5f\x34\x31\0\x4c\x42\x42\x30\x5f\x32\x31\0\x4c\x42\x42\
 +\x30\x5f\x31\x31\0\x4c\x42\x42\x30\x5f\x31\x31\x31\0\x4c\x42\x42\x30\x5f\x31\
 +\x30\x31\0\x4c\x42\x42\x30\x5f\x38\x30\0\x4c\x42\x42\x30\x5f\x36\x30\0\x4c\x42\
 +\x42\x30\x5f\x35\x30\0\x4c\x42\x42\x30\x5f\x31\x30\0\x4c\x42\x42\x30\x5f\x31\
 +\x31\x30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
 +\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xaa\
 +\0\0\0\x03\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xa0\x1a\0\0\0\0\0\0\x71\x02\0\
 +\0\0\0\0\0\0\0\0\0\0\0\0\0\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x1a\0\0\0\x01\0\0\
 +\0\x06\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x40\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
 +\0\0\0\0\x04\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x5a\0\0\0\x01\0\0\0\x06\0\0\0\0\0\0\
 +\0\0\0\0\0\0\0\0\0\x40\0\0\0\0\0\0\0\xd8\x13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x08\0\
 +\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x56\0\0\0\x09\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
 +\0\x60\x1a\0\0\0\0\0\0\x30\0\0\0\0\0\0\0\x09\0\0\0\x03\0\0\0\x08\0\0\0\0\0\0\0\
 +\x10\0\0\0\0\0\0\0\x20\0\0\0\x01\0\0\0\x03\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x18\
 +\x14\0\0\0\0\0\0\x3c\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x04\0\0\0\0\0\0\0\0\0\0\0\0\
 +\0\0\0\x6c\0\0\0\x01\0\0\0\x03\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x54\x14\0\0\0\0\0\
 +\0\x07\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x78\0\0\
 +\0\x01\0\0\0\x02\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x60\x14\0\0\0\0\0\0\x30\0\0\0\0\
 +\0\0\0\0\0\0\0\0\0\0\0\x08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x74\0\0\0\x09\0\0\0\0\
 +\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x90\x1a\0\0\0\0\0\0\x10\0\0\0\0\0\0\0\x09\0\0\0\
 +\x07\0\0\0\x08\0\0\0\0\0\0\0\x10\0\0\0\0\0\0\0\xb2\0\0\0\x02\0\0\0\0\0\0\0\0\0\
 +\0\0\0\0\0\0\0\0\0\0\x90\x14\0\0\0\0\0\0\xd0\x05\0\0\0\0\0\0\x01\0\0\0\x39\0\0\
 +\0\x08\0\0\0\0\0\0\0\x18\0\0\0\0\0\0\0";
 +
 +    return 0;
 +err:
 +    bpf_object__destroy_skeleton(s);
 +    return -1;
 +}
 +
 +#endif /* __RSS_BPF_SKEL_H__ */
 diff --git a/ebpf/trace-events b/ebpf/trace-events
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/ebpf/trace-events
@@ -XXX,XX +XXX,XX @@
 +# See docs/devel/tracing.txt for syntax documentation.
 +
 +# ebpf-rss.c
 +ebpf_error(const char *s1, const char *s2) "error in %s: %s"
 diff --git a/ebpf/trace.h b/ebpf/trace.h
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
 +++ b/ebpf/trace.h
@@ -0,0 +1 @@
 +#include "trace/trace-ebpf.h"
 diff --git a/meson.build b/meson.build
 index XXXXXXX..XXXXXXX 100644
---- a/meson.build
+--- a/qemu-options.hx
-+++ b/meson.build
++++ b/qemu-options.hx
-@@ -XXX,XX +XXX,XX @@ if not get_option('fuse_lseek').disabled()
+@@ -XXX,XX +XXX,XX @@ SRST
-   endif
+         stored. The file format is libpcap, so it can be analyzed with
- endif
+         tools such as tcpdump or Wireshark.
-+# libbpf
+-    ``-object colo-compare,id=id,primary_in=chardevid,secondary_in=chardevid,outdev=chardevid,iothread=id[,vnet_hdr_support][,notify_dev=id]``
-+libbpf = dependency('libbpf', required: get_option('bpf'), method: 'pkg-config')
++    ``-object colo-compare,id=id,primary_in=chardevid,secondary_in=chardevid,outdev=chardevid,iothread=id[,vnet_hdr_support][,notify_dev=id][,compare_timeout=@var{ms}]``
-+if libbpf.found() and not cc.links('''
+         Colo-compare gets packet from primary\_inchardevid and
-+   #include <bpf/libbpf.h>
+         secondary\_inchardevid, than compare primary packet with
-+   int main(void)
+         secondary packet. If the packets are same, we will output
-+   {
+@@ -XXX,XX +XXX,XX @@ SRST
-+     bpf_object__destroy_skeleton(NULL);
+         outdevchardevid. In order to improve efficiency, we need to put
-+     return 0;
+         the task of comparison in another thread. If it has the
-+   }''', dependencies: libbpf)
+         vnet\_hdr\_support flag, colo compare will send/recv packet with
-+  libbpf = not_found
+-        vnet\_hdr\_len. If you want to use Xen COLO, will need the
-+  if get_option('bpf').enabled()
+-        notify\_dev to notify Xen colo-frame to do checkpoint.
-+    error('libbpf skeleton test failed')
++        vnet\_hdr\_len. Then compare\_timeout=@var{ms} determines the
-+  else
++        maximum delay colo-compare wait for the packet.
-+    warning('libbpf skeleton test failed, disabling')
++        If you want to use Xen COLO, will need the notify\_dev to
-+  endif
++        notify Xen colo-frame to do checkpoint.
-+endif
-+
+         we must use it with the help of filter-mirror and
- if get_option('cfi')
+         filter-redirector.
    cfi_flags=[]
    # Check for dependency on LTO
@@ -XXX,XX +XXX,XX @@ endif
  config_host_data.set('CONFIG_GTK', gtk.found())
  config_host_data.set('CONFIG_LIBATTR', have_old_libattr)
  config_host_data.set('CONFIG_LIBCAP_NG', libcap_ng.found())
 +config_host_data.set('CONFIG_EBPF', libbpf.found())
  config_host_data.set('CONFIG_LIBISCSI', libiscsi.found())
  config_host_data.set('CONFIG_LIBNFS', libnfs.found())
  config_host_data.set('CONFIG_RBD', rbd.found())
@@ -XXX,XX +XXX,XX @@ if have_system
      'backends',
      'backends/tpm',
      'chardev',
 +    'ebpf',
      'hw/9pfs',
      'hw/acpi',
      'hw/adc',
@@ -XXX,XX +XXX,XX @@ subdir('accel')
  subdir('plugins')
  subdir('bsd-user')
  subdir('linux-user')
 +subdir('ebpf')
 +
 +common_ss.add(libbpf)
  bsd_user_ss.add(files('gdbstub.c'))
  specific_ss.add_all(when: 'CONFIG_BSD_USER', if_true: bsd_user_ss)
@@ -XXX,XX +XXX,XX @@ summary_info += {'RDMA support':      config_host.has_key('CONFIG_RDMA')}
  summary_info += {'PVRDMA support':    config_host.has_key('CONFIG_PVRDMA')}
  summary_info += {'fdt support':       fdt_opt == 'disabled' ? false : fdt_opt}
  summary_info += {'libcap-ng support': libcap_ng.found()}
 +summary_info += {'bpf support': libbpf.found()}
  # TODO: add back protocol and server version
  summary_info += {'spice support':     config_host.has_key('CONFIG_SPICE')}
  summary_info += {'rbd support':       rbd.found()}
 diff --git a/meson_options.txt b/meson_options.txt
 index XXXXXXX..XXXXXXX 100644
 --- a/meson_options.txt
 +++ b/meson_options.txt
@@ -XXX,XX +XXX,XX @@ option('bzip2', type : 'feature', value : 'auto',
         description: 'bzip2 support for DMG images')
  option('cap_ng', type : 'feature', value : 'auto',
         description: 'cap_ng support')
 +option('bpf', type : 'feature', value : 'auto',
 +        description: 'eBPF support')
  option('cocoa', type : 'feature', value : 'auto',
         description: 'Cocoa user interface (macOS only)')
  option('curl', type : 'feature', value : 'auto',
 --
-.7.4
+.5.0

-[PULL 1/7] net/tap: Added TUNSETSTEERINGEBPF code.
+[PULL V2 11/14] net/colo-compare.c: Expose "expired_scan_cycle" to users
-From: Andrew Melnychenko <andrew@daynix.com>
+From: Zhang Chen <chen.zhang@intel.com>
-Additional code that will be used for eBPF setting steering routine.
+The "expired_scan_cycle" determines period of scanning expired
 primary node net packets.
-Signed-off-by: Andrew Melnychenko <andrew@daynix.com>
+Signed-off-by: Zhang Chen <chen.zhang@intel.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- net/tap-linux.h | 1 +
+ net/colo-compare.c | 48 +++++++++++++++++++++++++++++++++++++++++++++---
-file changed, 1 insertion(+)
+ qemu-options.hx    |  4 +++-
 files changed, 48 insertions(+), 4 deletions(-)
-diff --git a/net/tap-linux.h b/net/tap-linux.h
+diff --git a/net/colo-compare.c b/net/colo-compare.c
 index XXXXXXX..XXXXXXX 100644
---- a/net/tap-linux.h
+--- a/net/colo-compare.c
-+++ b/net/tap-linux.h
++++ b/net/colo-compare.c
-@@ -XXX,XX +XXX,XX @@
+@@ -XXX,XX +XXX,XX @@ static NotifierList colo_compare_notifiers =
- #define TUNSETQUEUE  _IOW('T', 217, int)
+ #define COLO_COMPARE_FREE_PRIMARY     0x01
- #define TUNSETVNETLE _IOW('T', 220, int)
+ #define COLO_COMPARE_FREE_SECONDARY   0x02
- #define TUNSETVNETBE _IOW('T', 222, int)
-+#define TUNSETSTEERINGEBPF _IOR('T', 224, int)
+-/* TODO: Should be configurable */
+ #define REGULAR_PACKET_CHECK_MS 3000
- #endif
+ #define DEFAULT_TIME_OUT_MS 3000
@@ -XXX,XX +XXX,XX @@ typedef struct CompareState {
      SocketReadState notify_rs;
      bool vnet_hdr;
      uint32_t compare_timeout;
 +    uint32_t expired_scan_cycle;
      /*
       * Record the connection that through the NIC
@@ -XXX,XX +XXX,XX @@ static void check_old_packet_regular(void *opaque)
      /* if have old packet we will notify checkpoint */
      colo_old_packet_check(s);
      timer_mod(s->packet_check_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) +
 -                REGULAR_PACKET_CHECK_MS);
 +              s->expired_scan_cycle);
  }
  /* Public API, Used for COLO frame to notify compare event */
@@ -XXX,XX +XXX,XX @@ static void colo_compare_timer_init(CompareState *s)
                                  SCALE_MS, check_old_packet_regular,
                                  s);
      timer_mod(s->packet_check_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) +
 -                    REGULAR_PACKET_CHECK_MS);
 +              s->expired_scan_cycle);
  }
  static void colo_compare_timer_del(CompareState *s)
@@ -XXX,XX +XXX,XX @@ out:
      error_propagate(errp, local_err);
  }
 +static void compare_get_expired_scan_cycle(Object *obj, Visitor *v,
 +                                           const char *name, void *opaque,
 +                                           Error **errp)
 +{
 +    CompareState *s = COLO_COMPARE(obj);
 +    uint32_t value = s->expired_scan_cycle;
 +
 +    visit_type_uint32(v, name, &value, errp);
 +}
 +
 +static void compare_set_expired_scan_cycle(Object *obj, Visitor *v,
 +                                           const char *name, void *opaque,
 +                                           Error **errp)
 +{
 +    CompareState *s = COLO_COMPARE(obj);
 +    Error *local_err = NULL;
 +    uint32_t value;
 +
 +    visit_type_uint32(v, name, &value, &local_err);
 +    if (local_err) {
 +        goto out;
 +    }
 +    if (!value) {
 +        error_setg(&local_err, "Property '%s.%s' requires a positive value",
 +                   object_get_typename(obj), name);
 +        goto out;
 +    }
 +    s->expired_scan_cycle = value;
 +
 +out:
 +    error_propagate(errp, local_err);
 +}
 +
  static void compare_pri_rs_finalize(SocketReadState *pri_rs)
  {
      CompareState *s = container_of(pri_rs, CompareState, pri_rs);
@@ -XXX,XX +XXX,XX @@ static void colo_compare_complete(UserCreatable *uc, Error **errp)
          s->compare_timeout = DEFAULT_TIME_OUT_MS;
      }
 +    if (!s->expired_scan_cycle) {
 +        /* Set default value to 3000 MS */
 +        s->expired_scan_cycle = REGULAR_PACKET_CHECK_MS;
 +    }
 +
      if (find_and_check_chardev(&chr, s->pri_indev, errp) ||
          !qemu_chr_fe_init(&s->chr_pri_in, chr, errp)) {
          return;
@@ -XXX,XX +XXX,XX @@ static void colo_compare_init(Object *obj)
                          compare_get_timeout,
                          compare_set_timeout, NULL, NULL, NULL);
 +    object_property_add(obj, "expired_scan_cycle", "uint32",
 +                        compare_get_expired_scan_cycle,
 +                        compare_set_expired_scan_cycle, NULL, NULL, NULL);
 +
      s->vnet_hdr = false;
      object_property_add_bool(obj, "vnet_hdr_support", compare_get_vnet_hdr,
                               compare_set_vnet_hdr, NULL);
 diff --git a/qemu-options.hx b/qemu-options.hx
 index XXXXXXX..XXXXXXX 100644
 --- a/qemu-options.hx
 +++ b/qemu-options.hx
@@ -XXX,XX +XXX,XX @@ SRST
          stored. The file format is libpcap, so it can be analyzed with
          tools such as tcpdump or Wireshark.
 -    ``-object colo-compare,id=id,primary_in=chardevid,secondary_in=chardevid,outdev=chardevid,iothread=id[,vnet_hdr_support][,notify_dev=id][,compare_timeout=@var{ms}]``
 +    ``-object colo-compare,id=id,primary_in=chardevid,secondary_in=chardevid,outdev=chardevid,iothread=id[,vnet_hdr_support][,notify_dev=id][,compare_timeout=@var{ms}][,expired_scan_cycle=@var{ms}``
          Colo-compare gets packet from primary\_inchardevid and
          secondary\_inchardevid, than compare primary packet with
          secondary packet. If the packets are same, we will output
@@ -XXX,XX +XXX,XX @@ SRST
          vnet\_hdr\_support flag, colo compare will send/recv packet with
          vnet\_hdr\_len. Then compare\_timeout=@var{ms} determines the
          maximum delay colo-compare wait for the packet.
 +        The expired\_scan\_cycle=@var{ms} to set the period of scanning
 +        expired primary node network packets.
          If you want to use Xen COLO, will need the notify\_dev to
          notify Xen colo-frame to do checkpoint.
 --
-.7.4
+.5.0

-New patch
+[PULL V2 12/14] net: tulip: check frame size and r/w data length
+From: Prasad J Pandit <pjp@fedoraproject.org>
+Tulip network driver while copying tx/rx buffers does not check
+frame size against r/w data length. This may lead to OOB buffer
+access. Add check to avoid it.
+Limit iterations over descriptors to avoid potential infinite
+loop issue in tulip_xmit_list_update.
+Reported-by: Li Qiang <pangpei.lq@antfin.com>
+Reported-by: Ziming Zhang <ezrakiez@gmail.com>
+Reported-by: Jason Wang <jasowang@redhat.com>
+Tested-by: Li Qiang <liq3ea@gmail.com>
+Reviewed-by: Li Qiang <liq3ea@gmail.com>
+Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ hw/net/tulip.c | 36 +++++++++++++++++++++++++++---------
+file changed, 27 insertions(+), 9 deletions(-)
+diff --git a/hw/net/tulip.c b/hw/net/tulip.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/tulip.c
++++ b/hw/net/tulip.c
+@@ -XXX,XX +XXX,XX @@ static void tulip_copy_rx_bytes(TULIPState *s, struct tulip_descriptor *desc)
+         } else {
+             len = s->rx_frame_len;
+         }
++
++        if (s->rx_frame_len + len > sizeof(s->rx_frame)) {
++            return;
++        }
+         pci_dma_write(&s->dev, desc->buf_addr1, s->rx_frame +
+             (s->rx_frame_size - s->rx_frame_len), len);
+         s->rx_frame_len -= len;
+@@ -XXX,XX +XXX,XX @@ static void tulip_copy_rx_bytes(TULIPState *s, struct tulip_descriptor *desc)
+         } else {
+             len = s->rx_frame_len;
+         }
++
++        if (s->rx_frame_len + len > sizeof(s->rx_frame)) {
++            return;
++        }
+         pci_dma_write(&s->dev, desc->buf_addr2, s->rx_frame +
+             (s->rx_frame_size - s->rx_frame_len), len);
+         s->rx_frame_len -= len;
+@@ -XXX,XX +XXX,XX @@ static ssize_t tulip_receive(TULIPState *s, const uint8_t *buf, size_t size)
+     trace_tulip_receive(buf, size);
+-    if (size < 14 || size > 2048 || s->rx_frame_len || tulip_rx_stopped(s)) {
++    if (size < 14 || size > sizeof(s->rx_frame) - 4
++        || s->rx_frame_len || tulip_rx_stopped(s)) {
+         return 0;
+     }
+@@ -XXX,XX +XXX,XX @@ static ssize_t tulip_receive_nc(NetClientState *nc,
+     return tulip_receive(qemu_get_nic_opaque(nc), buf, size);
+ }
+-
+ static NetClientInfo net_tulip_info = {
+     .type = NET_CLIENT_DRIVER_NIC,
+     .size = sizeof(NICState),
+@@ -XXX,XX +XXX,XX @@ static void tulip_tx(TULIPState *s, struct tulip_descriptor *desc)
+         if ((s->csr[6] >> CSR6_OM_SHIFT) & CSR6_OM_MASK) {
+             /* Internal or external Loopback */
+             tulip_receive(s, s->tx_frame, s->tx_frame_len);
+-        } else {
++        } else if (s->tx_frame_len <= sizeof(s->tx_frame)) {
+             qemu_send_packet(qemu_get_queue(s->nic),
+                 s->tx_frame, s->tx_frame_len);
+         }
+@@ -XXX,XX +XXX,XX @@ static void tulip_tx(TULIPState *s, struct tulip_descriptor *desc)
+     }
+ }
+-static void tulip_copy_tx_buffers(TULIPState *s, struct tulip_descriptor *desc)
++static int tulip_copy_tx_buffers(TULIPState *s, struct tulip_descriptor *desc)
+ {
+     int len1 = (desc->control >> TDES1_BUF1_SIZE_SHIFT) & TDES1_BUF1_SIZE_MASK;
+     int len2 = (desc->control >> TDES1_BUF2_SIZE_SHIFT) & TDES1_BUF2_SIZE_MASK;
++    if (s->tx_frame_len + len1 > sizeof(s->tx_frame)) {
++        return -1;
++    }
+     if (len1) {
+         pci_dma_read(&s->dev, desc->buf_addr1,
+             s->tx_frame + s->tx_frame_len, len1);
+         s->tx_frame_len += len1;
+     }
++    if (s->tx_frame_len + len2 > sizeof(s->tx_frame)) {
++        return -1;
++    }
+     if (len2) {
+         pci_dma_read(&s->dev, desc->buf_addr2,
+             s->tx_frame + s->tx_frame_len, len2);
+         s->tx_frame_len += len2;
+     }
+     desc->status = (len1 + len2) ? 0 : 0x7fffffff;
++
++    return 0;
+ }
+ static void tulip_setup_filter_addr(TULIPState *s, uint8_t *buf, int n)
+@@ -XXX,XX +XXX,XX @@ static uint32_t tulip_ts(TULIPState *s)
+ static void tulip_xmit_list_update(TULIPState *s)
+ {
++#define TULIP_DESC_MAX 128
++    uint8_t i = 0;
+     struct tulip_descriptor desc;
+     if (tulip_ts(s) != CSR5_TS_SUSPENDED) {
+         return;
+     }
+-    for (;;) {
++    for (i = 0; i < TULIP_DESC_MAX; i++) {
+         tulip_desc_read(s, s->current_tx_desc, &desc);
+         tulip_dump_tx_descriptor(s, &desc);
+@@ -XXX,XX +XXX,XX @@ static void tulip_xmit_list_update(TULIPState *s)
+                 s->tx_frame_len = 0;
+             }
+-            tulip_copy_tx_buffers(s, &desc);
+-
+-            if (desc.control & TDES1_LS) {
+-                tulip_tx(s, &desc);
++            if (!tulip_copy_tx_buffers(s, &desc)) {
++                if (desc.control & TDES1_LS) {
++                    tulip_tx(s, &desc);
++                }
+             }
+         }
+         tulip_desc_write(s, s->current_tx_desc, &desc);
+--
+.5.0

