Series comparison

-[PULL 0/6] Net patches
+[PULL V3 00/13] Net patches
-The following changes since commit 6b99bb046dd36a6dd5525b8f88c2dcddae49222a:
+The following changes since commit f8d75e10d3e0033a0a29a7a7e4777a4fbc17a016:
-  Merge tag 'pull-lu-20241122' of https://gitlab.com/rth7680/qemu into staging (2024-11-24 13:39:06 +0000)
+  Merge remote-tracking branch 'remotes/legoater/tags/pull-ppc-20220112' into staging (2022-01-13 11:18:24 +0000)
-are available in the Git repository at:
+are available in the git repository at:
   https://github.com/jasowang/qemu.git tags/net-pull-request
-for you to fetch changes up to 7987d2be5a8bc3a502f89ba8cf3ac3e09f64d1ce:
+for you to fetch changes up to 818692f0a01587d02220916b31d5bb8e7dced611:
-  virtio-net: Copy received header to buffer (2024-11-25 14:00:51 +0800)
+  net/vmnet: update MAINTAINERS list (2022-01-14 12:58:19 +0800)
 ----------------------------------------------------------------
------BEGIN PGP SIGNATURE-----
-iQEzBAABCAAdFiEEIV1G9IJGaJ7HfzVi7wSWWzmNYhEFAmdEEtgACgkQ7wSWWzmN
+Changes since V2:
-YhH5qAgAlKdcx/gFt4EBXtjVq/qbPluEGOQxvcRYLlN90rPLHPgCjAoT5ly3fIv1
-kCgcVZyG8SdGu1n0TzTTS9kg5tL7weQ9xEWwF0oyyuZABgAB7w/wpC8MHSkJFOn
+- Try to make vmnet work on some old mac version
 Tv+2Iab0dJ+e1pw71OMpE/YR5X2xq5vopsSHRtnyGWfRPGswJFwka+f8FS5DSiq
 CeNxADgTkPxJgDmOrNSsAPz8Rns77FAZdvDMqFjx1Lrqm8kPv9jzwOMO+a/2LpC
 t6OkpFzGjiiskPjSnSn/tzo4TfWYoABjJaI7b3vEqmNEJSTAaxltZNtSXZucctEt
 ihnFdjr/wPwGK/5Wu+qGnfDbFNxBw==
 =W4y1
 -----END PGP SIGNATURE-----
 ----------------------------------------------------------------
-Akihiko Odaki (6):
+Peter Foley (2):
-      net: checksum: Convert data to void *
+      net/tap: Set return code on failure
-      virtio-net: Fix size check in dhclient workaround
+      net: Fix uninitialized data usage
       virtio-net: Do not check for the queue before RSS
       virtio-net: Fix hash reporting when the queue changes
       virtio-net: Initialize hash reporting values
       virtio-net: Copy received header to buffer
- hw/net/virtio-net.c    | 108 +++++++++++++++++++++++++++----------------------
+Philippe Mathieu-Daudé (1):
- include/net/checksum.h |   2 +-
+      hw/net/vmxnet3: Log guest-triggerable errors using LOG_GUEST_ERROR
- net/checksum.c         |   4 +-
-files changed, 63 insertions(+), 51 deletions(-)
+Rao Lei (1):
       net/filter: Optimize filter_send to coroutine
 Vladislav Yaroshchuk (7):
       net/vmnet: add vmnet dependency and customizable option
       net/vmnet: add vmnet backends to qapi/net
       net/vmnet: implement shared mode (vmnet-shared)
       net/vmnet: implement host mode (vmnet-host)
       net/vmnet: implement bridged mode (vmnet-bridged)
       net/vmnet: update qemu-options.hx
       net/vmnet: update MAINTAINERS list
 Zhang Chen (2):
       net/colo-compare.c: Optimize compare order for performance
       net/colo-compare.c: Update the default value comments
  MAINTAINERS                   |   5 +
  hw/net/vmxnet3.c              |   4 +-
  meson.build                   |  16 +-
  meson_options.txt             |   2 +
  net/clients.h                 |  11 ++
  net/colo-compare.c            |  28 ++--
  net/filter-mirror.c           |  66 +++++++--
  net/meson.build               |   7 +
  net/net.c                     |  10 ++
  net/tap-linux.c               |   1 +
  net/tap.c                     |   1 +
  net/vmnet-bridged.m           | 120 +++++++++++++++
  net/vmnet-common.m            | 333 ++++++++++++++++++++++++++++++++++++++++++
  net/vmnet-host.c              | 122 ++++++++++++++++
  net/vmnet-shared.c            | 100 +++++++++++++
  net/vmnet_int.h               |  48 ++++++
  qapi/net.json                 | 133 ++++++++++++++++-
  qemu-options.hx               |  25 ++++
  scripts/meson-buildoptions.sh |   3 +
 files changed, 1004 insertions(+), 31 deletions(-)
  create mode 100644 net/vmnet-bridged.m
  create mode 100644 net/vmnet-common.m
  create mode 100644 net/vmnet-host.c
  create mode 100644 net/vmnet-shared.c
  create mode 100644 net/vmnet_int.h

-New patch
+[PULL V3 01/13] hw/net/vmxnet3: Log guest-triggerable errors using LOG_GUEST_ERROR
+From: Philippe Mathieu-Daudé <philmd@redhat.com>
+The "Interrupt Cause" register (VMXNET3_REG_ICR) is read-only.
+Write accesses are ignored. Log them with as LOG_GUEST_ERROR
+instead of aborting:
+  [R +0.239743] writeq 0xe0002031 0x46291a5a55460800
+  ERROR:hw/net/vmxnet3.c:1819:vmxnet3_io_bar1_write: code should not be reached
+  Thread 1 "qemu-system-i38" received signal SIGABRT, Aborted.
+  (gdb) bt
+  #3  0x74c397d3 in __GI_abort () at abort.c:79
+  #4  0x76d3cd4c in g_assertion_message (domain=<optimized out>, file=<optimized out>, line=<optimized out>, func=<optimized out>, message=<optimized out>) at ../glib/gtestutils.c:3223
+  #5  0x76d9d45f in g_assertion_message_expr
+      (domain=0x0, file=0x59fc2e53 "hw/net/vmxnet3.c", line=1819, func=0x59fc11e0 <__func__.vmxnet3_io_bar1_write> "vmxnet3_io_bar1_write", expr=<optimized out>)
+      at ../glib/gtestutils.c:3249
+  #6  0x57e80a3a in vmxnet3_io_bar1_write (opaque=0x62814100, addr=56, val=70, size=4) at hw/net/vmxnet3.c:1819
+  #7  0x58c2d894 in memory_region_write_accessor (mr=0x62816b90, addr=56, value=0x7fff9450, size=4, shift=0, mask=4294967295, attrs=...) at softmmu/memory.c:492
+  #8  0x58c2d1d2 in access_with_adjusted_size (addr=56, value=0x7fff9450, size=1, access_size_min=4, access_size_max=4, access_fn=
+x58c2d290 <memory_region_write_accessor>, mr=0x62816b90, attrs=...) at softmmu/memory.c:554
+  #9  0x58c2bae7 in memory_region_dispatch_write (mr=0x62816b90, addr=56, data=70, op=MO_8, attrs=...) at softmmu/memory.c:1504
+  #10 0x58bfd034 in flatview_write_continue (fv=0x606000181700, addr=0xe0002038, attrs=..., ptr=0x7fffb9e0, len=1, addr1=56, l=1, mr=0x62816b90)
+      at softmmu/physmem.c:2782
+  #11 0x58beba00 in flatview_write (fv=0x606000181700, addr=0xe0002031, attrs=..., buf=0x7fffb9e0, len=8) at softmmu/physmem.c:2822
+  #12 0x58beb589 in address_space_write (as=0x608000015f20, addr=0xe0002031, attrs=..., buf=0x7fffb9e0, len=8) at softmmu/physmem.c:2914
+Reported-by: Dike <dike199774@qq.com>
+Reported-by: Duhao <504224090@qq.com>
+BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=2032932
+Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ hw/net/vmxnet3.c | 4 +++-
+file changed, 3 insertions(+), 1 deletion(-)
+diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
+index XXXXXXX..XXXXXXX 100644
+--- a/hw/net/vmxnet3.c
++++ b/hw/net/vmxnet3.c
+@@ -XXX,XX +XXX,XX @@ vmxnet3_io_bar1_write(void *opaque,
+     case VMXNET3_REG_ICR:
+         VMW_CBPRN("Write BAR1 [VMXNET3_REG_ICR] = %" PRIx64 ", size %d",
+                   val, size);
+-        g_assert_not_reached();
++        qemu_log_mask(LOG_GUEST_ERROR,
++                      "%s: write to read-only register VMXNET3_REG_ICR\n",
++                      TYPE_VMXNET3);
+         break;
+     /* Event Cause Register */
+--
+.7.4

-New patch
+[PULL V3 02/13] net/tap: Set return code on failure
+From: Peter Foley <pefoley@google.com>
+Match the other error handling in this function.
+Fixes: e7b347d0bf6 ("net: detect errors from probing vnet hdr flag for TAP devices")
+Reviewed-by: Patrick Venture <venture@google.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Peter Foley <pefoley@google.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ net/tap.c | 1 +
+file changed, 1 insertion(+)
+diff --git a/net/tap.c b/net/tap.c
+index XXXXXXX..XXXXXXX 100644
+--- a/net/tap.c
++++ b/net/tap.c
+@@ -XXX,XX +XXX,XX @@ int net_init_tap(const Netdev *netdev, const char *name,
+             if (i == 0) {
+                 vnet_hdr = tap_probe_vnet_hdr(fd, errp);
+                 if (vnet_hdr < 0) {
++                    ret = -1;
+                     goto free_fail;
+                 }
+             } else if (vnet_hdr != tap_probe_vnet_hdr(fd, NULL)) {
+--
+.7.4

-New patch
+[PULL V3 03/13] net: Fix uninitialized data usage
+From: Peter Foley <pefoley@google.com>
+e.g.
+15:16:20.151506 Uninitialized bytes in ioctl_common_pre at offset 0 inside [0x7ffc516af9b8, 4)
+15:16:20.151659 ==588974==WARNING: MemorySanitizer: use-of-uninitialized-value
+15:16:20.312923     #0 0x5639b88acb21 in tap_probe_vnet_hdr_len third_party/qemu/net/tap-linux.c:183:9
+15:16:20.312952     #1 0x5639b88afd66 in net_tap_fd_init third_party/qemu/net/tap.c:409:9
+15:16:20.312954     #2 0x5639b88b2d1b in net_init_tap_one third_party/qemu/net/tap.c:681:19
+15:16:20.312956     #3 0x5639b88b16a8 in net_init_tap third_party/qemu/net/tap.c:912:13
+15:16:20.312957     #4 0x5639b8890175 in net_client_init1 third_party/qemu/net/net.c:1110:9
+15:16:20.312958     #5 0x5639b888f912 in net_client_init third_party/qemu/net/net.c:1208:15
+15:16:20.312960     #6 0x5639b8894aa5 in net_param_nic third_party/qemu/net/net.c:1588:11
+15:16:20.312961     #7 0x5639b900cd18 in qemu_opts_foreach third_party/qemu/util/qemu-option.c:1135:14
+15:16:20.312962     #8 0x5639b889393c in net_init_clients third_party/qemu/net/net.c:1612:9
+15:16:20.312964     #9 0x5639b717aaf3 in qemu_create_late_backends third_party/qemu/softmmu/vl.c:1962:5
+15:16:20.312965     #10 0x5639b717aaf3 in qemu_init third_party/qemu/softmmu/vl.c:3694:5
+15:16:20.312967     #11 0x5639b71083b8 in main third_party/qemu/softmmu/main.c:49:5
+15:16:20.312968     #12 0x7f464de1d8d2 in __libc_start_main (/usr/grte/v5/lib64/libc.so.6+0x628d2)
+15:16:20.312969     #13 0x5639b6bbd389 in _start /usr/grte/v5/debug-src/src/csu/../sysdeps/x86_64/start.S:120
+15:16:20.312970
+15:16:20.312975   Uninitialized value was stored to memory at
+15:16:20.313393     #0 0x5639b88acbee in tap_probe_vnet_hdr_len third_party/qemu/net/tap-linux.c
+15:16:20.313396     #1 0x5639b88afd66 in net_tap_fd_init third_party/qemu/net/tap.c:409:9
+15:16:20.313398     #2 0x5639b88b2d1b in net_init_tap_one third_party/qemu/net/tap.c:681:19
+15:16:20.313399     #3 0x5639b88b16a8 in net_init_tap third_party/qemu/net/tap.c:912:13
+15:16:20.313400     #4 0x5639b8890175 in net_client_init1 third_party/qemu/net/net.c:1110:9
+15:16:20.313401     #5 0x5639b888f912 in net_client_init third_party/qemu/net/net.c:1208:15
+15:16:20.313403     #6 0x5639b8894aa5 in net_param_nic third_party/qemu/net/net.c:1588:11
+15:16:20.313404     #7 0x5639b900cd18 in qemu_opts_foreach third_party/qemu/util/qemu-option.c:1135:14
+15:16:20.313405     #8 0x5639b889393c in net_init_clients third_party/qemu/net/net.c:1612:9
+15:16:20.313407     #9 0x5639b717aaf3 in qemu_create_late_backends third_party/qemu/softmmu/vl.c:1962:5
+15:16:20.313408     #10 0x5639b717aaf3 in qemu_init third_party/qemu/softmmu/vl.c:3694:5
+15:16:20.313409     #11 0x5639b71083b8 in main third_party/qemu/softmmu/main.c:49:5
+15:16:20.313410     #12 0x7f464de1d8d2 in __libc_start_main (/usr/grte/v5/lib64/libc.so.6+0x628d2)
+15:16:20.313412     #13 0x5639b6bbd389 in _start /usr/grte/v5/debug-src/src/csu/../sysdeps/x86_64/start.S:120
+15:16:20.313413
+15:16:20.313417   Uninitialized value was stored to memory at
+15:16:20.313791     #0 0x5639b88affbd in net_tap_fd_init third_party/qemu/net/tap.c:400:26
+15:16:20.313826     #1 0x5639b88b2d1b in net_init_tap_one third_party/qemu/net/tap.c:681:19
+15:16:20.313829     #2 0x5639b88b16a8 in net_init_tap third_party/qemu/net/tap.c:912:13
+15:16:20.313831     #3 0x5639b8890175 in net_client_init1 third_party/qemu/net/net.c:1110:9
+15:16:20.313836     #4 0x5639b888f912 in net_client_init third_party/qemu/net/net.c:1208:15
+15:16:20.313838     #5 0x5639b8894aa5 in net_param_nic third_party/qemu/net/net.c:1588:11
+15:16:20.313839     #6 0x5639b900cd18 in qemu_opts_foreach third_party/qemu/util/qemu-option.c:1135:14
+15:16:20.313841     #7 0x5639b889393c in net_init_clients third_party/qemu/net/net.c:1612:9
+15:16:20.313843     #8 0x5639b717aaf3 in qemu_create_late_backends third_party/qemu/softmmu/vl.c:1962:5
+15:16:20.313844     #9 0x5639b717aaf3 in qemu_init third_party/qemu/softmmu/vl.c:3694:5
+15:16:20.313845     #10 0x5639b71083b8 in main third_party/qemu/softmmu/main.c:49:5
+15:16:20.313846     #11 0x7f464de1d8d2 in __libc_start_main (/usr/grte/v5/lib64/libc.so.6+0x628d2)
+15:16:20.313847     #12 0x5639b6bbd389 in _start /usr/grte/v5/debug-src/src/csu/../sysdeps/x86_64/start.S:120
+15:16:20.313849
+15:16:20.313851   Uninitialized value was created by an allocation of 'ifr' in the stack frame of function 'tap_probe_vnet_hdr'
+15:16:20.313855     #0 0x5639b88ac680 in tap_probe_vnet_hdr third_party/qemu/net/tap-linux.c:151
+15:16:20.313856
+15:16:20.313878 SUMMARY: MemorySanitizer: use-of-uninitialized-value third_party/qemu/net/tap-linux.c:183:9 in tap_probe_vnet_hdr_len
+Fixes: dc69004c7d8 ("net: move tap_probe_vnet_hdr() to tap-linux.c")
+Reviewed-by: Hao Wu <wuhaotsh@google.com>
+Reviewed-by: Patrick Venture <venture@google.com>
+Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
+Signed-off-by: Peter Foley <pefoley@google.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ net/tap-linux.c | 1 +
+file changed, 1 insertion(+)
+diff --git a/net/tap-linux.c b/net/tap-linux.c
+index XXXXXXX..XXXXXXX 100644
+--- a/net/tap-linux.c
++++ b/net/tap-linux.c
+@@ -XXX,XX +XXX,XX @@ void tap_set_sndbuf(int fd, const NetdevTapOptions *tap, Error **errp)
+ int tap_probe_vnet_hdr(int fd, Error **errp)
+ {
+     struct ifreq ifr;
++    memset(&ifr, 0, sizeof(ifr));
+     if (ioctl(fd, TUNGETIFF, &ifr) != 0) {
+         /* TUNGETIFF is available since kernel v2.6.27 */
+--
+.7.4

-[PULL 1/6] net: checksum: Convert data to void *
+[PULL V3 04/13] net/colo-compare.c: Optimize compare order for performance
-From: Akihiko Odaki <akihiko.odaki@daynix.com>
+From: Zhang Chen <chen.zhang@intel.com>
-Convert the data parameter of net_checksum_calculate() to void * to
+COLO-compare use the glib function g_queue_find_custom to dump
-save unnecessary casts for callers.
+another VM's networking packet to compare. But this function always
 start find from the queue->head(here is the newest packet), It will
 reduce the success rate of comparison. So this patch reversed
 the order of the queues for performance.
-Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
+Signed-off-by: Zhang Chen <chen.zhang@intel.com>
-Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
+Reported-by: leirao <lei.rao@intel.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- include/net/checksum.h | 2 +-
+ net/colo-compare.c | 26 +++++++++++++-------------
- net/checksum.c         | 4 ++--
+file changed, 13 insertions(+), 13 deletions(-)
 files changed, 3 insertions(+), 3 deletions(-)
-diff --git a/include/net/checksum.h b/include/net/checksum.h
+diff --git a/net/colo-compare.c b/net/colo-compare.c
 index XXXXXXX..XXXXXXX 100644
---- a/include/net/checksum.h
+--- a/net/colo-compare.c
-+++ b/include/net/checksum.h
++++ b/net/colo-compare.c
-@@ -XXX,XX +XXX,XX @@ uint32_t net_checksum_add_cont(int len, uint8_t *buf, int seq);
+@@ -XXX,XX +XXX,XX @@ static void colo_compare_inconsistency_notify(CompareState *s)
- uint16_t net_checksum_finish(uint32_t sum);
+ /* Use restricted to colo_insert_packet() */
- uint16_t net_checksum_tcpudp(uint16_t length, uint16_t proto,
+ static gint seq_sorter(Packet *a, Packet *b, gpointer data)
-                              uint8_t *addrs, uint8_t *buf);
+ {
--void net_checksum_calculate(uint8_t *data, int length, int csum_flag);
+-    return a->tcp_seq - b->tcp_seq;
-+void net_checksum_calculate(void *data, int length, int csum_flag);
++    return b->tcp_seq - a->tcp_seq;
  static inline uint32_t
  net_checksum_add(int len, uint8_t *buf)
 diff --git a/net/checksum.c b/net/checksum.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/checksum.c
 +++ b/net/checksum.c
@@ -XXX,XX +XXX,XX @@ uint16_t net_checksum_tcpudp(uint16_t length, uint16_t proto,
      return net_checksum_finish(sum);
  }
--void net_checksum_calculate(uint8_t *data, int length, int csum_flag)
+ static void fill_pkt_tcp_info(void *data, uint32_t *max_ack)
-+void net_checksum_calculate(void *data, int length, int csum_flag)
+@@ -XXX,XX +XXX,XX @@ pri:
- {
+     if (g_queue_is_empty(&conn->primary_list)) {
      int mac_hdr_len, ip_len;
      struct ip_header *ip;
@@ -XXX,XX +XXX,XX @@ void net_checksum_calculate(uint8_t *data, int length, int csum_flag)
          return;
      }
+-    ppkt = g_queue_pop_head(&conn->primary_list);
--    ip = (struct ip_header *)(data + mac_hdr_len);
++    ppkt = g_queue_pop_tail(&conn->primary_list);
-+    ip = (struct ip_header *)((uint8_t *)data + mac_hdr_len);
+ sec:
+     if (g_queue_is_empty(&conn->secondary_list)) {
-     if (IP_HEADER_VERSION(ip) != IP_HEADER_VERSION_4) {
+-        g_queue_push_head(&conn->primary_list, ppkt);
-         return; /* not IPv4 */
++        g_queue_push_tail(&conn->primary_list, ppkt);
          return;
      }
 -    spkt = g_queue_pop_head(&conn->secondary_list);
 +    spkt = g_queue_pop_tail(&conn->secondary_list);
      if (ppkt->tcp_seq == ppkt->seq_end) {
          colo_release_primary_pkt(s, ppkt);
@@ -XXX,XX +XXX,XX @@ sec:
              }
          }
          if (!ppkt) {
 -            g_queue_push_head(&conn->secondary_list, spkt);
 +            g_queue_push_tail(&conn->secondary_list, spkt);
              goto pri;
          }
      }
@@ -XXX,XX +XXX,XX @@ sec:
          if (mark == COLO_COMPARE_FREE_PRIMARY) {
              conn->compare_seq = ppkt->seq_end;
              colo_release_primary_pkt(s, ppkt);
 -            g_queue_push_head(&conn->secondary_list, spkt);
 +            g_queue_push_tail(&conn->secondary_list, spkt);
              goto pri;
          } else if (mark == COLO_COMPARE_FREE_SECONDARY) {
              conn->compare_seq = spkt->seq_end;
@@ -XXX,XX +XXX,XX @@ sec:
              goto pri;
          }
      } else {
 -        g_queue_push_head(&conn->primary_list, ppkt);
 -        g_queue_push_head(&conn->secondary_list, spkt);
 +        g_queue_push_tail(&conn->primary_list, ppkt);
 +        g_queue_push_tail(&conn->secondary_list, spkt);
  #ifdef DEBUG_COLO_PACKETS
          qemu_hexdump(stderr, "colo-compare ppkt", ppkt->data, ppkt->size);
@@ -XXX,XX +XXX,XX @@ static void colo_compare_packet(CompareState *s, Connection *conn,
      while (!g_queue_is_empty(&conn->primary_list) &&
             !g_queue_is_empty(&conn->secondary_list)) {
 -        pkt = g_queue_pop_head(&conn->primary_list);
 +        pkt = g_queue_pop_tail(&conn->primary_list);
          result = g_queue_find_custom(&conn->secondary_list,
                   pkt, (GCompareFunc)HandlePacket);
@@ -XXX,XX +XXX,XX @@ static void colo_compare_packet(CompareState *s, Connection *conn,
               * timeout, it will trigger a checkpoint request.
               */
              trace_colo_compare_main("packet different");
 -            g_queue_push_head(&conn->primary_list, pkt);
 +            g_queue_push_tail(&conn->primary_list, pkt);
              colo_compare_inconsistency_notify(s);
              break;
@@ -XXX,XX +XXX,XX @@ static int compare_chr_send(CompareState *s,
          entry->buf = g_malloc(size);
          memcpy(entry->buf, buf, size);
      }
 -    g_queue_push_head(&sendco->send_list, entry);
 +    g_queue_push_tail(&sendco->send_list, entry);
      if (sendco->done) {
          sendco->co = qemu_coroutine_create(_compare_chr_send, sendco);
@@ -XXX,XX +XXX,XX @@ static void colo_flush_packets(void *opaque, void *user_data)
      Packet *pkt = NULL;
      while (!g_queue_is_empty(&conn->primary_list)) {
 -        pkt = g_queue_pop_head(&conn->primary_list);
 +        pkt = g_queue_pop_tail(&conn->primary_list);
          compare_chr_send(s,
                           pkt->data,
                           pkt->size,
@@ -XXX,XX +XXX,XX @@ static void colo_flush_packets(void *opaque, void *user_data)
          packet_destroy_partial(pkt, NULL);
      }
      while (!g_queue_is_empty(&conn->secondary_list)) {
 -        pkt = g_queue_pop_head(&conn->secondary_list);
 +        pkt = g_queue_pop_tail(&conn->secondary_list);
          packet_destroy(pkt, NULL);
      }
  }
 --
-.42.0
+.7.4

