diff mbox

[7/7,v5] VMXNET3 paravirtualized device implementation Interface type "vmxnet3" added.

Message ID 1332062822-14342-8-git-send-email-dmitry.fleytman@ravellosystems.com
State New
Headers show

Commit Message

Dmitry Fleytman March 18, 2012, 9:27 a.m. UTC
Signed-off-by: Dmitry Fleytman <dmitry@daynix.com>
Signed-off-by: Yan Vugenfirer <yan@daynix.com>
---
 Makefile.objs           |    1 +
 default-configs/pci.mak |    1 +
 hw/pci.c                |    2 +
 hw/pci.h                |    1 +
 hw/vmxnet3.c            | 2454 +++++++++++++++++++++++++++++++++++++++++++++++
 hw/vmxnet3.h            |  757 +++++++++++++++
 net.c                   |    2 +-
 7 files changed, 3217 insertions(+), 1 deletions(-)
 create mode 100644 hw/vmxnet3.c
 create mode 100644 hw/vmxnet3.h

Comments

Izik Eidus April 4, 2012, 11:44 a.m. UTC | #1
Hi,

What about this patch?, everything that was asked from Dmitry was 
accomplished...
What prevent us from progressing with merging this patch?

Thanks.

On 18/03/2012 11:27, Dmitry Fleytman wrote:
> Signed-off-by: Dmitry Fleytman<dmitry@daynix.com>
> Signed-off-by: Yan Vugenfirer<yan@daynix.com>
> ---
>   Makefile.objs           |    1 +
>   default-configs/pci.mak |    1 +
>   hw/pci.c                |    2 +
>   hw/pci.h                |    1 +
>   hw/vmxnet3.c            | 2454 +++++++++++++++++++++++++++++++++++++++++++++++
>   hw/vmxnet3.h            |  757 +++++++++++++++
>   net.c                   |    2 +-
>   7 files changed, 3217 insertions(+), 1 deletions(-)
>   create mode 100644 hw/vmxnet3.c
>   create mode 100644 hw/vmxnet3.h
>
Michael S. Tsirkin April 4, 2012, 7:39 p.m. UTC | #2
On Wed, Apr 04, 2012 at 02:44:01PM +0300, Izik Eidus wrote:
> Hi,
> 
> What about this patch?, everything that was asked from Dmitry was
> accomplished...
> What prevent us from progressing with merging this patch?
> 
> Thanks.

Off the top of my head: issues with v5:
polluting global namespace, must scope names
appropriately with vmxnet_ VMXNET_ unless they have file scope.
Don't use names with _ followed by an upper case letter
or that star with two underscores. Don't mix underscores and mixed case.
Don't stick any new types in net.c/pci.c - new devices should use -device
not -net. Global stuff like ethernet header size
should move to central place instead of copy paste.


> On 18/03/2012 11:27, Dmitry Fleytman wrote:
> >Signed-off-by: Dmitry Fleytman<dmitry@daynix.com>
> >Signed-off-by: Yan Vugenfirer<yan@daynix.com>
> >---
> >  Makefile.objs           |    1 +
> >  default-configs/pci.mak |    1 +
> >  hw/pci.c                |    2 +
> >  hw/pci.h                |    1 +
> >  hw/vmxnet3.c            | 2454 +++++++++++++++++++++++++++++++++++++++++++++++
> >  hw/vmxnet3.h            |  757 +++++++++++++++
> >  net.c                   |    2 +-
> >  7 files changed, 3217 insertions(+), 1 deletions(-)
> >  create mode 100644 hw/vmxnet3.c
> >  create mode 100644 hw/vmxnet3.h
> >
Gerhard Wiesinger April 5, 2012, 5:25 a.m. UTC | #3
On Wed, 4 Apr 2012, Izik Eidus wrote:
> What about this patch?, everything that was asked from Dmitry was 
> accomplished...
> What prevent us from progressing with merging this patch?

As already discussed on the list patch v5 doesn't work at least for me. 
Previous patches worked better but were not stable under load.

I'm also appreciating a working version and integrating the patch fast.

Ciao,
Gerhard

--
http://www.wiesinger.com/
Yan Vugenfirer April 5, 2012, 8:02 a.m. UTC | #4
On Thu, Apr 5, 2012 at 8:25 AM, Gerhard Wiesinger <lists@wiesinger.com> wrote:
>
> On Wed, 4 Apr 2012, Izik Eidus wrote:
>>
>> What about this patch?, everything that was asked from Dmitry was accomplished...
>> What prevent us from progressing with merging this patch?
>
>
> As already discussed on the list patch v5 doesn't work at least for me. Previous patches worked better but were not stable under load.
>
> I'm also appreciating a working version and integrating the patch fast.
>
> Ciao,
> Gerhard
>
> --
> http://www.wiesinger.com/

Hello Gerhard,

1. I understand that you send your exact command line to Dmitry and
your test scripts, but we cannot reproduce the issues. Can you send us
host network configuration?

2. Is it possible for you to run tcpdump on the guest and on the host
and send us the files for review?

Best regards,
Yan.
Gerhard Wiesinger April 5, 2012, 7 p.m. UTC | #5
On Thu, 5 Apr 2012, Yan Vugenfirer wrote:

> On Thu, Apr 5, 2012 at 8:25 AM, Gerhard Wiesinger <lists@wiesinger.com> wrote:
>>
>> On Wed, 4 Apr 2012, Izik Eidus wrote:
>>>
>>> What about this patch?, everything that was asked from Dmitry was accomplished...
>>> What prevent us from progressing with merging this patch?
>>
>>
>> As already discussed on the list patch v5 doesn't work at least for me. Previous patches worked better but were not stable under load.
>>
>> I'm also appreciating a working version and integrating the patch fast.
>>
>> Ciao,
>> Gerhard
>>
>> --
>> http://www.wiesinger.com/
>
> Hello Gerhard,
>
> 1. I understand that you send your exact command line to Dmitry and
> your test scripts, but we cannot reproduce the issues. Can you send us
> host network configuration?
>
> 2. Is it possible for you to run tcpdump on the guest and on the host
> and send us the files for review?

Since there was no difference for v5 patch, I already sent this for v4 
patch:

See:
https://lists.gnu.org/archive/html/qemu-devel/2012-03/msg04062.html
https://lists.gnu.org/archive/html/qemu-devel/2012-03/msg04634.html

I also sniffed between working NIC (rtl8139) and non working
NIC (vmxnet3) and as already thought in
//lists.gnu.org/archive/html/qemu-devel/2012-03/msg04062.html
TCP offloading checksum is NOT correct.

From wireshark sniff:
Checksum SYN1: 0xe937 [incorrect, should be 0xe936 (maybe caused by "TCP checksum offload"?)]
Checksum SYN2: [incorrect, should be 0xe5af (maybe caused by "TCP checksum offload"?)]
=> checksum is always too high by 1.

Please fix it.

Ciao,
Gerhard

--
http://www.wiesinger.com/
Stefan Hajnoczi April 10, 2012, 3:47 p.m. UTC | #6
On Wed, Apr 4, 2012 at 12:44 PM, Izik Eidus
<izik.eidus@ravellosystems.com> wrote:
> What about this patch?, everything that was asked from Dmitry was
> accomplished...
> What prevent us from progressing with merging this patch?

Hang on, I asked what the point of the VMware paravirt device models
is.  I don't think that was ever answered fully.

I know it makes migration of existing VMware guests easy, but now we
have the burden of maintaining these device models, whose feature set
and performance will never be equivalent to virtio.  The reason is
because we cannot extend the device spec without breaking guests (we
don't control the device specification and therefore cannot add new
features) and we now have twice as much performance optimization work
if we want the same level of performance as virtio devices.

For these reasons, I think that VMware device models can only ever be
2nd class device models in QEMU.  And I wonder if the effort isn't
better invested in good v2v migration tooling instead of adding this
to QEMU.

I'm not strongly against VMware device models in QEMU, I do see the
benefit too, but please explain what the plan here is.