-New patch
+[PULL V2 13/14] hw/net/allwinner-sun8i-emac.c: Fix REG_ADDR_HIGH/LOW reads
+From: Peter Maydell <peter.maydell@linaro.org>
+Coverity points out (CID 1421926) that the read code for
+REG_ADDR_HIGH reads off the end of the buffer, because it does a
+-bit read from byte 4 of a 6-byte buffer.
+The code also has an endianness issue for both REG_ADDR_HIGH and
+REG_ADDR_LOW, because it will do the wrong thing on a big-endian
+host.
+Rewrite the read code to use ldl_le_p() and lduw_le_p() to fix this;
+the write code is not incorrect, but for consistency we make it use
+stl_le_p() and stw_le_p().
+Reviewed-by: Richard Henderson <richard.henderson@linaro.org>
+Tested-by: Niek Linnenbank <nieklinnenbank@gmail.com>
+Reviewed-by: Niek Linnenbank <nieklinnenbank@gmail.com>
+Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ hw/net/allwinner-sun8i-emac.c | 12 ++++--------
+file changed, 4 insertions(+), 8 deletions(-)
+diff --git a/hw/net/allwinner-sun8i-emac.c b/hw/net/allwinner-sun8i-emac.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/allwinner-sun8i-emac.c
++++ b/hw/net/allwinner-sun8i-emac.c
+@@ -XXX,XX +XXX,XX @@ static uint64_t allwinner_sun8i_emac_read(void *opaque, hwaddr offset,
+         value = s->mii_data;
+         break;
+     case REG_ADDR_HIGH:         /* MAC Address High */
+-        value = *(((uint32_t *) (s->conf.macaddr.a)) + 1);
++        value = lduw_le_p(s->conf.macaddr.a + 4);
+         break;
+     case REG_ADDR_LOW:          /* MAC Address Low */
+-        value = *(uint32_t *) (s->conf.macaddr.a);
++        value = ldl_le_p(s->conf.macaddr.a);
+         break;
+     case REG_TX_DMA_STA:        /* Transmit DMA Status */
+         break;
+@@ -XXX,XX +XXX,XX @@ static void allwinner_sun8i_emac_write(void *opaque, hwaddr offset,
+         s->mii_data = value;
+         break;
+     case REG_ADDR_HIGH:         /* MAC Address High */
+-        s->conf.macaddr.a[4] = (value & 0xff);
+-        s->conf.macaddr.a[5] = (value & 0xff00) >> 8;
++        stw_le_p(s->conf.macaddr.a + 4, value);
+         break;
+     case REG_ADDR_LOW:          /* MAC Address Low */
+-        s->conf.macaddr.a[0] = (value & 0xff);
+-        s->conf.macaddr.a[1] = (value & 0xff00) >> 8;
+-        s->conf.macaddr.a[2] = (value & 0xff0000) >> 16;
+-        s->conf.macaddr.a[3] = (value & 0xff000000) >> 24;
++        stl_le_p(s->conf.macaddr.a, value);
+         break;
+     case REG_TX_DMA_STA:        /* Transmit DMA Status */
+     case REG_TX_CUR_DESC:       /* Transmit Current Descriptor */
+--
+.5.0

-[PULL 3/7] ebpf: Added eBPF RSS program.
+[PULL V2 14/14] qtest: add tulip test case
-From: Andrew Melnychenko <andrew@daynix.com>
+From: Li Qiang <liq3ea@163.com>
-RSS program and Makefile to build it.
+The tulip networking card emulation has an OOB issue in
-The bpftool used to generate '.h' file.
+'tulip_copy_tx_buffers' when the guest provide malformed descriptor.
-The data in that file may be loaded by libbpf.
+This test will trigger a ASAN heap overflow crash. To trigger this
-EBPF compilation is not required for building qemu.
+issue we can construct the data as following:
 You can use Makefile if you need to regenerate rss.bpf.skeleton.h.
-Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
+. construct a 'tulip_descriptor'. Its control is set to
-Signed-off-by: Andrew Melnychenko <andrew@daynix.com>
+'0x7ff | 0x7ff << 11', this will make the 'tulip_copy_tx_buffers's
 'len1' and 'len2' to 0x7ff(2047). So 'len1+len2' will overflow
 'TULIPState's 'tx_frame' field. This descriptor's 'buf_addr1' and
 'buf_addr2' should set to a guest address.
 . write this descriptor to tulip device's CSR4 register. This will
 set the 'TULIPState's 'current_tx_desc' field.
 . write 'CSR6_ST' to tulip device's CSR6 register. This will trigger
 'tulip_xmit_list_update' and finally calls 'tulip_copy_tx_buffers'.
 Following shows the backtrack of crash:
 ==31781==ERROR: AddressSanitizer: heap-buffer-overflow on address 0x628000007cd0 at pc 0x7fe03c5a077a bp 0x7fff05b46770 sp 0x7fff05b45f18
 WRITE of size 2047 at 0x628000007cd0 thread T0
     #0 0x7fe03c5a0779  (/usr/lib/x86_64-linux-gnu/libasan.so.4+0x79779)
     #1 0x5575fb6daa6a in flatview_read_continue /home/test/qemu/exec.c:3194
     #2 0x5575fb6daccb in flatview_read /home/test/qemu/exec.c:3227
     #3 0x5575fb6dae66 in address_space_read_full /home/test/qemu/exec.c:3240
     #4 0x5575fb6db0cb in address_space_rw /home/test/qemu/exec.c:3268
     #5 0x5575fbdfd460 in dma_memory_rw_relaxed /home/test/qemu/include/sysemu/dma.h:87
     #6 0x5575fbdfd4b5 in dma_memory_rw /home/test/qemu/include/sysemu/dma.h:110
     #7 0x5575fbdfd866 in pci_dma_rw /home/test/qemu/include/hw/pci/pci.h:787
     #8 0x5575fbdfd8a3 in pci_dma_read /home/test/qemu/include/hw/pci/pci.h:794
     #9 0x5575fbe02761 in tulip_copy_tx_buffers hw/net/tulip.c:585
     #10 0x5575fbe0366b in tulip_xmit_list_update hw/net/tulip.c:678
     #11 0x5575fbe04073 in tulip_write hw/net/tulip.c:783
 Signed-off-by: Li Qiang <liq3ea@163.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- tools/ebpf/Makefile.ebpf |  21 ++
+ tests/qtest/Makefile.include |  1 +
- tools/ebpf/rss.bpf.c     | 571 +++++++++++++++++++++++++++++++++++++++++++++++
+ tests/qtest/tulip-test.c     | 91 ++++++++++++++++++++++++++++++++++++++++++++
-files changed, 592 insertions(+)
+files changed, 92 insertions(+)
- create mode 100755 tools/ebpf/Makefile.ebpf
+ create mode 100644 tests/qtest/tulip-test.c
  create mode 100644 tools/ebpf/rss.bpf.c
-diff --git a/tools/ebpf/Makefile.ebpf b/tools/ebpf/Makefile.ebpf
+diff --git a/tests/qtest/Makefile.include b/tests/qtest/Makefile.include
-new file mode 100755
+index XXXXXXX..XXXXXXX 100644
-index XXXXXXX..XXXXXXX
+--- a/tests/qtest/Makefile.include
---- /dev/null
++++ b/tests/qtest/Makefile.include
-+++ b/tools/ebpf/Makefile.ebpf
+@@ -XXX,XX +XXX,XX @@ qos-test-obj-y += tests/qtest/es1370-test.o
-@@ -XXX,XX +XXX,XX @@
+ qos-test-obj-y += tests/qtest/ipoctal232-test.o
-+OBJS = rss.bpf.o
+ qos-test-obj-y += tests/qtest/megasas-test.o
-+
+ qos-test-obj-y += tests/qtest/ne2000-test.o
-+LLC ?= llc
++qos-test-obj-y += tests/qtest/tulip-test.o
-+CLANG ?= clang
+ qos-test-obj-y += tests/qtest/nvme-test.o
-+INC_FLAGS = `$(CLANG) -print-file-name=include`
+ qos-test-obj-y += tests/qtest/pca9552-test.o
-+EXTRA_CFLAGS ?= -O2 -emit-llvm -fno-stack-protector
+ qos-test-obj-y += tests/qtest/pci-test.o
-+
+diff --git a/tests/qtest/tulip-test.c b/tests/qtest/tulip-test.c
 +all: $(OBJS)
 +
 +.PHONY: clean
 +
 +clean:
 +    rm -f $(OBJS)
 +
 +$(OBJS):  %.o:%.c
 +    $(CLANG) $(INC_FLAGS) \
 +                -D__KERNEL__ -D__ASM_SYSREG_H \
 +                -I../include $(LINUXINCLUDE) \
 +                $(EXTRA_CFLAGS) -c $< -o -| $(LLC) -march=bpf -filetype=obj -o $@
 +    bpftool gen skeleton rss.bpf.o > rss.bpf.skeleton.h
 +    cp rss.bpf.skeleton.h ../../ebpf/
 diff --git a/tools/ebpf/rss.bpf.c b/tools/ebpf/rss.bpf.c
 new file mode 100644
 index XXXXXXX..XXXXXXX
 --- /dev/null
-+++ b/tools/ebpf/rss.bpf.c
++++ b/tests/qtest/tulip-test.c
 @@ -XXX,XX +XXX,XX @@
 +/*
-+ * eBPF RSS program
++ * QTest testcase for DEC/Intel Tulip 21143
 + *
-+ * Developed by Daynix Computing LTD (http://www.daynix.com)
++ * Copyright (c) 2020 Li Qiang <liq3ea@gmail.com>
 + *
-+ * Authors:
++ * This work is licensed under the terms of the GNU GPL, version 2 or later.
-+ *  Andrew Melnychenko <andrew@daynix.com>
++ * See the COPYING file in the top-level directory.
 + *  Yuri Benditovich <yuri.benditovich@daynix.com>
 + *
 + * This work is licensed under the terms of the GNU GPL, version 2.  See
 + * the COPYING file in the top-level directory.
 + *
 + * Prepare:
 + * Requires llvm, clang, bpftool, linux kernel tree
 + *
 + * Build rss.bpf.skeleton.h:
 + * make -f Makefile.ebpf clean all
 + */
 +
-+#include <stddef.h>
++#include "qemu/osdep.h"
-+#include <stdbool.h>
++#include "libqtest.h"
-+#include <linux/bpf.h>
++#include "qemu/module.h"
 +#include "libqos/qgraph.h"
 +#include "libqos/pci.h"
 +#include "qemu/bitops.h"
 +#include "hw/net/tulip.h"
 +
-+#include <linux/in.h>
++typedef struct QTulip_pci QTulip_pci;
 +#include <linux/if_ether.h>
 +#include <linux/ip.h>
 +#include <linux/ipv6.h>
 +
-+#include <linux/udp.h>
++struct QTulip_pci {
-+#include <linux/tcp.h>
++    QOSGraphObject obj;
-+
++    QPCIDevice dev;
 +#include <bpf/bpf_helpers.h>
 +#include <bpf/bpf_endian.h>
 +#include <linux/virtio_net.h>
 +
 +#define INDIRECTION_TABLE_SIZE 128
 +#define HASH_CALCULATION_BUFFER_SIZE 36
 +
 +struct rss_config_t {
 +    __u8 redirect;
 +    __u8 populate_hash;
 +    __u32 hash_types;
 +    __u16 indirections_len;
 +    __u16 default_queue;
 +} __attribute__((packed));
 +
 +struct toeplitz_key_data_t {
 +    __u32 leftmost_32_bits;
 +    __u8 next_byte[HASH_CALCULATION_BUFFER_SIZE];
 +};
 +
-+struct packet_hash_info_t {
++static void *tulip_pci_get_driver(void *obj, const char *interface)
-+    __u8 is_ipv4;
++{
-+    __u8 is_ipv6;
++    QTulip_pci *tulip_pci = obj;
 +    __u8 is_udp;
 +    __u8 is_tcp;
 +    __u8 is_ipv6_ext_src;
 +    __u8 is_ipv6_ext_dst;
 +    __u8 is_fragmented;
 +
-+    __u16 src_port;
++    if (!g_strcmp0(interface, "pci-device")) {
-+    __u16 dst_port;
++        return &tulip_pci->dev;
 +    }
 +
-+    union {
++    fprintf(stderr, "%s not present in tulip_pci\n", interface);
-+        struct {
++    g_assert_not_reached();
 +            __be32 in_src;
 +            __be32 in_dst;
 +        };
 +
 +        struct {
 +            struct in6_addr in6_src;
 +            struct in6_addr in6_dst;
 +            struct in6_addr in6_ext_src;
 +            struct in6_addr in6_ext_dst;
 +        };
 +    };
 +};
 +
 +struct bpf_map_def SEC("maps")
 +tap_rss_map_configurations = {
 +        .type        = BPF_MAP_TYPE_ARRAY,
 +        .key_size    = sizeof(__u32),
 +        .value_size  = sizeof(struct rss_config_t),
 +        .max_entries = 1,
 +};
 +
 +struct bpf_map_def SEC("maps")
 +tap_rss_map_toeplitz_key = {
 +        .type        = BPF_MAP_TYPE_ARRAY,
 +        .key_size    = sizeof(__u32),
 +        .value_size  = sizeof(struct toeplitz_key_data_t),
 +        .max_entries = 1,
 +};
 +
 +struct bpf_map_def SEC("maps")
 +tap_rss_map_indirection_table = {
 +        .type        = BPF_MAP_TYPE_ARRAY,
 +        .key_size    = sizeof(__u32),
 +        .value_size  = sizeof(__u16),
 +        .max_entries = INDIRECTION_TABLE_SIZE,
 +};
 +
 +static inline void net_rx_rss_add_chunk(__u8 *rss_input, size_t *bytes_written,
 +                                        const void *ptr, size_t size) {
 +    __builtin_memcpy(&rss_input[*bytes_written], ptr, size);
 +    *bytes_written += size;
 +}
 +
-+static inline
++static void *tulip_pci_create(void *pci_bus, QGuestAllocator *alloc, void *addr)
-+void net_toeplitz_add(__u32 *result,
++{
-+                      __u8 *input,
++    QTulip_pci *tulip_pci = g_new0(QTulip_pci, 1);
-+                      __u32 len
++    QPCIBus *bus = pci_bus;
 +        , struct toeplitz_key_data_t *key) {
 +
-+    __u32 accumulator = *result;
++    qpci_device_init(&tulip_pci->dev, bus, addr);
-+    __u32 leftmost_32_bits = key->leftmost_32_bits;
++    tulip_pci->obj.get_driver = tulip_pci_get_driver;
 +    __u32 byte;
 +
-+    for (byte = 0; byte < HASH_CALCULATION_BUFFER_SIZE; byte++) {
++    return &tulip_pci->obj;
 +        __u8 input_byte = input[byte];
 +        __u8 key_byte = key->next_byte[byte];
 +        __u8 bit;
 +
 +        for (bit = 0; bit < 8; bit++) {
 +            if (input_byte & (1 << 7)) {
 +                accumulator ^= leftmost_32_bits;
 +            }
 +
 +            leftmost_32_bits =
 +                    (leftmost_32_bits << 1) | ((key_byte & (1 << 7)) >> 7);
 +
 +            input_byte <<= 1;
 +            key_byte <<= 1;
 +        }
 +    }
 +
 +    *result = accumulator;
 +}
 +
++static void tulip_large_tx(void *obj, void *data, QGuestAllocator *alloc)
++{
++    QTulip_pci *tulip_pci = obj;
++    QPCIDevice *dev = &tulip_pci->dev;
++    QPCIBar bar;
++    struct tulip_descriptor context;
++    char guest_data[4096];
++    uint64_t context_pa;
++    uint64_t guest_pa;
 +
-+static inline int ip6_extension_header_type(__u8 hdr_type)
++    qpci_device_enable(dev);
-+{
++    bar = qpci_iomap(dev, 0, NULL);
-+    switch (hdr_type) {
++    context_pa = guest_alloc(alloc, sizeof(context));
-+    case IPPROTO_HOPOPTS:
++    guest_pa = guest_alloc(alloc, 4096);
-+    case IPPROTO_ROUTING:
++    memset(guest_data, 'A', sizeof(guest_data));
-+    case IPPROTO_FRAGMENT:
++    context.status = TDES0_OWN;
-+    case IPPROTO_ICMPV6:
++    context.control = TDES1_BUF2_SIZE_MASK << TDES1_BUF2_SIZE_SHIFT |
-+    case IPPROTO_NONE:
++                      TDES1_BUF1_SIZE_MASK << TDES1_BUF1_SIZE_SHIFT;
-+    case IPPROTO_DSTOPTS:
++    context.buf_addr2 = guest_pa;
-+    case IPPROTO_MH:
++    context.buf_addr1 = guest_pa;
 +        return 1;
 +    default:
 +        return 0;
 +    }
 +}
 +/*
 + * According to
 + * https://www.iana.org/assignments/ipv6-parameters/ipv6-parameters.xhtml
 + * we expect that there are would be no more than 11 extensions in IPv6 header,
 + * also there is 27 TLV options for Destination and Hop-by-hop extensions.
 + * Need to choose reasonable amount of maximum extensions/options we may
 + * check to find ext src/dst.
 + */
 +#define IP6_EXTENSIONS_COUNT 11
 +#define IP6_OPTIONS_COUNT 30
 +
-+static inline int parse_ipv6_ext(struct __sk_buff *skb,
++    qtest_memwrite(dev->bus->qts, context_pa, &context, sizeof(context));
-+        struct packet_hash_info_t *info,
++    qtest_memwrite(dev->bus->qts, guest_pa, guest_data, sizeof(guest_data));
-+        __u8 *l4_protocol, size_t *l4_offset)
++    qpci_io_writel(dev, bar, 0x20, context_pa);
-+{
++    qpci_io_writel(dev, bar, 0x30, CSR6_ST);
-+    int err = 0;
++    guest_free(alloc, context_pa);
-+
++    guest_free(alloc, guest_pa);
 +    if (!ip6_extension_header_type(*l4_protocol)) {
 +        return 0;
 +    }
 +
 +    struct ipv6_opt_hdr ext_hdr = {};
 +
 +    for (unsigned int i = 0; i < IP6_EXTENSIONS_COUNT; ++i) {
 +
 +        err = bpf_skb_load_bytes_relative(skb, *l4_offset, &ext_hdr,
 +                                    sizeof(ext_hdr), BPF_HDR_START_NET);
 +        if (err) {
 +            goto error;
 +        }
 +
 +        if (*l4_protocol == IPPROTO_ROUTING) {
 +            struct ipv6_rt_hdr ext_rt = {};
 +
 +            err = bpf_skb_load_bytes_relative(skb, *l4_offset, &ext_rt,
 +                                        sizeof(ext_rt), BPF_HDR_START_NET);
 +            if (err) {
 +                goto error;
 +            }
 +
 +            if ((ext_rt.type == IPV6_SRCRT_TYPE_2) &&
 +                    (ext_rt.hdrlen == sizeof(struct in6_addr) / 8) &&
 +                    (ext_rt.segments_left == 1)) {
 +
 +                err = bpf_skb_load_bytes_relative(skb,
 +                    *l4_offset + offsetof(struct rt2_hdr, addr),
 +                    &info->in6_ext_dst, sizeof(info->in6_ext_dst),
 +                    BPF_HDR_START_NET);
 +                if (err) {
 +                    goto error;
 +                }
 +
 +                info->is_ipv6_ext_dst = 1;
 +            }
 +
 +        } else if (*l4_protocol == IPPROTO_DSTOPTS) {
 +            struct ipv6_opt_t {
 +                __u8 type;
 +                __u8 length;
 +            } __attribute__((packed)) opt = {};
 +
 +            size_t opt_offset = sizeof(ext_hdr);
 +
 +            for (unsigned int j = 0; j < IP6_OPTIONS_COUNT; ++j) {
 +                err = bpf_skb_load_bytes_relative(skb, *l4_offset + opt_offset,
 +                                        &opt, sizeof(opt), BPF_HDR_START_NET);
 +                if (err) {
 +                    goto error;
 +                }
 +
 +                if (opt.type == IPV6_TLV_HAO) {
 +                    err = bpf_skb_load_bytes_relative(skb,
 +                        *l4_offset + opt_offset
 +                        + offsetof(struct ipv6_destopt_hao, addr),
 +                        &info->in6_ext_src, sizeof(info->in6_ext_src),
 +                        BPF_HDR_START_NET);
 +                    if (err) {
 +                        goto error;
 +                    }
 +
 +                    info->is_ipv6_ext_src = 1;
 +                    break;
 +                }
 +
 +                opt_offset += (opt.type == IPV6_TLV_PAD1) ?
 +                              1 : opt.length + sizeof(opt);
 +
 +                if (opt_offset + 1 >= ext_hdr.hdrlen * 8) {
 +                    break;
 +                }
 +            }
 +        } else if (*l4_protocol == IPPROTO_FRAGMENT) {
 +            info->is_fragmented = true;
 +        }
 +
 +        *l4_protocol = ext_hdr.nexthdr;
 +        *l4_offset += (ext_hdr.hdrlen + 1) * 8;
 +
 +        if (!ip6_extension_header_type(ext_hdr.nexthdr)) {
 +            return 0;
 +        }
 +    }
 +
 +    return 0;
 +error:
 +    return err;
 +}
 +
-+static __be16 parse_eth_type(struct __sk_buff *skb)
++static void tulip_register_nodes(void)
 +{
-+    unsigned int offset = 12;
++    QOSGraphEdgeOptions opts = {
-+    __be16 ret = 0;
++        .extra_device_opts = "addr=04.0",
-+    int err = 0;
++    };
 +    add_qpci_address(&opts, &(QPCIAddress) { .devfn = QPCI_DEVFN(4, 0) });
 +
-+    err = bpf_skb_load_bytes_relative(skb, offset, &ret, sizeof(ret),
++    qos_node_create_driver("tulip", tulip_pci_create);
-+                                BPF_HDR_START_MAC);
++    qos_node_consumes("tulip", "pci-bus", &opts);
-+    if (err) {
++    qos_node_produces("tulip", "pci-device");
 +        return 0;
 +    }
 +
-+    switch (bpf_ntohs(ret)) {
++    qos_add_test("tulip_large_tx", "tulip", tulip_large_tx, NULL);
 +    case ETH_P_8021AD:
 +        offset += 4;
 +    case ETH_P_8021Q:
 +        offset += 4;
 +        err = bpf_skb_load_bytes_relative(skb, offset, &ret, sizeof(ret),
 +                                    BPF_HDR_START_MAC);
 +    default:
 +        break;
 +    }
 +
 +    if (err) {
 +        return 0;
 +    }
 +
 +    return ret;
 +}
 +
-+static inline int parse_packet(struct __sk_buff *skb,
++libqos_init(tulip_register_nodes);
 +        struct packet_hash_info_t *info)
 +{
 +    int err = 0;
 +
 +    if (!info || !skb) {
 +        return -1;
 +    }
 +
 +    size_t l4_offset = 0;
 +    __u8 l4_protocol = 0;
 +    __u16 l3_protocol = bpf_ntohs(parse_eth_type(skb));
 +    if (l3_protocol == 0) {
 +        err = -1;
 +        goto error;
 +    }
 +
 +    if (l3_protocol == ETH_P_IP) {
 +        info->is_ipv4 = 1;
 +
 +        struct iphdr ip = {};
 +        err = bpf_skb_load_bytes_relative(skb, 0, &ip, sizeof(ip),
 +                                    BPF_HDR_START_NET);
 +        if (err) {
 +            goto error;
 +        }
 +
 +        info->in_src = ip.saddr;
 +        info->in_dst = ip.daddr;
 +        info->is_fragmented = !!ip.frag_off;
 +
 +        l4_protocol = ip.protocol;
 +        l4_offset = ip.ihl * 4;
 +    } else if (l3_protocol == ETH_P_IPV6) {
 +        info->is_ipv6 = 1;
 +
 +        struct ipv6hdr ip6 = {};
 +        err = bpf_skb_load_bytes_relative(skb, 0, &ip6, sizeof(ip6),
 +                                    BPF_HDR_START_NET);
 +        if (err) {
 +            goto error;
 +        }
 +
 +        info->in6_src = ip6.saddr;
 +        info->in6_dst = ip6.daddr;
 +
 +        l4_protocol = ip6.nexthdr;
 +        l4_offset = sizeof(ip6);
 +
 +        err = parse_ipv6_ext(skb, info, &l4_protocol, &l4_offset);
 +        if (err) {
 +            goto error;
 +        }
 +    }
 +
 +    if (l4_protocol != 0 && !info->is_fragmented) {
 +        if (l4_protocol == IPPROTO_TCP) {
 +            info->is_tcp = 1;
 +
 +            struct tcphdr tcp = {};
 +            err = bpf_skb_load_bytes_relative(skb, l4_offset, &tcp, sizeof(tcp),
 +                                        BPF_HDR_START_NET);
 +            if (err) {
 +                goto error;
 +            }
 +
 +            info->src_port = tcp.source;
 +            info->dst_port = tcp.dest;
 +        } else if (l4_protocol == IPPROTO_UDP) { /* TODO: add udplite? */
 +            info->is_udp = 1;
 +
 +            struct udphdr udp = {};
 +            err = bpf_skb_load_bytes_relative(skb, l4_offset, &udp, sizeof(udp),
 +                                        BPF_HDR_START_NET);
 +            if (err) {
 +                goto error;
 +            }
 +
 +            info->src_port = udp.source;
 +            info->dst_port = udp.dest;
 +        }
 +    }
 +
 +    return 0;
 +
 +error:
 +    return err;
 +}
 +
 +static inline __u32 calculate_rss_hash(struct __sk_buff *skb,
 +        struct rss_config_t *config, struct toeplitz_key_data_t *toe)
 +{
 +    __u8 rss_input[HASH_CALCULATION_BUFFER_SIZE] = {};
 +    size_t bytes_written = 0;
 +    __u32 result = 0;
 +    int err = 0;
 +    struct packet_hash_info_t packet_info = {};
 +
 +    err = parse_packet(skb, &packet_info);
 +    if (err) {
 +        return 0;
 +    }
 +
 +    if (packet_info.is_ipv4) {
 +        if (packet_info.is_tcp &&
 +            config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_TCPv4) {
 +
 +            net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                 &packet_info.in_src,
 +                                 sizeof(packet_info.in_src));
 +            net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                 &packet_info.in_dst,
 +                                 sizeof(packet_info.in_dst));
 +            net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                 &packet_info.src_port,
 +                                 sizeof(packet_info.src_port));
 +            net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                 &packet_info.dst_port,
 +                                 sizeof(packet_info.dst_port));
 +        } else if (packet_info.is_udp &&
 +                   config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_UDPv4) {
 +
 +            net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                 &packet_info.in_src,
 +                                 sizeof(packet_info.in_src));
 +            net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                 &packet_info.in_dst,
 +                                 sizeof(packet_info.in_dst));
 +            net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                 &packet_info.src_port,
 +                                 sizeof(packet_info.src_port));
 +            net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                 &packet_info.dst_port,
 +                                 sizeof(packet_info.dst_port));
 +        } else if (config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_IPv4) {
 +            net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                 &packet_info.in_src,
 +                                 sizeof(packet_info.in_src));
 +            net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                 &packet_info.in_dst,
 +                                 sizeof(packet_info.in_dst));
 +        }
 +    } else if (packet_info.is_ipv6) {
 +        if (packet_info.is_tcp &&
 +            config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_TCPv6) {
 +
 +            if (packet_info.is_ipv6_ext_src &&
 +                config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_TCP_EX) {
 +
 +                net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                     &packet_info.in6_ext_src,
 +                                     sizeof(packet_info.in6_ext_src));
 +            } else {
 +                net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                     &packet_info.in6_src,
 +                                     sizeof(packet_info.in6_src));
 +            }
 +            if (packet_info.is_ipv6_ext_dst &&
 +                config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_TCP_EX) {
 +
 +                net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                     &packet_info.in6_ext_dst,
 +                                     sizeof(packet_info.in6_ext_dst));
 +            } else {
 +                net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                     &packet_info.in6_dst,
 +                                     sizeof(packet_info.in6_dst));
 +            }
 +            net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                 &packet_info.src_port,
 +                                 sizeof(packet_info.src_port));
 +            net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                 &packet_info.dst_port,
 +                                 sizeof(packet_info.dst_port));
 +        } else if (packet_info.is_udp &&
 +                   config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_UDPv6) {
 +
 +            if (packet_info.is_ipv6_ext_src &&
 +               config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_UDP_EX) {
 +
 +                net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                     &packet_info.in6_ext_src,
 +                                     sizeof(packet_info.in6_ext_src));
 +            } else {
 +                net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                     &packet_info.in6_src,
 +                                     sizeof(packet_info.in6_src));
 +            }
 +            if (packet_info.is_ipv6_ext_dst &&
 +               config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_UDP_EX) {
 +
 +                net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                     &packet_info.in6_ext_dst,
 +                                     sizeof(packet_info.in6_ext_dst));
 +            } else {
 +                net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                     &packet_info.in6_dst,
 +                                     sizeof(packet_info.in6_dst));
 +            }
 +
 +            net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                 &packet_info.src_port,
 +                                 sizeof(packet_info.src_port));
 +            net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                 &packet_info.dst_port,
 +                                 sizeof(packet_info.dst_port));
 +
 +        } else if (config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_IPv6) {
 +            if (packet_info.is_ipv6_ext_src &&
 +               config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_IP_EX) {
 +
 +                net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                     &packet_info.in6_ext_src,
 +                                     sizeof(packet_info.in6_ext_src));
 +            } else {
 +                net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                     &packet_info.in6_src,
 +                                     sizeof(packet_info.in6_src));
 +            }
 +            if (packet_info.is_ipv6_ext_dst &&
 +                config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_IP_EX) {
 +
 +                net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                     &packet_info.in6_ext_dst,
 +                                     sizeof(packet_info.in6_ext_dst));
 +            } else {
 +                net_rx_rss_add_chunk(rss_input, &bytes_written,
 +                                     &packet_info.in6_dst,
 +                                     sizeof(packet_info.in6_dst));
 +            }
 +        }
 +    }
 +
 +    if (bytes_written) {
 +        net_toeplitz_add(&result, rss_input, bytes_written, toe);
 +    }
 +
 +    return result;
 +}
 +
 +SEC("tun_rss_steering")
 +int tun_rss_steering_prog(struct __sk_buff *skb)
 +{
 +
 +    struct rss_config_t *config;
 +    struct toeplitz_key_data_t *toe;
 +
 +    __u32 key = 0;
 +    __u32 hash = 0;
 +
 +    config = bpf_map_lookup_elem(&tap_rss_map_configurations, &key);
 +    toe = bpf_map_lookup_elem(&tap_rss_map_toeplitz_key, &key);
 +
 +    if (config && toe) {
 +        if (!config->redirect) {
 +            return config->default_queue;
 +        }
 +
 +        hash = calculate_rss_hash(skb, config, toe);
 +        if (hash) {
 +            __u32 table_idx = hash % config->indirections_len;
 +            __u16 *queue = 0;
 +
 +            queue = bpf_map_lookup_elem(&tap_rss_map_indirection_table,
 +                                        &table_idx);
 +
 +            if (queue) {
 +                return *queue;
 +            }
 +        }
 +
 +        return config->default_queue;
 +    }
 +
 +    return -1;
 +}
 +
 +char _license[] SEC("license") = "GPL v2";
 --
-.7.4
+.5.0