-[PULL 4/6] virtio-net: Fix hash reporting when the queue changes
+[PULL V3 05/13] net/colo-compare.c: Update the default value comments
-From: Akihiko Odaki <akihiko.odaki@daynix.com>
+From: Zhang Chen <chen.zhang@intel.com>
-virtio_net_process_rss() fills the values used for hash reporting, but
+Make the comments consistent with the REGULAR_PACKET_CHECK_MS.
 the values used to be thrown away with a recursive function call if
 the queue changes after RSS. Avoid the function call to keep the values.
-Fixes: a4c960eedcd2 ("virtio-net: Do not write hashes to peer buffer")
+Signed-off-by: Zhang Chen <chen.zhang@intel.com>
 Buglink: https://issues.redhat.com/browse/RHEL-59572
 Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- hw/net/virtio-net.c | 14 +++++++-------
+ net/colo-compare.c | 2 +-
-file changed, 7 insertions(+), 7 deletions(-)
+file changed, 1 insertion(+), 1 deletion(-)
-diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
+diff --git a/net/colo-compare.c b/net/colo-compare.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/virtio-net.c
+--- a/net/colo-compare.c
-+++ b/hw/net/virtio-net.c
++++ b/net/colo-compare.c
-@@ -XXX,XX +XXX,XX @@ static int virtio_net_process_rss(NetClientState *nc, const uint8_t *buf,
+@@ -XXX,XX +XXX,XX @@ static void colo_compare_complete(UserCreatable *uc, Error **errp)
  }
  static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
 -                                      size_t size, bool no_rss)
 +                                      size_t size)
  {
      VirtIONet *n = qemu_get_nic_opaque(nc);
 -    VirtIONetQueue *q = virtio_net_get_subqueue(nc);
 +    VirtIONetQueue *q;
      VirtIODevice *vdev = VIRTIO_DEVICE(n);
      VirtQueueElement *elems[VIRTQUEUE_MAX_SIZE];
      size_t lens[VIRTQUEUE_MAX_SIZE];
@@ -XXX,XX +XXX,XX @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
      size_t offset, i, guest_offset, j;
      ssize_t err;
 -    if (!no_rss && n->rss_data.enabled && n->rss_data.enabled_software_rss) {
 +    if (n->rss_data.enabled && n->rss_data.enabled_software_rss) {
          int index = virtio_net_process_rss(nc, buf, size, &extra_hdr);
          if (index >= 0) {
 -            NetClientState *nc2 =
 -                qemu_get_subqueue(n->nic, index % n->curr_queue_pairs);
 -            return virtio_net_receive_rcu(nc2, buf, size, true);
 +            nc = qemu_get_subqueue(n->nic, index % n->curr_queue_pairs);
          }
      }
-@@ -XXX,XX +XXX,XX @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
+     if (!s->expired_scan_cycle) {
-         return -1;
+-        /* Set default value to 3000 MS */
 +        /* Set default value to 1000 MS */
          s->expired_scan_cycle = REGULAR_PACKET_CHECK_MS;
      }
-+    q = virtio_net_get_subqueue(nc);
-+
-     /* hdr_len refers to the header we supply to the guest */
-     if (!virtio_net_has_buffers(q, size + n->guest_hdr_len - n->host_hdr_len)) {
-         return 0;
-@@ -XXX,XX +XXX,XX @@ static ssize_t virtio_net_do_receive(NetClientState *nc, const uint8_t *buf,
- {
-     RCU_READ_LOCK_GUARD();
--    return virtio_net_receive_rcu(nc, buf, size, false);
-+    return virtio_net_receive_rcu(nc, buf, size);
- }
- /*
 --
-.42.0
+.7.4

-[PULL 3/6] virtio-net: Do not check for the queue before RSS
+[PULL V3 06/13] net/filter: Optimize filter_send to coroutine
-From: Akihiko Odaki <akihiko.odaki@daynix.com>
+From: Rao Lei <lei.rao@intel.com>
-virtio_net_can_receive() checks if the queue is ready, but RSS will
+This patch is to improve the logic of QEMU main thread sleep code in
-change the queue to use so, strictly speaking, we may still be able to
+qemu_chr_write_buffer() where it can be blocked and can't run other
-receive the packet even if the queue initially provided is not ready.
+coroutines during COLO IO stress test.
 Perform RSS before virtio_net_can_receive() to cover such a case.
-Fixes: 4474e37a5b3a ("virtio-net: implement RX RSS processing")
+Our approach is to put filter_send() in a coroutine. In this way,
-Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
+filter_send() will call qemu_coroutine_yield() in qemu_co_sleep_ns(),
 so that it can be scheduled out and QEMU main thread has opportunity to
 run other tasks.
 Signed-off-by: Lei Rao <lei.rao@intel.com>
 Signed-off-by: Zhang Chen <chen.zhang@intel.com>
 Reviewed-by: Li Zhijian <lizhijian@fujitsu.com>
 Reviewed-by: Zhang Chen <chen.zhang@intel.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- hw/net/virtio-net.c | 8 ++++----
+ net/filter-mirror.c | 66 ++++++++++++++++++++++++++++++++++++++++++-----------
-file changed, 4 insertions(+), 4 deletions(-)
+file changed, 53 insertions(+), 13 deletions(-)
-diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
+diff --git a/net/filter-mirror.c b/net/filter-mirror.c
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/virtio-net.c
+--- a/net/filter-mirror.c
-+++ b/hw/net/virtio-net.c
++++ b/net/filter-mirror.c
-@@ -XXX,XX +XXX,XX @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
+@@ -XXX,XX +XXX,XX @@
-     size_t offset, i, guest_offset, j;
+ #include "chardev/char-fe.h"
-     ssize_t err;
+ #include "qemu/iov.h"
+ #include "qemu/sockets.h"
--    if (!virtio_net_can_receive(nc)) {
++#include "block/aio-wait.h"
--        return -1;
  #define TYPE_FILTER_MIRROR "filter-mirror"
  typedef struct MirrorState MirrorState;
@@ -XXX,XX +XXX,XX @@ struct MirrorState {
      bool vnet_hdr;
  };
 -static int filter_send(MirrorState *s,
 -                       const struct iovec *iov,
 -                       int iovcnt)
 +typedef struct FilterSendCo {
 +    MirrorState *s;
 +    char *buf;
 +    ssize_t size;
 +    bool done;
 +    int ret;
 +} FilterSendCo;
 +
 +static int _filter_send(MirrorState *s,
 +                       char *buf,
 +                       ssize_t size)
  {
      NetFilterState *nf = NETFILTER(s);
      int ret = 0;
 -    ssize_t size = 0;
      uint32_t len = 0;
 -    char *buf;
 -
 -    size = iov_size(iov, iovcnt);
 -    if (!size) {
 -        return 0;
 -    }
--
-     if (!no_rss && n->rss_data.enabled && n->rss_data.enabled_software_rss) {
+     len = htonl(size);
-         int index = virtio_net_process_rss(nc, buf, size, &extra_hdr);
+     ret = qemu_chr_fe_write_all(&s->chr_out, (uint8_t *)&len, sizeof(len));
-         if (index >= 0) {
+@@ -XXX,XX +XXX,XX @@ static int filter_send(MirrorState *s,
@@ -XXX,XX +XXX,XX @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
          }
      }
-+    if (!virtio_net_can_receive(nc)) {
+-    buf = g_malloc(size);
-+        return -1;
+-    iov_to_buf(iov, iovcnt, 0, buf, size);
      ret = qemu_chr_fe_write_all(&s->chr_out, (uint8_t *)buf, size);
 -    g_free(buf);
      if (ret != size) {
          goto err;
      }
@@ -XXX,XX +XXX,XX @@ err:
      return ret < 0 ? ret : -EIO;
  }
 +static void coroutine_fn filter_send_co(void *opaque)
 +{
 +    FilterSendCo *data = opaque;
 +
 +    data->ret = _filter_send(data->s, data->buf, data->size);
 +    data->done = true;
 +    g_free(data->buf);
 +    aio_wait_kick();
 +}
 +
 +static int filter_send(MirrorState *s,
 +                       const struct iovec *iov,
 +                       int iovcnt)
 +{
 +    ssize_t size = iov_size(iov, iovcnt);
 +    char *buf = NULL;
 +
 +    if (!size) {
 +        return 0;
 +    }
 +
-     /* hdr_len refers to the header we supply to the guest */
++    buf = g_malloc(size);
-     if (!virtio_net_has_buffers(q, size + n->guest_hdr_len - n->host_hdr_len)) {
++    iov_to_buf(iov, iovcnt, 0, buf, size);
-         return 0;
++
 +    FilterSendCo data = {
 +        .s = s,
 +        .size = size,
 +        .buf = buf,
 +        .ret = 0,
 +    };
 +
 +    Coroutine *co = qemu_coroutine_create(filter_send_co, &data);
 +    qemu_coroutine_enter(co);
 +
 +    while (!data.done) {
 +        aio_poll(qemu_get_aio_context(), true);
 +    }
 +
 +    return data.ret;
 +}
 +
  static void redirector_to_filter(NetFilterState *nf,
                                   const uint8_t *buf,
                                   int len)
 --
-.42.0
+.7.4

-New patch
+[PULL V3 07/13] net/vmnet: add vmnet dependency and customizable option
+From: Vladislav Yaroshchuk <yaroshchuk2000@gmail.com>
+vmnet.framework dependency is added with 'vmnet' option
+to enable or disable it. Default value is 'auto'.
+vmnet features to be used are available since macOS 11.0,
+corresponding probe is created into meson.build.
+Signed-off-by: Vladislav Yaroshchuk <yaroshchuk2000@gmail.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ meson.build                   | 16 +++++++++++++++-
+ meson_options.txt             |  2 ++
+ scripts/meson-buildoptions.sh |  3 +++
+files changed, 20 insertions(+), 1 deletion(-)
+diff --git a/meson.build b/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/meson.build
++++ b/meson.build
+@@ -XXX,XX +XXX,XX @@ if cocoa.found() and get_option('gtk').enabled()
+   error('Cocoa and GTK+ cannot be enabled at the same time')
+ endif
++vmnet = dependency('appleframeworks', modules: 'vmnet', required: get_option('vmnet'))
++if vmnet.found() and not cc.has_header_symbol('vmnet/vmnet.h',
++                                              'VMNET_BRIDGED_MODE',
++                                              dependencies: vmnet)
++  vmnet = not_found
++  if get_option('vmnet').enabled()
++    error('vmnet.framework API is outdated')
++  else
++    warning('vmnet.framework API is outdated, disabling')
++  endif
++endif
++
+ seccomp = not_found
+ if not get_option('seccomp').auto() or have_system or have_tools
+   seccomp = dependency('libseccomp', version: '>=2.3.0',
+@@ -XXX,XX +XXX,XX @@ config_host_data.set('CONFIG_SECCOMP', seccomp.found())
+ config_host_data.set('CONFIG_SNAPPY', snappy.found())
+ config_host_data.set('CONFIG_USB_LIBUSB', libusb.found())
+ config_host_data.set('CONFIG_VDE', vde.found())
++config_host_data.set('CONFIG_VMNET', vmnet.found())
+ config_host_data.set('CONFIG_VHOST_USER_BLK_SERVER', have_vhost_user_blk_server)
+ config_host_data.set('CONFIG_VNC', vnc.found())
+ config_host_data.set('CONFIG_VNC_JPEG', jpeg.found())
+@@ -XXX,XX +XXX,XX @@ summary(summary_info, bool_yn: true, section: 'Crypto')
+ # Libraries
+ summary_info = {}
+ if targetos == 'darwin'
+-  summary_info += {'Cocoa support':   cocoa}
++  summary_info += {'Cocoa support':           cocoa}
++  summary_info += {'vmnet.framework support': vmnet}
+ endif
+ summary_info += {'SDL support':       sdl}
+ summary_info += {'SDL image support': sdl_image}
+diff --git a/meson_options.txt b/meson_options.txt
+index XXXXXXX..XXXXXXX 100644
+--- a/meson_options.txt
++++ b/meson_options.txt
+@@ -XXX,XX +XXX,XX @@ option('netmap', type : 'feature', value : 'auto',
+        description: 'netmap network backend support')
+ option('vde', type : 'feature', value : 'auto',
+        description: 'vde network backend support')
++option('vmnet', type : 'feature', value : 'auto',
++       description: 'vmnet.framework network backend support')
+ option('virglrenderer', type : 'feature', value : 'auto',
+        description: 'virgl rendering support')
+ option('vnc', type : 'feature', value : 'auto',
+diff --git a/scripts/meson-buildoptions.sh b/scripts/meson-buildoptions.sh
+index XXXXXXX..XXXXXXX 100644
+--- a/scripts/meson-buildoptions.sh
++++ b/scripts/meson-buildoptions.sh
+@@ -XXX,XX +XXX,XX @@ meson_options_help() {
+   printf "%s\n" '  u2f             U2F emulation support'
+   printf "%s\n" '  usb-redir       libusbredir support'
+   printf "%s\n" '  vde             vde network backend support'
++  printf "%s\n" '  vmnet           vmnet.framework network backend support'
+   printf "%s\n" '  vhost-user-blk-server'
+   printf "%s\n" '                  build vhost-user-blk server'
+   printf "%s\n" '  virglrenderer   virgl rendering support'
+@@ -XXX,XX +XXX,XX @@ _meson_option_parse() {
+     --disable-usb-redir) printf "%s" -Dusb_redir=disabled ;;
+     --enable-vde) printf "%s" -Dvde=enabled ;;
+     --disable-vde) printf "%s" -Dvde=disabled ;;
++    --enable-vmnet) printf "%s" -Dvmnet=enabled ;;
++    --disable-vmnet) printf "%s" -Dvmnet=disabled ;;
+     --enable-vhost-user-blk-server) printf "%s" -Dvhost_user_blk_server=enabled ;;
+     --disable-vhost-user-blk-server) printf "%s" -Dvhost_user_blk_server=disabled ;;
+     --enable-virglrenderer) printf "%s" -Dvirglrenderer=enabled ;;
+--
+.7.4