Stefan
Yan Vugenfirer April 11, 2012, 1:38 p.m. UTC | #7
On Tue, Apr 10, 2012 at 6:47 PM, Stefan Hajnoczi <stefanha@gmail.com> wrote:
>
> On Wed, Apr 4, 2012 at 12:44 PM, Izik Eidus
> <izik.eidus@ravellosystems.com> wrote:
> > What about this patch?, everything that was asked from Dmitry was
> > accomplished...
> > What prevent us from progressing with merging this patch?
>
> Hang on, I asked what the point of the VMware paravirt device models
> is.  I don't think that was ever answered fully.
>
> I know it makes migration of existing VMware guests easy, but now we
> have the burden of maintaining these device models, whose feature set
> and performance will never be equivalent to virtio.  The reason is
> because we cannot extend the device spec without breaking guests (we
> don't control the device specification and therefore cannot add new
> features) and we now have twice as much performance optimization work
> if we want the same level of performance as virtio devices.
>
> For these reasons, I think that VMware device models can only ever be
> 2nd class device models in QEMU.  And I wonder if the effort isn't
> better invested in good v2v migration tooling instead of adding this
> to QEMU.
>
> I'm not strongly against VMware device models in QEMU, I do see the
> benefit too, but please explain what the plan here is.
>
> Stefan

In my opinion there is a great opportunity to create painless
migration method from VMWare to QEMU\KVM. You just copy image and run,
no image conversions and no issues with V2V which are painful to debug
to regular person. After VM is already running on top of QEMU -
changing the devices is much easier.
Considering that VMWare "rule" the world more or less - enabling more
people to switch easily or at least to get a taste of QEMU\KVM is a
huge advantage.

Regarding optimization - adding vhost support to VMXNET3 doesn't look
like a huge effort anyway and if you look at the patch you will see
that we are using virtio-net mechanisms in VMXNET3 device (for example
using virtio headers for offloading).

Best regards,
Yan Vugenfirer.
Daniel P. Berrangé April 11, 2012, 1:53 p.m. UTC | #8
On Tue, Apr 10, 2012 at 04:47:19PM +0100, Stefan Hajnoczi wrote:
> On Wed, Apr 4, 2012 at 12:44 PM, Izik Eidus
> <izik.eidus@ravellosystems.com> wrote:
> > What about this patch?, everything that was asked from Dmitry was
> > accomplished...
> > What prevent us from progressing with merging this patch?
> 
> Hang on, I asked what the point of the VMware paravirt device models
> is.  I don't think that was ever answered fully.
> 
> I know it makes migration of existing VMware guests easy, but now we
> have the burden of maintaining these device models, whose feature set
> and performance will never be equivalent to virtio.  The reason is
> because we cannot extend the device spec without breaking guests (we
> don't control the device specification and therefore cannot add new
> features) and we now have twice as much performance optimization work
> if we want the same level of performance as virtio devices.
> 
> For these reasons, I think that VMware device models can only ever be
> 2nd class device models in QEMU.  And I wonder if the effort isn't
> better invested in good v2v migration tooling instead of adding this
> to QEMU.
>
> I'm not strongly against VMware device models in QEMU, I do see the
> benefit too, but please explain what the plan here is.

While I can sort of understand where you're coming from, this does seem
to be inventing new patch acceptance criteria (which VMXNET3 authors have
to satisfy) that haven't generally existed / been applied to any other
device impl submission in the past. AFAICT, QEMU has welcomed / accepted
patches implementing pretty much any hardware device, provided the code
quality was acceptable.

Regards,
Daniel
Stefan Hajnoczi April 11, 2012, 2:21 p.m. UTC | #9
On Wed, Apr 11, 2012 at 2:53 PM, Daniel P. Berrange <berrange@redhat.com> wrote:
> On Tue, Apr 10, 2012 at 04:47:19PM +0100, Stefan Hajnoczi wrote:
>> On Wed, Apr 4, 2012 at 12:44 PM, Izik Eidus
>> <izik.eidus@ravellosystems.com> wrote:
>> > What about this patch?, everything that was asked from Dmitry was
>> > accomplished...
>> > What prevent us from progressing with merging this patch?
>>
>> Hang on, I asked what the point of the VMware paravirt device models
>> is.  I don't think that was ever answered fully.
>>
>> I know it makes migration of existing VMware guests easy, but now we
>> have the burden of maintaining these device models, whose feature set
>> and performance will never be equivalent to virtio.  The reason is
>> because we cannot extend the device spec without breaking guests (we
>> don't control the device specification and therefore cannot add new
>> features) and we now have twice as much performance optimization work
>> if we want the same level of performance as virtio devices.
>>
>> For these reasons, I think that VMware device models can only ever be
>> 2nd class device models in QEMU.  And I wonder if the effort isn't
>> better invested in good v2v migration tooling instead of adding this
>> to QEMU.
>>
>> I'm not strongly against VMware device models in QEMU, I do see the
>> benefit too, but please explain what the plan here is.
>
> While I can sort of understand where you're coming from, this does seem
> to be inventing new patch acceptance criteria (which VMXNET3 authors have
> to satisfy) that haven't generally existed / been applied to any other
> device impl submission in the past. AFAICT, QEMU has welcomed / accepted
> patches implementing pretty much any hardware device, provided the code
> quality was acceptable.

I am not trying to change patch acceptance criteria.  I'm trying to
understand what problem the submitter is trying to solve with these
patches and how they intend to support them in the future.  And I'm
hoping to explain the risk of adding this feature to QEMU.

But as I said, I'm not strongly against them.  I'd just like some
discussion before merge.

Stefan
Stefan Hajnoczi April 11, 2012, 2:48 p.m. UTC | #10
On Wed, Apr 11, 2012 at 2:38 PM, Yan Vugenfirer <yan@daynix.com> wrote:
> On Tue, Apr 10, 2012 at 6:47 PM, Stefan Hajnoczi <stefanha@gmail.com> wrote:
>>
>> On Wed, Apr 4, 2012 at 12:44 PM, Izik Eidus
>> <izik.eidus@ravellosystems.com> wrote:
>> > What about this patch?, everything that was asked from Dmitry was
>> > accomplished...
>> > What prevent us from progressing with merging this patch?
>>
>> Hang on, I asked what the point of the VMware paravirt device models
>> is.  I don't think that was ever answered fully.
>>
>> I know it makes migration of existing VMware guests easy, but now we
>> have the burden of maintaining these device models, whose feature set
>> and performance will never be equivalent to virtio.  The reason is
>> because we cannot extend the device spec without breaking guests (we
>> don't control the device specification and therefore cannot add new
>> features) and we now have twice as much performance optimization work
>> if we want the same level of performance as virtio devices.
>>
>> For these reasons, I think that VMware device models can only ever be
>> 2nd class device models in QEMU.  And I wonder if the effort isn't
>> better invested in good v2v migration tooling instead of adding this
>> to QEMU.
>>
>> I'm not strongly against VMware device models in QEMU, I do see the
>> benefit too, but please explain what the plan here is.
>>
>> Stefan
>
> In my opinion there is a great opportunity to create painless
> migration method from VMWare to QEMU\KVM. You just copy image and run,
> no image conversions and no issues with V2V which are painful to debug
> to regular person. After VM is already running on top of QEMU -
> changing the devices is much easier.
> Considering that VMWare "rule" the world more or less - enabling more
> people to switch easily or at least to get a taste of QEMU\KVM is a
> huge advantage.

The problem with supporting VMware devices in order to ease v2v
migration is that it actually creates a worse user experience in the
long run.

Users will be running devices that are not integrated or supported to
the level that the virtio devices are.  The danger is that we end up
with a bad user experience because users never do the full migration
from VMware to KVM.

We need to get inside the guest to perform full v2v migration (e.g.
install guest agent).  Because of this it seems we might as well
install virtio drivers and migrate the guest at that point.  Letting
the user run the guest before this has been done only results in the
poor experience I've mentioned above.

These are the reasons why I'm not sure this effort will pay off.