The following changes since commit 92f8c6fef13b31ba222c4d20ad8afd2b79c4c28e:

Merge remote-tracking branch 'remotes/pmaydell/tags/pull-target-arm-20210525' into staging (2021-05-25 16:17:06 +0100)

are available in the git repository at:

https://github.com/jasowang/qemu.git tags/net-pull-request

for you to fetch changes up to 90322e646e87c1440661cb3ddbc0cc94309d8a4f:

MAINTAINERS: Added eBPF maintainers information. (2021-06-04 15:25:46 +0800)

----------------------------------------------------------------

----------------------------------------------------------------
Andrew Melnychenko (7):
      net/tap: Added TUNSETSTEERINGEBPF code.
      net: Added SetSteeringEBPF method for NetClientState.
      ebpf: Added eBPF RSS program.
      ebpf: Added eBPF RSS loader.
      virtio-net: Added eBPF RSS to virtio-net.
      docs: Added eBPF documentation.
      MAINTAINERS: Added eBPF maintainers information.

MAINTAINERS                    |   8 +
 configure                      |   8 +-
 docs/devel/ebpf_rss.rst        | 125 +++++++++
 docs/devel/index.rst           |   1 +
 ebpf/ebpf_rss-stub.c           |  40 +++
 ebpf/ebpf_rss.c                | 165 ++++++++++++
 ebpf/ebpf_rss.h                |  44 ++++
 ebpf/meson.build               |   1 +
 ebpf/rss.bpf.skeleton.h        | 431 +++++++++++++++++++++++++++++++
 ebpf/trace-events              |   4 +
 ebpf/trace.h                   |   1 +
 hw/net/vhost_net.c             |   3 +
 hw/net/virtio-net.c            | 116 ++++++++-
 include/hw/virtio/virtio-net.h |   4 +
 include/net/net.h              |   2 +
 meson.build                    |  23 ++
 meson_options.txt              |   2 +
 net/tap-bsd.c                  |   5 +
 net/tap-linux.c                |  13 +
 net/tap-linux.h                |   1 +
 net/tap-solaris.c              |   5 +
 net/tap-stub.c                 |   5 +
 net/tap.c                      |   9 +
 net/tap_int.h                  |   1 +
 net/vhost-vdpa.c               |   2 +
 tools/ebpf/Makefile.ebpf       |  21 ++
 tools/ebpf/rss.bpf.c           | 571 +++++++++++++++++++++++++++++++++++++++++
 27 files changed, 1607 insertions(+), 4 deletions(-)
 create mode 100644 docs/devel/ebpf_rss.rst
 create mode 100644 ebpf/ebpf_rss-stub.c
 create mode 100644 ebpf/ebpf_rss.c
 create mode 100644 ebpf/ebpf_rss.h
 create mode 100644 ebpf/meson.build
 create mode 100644 ebpf/rss.bpf.skeleton.h
 create mode 100644 ebpf/trace-events
 create mode 100644 ebpf/trace.h
 create mode 100755 tools/ebpf/Makefile.ebpf
 create mode 100644 tools/ebpf/rss.bpf.c

From: Andrew Melnychenko <andrew@daynix.com>

For now, that method supported only by Linux TAP.
Linux TAP uses TUNSETSTEERINGEBPF ioctl.

diff --git a/include/net/net.h b/include/net/net.h
index XXXXXXX..XXXXXXX 100644
--- a/include/net/net.h
+++ b/include/net/net.h
@@ -XXX,XX +XXX,XX @@ typedef int (SetVnetBE)(NetClientState *, bool);
 typedef struct SocketReadState SocketReadState;
 typedef void (SocketReadStateFinalize)(SocketReadState *rs);
 typedef void (NetAnnounce)(NetClientState *);
+typedef bool (SetSteeringEBPF)(NetClientState *, int);
 
 typedef struct NetClientInfo {
     NetClientDriver type;
@@ -XXX,XX +XXX,XX @@ typedef struct NetClientInfo {
     SetVnetLE *set_vnet_le;
     SetVnetBE *set_vnet_be;
     NetAnnounce *announce;
+    SetSteeringEBPF *set_steering_ebpf;
 } NetClientInfo;
 
 struct NetClientState {
diff --git a/net/tap-bsd.c b/net/tap-bsd.c
index XXXXXXX..XXXXXXX 100644
--- a/net/tap-bsd.c
+++ b/net/tap-bsd.c
@@ -XXX,XX +XXX,XX @@ int tap_fd_get_ifname(int fd, char *ifname)
 {
     return -1;
 }
+
+int tap_fd_set_steering_ebpf(int fd, int prog_fd)
+{
+    return -1;
+}
diff --git a/net/tap-linux.c b/net/tap-linux.c
index XXXXXXX..XXXXXXX 100644
--- a/net/tap-linux.c
+++ b/net/tap-linux.c
@@ -XXX,XX +XXX,XX @@ int tap_fd_get_ifname(int fd, char *ifname)
     pstrcpy(ifname, sizeof(ifr.ifr_name), ifr.ifr_name);
     return 0;
 }
+
+int tap_fd_set_steering_ebpf(int fd, int prog_fd)
+{
+    if (ioctl(fd, TUNSETSTEERINGEBPF, (void *) &prog_fd) != 0) {
+        error_report("Issue while setting TUNSETSTEERINGEBPF:"
+                    " %s with fd: %d, prog_fd: %d",
+                    strerror(errno), fd, prog_fd);
+
+       return -1;
+    }
+
+    return 0;
+}
diff --git a/net/tap-solaris.c b/net/tap-solaris.c
index XXXXXXX..XXXXXXX 100644
--- a/net/tap-solaris.c
+++ b/net/tap-solaris.c
@@ -XXX,XX +XXX,XX @@ int tap_fd_get_ifname(int fd, char *ifname)
 {
     return -1;
 }
+
+int tap_fd_set_steering_ebpf(int fd, int prog_fd)
+{
+    return -1;
+}
diff --git a/net/tap-stub.c b/net/tap-stub.c
index XXXXXXX..XXXXXXX 100644
--- a/net/tap-stub.c
+++ b/net/tap-stub.c
@@ -XXX,XX +XXX,XX @@ int tap_fd_get_ifname(int fd, char *ifname)
 {
     return -1;
 }
+
+int tap_fd_set_steering_ebpf(int fd, int prog_fd)
+{
+    return -1;
+}
diff --git a/net/tap.c b/net/tap.c
index XXXXXXX..XXXXXXX 100644
--- a/net/tap.c
+++ b/net/tap.c
@@ -XXX,XX +XXX,XX @@ static void tap_poll(NetClientState *nc, bool enable)
     tap_write_poll(s, enable);
 }
 
+static bool tap_set_steering_ebpf(NetClientState *nc, int prog_fd)
+{
+    TAPState *s = DO_UPCAST(TAPState, nc, nc);
+    assert(nc->info->type == NET_CLIENT_DRIVER_TAP);
+
+    return tap_fd_set_steering_ebpf(s->fd, prog_fd) == 0;
+}
+
 int tap_get_fd(NetClientState *nc)
 {
     TAPState *s = DO_UPCAST(TAPState, nc, nc);
@@ -XXX,XX +XXX,XX @@ static NetClientInfo net_tap_info = {
     .set_vnet_hdr_len = tap_set_vnet_hdr_len,
     .set_vnet_le = tap_set_vnet_le,
     .set_vnet_be = tap_set_vnet_be,
+    .set_steering_ebpf = tap_set_steering_ebpf,
 };
 
 static TAPState *net_tap_fd_init(NetClientState *peer,
diff --git a/net/tap_int.h b/net/tap_int.h
index XXXXXXX..XXXXXXX 100644
--- a/net/tap_int.h
+++ b/net/tap_int.h
@@ -XXX,XX +XXX,XX @@ int tap_fd_set_vnet_be(int fd, int vnet_is_be);
 int tap_fd_enable(int fd);
 int tap_fd_disable(int fd);
 int tap_fd_get_ifname(int fd, char *ifname);
+int tap_fd_set_steering_ebpf(int fd, int prog_fd);
 
 #endif /* NET_TAP_INT_H */
-- 
2.7.4

From: Andrew Melnychenko <andrew@daynix.com>

RSS program and Makefile to build it.
The bpftool used to generate '.h' file.
The data in that file may be loaded by libbpf.
EBPF compilation is not required for building qemu.
You can use Makefile if you need to regenerate rss.bpf.skeleton.h.

Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
Signed-off-by: Andrew Melnychenko <andrew@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 tools/ebpf/Makefile.ebpf |  21 ++
 tools/ebpf/rss.bpf.c     | 571 +++++++++++++++++++++++++++++++++++++++++++++++
 2 files changed, 592 insertions(+)
 create mode 100755 tools/ebpf/Makefile.ebpf
 create mode 100644 tools/ebpf/rss.bpf.c