-New patch
+[PULL V3 08/13] net/vmnet: add vmnet backends to qapi/net
+From: Vladislav Yaroshchuk <yaroshchuk2000@gmail.com>
+Create separate netdevs for each vmnet operating mode:
+- vmnet-host
+- vmnet-shared
+- vmnet-bridged
+Signed-off-by: Vladislav Yaroshchuk <yaroshchuk2000@gmail.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ net/clients.h       |  11 +++++
+ net/meson.build     |   7 +++
+ net/net.c           |  10 ++++
+ net/vmnet-bridged.m |  25 ++++++++++
+ net/vmnet-common.m  |  19 ++++++++
+ net/vmnet-host.c    |  24 ++++++++++
+ net/vmnet-shared.c  |  25 ++++++++++
+ net/vmnet_int.h     |  25 ++++++++++
+ qapi/net.json       | 133 +++++++++++++++++++++++++++++++++++++++++++++++++++-
+files changed, 277 insertions(+), 2 deletions(-)
+ create mode 100644 net/vmnet-bridged.m
+ create mode 100644 net/vmnet-common.m
+ create mode 100644 net/vmnet-host.c
+ create mode 100644 net/vmnet-shared.c
+ create mode 100644 net/vmnet_int.h
+diff --git a/net/clients.h b/net/clients.h
+index XXXXXXX..XXXXXXX 100644
+--- a/net/clients.h
++++ b/net/clients.h
+@@ -XXX,XX +XXX,XX @@ int net_init_vhost_user(const Netdev *netdev, const char *name,
+ int net_init_vhost_vdpa(const Netdev *netdev, const char *name,
+                         NetClientState *peer, Error **errp);
++#ifdef CONFIG_VMNET
++int net_init_vmnet_host(const Netdev *netdev, const char *name,
++                          NetClientState *peer, Error **errp);
++
++int net_init_vmnet_shared(const Netdev *netdev, const char *name,
++                          NetClientState *peer, Error **errp);
++
++int net_init_vmnet_bridged(const Netdev *netdev, const char *name,
++                          NetClientState *peer, Error **errp);
++#endif /* CONFIG_VMNET */
++
+ #endif /* QEMU_NET_CLIENTS_H */
+diff --git a/net/meson.build b/net/meson.build
+index XXXXXXX..XXXXXXX 100644
+--- a/net/meson.build
++++ b/net/meson.build
+@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_POSIX', if_true: files(tap_posix))
+ softmmu_ss.add(when: 'CONFIG_WIN32', if_true: files('tap-win32.c'))
+ softmmu_ss.add(when: 'CONFIG_VHOST_NET_VDPA', if_true: files('vhost-vdpa.c'))
++vmnet_files = files(
++  'vmnet-common.m',
++  'vmnet-bridged.m',
++  'vmnet-host.c',
++  'vmnet-shared.c'
++)
++softmmu_ss.add(when: vmnet, if_true: vmnet_files)
+ subdir('can')
+diff --git a/net/net.c b/net/net.c
+index XXXXXXX..XXXXXXX 100644
+--- a/net/net.c
++++ b/net/net.c
+@@ -XXX,XX +XXX,XX @@ static int (* const net_client_init_fun[NET_CLIENT_DRIVER__MAX])(
+ #ifdef CONFIG_L2TPV3
+         [NET_CLIENT_DRIVER_L2TPV3]    = net_init_l2tpv3,
+ #endif
++#ifdef CONFIG_VMNET
++        [NET_CLIENT_DRIVER_VMNET_HOST] = net_init_vmnet_host,
++        [NET_CLIENT_DRIVER_VMNET_SHARED] = net_init_vmnet_shared,
++        [NET_CLIENT_DRIVER_VMNET_BRIDGED] = net_init_vmnet_bridged,
++#endif /* CONFIG_VMNET */
+ };
+@@ -XXX,XX +XXX,XX @@ void show_netdevs(void)
+ #ifdef CONFIG_VHOST_VDPA
+         "vhost-vdpa",
+ #endif
++#ifdef CONFIG_VMNET
++        "vmnet-host",
++        "vmnet-shared",
++        "vmnet-bridged",
++#endif
+     };
+     qemu_printf("Available netdev backend types:\n");
+diff --git a/net/vmnet-bridged.m b/net/vmnet-bridged.m
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/net/vmnet-bridged.m
+@@ -XXX,XX +XXX,XX @@
++/*
++ * vmnet-bridged.m
++ *
++ * Copyright(c) 2021 Vladislav Yaroshchuk <yaroshchuk2000@gmail.com>
++ *
++ * This work is licensed under the terms of the GNU GPL, version 2 or later.
++ * See the COPYING file in the top-level directory.
++ *
++ */
++
++#include "qemu/osdep.h"
++#include "qapi/qapi-types-net.h"
++#include "vmnet_int.h"
++#include "clients.h"
++#include "qemu/error-report.h"
++#include "qapi/error.h"
++
++#include <vmnet/vmnet.h>
++
++int net_init_vmnet_bridged(const Netdev *netdev, const char *name,
++                           NetClientState *peer, Error **errp)
++{
++  error_setg(errp, "vmnet-bridged is not implemented yet");
++  return -1;
++}
+diff --git a/net/vmnet-common.m b/net/vmnet-common.m
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/net/vmnet-common.m
+@@ -XXX,XX +XXX,XX @@
++/*
++ * vmnet-common.m - network client wrapper for Apple vmnet.framework
++ *
++ * Copyright(c) 2021 Vladislav Yaroshchuk <yaroshchuk2000@gmail.com>
++ * Copyright(c) 2021 Phillip Tennen <phillip@axleos.com>
++ *
++ * This work is licensed under the terms of the GNU GPL, version 2 or later.
++ * See the COPYING file in the top-level directory.
++ *
++ */
++
++#include "qemu/osdep.h"
++#include "qapi/qapi-types-net.h"
++#include "vmnet_int.h"
++#include "clients.h"
++#include "qemu/error-report.h"
++#include "qapi/error.h"
++
++#include <vmnet/vmnet.h>
+diff --git a/net/vmnet-host.c b/net/vmnet-host.c
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/net/vmnet-host.c
+@@ -XXX,XX +XXX,XX @@
++/*
++ * vmnet-host.c
++ *
++ * Copyright(c) 2021 Vladislav Yaroshchuk <yaroshchuk2000@gmail.com>
++ *
++ * This work is licensed under the terms of the GNU GPL, version 2 or later.
++ * See the COPYING file in the top-level directory.
++ *
++ */
++
++#include "qemu/osdep.h"
++#include "qapi/qapi-types-net.h"
++#include "vmnet_int.h"
++#include "clients.h"
++#include "qemu/error-report.h"
++#include "qapi/error.h"
++
++#include <vmnet/vmnet.h>
++
++int net_init_vmnet_host(const Netdev *netdev, const char *name,
++                        NetClientState *peer, Error **errp) {
++  error_setg(errp, "vmnet-host is not implemented yet");
++  return -1;
++}
+diff --git a/net/vmnet-shared.c b/net/vmnet-shared.c
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/net/vmnet-shared.c
+@@ -XXX,XX +XXX,XX @@
++/*
++ * vmnet-shared.c
++ *
++ * Copyright(c) 2021 Vladislav Yaroshchuk <yaroshchuk2000@gmail.com>
++ *
++ * This work is licensed under the terms of the GNU GPL, version 2 or later.
++ * See the COPYING file in the top-level directory.
++ *
++ */
++
++#include "qemu/osdep.h"
++#include "qapi/qapi-types-net.h"
++#include "vmnet_int.h"
++#include "clients.h"
++#include "qemu/error-report.h"
++#include "qapi/error.h"
++
++#include <vmnet/vmnet.h>
++
++int net_init_vmnet_shared(const Netdev *netdev, const char *name,
++                          NetClientState *peer, Error **errp)
++{
++  error_setg(errp, "vmnet-shared is not implemented yet");
++  return -1;
++}
+diff --git a/net/vmnet_int.h b/net/vmnet_int.h
+new file mode 100644
+index XXXXXXX..XXXXXXX
+--- /dev/null
++++ b/net/vmnet_int.h
+@@ -XXX,XX +XXX,XX @@
++/*
++ * vmnet_int.h
++ *
++ * Copyright(c) 2021 Vladislav Yaroshchuk <yaroshchuk2000@gmail.com>
++ *
++ * This work is licensed under the terms of the GNU GPL, version 2 or later.
++ * See the COPYING file in the top-level directory.
++ *
++ */
++#ifndef VMNET_INT_H
++#define VMNET_INT_H
++
++#include "qemu/osdep.h"
++#include "vmnet_int.h"
++#include "clients.h"
++
++#include <vmnet/vmnet.h>
++
++typedef struct VmnetCommonState {
++  NetClientState nc;
++
++} VmnetCommonState;
++
++
++#endif /* VMNET_INT_H */
+diff --git a/qapi/net.json b/qapi/net.json
+index XXXXXXX..XXXXXXX 100644
+--- a/qapi/net.json
++++ b/qapi/net.json
+@@ -XXX,XX +XXX,XX @@
+     '*queues':       'int' } }
+ ##
++# @NetdevVmnetHostOptions:
++#
++# vmnet (host mode) network backend.
++#
++# Allows the vmnet interface to communicate with other vmnet
++# interfaces that are in host mode and also with the host.
++#
++# @start-address: The starting IPv4 address to use for the interface.
++#                 Must be in the private IP range (RFC 1918). Must be
++#                 specified along with @end-address and @subnet-mask.
++#                 This address is used as the gateway address. The
++#                 subsequent address up to and including end-address are
++#                 placed in the DHCP pool.
++#
++# @end-address: The DHCP IPv4 range end address to use for the
++#               interface. Must be in the private IP range (RFC 1918).
++#               Must be specified along with @start-address and
++#               @subnet-mask.
++#
++# @subnet-mask: The IPv4 subnet mask to use on the interface. Must
++#               be specified along with @start-address and @subnet-mask.
++#
++# @isolated: Enable isolation for this interface. Interface isolation
++#            ensures that vmnet interface is not able to communicate
++#            with any other vmnet interfaces. Only communication with
++#            host is allowed. Available since macOS Big Sur 11.0.
++#
++# @net-uuid: The identifier (UUID) to uniquely identify the isolated
++#            network vmnet interface should be added to. If
++#            set, no DHCP service is provided for this interface and
++#            network communication is allowed only with other interfaces
++#            added to this network identified by the UUID. Available
++#            since macOS Big Sur 11.0.
++#
++# Since: 7.0
++##
++{ 'struct': 'NetdevVmnetHostOptions',
++  'data': {
++    '*start-address': 'str',
++    '*end-address':   'str',
++    '*subnet-mask':   'str',
++    '*isolated':      'bool',
++    '*net-uuid':      'str' },
++  'if': 'CONFIG_VMNET' }
++
++##
++# @NetdevVmnetSharedOptions:
++#
++# vmnet (shared mode) network backend.
++#
++# Allows traffic originating from the vmnet interface to reach the
++# Internet through a network address translator (NAT).
++# The vmnet interface can communicate with the host and with
++# other shared mode interfaces on the same subnet. If no DHCP
++# settings, subnet mask and IPv6 prefix specified, the interface can
++# communicate with any of other interfaces in shared mode.
++#
++# @start-address: The starting IPv4 address to use for the interface.
++#                 Must be in the private IP range (RFC 1918). Must be
++#                 specified along with @end-address and @subnet-mask.
++#                 This address is used as the gateway address. The
++#                 subsequent address up to and including end-address are
++#                 placed in the DHCP pool.
++#
++# @end-address: The DHCP IPv4 range end address to use for the
++#               interface. Must be in the private IP range (RFC 1918).
++#               Must be specified along with @start-address and @subnet-mask.
++#
++# @subnet-mask: The IPv4 subnet mask to use on the interface. Must
++#                be specified along with @start-address and @subnet-mask.
++#
++# @isolated: Enable isolation for this interface. Interface isolation
++#            ensures that vmnet interface is not able to communicate
++#            with any other vmnet interfaces. Only communication with
++#            host is allowed. Available since macOS Big Sur 11.0.
++#
++# @nat66-prefix: The IPv6 prefix to use into guest network. Must be a
++#                unique local address i.e. start with fd00::/8 and have
++#                length of 64.
++#
++# Since: 7.0
++##
++{ 'struct': 'NetdevVmnetSharedOptions',
++  'data': {
++    '*start-address': 'str',
++    '*end-address':   'str',
++    '*subnet-mask':   'str',
++    '*isolated':      'bool',
++    '*nat66-prefix':  'str' },
++  'if': 'CONFIG_VMNET' }
++
++##
++# @NetdevVmnetBridgedOptions:
++#
++# vmnet (bridged mode) network backend.
++#
++# Bridges the vmnet interface with a physical network interface.
++#
++# @ifname: The name of the physical interface to be bridged.
++#
++# @isolated: Enable isolation for this interface. Interface isolation
++#            ensures that vmnet interface is not able to communicate
++#            with any other vmnet interfaces. Only communication with
++#            host is allowed. Available since macOS Big Sur 11.0.
++#
++# Since: 7.0
++##
++{ 'struct': 'NetdevVmnetBridgedOptions',
++  'data': {
++    'ifname':     'str',
++    '*isolated':  'bool' },
++  'if': 'CONFIG_VMNET' }
++
++##
+ # @NetClientDriver:
+ #
+ # Available netdev drivers.
+@@ -XXX,XX +XXX,XX @@
+ # Since: 2.7
+ #
+ #        @vhost-vdpa since 5.1
++#        @vmnet-host since 7.0
++#        @vmnet-shared since 7.0
++#        @vmnet-bridged since 7.0
+ ##
+ { 'enum': 'NetClientDriver',
+   'data': [ 'none', 'nic', 'user', 'tap', 'l2tpv3', 'socket', 'vde',
+-            'bridge', 'hubport', 'netmap', 'vhost-user', 'vhost-vdpa' ] }
++            'bridge', 'hubport', 'netmap', 'vhost-user', 'vhost-vdpa',
++            { 'name': 'vmnet-host', 'if': 'CONFIG_VMNET' },
++            { 'name': 'vmnet-shared', 'if': 'CONFIG_VMNET' },
++            { 'name': 'vmnet-bridged', 'if': 'CONFIG_VMNET' }] }
+ ##
+ # @Netdev:
+@@ -XXX,XX +XXX,XX @@
+ # Since: 1.2
+ #
+ #        'l2tpv3' - since 2.1
++#        'vmnet-host' - since 7.0
++#        'vmnet-shared' - since 7.0
++#        'vmnet-bridged' - since 7.0
+ ##
+ { 'union': 'Netdev',
+   'base': { 'id': 'str', 'type': 'NetClientDriver' },
+@@ -XXX,XX +XXX,XX @@
+     'hubport':  'NetdevHubPortOptions',
+     'netmap':   'NetdevNetmapOptions',
+     'vhost-user': 'NetdevVhostUserOptions',
+-    'vhost-vdpa': 'NetdevVhostVDPAOptions' } }
++    'vhost-vdpa': 'NetdevVhostVDPAOptions',
++    'vmnet-host': { 'type': 'NetdevVmnetHostOptions',
++                    'if': 'CONFIG_VMNET' },
++    'vmnet-shared': { 'type': 'NetdevVmnetSharedOptions',
++                      'if': 'CONFIG_VMNET' },
++    'vmnet-bridged': { 'type': 'NetdevVmnetBridgedOptions',
++                       'if': 'CONFIG_VMNET' } } }
+ ##
+ # @RxState:
+--
+.7.4

-New patch
+[PULL V3 09/13] net/vmnet: implement shared mode (vmnet-shared)
+From: Vladislav Yaroshchuk <yaroshchuk2000@gmail.com>
 Interaction with vmnet.framework in different modes
 differs only on configuration stage, so we can create
 common `send`, `receive`, etc. procedures and reuse them.
 vmnet.framework supports iov, but writing more than
 one iov into vmnet interface fails with
 'VMNET_INVALID_ARGUMENT'. Collecting provided iovs into
 one and passing it to vmnet works fine. That's the
 reason why receive_iov() left unimplemented. But it still
 works with good enough performance having .receive()
 implemented only.
 Also, there is no way to unsubscribe from vmnet packages
 receiving except registering and unregistering event
 callback or simply drop packages just ignoring and
 not processing them when related flag is set. Here we do
 using the second way.
 Signed-off-by: Phillip Tennen <phillip@axleos.com>
 Signed-off-by: Vladislav Yaroshchuk <yaroshchuk2000@gmail.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
  net/vmnet-common.m | 314 +++++++++++++++++++++++++++++++++++++++++++++++++++++
  net/vmnet-shared.c |  83 +++++++++++++-
  net/vmnet_int.h    |  23 ++++
 files changed, 416 insertions(+), 4 deletions(-)
 diff --git a/net/vmnet-common.m b/net/vmnet-common.m
 index XXXXXXX..XXXXXXX 100644
 --- a/net/vmnet-common.m
 +++ b/net/vmnet-common.m
@@ -XXX,XX +XXX,XX @@
   */
  #include "qemu/osdep.h"
 +#include "qemu/main-loop.h"
 +#include "qemu/log.h"
  #include "qapi/qapi-types-net.h"
  #include "vmnet_int.h"
  #include "clients.h"
@@ -XXX,XX +XXX,XX @@
  #include "qapi/error.h"
  #include <vmnet/vmnet.h>
 +#include <dispatch/dispatch.h>
 +
 +#ifdef DEBUG
 +#define D(x) x
 +#define D_LOG(...) qemu_log(__VA_ARGS__)
 +#else
 +#define D(x) do { } while (0)
 +#define D_LOG(...) do { } while (0)
 +#endif
 +
 +typedef struct vmpktdesc vmpktdesc_t;
 +typedef struct iovec iovec_t;
 +
 +static void vmnet_set_send_enabled(VmnetCommonState *s, bool enable)
 +{
 +    s->send_enabled = enable;
 +}
 +
 +
 +static void vmnet_send_completed(NetClientState *nc, ssize_t len)
 +{
 +    VmnetCommonState *s = DO_UPCAST(VmnetCommonState, nc, nc);
 +    vmnet_set_send_enabled(s, true);
 +}
 +
 +
 +static void vmnet_send(NetClientState *nc,
 +                       interface_event_t event_id,
 +                       xpc_object_t event)
 +{
 +    assert(event_id == VMNET_INTERFACE_PACKETS_AVAILABLE);
 +
 +    VmnetCommonState *s;
 +    uint64_t packets_available;
 +
 +    struct iovec *iov;
 +    struct vmpktdesc *packets;
 +    int pkt_cnt;
 +    int i;
 +
 +    vmnet_return_t if_status;
 +    ssize_t size;
 +
 +    s = DO_UPCAST(VmnetCommonState, nc, nc);
 +
 +    packets_available = xpc_dictionary_get_uint64(
 +        event,
 +        vmnet_estimated_packets_available_key
 +    );
 +
 +    pkt_cnt = (packets_available < VMNET_PACKETS_LIMIT) ?
 +              packets_available :
 +              VMNET_PACKETS_LIMIT;
 +
 +
 +    iov = s->iov_buf;
 +    packets = s->packets_buf;
 +
 +    for (i = 0; i < pkt_cnt; ++i) {
 +        packets[i].vm_pkt_size = s->max_packet_size;
 +        packets[i].vm_pkt_iovcnt = 1;
 +        packets[i].vm_flags = 0;
 +    }
 +
 +    if_status = vmnet_read(s->vmnet_if, packets, &pkt_cnt);
 +    if (if_status != VMNET_SUCCESS) {
 +        error_printf("vmnet: read failed: %s\n",
 +                     vmnet_status_map_str(if_status));
 +    }
 +    qemu_mutex_lock_iothread();
 +    for (i = 0; i < pkt_cnt; ++i) {
 +        size = qemu_send_packet_async(nc,
 +                                      iov[i].iov_base,
 +                                      packets[i].vm_pkt_size,
 +                                      vmnet_send_completed);
 +        if (size == 0) {
 +            vmnet_set_send_enabled(s, false);
 +        } else if (size < 0) {
 +            break;
 +        }
 +    }
 +    qemu_mutex_unlock_iothread();
 +
 +}
 +
 +
 +static void vmnet_register_event_callback(VmnetCommonState *s)
 +{
 +    dispatch_queue_t avail_pkt_q = dispatch_queue_create(
 +        "org.qemu.vmnet.if_queue",
 +        DISPATCH_QUEUE_SERIAL
 +    );
 +
 +    vmnet_interface_set_event_callback(
 +        s->vmnet_if,
 +        VMNET_INTERFACE_PACKETS_AVAILABLE,
 +        avail_pkt_q,
 +        ^(interface_event_t event_id, xpc_object_t event) {
 +          if (s->send_enabled) {
 +              vmnet_send(&s->nc, event_id, event);
 +          }
 +        });
 +}
 +
 +
 +static void vmnet_bufs_init(VmnetCommonState *s)
 +{
 +    int i;
 +    struct vmpktdesc *packets;
 +    struct iovec *iov;
 +
 +    packets = s->packets_buf;
 +    iov = s->iov_buf;
 +
 +    for (i = 0; i < VMNET_PACKETS_LIMIT; ++i) {
 +        iov[i].iov_len = s->max_packet_size;
 +        iov[i].iov_base = g_malloc0(iov[i].iov_len);
 +        packets[i].vm_pkt_iov = iov + i;
 +    }
 +}
 +
 +
 +const char *vmnet_status_map_str(vmnet_return_t status)
 +{
 +    switch (status) {
 +    case VMNET_SUCCESS:
 +        return "success";
 +    case VMNET_FAILURE:
 +        return "general failure";
 +    case VMNET_MEM_FAILURE:
 +        return "memory allocation failure";
 +    case VMNET_INVALID_ARGUMENT:
 +        return "invalid argument specified";
 +    case VMNET_SETUP_INCOMPLETE:
 +        return "interface setup is not complete";
 +    case VMNET_INVALID_ACCESS:
 +        return "invalid access, permission denied";
 +    case VMNET_PACKET_TOO_BIG:
 +        return "packet size is larger than MTU";
 +    case VMNET_BUFFER_EXHAUSTED:
 +        return "buffers exhausted in kernel";
 +    case VMNET_TOO_MANY_PACKETS:
 +        return "packet count exceeds limit";
 +#if defined(MAC_OS_VERSION_11_0) && \
 +    MAC_OS_X_VERSION_MIN_REQUIRED >= MAC_OS_VERSION_11_0
 +    case VMNET_SHARING_SERVICE_BUSY:
 +        return "conflict, sharing service is in use";
 +#endif
 +    default:
 +        return "unknown vmnet error";
 +    }
 +}
 +
 +
 +int vmnet_if_create(NetClientState *nc,
 +                    xpc_object_t if_desc,
 +                    Error **errp,
 +                    void (*completion_callback)(xpc_object_t interface_param))
 +{
 +    VmnetCommonState *s;
 +
 +    dispatch_queue_t if_create_q;
 +    dispatch_semaphore_t if_created_sem;
 +
 +    __block vmnet_return_t if_status;
 +
 +    if_create_q = dispatch_queue_create("org.qemu.vmnet.create",
 +                                        DISPATCH_QUEUE_SERIAL);
 +    if_created_sem = dispatch_semaphore_create(0);
 +
 +    xpc_dictionary_set_bool(
 +        if_desc,
 +        vmnet_allocate_mac_address_key,
 +        false
 +    );
 +
 +    D(D_LOG("vmnet.start.interface_desc:\n");
 +    xpc_dictionary_apply(if_desc,
 +                         ^bool(const char *k, xpc_object_t v) {
 +                           char *desc = xpc_copy_description(v);
 +                           D_LOG("  %s=%s\n", k, desc);
 +                           free(desc);
 +                           return true;
 +                         }));
 +
 +    s = DO_UPCAST(VmnetCommonState, nc, nc);
 +    s->vmnet_if = vmnet_start_interface(
 +        if_desc,
 +        if_create_q,
 +        ^(vmnet_return_t status, xpc_object_t interface_param) {
 +          if_status = status;
 +          if (status != VMNET_SUCCESS || !interface_param) {
 +              dispatch_semaphore_signal(if_created_sem);
 +              return;
 +          }
 +
 +          D(D_LOG("vmnet.start.interface_param:\n");
 +                xpc_dictionary_apply(interface_param,
 +                                     ^bool(const char *k, xpc_object_t v) {
 +                                       char *desc = xpc_copy_description(v);
 +                                       D_LOG("  %s=%s\n", k, desc);
 +                                       free(desc);
 +                                       return true;
 +                                     }));
 +
 +          s->mtu = xpc_dictionary_get_uint64(
 +              interface_param,
 +              vmnet_mtu_key);
 +          s->max_packet_size = xpc_dictionary_get_uint64(
 +              interface_param,
 +              vmnet_max_packet_size_key);
 +
 +          if (completion_callback) {
 +              completion_callback(interface_param);
 +          }
 +          dispatch_semaphore_signal(if_created_sem);
 +        });
 +
 +    if (s->vmnet_if == NULL) {
 +        error_setg(errp, "unable to create interface with requested params");
 +        return -1;
 +    }
 +
 +    dispatch_semaphore_wait(if_created_sem, DISPATCH_TIME_FOREVER);
 +    dispatch_release(if_create_q);
 +
 +    if (if_status != VMNET_SUCCESS) {
 +        error_setg(errp,
 +                   "cannot create vmnet interface: %s",
 +                   vmnet_status_map_str(if_status));
 +        return -1;
 +    }
 +
 +    vmnet_register_event_callback(s);
 +    vmnet_bufs_init(s);
 +    vmnet_set_send_enabled(s, true);
 +
 +    return 0;
 +}
 +
 +
 +ssize_t vmnet_receive_common(NetClientState *nc,
 +                             const uint8_t *buf,
 +                             size_t size)
 +{
 +    VmnetCommonState *s;
 +    vmpktdesc_t packet;
 +    iovec_t iov;
 +    int pkt_cnt;
 +    vmnet_return_t if_status;
 +
 +    s = DO_UPCAST(VmnetCommonState, nc, nc);
 +
 +    if (size > s->max_packet_size) {
 +        warn_report("vmnet: packet is too big, %zu > %llu\n",
 +                    packet.vm_pkt_size,
 +                    s->max_packet_size);
 +        return -1;
 +    }
 +
 +    iov.iov_base = (char *) buf;
 +    iov.iov_len = size;
 +
 +    packet.vm_pkt_iovcnt = 1;
 +    packet.vm_flags = 0;
 +    packet.vm_pkt_size = size;
 +    packet.vm_pkt_iov = &iov;
 +
 +    pkt_cnt = 1;
 +    if_status = vmnet_write(s->vmnet_if, &packet, &pkt_cnt);
 +
 +    if (if_status != VMNET_SUCCESS) {
 +        error_report("vmnet: write error: %s\n",
 +                     vmnet_status_map_str(if_status));
 +    }
 +
 +    if (if_status == VMNET_SUCCESS && pkt_cnt) {
 +        return size;
 +    }
 +    return 0;
 +}
 +
 +
 +void vmnet_cleanup_common(NetClientState *nc)
 +{
 +    VmnetCommonState *s;
 +    dispatch_queue_t if_destroy_q;
 +
 +    s = DO_UPCAST(VmnetCommonState, nc, nc);
 +
 +    qemu_purge_queued_packets(nc);
 +    vmnet_set_send_enabled(s, false);
 +
 +    if (s->vmnet_if == NULL) {
 +        return;
 +    }
 +
 +    if_destroy_q = dispatch_queue_create(
 +        "org.qemu.vmnet.destroy",
 +        DISPATCH_QUEUE_SERIAL
 +    );
 +
 +    vmnet_stop_interface(
 +        s->vmnet_if,
 +        if_destroy_q,
 +        ^(vmnet_return_t status) {
 +        });
 +
 +    for (int i = 0; i < VMNET_PACKETS_LIMIT; ++i) {
 +        g_free(s->iov_buf[i].iov_base);
 +    }
 +}
 diff --git a/net/vmnet-shared.c b/net/vmnet-shared.c
 index XXXXXXX..XXXXXXX 100644
 --- a/net/vmnet-shared.c
 +++ b/net/vmnet-shared.c
@@ -XXX,XX +XXX,XX @@
  #include "qemu/osdep.h"
  #include "qapi/qapi-types-net.h"
 +#include "qapi/error.h"
  #include "vmnet_int.h"
  #include "clients.h"
 -#include "qemu/error-report.h"
 -#include "qapi/error.h"
  #include <vmnet/vmnet.h>
 +typedef struct VmnetSharedState {
 +  VmnetCommonState cs;
 +} VmnetSharedState;
 +
 +
 +static xpc_object_t create_if_desc(const Netdev *netdev, Error **errp)
 +{
 +    const NetdevVmnetSharedOptions *options = &(netdev->u.vmnet_shared);
 +    xpc_object_t if_desc = xpc_dictionary_create(NULL, NULL, 0);
 +
 +    xpc_dictionary_set_uint64(
 +        if_desc,
 +        vmnet_operation_mode_key,
 +        VMNET_SHARED_MODE
 +    );
 +
 +#if defined(MAC_OS_VERSION_11_0) && \
 +    MAC_OS_X_VERSION_MIN_REQUIRED >= MAC_OS_VERSION_11_0
 +    xpc_dictionary_set_bool(
 +        if_desc,
 +        vmnet_enable_isolation_key,
 +        options->isolated
 +    );
 +#else
 +    if (options->has_isolated) {
 +        error_setg(errp,
 +                   "vmnet-shared.isolated feature is "
 +                   "unavailable: outdated vmnet.framework API");
 +    }
 +#endif
 +
 +    if (options->has_nat66_prefix) {
 +        xpc_dictionary_set_string(if_desc,
 +                                  vmnet_nat66_prefix_key,
 +                                  options->nat66_prefix);
 +    }
 +
 +    if (options->has_start_address ||
 +        options->has_end_address ||
 +        options->has_subnet_mask) {
 +
 +        if (options->has_start_address &&
 +            options->has_end_address &&
 +            options->has_subnet_mask) {
 +
 +            xpc_dictionary_set_string(if_desc,
 +                                      vmnet_start_address_key,
 +                                      options->start_address);
 +            xpc_dictionary_set_string(if_desc,
 +                                      vmnet_end_address_key,
 +                                      options->end_address);
 +            xpc_dictionary_set_string(if_desc,
 +                                      vmnet_subnet_mask_key,
 +                                      options->subnet_mask);
 +        } else {
 +            error_setg(
 +                errp,
 +                "'start-address', 'end-address', 'subnet-mask' "
 +                "should be provided together"
 +            );
 +        }
 +    }
 +
 +    return if_desc;
 +}
 +
 +static NetClientInfo net_vmnet_shared_info = {
 +    .type = NET_CLIENT_DRIVER_VMNET_SHARED,
 +    .size = sizeof(VmnetSharedState),
 +    .receive = vmnet_receive_common,
 +    .cleanup = vmnet_cleanup_common,
 +};
 +
  int net_init_vmnet_shared(const Netdev *netdev, const char *name,
                            NetClientState *peer, Error **errp)
  {
 -  error_setg(errp, "vmnet-shared is not implemented yet");
 -  return -1;
 +    NetClientState *nc = qemu_new_net_client(&net_vmnet_shared_info,
 +                                             peer, "vmnet-shared", name);
 +    xpc_object_t if_desc = create_if_desc(netdev, errp);
 +
 +    return vmnet_if_create(nc, if_desc, errp, NULL);
  }
 diff --git a/net/vmnet_int.h b/net/vmnet_int.h
 index XXXXXXX..XXXXXXX 100644
 --- a/net/vmnet_int.h
 +++ b/net/vmnet_int.h
@@ -XXX,XX +XXX,XX @@
  #include <vmnet/vmnet.h>
 +#define VMNET_PACKETS_LIMIT 50
 +
  typedef struct VmnetCommonState {
    NetClientState nc;
 +  interface_ref vmnet_if;
 +
 +  bool send_enabled;
 +
 +  uint64_t mtu;
 +  uint64_t max_packet_size;
 +
 +  struct vmpktdesc packets_buf[VMNET_PACKETS_LIMIT];
 +  struct iovec iov_buf[VMNET_PACKETS_LIMIT];
  } VmnetCommonState;
 +const char *vmnet_status_map_str(vmnet_return_t status);
 +
 +int vmnet_if_create(NetClientState *nc,
 +                    xpc_object_t if_desc,
 +                    Error **errp,
 +                    void (*completion_callback)(xpc_object_t interface_param));
 +
 +ssize_t vmnet_receive_common(NetClientState *nc,
 +                             const uint8_t *buf,
 +                             size_t size);
 +
 +void vmnet_cleanup_common(NetClientState *nc);
  #endif /* VMNET_INT_H */
 --
 .7.4