What are the steps in the v2v process that you have in mind?

> Regarding optimization - adding vhost support to VMXNET3 doesn't look
> like a huge effort anyway and if you look at the patch you will see
> that we are using virtio-net mechanisms in VMXNET3 device (for example
> using virtio headers for offloading).

When you say vhost support do you mean using the vhost_net.ko
userspace interface from hw/vmxnet3.c?  All I/O emulation would still
go through the QEMU process and that defeats the biggest advantage of
vhost.

Stefan
Anthony Liguori April 11, 2012, 5:25 p.m. UTC | #11
On 04/04/2012 02:39 PM, Michael S. Tsirkin wrote:
> On Wed, Apr 04, 2012 at 02:44:01PM +0300, Izik Eidus wrote:
>> Hi,
>>
>> What about this patch?, everything that was asked from Dmitry was
>> accomplished...
>> What prevent us from progressing with merging this patch?
>>
>> Thanks.
>
> Off the top of my head: issues with v5:
> polluting global namespace, must scope names
> appropriately with vmxnet_ VMXNET_ unless they have file scope.
> Don't use names with _ followed by an upper case letter
> or that star with two underscores. Don't mix underscores and mixed case.
> Don't stick any new types in net.c/pci.c - new devices should use -device
> not -net. Global stuff like ethernet header size
> should move to central place instead of copy paste.

I'd like to see qtest test cases for this too.

Regards,

Anthony Liguori

>
>
>> On 18/03/2012 11:27, Dmitry Fleytman wrote:
>>> Signed-off-by: Dmitry Fleytman<dmitry@daynix.com>
>>> Signed-off-by: Yan Vugenfirer<yan@daynix.com>
>>> ---
>>>   Makefile.objs           |    1 +
>>>   default-configs/pci.mak |    1 +
>>>   hw/pci.c                |    2 +
>>>   hw/pci.h                |    1 +
>>>   hw/vmxnet3.c            | 2454 +++++++++++++++++++++++++++++++++++++++++++++++
>>>   hw/vmxnet3.h            |  757 +++++++++++++++
>>>   net.c                   |    2 +-
>>>   7 files changed, 3217 insertions(+), 1 deletions(-)
>>>   create mode 100644 hw/vmxnet3.c
>>>   create mode 100644 hw/vmxnet3.h
>>>
>
Anthony Liguori April 11, 2012, 5:27 p.m. UTC | #12
On 04/10/2012 10:47 AM, Stefan Hajnoczi wrote:
> On Wed, Apr 4, 2012 at 12:44 PM, Izik Eidus
> <izik.eidus@ravellosystems.com>  wrote:
>> What about this patch?, everything that was asked from Dmitry was
>> accomplished...
>> What prevent us from progressing with merging this patch?
>
> Hang on, I asked what the point of the VMware paravirt device models
> is.  I don't think that was ever answered fully.

As long as the code is high quality and there's a test suite to go along with 
it, I think adding additional device emulation is perfectly fine.

I don't think *inventing* new paravirtual devices is a good idea but this is 
just like someone submitting BNX emulation.  Emulating a wide variety of devices 
is what we do.

Regards,

Anthony Liguori

>
> I know it makes migration of existing VMware guests easy, but now we
> have the burden of maintaining these device models, whose feature set
> and performance will never be equivalent to virtio.  The reason is
> because we cannot extend the device spec without breaking guests (we
> don't control the device specification and therefore cannot add new
> features) and we now have twice as much performance optimization work
> if we want the same level of performance as virtio devices.
>
> For these reasons, I think that VMware device models can only ever be
> 2nd class device models in QEMU.  And I wonder if the effort isn't
> better invested in good v2v migration tooling instead of adding this
> to QEMU.
>
> I'm not strongly against VMware device models in QEMU, I do see the
> benefit too, but please explain what the plan here is.
>
> Stefan
>
Stefan Hajnoczi April 11, 2012, 7:01 p.m. UTC | #13
On Wed, Apr 11, 2012 at 6:27 PM, Anthony Liguori <aliguori@us.ibm.com> wrote:
> On 04/10/2012 10:47 AM, Stefan Hajnoczi wrote:
>>
>> On Wed, Apr 4, 2012 at 12:44 PM, Izik Eidus
>> <izik.eidus@ravellosystems.com>  wrote:
>>>
>>> What about this patch?, everything that was asked from Dmitry was
>>> accomplished...
>>> What prevent us from progressing with merging this patch?
>>
>>
>> Hang on, I asked what the point of the VMware paravirt device models
>> is.  I don't think that was ever answered fully.
>
>
> As long as the code is high quality and there's a test suite to go along
> with it, I think adding additional device emulation is perfectly fine.
>
> I don't think *inventing* new paravirtual devices is a good idea but this is
> just like someone submitting BNX emulation.  Emulating a wide variety of
> devices is what we do.

The discussion I'm trying to get is: how does adding VMware emulated
devices get us closer to solving v2v?

I think the answer is that it doesn't but I'm curious to find out more
about how exactly this fits in to a v2v process.

Stefan
Paolo Bonzini April 11, 2012, 7:08 p.m. UTC | #14
Il 11/04/2012 19:25, Anthony Liguori ha scritto:
>>
>> Off the top of my head: issues with v5:
>> polluting global namespace, must scope names
>> appropriately with vmxnet_ VMXNET_ unless they have file scope.
>> Don't use names with _ followed by an upper case letter
>> or that star with two underscores. Don't mix underscores and mixed case.
>> Don't stick any new types in net.c/pci.c - new devices should use -device
>> not -net. Global stuff like ethernet header size
>> should move to central place instead of copy paste.
> 
> I'd like to see qtest test cases for this too.

I think as things stand it is a bit too much to request this.  You're
basically asking to write a libos.

Paolo
Anthony Liguori April 11, 2012, 7:10 p.m. UTC | #15
On 04/11/2012 02:08 PM, Paolo Bonzini wrote:
> Il 11/04/2012 19:25, Anthony Liguori ha scritto:
>>>
>>> Off the top of my head: issues with v5:
>>> polluting global namespace, must scope names
>>> appropriately with vmxnet_ VMXNET_ unless they have file scope.
>>> Don't use names with _ followed by an upper case letter
>>> or that star with two underscores. Don't mix underscores and mixed case.
>>> Don't stick any new types in net.c/pci.c - new devices should use -device
>>> not -net. Global stuff like ethernet header size
>>> should move to central place instead of copy paste.
>>
>> I'd like to see qtest test cases for this too.
>
> I think as things stand it is a bit too much to request this.  You're
> basically asking to write a libos.

The only functionality you need is PCI device enumeration which is pretty much 
dead simple.

What other functions would you need a libos for?

Regards,

Anthony Liguori

>
> Paolo
>
>
Paolo Bonzini April 11, 2012, 8:45 p.m. UTC | #16
Il 11/04/2012 21:10, Anthony Liguori ha scritto:
> On 04/11/2012 02:08 PM, Paolo Bonzini wrote:
>> Il 11/04/2012 19:25, Anthony Liguori ha scritto:
>>>>
>>>> Off the top of my head: issues with v5:
>>>> polluting global namespace, must scope names
>>>> appropriately with vmxnet_ VMXNET_ unless they have file scope.
>>>> Don't use names with _ followed by an upper case letter
>>>> or that star with two underscores. Don't mix underscores and mixed
>>>> case.
>>>> Don't stick any new types in net.c/pci.c - new devices should use
>>>> -device
>>>> not -net. Global stuff like ethernet header size
>>>> should move to central place instead of copy paste.
>>>
>>> I'd like to see qtest test cases for this too.
>>
>> I think as things stand it is a bit too much to request this.  You're
>> basically asking to write a libos.
> 
> The only functionality you need is PCI device enumeration which is
> pretty much dead simple.
> 
> What other functions would you need a libos for?

You need mocks for a network device.