diff --git a/tools/ebpf/Makefile.ebpf b/tools/ebpf/Makefile.ebpf
new file mode 100755
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tools/ebpf/Makefile.ebpf
@@ -XXX,XX +XXX,XX @@
+OBJS = rss.bpf.o
+
+LLC ?= llc
+CLANG ?= clang
+INC_FLAGS = `$(CLANG) -print-file-name=include`
+EXTRA_CFLAGS ?= -O2 -emit-llvm -fno-stack-protector
+
+all: $(OBJS)
+
+.PHONY: clean
+
+clean:
+	rm -f $(OBJS)
+
+$(OBJS):  %.o:%.c
+	$(CLANG) $(INC_FLAGS) \
+                -D__KERNEL__ -D__ASM_SYSREG_H \
+                -I../include $(LINUXINCLUDE) \
+                $(EXTRA_CFLAGS) -c $< -o -| $(LLC) -march=bpf -filetype=obj -o $@
+	bpftool gen skeleton rss.bpf.o > rss.bpf.skeleton.h
+	cp rss.bpf.skeleton.h ../../ebpf/
diff --git a/tools/ebpf/rss.bpf.c b/tools/ebpf/rss.bpf.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/tools/ebpf/rss.bpf.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * eBPF RSS program
+ *
+ * Developed by Daynix Computing LTD (http://www.daynix.com)
+ *
+ * Authors:
+ *  Andrew Melnychenko <andrew@daynix.com>
+ *  Yuri Benditovich <yuri.benditovich@daynix.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.  See
+ * the COPYING file in the top-level directory.
+ *
+ * Prepare:
+ * Requires llvm, clang, bpftool, linux kernel tree
+ *
+ * Build rss.bpf.skeleton.h:
+ * make -f Makefile.ebpf clean all
+ */
+
+#include <stddef.h>
+#include <stdbool.h>
+#include <linux/bpf.h>
+
+#include <linux/in.h>
+#include <linux/if_ether.h>
+#include <linux/ip.h>
+#include <linux/ipv6.h>
+
+#include <linux/udp.h>
+#include <linux/tcp.h>
+
+#include <bpf/bpf_helpers.h>
+#include <bpf/bpf_endian.h>
+#include <linux/virtio_net.h>
+
+#define INDIRECTION_TABLE_SIZE 128
+#define HASH_CALCULATION_BUFFER_SIZE 36
+
+struct rss_config_t {
+    __u8 redirect;
+    __u8 populate_hash;
+    __u32 hash_types;
+    __u16 indirections_len;
+    __u16 default_queue;
+} __attribute__((packed));
+
+struct toeplitz_key_data_t {
+    __u32 leftmost_32_bits;
+    __u8 next_byte[HASH_CALCULATION_BUFFER_SIZE];
+};
+
+struct packet_hash_info_t {
+    __u8 is_ipv4;
+    __u8 is_ipv6;
+    __u8 is_udp;
+    __u8 is_tcp;
+    __u8 is_ipv6_ext_src;
+    __u8 is_ipv6_ext_dst;
+    __u8 is_fragmented;
+
+    __u16 src_port;
+    __u16 dst_port;
+
+    union {
+        struct {
+            __be32 in_src;
+            __be32 in_dst;
+        };
+
+        struct {
+            struct in6_addr in6_src;
+            struct in6_addr in6_dst;
+            struct in6_addr in6_ext_src;
+            struct in6_addr in6_ext_dst;
+        };
+    };
+};
+
+struct bpf_map_def SEC("maps")
+tap_rss_map_configurations = {
+        .type        = BPF_MAP_TYPE_ARRAY,
+        .key_size    = sizeof(__u32),
+        .value_size  = sizeof(struct rss_config_t),
+        .max_entries = 1,
+};
+
+struct bpf_map_def SEC("maps")
+tap_rss_map_toeplitz_key = {
+        .type        = BPF_MAP_TYPE_ARRAY,
+        .key_size    = sizeof(__u32),
+        .value_size  = sizeof(struct toeplitz_key_data_t),
+        .max_entries = 1,
+};
+
+struct bpf_map_def SEC("maps")
+tap_rss_map_indirection_table = {
+        .type        = BPF_MAP_TYPE_ARRAY,
+        .key_size    = sizeof(__u32),
+        .value_size  = sizeof(__u16),
+        .max_entries = INDIRECTION_TABLE_SIZE,
+};
+
+static inline void net_rx_rss_add_chunk(__u8 *rss_input, size_t *bytes_written,
+                                        const void *ptr, size_t size) {
+    __builtin_memcpy(&rss_input[*bytes_written], ptr, size);
+    *bytes_written += size;
+}
+
+static inline
+void net_toeplitz_add(__u32 *result,
+                      __u8 *input,
+                      __u32 len
+        , struct toeplitz_key_data_t *key) {
+
+    __u32 accumulator = *result;
+    __u32 leftmost_32_bits = key->leftmost_32_bits;
+    __u32 byte;
+
+    for (byte = 0; byte < HASH_CALCULATION_BUFFER_SIZE; byte++) {
+        __u8 input_byte = input[byte];
+        __u8 key_byte = key->next_byte[byte];
+        __u8 bit;
+
+        for (bit = 0; bit < 8; bit++) {
+            if (input_byte & (1 << 7)) {
+                accumulator ^= leftmost_32_bits;
+            }
+
+            leftmost_32_bits =
+                    (leftmost_32_bits << 1) | ((key_byte & (1 << 7)) >> 7);
+
+            input_byte <<= 1;
+            key_byte <<= 1;
+        }
+    }
+
+    *result = accumulator;
+}
+
+
+static inline int ip6_extension_header_type(__u8 hdr_type)
+{
+    switch (hdr_type) {
+    case IPPROTO_HOPOPTS:
+    case IPPROTO_ROUTING:
+    case IPPROTO_FRAGMENT:
+    case IPPROTO_ICMPV6:
+    case IPPROTO_NONE:
+    case IPPROTO_DSTOPTS:
+    case IPPROTO_MH:
+        return 1;
+    default:
+        return 0;
+    }
+}
+/*
+ * According to
+ * https://www.iana.org/assignments/ipv6-parameters/ipv6-parameters.xhtml
+ * we expect that there are would be no more than 11 extensions in IPv6 header,
+ * also there is 27 TLV options for Destination and Hop-by-hop extensions.
+ * Need to choose reasonable amount of maximum extensions/options we may
+ * check to find ext src/dst.
+ */
+#define IP6_EXTENSIONS_COUNT 11
+#define IP6_OPTIONS_COUNT 30
+
+static inline int parse_ipv6_ext(struct __sk_buff *skb,
+        struct packet_hash_info_t *info,
+        __u8 *l4_protocol, size_t *l4_offset)
+{
+    int err = 0;
+
+    if (!ip6_extension_header_type(*l4_protocol)) {
+        return 0;
+    }
+
+    struct ipv6_opt_hdr ext_hdr = {};
+
+    for (unsigned int i = 0; i < IP6_EXTENSIONS_COUNT; ++i) {
+
+        err = bpf_skb_load_bytes_relative(skb, *l4_offset, &ext_hdr,
+                                    sizeof(ext_hdr), BPF_HDR_START_NET);
+        if (err) {
+            goto error;
+        }
+
+        if (*l4_protocol == IPPROTO_ROUTING) {
+            struct ipv6_rt_hdr ext_rt = {};
+
+            err = bpf_skb_load_bytes_relative(skb, *l4_offset, &ext_rt,
+                                        sizeof(ext_rt), BPF_HDR_START_NET);
+            if (err) {
+                goto error;
+            }
+
+            if ((ext_rt.type == IPV6_SRCRT_TYPE_2) &&
+                    (ext_rt.hdrlen == sizeof(struct in6_addr) / 8) &&
+                    (ext_rt.segments_left == 1)) {
+
+                err = bpf_skb_load_bytes_relative(skb,
+                    *l4_offset + offsetof(struct rt2_hdr, addr),
+                    &info->in6_ext_dst, sizeof(info->in6_ext_dst),
+                    BPF_HDR_START_NET);
+                if (err) {
+                    goto error;
+                }
+
+                info->is_ipv6_ext_dst = 1;
+            }
+
+        } else if (*l4_protocol == IPPROTO_DSTOPTS) {
+            struct ipv6_opt_t {
+                __u8 type;
+                __u8 length;
+            } __attribute__((packed)) opt = {};
+
+            size_t opt_offset = sizeof(ext_hdr);
+
+            for (unsigned int j = 0; j < IP6_OPTIONS_COUNT; ++j) {
+                err = bpf_skb_load_bytes_relative(skb, *l4_offset + opt_offset,
+                                        &opt, sizeof(opt), BPF_HDR_START_NET);
+                if (err) {
+                    goto error;
+                }
+
+                if (opt.type == IPV6_TLV_HAO) {
+                    err = bpf_skb_load_bytes_relative(skb,
+                        *l4_offset + opt_offset
+                        + offsetof(struct ipv6_destopt_hao, addr),
+                        &info->in6_ext_src, sizeof(info->in6_ext_src),
+                        BPF_HDR_START_NET);
+                    if (err) {
+                        goto error;
+                    }
+
+                    info->is_ipv6_ext_src = 1;
+                    break;
+                }
+
+                opt_offset += (opt.type == IPV6_TLV_PAD1) ?
+                              1 : opt.length + sizeof(opt);
+
+                if (opt_offset + 1 >= ext_hdr.hdrlen * 8) {
+                    break;
+                }
+            }
+        } else if (*l4_protocol == IPPROTO_FRAGMENT) {
+            info->is_fragmented = true;
+        }
+
+        *l4_protocol = ext_hdr.nexthdr;
+        *l4_offset += (ext_hdr.hdrlen + 1) * 8;
+
+        if (!ip6_extension_header_type(ext_hdr.nexthdr)) {
+            return 0;
+        }
+    }
+
+    return 0;
+error:
+    return err;
+}
+
+static __be16 parse_eth_type(struct __sk_buff *skb)
+{
+    unsigned int offset = 12;
+    __be16 ret = 0;
+    int err = 0;
+
+    err = bpf_skb_load_bytes_relative(skb, offset, &ret, sizeof(ret),
+                                BPF_HDR_START_MAC);
+    if (err) {
+        return 0;
+    }
+
+    switch (bpf_ntohs(ret)) {
+    case ETH_P_8021AD:
+        offset += 4;
+    case ETH_P_8021Q:
+        offset += 4;
+        err = bpf_skb_load_bytes_relative(skb, offset, &ret, sizeof(ret),
+                                    BPF_HDR_START_MAC);
+    default:
+        break;
+    }
+
+    if (err) {
+        return 0;
+    }
+
+    return ret;
+}
+
+static inline int parse_packet(struct __sk_buff *skb,
+        struct packet_hash_info_t *info)
+{
+    int err = 0;
+
+    if (!info || !skb) {
+        return -1;
+    }
+
+    size_t l4_offset = 0;
+    __u8 l4_protocol = 0;
+    __u16 l3_protocol = bpf_ntohs(parse_eth_type(skb));
+    if (l3_protocol == 0) {
+        err = -1;
+        goto error;
+    }
+
+    if (l3_protocol == ETH_P_IP) {
+        info->is_ipv4 = 1;
+
+        struct iphdr ip = {};
+        err = bpf_skb_load_bytes_relative(skb, 0, &ip, sizeof(ip),
+                                    BPF_HDR_START_NET);
+        if (err) {
+            goto error;
+        }
+
+        info->in_src = ip.saddr;
+        info->in_dst = ip.daddr;
+        info->is_fragmented = !!ip.frag_off;
+
+        l4_protocol = ip.protocol;
+        l4_offset = ip.ihl * 4;
+    } else if (l3_protocol == ETH_P_IPV6) {
+        info->is_ipv6 = 1;
+
+        struct ipv6hdr ip6 = {};
+        err = bpf_skb_load_bytes_relative(skb, 0, &ip6, sizeof(ip6),
+                                    BPF_HDR_START_NET);
+        if (err) {
+            goto error;
+        }
+
+        info->in6_src = ip6.saddr;
+        info->in6_dst = ip6.daddr;
+
+        l4_protocol = ip6.nexthdr;
+        l4_offset = sizeof(ip6);
+
+        err = parse_ipv6_ext(skb, info, &l4_protocol, &l4_offset);
+        if (err) {
+            goto error;
+        }
+    }
+
+    if (l4_protocol != 0 && !info->is_fragmented) {
+        if (l4_protocol == IPPROTO_TCP) {
+            info->is_tcp = 1;
+
+            struct tcphdr tcp = {};
+            err = bpf_skb_load_bytes_relative(skb, l4_offset, &tcp, sizeof(tcp),
+                                        BPF_HDR_START_NET);
+            if (err) {
+                goto error;
+            }
+
+            info->src_port = tcp.source;
+            info->dst_port = tcp.dest;
+        } else if (l4_protocol == IPPROTO_UDP) { /* TODO: add udplite? */
+            info->is_udp = 1;
+
+            struct udphdr udp = {};
+            err = bpf_skb_load_bytes_relative(skb, l4_offset, &udp, sizeof(udp),
+                                        BPF_HDR_START_NET);
+            if (err) {
+                goto error;
+            }
+
+            info->src_port = udp.source;
+            info->dst_port = udp.dest;
+        }
+    }
+
+    return 0;
+
+error:
+    return err;
+}
+
+static inline __u32 calculate_rss_hash(struct __sk_buff *skb,
+        struct rss_config_t *config, struct toeplitz_key_data_t *toe)
+{
+    __u8 rss_input[HASH_CALCULATION_BUFFER_SIZE] = {};
+    size_t bytes_written = 0;
+    __u32 result = 0;
+    int err = 0;
+    struct packet_hash_info_t packet_info = {};
+
+    err = parse_packet(skb, &packet_info);
+    if (err) {
+        return 0;
+    }
+
+    if (packet_info.is_ipv4) {
+        if (packet_info.is_tcp &&
+            config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_TCPv4) {
+
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.in_src,
+                                 sizeof(packet_info.in_src));
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.in_dst,
+                                 sizeof(packet_info.in_dst));
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.src_port,
+                                 sizeof(packet_info.src_port));
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.dst_port,
+                                 sizeof(packet_info.dst_port));
+        } else if (packet_info.is_udp &&
+                   config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_UDPv4) {
+
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.in_src,
+                                 sizeof(packet_info.in_src));
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.in_dst,
+                                 sizeof(packet_info.in_dst));
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.src_port,
+                                 sizeof(packet_info.src_port));
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.dst_port,
+                                 sizeof(packet_info.dst_port));
+        } else if (config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_IPv4) {
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.in_src,
+                                 sizeof(packet_info.in_src));
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.in_dst,
+                                 sizeof(packet_info.in_dst));
+        }
+    } else if (packet_info.is_ipv6) {
+        if (packet_info.is_tcp &&
+            config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_TCPv6) {
+
+            if (packet_info.is_ipv6_ext_src &&
+                config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_TCP_EX) {
+
+                net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                     &packet_info.in6_ext_src,
+                                     sizeof(packet_info.in6_ext_src));
+            } else {
+                net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                     &packet_info.in6_src,
+                                     sizeof(packet_info.in6_src));
+            }
+            if (packet_info.is_ipv6_ext_dst &&
+                config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_TCP_EX) {
+
+                net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                     &packet_info.in6_ext_dst,
+                                     sizeof(packet_info.in6_ext_dst));
+            } else {
+                net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                     &packet_info.in6_dst,
+                                     sizeof(packet_info.in6_dst));
+            }
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.src_port,
+                                 sizeof(packet_info.src_port));
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.dst_port,
+                                 sizeof(packet_info.dst_port));
+        } else if (packet_info.is_udp &&
+                   config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_UDPv6) {
+
+            if (packet_info.is_ipv6_ext_src &&
+               config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_UDP_EX) {
+
+                net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                     &packet_info.in6_ext_src,
+                                     sizeof(packet_info.in6_ext_src));
+            } else {
+                net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                     &packet_info.in6_src,
+                                     sizeof(packet_info.in6_src));
+            }
+            if (packet_info.is_ipv6_ext_dst &&
+               config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_UDP_EX) {
+
+                net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                     &packet_info.in6_ext_dst,
+                                     sizeof(packet_info.in6_ext_dst));
+            } else {
+                net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                     &packet_info.in6_dst,
+                                     sizeof(packet_info.in6_dst));
+            }
+
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.src_port,
+                                 sizeof(packet_info.src_port));
+            net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                 &packet_info.dst_port,
+                                 sizeof(packet_info.dst_port));
+
+        } else if (config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_IPv6) {
+            if (packet_info.is_ipv6_ext_src &&
+               config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_IP_EX) {
+
+                net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                     &packet_info.in6_ext_src,
+                                     sizeof(packet_info.in6_ext_src));
+            } else {
+                net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                     &packet_info.in6_src,
+                                     sizeof(packet_info.in6_src));
+            }
+            if (packet_info.is_ipv6_ext_dst &&
+                config->hash_types & VIRTIO_NET_RSS_HASH_TYPE_IP_EX) {
+
+                net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                     &packet_info.in6_ext_dst,
+                                     sizeof(packet_info.in6_ext_dst));
+            } else {
+                net_rx_rss_add_chunk(rss_input, &bytes_written,
+                                     &packet_info.in6_dst,
+                                     sizeof(packet_info.in6_dst));
+            }
+        }
+    }
+
+    if (bytes_written) {
+        net_toeplitz_add(&result, rss_input, bytes_written, toe);
+    }
+
+    return result;
+}
+
+SEC("tun_rss_steering")
+int tun_rss_steering_prog(struct __sk_buff *skb)
+{
+
+    struct rss_config_t *config;
+    struct toeplitz_key_data_t *toe;
+
+    __u32 key = 0;
+    __u32 hash = 0;
+
+    config = bpf_map_lookup_elem(&tap_rss_map_configurations, &key);
+    toe = bpf_map_lookup_elem(&tap_rss_map_toeplitz_key, &key);
+
+    if (config && toe) {
+        if (!config->redirect) {
+            return config->default_queue;
+        }
+
+        hash = calculate_rss_hash(skb, config, toe);
+        if (hash) {
+            __u32 table_idx = hash % config->indirections_len;
+            __u16 *queue = 0;
+
+            queue = bpf_map_lookup_elem(&tap_rss_map_indirection_table,
+                                        &table_idx);
+
+            if (queue) {
+                return *queue;
+            }
+        }
+
+        return config->default_queue;
+    }
+
+    return -1;
+}
+
+char _license[] SEC("license") = "GPL v2";
-- 
2.7.4

From: Andrew Melnychenko <andrew@daynix.com>

Added function that loads RSS eBPF program.
Added stub functions for RSS eBPF loader.
Added meson and configuration options.

By default, eBPF feature enabled if libbpf is present in the build system.
libbpf checked in configuration shell script and meson script.

Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
Signed-off-by: Andrew Melnychenko <andrew@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 configure               |   8 +-
 ebpf/ebpf_rss-stub.c    |  40 +++++
 ebpf/ebpf_rss.c         | 165 ++++++++++++++++++
 ebpf/ebpf_rss.h         |  44 +++++
 ebpf/meson.build        |   1 +
 ebpf/rss.bpf.skeleton.h | 431 ++++++++++++++++++++++++++++++++++++++++++++++++
 ebpf/trace-events       |   4 +
 ebpf/trace.h            |   1 +
 meson.build             |  23 +++
 meson_options.txt       |   2 +
 10 files changed, 718 insertions(+), 1 deletion(-)
 create mode 100644 ebpf/ebpf_rss-stub.c
 create mode 100644 ebpf/ebpf_rss.c
 create mode 100644 ebpf/ebpf_rss.h
 create mode 100644 ebpf/meson.build
 create mode 100644 ebpf/rss.bpf.skeleton.h
 create mode 100644 ebpf/trace-events
 create mode 100644 ebpf/trace.h