-New patch
+[PULL V3 10/13] net/vmnet: implement host mode (vmnet-host)
+From: Vladislav Yaroshchuk <yaroshchuk2000@gmail.com>
+Signed-off-by: Vladislav Yaroshchuk <yaroshchuk2000@gmail.com>
+Signed-off-by: Jason Wang <jasowang@redhat.com>
+---
+ net/vmnet-host.c | 110 ++++++++++++++++++++++++++++++++++++++++++++++++++++---
+file changed, 104 insertions(+), 6 deletions(-)
+diff --git a/net/vmnet-host.c b/net/vmnet-host.c
+index XXXXXXX..XXXXXXX 100644
+--- a/net/vmnet-host.c
++++ b/net/vmnet-host.c
+@@ -XXX,XX +XXX,XX @@
+  */
+ #include "qemu/osdep.h"
++#include "qemu/uuid.h"
+ #include "qapi/qapi-types-net.h"
+-#include "vmnet_int.h"
+-#include "clients.h"
+-#include "qemu/error-report.h"
+ #include "qapi/error.h"
++#include "clients.h"
++#include "vmnet_int.h"
+ #include <vmnet/vmnet.h>
++typedef struct VmnetHostState {
++  VmnetCommonState cs;
++  QemuUUID network_uuid;
++} VmnetHostState;
++
++static xpc_object_t create_if_desc(const Netdev *netdev,
++                                   NetClientState *nc,
++                                   Error **errp)
++{
++    const NetdevVmnetHostOptions *options = &(netdev->u.vmnet_host);
++
++    xpc_object_t if_desc = xpc_dictionary_create(NULL, NULL, 0);
++
++    xpc_dictionary_set_uint64(
++        if_desc,
++        vmnet_operation_mode_key,
++        VMNET_HOST_MODE
++    );
++
++#if defined(MAC_OS_VERSION_11_0) && \
++    MAC_OS_X_VERSION_MIN_REQUIRED >= MAC_OS_VERSION_11_0
++
++    VmnetCommonState *cs = DO_UPCAST(VmnetCommonState, nc, nc);
++    VmnetHostState *hs = DO_UPCAST(VmnetHostState, cs, cs);
++
++    xpc_dictionary_set_bool(
++        if_desc,
++        vmnet_enable_isolation_key,
++        options->isolated
++    );
++
++    if (options->has_net_uuid) {
++        if (qemu_uuid_parse(options->net_uuid, &hs->network_uuid) < 0) {
++            error_setg(errp, "Invalid UUID provided in 'net-uuid'");
++        }
++
++        xpc_dictionary_set_uuid(
++            if_desc,
++            vmnet_network_identifier_key,
++            hs->network_uuid.data
++        );
++    }
++#else
++    if (options->has_isolated) {
++        error_setg(errp,
++                   "vmnet-host.isolated feature is "
++                   "unavailable: outdated vmnet.framework API");
++    }
++
++    if (options->has_net_uuid) {
++        error_setg(errp,
++                   "vmnet-host.net-uuid feature is "
++                   "unavailable: outdated vmnet.framework API");
++    }
++#endif
++
++    if (options->has_start_address ||
++        options->has_end_address ||
++        options->has_subnet_mask) {
++
++        if (options->has_start_address &&
++            options->has_end_address &&
++            options->has_subnet_mask) {
++
++            xpc_dictionary_set_string(if_desc,
++                                      vmnet_start_address_key,
++                                      options->start_address);
++            xpc_dictionary_set_string(if_desc,
++                                      vmnet_end_address_key,
++                                      options->end_address);
++            xpc_dictionary_set_string(if_desc,
++                                      vmnet_subnet_mask_key,
++                                      options->subnet_mask);
++        } else {
++            error_setg(
++                errp,
++                "'start-address', 'end-address', 'subnet-mask' "
++                "should be provided together"
++            );
++        }
++    }
++
++    return if_desc;
++}
++
++static NetClientInfo net_vmnet_host_info = {
++    .type = NET_CLIENT_DRIVER_VMNET_HOST,
++    .size = sizeof(VmnetHostState),
++    .receive = vmnet_receive_common,
++    .cleanup = vmnet_cleanup_common,
++};
++
+ int net_init_vmnet_host(const Netdev *netdev, const char *name,
+-                        NetClientState *peer, Error **errp) {
+-  error_setg(errp, "vmnet-host is not implemented yet");
+-  return -1;
++                        NetClientState *peer, Error **errp)
++{
++    NetClientState *nc;
++    xpc_object_t if_desc;
++
++    nc = qemu_new_net_client(&net_vmnet_host_info,
++                             peer, "vmnet-host", name);
++    if_desc = create_if_desc(netdev, nc, errp);
++    return vmnet_if_create(nc, if_desc, errp, NULL);
+ }
+--
+.7.4

-[PULL 6/6] virtio-net: Copy received header to buffer
+[PULL V3 11/13] net/vmnet: implement bridged mode (vmnet-bridged)
-From: Akihiko Odaki <akihiko.odaki@daynix.com>
+From: Vladislav Yaroshchuk <yaroshchuk2000@gmail.com>
-receive_header() used to cast the const qualifier of the pointer to the
+Signed-off-by: Vladislav Yaroshchuk <yaroshchuk2000@gmail.com>
 received packet away to modify the header. Avoid this by copying the
 received header to buffer.
 Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- hw/net/virtio-net.c | 85 ++++++++++++++++++++++++---------------------
+ net/vmnet-bridged.m | 105 +++++++++++++++++++++++++++++++++++++++++++++++++---
-file changed, 46 insertions(+), 39 deletions(-)
+file changed, 100 insertions(+), 5 deletions(-)
-diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
+diff --git a/net/vmnet-bridged.m b/net/vmnet-bridged.m
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/virtio-net.c
+--- a/net/vmnet-bridged.m
-+++ b/hw/net/virtio-net.c
++++ b/net/vmnet-bridged.m
-@@ -XXX,XX +XXX,XX @@ static void virtio_net_hdr_swap(VirtIODevice *vdev, struct virtio_net_hdr *hdr)
+@@ -XXX,XX +XXX,XX @@
-  * cache.
-  */
+ #include "qemu/osdep.h"
- static void work_around_broken_dhclient(struct virtio_net_hdr *hdr,
+ #include "qapi/qapi-types-net.h"
--                                        uint8_t *buf, size_t size)
+-#include "vmnet_int.h"
-+                                        size_t *hdr_len, const uint8_t *buf,
+-#include "clients.h"
-+                                        size_t buf_size, size_t *buf_offset)
+-#include "qemu/error-report.h"
  #include "qapi/error.h"
 +#include "clients.h"
 +#include "vmnet_int.h"
  #include <vmnet/vmnet.h>
 +typedef struct VmnetBridgedState {
 +  VmnetCommonState cs;
 +} VmnetBridgedState;
 +
 +static bool validate_ifname(const char *ifname)
 +{
 +    xpc_object_t shared_if_list = vmnet_copy_shared_interface_list();
 +    __block bool match = false;
 +
 +    xpc_array_apply(
 +        shared_if_list,
 +        ^bool(size_t index, xpc_object_t value) {
 +          if (strcmp(xpc_string_get_string_ptr(value), ifname) == 0) {
 +              match = true;
 +              return false;
 +          }
 +          return true;
 +        });
 +
 +    return match;
 +}
 +
 +static const char *get_valid_ifnames(void)
 +{
 +    xpc_object_t shared_if_list = vmnet_copy_shared_interface_list();
 +    __block char *if_list = NULL;
 +
 +    xpc_array_apply(
 +        shared_if_list,
 +        ^bool(size_t index, xpc_object_t value) {
 +          if_list = g_strconcat(xpc_string_get_string_ptr(value),
 +                                " ",
 +                                if_list,
 +                                NULL);
 +          return true;
 +        });
 +
 +    if (if_list) {
 +        return if_list;
 +    }
 +    return "[no interfaces]";
 +}
 +
 +static xpc_object_t create_if_desc(const Netdev *netdev, Error **errp)
 +{
 +    const NetdevVmnetBridgedOptions *options = &(netdev->u.vmnet_bridged);
 +    xpc_object_t if_desc = xpc_dictionary_create(NULL, NULL, 0);
 +
 +    xpc_dictionary_set_uint64(
 +        if_desc,
 +        vmnet_operation_mode_key,
 +        VMNET_BRIDGED_MODE
 +    );
 +
 +#if defined(MAC_OS_VERSION_11_0) && \
 +    MAC_OS_X_VERSION_MIN_REQUIRED >= MAC_OS_VERSION_11_0
 +    xpc_dictionary_set_bool(
 +        if_desc,
 +        vmnet_enable_isolation_key,
 +        options->isolated
 +    );
 +#else
 +    if (options->has_isolated) {
 +        error_setg(errp,
 +                   "vmnet-bridged.isolated feature is "
 +                   "unavailable: outdated vmnet.framework API");
 +    }
 +#endif
 +
 +    if (validate_ifname(options->ifname)) {
 +        xpc_dictionary_set_string(if_desc,
 +                                  vmnet_shared_interface_name_key,
 +                                  options->ifname);
 +    } else {
 +        return NULL;
 +    }
 +    return if_desc;
 +}
 +
 +static NetClientInfo net_vmnet_bridged_info = {
 +    .type = NET_CLIENT_DRIVER_VMNET_BRIDGED,
 +    .size = sizeof(VmnetBridgedState),
 +    .receive = vmnet_receive_common,
 +    .cleanup = vmnet_cleanup_common,
 +};
 +
  int net_init_vmnet_bridged(const Netdev *netdev, const char *name,
                             NetClientState *peer, Error **errp)
  {
-     size_t csum_size = ETH_HLEN + sizeof(struct ip_header) +
+-  error_setg(errp, "vmnet-bridged is not implemented yet");
-                        sizeof(struct udp_header);
+-  return -1;
++    NetClientState *nc = qemu_new_net_client(&net_vmnet_bridged_info,
-+    buf += *buf_offset;
++                                             peer, "vmnet-bridged", name);
-+    buf_size -= *buf_offset;
++    xpc_object_t if_desc = create_if_desc(netdev, errp);;
 +
-     if ((hdr->flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) && /* missing csum */
++    if (!if_desc) {
--        (size >= csum_size && size < 1500) && /* normal sized MTU */
++        error_setg(errp,
-+        (buf_size >= csum_size && buf_size < 1500) && /* normal sized MTU */
++                   "unsupported ifname, should be one of: %s",
-         (buf[12] == 0x08 && buf[13] == 0x00) && /* ethertype == IPv4 */
++                   get_valid_ifnames());
-         (buf[23] == 17) && /* ip.protocol == UDP */
++        return -1;
-         (buf[34] == 0 && buf[35] == 67)) { /* udp.srcport == bootps */
++    }
--        net_checksum_calculate(buf, size, CSUM_UDP);
++
-+        memcpy((uint8_t *)hdr + *hdr_len, buf, csum_size);
++    return vmnet_if_create(nc, if_desc, errp, NULL);
 +        net_checksum_calculate((uint8_t *)hdr + *hdr_len, csum_size, CSUM_UDP);
          hdr->flags &= ~VIRTIO_NET_HDR_F_NEEDS_CSUM;
 +        *hdr_len += csum_size;
 +        *buf_offset += csum_size;
      }
  }
--static void receive_header(VirtIONet *n, const struct iovec *iov, int iov_cnt,
--                           const void *buf, size_t size)
-+static size_t receive_header(VirtIONet *n, struct virtio_net_hdr *hdr,
-+                             const void *buf, size_t buf_size,
-+                             size_t *buf_offset)
- {
--    if (n->has_vnet_hdr) {
--        /* FIXME this cast is evil */
--        void *wbuf = (void *)buf;
--        work_around_broken_dhclient(wbuf, wbuf + n->host_hdr_len,
--                                    size - n->host_hdr_len);
-+    size_t hdr_len = n->guest_hdr_len;
--        if (n->needs_vnet_hdr_swap) {
--            virtio_net_hdr_swap(VIRTIO_DEVICE(n), wbuf);
--        }
--        iov_from_buf(iov, iov_cnt, 0, buf, sizeof(struct virtio_net_hdr));
--    } else {
--        struct virtio_net_hdr hdr = {
--            .flags = 0,
--            .gso_type = VIRTIO_NET_HDR_GSO_NONE
--        };
--        iov_from_buf(iov, iov_cnt, 0, &hdr, sizeof hdr);
-+    memcpy(hdr, buf, sizeof(struct virtio_net_hdr));
-+
-+    *buf_offset = n->host_hdr_len;
-+    work_around_broken_dhclient(hdr, &hdr_len, buf, buf_size, buf_offset);
-+
-+    if (n->needs_vnet_hdr_swap) {
-+        virtio_net_hdr_swap(VIRTIO_DEVICE(n), hdr);
-     }
-+
-+    return hdr_len;
- }
- static int receive_filter(VirtIONet *n, const uint8_t *buf, int size)
-@@ -XXX,XX +XXX,XX @@ static int virtio_net_process_rss(NetClientState *nc, const uint8_t *buf,
-     return (index == new_index) ? -1 : new_index;
- }
-+typedef struct Header {
-+    struct virtio_net_hdr_v1_hash virtio_net;
-+    struct eth_header eth;
-+    struct ip_header ip;
-+    struct udp_header udp;
-+} Header;
-+
- static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
-                                       size_t size)
- {
-@@ -XXX,XX +XXX,XX @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
-     VirtQueueElement *elems[VIRTQUEUE_MAX_SIZE];
-     size_t lens[VIRTQUEUE_MAX_SIZE];
-     struct iovec mhdr_sg[VIRTQUEUE_MAX_SIZE];
--    struct virtio_net_hdr_v1_hash extra_hdr;
-+    Header hdr;
-     unsigned mhdr_cnt = 0;
-     size_t offset, i, guest_offset, j;
-     ssize_t err;
--    memset(&extra_hdr, 0, sizeof(extra_hdr));
-+    memset(&hdr.virtio_net, 0, sizeof(hdr.virtio_net));
-     if (n->rss_data.enabled && n->rss_data.enabled_software_rss) {
--        int index = virtio_net_process_rss(nc, buf, size, &extra_hdr);
-+        int index = virtio_net_process_rss(nc, buf, size, &hdr.virtio_net);
-         if (index >= 0) {
-             nc = qemu_get_subqueue(n->nic, index % n->curr_queue_pairs);
-         }
-@@ -XXX,XX +XXX,XX @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
-             if (n->mergeable_rx_bufs) {
-                 mhdr_cnt = iov_copy(mhdr_sg, ARRAY_SIZE(mhdr_sg),
-                                     sg, elem->in_num,
--                                    offsetof(typeof(extra_hdr), hdr.num_buffers),
--                                    sizeof(extra_hdr.hdr.num_buffers));
-+                                    offsetof(typeof(hdr),
-+                                             virtio_net.hdr.num_buffers),
-+                                    sizeof(hdr.virtio_net.hdr.num_buffers));
-             }
--            receive_header(n, sg, elem->in_num, buf, size);
--            if (n->rss_data.populate_hash) {
--                offset = offsetof(typeof(extra_hdr), hash_value);
--                iov_from_buf(sg, elem->in_num, offset,
--                             (char *)&extra_hdr + offset,
--                             sizeof(extra_hdr.hash_value) +
--                             sizeof(extra_hdr.hash_report));
--            }
--            offset = n->host_hdr_len;
--            total += n->guest_hdr_len;
--            guest_offset = n->guest_hdr_len;
-+            guest_offset = n->has_vnet_hdr ?
-+                           receive_header(n, (struct virtio_net_hdr *)&hdr,
-+                                          buf, size, &offset) :
-+                           n->guest_hdr_len;
-+
-+            iov_from_buf(sg, elem->in_num, 0, &hdr, guest_offset);
-+            total += guest_offset;
-         } else {
-             guest_offset = 0;
-         }
-@@ -XXX,XX +XXX,XX @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
-     }
-     if (mhdr_cnt) {
--        virtio_stw_p(vdev, &extra_hdr.hdr.num_buffers, i);
-+        virtio_stw_p(vdev, &hdr.virtio_net.hdr.num_buffers, i);
-         iov_from_buf(mhdr_sg, mhdr_cnt,
-,
--                     &extra_hdr.hdr.num_buffers,
--                     sizeof extra_hdr.hdr.num_buffers);
-+                     &hdr.virtio_net.hdr.num_buffers,
-+                     sizeof hdr.virtio_net.hdr.num_buffers);
-     }
-     for (j = 0; j < i; j++) {
 --
-.42.0
+.7.4

-[PULL 5/6] virtio-net: Initialize hash reporting values
+[PULL V3 12/13] net/vmnet: update qemu-options.hx
-From: Akihiko Odaki <akihiko.odaki@daynix.com>
+From: Vladislav Yaroshchuk <yaroshchuk2000@gmail.com>
-The specification says hash_report should be set to
+Signed-off-by: Vladislav Yaroshchuk <yaroshchuk2000@gmail.com>
 VIRTIO_NET_HASH_REPORT_NONE if VIRTIO_NET_F_HASH_REPORT is negotiated
 but not configured with VIRTIO_NET_CTRL_MQ_RSS_CONFIG. However,
 virtio_net_receive_rcu() instead wrote out the content of the extra_hdr
 variable, which is not uninitialized in such a case.
 Fix this by zeroing the extra_hdr.
 Fixes: e22f0603fb2f ("virtio-net: reference implementation of hash report")
 Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
 Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- hw/net/virtio-net.c | 2 ++
+ qemu-options.hx | 25 +++++++++++++++++++++++++
-file changed, 2 insertions(+)
+file changed, 25 insertions(+)
-diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
+diff --git a/qemu-options.hx b/qemu-options.hx
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/virtio-net.c
+--- a/qemu-options.hx
-+++ b/hw/net/virtio-net.c
++++ b/qemu-options.hx
-@@ -XXX,XX +XXX,XX @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
+@@ -XXX,XX +XXX,XX @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev,
-     size_t offset, i, guest_offset, j;
+     "-netdev vhost-vdpa,id=str,vhostdev=/path/to/dev\n"
-     ssize_t err;
+     "                configure a vhost-vdpa network,Establish a vhost-vdpa netdev\n"
+ #endif
-+    memset(&extra_hdr, 0, sizeof(extra_hdr));
++#ifdef CONFIG_VMNET
-+
++    "-netdev vmnet-host,id=str[,isolated=on|off][,net-uuid=uuid]\n"
-     if (n->rss_data.enabled && n->rss_data.enabled_software_rss) {
++    "         [,start-address=addr,end-address=addr,subnet-mask=mask]\n"
-         int index = virtio_net_process_rss(nc, buf, size, &extra_hdr);
++    "                configure a vmnet network backend in host mode with ID 'str',\n"
-         if (index >= 0) {
++    "                isolate this interface from others with 'isolated',\n"
 +    "                configure the address range and choose a subnet mask,\n"
 +    "                specify network UUID 'uuid' to disable DHCP and interact with\n"
 +    "                vmnet-host interfaces within this isolated network\n"
 +    "-netdev vmnet-shared,id=str[,isolated=on|off][,nat66-prefix=addr]\n"
 +    "         [,start-address=addr,end-address=addr,subnet-mask=mask]\n"
 +    "                configure a vmnet network backend in shared mode with ID 'str',\n"
 +    "                configure the address range and choose a subnet mask,\n"
 +    "                set IPv6 ULA prefix (of length 64) to use for internal network,\n"
 +    "                isolate this interface from others with 'isolated'\n"
 +    "-netdev vmnet-bridged,id=str,ifname=name[,isolated=on|off]\n"
 +    "                configure a vmnet network backend in bridged mode with ID 'str',\n"
 +    "                use 'ifname=name' to select a physical network interface to be bridged,\n"
 +    "                isolate this interface from others with 'isolated'\n"
 +#endif
      "-netdev hubport,id=str,hubid=n[,netdev=nd]\n"
      "                configure a hub port on the hub with ID 'n'\n", QEMU_ARCH_ALL)
  DEF("nic", HAS_ARG, QEMU_OPTION_nic,
@@ -XXX,XX +XXX,XX @@ DEF("nic", HAS_ARG, QEMU_OPTION_nic,
  #ifdef CONFIG_POSIX
      "vhost-user|"
  #endif
 +#ifdef CONFIG_VMNET
 +    "vmnet-host|vmnet-shared|vmnet-bridged|"
 +#endif
      "socket][,option][,...][mac=macaddr]\n"
      "                initialize an on-board / default host NIC (using MAC address\n"
      "                macaddr) and connect it to the given host network backend\n"
@@ -XXX,XX +XXX,XX @@ DEF("net", HAS_ARG, QEMU_OPTION_net,
  #ifdef CONFIG_NETMAP
      "netmap|"
  #endif
 +#ifdef CONFIG_VMNET
 +    "vmnet-host|vmnet-shared|vmnet-bridged|"
 +#endif
      "socket][,option][,option][,...]\n"
      "                old way to initialize a host network interface\n"
      "                (use the -netdev option if possible instead)\n", QEMU_ARCH_ALL)
 --
-.42.0
+.7.4