Paolo
Stefan Hajnoczi April 12, 2012, 8:35 a.m. UTC | #17
On Wed, Apr 11, 2012 at 9:45 PM, Paolo Bonzini <pbonzini@redhat.com> wrote:
> Il 11/04/2012 21:10, Anthony Liguori ha scritto:
>> On 04/11/2012 02:08 PM, Paolo Bonzini wrote:
>>> Il 11/04/2012 19:25, Anthony Liguori ha scritto:
>>>>>
>>>>> Off the top of my head: issues with v5:
>>>>> polluting global namespace, must scope names
>>>>> appropriately with vmxnet_ VMXNET_ unless they have file scope.
>>>>> Don't use names with _ followed by an upper case letter
>>>>> or that star with two underscores. Don't mix underscores and mixed
>>>>> case.
>>>>> Don't stick any new types in net.c/pci.c - new devices should use
>>>>> -device
>>>>> not -net. Global stuff like ethernet header size
>>>>> should move to central place instead of copy paste.
>>>>
>>>> I'd like to see qtest test cases for this too.
>>>
>>> I think as things stand it is a bit too much to request this.  You're
>>> basically asking to write a libos.
>>
>> The only functionality you need is PCI device enumeration which is
>> pretty much dead simple.
>>
>> What other functions would you need a libos for?
>
> You need mocks for a network device.

Starting to get off-topic but net/socket.c already provides an easy
packet injection/capture interface that can be used for testing.

Stefan
Yan Vugenfirer April 15, 2012, 9:16 a.m. UTC | #18
On Wed, Apr 11, 2012 at 10:10 PM, Anthony Liguori <anthony@codemonkey.ws> wrote:
> On 04/11/2012 02:08 PM, Paolo Bonzini wrote:
>>
>> Il 11/04/2012 19:25, Anthony Liguori ha scritto:
>>>>
>>>>
>>>> Off the top of my head: issues with v5:
>>>> polluting global namespace, must scope names
>>>> appropriately with vmxnet_ VMXNET_ unless they have file scope.
>>>> Don't use names with _ followed by an upper case letter
>>>> or that star with two underscores. Don't mix underscores and mixed case.
>>>> Don't stick any new types in net.c/pci.c - new devices should use
>>>> -device
>>>> not -net. Global stuff like ethernet header size
>>>> should move to central place instead of copy paste.
>>>
>>>
>>> I'd like to see qtest test cases for this too.
>>
>>
>> I think as things stand it is a bit too much to request this.  You're
>> basically asking to write a libos.
>
>
> The only functionality you need is PCI device enumeration which is pretty
> much dead simple.
>
> What other functions would you need a libos for?
>
> Regards,
>
> Anthony Liguori
>
>>
>> Paolo
>>
>>
>

Regarding the testing - we ran WHQL networking tests on the device. If
we provide the logs will it be sufficient? I believe the test coverage
is much more comprehensive than anything that we will do with qtest.

Best regards,
Yan.
Anthony Liguori April 16, 2012, 6:10 p.m. UTC | #19
On 04/15/2012 04:16 AM, Yan Vugenfirer wrote:
> On Wed, Apr 11, 2012 at 10:10 PM, Anthony Liguori<anthony@codemonkey.ws>  wrote:
>> On 04/11/2012 02:08 PM, Paolo Bonzini wrote:
>>>
>>> Il 11/04/2012 19:25, Anthony Liguori ha scritto:
>>>>>
>>>>>
>>>>> Off the top of my head: issues with v5:
>>>>> polluting global namespace, must scope names
>>>>> appropriately with vmxnet_ VMXNET_ unless they have file scope.
>>>>> Don't use names with _ followed by an upper case letter
>>>>> or that star with two underscores. Don't mix underscores and mixed case.
>>>>> Don't stick any new types in net.c/pci.c - new devices should use
>>>>> -device
>>>>> not -net. Global stuff like ethernet header size
>>>>> should move to central place instead of copy paste.
>>>>
>>>>
>>>> I'd like to see qtest test cases for this too.
>>>
>>>
>>> I think as things stand it is a bit too much to request this.  You're
>>> basically asking to write a libos.
>>
>>
>> The only functionality you need is PCI device enumeration which is pretty
>> much dead simple.
>>
>> What other functions would you need a libos for?
>>
>> Regards,
>>
>> Anthony Liguori
>>
>>>
>>> Paolo
>>>
>>>
>>
>
> Regarding the testing - we ran WHQL networking tests on the device. If
> we provide the logs will it be sufficient? I believe the test coverage
> is much more comprehensive than anything that we will do with qtest.

I'm not sure I'd agree about comprehensive, but the problem with WHQL is that 
it's not reproducible.

As you've seen from this thread, there's no a tremendous amount of interest in 
supporting this device.  Since it's likely you'll be the only ones using it, 
having an in-tree test case will help reduce the maintenance burden for everyone 
else.

But VMXNET3 isn't really special here.  From this point forward, I would expect 
all new devices to come with a qtest-based test case.

Regards,

Anthony Liguori

>
> Best regards,
> Yan.
>
Paolo Bonzini April 16, 2012, 7:49 p.m. UTC | #20
> > Regarding the testing - we ran WHQL networking tests on the device.
> > If we provide the logs will it be sufficient? I believe the test
> > coverage is much more comprehensive than anything that we will do with
> > qtest.
> 
> I'm not sure I'd agree about comprehensive

Let's just say that passing WHQL can easily be months of work.

> As you've seen from this thread, there's no a tremendous amount of
> interest in supporting this device.

That's your opinion.  Personally I would be very glad to help getting
the vmw_pvscsi device in QEMU via the SCSI tree, and I don't see
why VMXNET3 should be different.

> But VMXNET3 isn't really special here.  From this point forward, I
> would expect all new devices to come with a qtest-based test case.

I find this to be hard to justify.

With a grand total of 1 device tested, and with a coverage of almost
zero even for that device, I think it's only sane to consider qtest
a proof of concept.

We can talk again when QEMU has:

* libos bindings for at least PCI and the APICs, perhaps the 8259 too,
and examples of how to use those;

* mocks for network devices (block device mocks are needed too, but
not for this device of course).

I helped moving qtest forward hoping that other people (like Stefan
is doing, and like Andreas did for QOM) would contribute other pieces
of the infrastructure.  I certainly would have spent my time otherwise,
had I known that the immediate outcome was making QEMU development slow
and unwelcoming due to unreasonable prerequisites for contributing new
devices.

Certainly it is not reasonable to expect infrequent contributors to do
our homework.

Paolo
Anthony Liguori April 16, 2012, 7:55 p.m. UTC | #21
On 04/16/2012 02:49 PM, Paolo Bonzini wrote:
>
>>> Regarding the testing - we ran WHQL networking tests on the device.
>>> If we provide the logs will it be sufficient? I believe the test
>>> coverage is much more comprehensive than anything that we will do with
>>> qtest.
>>
>> I'm not sure I'd agree about comprehensive
>
> Let's just say that passing WHQL can easily be months of work.

I'm very well aware of that.  But WHQL is designed to test the drivers as much 
as it's a hardware certification.

The bits I'm more interested about is edge case testing (things that could pose 
a security concern).  Since WHQL interfaces at the expected paths for the 
driver, it's unlikely that it can test any of this.

>
>> As you've seen from this thread, there's no a tremendous amount of
>> interest in supporting this device.
>
> That's your opinion.  Personally I would be very glad to help getting
> the vmw_pvscsi device in QEMU via the SCSI tree, and I don't see
> why VMXNET3 should be different.
>
>> But VMXNET3 isn't really special here.  From this point forward, I
>> would expect all new devices to come with a qtest-based test case.
>
> I find this to be hard to justify.
>
> With a grand total of 1 device tested, and with a coverage of almost
> zero even for that device, I think it's only sane to consider qtest
> a proof of concept.

How else are we going to get there other than asking people to use it?

Look, it's pretty darn simple to add a basic test for vmxnet3 to qtest that 
initializes the device.  I don't see what the big deal is asking for that.

> We can talk again when QEMU has:
>
> * libos bindings for at least PCI and the APICs, perhaps the 8259 too,
> and examples of how to use those;

Stefan's posted patches for the PCI bits.