diff --git a/configure b/configure
index XXXXXXX..XXXXXXX 100755
--- a/configure
+++ b/configure
@@ -XXX,XX +XXX,XX @@ vhost_vsock="$default_feature"
 vhost_user="no"
 vhost_user_blk_server="auto"
 vhost_user_fs="$default_feature"
+bpf="auto"
 kvm="auto"
 hax="auto"
 hvf="auto"
@@ -XXX,XX +XXX,XX @@ for opt do
   ;;
   --enable-membarrier) membarrier="yes"
   ;;
+  --disable-bpf) bpf="disabled"
+  ;;
+  --enable-bpf) bpf="enabled"
+  ;;
   --disable-blobs) blobs="false"
   ;;
   --with-pkgversion=*) pkgversion="$optarg"
@@ -XXX,XX +XXX,XX @@ disabled with --disable-FEATURE, default is enabled if available
   vhost-user      vhost-user backend support
   vhost-user-blk-server    vhost-user-blk server support
   vhost-vdpa      vhost-vdpa kernel backend support
+  bpf             BPF kernel support
   spice           spice
   spice-protocol  spice-protocol
   rbd             rados block device (rbd)
@@ -XXX,XX +XXX,XX @@ if test "$skip_meson" = no; then
         -Dattr=$attr -Ddefault_devices=$default_devices \
         -Ddocs=$docs -Dsphinx_build=$sphinx_build -Dinstall_blobs=$blobs \
         -Dvhost_user_blk_server=$vhost_user_blk_server -Dmultiprocess=$multiprocess \
-        -Dfuse=$fuse -Dfuse_lseek=$fuse_lseek -Dguest_agent_msi=$guest_agent_msi \
+        -Dfuse=$fuse -Dfuse_lseek=$fuse_lseek -Dguest_agent_msi=$guest_agent_msi -Dbpf=$bpf\
         $(if test "$default_features" = no; then echo "-Dauto_features=disabled"; fi) \
 	-Dtcg_interpreter=$tcg_interpreter \
         $cross_arg \
diff --git a/ebpf/ebpf_rss-stub.c b/ebpf/ebpf_rss-stub.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/ebpf/ebpf_rss-stub.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * eBPF RSS stub file
+ *
+ * Developed by Daynix Computing LTD (http://www.daynix.com)
+ *
+ * Authors:
+ *  Yuri Benditovich <yuri.benditovich@daynix.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.  See
+ * the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "ebpf/ebpf_rss.h"
+
+void ebpf_rss_init(struct EBPFRSSContext *ctx)
+{
+
+}
+
+bool ebpf_rss_is_loaded(struct EBPFRSSContext *ctx)
+{
+    return false;
+}
+
+bool ebpf_rss_load(struct EBPFRSSContext *ctx)
+{
+    return false;
+}
+
+bool ebpf_rss_set_all(struct EBPFRSSContext *ctx, struct EBPFRSSConfig *config,
+                      uint16_t *indirections_table, uint8_t *toeplitz_key)
+{
+    return false;
+}
+
+void ebpf_rss_unload(struct EBPFRSSContext *ctx)
+{
+
+}
diff --git a/ebpf/ebpf_rss.c b/ebpf/ebpf_rss.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/ebpf/ebpf_rss.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * eBPF RSS loader
+ *
+ * Developed by Daynix Computing LTD (http://www.daynix.com)
+ *
+ * Authors:
+ *  Andrew Melnychenko <andrew@daynix.com>
+ *  Yuri Benditovich <yuri.benditovich@daynix.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.  See
+ * the COPYING file in the top-level directory.
+ */
+
+#include "qemu/osdep.h"
+#include "qemu/error-report.h"
+
+#include <bpf/libbpf.h>
+#include <bpf/bpf.h>
+
+#include "hw/virtio/virtio-net.h" /* VIRTIO_NET_RSS_MAX_TABLE_LEN */
+
+#include "ebpf/ebpf_rss.h"
+#include "ebpf/rss.bpf.skeleton.h"
+#include "trace.h"
+
+void ebpf_rss_init(struct EBPFRSSContext *ctx)
+{
+    if (ctx != NULL) {
+        ctx->obj = NULL;
+    }
+}
+
+bool ebpf_rss_is_loaded(struct EBPFRSSContext *ctx)
+{
+    return ctx != NULL && ctx->obj != NULL;
+}
+
+bool ebpf_rss_load(struct EBPFRSSContext *ctx)
+{
+    struct rss_bpf *rss_bpf_ctx;
+
+    if (ctx == NULL) {
+        return false;
+    }
+
+    rss_bpf_ctx = rss_bpf__open();
+    if (rss_bpf_ctx == NULL) {
+        trace_ebpf_error("eBPF RSS", "can not open eBPF RSS object");
+        goto error;
+    }
+
+    bpf_program__set_socket_filter(rss_bpf_ctx->progs.tun_rss_steering_prog);
+
+    if (rss_bpf__load(rss_bpf_ctx)) {
+        trace_ebpf_error("eBPF RSS", "can not load RSS program");
+        goto error;
+    }
+
+    ctx->obj = rss_bpf_ctx;
+    ctx->program_fd = bpf_program__fd(
+            rss_bpf_ctx->progs.tun_rss_steering_prog);
+    ctx->map_configuration = bpf_map__fd(
+            rss_bpf_ctx->maps.tap_rss_map_configurations);
+    ctx->map_indirections_table = bpf_map__fd(
+            rss_bpf_ctx->maps.tap_rss_map_indirection_table);
+    ctx->map_toeplitz_key = bpf_map__fd(
+            rss_bpf_ctx->maps.tap_rss_map_toeplitz_key);
+
+    return true;
+error:
+    rss_bpf__destroy(rss_bpf_ctx);
+    ctx->obj = NULL;
+
+    return false;
+}
+
+static bool ebpf_rss_set_config(struct EBPFRSSContext *ctx,
+                                struct EBPFRSSConfig *config)
+{
+    uint32_t map_key = 0;
+
+    if (!ebpf_rss_is_loaded(ctx)) {
+        return false;
+    }
+    if (bpf_map_update_elem(ctx->map_configuration,
+                            &map_key, config, 0) < 0) {
+        return false;
+    }
+    return true;
+}
+
+static bool ebpf_rss_set_indirections_table(struct EBPFRSSContext *ctx,
+                                            uint16_t *indirections_table,
+                                            size_t len)
+{
+    uint32_t i = 0;
+
+    if (!ebpf_rss_is_loaded(ctx) || indirections_table == NULL ||
+       len > VIRTIO_NET_RSS_MAX_TABLE_LEN) {
+        return false;
+    }
+
+    for (; i < len; ++i) {
+        if (bpf_map_update_elem(ctx->map_indirections_table, &i,
+                                indirections_table + i, 0) < 0) {
+            return false;
+        }
+    }
+    return true;
+}
+
+static bool ebpf_rss_set_toepliz_key(struct EBPFRSSContext *ctx,
+                                     uint8_t *toeplitz_key)
+{
+    uint32_t map_key = 0;
+
+    /* prepare toeplitz key */
+    uint8_t toe[VIRTIO_NET_RSS_MAX_KEY_SIZE] = {};
+
+    if (!ebpf_rss_is_loaded(ctx) || toeplitz_key == NULL) {
+        return false;
+    }
+    memcpy(toe, toeplitz_key, VIRTIO_NET_RSS_MAX_KEY_SIZE);
+    *(uint32_t *)toe = ntohl(*(uint32_t *)toe);
+
+    if (bpf_map_update_elem(ctx->map_toeplitz_key, &map_key, toe,
+                            0) < 0) {
+        return false;
+    }
+    return true;
+}
+
+bool ebpf_rss_set_all(struct EBPFRSSContext *ctx, struct EBPFRSSConfig *config,
+                      uint16_t *indirections_table, uint8_t *toeplitz_key)
+{
+    if (!ebpf_rss_is_loaded(ctx) || config == NULL ||
+        indirections_table == NULL || toeplitz_key == NULL) {
+        return false;
+    }
+
+    if (!ebpf_rss_set_config(ctx, config)) {
+        return false;
+    }
+
+    if (!ebpf_rss_set_indirections_table(ctx, indirections_table,
+                                      config->indirections_len)) {
+        return false;
+    }
+
+    if (!ebpf_rss_set_toepliz_key(ctx, toeplitz_key)) {
+        return false;
+    }
+
+    return true;
+}
+
+void ebpf_rss_unload(struct EBPFRSSContext *ctx)
+{
+    if (!ebpf_rss_is_loaded(ctx)) {
+        return;
+    }
+
+    rss_bpf__destroy(ctx->obj);
+    ctx->obj = NULL;
+}
diff --git a/ebpf/ebpf_rss.h b/ebpf/ebpf_rss.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/ebpf/ebpf_rss.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * eBPF RSS header
+ *
+ * Developed by Daynix Computing LTD (http://www.daynix.com)
+ *
+ * Authors:
+ *  Andrew Melnychenko <andrew@daynix.com>
+ *  Yuri Benditovich <yuri.benditovich@daynix.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2.  See
+ * the COPYING file in the top-level directory.
+ */
+
+#ifndef QEMU_EBPF_RSS_H
+#define QEMU_EBPF_RSS_H
+
+struct EBPFRSSContext {
+    void *obj;
+    int program_fd;
+    int map_configuration;
+    int map_toeplitz_key;
+    int map_indirections_table;
+};
+
+struct EBPFRSSConfig {
+    uint8_t redirect;
+    uint8_t populate_hash;
+    uint32_t hash_types;
+    uint16_t indirections_len;
+    uint16_t default_queue;
+} __attribute__((packed));
+
+void ebpf_rss_init(struct EBPFRSSContext *ctx);
+
+bool ebpf_rss_is_loaded(struct EBPFRSSContext *ctx);
+
+bool ebpf_rss_load(struct EBPFRSSContext *ctx);
+
+bool ebpf_rss_set_all(struct EBPFRSSContext *ctx, struct EBPFRSSConfig *config,
+                      uint16_t *indirections_table, uint8_t *toeplitz_key);
+
+void ebpf_rss_unload(struct EBPFRSSContext *ctx);
+
+#endif /* QEMU_EBPF_RSS_H */
diff --git a/ebpf/meson.build b/ebpf/meson.build
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/ebpf/meson.build
@@ -0,0 +1 @@
+common_ss.add(when: libbpf, if_true: files('ebpf_rss.c'), if_false: files('ebpf_rss-stub.c'))
diff --git a/ebpf/rss.bpf.skeleton.h b/ebpf/rss.bpf.skeleton.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/ebpf/rss.bpf.skeleton.h
@@ -XXX,XX +XXX,XX @@
+/* SPDX-License-Identifier: (LGPL-2.1 OR BSD-2-Clause) */
+
+/* THIS FILE IS AUTOGENERATED! */
+#ifndef __RSS_BPF_SKEL_H__
+#define __RSS_BPF_SKEL_H__
+
+#include <stdlib.h>
+#include <bpf/libbpf.h>
+
+struct rss_bpf {
+	struct bpf_object_skeleton *skeleton;
+	struct bpf_object *obj;
+	struct {
+		struct bpf_map *tap_rss_map_configurations;
+		struct bpf_map *tap_rss_map_indirection_table;
+		struct bpf_map *tap_rss_map_toeplitz_key;
+	} maps;
+	struct {
+		struct bpf_program *tun_rss_steering_prog;
+	} progs;
+	struct {
+		struct bpf_link *tun_rss_steering_prog;
+	} links;
+};
+
+static void
+rss_bpf__destroy(struct rss_bpf *obj)
+{
+	if (!obj)
+		return;
+	if (obj->skeleton)
+		bpf_object__destroy_skeleton(obj->skeleton);
+	free(obj);
+}
+
+static inline int
+rss_bpf__create_skeleton(struct rss_bpf *obj);
+
+static inline struct rss_bpf *
+rss_bpf__open_opts(const struct bpf_object_open_opts *opts)
+{
+	struct rss_bpf *obj;
+
+	obj = (struct rss_bpf *)calloc(1, sizeof(*obj));
+	if (!obj)
+		return NULL;
+	if (rss_bpf__create_skeleton(obj))
+		goto err;
+	if (bpf_object__open_skeleton(obj->skeleton, opts))
+		goto err;
+
+	return obj;
+err:
+	rss_bpf__destroy(obj);
+	return NULL;
+}
+
+static inline struct rss_bpf *
+rss_bpf__open(void)
+{
+	return rss_bpf__open_opts(NULL);
+}
+
+static inline int
+rss_bpf__load(struct rss_bpf *obj)
+{
+	return bpf_object__load_skeleton(obj->skeleton);
+}
+
+static inline struct rss_bpf *
+rss_bpf__open_and_load(void)
+{
+	struct rss_bpf *obj;
+
+	obj = rss_bpf__open();
+	if (!obj)
+		return NULL;
+	if (rss_bpf__load(obj)) {
+		rss_bpf__destroy(obj);
+		return NULL;
+	}
+	return obj;
+}
+
+static inline int
+rss_bpf__attach(struct rss_bpf *obj)
+{
+	return bpf_object__attach_skeleton(obj->skeleton);
+}
+
+static inline void
+rss_bpf__detach(struct rss_bpf *obj)
+{
+	return bpf_object__detach_skeleton(obj->skeleton);
+}
+
+static inline int
+rss_bpf__create_skeleton(struct rss_bpf *obj)
+{
+	struct bpf_object_skeleton *s;
+
+	s = (struct bpf_object_skeleton *)calloc(1, sizeof(*s));
+	if (!s)
+		return -1;
+	obj->skeleton = s;
+
+	s->sz = sizeof(*s);
+	s->name = "rss_bpf";
+	s->obj = &obj->obj;
+
+	/* maps */
+	s->map_cnt = 3;
+	s->map_skel_sz = sizeof(*s->maps);
+	s->maps = (struct bpf_map_skeleton *)calloc(s->map_cnt, s->map_skel_sz);
+	if (!s->maps)
+		goto err;
+
+	s->maps[0].name = "tap_rss_map_configurations";
+	s->maps[0].map = &obj->maps.tap_rss_map_configurations;
+
+	s->maps[1].name = "tap_rss_map_indirection_table";
+	s->maps[1].map = &obj->maps.tap_rss_map_indirection_table;
+
+	s->maps[2].name = "tap_rss_map_toeplitz_key";
+	s->maps[2].map = &obj->maps.tap_rss_map_toeplitz_key;
+
+	/* programs */
+	s->prog_cnt = 1;
+	s->prog_skel_sz = sizeof(*s->progs);
+	s->progs = (struct bpf_prog_skeleton *)calloc(s->prog_cnt, s->prog_skel_sz);
+	if (!s->progs)
+		goto err;
+
+	s->progs[0].name = "tun_rss_steering_prog";
+	s->progs[0].prog = &obj->progs.tun_rss_steering_prog;
+	s->progs[0].link = &obj->links.tun_rss_steering_prog;
+
+	s->data_sz = 8088;
+	s->data = (void *)"\
+\x7f\x45\x4c\x46\x02\x01\x01\0\0\0\0\0\0\0\0\0\x01\0\xf7\0\x01\0\0\0\0\0\0\0\0\
+\0\0\0\0\0\0\0\0\0\0\0\x18\x1d\0\0\0\0\0\0\0\0\0\0\x40\0\0\0\0\0\x40\0\x0a\0\
+\x01\0\xbf\x18\0\0\0\0\0\0\xb7\x01\0\0\0\0\0\0\x63\x1a\x4c\xff\0\0\0\0\xbf\xa7\
+\0\0\0\0\0\0\x07\x07\0\0\x4c\xff\xff\xff\x18\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
+\xbf\x72\0\0\0\0\0\0\x85\0\0\0\x01\0\0\0\xbf\x06\0\0\0\0\0\0\x18\x01\0\0\0\0\0\
+\0\0\0\0\0\0\0\0\0\xbf\x72\0\0\0\0\0\0\x85\0\0\0\x01\0\0\0\xbf\x07\0\0\0\0\0\0\
+\x18\0\0\0\xff\xff\xff\xff\0\0\0\0\0\0\0\0\x15\x06\x66\x02\0\0\0\0\xbf\x79\0\0\
+\0\0\0\0\x15\x09\x64\x02\0\0\0\0\x71\x61\0\0\0\0\0\0\x55\x01\x01\0\0\0\0\0\x05\
+\0\x5d\x02\0\0\0\0\xb7\x01\0\0\0\0\0\0\x63\x1a\xc0\xff\0\0\0\0\x7b\x1a\xb8\xff\
+\0\0\0\0\x7b\x1a\xb0\xff\0\0\0\0\x7b\x1a\xa8\xff\0\0\0\0\x7b\x1a\xa0\xff\0\0\0\
+\0\x63\x1a\x98\xff\0\0\0\0\x7b\x1a\x90\xff\0\0\0\0\x7b\x1a\x88\xff\0\0\0\0\x7b\
+\x1a\x80\xff\0\0\0\0\x7b\x1a\x78\xff\0\0\0\0\x7b\x1a\x70\xff\0\0\0\0\x7b\x1a\
+\x68\xff\0\0\0\0\x7b\x1a\x60\xff\0\0\0\0\x7b\x1a\x58\xff\0\0\0\0\x7b\x1a\x50\
+\xff\0\0\0\0\x15\x08\x4c\x02\0\0\0\0\x6b\x1a\xd0\xff\0\0\0\0\xbf\xa3\0\0\0\0\0\
+\0\x07\x03\0\0\xd0\xff\xff\xff\xbf\x81\0\0\0\0\0\0\xb7\x02\0\0\x0c\0\0\0\xb7\
+\x04\0\0\x02\0\0\0\xb7\x05\0\0\0\0\0\0\x85\0\0\0\x44\0\0\0\x67\0\0\0\x20\0\0\0\
+\x77\0\0\0\x20\0\0\0\x55\0\x11\0\0\0\0\0\xb7\x02\0\0\x10\0\0\0\x69\xa1\xd0\xff\
+\0\0\0\0\xbf\x13\0\0\0\0\0\0\xdc\x03\0\0\x10\0\0\0\x15\x03\x02\0\0\x81\0\0\x55\
+\x03\x0c\0\xa8\x88\0\0\xb7\x02\0\0\x14\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\
+\xd0\xff\xff\xff\xbf\x81\0\0\0\0\0\0\xb7\x04\0\0\x02\0\0\0\xb7\x05\0\0\0\0\0\0\
+\x85\0\0\0\x44\0\0\0\x69\xa1\xd0\xff\0\0\0\0\x67\0\0\0\x20\0\0\0\x77\0\0\0\x20\
+\0\0\0\x15\0\x01\0\0\0\0\0\x05\0\x2f\x02\0\0\0\0\x15\x01\x2e\x02\0\0\0\0\x7b\
+\x9a\x30\xff\0\0\0\0\x15\x01\x57\0\x86\xdd\0\0\x55\x01\x3b\0\x08\0\0\0\x7b\x7a\
+\x20\xff\0\0\0\0\xb7\x07\0\0\x01\0\0\0\x73\x7a\x50\xff\0\0\0\0\xb7\x01\0\0\0\0\
+\0\0\x63\x1a\xe0\xff\0\0\0\0\x7b\x1a\xd8\xff\0\0\0\0\x7b\x1a\xd0\xff\0\0\0\0\
+\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\xd0\xff\xff\xff\xbf\x81\0\0\0\0\0\0\xb7\x02\0\
+\0\0\0\0\0\xb7\x04\0\0\x14\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\0\0\0\x67\
+\0\0\0\x20\0\0\0\x77\0\0\0\x20\0\0\0\x55\0\x1a\x02\0\0\0\0\x69\xa1\xd6\xff\0\0\
+\0\0\x55\x01\x01\0\0\0\0\0\xb7\x07\0\0\0\0\0\0\x61\xa1\xdc\xff\0\0\0\0\x63\x1a\
+\x5c\xff\0\0\0\0\x61\xa1\xe0\xff\0\0\0\0\x63\x1a\x60\xff\0\0\0\0\x73\x7a\x56\
+\xff\0\0\0\0\x71\xa9\xd9\xff\0\0\0\0\x71\xa1\xd0\xff\0\0\0\0\x67\x01\0\0\x02\0\
+\0\0\x57\x01\0\0\x3c\0\0\0\x7b\x1a\x40\xff\0\0\0\0\x79\xa7\x20\xff\0\0\0\0\xbf\
+\x91\0\0\0\0\0\0\x57\x01\0\0\xff\0\0\0\x15\x01\x19\0\0\0\0\0\x71\xa1\x56\xff\0\
+\0\0\0\x55\x01\x17\0\0\0\0\0\x57\x09\0\0\xff\0\0\0\x15\x09\x7a\x01\x11\0\0\0\
+\x55\x09\x14\0\x06\0\0\0\xb7\x01\0\0\x01\0\0\0\x73\x1a\x53\xff\0\0\0\0\xb7\x01\
+\0\0\0\0\0\0\x63\x1a\xe0\xff\0\0\0\0\x7b\x1a\xd8\xff\0\0\0\0\x7b\x1a\xd0\xff\0\
+\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\xd0\xff\xff\xff\xbf\x81\0\0\0\0\0\0\x79\
+\xa2\x40\xff\0\0\0\0\xb7\x04\0\0\x14\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\
+\0\0\0\x67\0\0\0\x20\0\0\0\x77\0\0\0\x20\0\0\0\x55\0\xf4\x01\0\0\0\0\x69\xa1\
+\xd0\xff\0\0\0\0\x6b\x1a\x58\xff\0\0\0\0\x69\xa1\xd2\xff\0\0\0\0\x6b\x1a\x5a\
+\xff\0\0\0\0\x71\xa1\x50\xff\0\0\0\0\x15\x01\xd4\0\0\0\0\0\x71\x62\x03\0\0\0\0\
+\0\x67\x02\0\0\x08\0\0\0\x71\x61\x02\0\0\0\0\0\x4f\x12\0\0\0\0\0\0\x71\x63\x04\
+\0\0\0\0\0\x71\x61\x05\0\0\0\0\0\x67\x01\0\0\x08\0\0\0\x4f\x31\0\0\0\0\0\0\x67\
+\x01\0\0\x10\0\0\0\x4f\x21\0\0\0\0\0\0\x71\xa2\x53\xff\0\0\0\0\x79\xa0\x30\xff\
+\0\0\0\0\x15\x02\x06\x01\0\0\0\0\xbf\x12\0\0\0\0\0\0\x57\x02\0\0\x02\0\0\0\x15\
+\x02\x03\x01\0\0\0\0\x61\xa1\x5c\xff\0\0\0\0\x63\x1a\xa0\xff\0\0\0\0\x61\xa1\
+\x60\xff\0\0\0\0\x63\x1a\xa4\xff\0\0\0\0\x69\xa1\x58\xff\0\0\0\0\x6b\x1a\xa8\
+\xff\0\0\0\0\x69\xa1\x5a\xff\0\0\0\0\x6b\x1a\xaa\xff\0\0\0\0\x05\0\x65\x01\0\0\
+\0\0\xb7\x01\0\0\x01\0\0\0\x73\x1a\x51\xff\0\0\0\0\xb7\x01\0\0\0\0\0\0\x7b\x1a\
+\xf0\xff\0\0\0\0\x7b\x1a\xe8\xff\0\0\0\0\x7b\x1a\xe0\xff\0\0\0\0\x7b\x1a\xd8\
+\xff\0\0\0\0\x7b\x1a\xd0\xff\0\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\xd0\xff\
+\xff\xff\xb7\x01\0\0\x28\0\0\0\x7b\x1a\x40\xff\0\0\0\0\xbf\x81\0\0\0\0\0\0\xb7\
+\x02\0\0\0\0\0\0\xb7\x04\0\0\x28\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\0\0\
+\0\x67\0\0\0\x20\0\0\0\x77\0\0\0\x20\0\0\0\x55\0\x10\x01\0\0\0\0\x79\xa1\xe0\
+\xff\0\0\0\0\x63\x1a\x64\xff\0\0\0\0\x77\x01\0\0\x20\0\0\0\x63\x1a\x68\xff\0\0\
+\0\0\x79\xa1\xd8\xff\0\0\0\0\x63\x1a\x5c\xff\0\0\0\0\x77\x01\0\0\x20\0\0\0\x63\
+\x1a\x60\xff\0\0\0\0\x79\xa1\xe8\xff\0\0\0\0\x63\x1a\x6c\xff\0\0\0\0\x77\x01\0\
+\0\x20\0\0\0\x63\x1a\x70\xff\0\0\0\0\x79\xa1\xf0\xff\0\0\0\0\x63\x1a\x74\xff\0\
+\0\0\0\x77\x01\0\0\x20\0\0\0\x63\x1a\x78\xff\0\0\0\0\x71\xa9\xd6\xff\0\0\0\0\
+\x25\x09\xff\0\x3c\0\0\0\xb7\x01\0\0\x01\0\0\0\x6f\x91\0\0\0\0\0\0\x18\x02\0\0\
+\x01\0\0\0\0\0\0\0\0\x18\0\x1c\x5f\x21\0\0\0\0\0\0\x55\x01\x01\0\0\0\0\0\x05\0\
+\xf8\0\0\0\0\0\xb7\x01\0\0\0\0\0\0\x6b\x1a\xfe\xff\0\0\0\0\xb7\x01\0\0\x28\0\0\
+\0\x7b\x1a\x40\xff\0\0\0\0\xbf\xa1\0\0\0\0\0\0\x07\x01\0\0\x8c\xff\xff\xff\x7b\
+\x1a\x18\xff\0\0\0\0\xbf\xa1\0\0\0\0\0\0\x07\x01\0\0\x7c\xff\xff\xff\x7b\x1a\
+\x10\xff\0\0\0\0\xb7\x01\0\0\0\0\0\0\x7b\x1a\x28\xff\0\0\0\0\x7b\x7a\x20\xff\0\
+\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\xfe\xff\xff\xff\xbf\x81\0\0\0\0\0\0\x79\
+\xa2\x40\xff\0\0\0\0\xb7\x04\0\0\x02\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\
+\0\0\0\x67\0\0\0\x20\0\0\0\x77\0\0\0\x20\0\0\0\x15\0\x01\0\0\0\0\0\x05\0\x90\
+\x01\0\0\0\0\xbf\x91\0\0\0\0\0\0\x15\x01\x23\0\x3c\0\0\0\x15\x01\x59\0\x2c\0\0\
+\0\x55\x01\x5a\0\x2b\0\0\0\xb7\x01\0\0\0\0\0\0\x63\x1a\xf8\xff\0\0\0\0\xbf\xa3\
+\0\0\0\0\0\0\x07\x03\0\0\xf8\xff\xff\xff\xbf\x81\0\0\0\0\0\0\x79\xa2\x40\xff\0\
+\0\0\0\xb7\x04\0\0\x04\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\0\0\0\xbf\x01\
+\0\0\0\0\0\0\x67\x01\0\0\x20\0\0\0\x77\x01\0\0\x20\0\0\0\x55\x01\x03\x01\0\0\0\
+\0\x71\xa1\xfa\xff\0\0\0\0\x55\x01\x4b\0\x02\0\0\0\x71\xa1\xf9\xff\0\0\0\0\x55\
+\x01\x49\0\x02\0\0\0\x71\xa1\xfb\xff\0\0\0\0\x55\x01\x47\0\x01\0\0\0\x79\xa2\
+\x40\xff\0\0\0\0\x07\x02\0\0\x08\0\0\0\xbf\x81\0\0\0\0\0\0\x79\xa3\x18\xff\0\0\
+\0\0\xb7\x04\0\0\x10\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\0\0\0\xbf\x01\0\
+\0\0\0\0\0\x67\x01\0\0\x20\0\0\0\x77\x01\0\0\x20\0\0\0\x55\x01\xf2\0\0\0\0\0\
+\xb7\x01\0\0\x01\0\0\0\x73\x1a\x55\xff\0\0\0\0\x05\0\x39\0\0\0\0\0\xb7\x01\0\0\
+\0\0\0\0\x6b\x1a\xf8\xff\0\0\0\0\xb7\x09\0\0\x02\0\0\0\xb7\x07\0\0\x1e\0\0\0\
+\x05\0\x0e\0\0\0\0\0\x79\xa2\x38\xff\0\0\0\0\x0f\x29\0\0\0\0\0\0\xbf\x92\0\0\0\
+\0\0\0\x07\x02\0\0\x01\0\0\0\x71\xa3\xff\xff\0\0\0\0\x67\x03\0\0\x03\0\0\0\x2d\
+\x23\x02\0\0\0\0\0\x79\xa7\x20\xff\0\0\0\0\x05\0\x2b\0\0\0\0\0\x07\x07\0\0\xff\
+\xff\xff\xff\xbf\x72\0\0\0\0\0\0\x67\x02\0\0\x20\0\0\0\x77\x02\0\0\x20\0\0\0\
+\x15\x02\xf9\xff\0\0\0\0\x7b\x9a\x38\xff\0\0\0\0\x79\xa1\x40\xff\0\0\0\0\x0f\
+\x19\0\0\0\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\xf8\xff\xff\xff\xbf\x81\0\0\0\
+\0\0\0\xbf\x92\0\0\0\0\0\0\xb7\x04\0\0\x02\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\
+\0\x44\0\0\0\xbf\x01\0\0\0\0\0\0\x67\x01\0\0\x20\0\0\0\x77\x01\0\0\x20\0\0\0\
+\x55\x01\x94\0\0\0\0\0\x71\xa2\xf8\xff\0\0\0\0\x55\x02\x0f\0\xc9\0\0\0\x07\x09\
+\0\0\x02\0\0\0\xbf\x81\0\0\0\0\0\0\xbf\x92\0\0\0\0\0\0\x79\xa3\x10\xff\0\0\0\0\
+\xb7\x04\0\0\x10\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\0\0\0\xbf\x01\0\0\0\
+\0\0\0\x67\x01\0\0\x20\0\0\0\x77\x01\0\0\x20\0\0\0\x55\x01\x87\0\0\0\0\0\xb7\
+\x01\0\0\x01\0\0\0\x73\x1a\x54\xff\0\0\0\0\x79\xa7\x20\xff\0\0\0\0\x05\0\x07\0\
+\0\0\0\0\xb7\x09\0\0\x01\0\0\0\x15\x02\xd1\xff\0\0\0\0\x71\xa9\xf9\xff\0\0\0\0\
+\x07\x09\0\0\x02\0\0\0\x05\0\xce\xff\0\0\0\0\xb7\x01\0\0\x01\0\0\0\x73\x1a\x56\
+\xff\0\0\0\0\x71\xa1\xff\xff\0\0\0\0\x67\x01\0\0\x03\0\0\0\x79\xa2\x40\xff\0\0\
+\0\0\x0f\x12\0\0\0\0\0\0\x07\x02\0\0\x08\0\0\0\x7b\x2a\x40\xff\0\0\0\0\x71\xa9\
+\xfe\xff\0\0\0\0\x25\x09\x0e\0\x3c\0\0\0\xb7\x01\0\0\x01\0\0\0\x6f\x91\0\0\0\0\
+\0\0\x18\x02\0\0\x01\0\0\0\0\0\0\0\0\x18\0\x1c\x5f\x21\0\0\0\0\0\0\x55\x01\x01\
+\0\0\0\0\0\x05\0\x07\0\0\0\0\0\x79\xa1\x28\xff\0\0\0\0\x07\x01\0\0\x01\0\0\0\
+\x7b\x1a\x28\xff\0\0\0\0\x67\x01\0\0\x20\0\0\0\x77\x01\0\0\x20\0\0\0\x55\x01\
+\x82\xff\x0b\0\0\0\x05\0\x10\xff\0\0\0\0\x15\x09\xf8\xff\x87\0\0\0\x05\0\xfd\
+\xff\0\0\0\0\x71\xa1\x51\xff\0\0\0\0\x79\xa0\x30\xff\0\0\0\0\x15\x01\x17\x01\0\
+\0\0\0\x71\x62\x03\0\0\0\0\0\x67\x02\0\0\x08\0\0\0\x71\x61\x02\0\0\0\0\0\x4f\
+\x12\0\0\0\0\0\0\x71\x63\x04\0\0\0\0\0\x71\x61\x05\0\0\0\0\0\x67\x01\0\0\x08\0\
+\0\0\x4f\x31\0\0\0\0\0\0\x67\x01\0\0\x10\0\0\0\x4f\x21\0\0\0\0\0\0\x71\xa2\x53\
+\xff\0\0\0\0\x15\x02\x3d\0\0\0\0\0\xbf\x12\0\0\0\0\0\0\x57\x02\0\0\x10\0\0\0\
+\x15\x02\x3a\0\0\0\0\0\xbf\xa2\0\0\0\0\0\0\x07\x02\0\0\x5c\xff\xff\xff\x71\xa4\
+\x54\xff\0\0\0\0\xbf\x23\0\0\0\0\0\0\x15\x04\x02\0\0\0\0\0\xbf\xa3\0\0\0\0\0\0\
+\x07\x03\0\0\x7c\xff\xff\xff\x67\x01\0\0\x38\0\0\0\xc7\x01\0\0\x38\0\0\0\x65\
+\x01\x01\0\xff\xff\xff\xff\xbf\x32\0\0\0\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\
+\x6c\xff\xff\xff\x71\xa5\x55\xff\0\0\0\0\xbf\x34\0\0\0\0\0\0\x15\x05\x02\0\0\0\
+\0\0\xbf\xa4\0\0\0\0\0\0\x07\x04\0\0\x8c\xff\xff\xff\x65\x01\x01\0\xff\xff\xff\
+\xff\xbf\x43\0\0\0\0\0\0\x61\x21\x04\0\0\0\0\0\x67\x01\0\0\x20\0\0\0\x61\x24\0\
+\0\0\0\0\0\x4f\x41\0\0\0\0\0\0\x7b\x1a\xa0\xff\0\0\0\0\x61\x21\x08\0\0\0\0\0\
+\x61\x22\x0c\0\0\0\0\0\x67\x02\0\0\x20\0\0\0\x4f\x12\0\0\0\0\0\0\x7b\x2a\xa8\
+\xff\0\0\0\0\x61\x31\0\0\0\0\0\0\x61\x32\x04\0\0\0\0\0\x61\x34\x08\0\0\0\0\0\
+\x61\x33\x0c\0\0\0\0\0\x69\xa5\x5a\xff\0\0\0\0\x6b\x5a\xc2\xff\0\0\0\0\x69\xa5\
+\x58\xff\0\0\0\0\x6b\x5a\xc0\xff\0\0\0\0\x67\x03\0\0\x20\0\0\0\x4f\x43\0\0\0\0\
+\0\0\x7b\x3a\xb8\xff\0\0\0\0\x67\x02\0\0\x20\0\0\0\x4f\x12\0\0\0\0\0\0\x7b\x2a\
+\xb0\xff\0\0\0\0\x05\0\x6b\0\0\0\0\0\x71\xa2\x52\xff\0\0\0\0\x15\x02\x04\0\0\0\
+\0\0\xbf\x12\0\0\0\0\0\0\x57\x02\0\0\x04\0\0\0\x15\x02\x01\0\0\0\0\0\x05\0\xf7\
+\xfe\0\0\0\0\x57\x01\0\0\x01\0\0\0\x15\x01\xd3\0\0\0\0\0\x61\xa1\x5c\xff\0\0\0\
+\0\x63\x1a\xa0\xff\0\0\0\0\x61\xa1\x60\xff\0\0\0\0\x63\x1a\xa4\xff\0\0\0\0\x05\
+\0\x5e\0\0\0\0\0\x71\xa2\x52\xff\0\0\0\0\x15\x02\x1e\0\0\0\0\0\xbf\x12\0\0\0\0\
+\0\0\x57\x02\0\0\x20\0\0\0\x15\x02\x1b\0\0\0\0\0\xbf\xa2\0\0\0\0\0\0\x07\x02\0\
+\0\x5c\xff\xff\xff\x71\xa4\x54\xff\0\0\0\0\xbf\x23\0\0\0\0\0\0\x15\x04\x02\0\0\
+\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\x7c\xff\xff\xff\x57\x01\0\0\0\x01\0\0\
+\x15\x01\x01\0\0\0\0\0\xbf\x32\0\0\0\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\x03\0\0\x6c\
+\xff\xff\xff\x71\xa5\x55\xff\0\0\0\0\xbf\x34\0\0\0\0\0\0\x15\x05\x02\0\0\0\0\0\
+\xbf\xa4\0\0\0\0\0\0\x07\x04\0\0\x8c\xff\xff\xff\x15\x01\xc3\xff\0\0\0\0\x05\0\
+\xc1\xff\0\0\0\0\xb7\x09\0\0\x3c\0\0\0\x79\xa7\x20\xff\0\0\0\0\x67\0\0\0\x20\0\
+\0\0\x77\0\0\0\x20\0\0\0\x15\0\xa5\xfe\0\0\0\0\x05\0\xb0\0\0\0\0\0\x15\x09\x07\
+\xff\x87\0\0\0\x05\0\xa2\xfe\0\0\0\0\xbf\x12\0\0\0\0\0\0\x57\x02\0\0\x08\0\0\0\
+\x15\x02\xab\0\0\0\0\0\xbf\xa2\0\0\0\0\0\0\x07\x02\0\0\x5c\xff\xff\xff\x71\xa4\
+\x54\xff\0\0\0\0\xbf\x23\0\0\0\0\0\0\x15\x04\x02\0\0\0\0\0\xbf\xa3\0\0\0\0\0\0\
+\x07\x03\0\0\x7c\xff\xff\xff\x57\x01\0\0\x40\0\0\0\x15\x01\x01\0\0\0\0\0\xbf\
+\x32\0\0\0\0\0\0\x61\x23\x04\0\0\0\0\0\x67\x03\0\0\x20\0\0\0\x61\x24\0\0\0\0\0\
+\0\x4f\x43\0\0\0\0\0\0\x7b\x3a\xa0\xff\0\0\0\0\x61\x23\x08\0\0\0\0\0\x61\x22\
+\x0c\0\0\0\0\0\x67\x02\0\0\x20\0\0\0\x4f\x32\0\0\0\0\0\0\x7b\x2a\xa8\xff\0\0\0\
+\0\x15\x01\x1c\0\0\0\0\0\x71\xa1\x55\xff\0\0\0\0\x15\x01\x1a\0\0\0\0\0\x61\xa1\
+\x98\xff\0\0\0\0\x67\x01\0\0\x20\0\0\0\x61\xa2\x94\xff\0\0\0\0\x4f\x21\0\0\0\0\
+\0\0\x7b\x1a\xb8\xff\0\0\0\0\x61\xa1\x90\xff\0\0\0\0\x67\x01\0\0\x20\0\0\0\x61\
+\xa2\x8c\xff\0\0\0\0\x05\0\x19\0\0\0\0\0\xb7\x01\0\0\x01\0\0\0\x73\x1a\x52\xff\
+\0\0\0\0\xb7\x01\0\0\0\0\0\0\x7b\x1a\xd0\xff\0\0\0\0\xbf\xa3\0\0\0\0\0\0\x07\
+\x03\0\0\xd0\xff\xff\xff\xbf\x81\0\0\0\0\0\0\x79\xa2\x40\xff\0\0\0\0\xb7\x04\0\
+\0\x08\0\0\0\xb7\x05\0\0\x01\0\0\0\x85\0\0\0\x44\0\0\0\x67\0\0\0\x20\0\0\0\x77\
+\0\0\0\x20\0\0\0\x55\0\x7d\0\0\0\0\0\x05\0\x88\xfe\0\0\0\0\xb7\x09\0\0\x2b\0\0\
+\0\x05\0\xc6\xff\0\0\0\0\x61\xa1\x78\xff\0\0\0\0\x67\x01\0\0\x20\0\0\0\x61\xa2\
+\x74\xff\0\0\0\0\x4f\x21\0\0\0\0\0\0\x7b\x1a\xb8\xff\0\0\0\0\x61\xa1\x70\xff\0\
+\0\0\0\x67\x01\0\0\x20\0\0\0\x61\xa2\x6c\xff\0\0\0\0\x4f\x21\0\0\0\0\0\0\x7b\
+\x1a\xb0\xff\0\0\0\0\xb7\x01\0\0\0\0\0\0\x07\x07\0\0\x04\0\0\0\x61\x03\0\0\0\0\
+\0\0\xb7\x05\0\0\0\0\0\0\x05\0\x4e\0\0\0\0\0\xaf\x52\0\0\0\0\0\0\xbf\x75\0\0\0\
+\0\0\0\x0f\x15\0\0\0\0\0\0\x71\x55\0\0\0\0\0\0\x67\x03\0\0\x01\0\0\0\xbf\x50\0\
+\0\0\0\0\0\x77\0\0\0\x07\0\0\0\x4f\x03\0\0\0\0\0\0\xbf\x40\0\0\0\0\0\0\x67\0\0\
+\0\x39\0\0\0\xc7\0\0\0\x3f\0\0\0\x5f\x30\0\0\0\0\0\0\xaf\x02\0\0\0\0\0\0\xbf\
+\x50\0\0\0\0\0\0\x77\0\0\0\x06\0\0\0\x57\0\0\0\x01\0\0\0\x67\x03\0\0\x01\0\0\0\
+\x4f\x03\0\0\0\0\0\0\xbf\x40\0\0\0\0\0\0\x67\0\0\0\x3a\0\0\0\xc7\0\0\0\x3f\0\0\
+\0\x5f\x30\0\0\0\0\0\0\xaf\x02\0\0\0\0\0\0\x67\x03\0\0\x01\0\0\0\xbf\x50\0\0\0\
+\0\0\0\x77\0\0\0\x05\0\0\0\x57\0\0\0\x01\0\0\0\x4f\x03\0\0\0\0\0\0\xbf\x40\0\0\
+\0\0\0\0\x67\0\0\0\x3b\0\0\0\xc7\0\0\0\x3f\0\0\0\x5f\x30\0\0\0\0\0\0\xaf\x02\0\
+\0\0\0\0\0\x67\x03\0\0\x01\0\0\0\xbf\x50\0\0\0\0\0\0\x77\0\0\0\x04\0\0\0\x57\0\
+\0\0\x01\0\0\0\x4f\x03\0\0\0\0\0\0\xbf\x40\0\0\0\0\0\0\x67\0\0\0\x3c\0\0\0\xc7\
+\0\0\0\x3f\0\0\0\x5f\x30\0\0\0\0\0\0\xaf\x02\0\0\0\0\0\0\xbf\x50\0\0\0\0\0\0\
+\x77\0\0\0\x03\0\0\0\x57\0\0\0\x01\0\0\0\x67\x03\0\0\x01\0\0\0\x4f\x03\0\0\0\0\
+\0\0\xbf\x40\0\0\0\0\0\0\x67\0\0\0\x3d\0\0\0\xc7\0\0\0\x3f\0\0\0\x5f\x30\0\0\0\
+\0\0\0\xaf\x02\0\0\0\0\0\0\xbf\x50\0\0\0\0\0\0\x77\0\0\0\x02\0\0\0\x57\0\0\0\
+\x01\0\0\0\x67\x03\0\0\x01\0\0\0\x4f\x03\0\0\0\0\0\0\xbf\x40\0\0\0\0\0\0\x67\0\
+\0\0\x3e\0\0\0\xc7\0\0\0\x3f\0\0\0\x5f\x30\0\0\0\0\0\0\xaf\x02\0\0\0\0\0\0\xbf\
+\x50\0\0\0\0\0\0\x77\0\0\0\x01\0\0\0\x57\0\0\0\x01\0\0\0\x67\x03\0\0\x01\0\0\0\
+\x4f\x03\0\0\0\0\0\0\x57\x04\0\0\x01\0\0\0\x87\x04\0\0\0\0\0\0\x5f\x34\0\0\0\0\
+\0\0\xaf\x42\0\0\0\0\0\0\x57\x05\0\0\x01\0\0\0\x67\x03\0\0\x01\0\0\0\x4f\x53\0\
+\0\0\0\0\0\x07\x01\0\0\x01\0\0\0\xbf\x25\0\0\0\0\0\0\x15\x01\x0b\0\x24\0\0\0\
+\xbf\xa2\0\0\0\0\0\0\x07\x02\0\0\xa0\xff\xff\xff\x0f\x12\0\0\0\0\0\0\x71\x24\0\
+\0\0\0\0\0\xbf\x40\0\0\0\0\0\0\x67\0\0\0\x38\0\0\0\xc7\0\0\0\x38\0\0\0\xb7\x02\
+\0\0\0\0\0\0\x65\0\xa9\xff\xff\xff\xff\xff\xbf\x32\0\0\0\0\0\0\x05\0\xa7\xff\0\
+\0\0\0\xbf\x21\0\0\0\0\0\0\x67\x01\0\0\x20\0\0\0\x77\x01\0\0\x20\0\0\0\x15\x01\
+\x0e\0\0\0\0\0\x71\x63\x06\0\0\0\0\0\x71\x64\x07\0\0\0\0\0\x67\x04\0\0\x08\0\0\
+\0\x4f\x34\0\0\0\0\0\0\x3f\x41\0\0\0\0\0\0\x2f\x41\0\0\0\0\0\0\x1f\x12\0\0\0\0\
+\0\0\x63\x2a\x50\xff\0\0\0\0\xbf\xa2\0\0\0\0\0\0\x07\x02\0\0\x50\xff\xff\xff\
+\x18\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x85\0\0\0\x01\0\0\0\x55\0\x05\0\0\0\0\0\
+\x71\x61\x08\0\0\0\0\0\x71\x60\x09\0\0\0\0\0\x67\0\0\0\x08\0\0\0\x4f\x10\0\0\0\
+\0\0\0\x95\0\0\0\0\0\0\0\x69\0\0\0\0\0\0\0\x05\0\xfd\xff\0\0\0\0\x02\0\0\0\x04\
+\0\0\0\x0a\0\0\0\x01\0\0\0\0\0\0\0\x02\0\0\0\x04\0\0\0\x28\0\0\0\x01\0\0\0\0\0\
+\0\0\x02\0\0\0\x04\0\0\0\x02\0\0\0\x80\0\0\0\0\0\0\0\x47\x50\x4c\x20\x76\x32\0\
+\0\0\0\0\0\x10\0\0\0\0\0\0\0\x01\x7a\x52\0\x08\x7c\x0b\x01\x0c\0\0\0\x18\0\0\0\
+\x18\0\0\0\0\0\0\0\0\0\0\0\xd8\x13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
+\0\0\0\0\0\0\0\0\0\0\0\0\xa0\0\0\0\x04\0\xf1\xff\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
+\0\x60\x02\0\0\0\0\x03\0\x20\x02\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x3f\x02\0\0\0\0\
+\x03\0\xd0\x0f\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xed\x01\0\0\0\0\x03\0\x10\x10\0\0\0\
+\0\0\0\0\0\0\0\0\0\0\0\xd4\x01\0\0\0\0\x03\0\x20\x10\0\0\0\0\0\0\0\0\0\0\0\0\0\
+\0\xa3\x01\0\0\0\0\x03\0\xb8\x12\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x63\x01\0\0\0\0\
+\x03\0\x48\x10\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x2a\x01\0\0\0\0\x03\0\x10\x13\0\0\0\
+\0\0\0\0\0\0\0\0\0\0\0\xe1\0\0\0\0\0\x03\0\xa0\x13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
+\x2e\x02\0\0\0\0\x03\0\x28\x02\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x68\x02\0\0\0\0\x03\
+\0\xc0\x13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x36\x02\0\0\0\0\x03\0\xc8\x13\0\0\0\0\0\
+\0\0\0\0\0\0\0\0\0\x22\x01\0\0\0\0\x03\0\xe8\x02\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
+\x02\x01\0\0\0\0\x03\0\x40\x03\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xd9\0\0\0\0\0\x03\0\
+\xf8\x04\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x26\x02\0\0\0\0\x03\0\x20\x0e\0\0\0\0\0\0\
+\0\0\0\0\0\0\0\0\xcc\x01\0\0\0\0\x03\0\x60\x06\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x9b\
+\x01\0\0\0\0\x03\0\xc8\x06\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x5b\x01\0\0\0\0\x03\0\
+\x20\x07\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x7c\x01\0\0\0\0\x03\0\x48\x08\0\0\0\0\0\0\
+\0\0\0\0\0\0\0\0\x53\x01\0\0\0\0\x03\0\xb8\x08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x1a\
+\x01\0\0\0\0\x03\0\xe0\x08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x84\x01\0\0\0\0\x03\0\
+\xb8\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x1e\x02\0\0\0\0\x03\0\xd8\x09\0\0\0\0\0\0\0\
+\0\0\0\0\0\0\0\xc4\x01\0\0\0\0\x03\0\x70\x08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x93\
+\x01\0\0\0\0\x03\0\xa8\x08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x74\x01\0\0\0\0\x03\0\
+\xf0\x0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x4b\x01\0\0\0\0\x03\0\0\x0a\0\0\0\0\0\0\0\
+\0\0\0\0\0\0\0\x12\x01\0\0\0\0\x03\0\x10\x0a\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xfa\0\
+\0\0\0\0\x03\0\xc0\x0a\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x58\x02\0\0\0\0\x03\0\x88\
+\x0a\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x16\x02\0\0\0\0\x03\0\xb8\x0a\0\0\0\0\0\0\0\0\
+\0\0\0\0\0\0\xe5\x01\0\0\0\0\x03\0\xc0\x0f\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xbc\x01\
+\0\0\0\0\x03\0\0\x0e\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x8b\x01\0\0\0\0\x03\0\x18\x0e\
+\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xd1\0\0\0\0\0\x03\0\0\x04\0\0\0\0\0\0\0\0\0\0\0\0\
+\0\0\x50\x02\0\0\0\0\x03\0\x20\x04\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x0e\x02\0\0\0\0\
+\x03\0\x48\x0f\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x6c\x01\0\0\0\0\x03\0\xb0\x04\0\0\0\
+\0\0\0\0\0\0\0\0\0\0\0\x43\x01\0\0\0\0\x03\0\xc8\x0c\0\0\0\0\0\0\0\0\0\0\0\0\0\
+\0\xc9\0\0\0\0\0\x03\0\xf8\x0c\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x06\x02\0\0\0\0\x03\
+\0\xd0\x0a\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x3b\x01\0\0\0\0\x03\0\x98\x0b\0\0\0\0\0\
+\0\0\0\0\0\0\0\0\0\xf2\0\0\0\0\0\x03\0\xb8\x0b\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x48\
+\x02\0\0\0\0\x03\0\xf0\x0b\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xfe\x01\0\0\0\0\x03\0\
+\xf8\x0b\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xdd\x01\0\0\0\0\x03\0\0\x0c\0\0\0\0\0\0\0\
+\0\0\0\0\0\0\0\xb4\x01\0\0\0\0\x03\0\x30\x0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x0a\
+\x01\0\0\0\0\x03\0\x90\x0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xc1\0\0\0\0\0\x03\0\xa8\
+\x0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xba\0\0\0\0\0\x03\0\xd0\x01\0\0\0\0\0\0\0\0\0\
+\0\0\0\0\0\xf6\x01\0\0\0\0\x03\0\xe0\x0d\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xac\x01\0\
+\0\0\0\x03\0\x30\x0e\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x33\x01\0\0\0\0\x03\0\x80\x0e\
+\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xea\0\0\0\0\0\x03\0\x98\x0e\0\0\0\0\0\0\0\0\0\0\0\
+\0\0\0\0\0\0\0\x03\0\x03\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x6b\0\0\0\x11\0\x06\
+\0\0\0\0\0\0\0\0\0\x07\0\0\0\0\0\0\0\x25\0\0\0\x11\0\x05\0\0\0\0\0\0\0\0\0\x14\
+\0\0\0\0\0\0\0\x82\0\0\0\x11\0\x05\0\x28\0\0\0\0\0\0\0\x14\0\0\0\0\0\0\0\x01\0\
+\0\0\x11\0\x05\0\x14\0\0\0\0\0\0\0\x14\0\0\0\0\0\0\0\x40\0\0\0\x12\0\x03\0\0\0\
+\0\0\0\0\0\0\xd8\x13\0\0\0\0\0\0\x28\0\0\0\0\0\0\0\x01\0\0\0\x3a\0\0\0\x50\0\0\
+\0\0\0\0\0\x01\0\0\0\x3c\0\0\0\x80\x13\0\0\0\0\0\0\x01\0\0\0\x3b\0\0\0\x1c\0\0\
+\0\0\0\0\0\x01\0\0\0\x38\0\0\0\0\x74\x61\x70\x5f\x72\x73\x73\x5f\x6d\x61\x70\
+\x5f\x74\x6f\x65\x70\x6c\x69\x74\x7a\x5f\x6b\x65\x79\0\x2e\x74\x65\x78\x74\0\
+\x6d\x61\x70\x73\0\x74\x61\x70\x5f\x72\x73\x73\x5f\x6d\x61\x70\x5f\x63\x6f\x6e\
+\x66\x69\x67\x75\x72\x61\x74\x69\x6f\x6e\x73\0\x74\x75\x6e\x5f\x72\x73\x73\x5f\
+\x73\x74\x65\x65\x72\x69\x6e\x67\x5f\x70\x72\x6f\x67\0\x2e\x72\x65\x6c\x74\x75\
+\x6e\x5f\x72\x73\x73\x5f\x73\x74\x65\x65\x72\x69\x6e\x67\0\x5f\x6c\x69\x63\x65\
+\x6e\x73\x65\0\x2e\x72\x65\x6c\x2e\x65\x68\x5f\x66\x72\x61\x6d\x65\0\x74\x61\
+\x70\x5f\x72\x73\x73\x5f\x6d\x61\x70\x5f\x69\x6e\x64\x69\x72\x65\x63\x74\x69\
+\x6f\x6e\x5f\x74\x61\x62\x6c\x65\0\x72\x73\x73\x2e\x62\x70\x66\x2e\x63\0\x2e\
+\x73\x74\x72\x74\x61\x62\0\x2e\x73\x79\x6d\x74\x61\x62\0\x4c\x42\x42\x30\x5f\
+\x39\0\x4c\x42\x42\x30\x5f\x38\x39\0\x4c\x42\x42\x30\x5f\x36\x39\0\x4c\x42\x42\
+\x30\x5f\x35\x39\0\x4c\x42\x42\x30\x5f\x31\x39\0\x4c\x42\x42\x30\x5f\x31\x30\
+\x39\0\x4c\x42\x42\x30\x5f\x39\x38\0\x4c\x42\x42\x30\x5f\x37\x38\0\x4c\x42\x42\
+\x30\x5f\x34\x38\0\x4c\x42\x42\x30\x5f\x31\x38\0\x4c\x42\x42\x30\x5f\x38\x37\0\
+\x4c\x42\x42\x30\x5f\x34\x37\0\x4c\x42\x42\x30\x5f\x33\x37\0\x4c\x42\x42\x30\
+\x5f\x31\x37\0\x4c\x42\x42\x30\x5f\x31\x30\x37\0\x4c\x42\x42\x30\x5f\x39\x36\0\
+\x4c\x42\x42\x30\x5f\x37\x36\0\x4c\x42\x42\x30\x5f\x36\x36\0\x4c\x42\x42\x30\
+\x5f\x34\x36\0\x4c\x42\x42\x30\x5f\x33\x36\0\x4c\x42\x42\x30\x5f\x32\x36\0\x4c\
+\x42\x42\x30\x5f\x31\x30\x36\0\x4c\x42\x42\x30\x5f\x36\x35\0\x4c\x42\x42\x30\
+\x5f\x34\x35\0\x4c\x42\x42\x30\x5f\x33\x35\0\x4c\x42\x42\x30\x5f\x34\0\x4c\x42\
+\x42\x30\x5f\x35\x34\0\x4c\x42\x42\x30\x5f\x34\x34\0\x4c\x42\x42\x30\x5f\x32\
+\x34\0\x4c\x42\x42\x30\x5f\x31\x30\x34\0\x4c\x42\x42\x30\x5f\x39\x33\0\x4c\x42\
+\x42\x30\x5f\x38\x33\0\x4c\x42\x42\x30\x5f\x35\x33\0\x4c\x42\x42\x30\x5f\x34\
+\x33\0\x4c\x42\x42\x30\x5f\x32\x33\0\x4c\x42\x42\x30\x5f\x31\x30\x33\0\x4c\x42\
+\x42\x30\x5f\x38\x32\0\x4c\x42\x42\x30\x5f\x35\x32\0\x4c\x42\x42\x30\x5f\x31\
+\x30\x32\0\x4c\x42\x42\x30\x5f\x39\x31\0\x4c\x42\x42\x30\x5f\x38\x31\0\x4c\x42\
+\x42\x30\x5f\x37\x31\0\x4c\x42\x42\x30\x5f\x36\x31\0\x4c\x42\x42\x30\x5f\x35\
+\x31\0\x4c\x42\x42\x30\x5f\x34\x31\0\x4c\x42\x42\x30\x5f\x32\x31\0\x4c\x42\x42\
+\x30\x5f\x31\x31\0\x4c\x42\x42\x30\x5f\x31\x31\x31\0\x4c\x42\x42\x30\x5f\x31\
+\x30\x31\0\x4c\x42\x42\x30\x5f\x38\x30\0\x4c\x42\x42\x30\x5f\x36\x30\0\x4c\x42\
+\x42\x30\x5f\x35\x30\0\x4c\x42\x42\x30\x5f\x31\x30\0\x4c\x42\x42\x30\x5f\x31\
+\x31\x30\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
+\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xaa\
+\0\0\0\x03\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\xa0\x1a\0\0\0\0\0\0\x71\x02\0\
+\0\0\0\0\0\0\0\0\0\0\0\0\0\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x1a\0\0\0\x01\0\0\
+\0\x06\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x40\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
+\0\0\0\0\x04\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x5a\0\0\0\x01\0\0\0\x06\0\0\0\0\0\0\
+\0\0\0\0\0\0\0\0\0\x40\0\0\0\0\0\0\0\xd8\x13\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x08\0\
+\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x56\0\0\0\x09\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\
+\0\x60\x1a\0\0\0\0\0\0\x30\0\0\0\0\0\0\0\x09\0\0\0\x03\0\0\0\x08\0\0\0\0\0\0\0\
+\x10\0\0\0\0\0\0\0\x20\0\0\0\x01\0\0\0\x03\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x18\
+\x14\0\0\0\0\0\0\x3c\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x04\0\0\0\0\0\0\0\0\0\0\0\0\
+\0\0\0\x6c\0\0\0\x01\0\0\0\x03\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x54\x14\0\0\0\0\0\
+\0\x07\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x01\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x78\0\0\
+\0\x01\0\0\0\x02\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x60\x14\0\0\0\0\0\0\x30\0\0\0\0\
+\0\0\0\0\0\0\0\0\0\0\0\x08\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x74\0\0\0\x09\0\0\0\0\
+\0\0\0\0\0\0\0\0\0\0\0\0\0\0\0\x90\x1a\0\0\0\0\0\0\x10\0\0\0\0\0\0\0\x09\0\0\0\
+\x07\0\0\0\x08\0\0\0\0\0\0\0\x10\0\0\0\0\0\0\0\xb2\0\0\0\x02\0\0\0\0\0\0\0\0\0\
+\0\0\0\0\0\0\0\0\0\0\x90\x14\0\0\0\0\0\0\xd0\x05\0\0\0\0\0\0\x01\0\0\0\x39\0\0\
+\0\x08\0\0\0\0\0\0\0\x18\0\0\0\0\0\0\0";
+
+	return 0;
+err:
+	bpf_object__destroy_skeleton(s);
+	return -1;
+}
+
+#endif /* __RSS_BPF_SKEL_H__ */
diff --git a/ebpf/trace-events b/ebpf/trace-events
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/ebpf/trace-events
@@ -XXX,XX +XXX,XX @@
+# See docs/devel/tracing.txt for syntax documentation.
+
+# ebpf-rss.c
+ebpf_error(const char *s1, const char *s2) "error in %s: %s"
diff --git a/ebpf/trace.h b/ebpf/trace.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/ebpf/trace.h
@@ -0,0 +1 @@
+#include "trace/trace-ebpf.h"
diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ if not get_option('fuse_lseek').disabled()
   endif
 endif
 