-[PULL 2/6] virtio-net: Fix size check in dhclient workaround
+[PULL V3 13/13] net/vmnet: update MAINTAINERS list
-From: Akihiko Odaki <akihiko.odaki@daynix.com>
+From: Vladislav Yaroshchuk <yaroshchuk2000@gmail.com>
-work_around_broken_dhclient() accesses IP and UDP headers to detect
+Signed-off-by: Vladislav Yaroshchuk <yaroshchuk2000@gmail.com>
 relevant packets and to calculate checksums, but it didn't check if
 the packet has size sufficient to accommodate them, causing out-of-bound
 access hazards. Fix this by correcting the size requirement.
 Fixes: 1d41b0c1ec66 ("Work around dhclient brokenness")
 Cc: qemu-stable@nongnu.org
 Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
 Signed-off-by: Jason Wang <jasowang@redhat.com>
 ---
- hw/net/virtio-net.c | 5 ++++-
+ MAINTAINERS | 5 +++++
-file changed, 4 insertions(+), 1 deletion(-)
+file changed, 5 insertions(+)
-diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
+diff --git a/MAINTAINERS b/MAINTAINERS
 index XXXXXXX..XXXXXXX 100644
---- a/hw/net/virtio-net.c
+--- a/MAINTAINERS
-+++ b/hw/net/virtio-net.c
++++ b/MAINTAINERS
-@@ -XXX,XX +XXX,XX @@ static void virtio_net_hdr_swap(VirtIODevice *vdev, struct virtio_net_hdr *hdr)
+@@ -XXX,XX +XXX,XX @@ W: http://info.iet.unipi.it/~luigi/netmap/
- static void work_around_broken_dhclient(struct virtio_net_hdr *hdr,
+ S: Maintained
-                                         uint8_t *buf, size_t size)
+ F: net/netmap.c
- {
-+    size_t csum_size = ETH_HLEN + sizeof(struct ip_header) +
++Apple vmnet network backends
-+                       sizeof(struct udp_header);
++M: Vladislav Yaroshchuk <yaroshchuk2000@gmail.com>
 +S: Maintained
 +F: net/vmnet*
 +
-     if ((hdr->flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) && /* missing csum */
+ Host Memory Backends
--        (size > 27 && size < 1500) && /* normal sized MTU */
+ M: David Hildenbrand <david@redhat.com>
-+        (size >= csum_size && size < 1500) && /* normal sized MTU */
+ M: Igor Mammedov <imammedo@redhat.com>
          (buf[12] == 0x08 && buf[13] == 0x00) && /* ethertype == IPv4 */
          (buf[23] == 17) && /* ip.protocol == UDP */
          (buf[34] == 0 && buf[35] == 67)) { /* udp.srcport == bootps */
 --
-.42.0
+.7.4

The following changes since commit 6b99bb046dd36a6dd5525b8f88c2dcddae49222a:

Merge tag 'pull-lu-20241122' of https://gitlab.com/rth7680/qemu into staging (2024-11-24 13:39:06 +0000)

are available in the Git repository at:

https://github.com/jasowang/qemu.git tags/net-pull-request

for you to fetch changes up to 7987d2be5a8bc3a502f89ba8cf3ac3e09f64d1ce:

virtio-net: Copy received header to buffer (2024-11-25 14:00:51 +0800)

----------------------------------------------------------------
-----BEGIN PGP SIGNATURE-----

iQEzBAABCAAdFiEEIV1G9IJGaJ7HfzVi7wSWWzmNYhEFAmdEEtgACgkQ7wSWWzmN
YhH5qAgAlKdcx/gFt4EBXtjVq/qbPluEGOQxvcRYLlN90rPLHPgCjAoT5ly3fIv1
4kCgcVZyG8SdGu1n0TzTTS9kg5tL7weQ9xEWwF0oyyuZABgAB7w/wpC8MHSkJFOn
2Tv+2Iab0dJ+e1pw71OMpE/YR5X2xq5vopsSHRtnyGWfRPGswJFwka+f8FS5DSiq
2CeNxADgTkPxJgDmOrNSsAPz8Rns77FAZdvDMqFjx1Lrqm8kPv9jzwOMO+a/2LpC
t6OkpFzGjiiskPjSnSn/tzo4TfWYoABjJaI7b3vEqmNEJSTAaxltZNtSXZucctEt
1ihnFdjr/wPwGK/5Wu+qGnfDbFNxBw==
=W4y1
-----END PGP SIGNATURE-----

----------------------------------------------------------------
Akihiko Odaki (6):
      net: checksum: Convert data to void *
      virtio-net: Fix size check in dhclient workaround
      virtio-net: Do not check for the queue before RSS
      virtio-net: Fix hash reporting when the queue changes
      virtio-net: Initialize hash reporting values
      virtio-net: Copy received header to buffer

hw/net/virtio-net.c    | 108 +++++++++++++++++++++++++++----------------------
 include/net/checksum.h |   2 +-
 net/checksum.c         |   4 +-
 3 files changed, 63 insertions(+), 51 deletions(-)

From: Akihiko Odaki <akihiko.odaki@daynix.com>

Convert the data parameter of net_checksum_calculate() to void * to
save unnecessary casts for callers.

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 include/net/checksum.h | 2 +-
 net/checksum.c         | 4 ++--
 2 files changed, 3 insertions(+), 3 deletions(-)

diff --git a/include/net/checksum.h b/include/net/checksum.h
index XXXXXXX..XXXXXXX 100644
--- a/include/net/checksum.h
+++ b/include/net/checksum.h
@@ -XXX,XX +XXX,XX @@ uint32_t net_checksum_add_cont(int len, uint8_t *buf, int seq);
 uint16_t net_checksum_finish(uint32_t sum);
 uint16_t net_checksum_tcpudp(uint16_t length, uint16_t proto,
                              uint8_t *addrs, uint8_t *buf);
-void net_checksum_calculate(uint8_t *data, int length, int csum_flag);
+void net_checksum_calculate(void *data, int length, int csum_flag);
 
 static inline uint32_t
 net_checksum_add(int len, uint8_t *buf)
diff --git a/net/checksum.c b/net/checksum.c
index XXXXXXX..XXXXXXX 100644
--- a/net/checksum.c
+++ b/net/checksum.c
@@ -XXX,XX +XXX,XX @@ uint16_t net_checksum_tcpudp(uint16_t length, uint16_t proto,
     return net_checksum_finish(sum);
 }
 
-void net_checksum_calculate(uint8_t *data, int length, int csum_flag)
+void net_checksum_calculate(void *data, int length, int csum_flag)
 {
     int mac_hdr_len, ip_len;
     struct ip_header *ip;
@@ -XXX,XX +XXX,XX @@ void net_checksum_calculate(uint8_t *data, int length, int csum_flag)
         return;
     }
 
-    ip = (struct ip_header *)(data + mac_hdr_len);
+    ip = (struct ip_header *)((uint8_t *)data + mac_hdr_len);
 
     if (IP_HEADER_VERSION(ip) != IP_HEADER_VERSION_4) {
         return; /* not IPv4 */
-- 
2.42.0

From: Akihiko Odaki <akihiko.odaki@daynix.com>

work_around_broken_dhclient() accesses IP and UDP headers to detect
relevant packets and to calculate checksums, but it didn't check if
the packet has size sufficient to accommodate them, causing out-of-bound
access hazards. Fix this by correcting the size requirement.

Fixes: 1d41b0c1ec66 ("Work around dhclient brokenness")
Cc: qemu-stable@nongnu.org
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/virtio-net.c | 5 ++++-
 1 file changed, 4 insertions(+), 1 deletion(-)

From: Akihiko Odaki <akihiko.odaki@daynix.com>

virtio_net_can_receive() checks if the queue is ready, but RSS will
change the queue to use so, strictly speaking, we may still be able to
receive the packet even if the queue initially provided is not ready.
Perform RSS before virtio_net_can_receive() to cover such a case.

Fixes: 4474e37a5b3a ("virtio-net: implement RX RSS processing")
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/virtio-net.c | 8 ++++----
 1 file changed, 4 insertions(+), 4 deletions(-)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -XXX,XX +XXX,XX @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
     size_t offset, i, guest_offset, j;
     ssize_t err;
 
-    if (!virtio_net_can_receive(nc)) {
-        return -1;
-    }
-
     if (!no_rss && n->rss_data.enabled && n->rss_data.enabled_software_rss) {
         int index = virtio_net_process_rss(nc, buf, size, &extra_hdr);
         if (index >= 0) {
@@ -XXX,XX +XXX,XX @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
         }
     }
 
+    if (!virtio_net_can_receive(nc)) {
+        return -1;
+    }
+
     /* hdr_len refers to the header we supply to the guest */
     if (!virtio_net_has_buffers(q, size + n->guest_hdr_len - n->host_hdr_len)) {
         return 0;
-- 
2.42.0

From: Akihiko Odaki <akihiko.odaki@daynix.com>

virtio_net_process_rss() fills the values used for hash reporting, but
the values used to be thrown away with a recursive function call if
the queue changes after RSS. Avoid the function call to keep the values.

Fixes: a4c960eedcd2 ("virtio-net: Do not write hashes to peer buffer")
Buglink: https://issues.redhat.com/browse/RHEL-59572
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/virtio-net.c | 14 +++++++-------
 1 file changed, 7 insertions(+), 7 deletions(-)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -XXX,XX +XXX,XX @@ static int virtio_net_process_rss(NetClientState *nc, const uint8_t *buf,
 }
 
 static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
-                                      size_t size, bool no_rss)
+                                      size_t size)
 {
     VirtIONet *n = qemu_get_nic_opaque(nc);
-    VirtIONetQueue *q = virtio_net_get_subqueue(nc);
+    VirtIONetQueue *q;
     VirtIODevice *vdev = VIRTIO_DEVICE(n);
     VirtQueueElement *elems[VIRTQUEUE_MAX_SIZE];
     size_t lens[VIRTQUEUE_MAX_SIZE];
@@ -XXX,XX +XXX,XX @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
     size_t offset, i, guest_offset, j;
     ssize_t err;
 
-    if (!no_rss && n->rss_data.enabled && n->rss_data.enabled_software_rss) {
+    if (n->rss_data.enabled && n->rss_data.enabled_software_rss) {
         int index = virtio_net_process_rss(nc, buf, size, &extra_hdr);
         if (index >= 0) {
-            NetClientState *nc2 =
-                qemu_get_subqueue(n->nic, index % n->curr_queue_pairs);
-            return virtio_net_receive_rcu(nc2, buf, size, true);
+            nc = qemu_get_subqueue(n->nic, index % n->curr_queue_pairs);
         }
     }
 
@@ -XXX,XX +XXX,XX @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
         return -1;
     }
 
+    q = virtio_net_get_subqueue(nc);
+
     /* hdr_len refers to the header we supply to the guest */
     if (!virtio_net_has_buffers(q, size + n->guest_hdr_len - n->host_hdr_len)) {
         return 0;
@@ -XXX,XX +XXX,XX @@ static ssize_t virtio_net_do_receive(NetClientState *nc, const uint8_t *buf,
 {
     RCU_READ_LOCK_GUARD();
 
-    return virtio_net_receive_rcu(nc, buf, size, false);
+    return virtio_net_receive_rcu(nc, buf, size);
 }
 
 /*
-- 
2.42.0

From: Akihiko Odaki <akihiko.odaki@daynix.com>

The specification says hash_report should be set to
VIRTIO_NET_HASH_REPORT_NONE if VIRTIO_NET_F_HASH_REPORT is negotiated
but not configured with VIRTIO_NET_CTRL_MQ_RSS_CONFIG. However,
virtio_net_receive_rcu() instead wrote out the content of the extra_hdr
variable, which is not uninitialized in such a case.

Fix this by zeroing the extra_hdr.

Fixes: e22f0603fb2f ("virtio-net: reference implementation of hash report")
Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Reviewed-by: Philippe Mathieu-Daudé <philmd@linaro.org>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/virtio-net.c | 2 ++
 1 file changed, 2 insertions(+)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -XXX,XX +XXX,XX @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
     size_t offset, i, guest_offset, j;
     ssize_t err;
 
+    memset(&extra_hdr, 0, sizeof(extra_hdr));
+
     if (n->rss_data.enabled && n->rss_data.enabled_software_rss) {
         int index = virtio_net_process_rss(nc, buf, size, &extra_hdr);
         if (index >= 0) {
-- 
2.42.0

From: Akihiko Odaki <akihiko.odaki@daynix.com>

receive_header() used to cast the const qualifier of the pointer to the
received packet away to modify the header. Avoid this by copying the
received header to buffer.

Signed-off-by: Akihiko Odaki <akihiko.odaki@daynix.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/virtio-net.c | 85 ++++++++++++++++++++++++---------------------
 1 file changed, 46 insertions(+), 39 deletions(-)

diff --git a/hw/net/virtio-net.c b/hw/net/virtio-net.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/virtio-net.c
+++ b/hw/net/virtio-net.c
@@ -XXX,XX +XXX,XX @@ static void virtio_net_hdr_swap(VirtIODevice *vdev, struct virtio_net_hdr *hdr)
  * cache.
  */
 static void work_around_broken_dhclient(struct virtio_net_hdr *hdr,
-                                        uint8_t *buf, size_t size)
+                                        size_t *hdr_len, const uint8_t *buf,
+                                        size_t buf_size, size_t *buf_offset)
 {
     size_t csum_size = ETH_HLEN + sizeof(struct ip_header) +
                        sizeof(struct udp_header);
 
+    buf += *buf_offset;
+    buf_size -= *buf_offset;
+
     if ((hdr->flags & VIRTIO_NET_HDR_F_NEEDS_CSUM) && /* missing csum */
-        (size >= csum_size && size < 1500) && /* normal sized MTU */
+        (buf_size >= csum_size && buf_size < 1500) && /* normal sized MTU */
         (buf[12] == 0x08 && buf[13] == 0x00) && /* ethertype == IPv4 */
         (buf[23] == 17) && /* ip.protocol == UDP */
         (buf[34] == 0 && buf[35] == 67)) { /* udp.srcport == bootps */
-        net_checksum_calculate(buf, size, CSUM_UDP);
+        memcpy((uint8_t *)hdr + *hdr_len, buf, csum_size);
+        net_checksum_calculate((uint8_t *)hdr + *hdr_len, csum_size, CSUM_UDP);
         hdr->flags &= ~VIRTIO_NET_HDR_F_NEEDS_CSUM;
+        *hdr_len += csum_size;
+        *buf_offset += csum_size;
     }
 }
 
-static void receive_header(VirtIONet *n, const struct iovec *iov, int iov_cnt,
-                           const void *buf, size_t size)
+static size_t receive_header(VirtIONet *n, struct virtio_net_hdr *hdr,
+                             const void *buf, size_t buf_size,
+                             size_t *buf_offset)
 {
-    if (n->has_vnet_hdr) {
-        /* FIXME this cast is evil */
-        void *wbuf = (void *)buf;
-        work_around_broken_dhclient(wbuf, wbuf + n->host_hdr_len,
-                                    size - n->host_hdr_len);
+    size_t hdr_len = n->guest_hdr_len;
 
-        if (n->needs_vnet_hdr_swap) {
-            virtio_net_hdr_swap(VIRTIO_DEVICE(n), wbuf);
-        }
-        iov_from_buf(iov, iov_cnt, 0, buf, sizeof(struct virtio_net_hdr));
-    } else {
-        struct virtio_net_hdr hdr = {
-            .flags = 0,
-            .gso_type = VIRTIO_NET_HDR_GSO_NONE
-        };
-        iov_from_buf(iov, iov_cnt, 0, &hdr, sizeof hdr);
+    memcpy(hdr, buf, sizeof(struct virtio_net_hdr));
+
+    *buf_offset = n->host_hdr_len;
+    work_around_broken_dhclient(hdr, &hdr_len, buf, buf_size, buf_offset);
+
+    if (n->needs_vnet_hdr_swap) {
+        virtio_net_hdr_swap(VIRTIO_DEVICE(n), hdr);
     }
+
+    return hdr_len;
 }
 
 static int receive_filter(VirtIONet *n, const uint8_t *buf, int size)
@@ -XXX,XX +XXX,XX @@ static int virtio_net_process_rss(NetClientState *nc, const uint8_t *buf,
     return (index == new_index) ? -1 : new_index;
 }
 
+typedef struct Header {
+    struct virtio_net_hdr_v1_hash virtio_net;
+    struct eth_header eth;
+    struct ip_header ip;
+    struct udp_header udp;
+} Header;
+
 static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
                                       size_t size)
 {
@@ -XXX,XX +XXX,XX @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
     VirtQueueElement *elems[VIRTQUEUE_MAX_SIZE];
     size_t lens[VIRTQUEUE_MAX_SIZE];
     struct iovec mhdr_sg[VIRTQUEUE_MAX_SIZE];
-    struct virtio_net_hdr_v1_hash extra_hdr;
+    Header hdr;
     unsigned mhdr_cnt = 0;
     size_t offset, i, guest_offset, j;
     ssize_t err;
 
-    memset(&extra_hdr, 0, sizeof(extra_hdr));
+    memset(&hdr.virtio_net, 0, sizeof(hdr.virtio_net));
 
     if (n->rss_data.enabled && n->rss_data.enabled_software_rss) {
-        int index = virtio_net_process_rss(nc, buf, size, &extra_hdr);
+        int index = virtio_net_process_rss(nc, buf, size, &hdr.virtio_net);
         if (index >= 0) {
             nc = qemu_get_subqueue(n->nic, index % n->curr_queue_pairs);
         }
@@ -XXX,XX +XXX,XX @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
             if (n->mergeable_rx_bufs) {
                 mhdr_cnt = iov_copy(mhdr_sg, ARRAY_SIZE(mhdr_sg),
                                     sg, elem->in_num,
-                                    offsetof(typeof(extra_hdr), hdr.num_buffers),
-                                    sizeof(extra_hdr.hdr.num_buffers));
+                                    offsetof(typeof(hdr),
+                                             virtio_net.hdr.num_buffers),
+                                    sizeof(hdr.virtio_net.hdr.num_buffers));
             }
 
-            receive_header(n, sg, elem->in_num, buf, size);
-            if (n->rss_data.populate_hash) {
-                offset = offsetof(typeof(extra_hdr), hash_value);
-                iov_from_buf(sg, elem->in_num, offset,
-                             (char *)&extra_hdr + offset,
-                             sizeof(extra_hdr.hash_value) +
-                             sizeof(extra_hdr.hash_report));
-            }
-            offset = n->host_hdr_len;
-            total += n->guest_hdr_len;
-            guest_offset = n->guest_hdr_len;
+            guest_offset = n->has_vnet_hdr ?
+                           receive_header(n, (struct virtio_net_hdr *)&hdr,
+                                          buf, size, &offset) :
+                           n->guest_hdr_len;
+
+            iov_from_buf(sg, elem->in_num, 0, &hdr, guest_offset);
+            total += guest_offset;
         } else {
             guest_offset = 0;
         }
@@ -XXX,XX +XXX,XX @@ static ssize_t virtio_net_receive_rcu(NetClientState *nc, const uint8_t *buf,
     }
 
     if (mhdr_cnt) {
-        virtio_stw_p(vdev, &extra_hdr.hdr.num_buffers, i);
+        virtio_stw_p(vdev, &hdr.virtio_net.hdr.num_buffers, i);
         iov_from_buf(mhdr_sg, mhdr_cnt,
                      0,
-                     &extra_hdr.hdr.num_buffers,
-                     sizeof extra_hdr.hdr.num_buffers);
+                     &hdr.virtio_net.hdr.num_buffers,
+                     sizeof hdr.virtio_net.hdr.num_buffers);
     }
 
     for (j = 0; j < i; j++) {
-- 
2.42.0

The following changes since commit f8d75e10d3e0033a0a29a7a7e4777a4fbc17a016:

Merge remote-tracking branch 'remotes/legoater/tags/pull-ppc-20220112' into staging (2022-01-13 11:18:24 +0000)

are available in the git repository at:

https://github.com/jasowang/qemu.git tags/net-pull-request

for you to fetch changes up to 818692f0a01587d02220916b31d5bb8e7dced611:

net/vmnet: update MAINTAINERS list (2022-01-14 12:58:19 +0800)

----------------------------------------------------------------

Changes since V2:

- Try to make vmnet work on some old mac version

----------------------------------------------------------------
Peter Foley (2):
      net/tap: Set return code on failure
      net: Fix uninitialized data usage

Philippe Mathieu-Daudé (1):
      hw/net/vmxnet3: Log guest-triggerable errors using LOG_GUEST_ERROR

Rao Lei (1):
      net/filter: Optimize filter_send to coroutine

Vladislav Yaroshchuk (7):
      net/vmnet: add vmnet dependency and customizable option
      net/vmnet: add vmnet backends to qapi/net
      net/vmnet: implement shared mode (vmnet-shared)
      net/vmnet: implement host mode (vmnet-host)
      net/vmnet: implement bridged mode (vmnet-bridged)
      net/vmnet: update qemu-options.hx
      net/vmnet: update MAINTAINERS list