>
> * mocks for network devices (block device mocks are needed too, but
> not for this device of course).
>
> I helped moving qtest forward hoping that other people (like Stefan
> is doing, and like Andreas did for QOM) would contribute other pieces
> of the infrastructure.  I certainly would have spent my time otherwise,
> had I known that the immediate outcome was making QEMU development slow
> and unwelcoming due to unreasonable prerequisites for contributing new
> devices.
>
> Certainly it is not reasonable to expect infrequent contributors to do
> our homework.

Perhaps the issue here is about what is expected from a test case?  All I expect 
is something that does basic device initialization and begins interacting with 
the device.

It doesn't need to start as an exhaustive test but I think there's tremendous 
value in at least having something to start with.  Otherwise, we'll continue to 
exist in the same chicken and the egg state.

Regards,

Anthony Liguroi

>
> Paolo
Paolo Bonzini April 16, 2012, 8:14 p.m. UTC | #22
> The bits I'm more interested about is edge case testing (things that
> could pose a security concern).  Since WHQL interfaces at the expected
> paths for the driver, it's unlikely that it can test any of this.

It does include fuzz tests.

> >> But VMXNET3 isn't really special here.  From this point forward, I
> >> would expect all new devices to come with a qtest-based test case.
> >
> > I find this to be hard to justify.
> >
> > With a grand total of 1 device tested, and with a coverage of almost
> > zero even for that device, I think it's only sane to consider qtest
> > a proof of concept.
> 
> How else are we going to get there other than asking people to use it?

I agree.  But I'm saying it's too early even for that.

> Look, it's pretty darn simple to add a basic test for vmxnet3 to qtest 
> that initializes the device.  I don't see what the big deal is asking for
> that.

For that, qemu-test is enough.  Just boot into a Linux system that has
the driver.

> It doesn't need to start as an exhaustive test but I think there's
> tremendous value in at least having something to start with.  Otherwise,
> we'll continue to exist in the same chicken and the egg state.

Yes, that's a risk.  I guess you were aware of that though.

I've long planned to contact again my academic friends, ask for a
bachelor student or two and have them work on QEMU.  qtest would be
perfect for that (libos and a decent block layer mock would be two
nice projects).  However, mentoring can be time consuming, and right
now I'm not really able to set aside time for that.

Paolo
Anthony Liguori April 16, 2012, 8:34 p.m. UTC | #23
On 04/16/2012 03:14 PM, Paolo Bonzini wrote:
>> The bits I'm more interested about is edge case testing (things that
>> could pose a security concern).  Since WHQL interfaces at the expected
>> paths for the driver, it's unlikely that it can test any of this.
>
> It does include fuzz tests.
>
>>>> But VMXNET3 isn't really special here.  From this point forward, I
>>>> would expect all new devices to come with a qtest-based test case.
>>>
>>> I find this to be hard to justify.
>>>
>>> With a grand total of 1 device tested, and with a coverage of almost
>>> zero even for that device, I think it's only sane to consider qtest
>>> a proof of concept.
>>
>> How else are we going to get there other than asking people to use it?
>
> I agree.  But I'm saying it's too early even for that.

For a 10 line test that enumerates the PCI device given the command line argument?

Here's the thing, I just looked through the code and spotted what I think is a 
buffer overflow.  It's hard to tell purely from code inspection.  With just a 
basic qtest harness, it makes it possible to attempt to test whether or not you 
can overflow.

>> Look, it's pretty darn simple to add a basic test for vmxnet3 to qtest
>> that initializes the device.  I don't see what the big deal is asking for
>> that.
>
> For that, qemu-test is enough.  Just boot into a Linux system that has
> the driver.

I'm basically looking for

>
>> It doesn't need to start as an exhaustive test but I think there's
>> tremendous value in at least having something to start with.  Otherwise,
>> we'll continue to exist in the same chicken and the egg state.
>
> Yes, that's a risk.  I guess you were aware of that though.
>
> I've long planned to contact again my academic friends, ask for a
> bachelor student or two and have them work on QEMU.  qtest would be
> perfect for that (libos and a decent block layer mock would be two
> nice projects).  However, mentoring can be time consuming, and right
> now I'm not really able to set aside time for that.
>
> Paolo
>
Anthony Liguori April 16, 2012, 9:43 p.m. UTC | #24
On 04/16/2012 03:34 PM, Anthony Liguori wrote:
> On 04/16/2012 03:14 PM, Paolo Bonzini wrote:
>>> The bits I'm more interested about is edge case testing (things that
>>> could pose a security concern). Since WHQL interfaces at the expected
>>> paths for the driver, it's unlikely that it can test any of this.
>>
>> It does include fuzz tests.
>>
>>>>> But VMXNET3 isn't really special here. From this point forward, I
>>>>> would expect all new devices to come with a qtest-based test case.
>>>>
>>>> I find this to be hard to justify.
>>>>
>>>> With a grand total of 1 device tested, and with a coverage of almost
>>>> zero even for that device, I think it's only sane to consider qtest
>>>> a proof of concept.
>>>
>>> How else are we going to get there other than asking people to use it?
>>
>> I agree. But I'm saying it's too early even for that.
>
> For a 10 line test that enumerates the PCI device given the command line argument?
>
> Here's the thing, I just looked through the code and spotted what I think is a
> buffer overflow. It's hard to tell purely from code inspection. With just a
> basic qtest harness, it makes it possible to attempt to test whether or not you
> can overflow.
>
>>> Look, it's pretty darn simple to add a basic test for vmxnet3 to qtest
>>> that initializes the device. I don't see what the big deal is asking for
>>> that.
>>
>> For that, qemu-test is enough. Just boot into a Linux system that has
>> the driver.
>
> I'm basically looking for

A better email client apparently... :-/

I'm just looking for something simple.  I send an example in another note.

Regards,

Anthony Liguori
Paolo Bonzini April 17, 2012, 7:38 a.m. UTC | #25
Il 16/04/2012 23:43, Anthony Liguori ha scritto:
> For a 10 line test that enumerates the PCI device given the command line
> argument?
> 
> Here's the thing, I just looked through the code and spotted what I 
> think is a buffer overflow. It's hard to tell purely from code
> inspection. With just a basic qtest harness, it makes it possible
> to attempt to test whether or not you can overflow.

Something like what you attached is indeed a reasonable request, but I
don't see why it could not be written by whoever spots the bug.  You
need to know the spec of the hardware anyway to set up descriptors etc.

Paolo
diff mbox

Patch

diff --git a/Makefile.objs b/Makefile.objs
index 226b01d..1366e86 100644
--- a/Makefile.objs
+++ b/Makefile.objs
@@ -284,6 +284,7 @@  hw-obj-$(CONFIG_PCNET_PCI) += pcnet-pci.o
 hw-obj-$(CONFIG_PCNET_COMMON) += pcnet.o
 hw-obj-$(CONFIG_E1000_PCI) += e1000.o
 hw-obj-$(CONFIG_RTL8139_PCI) += rtl8139.o
+hw-obj-$(CONFIG_VMXNET3_PCI) += vmxnet3.o vmxnet_utils.o vmxnet_pkt.o
 
 hw-obj-$(CONFIG_SMC91C111) += smc91c111.o
 hw-obj-$(CONFIG_LAN9118) += lan9118.o
diff --git a/default-configs/pci.mak b/default-configs/pci.mak
index 21e4ccf..f8e6ee1 100644
--- a/default-configs/pci.mak
+++ b/default-configs/pci.mak
@@ -13,6 +13,7 @@  CONFIG_PCNET_COMMON=y
 CONFIG_LSI_SCSI_PCI=y
 CONFIG_RTL8139_PCI=y
 CONFIG_E1000_PCI=y
+CONFIG_VMXNET3_PCI=y
 CONFIG_IDE_CORE=y
 CONFIG_IDE_QDEV=y
 CONFIG_IDE_PCI=y
diff --git a/hw/pci.c b/hw/pci.c
index bf046bf..f0fb1ee 100644
--- a/hw/pci.c
+++ b/hw/pci.c
@@ -1350,6 +1350,7 @@  static const char * const pci_nic_models[] = {
     "e1000",
     "pcnet",
     "virtio",
+    "vmxnet3",
     NULL
 };
 