+# libbpf
+libbpf = dependency('libbpf', required: get_option('bpf'), method: 'pkg-config')
+if libbpf.found() and not cc.links('''
+   #include <bpf/libbpf.h>
+   int main(void)
+   {
+     bpf_object__destroy_skeleton(NULL);
+     return 0;
+   }''', dependencies: libbpf)
+  libbpf = not_found
+  if get_option('bpf').enabled()
+    error('libbpf skeleton test failed')
+  else
+    warning('libbpf skeleton test failed, disabling')
+  endif
+endif
+
 if get_option('cfi')
   cfi_flags=[]
   # Check for dependency on LTO
@@ -XXX,XX +XXX,XX @@ endif
 config_host_data.set('CONFIG_GTK', gtk.found())
 config_host_data.set('CONFIG_LIBATTR', have_old_libattr)
 config_host_data.set('CONFIG_LIBCAP_NG', libcap_ng.found())
+config_host_data.set('CONFIG_EBPF', libbpf.found())
 config_host_data.set('CONFIG_LIBISCSI', libiscsi.found())
 config_host_data.set('CONFIG_LIBNFS', libnfs.found())
 config_host_data.set('CONFIG_RBD', rbd.found())
@@ -XXX,XX +XXX,XX @@ if have_system
     'backends',
     'backends/tpm',
     'chardev',
+    'ebpf',
     'hw/9pfs',
     'hw/acpi',
     'hw/adc',
@@ -XXX,XX +XXX,XX @@ subdir('accel')
 subdir('plugins')
 subdir('bsd-user')
 subdir('linux-user')
+subdir('ebpf')
+
+common_ss.add(libbpf)
 