Zhang Chen (2):
      net/colo-compare.c: Optimize compare order for performance
      net/colo-compare.c: Update the default value comments

From: Philippe Mathieu-Daudé <philmd@redhat.com>

The "Interrupt Cause" register (VMXNET3_REG_ICR) is read-only.
Write accesses are ignored. Log them with as LOG_GUEST_ERROR
instead of aborting:

[R +0.239743] writeq 0xe0002031 0x46291a5a55460800
  ERROR:hw/net/vmxnet3.c:1819:vmxnet3_io_bar1_write: code should not be reached
  Thread 1 "qemu-system-i38" received signal SIGABRT, Aborted.
  (gdb) bt
  #3  0x74c397d3 in __GI_abort () at abort.c:79
  #4  0x76d3cd4c in g_assertion_message (domain=<optimized out>, file=<optimized out>, line=<optimized out>, func=<optimized out>, message=<optimized out>) at ../glib/gtestutils.c:3223
  #5  0x76d9d45f in g_assertion_message_expr
      (domain=0x0, file=0x59fc2e53 "hw/net/vmxnet3.c", line=1819, func=0x59fc11e0 <__func__.vmxnet3_io_bar1_write> "vmxnet3_io_bar1_write", expr=<optimized out>)
      at ../glib/gtestutils.c:3249
  #6  0x57e80a3a in vmxnet3_io_bar1_write (opaque=0x62814100, addr=56, val=70, size=4) at hw/net/vmxnet3.c:1819
  #7  0x58c2d894 in memory_region_write_accessor (mr=0x62816b90, addr=56, value=0x7fff9450, size=4, shift=0, mask=4294967295, attrs=...) at softmmu/memory.c:492
  #8  0x58c2d1d2 in access_with_adjusted_size (addr=56, value=0x7fff9450, size=1, access_size_min=4, access_size_max=4, access_fn=
      0x58c2d290 <memory_region_write_accessor>, mr=0x62816b90, attrs=...) at softmmu/memory.c:554
  #9  0x58c2bae7 in memory_region_dispatch_write (mr=0x62816b90, addr=56, data=70, op=MO_8, attrs=...) at softmmu/memory.c:1504
  #10 0x58bfd034 in flatview_write_continue (fv=0x606000181700, addr=0xe0002038, attrs=..., ptr=0x7fffb9e0, len=1, addr1=56, l=1, mr=0x62816b90)
      at softmmu/physmem.c:2782
  #11 0x58beba00 in flatview_write (fv=0x606000181700, addr=0xe0002031, attrs=..., buf=0x7fffb9e0, len=8) at softmmu/physmem.c:2822
  #12 0x58beb589 in address_space_write (as=0x608000015f20, addr=0xe0002031, attrs=..., buf=0x7fffb9e0, len=8) at softmmu/physmem.c:2914

Reported-by: Dike <dike199774@qq.com>
Reported-by: Duhao <504224090@qq.com>
BugLink: https://bugzilla.redhat.com/show_bug.cgi?id=2032932
Signed-off-by: Philippe Mathieu-Daudé <philmd@redhat.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 hw/net/vmxnet3.c | 4 +++-
 1 file changed, 3 insertions(+), 1 deletion(-)

diff --git a/hw/net/vmxnet3.c b/hw/net/vmxnet3.c
index XXXXXXX..XXXXXXX 100644
--- a/hw/net/vmxnet3.c
+++ b/hw/net/vmxnet3.c
@@ -XXX,XX +XXX,XX @@ vmxnet3_io_bar1_write(void *opaque,
     case VMXNET3_REG_ICR:
         VMW_CBPRN("Write BAR1 [VMXNET3_REG_ICR] = %" PRIx64 ", size %d",
                   val, size);
-        g_assert_not_reached();
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "%s: write to read-only register VMXNET3_REG_ICR\n",
+                      TYPE_VMXNET3);
         break;
 
     /* Event Cause Register */
-- 
2.7.4

From: Peter Foley <pefoley@google.com>

e.g.
1109 15:16:20.151506 Uninitialized bytes in ioctl_common_pre at offset 0 inside [0x7ffc516af9b8, 4)
 1109 15:16:20.151659 ==588974==WARNING: MemorySanitizer: use-of-uninitialized-value
 1109 15:16:20.312923     #0 0x5639b88acb21 in tap_probe_vnet_hdr_len third_party/qemu/net/tap-linux.c:183:9
 1109 15:16:20.312952     #1 0x5639b88afd66 in net_tap_fd_init third_party/qemu/net/tap.c:409:9
 1109 15:16:20.312954     #2 0x5639b88b2d1b in net_init_tap_one third_party/qemu/net/tap.c:681:19
 1109 15:16:20.312956     #3 0x5639b88b16a8 in net_init_tap third_party/qemu/net/tap.c:912:13
 1109 15:16:20.312957     #4 0x5639b8890175 in net_client_init1 third_party/qemu/net/net.c:1110:9
 1109 15:16:20.312958     #5 0x5639b888f912 in net_client_init third_party/qemu/net/net.c:1208:15
 1109 15:16:20.312960     #6 0x5639b8894aa5 in net_param_nic third_party/qemu/net/net.c:1588:11
 1109 15:16:20.312961     #7 0x5639b900cd18 in qemu_opts_foreach third_party/qemu/util/qemu-option.c:1135:14
 1109 15:16:20.312962     #8 0x5639b889393c in net_init_clients third_party/qemu/net/net.c:1612:9
 1109 15:16:20.312964     #9 0x5639b717aaf3 in qemu_create_late_backends third_party/qemu/softmmu/vl.c:1962:5
 1109 15:16:20.312965     #10 0x5639b717aaf3 in qemu_init third_party/qemu/softmmu/vl.c:3694:5
 1109 15:16:20.312967     #11 0x5639b71083b8 in main third_party/qemu/softmmu/main.c:49:5
 1109 15:16:20.312968     #12 0x7f464de1d8d2 in __libc_start_main (/usr/grte/v5/lib64/libc.so.6+0x628d2)
 1109 15:16:20.312969     #13 0x5639b6bbd389 in _start /usr/grte/v5/debug-src/src/csu/../sysdeps/x86_64/start.S:120
 1109 15:16:20.312970
 1109 15:16:20.312975   Uninitialized value was stored to memory at
 1109 15:16:20.313393     #0 0x5639b88acbee in tap_probe_vnet_hdr_len third_party/qemu/net/tap-linux.c
 1109 15:16:20.313396     #1 0x5639b88afd66 in net_tap_fd_init third_party/qemu/net/tap.c:409:9
 1109 15:16:20.313398     #2 0x5639b88b2d1b in net_init_tap_one third_party/qemu/net/tap.c:681:19
 1109 15:16:20.313399     #3 0x5639b88b16a8 in net_init_tap third_party/qemu/net/tap.c:912:13
 1109 15:16:20.313400     #4 0x5639b8890175 in net_client_init1 third_party/qemu/net/net.c:1110:9
 1109 15:16:20.313401     #5 0x5639b888f912 in net_client_init third_party/qemu/net/net.c:1208:15
 1109 15:16:20.313403     #6 0x5639b8894aa5 in net_param_nic third_party/qemu/net/net.c:1588:11
 1109 15:16:20.313404     #7 0x5639b900cd18 in qemu_opts_foreach third_party/qemu/util/qemu-option.c:1135:14
 1109 15:16:20.313405     #8 0x5639b889393c in net_init_clients third_party/qemu/net/net.c:1612:9
 1109 15:16:20.313407     #9 0x5639b717aaf3 in qemu_create_late_backends third_party/qemu/softmmu/vl.c:1962:5
 1109 15:16:20.313408     #10 0x5639b717aaf3 in qemu_init third_party/qemu/softmmu/vl.c:3694:5
 1109 15:16:20.313409     #11 0x5639b71083b8 in main third_party/qemu/softmmu/main.c:49:5
 1109 15:16:20.313410     #12 0x7f464de1d8d2 in __libc_start_main (/usr/grte/v5/lib64/libc.so.6+0x628d2)
 1109 15:16:20.313412     #13 0x5639b6bbd389 in _start /usr/grte/v5/debug-src/src/csu/../sysdeps/x86_64/start.S:120
 1109 15:16:20.313413
 1109 15:16:20.313417   Uninitialized value was stored to memory at
 1109 15:16:20.313791     #0 0x5639b88affbd in net_tap_fd_init third_party/qemu/net/tap.c:400:26
 1109 15:16:20.313826     #1 0x5639b88b2d1b in net_init_tap_one third_party/qemu/net/tap.c:681:19
 1109 15:16:20.313829     #2 0x5639b88b16a8 in net_init_tap third_party/qemu/net/tap.c:912:13
 1109 15:16:20.313831     #3 0x5639b8890175 in net_client_init1 third_party/qemu/net/net.c:1110:9
 1109 15:16:20.313836     #4 0x5639b888f912 in net_client_init third_party/qemu/net/net.c:1208:15
 1109 15:16:20.313838     #5 0x5639b8894aa5 in net_param_nic third_party/qemu/net/net.c:1588:11
 1109 15:16:20.313839     #6 0x5639b900cd18 in qemu_opts_foreach third_party/qemu/util/qemu-option.c:1135:14
 1109 15:16:20.313841     #7 0x5639b889393c in net_init_clients third_party/qemu/net/net.c:1612:9
 1109 15:16:20.313843     #8 0x5639b717aaf3 in qemu_create_late_backends third_party/qemu/softmmu/vl.c:1962:5
 1109 15:16:20.313844     #9 0x5639b717aaf3 in qemu_init third_party/qemu/softmmu/vl.c:3694:5
 1109 15:16:20.313845     #10 0x5639b71083b8 in main third_party/qemu/softmmu/main.c:49:5
 1109 15:16:20.313846     #11 0x7f464de1d8d2 in __libc_start_main (/usr/grte/v5/lib64/libc.so.6+0x628d2)
 1109 15:16:20.313847     #12 0x5639b6bbd389 in _start /usr/grte/v5/debug-src/src/csu/../sysdeps/x86_64/start.S:120
 1109 15:16:20.313849
 1109 15:16:20.313851   Uninitialized value was created by an allocation of 'ifr' in the stack frame of function 'tap_probe_vnet_hdr'
 1109 15:16:20.313855     #0 0x5639b88ac680 in tap_probe_vnet_hdr third_party/qemu/net/tap-linux.c:151
 1109 15:16:20.313856
 1109 15:16:20.313878 SUMMARY: MemorySanitizer: use-of-uninitialized-value third_party/qemu/net/tap-linux.c:183:9 in tap_probe_vnet_hdr_len

Fixes: dc69004c7d8 ("net: move tap_probe_vnet_hdr() to tap-linux.c")
Reviewed-by: Hao Wu <wuhaotsh@google.com>
Reviewed-by: Patrick Venture <venture@google.com>
Reviewed-by: Philippe Mathieu-Daudé <f4bug@amsat.org>
Signed-off-by: Peter Foley <pefoley@google.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/tap-linux.c | 1 +
 1 file changed, 1 insertion(+)

diff --git a/net/tap-linux.c b/net/tap-linux.c
index XXXXXXX..XXXXXXX 100644
--- a/net/tap-linux.c
+++ b/net/tap-linux.c
@@ -XXX,XX +XXX,XX @@ void tap_set_sndbuf(int fd, const NetdevTapOptions *tap, Error **errp)
 int tap_probe_vnet_hdr(int fd, Error **errp)
 {
     struct ifreq ifr;
+    memset(&ifr, 0, sizeof(ifr));
 
     if (ioctl(fd, TUNGETIFF, &ifr) != 0) {
         /* TUNGETIFF is available since kernel v2.6.27 */
-- 
2.7.4

From: Zhang Chen <chen.zhang@intel.com>

COLO-compare use the glib function g_queue_find_custom to dump
another VM's networking packet to compare. But this function always
start find from the queue->head(here is the newest packet), It will
reduce the success rate of comparison. So this patch reversed
the order of the queues for performance.

Signed-off-by: Zhang Chen <chen.zhang@intel.com>
Reported-by: leirao <lei.rao@intel.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/colo-compare.c | 26 +++++++++++++-------------
 1 file changed, 13 insertions(+), 13 deletions(-)

diff --git a/net/colo-compare.c b/net/colo-compare.c
index XXXXXXX..XXXXXXX 100644
--- a/net/colo-compare.c
+++ b/net/colo-compare.c
@@ -XXX,XX +XXX,XX @@ static void colo_compare_inconsistency_notify(CompareState *s)
 /* Use restricted to colo_insert_packet() */
 static gint seq_sorter(Packet *a, Packet *b, gpointer data)
 {
-    return a->tcp_seq - b->tcp_seq;
+    return b->tcp_seq - a->tcp_seq;
 }
 
 static void fill_pkt_tcp_info(void *data, uint32_t *max_ack)
@@ -XXX,XX +XXX,XX @@ pri:
     if (g_queue_is_empty(&conn->primary_list)) {
         return;
     }
-    ppkt = g_queue_pop_head(&conn->primary_list);
+    ppkt = g_queue_pop_tail(&conn->primary_list);
 sec:
     if (g_queue_is_empty(&conn->secondary_list)) {
-        g_queue_push_head(&conn->primary_list, ppkt);
+        g_queue_push_tail(&conn->primary_list, ppkt);
         return;
     }
-    spkt = g_queue_pop_head(&conn->secondary_list);
+    spkt = g_queue_pop_tail(&conn->secondary_list);
 
     if (ppkt->tcp_seq == ppkt->seq_end) {
         colo_release_primary_pkt(s, ppkt);
@@ -XXX,XX +XXX,XX @@ sec:
             }
         }
         if (!ppkt) {
-            g_queue_push_head(&conn->secondary_list, spkt);
+            g_queue_push_tail(&conn->secondary_list, spkt);
             goto pri;
         }
     }
@@ -XXX,XX +XXX,XX @@ sec:
         if (mark == COLO_COMPARE_FREE_PRIMARY) {
             conn->compare_seq = ppkt->seq_end;
             colo_release_primary_pkt(s, ppkt);
-            g_queue_push_head(&conn->secondary_list, spkt);
+            g_queue_push_tail(&conn->secondary_list, spkt);
             goto pri;
         } else if (mark == COLO_COMPARE_FREE_SECONDARY) {
             conn->compare_seq = spkt->seq_end;
@@ -XXX,XX +XXX,XX @@ sec:
             goto pri;
         }
     } else {
-        g_queue_push_head(&conn->primary_list, ppkt);
-        g_queue_push_head(&conn->secondary_list, spkt);
+        g_queue_push_tail(&conn->primary_list, ppkt);
+        g_queue_push_tail(&conn->secondary_list, spkt);
 
 #ifdef DEBUG_COLO_PACKETS
         qemu_hexdump(stderr, "colo-compare ppkt", ppkt->data, ppkt->size);
@@ -XXX,XX +XXX,XX @@ static void colo_compare_packet(CompareState *s, Connection *conn,
 
     while (!g_queue_is_empty(&conn->primary_list) &&
            !g_queue_is_empty(&conn->secondary_list)) {
-        pkt = g_queue_pop_head(&conn->primary_list);
+        pkt = g_queue_pop_tail(&conn->primary_list);
         result = g_queue_find_custom(&conn->secondary_list,
                  pkt, (GCompareFunc)HandlePacket);
 
@@ -XXX,XX +XXX,XX @@ static void colo_compare_packet(CompareState *s, Connection *conn,
              * timeout, it will trigger a checkpoint request.
              */
             trace_colo_compare_main("packet different");
-            g_queue_push_head(&conn->primary_list, pkt);
+            g_queue_push_tail(&conn->primary_list, pkt);
 
             colo_compare_inconsistency_notify(s);
             break;
@@ -XXX,XX +XXX,XX @@ static int compare_chr_send(CompareState *s,
         entry->buf = g_malloc(size);
         memcpy(entry->buf, buf, size);
     }
-    g_queue_push_head(&sendco->send_list, entry);
+    g_queue_push_tail(&sendco->send_list, entry);
 
     if (sendco->done) {
         sendco->co = qemu_coroutine_create(_compare_chr_send, sendco);
@@ -XXX,XX +XXX,XX @@ static void colo_flush_packets(void *opaque, void *user_data)
     Packet *pkt = NULL;
 
     while (!g_queue_is_empty(&conn->primary_list)) {
-        pkt = g_queue_pop_head(&conn->primary_list);
+        pkt = g_queue_pop_tail(&conn->primary_list);
         compare_chr_send(s,
                          pkt->data,
                          pkt->size,
@@ -XXX,XX +XXX,XX @@ static void colo_flush_packets(void *opaque, void *user_data)
         packet_destroy_partial(pkt, NULL);
     }
     while (!g_queue_is_empty(&conn->secondary_list)) {
-        pkt = g_queue_pop_head(&conn->secondary_list);
+        pkt = g_queue_pop_tail(&conn->secondary_list);
         packet_destroy(pkt, NULL);
     }
 }
-- 
2.7.4

From: Rao Lei <lei.rao@intel.com>

This patch is to improve the logic of QEMU main thread sleep code in
qemu_chr_write_buffer() where it can be blocked and can't run other
coroutines during COLO IO stress test.

Our approach is to put filter_send() in a coroutine. In this way,
filter_send() will call qemu_coroutine_yield() in qemu_co_sleep_ns(),
so that it can be scheduled out and QEMU main thread has opportunity to
run other tasks.

Signed-off-by: Lei Rao <lei.rao@intel.com>
Signed-off-by: Zhang Chen <chen.zhang@intel.com>
Reviewed-by: Li Zhijian <lizhijian@fujitsu.com>
Reviewed-by: Zhang Chen <chen.zhang@intel.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/filter-mirror.c | 66 ++++++++++++++++++++++++++++++++++++++++++-----------
 1 file changed, 53 insertions(+), 13 deletions(-)

diff --git a/net/filter-mirror.c b/net/filter-mirror.c
index XXXXXXX..XXXXXXX 100644
--- a/net/filter-mirror.c
+++ b/net/filter-mirror.c
@@ -XXX,XX +XXX,XX @@
 #include "chardev/char-fe.h"
 #include "qemu/iov.h"
 #include "qemu/sockets.h"
+#include "block/aio-wait.h"
 
 #define TYPE_FILTER_MIRROR "filter-mirror"
 typedef struct MirrorState MirrorState;
@@ -XXX,XX +XXX,XX @@ struct MirrorState {
     bool vnet_hdr;
 };
 
-static int filter_send(MirrorState *s,
-                       const struct iovec *iov,
-                       int iovcnt)
+typedef struct FilterSendCo {
+    MirrorState *s;
+    char *buf;
+    ssize_t size;
+    bool done;
+    int ret;
+} FilterSendCo;
+
+static int _filter_send(MirrorState *s,
+                       char *buf,
+                       ssize_t size)
 {
     NetFilterState *nf = NETFILTER(s);
     int ret = 0;
-    ssize_t size = 0;
     uint32_t len = 0;
-    char *buf;
-
-    size = iov_size(iov, iovcnt);
-    if (!size) {
-        return 0;
-    }
 
     len = htonl(size);
     ret = qemu_chr_fe_write_all(&s->chr_out, (uint8_t *)&len, sizeof(len));
@@ -XXX,XX +XXX,XX @@ static int filter_send(MirrorState *s,
         }
     }
 
-    buf = g_malloc(size);
-    iov_to_buf(iov, iovcnt, 0, buf, size);
     ret = qemu_chr_fe_write_all(&s->chr_out, (uint8_t *)buf, size);
-    g_free(buf);
     if (ret != size) {
         goto err;
     }
@@ -XXX,XX +XXX,XX @@ err:
     return ret < 0 ? ret : -EIO;
 }
 
+static void coroutine_fn filter_send_co(void *opaque)
+{
+    FilterSendCo *data = opaque;
+
+    data->ret = _filter_send(data->s, data->buf, data->size);
+    data->done = true;
+    g_free(data->buf);
+    aio_wait_kick();
+}
+
+static int filter_send(MirrorState *s,
+                       const struct iovec *iov,
+                       int iovcnt)
+{
+    ssize_t size = iov_size(iov, iovcnt);
+    char *buf = NULL;
+
+    if (!size) {
+        return 0;
+    }
+
+    buf = g_malloc(size);
+    iov_to_buf(iov, iovcnt, 0, buf, size);
+
+    FilterSendCo data = {
+        .s = s,
+        .size = size,
+        .buf = buf,
+        .ret = 0,
+    };
+
+    Coroutine *co = qemu_coroutine_create(filter_send_co, &data);
+    qemu_coroutine_enter(co);
+
+    while (!data.done) {
+        aio_poll(qemu_get_aio_context(), true);
+    }
+
+    return data.ret;
+}
+
 static void redirector_to_filter(NetFilterState *nf,
                                  const uint8_t *buf,
                                  int len)
-- 
2.7.4

From: Vladislav Yaroshchuk <yaroshchuk2000@gmail.com>

vmnet.framework dependency is added with 'vmnet' option
to enable or disable it. Default value is 'auto'.

vmnet features to be used are available since macOS 11.0,
corresponding probe is created into meson.build.