@@ -1362,6 +1363,7 @@  static const char * const pci_nic_names[] = {
     "e1000",
     "pcnet",
     "virtio-net-pci",
+    "vmxnet3",
     NULL
 };
 
diff --git a/hw/pci.h b/hw/pci.h
index 4f19fdb..fee8250 100644
--- a/hw/pci.h
+++ b/hw/pci.h
@@ -60,6 +60,7 @@ 
 #define PCI_DEVICE_ID_VMWARE_NET         0x0720
 #define PCI_DEVICE_ID_VMWARE_SCSI        0x0730
 #define PCI_DEVICE_ID_VMWARE_IDE         0x1729
+#define PCI_DEVICE_ID_VMWARE_VMXNET3     0x07B0
 
 /* Intel (0x8086) */
 #define PCI_DEVICE_ID_INTEL_82551IT      0x1209
diff --git a/hw/vmxnet3.c b/hw/vmxnet3.c
new file mode 100644
index 0000000..bc1c5bf
--- /dev/null
+++ b/hw/vmxnet3.c
@@ -0,0 +1,2454 @@ 
+/*
+ * QEMU VMWARE VMXNET3 paravirtual NIC
+ *
+ * Copyright (c) 2012 Ravello Systems LTD (http://ravellosystems.com)
+ *
+ * Developed by Daynix Computing LTD (http://www.daynix.com)
+ *
+ * Authors:
+ * Dmitry Fleytman <dmitry@daynix.com>
+ * Tamir Shomer <tamirs@daynix.com>
+ * Yan Vugenfirer <yan@daynix.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ *
+ */
+
+#include "hw.h"
+#include "pci.h"
+#include "net.h"
+#include "virtio-net.h"
+#include "net/tap.h"
+#include "net/checksum.h"
+#include "sysemu.h"
+#include "iov.h"
+#include "bswap.h"
+#include "msix.h"
+#include "msi.h"
+
+#include "vmxnet3.h"
+#include "vmxnet_debug.h"
+#include "vmware_utils.h"
+#include "vmxnet_utils.h"
+#include "vmxnet_pkt.h"
+
+#define PCI_DEVICE_ID_VMWARE_VMXNET3_REVISION 0x1
+#define VMXNET3_MSIX_BAR_SIZE 0x2000
+
+#define VMXNET3_BAR0_IDX      (0)
+#define VMXNET3_BAR1_IDX      (1)
+#define VMXNET3_MSIX_BAR_IDX  (2)
+
+/* Link speed in Mbps should be shifted by 16 */
+#define VMXNET3_LINK_SPEED      (1000 << 16)
+
+/* Link status: 1 - up, 0 - down. */
+#define VMXNET3_LINK_STATUS_UP  0x1
+
+/* Least significant bit should be set for revision and version */
+#define VMXNET3_DEVICE_VERSION    0x1
+#define VMXNET3_DEVICE_REVISION   0x1
+
+/* Macros for rings descriptors access */
+#define VMXNET3_READ_TX_QUEUE_DESCR8(dpa, field) \
+    (vmw_shmem_ld8(dpa + offsetof(struct Vmxnet3_TxQueueDesc, field)))
+
+#define VMXNET3_WRITE_TX_QUEUE_DESCR8(dpa, field, value) \
+    (vmw_shmem_st8(dpa + offsetof(struct Vmxnet3_TxQueueDesc, field, value)))
+
+#define VMXNET3_READ_TX_QUEUE_DESCR32(dpa, field) \
+    (vmw_shmem_ld32(dpa + offsetof(struct Vmxnet3_TxQueueDesc, field)))
+
+#define VMXNET3_WRITE_TX_QUEUE_DESCR32(dpa, field, value) \
+    (vmw_shmem_st32(dpa + offsetof(struct Vmxnet3_TxQueueDesc, field), value))
+
+#define VMXNET3_READ_TX_QUEUE_DESCR64(dpa, field) \
+    (vmw_shmem_ld64(dpa + offsetof(struct Vmxnet3_TxQueueDesc, field)))
+
+#define VMXNET3_WRITE_TX_QUEUE_DESCR64(dpa, field, value) \
+    (vmw_shmem_st64(dpa + offsetof(struct Vmxnet3_TxQueueDesc, field), value))
+
+#define VMXNET3_READ_RX_QUEUE_DESCR64(dpa, field) \
+    (vmw_shmem_ld64(dpa + offsetof(struct Vmxnet3_RxQueueDesc, field)))
+
+#define VMXNET3_READ_RX_QUEUE_DESCR32(dpa, field) \
+    (vmw_shmem_ld32(dpa + offsetof(struct Vmxnet3_RxQueueDesc, field)))
+
+#define VMXNET3_WRITE_RX_QUEUE_DESCR64(dpa, field, value) \
+    (vmw_shmem_st64(dpa + offsetof(struct Vmxnet3_RxQueueDesc, field), value))
+
+#define VMXNET3_WRITE_RX_QUEUE_DESCR8(dpa, field, value) \
+    (vmw_shmem_st8(dpa + offsetof(struct Vmxnet3_RxQueueDesc, field), value))
+
+/* Macros for guest driver shared area access */
+#define VMXNET3_READ_DRV_SHARED64(shpa, field) \
+    (vmw_shmem_ld64(shpa + offsetof(struct Vmxnet3_DriverShared, field)))
+
+#define VMXNET3_READ_DRV_SHARED32(shpa, field) \
+    (vmw_shmem_ld32(shpa + offsetof(struct Vmxnet3_DriverShared, field)))
+
+#define VMXNET3_WRITE_DRV_SHARED32(shpa, field, val) \
+    (vmw_shmem_st32(shpa + offsetof(struct Vmxnet3_DriverShared, field), val))
+
+#define VMXNET3_READ_DRV_SHARED16(shpa, field) \
+    (vmw_shmem_ld16(shpa + offsetof(struct Vmxnet3_DriverShared, field)))
+
+#define VMXNET3_READ_DRV_SHARED8(shpa, field) \
+    (vmw_shmem_ld8(shpa + offsetof(struct Vmxnet3_DriverShared, field)))
+
+#define VMXNET3_READ_DRV_SHARED(shpa, field, b, l) \
+    (vmw_shmem_read(shpa + offsetof(struct Vmxnet3_DriverShared, field), b, l))
+
+/* Cyclic ring abstraction */
+typedef struct Vmxnet3Ring {
+    target_phys_addr_t pa;
+    size_t size;
+    size_t cell_size;
+    size_t next;
+    uint8_t gen;
+} Vmxnet3Ring;
+
+static inline void vmxnet3_ring_init(Vmxnet3Ring *ring,
+                                     target_phys_addr_t pa,
+                                     size_t size,
+                                     size_t cell_size,
+                                     bool zero_region)
+{
+    ring->pa = pa;
+    ring->size = size;
+    ring->cell_size = cell_size;
+    ring->gen = VMXNET3_INIT_GEN;
+    ring->next = 0;
+
+    if (zero_region) {
+        vmw_shmem_set(pa, 0, size*cell_size);
+    }
+}
+
+#define vmxnet3_ring_dump(macro, ring_name, ridx, r)                         \
+    macro("%s#%d: base %" PRIx64 " size %lu cell_size %lu gen %d next %lu",  \
+          (ring_name), (ridx),                                               \
+          (r)->pa, (r)->size, (r)->cell_size, (r)->gen, (r)->next)
+
+static inline void vmxnet3_ring_inc(Vmxnet3Ring *ring)
+{
+    if (++ring->next >= ring->size) {
+        ring->next = 0;
+        ring->gen ^= 1;
+    }
+}
+
+static inline void vmxnet3_ring_dec(Vmxnet3Ring *ring)
+{
+    if (0 == ring->next--) {
+        ring->next = ring->size - 1;
+        ring->gen ^= 1;
+    }
+}
+
+static inline target_phys_addr_t vmxnet3_ring_curr_cell_pa(Vmxnet3Ring *ring)
+{
+    return ring->pa + ring->next * ring->cell_size;
+}
+
+static inline void vmxnet3_ring_read_curr_cell(Vmxnet3Ring *ring, void *buff)
+{
+    vmw_shmem_read(vmxnet3_ring_curr_cell_pa(ring), buff, ring->cell_size);
+}
+