 bsd_user_ss.add(files('gdbstub.c'))
 specific_ss.add_all(when: 'CONFIG_BSD_USER', if_true: bsd_user_ss)
@@ -XXX,XX +XXX,XX @@ summary_info += {'RDMA support':      config_host.has_key('CONFIG_RDMA')}
 summary_info += {'PVRDMA support':    config_host.has_key('CONFIG_PVRDMA')}
 summary_info += {'fdt support':       fdt_opt == 'disabled' ? false : fdt_opt}
 summary_info += {'libcap-ng support': libcap_ng.found()}
+summary_info += {'bpf support': libbpf.found()}
 # TODO: add back protocol and server version
 summary_info += {'spice support':     config_host.has_key('CONFIG_SPICE')}
 summary_info += {'rbd support':       rbd.found()}
diff --git a/meson_options.txt b/meson_options.txt
index XXXXXXX..XXXXXXX 100644
--- a/meson_options.txt
+++ b/meson_options.txt
@@ -XXX,XX +XXX,XX @@ option('bzip2', type : 'feature', value : 'auto',
        description: 'bzip2 support for DMG images')
 option('cap_ng', type : 'feature', value : 'auto',
        description: 'cap_ng support')
+option('bpf', type : 'feature', value : 'auto',
+        description: 'eBPF support')
 option('cocoa', type : 'feature', value : 'auto',
        description: 'Cocoa user interface (macOS only)')
 option('curl', type : 'feature', value : 'auto',
-- 
2.7.4

From: Andrew Melnychenko <andrew@daynix.com>

When RSS is enabled the device tries to load the eBPF program
to select RX virtqueue in the TUN. If eBPF can be loaded
the RSS will function also with vhost (works with kernel 5.8 and later).
Software RSS is used as a fallback with vhost=off when eBPF can't be loaded
or when hash population requested by the guest.

Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
Signed-off-by: Andrew Melnychenko <andrew@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/vhost_net.c             |   3 ++
 hw/net/virtio-net.c            | 116 +++++++++++++++++++++++++++++++++++++++--
 include/hw/virtio/virtio-net.h |   4 ++
 net/vhost-vdpa.c               |   2 +
 4 files changed, 122 insertions(+), 3 deletions(-)

diff --git a/hw/net/vhost_net.c b/hw/net/vhost_net.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/vhost_net.c
+++ b/hw/net/vhost_net.c
@@ -XXX,XX +XXX,XX @@ static const int kernel_feature_bits[] = {
     VIRTIO_NET_F_MTU,
     VIRTIO_F_IOMMU_PLATFORM,
     VIRTIO_F_RING_PACKED,
+    VIRTIO_NET_F_HASH_REPORT,
     VHOST_INVALID_FEATURE_BIT
 };
 
@@ -XXX,XX +XXX,XX @@ static const int user_feature_bits[] = {
     VIRTIO_NET_F_MTU,
     VIRTIO_F_IOMMU_PLATFORM,
     VIRTIO_F_RING_PACKED,
+    VIRTIO_NET_F_RSS,
+    VIRTIO_NET_F_HASH_REPORT,
 
     /* This bit implies RARP isn't sent by QEMU out of band */
     VIRTIO_NET_F_GUEST_ANNOUNCE,
diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -XXX,XX +XXX,XX @@ static uint64_t virtio_net_get_features(VirtIODevice *vdev, uint64_t features,
         return features;
     }
 
-    virtio_clear_feature(&features, VIRTIO_NET_F_RSS);
-    virtio_clear_feature(&features, VIRTIO_NET_F_HASH_REPORT);
+    if (!ebpf_rss_is_loaded(&n->ebpf_rss)) {
+        virtio_clear_feature(&features, VIRTIO_NET_F_RSS);
+    }
     features = vhost_net_get_features(get_vhost_net(nc->peer), features);
     vdev->backend_features = features;
 
@@ -XXX,XX +XXX,XX @@ static int virtio_net_handle_announce(VirtIONet *n, uint8_t cmd,
     }
 }
 
+static void virtio_net_detach_epbf_rss(VirtIONet *n);
+
 static void virtio_net_disable_rss(VirtIONet *n)
 {
     if (n->rss_data.enabled) {
         trace_virtio_net_rss_disable();
     }
     n->rss_data.enabled = false;
+
+    virtio_net_detach_epbf_rss(n);
+}
+
+static bool virtio_net_attach_ebpf_to_backend(NICState *nic, int prog_fd)
+{
+    NetClientState *nc = qemu_get_peer(qemu_get_queue(nic), 0);
+    if (nc == NULL || nc->info->set_steering_ebpf == NULL) {
+        return false;
+    }
+
+    return nc->info->set_steering_ebpf(nc, prog_fd);
+}
+
+static void rss_data_to_rss_config(struct VirtioNetRssData *data,
+                                   struct EBPFRSSConfig *config)
+{
+    config->redirect = data->redirect;
+    config->populate_hash = data->populate_hash;
+    config->hash_types = data->hash_types;
+    config->indirections_len = data->indirections_len;
+    config->default_queue = data->default_queue;
+}
+
+static bool virtio_net_attach_epbf_rss(VirtIONet *n)
+{
+    struct EBPFRSSConfig config = {};
+
+    if (!ebpf_rss_is_loaded(&n->ebpf_rss)) {
+        return false;
+    }
+
+    rss_data_to_rss_config(&n->rss_data, &config);
+
+    if (!ebpf_rss_set_all(&n->ebpf_rss, &config,
+                          n->rss_data.indirections_table, n->rss_data.key)) {
+        return false;
+    }
+
+    if (!virtio_net_attach_ebpf_to_backend(n->nic, n->ebpf_rss.program_fd)) {
+        return false;
+    }
+
+    return true;
+}
+
+static void virtio_net_detach_epbf_rss(VirtIONet *n)
+{
+    virtio_net_attach_ebpf_to_backend(n->nic, -1);
+}
+
+static bool virtio_net_load_ebpf(VirtIONet *n)
+{
+    if (!virtio_net_attach_ebpf_to_backend(n->nic, -1)) {
+        /* backend does't support steering ebpf */
+        return false;
+    }
+
+    return ebpf_rss_load(&n->ebpf_rss);
+}
+
+static void virtio_net_unload_ebpf(VirtIONet *n)
+{
+    virtio_net_attach_ebpf_to_backend(n->nic, -1);
+    ebpf_rss_unload(&n->ebpf_rss);
 }
 
 static uint16_t virtio_net_handle_rss(VirtIONet *n,
@@ -XXX,XX +XXX,XX @@ static uint16_t virtio_net_handle_rss(VirtIONet *n,
         goto error;
     }
     n->rss_data.enabled = true;
+
+    if (!n->rss_data.populate_hash) {
+        if (!virtio_net_attach_epbf_rss(n)) {
+            /* EBPF must be loaded for vhost */
+            if (get_vhost_net(qemu_get_queue(n->nic)->peer)) {
+                warn_report("Can't load eBPF RSS for vhost");
+                goto error;
+            }
+            /* fallback to software RSS */
+            warn_report("Can't load eBPF RSS - fallback to software RSS");
+            n->rss_data.enabled_software_rss = true;
+        }
+    } else {
+        /* use software RSS for hash populating */
+        /* and detach eBPF if was loaded before */
+        virtio_net_detach_epbf_rss(n);
+        n->rss_data.enabled_software_rss = true;
+    }
+
     trace_virtio_net_rss_enable(n->rss_data.hash_types,
                                 n->rss_data.indirections_len,
                                 temp.b);
@@ -XXX,XX +XXX,XX @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
         return -1;
     }
 
-    if (!no_rss && n->rss_data.enabled) {
+    if (!no_rss && n->rss_data.enabled && n->rss_data.enabled_software_rss) {
         int index = virtio_net_process_rss(nc, buf, size);
         if (index >= 0) {
             NetClientState *nc2 = qemu_get_subqueue(n->nic, index);
@@ -XXX,XX +XXX,XX @@ static int virtio_net_post_load_device(void *opaque, int version_id)
     }
 
     if (n->rss_data.enabled) {
+        n->rss_data.enabled_software_rss = n->rss_data.populate_hash;
+        if (!n->rss_data.populate_hash) {
+            if (!virtio_net_attach_epbf_rss(n)) {
+                if (get_vhost_net(qemu_get_queue(n->nic)->peer)) {
+                    warn_report("Can't post-load eBPF RSS for vhost");
+                } else {
+                    warn_report("Can't post-load eBPF RSS - "
+                                "fallback to software RSS");
+                    n->rss_data.enabled_software_rss = true;
+                }
+            }
+        }
+
         trace_virtio_net_rss_enable(n->rss_data.hash_types,
                                     n->rss_data.indirections_len,
                                     sizeof(n->rss_data.key));
@@ -XXX,XX +XXX,XX @@ static void virtio_net_device_realize(DeviceState *dev, Error **errp)
     n->qdev = dev;
 
     net_rx_pkt_init(&n->rx_pkt, false);
+
+    if (virtio_has_feature(n->host_features, VIRTIO_NET_F_RSS)) {
+        virtio_net_load_ebpf(n);
+    }
 }
 
 static void virtio_net_device_unrealize(DeviceState *dev)
@@ -XXX,XX +XXX,XX @@ static void virtio_net_device_unrealize(DeviceState *dev)
     VirtIONet *n = VIRTIO_NET(dev);
     int i, max_queues;
 