Signed-off-by: Vladislav Yaroshchuk <yaroshchuk2000@gmail.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 meson.build                   | 16 +++++++++++++++-
 meson_options.txt             |  2 ++
 scripts/meson-buildoptions.sh |  3 +++
 3 files changed, 20 insertions(+), 1 deletion(-)

diff --git a/meson.build b/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/meson.build
+++ b/meson.build
@@ -XXX,XX +XXX,XX @@ if cocoa.found() and get_option('gtk').enabled()
   error('Cocoa and GTK+ cannot be enabled at the same time')
 endif
 
+vmnet = dependency('appleframeworks', modules: 'vmnet', required: get_option('vmnet'))
+if vmnet.found() and not cc.has_header_symbol('vmnet/vmnet.h',
+                                              'VMNET_BRIDGED_MODE',
+                                              dependencies: vmnet)
+  vmnet = not_found
+  if get_option('vmnet').enabled()
+    error('vmnet.framework API is outdated')
+  else
+    warning('vmnet.framework API is outdated, disabling')
+  endif
+endif
+
 seccomp = not_found
 if not get_option('seccomp').auto() or have_system or have_tools
   seccomp = dependency('libseccomp', version: '>=2.3.0',
@@ -XXX,XX +XXX,XX @@ config_host_data.set('CONFIG_SECCOMP', seccomp.found())
 config_host_data.set('CONFIG_SNAPPY', snappy.found())
 config_host_data.set('CONFIG_USB_LIBUSB', libusb.found())
 config_host_data.set('CONFIG_VDE', vde.found())
+config_host_data.set('CONFIG_VMNET', vmnet.found())
 config_host_data.set('CONFIG_VHOST_USER_BLK_SERVER', have_vhost_user_blk_server)
 config_host_data.set('CONFIG_VNC', vnc.found())
 config_host_data.set('CONFIG_VNC_JPEG', jpeg.found())
@@ -XXX,XX +XXX,XX @@ summary(summary_info, bool_yn: true, section: 'Crypto')
 # Libraries
 summary_info = {}
 if targetos == 'darwin'
-  summary_info += {'Cocoa support':   cocoa}
+  summary_info += {'Cocoa support':           cocoa}
+  summary_info += {'vmnet.framework support': vmnet}
 endif
 summary_info += {'SDL support':       sdl}
 summary_info += {'SDL image support': sdl_image}
diff --git a/meson_options.txt b/meson_options.txt
index XXXXXXX..XXXXXXX 100644
--- a/meson_options.txt
+++ b/meson_options.txt
@@ -XXX,XX +XXX,XX @@ option('netmap', type : 'feature', value : 'auto',
        description: 'netmap network backend support')
 option('vde', type : 'feature', value : 'auto',
        description: 'vde network backend support')
+option('vmnet', type : 'feature', value : 'auto',
+       description: 'vmnet.framework network backend support')
 option('virglrenderer', type : 'feature', value : 'auto',
        description: 'virgl rendering support')
 option('vnc', type : 'feature', value : 'auto',
diff --git a/scripts/meson-buildoptions.sh b/scripts/meson-buildoptions.sh
index XXXXXXX..XXXXXXX 100644
--- a/scripts/meson-buildoptions.sh
+++ b/scripts/meson-buildoptions.sh
@@ -XXX,XX +XXX,XX @@ meson_options_help() {
   printf "%s\n" '  u2f             U2F emulation support'
   printf "%s\n" '  usb-redir       libusbredir support'
   printf "%s\n" '  vde             vde network backend support'
+  printf "%s\n" '  vmnet           vmnet.framework network backend support'
   printf "%s\n" '  vhost-user-blk-server'
   printf "%s\n" '                  build vhost-user-blk server'
   printf "%s\n" '  virglrenderer   virgl rendering support'
@@ -XXX,XX +XXX,XX @@ _meson_option_parse() {
     --disable-usb-redir) printf "%s" -Dusb_redir=disabled ;;
     --enable-vde) printf "%s" -Dvde=enabled ;;
     --disable-vde) printf "%s" -Dvde=disabled ;;
+    --enable-vmnet) printf "%s" -Dvmnet=enabled ;;
+    --disable-vmnet) printf "%s" -Dvmnet=disabled ;;
     --enable-vhost-user-blk-server) printf "%s" -Dvhost_user_blk_server=enabled ;;
     --disable-vhost-user-blk-server) printf "%s" -Dvhost_user_blk_server=disabled ;;
     --enable-virglrenderer) printf "%s" -Dvirglrenderer=enabled ;;
-- 
2.7.4

From: Vladislav Yaroshchuk <yaroshchuk2000@gmail.com>

Create separate netdevs for each vmnet operating mode:
- vmnet-host
- vmnet-shared
- vmnet-bridged

Signed-off-by: Vladislav Yaroshchuk <yaroshchuk2000@gmail.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/clients.h       |  11 +++++
 net/meson.build     |   7 +++
 net/net.c           |  10 ++++
 net/vmnet-bridged.m |  25 ++++++++++
 net/vmnet-common.m  |  19 ++++++++
 net/vmnet-host.c    |  24 ++++++++++
 net/vmnet-shared.c  |  25 ++++++++++
 net/vmnet_int.h     |  25 ++++++++++
 qapi/net.json       | 133 +++++++++++++++++++++++++++++++++++++++++++++++++++-
 9 files changed, 277 insertions(+), 2 deletions(-)
 create mode 100644 net/vmnet-bridged.m
 create mode 100644 net/vmnet-common.m
 create mode 100644 net/vmnet-host.c
 create mode 100644 net/vmnet-shared.c
 create mode 100644 net/vmnet_int.h

diff --git a/net/clients.h b/net/clients.h
index XXXXXXX..XXXXXXX 100644
--- a/net/clients.h
+++ b/net/clients.h
@@ -XXX,XX +XXX,XX @@ int net_init_vhost_user(const Netdev *netdev, const char *name,
 
 int net_init_vhost_vdpa(const Netdev *netdev, const char *name,
                         NetClientState *peer, Error **errp);
+#ifdef CONFIG_VMNET
+int net_init_vmnet_host(const Netdev *netdev, const char *name,
+                          NetClientState *peer, Error **errp);
+
+int net_init_vmnet_shared(const Netdev *netdev, const char *name,
+                          NetClientState *peer, Error **errp);
+
+int net_init_vmnet_bridged(const Netdev *netdev, const char *name,
+                          NetClientState *peer, Error **errp);
+#endif /* CONFIG_VMNET */
+
 #endif /* QEMU_NET_CLIENTS_H */
diff --git a/net/meson.build b/net/meson.build
index XXXXXXX..XXXXXXX 100644
--- a/net/meson.build
+++ b/net/meson.build
@@ -XXX,XX +XXX,XX @@ softmmu_ss.add(when: 'CONFIG_POSIX', if_true: files(tap_posix))
 softmmu_ss.add(when: 'CONFIG_WIN32', if_true: files('tap-win32.c'))
 softmmu_ss.add(when: 'CONFIG_VHOST_NET_VDPA', if_true: files('vhost-vdpa.c'))
 
+vmnet_files = files(
+  'vmnet-common.m',
+  'vmnet-bridged.m',
+  'vmnet-host.c',
+  'vmnet-shared.c'
+)
+softmmu_ss.add(when: vmnet, if_true: vmnet_files)
 subdir('can')
diff --git a/net/net.c b/net/net.c
index XXXXXXX..XXXXXXX 100644
--- a/net/net.c
+++ b/net/net.c
@@ -XXX,XX +XXX,XX @@ static int (* const net_client_init_fun[NET_CLIENT_DRIVER__MAX])(
 #ifdef CONFIG_L2TPV3
         [NET_CLIENT_DRIVER_L2TPV3]    = net_init_l2tpv3,
 #endif
+#ifdef CONFIG_VMNET
+        [NET_CLIENT_DRIVER_VMNET_HOST] = net_init_vmnet_host,
+        [NET_CLIENT_DRIVER_VMNET_SHARED] = net_init_vmnet_shared,
+        [NET_CLIENT_DRIVER_VMNET_BRIDGED] = net_init_vmnet_bridged,
+#endif /* CONFIG_VMNET */
 };
 
 
@@ -XXX,XX +XXX,XX @@ void show_netdevs(void)
 #ifdef CONFIG_VHOST_VDPA
         "vhost-vdpa",
 #endif
+#ifdef CONFIG_VMNET
+        "vmnet-host",
+        "vmnet-shared",
+        "vmnet-bridged",
+#endif
     };
 
     qemu_printf("Available netdev backend types:\n");
diff --git a/net/vmnet-bridged.m b/net/vmnet-bridged.m
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/net/vmnet-bridged.m
@@ -XXX,XX +XXX,XX @@
+/*
+ * vmnet-bridged.m
+ *
+ * Copyright(c) 2021 Vladislav Yaroshchuk <yaroshchuk2000@gmail.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ *
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/qapi-types-net.h"
+#include "vmnet_int.h"
+#include "clients.h"
+#include "qemu/error-report.h"
+#include "qapi/error.h"
+
+#include <vmnet/vmnet.h>
+
+int net_init_vmnet_bridged(const Netdev *netdev, const char *name,
+                           NetClientState *peer, Error **errp)
+{
+  error_setg(errp, "vmnet-bridged is not implemented yet");
+  return -1;
+}
diff --git a/net/vmnet-common.m b/net/vmnet-common.m
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/net/vmnet-common.m
@@ -XXX,XX +XXX,XX @@
+/*
+ * vmnet-common.m - network client wrapper for Apple vmnet.framework
+ *
+ * Copyright(c) 2021 Vladislav Yaroshchuk <yaroshchuk2000@gmail.com>
+ * Copyright(c) 2021 Phillip Tennen <phillip@axleos.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ *
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/qapi-types-net.h"
+#include "vmnet_int.h"
+#include "clients.h"
+#include "qemu/error-report.h"
+#include "qapi/error.h"
+
+#include <vmnet/vmnet.h>
diff --git a/net/vmnet-host.c b/net/vmnet-host.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/net/vmnet-host.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * vmnet-host.c
+ *
+ * Copyright(c) 2021 Vladislav Yaroshchuk <yaroshchuk2000@gmail.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ *
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/qapi-types-net.h"
+#include "vmnet_int.h"
+#include "clients.h"
+#include "qemu/error-report.h"
+#include "qapi/error.h"
+
+#include <vmnet/vmnet.h>
+
+int net_init_vmnet_host(const Netdev *netdev, const char *name,
+                        NetClientState *peer, Error **errp) {
+  error_setg(errp, "vmnet-host is not implemented yet");
+  return -1;
+}
diff --git a/net/vmnet-shared.c b/net/vmnet-shared.c
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/net/vmnet-shared.c
@@ -XXX,XX +XXX,XX @@
+/*
+ * vmnet-shared.c
+ *
+ * Copyright(c) 2021 Vladislav Yaroshchuk <yaroshchuk2000@gmail.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ *
+ */
+
+#include "qemu/osdep.h"
+#include "qapi/qapi-types-net.h"
+#include "vmnet_int.h"
+#include "clients.h"
+#include "qemu/error-report.h"
+#include "qapi/error.h"
+
+#include <vmnet/vmnet.h>
+
+int net_init_vmnet_shared(const Netdev *netdev, const char *name,
+                          NetClientState *peer, Error **errp)
+{
+  error_setg(errp, "vmnet-shared is not implemented yet");
+  return -1;
+}
diff --git a/net/vmnet_int.h b/net/vmnet_int.h
new file mode 100644
index XXXXXXX..XXXXXXX
--- /dev/null
+++ b/net/vmnet_int.h
@@ -XXX,XX +XXX,XX @@
+/*
+ * vmnet_int.h
+ *
+ * Copyright(c) 2021 Vladislav Yaroshchuk <yaroshchuk2000@gmail.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ *
+ */
+#ifndef VMNET_INT_H
+#define VMNET_INT_H
+
+#include "qemu/osdep.h"
+#include "vmnet_int.h"
+#include "clients.h"
+
+#include <vmnet/vmnet.h>
+
+typedef struct VmnetCommonState {
+  NetClientState nc;
+
+} VmnetCommonState;
+
+
+#endif /* VMNET_INT_H */
diff --git a/qapi/net.json b/qapi/net.json
index XXXXXXX..XXXXXXX 100644
--- a/qapi/net.json
+++ b/qapi/net.json
@@ -XXX,XX +XXX,XX @@
     '*queues':       'int' } }
 
 ##
+# @NetdevVmnetHostOptions:
+#
+# vmnet (host mode) network backend.
+#
+# Allows the vmnet interface to communicate with other vmnet
+# interfaces that are in host mode and also with the host.
+#
+# @start-address: The starting IPv4 address to use for the interface.
+#                 Must be in the private IP range (RFC 1918). Must be
+#                 specified along with @end-address and @subnet-mask.
+#                 This address is used as the gateway address. The
+#                 subsequent address up to and including end-address are
+#                 placed in the DHCP pool.
+#
+# @end-address: The DHCP IPv4 range end address to use for the
+#               interface. Must be in the private IP range (RFC 1918).
+#               Must be specified along with @start-address and
+#               @subnet-mask.
+#
+# @subnet-mask: The IPv4 subnet mask to use on the interface. Must
+#               be specified along with @start-address and @subnet-mask.
+#
+# @isolated: Enable isolation for this interface. Interface isolation
+#            ensures that vmnet interface is not able to communicate
+#            with any other vmnet interfaces. Only communication with
+#            host is allowed. Available since macOS Big Sur 11.0.
+#
+# @net-uuid: The identifier (UUID) to uniquely identify the isolated
+#            network vmnet interface should be added to. If
+#            set, no DHCP service is provided for this interface and
+#            network communication is allowed only with other interfaces
+#            added to this network identified by the UUID. Available
+#            since macOS Big Sur 11.0.
+#
+# Since: 7.0
+##
+{ 'struct': 'NetdevVmnetHostOptions',
+  'data': {
+    '*start-address': 'str',
+    '*end-address':   'str',
+    '*subnet-mask':   'str',
+    '*isolated':      'bool',
+    '*net-uuid':      'str' },
+  'if': 'CONFIG_VMNET' }
+
+##
+# @NetdevVmnetSharedOptions:
+#
+# vmnet (shared mode) network backend.
+#
+# Allows traffic originating from the vmnet interface to reach the
+# Internet through a network address translator (NAT).
+# The vmnet interface can communicate with the host and with
+# other shared mode interfaces on the same subnet. If no DHCP
+# settings, subnet mask and IPv6 prefix specified, the interface can
+# communicate with any of other interfaces in shared mode.
+#
+# @start-address: The starting IPv4 address to use for the interface.
+#                 Must be in the private IP range (RFC 1918). Must be
+#                 specified along with @end-address and @subnet-mask.
+#                 This address is used as the gateway address. The
+#                 subsequent address up to and including end-address are
+#                 placed in the DHCP pool.
+#
+# @end-address: The DHCP IPv4 range end address to use for the
+#               interface. Must be in the private IP range (RFC 1918).
+#               Must be specified along with @start-address and @subnet-mask.
+#
+# @subnet-mask: The IPv4 subnet mask to use on the interface. Must
+#                be specified along with @start-address and @subnet-mask.
+#
+# @isolated: Enable isolation for this interface. Interface isolation
+#            ensures that vmnet interface is not able to communicate
+#            with any other vmnet interfaces. Only communication with
+#            host is allowed. Available since macOS Big Sur 11.0.
+#
+# @nat66-prefix: The IPv6 prefix to use into guest network. Must be a
+#                unique local address i.e. start with fd00::/8 and have
+#                length of 64.
+#
+# Since: 7.0
+##
+{ 'struct': 'NetdevVmnetSharedOptions',
+  'data': {
+    '*start-address': 'str',
+    '*end-address':   'str',
+    '*subnet-mask':   'str',
+    '*isolated':      'bool',
+    '*nat66-prefix':  'str' },
+  'if': 'CONFIG_VMNET' }
+
+##
+# @NetdevVmnetBridgedOptions:
+#
+# vmnet (bridged mode) network backend.
+#
+# Bridges the vmnet interface with a physical network interface.
+#
+# @ifname: The name of the physical interface to be bridged.
+#
+# @isolated: Enable isolation for this interface. Interface isolation
+#            ensures that vmnet interface is not able to communicate
+#            with any other vmnet interfaces. Only communication with
+#            host is allowed. Available since macOS Big Sur 11.0.
+#
+# Since: 7.0
+##
+{ 'struct': 'NetdevVmnetBridgedOptions',
+  'data': {
+    'ifname':     'str',
+    '*isolated':  'bool' },
+  'if': 'CONFIG_VMNET' }
+
+##
 # @NetClientDriver:
 #
 # Available netdev drivers.
@@ -XXX,XX +XXX,XX @@
 # Since: 2.7
 #
 #        @vhost-vdpa since 5.1
+#        @vmnet-host since 7.0
+#        @vmnet-shared since 7.0
+#        @vmnet-bridged since 7.0
 ##
 { 'enum': 'NetClientDriver',
   'data': [ 'none', 'nic', 'user', 'tap', 'l2tpv3', 'socket', 'vde',
-            'bridge', 'hubport', 'netmap', 'vhost-user', 'vhost-vdpa' ] }
+            'bridge', 'hubport', 'netmap', 'vhost-user', 'vhost-vdpa',
+            { 'name': 'vmnet-host', 'if': 'CONFIG_VMNET' },
+            { 'name': 'vmnet-shared', 'if': 'CONFIG_VMNET' },
+            { 'name': 'vmnet-bridged', 'if': 'CONFIG_VMNET' }] }
 
 ##
 # @Netdev:
@@ -XXX,XX +XXX,XX @@
 # Since: 1.2
 #
 #        'l2tpv3' - since 2.1
+#        'vmnet-host' - since 7.0
+#        'vmnet-shared' - since 7.0
+#        'vmnet-bridged' - since 7.0
 ##
 { 'union': 'Netdev',
   'base': { 'id': 'str', 'type': 'NetClientDriver' },
@@ -XXX,XX +XXX,XX @@
     'hubport':  'NetdevHubPortOptions',
     'netmap':   'NetdevNetmapOptions',
     'vhost-user': 'NetdevVhostUserOptions',
-    'vhost-vdpa': 'NetdevVhostVDPAOptions' } }
+    'vhost-vdpa': 'NetdevVhostVDPAOptions',
+    'vmnet-host': { 'type': 'NetdevVmnetHostOptions',
+                    'if': 'CONFIG_VMNET' },
+    'vmnet-shared': { 'type': 'NetdevVmnetSharedOptions',
+                      'if': 'CONFIG_VMNET' },
+    'vmnet-bridged': { 'type': 'NetdevVmnetBridgedOptions',
+                       'if': 'CONFIG_VMNET' } } }
 
 ##
 # @RxState:
-- 
2.7.4

From: Vladislav Yaroshchuk <yaroshchuk2000@gmail.com>

Interaction with vmnet.framework in different modes
differs only on configuration stage, so we can create
common `send`, `receive`, etc. procedures and reuse them.

vmnet.framework supports iov, but writing more than
one iov into vmnet interface fails with
'VMNET_INVALID_ARGUMENT'. Collecting provided iovs into
one and passing it to vmnet works fine. That's the
reason why receive_iov() left unimplemented. But it still
works with good enough performance having .receive()
implemented only.

Also, there is no way to unsubscribe from vmnet packages
receiving except registering and unregistering event
callback or simply drop packages just ignoring and
not processing them when related flag is set. Here we do
using the second way.

Signed-off-by: Phillip Tennen <phillip@axleos.com>
Signed-off-by: Vladislav Yaroshchuk <yaroshchuk2000@gmail.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/vmnet-common.m | 314 +++++++++++++++++++++++++++++++++++++++++++++++++++++
 net/vmnet-shared.c |  83 +++++++++++++-
 net/vmnet_int.h    |  23 ++++
 3 files changed, 416 insertions(+), 4 deletions(-)

diff --git a/net/vmnet-common.m b/net/vmnet-common.m
index XXXXXXX..XXXXXXX 100644
--- a/net/vmnet-common.m
+++ b/net/vmnet-common.m
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/main-loop.h"
+#include "qemu/log.h"
 #include "qapi/qapi-types-net.h"
 #include "vmnet_int.h"
 #include "clients.h"
@@ -XXX,XX +XXX,XX @@
 #include "qapi/error.h"
 