+static inline void vmxnet3_ring_write_curr_cell(Vmxnet3Ring *ring, void *buff)
+{
+    vmw_shmem_write(vmxnet3_ring_curr_cell_pa(ring), buff, ring->cell_size);
+}
+
+static inline size_t vmxnet3_ring_curr_cell_idx(Vmxnet3Ring *ring)
+{
+    return ring->next;
+}
+
+static inline uint8_t vmxnet3_ring_curr_gen(Vmxnet3Ring *ring)
+{
+    return ring->gen;
+}
+
+/* Debug trace-related functions */
+static inline void
+vmxnet3_dump_tx_descr(struct Vmxnet3_TxDesc *descr)
+{
+    DPKPRINTF("TX DESCR: "
+              "addr %" PRIx64 ", len: %d, gen: %d, rsvd: %d, "
+              "dtype: %d, ext1: %d, msscof: %d, hlen: %d, om: %d, "
+              "eop: %d, cq: %d, ext2: %d, ti: %d, tci: %d",
+              le64_to_cpu(descr->addr), descr->len, descr->gen, descr->rsvd,
+              descr->dtype, descr->ext1, descr->msscof, descr->hlen, descr->om,
+              descr->eop, descr->cq, descr->ext2, descr->ti, descr->tci);
+}
+
+static inline void
+vmxnet3_dump_virt_hdr(struct virtio_net_hdr *vhdr)
+{
+    DPKPRINTF("VHDR: flags 0x%x, gso_type: 0x%x, hdr_len: %d, gso_size: %d, "
+              "csum_start: %d, csum_offset: %d",
+              vhdr->flags, vhdr->gso_type, vhdr->hdr_len, vhdr->gso_size,
+              vhdr->csum_start, vhdr->csum_offset);
+}
+
+static inline void
+vmxnet3_dump_rx_descr(struct Vmxnet3_RxDesc *descr)
+{
+    DPKPRINTF("RX DESCR: addr %" PRIx64 ", len: %d, gen: %d, rsvd: %d, "
+              "dtype: %d, ext1: %d, btype: %d",
+              le64_to_cpu(descr->addr), descr->len, descr->gen,
+              descr->rsvd, descr->dtype, descr->ext1, descr->btype);
+}
+
+/* Device state and helper functions */
+#define VMXNET3_RX_RINGS_PER_QUEUE (2)
+
+typedef struct {
+    Vmxnet3Ring tx_ring;
+    Vmxnet3Ring comp_ring;
+
+    uint8_t intr_idx;
+    target_phys_addr_t tx_stats_pa;
+    struct UPT1_TxStats txq_stats;
+} Vmxnet3_TxqDescr;
+
+typedef struct {
+    Vmxnet3Ring rx_ring[VMXNET3_RX_RINGS_PER_QUEUE];
+    Vmxnet3Ring comp_ring;
+    uint8_t intr_idx;
+    target_phys_addr_t rx_stats_pa;
+    struct UPT1_RxStats rxq_stats;
+} Vmxnet3_RxqDescr;
+
+typedef struct {
+    bool is_masked;
+    bool is_pending;
+    bool is_asserted;
+} Vmxnet3_IntState;
+
+typedef struct _VMXNET3_State {
+        PCIDevice dev;
+        NICState *nic;
+        NICConf conf;
+        MemoryRegion bar0;
+        MemoryRegion bar1;
+        MemoryRegion msix_bar;
+
+        Vmxnet3_RxqDescr rxq_descr[VMXNET3_DEVICE_MAX_RX_QUEUES];
+        Vmxnet3_TxqDescr txq_descr[VMXNET3_DEVICE_MAX_TX_QUEUES];
+
+        /* Whether MSI-X support was installed successfully */
+        uint8_t msix_used;
+        /* Whether MSI support was installed successfully */
+        uint8_t msi_used;
+        target_phys_addr_t drv_shmem;
+        target_phys_addr_t temp_shared_guest_driver_memory;
+
+        uint8_t txq_num;
+
+        /* This boolean tells whether RX packet being indicated has to */
+        /* be split into head and body chunks from different RX rings  */
+        bool rx_packets_compound;
+
+        bool rx_vlan_stripping;
+        bool lro_supported;
+
+        uint8_t rxq_num;
+
+        /* Network MTU */
+        uint32_t mtu;
+
+        /* Maximum number of fragments for indicated TX packets */
+        uint32_t max_tx_frags;
+
+        /* Maximum number of fragments for indicated RX packets */
+        uint16_t max_rx_frags;
+
+        /* Index for events interrupt */
+        uint8_t event_int_idx;
+
+        /* Whether automatic interrupts masking enabled */
+        uint8_t auto_int_masking;
+
+        bool peer_has_vhdr;
+
+        /* TX packets to QEMU interface */
+        Vmxnet_TxPkt_h tx_pkt;
+        uint32_t offload_mode;
+        uint32_t cso_or_gso_size;
+
+        Vmxnet_RxPkt_h rx_pkt;
+
+        bool curr_txpkt_skip;
+        bool curr_txpkt_header_processed;
+
+        uint32_t device_active;
+        uint32_t last_command;
+
+        uint32_t link_status_and_speed;
+
+        Vmxnet3_IntState interrupt_states[VMXNET3_MAX_INTRS];
+
+        uint32_t temp_mac;   /* To store the low part first */
+
+        MACAddr perm_mac;
+        uint32_t vlan_table[VMXNET3_VFT_SIZE];
+        uint32_t rx_mode;
+        MACAddr *mcast_list;
+        uint32_t mcast_list_len;
+        uint32_t mcast_list_buff_size; /* needed for live migration. */
+} VMXNET3_State;
+
+/* Interrupt management */
+
+/*
+ *This function returns sign whether interrupt line is in asserted state
+ * This depends on the type of interrupt used. For INTX interrupt line will
+ * be asserted until explicit deassertion, for MSI(X) interrupt line will
+ * be deasserted automatically due to notification semantics of the MSI(X)
+ * interrupts
+ */
+static bool _vmxnet3_assert_interrupt_line(VMXNET3_State *s, uint32_t int_idx)
+{
+    if (s->msix_used && msix_enabled(&s->dev)) {
+        DIRPRINTF("Sending MSI-X notification for vector %u", int_idx);
+        msix_notify(&s->dev, int_idx);
+        return false;
+    }
+    if (s->msi_used && msi_enabled(&s->dev)) {
+        DIRPRINTF("Sending MSI notification for vector %u", int_idx);
+        msi_notify(&s->dev, int_idx);
+        return false;
+    }
+
+    DIRPRINTF("Asserting line for interrupt %u", int_idx);
+    qemu_set_irq(s->dev.irq[int_idx], 1);
+    return true;
+}
+
+static void _vmxnet3_deassert_interrupt_line(VMXNET3_State *s, int lidx)
+{
+    /*
+     * This function should never be called for MSI(X) interrupts
+     * because deassertion never required for message interrupts
+     */
+    assert(!s->msix_used || !msix_enabled(&s->dev));
+    /*
+     * This function should never be called for MSI(X) interrupts
+     * because deassertion never required for message interrupts
+     */
+    assert(!s->msi_used || !msi_enabled(&s->dev));
+