+    if (virtio_has_feature(n->host_features, VIRTIO_NET_F_RSS)) {
+        virtio_net_unload_ebpf(n);
+    }
+
     /* This will stop vhost backend if appropriate. */
     virtio_net_set_status(vdev, 0);
 
@@ -XXX,XX +XXX,XX @@ static void virtio_net_instance_init(Object *obj)
     device_add_bootindex_property(obj, &n->nic_conf.bootindex,
                                   "bootindex", "/ethernet-phy@0",
                                   DEVICE(n));
+
+    ebpf_rss_init(&n->ebpf_rss);
 }
 
 static int virtio_net_pre_save(void *opaque)
diff --git a/include/hw/virtio/virtio-net.h b/include/hw/virtio/virtio-net.h
index XXXXXXX..XXXXXXX 100644
--- a/include/hw/virtio/virtio-net.h
+++ b/include/hw/virtio/virtio-net.h
@@ -XXX,XX +XXX,XX @@
 #include "qemu/option_int.h"
 #include "qom/object.h"
 
+#include "ebpf/ebpf_rss.h"
+
 #define TYPE_VIRTIO_NET "virtio-net-device"
 OBJECT_DECLARE_SIMPLE_TYPE(VirtIONet, VIRTIO_NET)
 
@@ -XXX,XX +XXX,XX @@ typedef struct VirtioNetRscChain {
 
 typedef struct VirtioNetRssData {
     bool    enabled;
+    bool    enabled_software_rss;
     bool    redirect;
     bool    populate_hash;
     uint32_t hash_types;
@@ -XXX,XX +XXX,XX @@ struct VirtIONet {
     Notifier migration_state;
     VirtioNetRssData rss_data;
     struct NetRxPkt *rx_pkt;
+    struct EBPFRSSContext ebpf_rss;
 };
 
 void virtio_net_set_netclient_name(VirtIONet *n, const char *name,
diff --git a/net/vhost-vdpa.c b/net/vhost-vdpa.c
index XXXXXXX..XXXXXXX 100644
--- a/net/vhost-vdpa.c
+++ b/net/vhost-vdpa.c
@@ -XXX,XX +XXX,XX @@ const int vdpa_feature_bits[] = {
     VIRTIO_NET_F_MTU,
     VIRTIO_F_IOMMU_PLATFORM,
     VIRTIO_F_RING_PACKED,
+    VIRTIO_NET_F_RSS,
+    VIRTIO_NET_F_HASH_REPORT,
     VIRTIO_NET_F_GUEST_ANNOUNCE,
     VIRTIO_NET_F_STATUS,
     VHOST_INVALID_FEATURE_BIT
-- 
2.7.4

From: Andrew Melnychenko <andrew@daynix.com>

Signed-off-by: Yuri Benditovich <yuri.benditovich@daynix.com>
Signed-off-by: Andrew Melnychenko <andrew@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 docs/devel/ebpf_rss.rst | 125 ++++++++++++++++++++++++++++++++++++++++++++++++
 docs/devel/index.rst    |   1 +
 2 files changed, 126 insertions(+)
 create mode 100644 docs/devel/ebpf_rss.rst

diff --git a/docs/devel/ebpf_rss.rst b/docs/devel/ebpf_rss.rst
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/docs/devel/ebpf_rss.rst
@@ -XXX,XX +XXX,XX @@
+===========================
+eBPF RSS virtio-net support
+===========================
+
+RSS(Receive Side Scaling) is used to distribute network packets to guest virtqueues
+by calculating packet hash. Usually every queue is processed then by a specific guest CPU core.
+
+For now there are 2 RSS implementations in qemu:
+- 'in-qemu' RSS (functions if qemu receives network packets, i.e. vhost=off)
+- eBPF RSS (can function with also with vhost=on)
+
+eBPF support (CONFIG_EBPF) is enabled by 'configure' script.
+To enable eBPF RSS support use './configure --enable-bpf'.
+
+If steering BPF is not set for kernel's TUN module, the TUN uses automatic selection
+of rx virtqueue based on lookup table built according to calculated symmetric hash
+of transmitted packets.
+If steering BPF is set for TUN the BPF code calculates the hash of packet header and
+returns the virtqueue number to place the packet to.
+
+Simplified decision formula:
+
+.. code:: C
+
+    queue_index = indirection_table[hash(<packet data>)%<indirection_table size>]
+
+
+Not for all packets, the hash can/should be calculated.
+
+Note: currently, eBPF RSS does not support hash reporting.
+
+eBPF RSS turned on by different combinations of vhost-net, vitrio-net and tap configurations:
+
+- eBPF is used:
+
+        tap,vhost=off & virtio-net-pci,rss=on,hash=off
+
+- eBPF is used:
+
+        tap,vhost=on & virtio-net-pci,rss=on,hash=off
+
+- 'in-qemu' RSS is used:
+
+        tap,vhost=off & virtio-net-pci,rss=on,hash=on
+
+- eBPF is used, hash population feature is not reported to the guest:
+
+        tap,vhost=on & virtio-net-pci,rss=on,hash=on
+
+If CONFIG_EBPF is not set then only 'in-qemu' RSS is supported.
+Also 'in-qemu' RSS, as a fallback, is used if the eBPF program failed to load or set to TUN.
+
+RSS eBPF program
+----------------
+
+RSS program located in ebpf/rss.bpf.skeleton.h generated by bpftool.
+So the program is part of the qemu binary.
+Initially, the eBPF program was compiled by clang and source code located at tools/ebpf/rss.bpf.c.
+Prerequisites to recompile the eBPF program (regenerate ebpf/rss.bpf.skeleton.h):
+
+        llvm, clang, kernel source tree, bpftool
+        Adjust Makefile.ebpf to reflect the location of the kernel source tree
+
+        $ cd tools/ebpf
+        $ make -f Makefile.ebpf
+
+Current eBPF RSS implementation uses 'bounded loops' with 'backward jump instructions' which present in the last kernels.
+Overall eBPF RSS works on kernels 5.8+.
+
+eBPF RSS implementation
+-----------------------
+
+eBPF RSS loading functionality located in ebpf/ebpf_rss.c and ebpf/ebpf_rss.h.
+
+The `struct EBPFRSSContext` structure that holds 4 file descriptors:
+
+- ctx - pointer of the libbpf context.
+- program_fd - file descriptor of the eBPF RSS program.
+- map_configuration - file descriptor of the 'configuration' map. This map contains one element of 'struct EBPFRSSConfig'. This configuration determines eBPF program behavior.
+- map_toeplitz_key - file descriptor of the 'Toeplitz key' map. One element of the 40byte key prepared for the hashing algorithm.
+- map_indirections_table - 128 elements of queue indexes.
+
+`struct EBPFRSSConfig` fields:
+
+- redirect - "boolean" value, should the hash be calculated, on false  - `default_queue` would be used as the final decision.
+- populate_hash - for now, not used. eBPF RSS doesn't support hash reporting.
+- hash_types - binary mask of different hash types. See `VIRTIO_NET_RSS_HASH_TYPE_*` defines. If for packet hash should not be calculated - `default_queue` would be used.
+- indirections_len - length of the indirections table, maximum 128.
+- default_queue - the queue index that used for packet that shouldn't be hashed. For some packets, the hash can't be calculated(g.e ARP).
+
+Functions:
+
+- `ebpf_rss_init()` - sets ctx to NULL, which indicates that EBPFRSSContext is not loaded.
+- `ebpf_rss_load()` - creates 3 maps and loads eBPF program from the rss.bpf.skeleton.h. Returns 'true' on success. After that, program_fd can be used to set steering for TAP.
+- `ebpf_rss_set_all()` - sets values for eBPF maps. `indirections_table` length is in EBPFRSSConfig. `toeplitz_key` is VIRTIO_NET_RSS_MAX_KEY_SIZE aka 40 bytes array.
+- `ebpf_rss_unload()` - close all file descriptors and set ctx to NULL.
+
+Simplified eBPF RSS workflow:
+
+.. code:: C
+
+    struct EBPFRSSConfig config;
+    config.redirect = 1;
+    config.hash_types = VIRTIO_NET_RSS_HASH_TYPE_UDPv4 | VIRTIO_NET_RSS_HASH_TYPE_TCPv4;
+    config.indirections_len = VIRTIO_NET_RSS_MAX_TABLE_LEN;
+    config.default_queue = 0;
+
+    uint16_t table[VIRTIO_NET_RSS_MAX_TABLE_LEN] = {...};
+    uint8_t key[VIRTIO_NET_RSS_MAX_KEY_SIZE] = {...};
+
+    struct EBPFRSSContext ctx;
+    ebpf_rss_init(&ctx);
+    ebpf_rss_load(&ctx);
+    ebpf_rss_set_all(&ctx, &config, table, key);
+    if (net_client->info->set_steering_ebpf != NULL) {
+        net_client->info->set_steering_ebpf(net_client, ctx->program_fd);
+    }
+    ...
+    ebpf_unload(&ctx);
+
+
+NetClientState SetSteeringEBPF()
+~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
+
+For now, `set_steering_ebpf()` method supported by Linux TAP NetClientState. The method requires an eBPF program file descriptor as an argument.
diff --git a/docs/devel/index.rst b/docs/devel/index.rst
index XXXXXXX..XXXXXXX 100644
--- a/docs/devel/index.rst
+++ b/docs/devel/index.rst
@@ -XXX,XX +XXX,XX @@ Contents:
    qom
    block-coroutine-wrapper
    multi-process
+   ebpf_rss
-- 
2.7.4

The following changes since commit 2a95551e8b1456aa53ce54fac573df18809340a6:

Merge remote-tracking branch 'remotes/rth/tags/pull-tcg-20200330' into staging (2020-03-31 11:20:21 +0100)

are available in the git repository at:

https://github.com/jasowang/qemu.git tags/net-pull-request

for you to fetch changes up to 1153cf9f5b67fad41ca6f8571e9a26e2c7c70759:

qtest: add tulip test case (2020-03-31 21:14:35 +0800)

----------------------------------------------------------------

Changes from V1:

- fix the compiling error
- include qtest for tulip OOB

----------------------------------------------------------------
Andrew Melnychenko (1):
      Fixed integer overflow in e1000e

Li Qiang (1):
      qtest: add tulip test case

Peter Maydell (2):
      hw/net/i82596.c: Avoid reading off end of buffer in i82596_receive()
      hw/net/allwinner-sun8i-emac.c: Fix REG_ADDR_HIGH/LOW reads

Philippe Mathieu-Daudé (7):
      hw/net/i82596: Correct command bitmask (CID 1419392)
      hw/net/e1000e_core: Let e1000e_can_receive() return a boolean
      hw/net/smc91c111: Let smc91c111_can_receive() return a boolean
      hw/net/rtl8139: Simplify if/else statement
      hw/net/rtl8139: Update coding style to make checkpatch.pl happy
      hw/net: Make NetCanReceive() return a boolean
      hw/net/can: Make CanBusClientInfo::can_receive() return a boolean

Prasad J Pandit (1):
      net: tulip: check frame size and r/w data length

Zhang Chen (2):
      net/colo-compare.c: Expose "compare_timeout" to users
      net/colo-compare.c: Expose "expired_scan_cycle" to users

From: Philippe Mathieu-Daudé <f4bug@amsat.org>

The command is 32-bit, but we are loading the 16 upper bits with
the 'get_uint16(s->scb + 2)' call.

Once shifted by 16, the command bits match the status bits:

- Command
  Bit 31 ACK-CX   Acknowledges that the CU completed an Action Command.
  Bit 30 ACK-FR   Acknowledges that the RU received a frame.
  Bit 29 ACK-CNA  Acknowledges that the Command Unit became not active.
  Bit 28 ACK-RNR  Acknowledges that the Receive Unit became not ready.

- Status
  Bit 15 CX       The CU finished executing a command with its I(interrupt) bit set.
  Bit 14 FR       The RU finished receiving a frame.
  Bit 13 CNA      The Command Unit left the Active state.
  Bit 12 RNR      The Receive Unit left the Ready state.

Add the SCB_COMMAND_ACK_MASK definition to simplify the code.

This fixes Coverity 1419392 (CONSTANT_EXPRESSION_RESULT):

/hw/net/i82596.c: 352 in examine_scb()
  346         cuc = (command >> 8) & 0x7;
  347         ruc = (command >> 4) & 0x7;
  348         DBG(printf("MAIN COMMAND %04x  cuc %02x ruc %02x\n", command, cuc, ruc));
  349         /* and clear the scb command word */
  350         set_uint16(s->scb + 2, 0);
  351
  >>>     CID 1419392:    (CONSTANT_EXPRESSION_RESULT)
  >>>     "command & (2147483648UL /* 1UL << 31 */)" is always 0 regardless of the values of its operands. This occurs as the logical operand of "if".
  352         if (command & BIT(31))      /* ACK-CX */
  353             s->scb_status &= ~SCB_STATUS_CX;
  >>>     CID 1419392:    (CONSTANT_EXPRESSION_RESULT)
  >>>     "command & (1073741824UL /* 1UL << 30 */)" is always 0 regardless of the values of its operands. This occurs as the logical operand of "if".
  354         if (command & BIT(30))      /*ACK-FR */
  355             s->scb_status &= ~SCB_STATUS_FR;
  >>>     CID 1419392:    (CONSTANT_EXPRESSION_RESULT)
  >>>     "command & (536870912UL /* 1UL << 29 */)" is always 0 regardless of the values of its operands. This occurs as the logical operand of "if".
  356         if (command & BIT(29))      /*ACK-CNA */
  357             s->scb_status &= ~SCB_STATUS_CNA;
  >>>     CID 1419392:    (CONSTANT_EXPRESSION_RESULT)
  >>>     "command & (268435456UL /* 1UL << 28 */)" is always 0 regardless of the values of its operands. This occurs as the logical operand of "if".
  358         if (command & BIT(28))      /*ACK-RNR */
  359             s->scb_status &= ~SCB_STATUS_RNR;

Fixes: Covertiy CID 1419392 (commit 376b851909)
Signed-off-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Reviewed-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/i82596.c | 12 ++++--------
 1 file changed, 4 insertions(+), 8 deletions(-)

diff --git a/hw/net/i82596.c b/hw/net/i82596.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/i82596.c
+++ b/hw/net/i82596.c
@@ -XXX,XX +XXX,XX @@
 #define SCB_STATUS_CNA  0x2000 /* CU left active state */
 #define SCB_STATUS_RNR  0x1000 /* RU left active state */
 
+#define SCB_COMMAND_ACK_MASK \
+        (SCB_STATUS_CX | SCB_STATUS_FR | SCB_STATUS_CNA | SCB_STATUS_RNR)
+
 #define CU_IDLE         0
 #define CU_SUSPENDED    1
 #define CU_ACTIVE       2
@@ -XXX,XX +XXX,XX @@ static void examine_scb(I82596State *s)
     /* and clear the scb command word */
     set_uint16(s->scb + 2, 0);
 
-    if (command & BIT(31))      /* ACK-CX */
-        s->scb_status &= ~SCB_STATUS_CX;
-    if (command & BIT(30))      /*ACK-FR */
-        s->scb_status &= ~SCB_STATUS_FR;
-    if (command & BIT(29))      /*ACK-CNA */
-        s->scb_status &= ~SCB_STATUS_CNA;
-    if (command & BIT(28))      /*ACK-RNR */
-        s->scb_status &= ~SCB_STATUS_RNR;
+    s->scb_status &= ~(command & SCB_COMMAND_ACK_MASK);
 
     switch (cuc) {
     case 0:     /* no change */
-- 
2.5.0

From: Peter Maydell <peter.maydell@linaro.org>

The i82596_receive() function attempts to pass the guest a buffer
which is effectively the concatenation of the data it is passed and a
4 byte CRC value.  However, rather than implementing this as "write
the data; then write the CRC" it instead bumps the length value of
the data by 4, and writes 4 extra bytes from beyond the end of the
buffer, which it then overwrites with the CRC.  It also assumed that
we could always fit all four bytes of the CRC into the final receive
buffer, which might not be true if the CRC needs to be split over two
receive buffers.

Calculate separately how many bytes we need to transfer into the
guest's receive buffer from the source buffer, and how many we need
to transfer from the CRC work.

We add a count 'bufsz' of the number of bytes left in the source
buffer, which we use purely to assert() that we don't overrun.

Spotted by Coverity (CID 1419396) for the specific case when we end
up using a local array as the source buffer.

Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/i82596.c | 44 +++++++++++++++++++++++++++++++++++---------
 1 file changed, 35 insertions(+), 9 deletions(-)

diff --git a/hw/net/i82596.c b/hw/net/i82596.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/i82596.c
+++ b/hw/net/i82596.c
@@ -XXX,XX +XXX,XX @@ ssize_t i82596_receive(NetClientState *nc, const uint8_t *buf, size_t sz)
     uint32_t rfd_p;
     uint32_t rbd;
     uint16_t is_broadcast = 0;
-    size_t len = sz;
+    size_t len = sz; /* length of data for guest (including CRC) */
+    size_t bufsz = sz; /* length of data in buf */
     uint32_t crc;
     uint8_t *crc_ptr;
     uint8_t buf1[MIN_BUF_SIZE + VLAN_HLEN];
@@ -XXX,XX +XXX,XX @@ ssize_t i82596_receive(NetClientState *nc, const uint8_t *buf, size_t sz)
         if (len < MIN_BUF_SIZE) {
             len = MIN_BUF_SIZE;
         }
+        bufsz = len;
     }
 
     /* Calculate the ethernet checksum (4 bytes) */
@@ -XXX,XX +XXX,XX @@ ssize_t i82596_receive(NetClientState *nc, const uint8_t *buf, size_t sz)
         while (len) {
             uint16_t buffer_size, num;
             uint32_t rba;
+            size_t bufcount, crccount;
 
             /* printf("Receive: rbd is %08x\n", rbd); */
             buffer_size = get_uint16(rbd + 12);
@@ -XXX,XX +XXX,XX @@ ssize_t i82596_receive(NetClientState *nc, const uint8_t *buf, size_t sz)
             }
             rba = get_uint32(rbd + 8);
             /* printf("rba is 0x%x\n", rba); */
-            address_space_write(&address_space_memory, rba,
-                                MEMTXATTRS_UNSPECIFIED, buf, num);
-            rba += num;
-            buf += num;
-            len -= num;
-            if (len == 0) { /* copy crc */
-                address_space_write(&address_space_memory, rba - 4,
-                                    MEMTXATTRS_UNSPECIFIED, crc_ptr, 4);
+            /*
+             * Calculate how many bytes we want from buf[] and how many
+             * from the CRC.
+             */
+            if ((len - num) >= 4) {
+                /* The whole guest buffer, we haven't hit the CRC yet */
+                bufcount = num;
+            } else {
+                /* All that's left of buf[] */
+                bufcount = len - 4;
+            }
+            crccount = num - bufcount;
+
+            if (bufcount > 0) {
+                /* Still some of the actual data buffer to transfer */
+                assert(bufsz >= bufcount);
+                bufsz -= bufcount;
+                address_space_write(&address_space_memory, rba,
+                                    MEMTXATTRS_UNSPECIFIED, buf, bufcount);
+                rba += bufcount;
+                buf += bufcount;
+                len -= bufcount;
+            }
+
+            /* Write as much of the CRC as fits */
+            if (crccount > 0) {
+                address_space_write(&address_space_memory, rba,
+                                    MEMTXATTRS_UNSPECIFIED, crc_ptr, crccount);
+                rba += crccount;
+                crc_ptr += crccount;
+                len -= crccount;
             }
 
             num |= 0x4000; /* set F BIT */
-- 
2.5.0

From: Andrew Melnychenko <andrew@daynix.com>

Buglink: https://bugzilla.redhat.com/show_bug.cgi?id=1737400
Fixed setting max_queue_num if there are no peers in
NICConf. qemu_new_nic() creates NICState with 1 NetClientState(index
0) without peers, set max_queue_num to 0 - It prevents undefined
behavior and possible crashes, especially during pcie hotplug.

Fixes: 6f3fbe4ed06 ("net: Introduce e1000e device emulation")
Signed-off-by: Andrew Melnychenko <andrew@daynix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Reviewed-by: Dmitry Fleytman <dmitry.fleytman@gmail.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/e1000e.c | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/hw/net/e1000e.c b/hw/net/e1000e.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/e1000e.c
+++ b/hw/net/e1000e.c
@@ -XXX,XX +XXX,XX @@ e1000e_init_net_peer(E1000EState *s, PCIDevice *pci_dev, uint8_t *macaddr)
     s->nic = qemu_new_nic(&net_e1000e_info, &s->conf,
         object_get_typename(OBJECT(s)), dev->id, s);
 
-    s->core.max_queue_num = s->conf.peers.queues - 1;
+    s->core.max_queue_num = s->conf.peers.queues ? s->conf.peers.queues - 1 : 0;
 
     trace_e1000e_mac_set_permanent(MAC_ARG(macaddr));
     memcpy(s->core.permanent_mac, macaddr, sizeof(s->core.permanent_mac));
-- 
2.5.0