 #include <vmnet/vmnet.h>
+#include <dispatch/dispatch.h>
+
+#ifdef DEBUG
+#define D(x) x
+#define D_LOG(...) qemu_log(__VA_ARGS__)
+#else
+#define D(x) do { } while (0)
+#define D_LOG(...) do { } while (0)
+#endif
+
+typedef struct vmpktdesc vmpktdesc_t;
+typedef struct iovec iovec_t;
+
+static void vmnet_set_send_enabled(VmnetCommonState *s, bool enable)
+{
+    s->send_enabled = enable;
+}
+
+
+static void vmnet_send_completed(NetClientState *nc, ssize_t len)
+{
+    VmnetCommonState *s = DO_UPCAST(VmnetCommonState, nc, nc);
+    vmnet_set_send_enabled(s, true);
+}
+
+
+static void vmnet_send(NetClientState *nc,
+                       interface_event_t event_id,
+                       xpc_object_t event)
+{
+    assert(event_id == VMNET_INTERFACE_PACKETS_AVAILABLE);
+
+    VmnetCommonState *s;
+    uint64_t packets_available;
+
+    struct iovec *iov;
+    struct vmpktdesc *packets;
+    int pkt_cnt;
+    int i;
+
+    vmnet_return_t if_status;
+    ssize_t size;
+
+    s = DO_UPCAST(VmnetCommonState, nc, nc);
+
+    packets_available = xpc_dictionary_get_uint64(
+        event,
+        vmnet_estimated_packets_available_key
+    );
+
+    pkt_cnt = (packets_available < VMNET_PACKETS_LIMIT) ?
+              packets_available :
+              VMNET_PACKETS_LIMIT;
+
+
+    iov = s->iov_buf;
+    packets = s->packets_buf;
+
+    for (i = 0; i < pkt_cnt; ++i) {
+        packets[i].vm_pkt_size = s->max_packet_size;
+        packets[i].vm_pkt_iovcnt = 1;
+        packets[i].vm_flags = 0;
+    }
+
+    if_status = vmnet_read(s->vmnet_if, packets, &pkt_cnt);
+    if (if_status != VMNET_SUCCESS) {
+        error_printf("vmnet: read failed: %s\n",
+                     vmnet_status_map_str(if_status));
+    }
+    qemu_mutex_lock_iothread();
+    for (i = 0; i < pkt_cnt; ++i) {
+        size = qemu_send_packet_async(nc,
+                                      iov[i].iov_base,
+                                      packets[i].vm_pkt_size,
+                                      vmnet_send_completed);
+        if (size == 0) {
+            vmnet_set_send_enabled(s, false);
+        } else if (size < 0) {
+            break;
+        }
+    }
+    qemu_mutex_unlock_iothread();
+
+}
+
+
+static void vmnet_register_event_callback(VmnetCommonState *s)
+{
+    dispatch_queue_t avail_pkt_q = dispatch_queue_create(
+        "org.qemu.vmnet.if_queue",
+        DISPATCH_QUEUE_SERIAL
+    );
+
+    vmnet_interface_set_event_callback(
+        s->vmnet_if,
+        VMNET_INTERFACE_PACKETS_AVAILABLE,
+        avail_pkt_q,
+        ^(interface_event_t event_id, xpc_object_t event) {
+          if (s->send_enabled) {
+              vmnet_send(&s->nc, event_id, event);
+          }
+        });
+}
+
+
+static void vmnet_bufs_init(VmnetCommonState *s)
+{
+    int i;
+    struct vmpktdesc *packets;
+    struct iovec *iov;
+
+    packets = s->packets_buf;
+    iov = s->iov_buf;
+
+    for (i = 0; i < VMNET_PACKETS_LIMIT; ++i) {
+        iov[i].iov_len = s->max_packet_size;
+        iov[i].iov_base = g_malloc0(iov[i].iov_len);
+        packets[i].vm_pkt_iov = iov + i;
+    }
+}
+
+
+const char *vmnet_status_map_str(vmnet_return_t status)
+{
+    switch (status) {
+    case VMNET_SUCCESS:
+        return "success";
+    case VMNET_FAILURE:
+        return "general failure";
+    case VMNET_MEM_FAILURE:
+        return "memory allocation failure";
+    case VMNET_INVALID_ARGUMENT:
+        return "invalid argument specified";
+    case VMNET_SETUP_INCOMPLETE:
+        return "interface setup is not complete";
+    case VMNET_INVALID_ACCESS:
+        return "invalid access, permission denied";
+    case VMNET_PACKET_TOO_BIG:
+        return "packet size is larger than MTU";
+    case VMNET_BUFFER_EXHAUSTED:
+        return "buffers exhausted in kernel";
+    case VMNET_TOO_MANY_PACKETS:
+        return "packet count exceeds limit";
+#if defined(MAC_OS_VERSION_11_0) && \
+    MAC_OS_X_VERSION_MIN_REQUIRED >= MAC_OS_VERSION_11_0
+    case VMNET_SHARING_SERVICE_BUSY:
+        return "conflict, sharing service is in use";
+#endif
+    default:
+        return "unknown vmnet error";
+    }
+}
+
+
+int vmnet_if_create(NetClientState *nc,
+                    xpc_object_t if_desc,
+                    Error **errp,
+                    void (*completion_callback)(xpc_object_t interface_param))
+{
+    VmnetCommonState *s;
+
+    dispatch_queue_t if_create_q;
+    dispatch_semaphore_t if_created_sem;
+
+    __block vmnet_return_t if_status;
+
+    if_create_q = dispatch_queue_create("org.qemu.vmnet.create",
+                                        DISPATCH_QUEUE_SERIAL);
+    if_created_sem = dispatch_semaphore_create(0);
+
+    xpc_dictionary_set_bool(
+        if_desc,
+        vmnet_allocate_mac_address_key,
+        false
+    );
+
+    D(D_LOG("vmnet.start.interface_desc:\n");
+    xpc_dictionary_apply(if_desc,
+                         ^bool(const char *k, xpc_object_t v) {
+                           char *desc = xpc_copy_description(v);
+                           D_LOG("  %s=%s\n", k, desc);
+                           free(desc);
+                           return true;
+                         }));
+
+    s = DO_UPCAST(VmnetCommonState, nc, nc);
+    s->vmnet_if = vmnet_start_interface(
+        if_desc,
+        if_create_q,
+        ^(vmnet_return_t status, xpc_object_t interface_param) {
+          if_status = status;
+          if (status != VMNET_SUCCESS || !interface_param) {
+              dispatch_semaphore_signal(if_created_sem);
+              return;
+          }
+
+          D(D_LOG("vmnet.start.interface_param:\n");
+                xpc_dictionary_apply(interface_param,
+                                     ^bool(const char *k, xpc_object_t v) {
+                                       char *desc = xpc_copy_description(v);
+                                       D_LOG("  %s=%s\n", k, desc);
+                                       free(desc);
+                                       return true;
+                                     }));
+
+          s->mtu = xpc_dictionary_get_uint64(
+              interface_param,
+              vmnet_mtu_key);
+          s->max_packet_size = xpc_dictionary_get_uint64(
+              interface_param,
+              vmnet_max_packet_size_key);
+
+          if (completion_callback) {
+              completion_callback(interface_param);
+          }
+          dispatch_semaphore_signal(if_created_sem);
+        });
+
+    if (s->vmnet_if == NULL) {
+        error_setg(errp, "unable to create interface with requested params");
+        return -1;
+    }
+
+    dispatch_semaphore_wait(if_created_sem, DISPATCH_TIME_FOREVER);
+    dispatch_release(if_create_q);
+
+    if (if_status != VMNET_SUCCESS) {
+        error_setg(errp,
+                   "cannot create vmnet interface: %s",
+                   vmnet_status_map_str(if_status));
+        return -1;
+    }
+
+    vmnet_register_event_callback(s);
+    vmnet_bufs_init(s);
+    vmnet_set_send_enabled(s, true);
+
+    return 0;
+}
+
+
+ssize_t vmnet_receive_common(NetClientState *nc,
+                             const uint8_t *buf,
+                             size_t size)
+{
+    VmnetCommonState *s;
+    vmpktdesc_t packet;
+    iovec_t iov;
+    int pkt_cnt;
+    vmnet_return_t if_status;
+
+    s = DO_UPCAST(VmnetCommonState, nc, nc);
+
+    if (size > s->max_packet_size) {
+        warn_report("vmnet: packet is too big, %zu > %llu\n",
+                    packet.vm_pkt_size,
+                    s->max_packet_size);
+        return -1;
+    }
+
+    iov.iov_base = (char *) buf;
+    iov.iov_len = size;
+
+    packet.vm_pkt_iovcnt = 1;
+    packet.vm_flags = 0;
+    packet.vm_pkt_size = size;
+    packet.vm_pkt_iov = &iov;
+
+    pkt_cnt = 1;
+    if_status = vmnet_write(s->vmnet_if, &packet, &pkt_cnt);
+
+    if (if_status != VMNET_SUCCESS) {
+        error_report("vmnet: write error: %s\n",
+                     vmnet_status_map_str(if_status));
+    }
+
+    if (if_status == VMNET_SUCCESS && pkt_cnt) {
+        return size;
+    }
+    return 0;
+}
+
+
+void vmnet_cleanup_common(NetClientState *nc)
+{
+    VmnetCommonState *s;
+    dispatch_queue_t if_destroy_q;
+
+    s = DO_UPCAST(VmnetCommonState, nc, nc);
+
+    qemu_purge_queued_packets(nc);
+    vmnet_set_send_enabled(s, false);
+
+    if (s->vmnet_if == NULL) {
+        return;
+    }
+
+    if_destroy_q = dispatch_queue_create(
+        "org.qemu.vmnet.destroy",
+        DISPATCH_QUEUE_SERIAL
+    );
+
+    vmnet_stop_interface(
+        s->vmnet_if,
+        if_destroy_q,
+        ^(vmnet_return_t status) {
+        });
+
+    for (int i = 0; i < VMNET_PACKETS_LIMIT; ++i) {
+        g_free(s->iov_buf[i].iov_base);
+    }
+}
diff --git a/net/vmnet-shared.c b/net/vmnet-shared.c
index XXXXXXX..XXXXXXX 100644
--- a/net/vmnet-shared.c
+++ b/net/vmnet-shared.c
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "qapi/qapi-types-net.h"
+#include "qapi/error.h"
 #include "vmnet_int.h"
 #include "clients.h"
-#include "qemu/error-report.h"
-#include "qapi/error.h"
 
 #include <vmnet/vmnet.h>
 
+typedef struct VmnetSharedState {
+  VmnetCommonState cs;
+} VmnetSharedState;
+
+
+static xpc_object_t create_if_desc(const Netdev *netdev, Error **errp)
+{
+    const NetdevVmnetSharedOptions *options = &(netdev->u.vmnet_shared);
+    xpc_object_t if_desc = xpc_dictionary_create(NULL, NULL, 0);
+
+    xpc_dictionary_set_uint64(
+        if_desc,
+        vmnet_operation_mode_key,
+        VMNET_SHARED_MODE
+    );
+
+#if defined(MAC_OS_VERSION_11_0) && \
+    MAC_OS_X_VERSION_MIN_REQUIRED >= MAC_OS_VERSION_11_0
+    xpc_dictionary_set_bool(
+        if_desc,
+        vmnet_enable_isolation_key,
+        options->isolated
+    );
+#else
+    if (options->has_isolated) {
+        error_setg(errp,
+                   "vmnet-shared.isolated feature is "
+                   "unavailable: outdated vmnet.framework API");
+    }
+#endif
+
+    if (options->has_nat66_prefix) {
+        xpc_dictionary_set_string(if_desc,
+                                  vmnet_nat66_prefix_key,
+                                  options->nat66_prefix);
+    }
+
+    if (options->has_start_address ||
+        options->has_end_address ||
+        options->has_subnet_mask) {
+
+        if (options->has_start_address &&
+            options->has_end_address &&
+            options->has_subnet_mask) {
+
+            xpc_dictionary_set_string(if_desc,
+                                      vmnet_start_address_key,
+                                      options->start_address);
+            xpc_dictionary_set_string(if_desc,
+                                      vmnet_end_address_key,
+                                      options->end_address);
+            xpc_dictionary_set_string(if_desc,
+                                      vmnet_subnet_mask_key,
+                                      options->subnet_mask);
+        } else {
+            error_setg(
+                errp,
+                "'start-address', 'end-address', 'subnet-mask' "
+                "should be provided together"
+            );
+        }
+    }
+
+    return if_desc;
+}
+
+static NetClientInfo net_vmnet_shared_info = {
+    .type = NET_CLIENT_DRIVER_VMNET_SHARED,
+    .size = sizeof(VmnetSharedState),
+    .receive = vmnet_receive_common,
+    .cleanup = vmnet_cleanup_common,
+};
+
 int net_init_vmnet_shared(const Netdev *netdev, const char *name,
                           NetClientState *peer, Error **errp)
 {
-  error_setg(errp, "vmnet-shared is not implemented yet");
-  return -1;
+    NetClientState *nc = qemu_new_net_client(&net_vmnet_shared_info,
+                                             peer, "vmnet-shared", name);
+    xpc_object_t if_desc = create_if_desc(netdev, errp);
+
+    return vmnet_if_create(nc, if_desc, errp, NULL);
 }
diff --git a/net/vmnet_int.h b/net/vmnet_int.h
index XXXXXXX..XXXXXXX 100644
--- a/net/vmnet_int.h
+++ b/net/vmnet_int.h
@@ -XXX,XX +XXX,XX @@
 
 #include <vmnet/vmnet.h>
 
+#define VMNET_PACKETS_LIMIT 50
+
 typedef struct VmnetCommonState {
   NetClientState nc;
+  interface_ref vmnet_if;
+
+  bool send_enabled;
+
+  uint64_t mtu;
+  uint64_t max_packet_size;
+
+  struct vmpktdesc packets_buf[VMNET_PACKETS_LIMIT];
+  struct iovec iov_buf[VMNET_PACKETS_LIMIT];
 
 } VmnetCommonState;
 
+const char *vmnet_status_map_str(vmnet_return_t status);
+
+int vmnet_if_create(NetClientState *nc,
+                    xpc_object_t if_desc,
+                    Error **errp,
+                    void (*completion_callback)(xpc_object_t interface_param));
+
+ssize_t vmnet_receive_common(NetClientState *nc,
+                             const uint8_t *buf,
+                             size_t size);
+
+void vmnet_cleanup_common(NetClientState *nc);
 
 #endif /* VMNET_INT_H */
-- 
2.7.4

From: Vladislav Yaroshchuk <yaroshchuk2000@gmail.com>

Signed-off-by: Vladislav Yaroshchuk <yaroshchuk2000@gmail.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/vmnet-host.c | 110 ++++++++++++++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 104 insertions(+), 6 deletions(-)

diff --git a/net/vmnet-host.c b/net/vmnet-host.c
index XXXXXXX..XXXXXXX 100644
--- a/net/vmnet-host.c
+++ b/net/vmnet-host.c
@@ -XXX,XX +XXX,XX @@
  */
 
 #include "qemu/osdep.h"
+#include "qemu/uuid.h"
 #include "qapi/qapi-types-net.h"
-#include "vmnet_int.h"
-#include "clients.h"
-#include "qemu/error-report.h"
 #include "qapi/error.h"
+#include "clients.h"
+#include "vmnet_int.h"
 
 #include <vmnet/vmnet.h>
 
+typedef struct VmnetHostState {
+  VmnetCommonState cs;
+  QemuUUID network_uuid;
+} VmnetHostState;
+
+static xpc_object_t create_if_desc(const Netdev *netdev,
+                                   NetClientState *nc,
+                                   Error **errp)
+{
+    const NetdevVmnetHostOptions *options = &(netdev->u.vmnet_host);
+
+    xpc_object_t if_desc = xpc_dictionary_create(NULL, NULL, 0);
+
+    xpc_dictionary_set_uint64(
+        if_desc,
+        vmnet_operation_mode_key,
+        VMNET_HOST_MODE
+    );
+
+#if defined(MAC_OS_VERSION_11_0) && \
+    MAC_OS_X_VERSION_MIN_REQUIRED >= MAC_OS_VERSION_11_0
+
+    VmnetCommonState *cs = DO_UPCAST(VmnetCommonState, nc, nc);
+    VmnetHostState *hs = DO_UPCAST(VmnetHostState, cs, cs);
+
+    xpc_dictionary_set_bool(
+        if_desc,
+        vmnet_enable_isolation_key,
+        options->isolated
+    );
+
+    if (options->has_net_uuid) {
+        if (qemu_uuid_parse(options->net_uuid, &hs->network_uuid) < 0) {
+            error_setg(errp, "Invalid UUID provided in 'net-uuid'");
+        }
+
+        xpc_dictionary_set_uuid(
+            if_desc,
+            vmnet_network_identifier_key,
+            hs->network_uuid.data
+        );
+    }
+#else
+    if (options->has_isolated) {
+        error_setg(errp,
+                   "vmnet-host.isolated feature is "
+                   "unavailable: outdated vmnet.framework API");
+    }
+
+    if (options->has_net_uuid) {
+        error_setg(errp,
+                   "vmnet-host.net-uuid feature is "
+                   "unavailable: outdated vmnet.framework API");
+    }
+#endif
+
+    if (options->has_start_address ||
+        options->has_end_address ||
+        options->has_subnet_mask) {
+
+        if (options->has_start_address &&
+            options->has_end_address &&
+            options->has_subnet_mask) {
+
+            xpc_dictionary_set_string(if_desc,
+                                      vmnet_start_address_key,
+                                      options->start_address);
+            xpc_dictionary_set_string(if_desc,
+                                      vmnet_end_address_key,
+                                      options->end_address);
+            xpc_dictionary_set_string(if_desc,
+                                      vmnet_subnet_mask_key,
+                                      options->subnet_mask);
+        } else {
+            error_setg(
+                errp,
+                "'start-address', 'end-address', 'subnet-mask' "
+                "should be provided together"
+            );
+        }
+    }
+
+    return if_desc;
+}
+
+static NetClientInfo net_vmnet_host_info = {
+    .type = NET_CLIENT_DRIVER_VMNET_HOST,
+    .size = sizeof(VmnetHostState),
+    .receive = vmnet_receive_common,
+    .cleanup = vmnet_cleanup_common,
+};
+
 int net_init_vmnet_host(const Netdev *netdev, const char *name,
-                        NetClientState *peer, Error **errp) {
-  error_setg(errp, "vmnet-host is not implemented yet");
-  return -1;
+                        NetClientState *peer, Error **errp)
+{
+    NetClientState *nc;
+    xpc_object_t if_desc;
+
+    nc = qemu_new_net_client(&net_vmnet_host_info,
+                             peer, "vmnet-host", name);
+    if_desc = create_if_desc(netdev, nc, errp);
+    return vmnet_if_create(nc, if_desc, errp, NULL);
 }
-- 
2.7.4

From: Vladislav Yaroshchuk <yaroshchuk2000@gmail.com>

Signed-off-by: Vladislav Yaroshchuk <yaroshchuk2000@gmail.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 net/vmnet-bridged.m | 105 +++++++++++++++++++++++++++++++++++++++++++++++++---
 1 file changed, 100 insertions(+), 5 deletions(-)

diff --git a/net/vmnet-bridged.m b/net/vmnet-bridged.m
index XXXXXXX..XXXXXXX 100644
--- a/net/vmnet-bridged.m
+++ b/net/vmnet-bridged.m
@@ -XXX,XX +XXX,XX @@
 
 #include "qemu/osdep.h"
 #include "qapi/qapi-types-net.h"
-#include "vmnet_int.h"
-#include "clients.h"
-#include "qemu/error-report.h"
 #include "qapi/error.h"
+#include "clients.h"
+#include "vmnet_int.h"
 
 #include <vmnet/vmnet.h>
 
+typedef struct VmnetBridgedState {
+  VmnetCommonState cs;
+} VmnetBridgedState;
+
+static bool validate_ifname(const char *ifname)
+{
+    xpc_object_t shared_if_list = vmnet_copy_shared_interface_list();
+    __block bool match = false;
+
+    xpc_array_apply(
+        shared_if_list,
+        ^bool(size_t index, xpc_object_t value) {
+          if (strcmp(xpc_string_get_string_ptr(value), ifname) == 0) {
+              match = true;
+              return false;
+          }
+          return true;
+        });
+
+    return match;
+}
+
+static const char *get_valid_ifnames(void)
+{
+    xpc_object_t shared_if_list = vmnet_copy_shared_interface_list();
+    __block char *if_list = NULL;
+
+    xpc_array_apply(
+        shared_if_list,
+        ^bool(size_t index, xpc_object_t value) {
+          if_list = g_strconcat(xpc_string_get_string_ptr(value),
+                                " ",
+                                if_list,
+                                NULL);
+          return true;
+        });
+
+    if (if_list) {
+        return if_list;
+    }
+    return "[no interfaces]";
+}
+
+static xpc_object_t create_if_desc(const Netdev *netdev, Error **errp)
+{
+    const NetdevVmnetBridgedOptions *options = &(netdev->u.vmnet_bridged);
+    xpc_object_t if_desc = xpc_dictionary_create(NULL, NULL, 0);
+
+    xpc_dictionary_set_uint64(
+        if_desc,
+        vmnet_operation_mode_key,
+        VMNET_BRIDGED_MODE
+    );
+
+#if defined(MAC_OS_VERSION_11_0) && \
+    MAC_OS_X_VERSION_MIN_REQUIRED >= MAC_OS_VERSION_11_0
+    xpc_dictionary_set_bool(
+        if_desc,
+        vmnet_enable_isolation_key,
+        options->isolated
+    );
+#else
+    if (options->has_isolated) {
+        error_setg(errp,
+                   "vmnet-bridged.isolated feature is "
+                   "unavailable: outdated vmnet.framework API");
+    }
+#endif
+
+    if (validate_ifname(options->ifname)) {
+        xpc_dictionary_set_string(if_desc,
+                                  vmnet_shared_interface_name_key,
+                                  options->ifname);
+    } else {
+        return NULL;
+    }
+    return if_desc;
+}
+
+static NetClientInfo net_vmnet_bridged_info = {
+    .type = NET_CLIENT_DRIVER_VMNET_BRIDGED,
+    .size = sizeof(VmnetBridgedState),
+    .receive = vmnet_receive_common,
+    .cleanup = vmnet_cleanup_common,
+};
+
 int net_init_vmnet_bridged(const Netdev *netdev, const char *name,
                            NetClientState *peer, Error **errp)
 {
-  error_setg(errp, "vmnet-bridged is not implemented yet");
-  return -1;
+    NetClientState *nc = qemu_new_net_client(&net_vmnet_bridged_info,
+                                             peer, "vmnet-bridged", name);
+    xpc_object_t if_desc = create_if_desc(netdev, errp);;
+
+    if (!if_desc) {
+        error_setg(errp,
+                   "unsupported ifname, should be one of: %s",
+                   get_valid_ifnames());
+        return -1;
+    }
+
+    return vmnet_if_create(nc, if_desc, errp, NULL);
 }
-- 
2.7.4

From: Vladislav Yaroshchuk <yaroshchuk2000@gmail.com>

Signed-off-by: Vladislav Yaroshchuk <yaroshchuk2000@gmail.com>
Signed-off-by: Jason Wang <jasowang@redhat.com>
---
 qemu-options.hx | 25 +++++++++++++++++++++++++
 1 file changed, 25 insertions(+)

diff --git a/qemu-options.hx b/qemu-options.hx
index XXXXXXX..XXXXXXX 100644
--- a/qemu-options.hx
+++ b/qemu-options.hx
@@ -XXX,XX +XXX,XX @@ DEF("netdev", HAS_ARG, QEMU_OPTION_netdev,
     "-netdev vhost-vdpa,id=str,vhostdev=/path/to/dev\n"
     "                configure a vhost-vdpa network,Establish a vhost-vdpa netdev\n"
 #endif
+#ifdef CONFIG_VMNET
+    "-netdev vmnet-host,id=str[,isolated=on|off][,net-uuid=uuid]\n"
+    "         [,start-address=addr,end-address=addr,subnet-mask=mask]\n"
+    "                configure a vmnet network backend in host mode with ID 'str',\n"
+    "                isolate this interface from others with 'isolated',\n"
+    "                configure the address range and choose a subnet mask,\n"
+    "                specify network UUID 'uuid' to disable DHCP and interact with\n"
+    "                vmnet-host interfaces within this isolated network\n"
+    "-netdev vmnet-shared,id=str[,isolated=on|off][,nat66-prefix=addr]\n"
+    "         [,start-address=addr,end-address=addr,subnet-mask=mask]\n"
+    "                configure a vmnet network backend in shared mode with ID 'str',\n"
+    "                configure the address range and choose a subnet mask,\n"
+    "                set IPv6 ULA prefix (of length 64) to use for internal network,\n"
+    "                isolate this interface from others with 'isolated'\n"
+    "-netdev vmnet-bridged,id=str,ifname=name[,isolated=on|off]\n"
+    "                configure a vmnet network backend in bridged mode with ID 'str',\n"
+    "                use 'ifname=name' to select a physical network interface to be bridged,\n"
+    "                isolate this interface from others with 'isolated'\n"
+#endif
     "-netdev hubport,id=str,hubid=n[,netdev=nd]\n"
     "                configure a hub port on the hub with ID 'n'\n", QEMU_ARCH_ALL)
 DEF("nic", HAS_ARG, QEMU_OPTION_nic,
@@ -XXX,XX +XXX,XX @@ DEF("nic", HAS_ARG, QEMU_OPTION_nic,
 #ifdef CONFIG_POSIX
     "vhost-user|"
 #endif
+#ifdef CONFIG_VMNET
+    "vmnet-host|vmnet-shared|vmnet-bridged|"
+#endif
     "socket][,option][,...][mac=macaddr]\n"
     "                initialize an on-board / default host NIC (using MAC address\n"
     "                macaddr) and connect it to the given host network backend\n"
@@ -XXX,XX +XXX,XX @@ DEF("net", HAS_ARG, QEMU_OPTION_net,
 #ifdef CONFIG_NETMAP
     "netmap|"
 #endif
+#ifdef CONFIG_VMNET
+    "vmnet-host|vmnet-shared|vmnet-bridged|"
+#endif
     "socket][,option][,option][,...]\n"
     "                old way to initialize a host network interface\n"
     "                (use the -netdev option if possible instead)\n", QEMU_ARCH_ALL)
-- 
2.7.4