+    DIRPRINTF("Deasserting line for interrupt %u", lidx);
+    qemu_set_irq(s->dev.irq[lidx], 0);
+}
+
+static void vmxnet3_update_interrupt_line_state(VMXNET3_State *s, int lidx)
+{
+    if (!s->interrupt_states[lidx].is_pending &&
+       s->interrupt_states[lidx].is_asserted) {
+        DIRPRINTF("New interrupt line state for index %d is DOWN", lidx);
+        _vmxnet3_deassert_interrupt_line(s, lidx);
+        s->interrupt_states[lidx].is_asserted = false;
+        return;
+    }
+
+    if (s->interrupt_states[lidx].is_pending &&
+       !s->interrupt_states[lidx].is_masked &&
+       !s->interrupt_states[lidx].is_asserted) {
+        DIRPRINTF("New interrupt line state for index %d is UP", lidx);
+        s->interrupt_states[lidx].is_asserted =
+            _vmxnet3_assert_interrupt_line(s, lidx);
+        s->interrupt_states[lidx].is_pending = false;
+        return;
+    }
+}
+
+static void vmxnet3_trigger_interrupt(VMXNET3_State *s, int lidx)
+{
+    s->interrupt_states[lidx].is_pending = true;
+    vmxnet3_update_interrupt_line_state(s, lidx);
+
+    if (s->msix_used && msix_enabled(&s->dev) && s->auto_int_masking) {
+        goto do_automask;
+    }
+
+    if (s->msi_used && msi_enabled(&s->dev) && s->auto_int_masking) {
+        goto do_automask;
+    }
+
+    return;
+
+do_automask:
+    s->interrupt_states[lidx].is_masked = true;
+    vmxnet3_update_interrupt_line_state(s, lidx);
+}
+
+static bool vmxnet3_interrupt_asserted(VMXNET3_State *s, int lidx)
+{
+    return s->interrupt_states[lidx].is_asserted;
+}
+
+static void vmxnet3_clear_interrupt(VMXNET3_State *s, int int_idx)
+{
+    s->interrupt_states[int_idx].is_pending = false;
+    if (s->auto_int_masking) {
+        s->interrupt_states[int_idx].is_masked = true;
+    }
+    vmxnet3_update_interrupt_line_state(s, int_idx);
+}
+
+static void
+vmxnet3_on_interrupt_mask_changed(VMXNET3_State *s, int lidx, bool is_masked)
+{
+    s->interrupt_states[lidx].is_masked = is_masked;
+    vmxnet3_update_interrupt_line_state(s, lidx);
+}
+
+static bool vmxnet3_verify_driver_magic(target_phys_addr_t dshmem)
+{
+    return (VMXNET3_REV1_MAGIC == VMXNET3_READ_DRV_SHARED32(dshmem, magic));
+}
+
+#define _GET_BYTE(x, byte_num) (((x) >> (byte_num)*8) & 0xFF)
+#define _MAKE_BYTE(byte_num, val) (((uint32_t)((val) & 0xFF)) << (byte_num)*8)
+
+static void vmxnet3_set_variable_mac(VMXNET3_State *s, uint32_t h, uint32_t l)
+{
+    s->conf.macaddr.a[0] = _GET_BYTE(l,  0);
+    s->conf.macaddr.a[1] = _GET_BYTE(l,  1);
+    s->conf.macaddr.a[2] = _GET_BYTE(l,  2);
+    s->conf.macaddr.a[3] = _GET_BYTE(l,  3);
+    s->conf.macaddr.a[4] = _GET_BYTE(h, 0);
+    s->conf.macaddr.a[5] = _GET_BYTE(h, 1);
+
+    DCFPRINTF("Variable MAC: " MAC_FMT, MAC_ARG(s->conf.macaddr.a));
+
+    qemu_format_nic_info_str(&s->nic->nc, s->conf.macaddr.a);
+}
+
+static uint64_t vmxnet3_get_mac_low(MACAddr *addr)
+{
+    return _MAKE_BYTE(0, addr->a[0]) |
+           _MAKE_BYTE(1, addr->a[1]) |
+           _MAKE_BYTE(2, addr->a[2]) |
+           _MAKE_BYTE(3, addr->a[3]);
+}
+
+static uint64_t vmxnet3_get_mac_high(MACAddr *addr)
+{
+    return _MAKE_BYTE(0, addr->a[4]) |
+           _MAKE_BYTE(1, addr->a[5]);
+}
+
+static void
+vmxnet3_inc_tx_consumption_counter(VMXNET3_State *s, int qidx)
+{
+    vmxnet3_ring_inc(&s->txq_descr[qidx].tx_ring);
+}
+
+static inline void
+vmxnet3_inc_rx_consumption_counter(VMXNET3_State *s, int qidx, int ridx)
+{
+    vmxnet3_ring_inc(&s->rxq_descr[qidx].rx_ring[ridx]);
+}
+
+static inline void
+vmxnet3_inc_tx_completion_counter(VMXNET3_State *s, int qidx)
+{
+    vmxnet3_ring_inc(&s->txq_descr[qidx].comp_ring);
+}
+
+static void
+vmxnet3_inc_rx_completion_counter(VMXNET3_State *s, int qidx)
+{
+    vmxnet3_ring_inc(&s->rxq_descr[qidx].comp_ring);
+}
+
+static void
+vmxnet3_dec_rx_completion_counter(VMXNET3_State *s, int qidx)
+{
+    vmxnet3_ring_dec(&s->rxq_descr[qidx].comp_ring);
+}
+
+static inline void vmxnet3_flush_shmem_changes(void)
+{
+    /*
+     * Flush shared memory changes
+     * Needed before transferring control to guest
+     */
+    smp_wmb();
+}
+
+static void vmxnet3_complete_packet(VMXNET3_State *s, int qidx, uint32 tx_ridx)
+{
+    struct Vmxnet3_TxCompDesc txcq_descr;
+
+    vmxnet3_ring_dump(DRIPRINTF, "TXC", qidx, &s->txq_descr[qidx].comp_ring);
+
+    txcq_descr.txdIdx = tx_ridx;
+    txcq_descr.gen = vmxnet3_ring_curr_gen(&s->txq_descr[qidx].comp_ring);
+
+    vmxnet3_ring_write_curr_cell(&s->txq_descr[qidx].comp_ring, &txcq_descr);
+    vmxnet3_inc_tx_completion_counter(s, qidx);
+
+    vmxnet3_flush_shmem_changes();
+    vmxnet3_trigger_interrupt(s, s->txq_descr[qidx].intr_idx);
+}
+
+static bool
+vmxnet3_setup_tx_offloads(VMXNET3_State *s)
+{
+    switch (s->offload_mode) {
+    case VMXNET3_OM_NONE:
+        vmxnet_tx_pkt_build_vheader(s->tx_pkt, false, false, 0);
+        break;
+
+    case VMXNET3_OM_CSUM:
+        vmxnet_tx_pkt_build_vheader(s->tx_pkt, false, true, 0);
+        DPKPRINTF("L4 CSO requested\n");
+        break;
+
+    case VMXNET3_OM_TSO:
+        vmxnet_tx_pkt_build_vheader(s->tx_pkt, true, true,
+            s->cso_or_gso_size);
+        vmxnet_tx_pkt_update_ip_checksums(s->tx_pkt);
+        DPKPRINTF("GSO offload  requested.");
+        break;
+
+    default:
+        assert(false);
+        return false;
+    }
+
+    return true;
+}
+
+static void
+vmxnet3_tx_retrieve_metadata(VMXNET3_State *s,
+                             const struct Vmxnet3_TxDesc *txd)
+{
+    s->offload_mode = txd->om;
+    s->cso_or_gso_size = txd->msscof;
+
+    if (txd->ti) {
+        vmxnet_tx_pkt_setup_vlan_header(s->tx_pkt, txd->tci);
+    }
+}
+
+typedef enum {
+    VMXNET3_PKT_STATUS_OK,
+    VMXNET3_PKT_STATUS_ERROR,
+    VMXNET3_PKT_STATUS_DISCARD,/* only for tx */
+    VMXNET3_PKT_STATUS_OUT_OF_BUF /* only for rx */
+} Vmxnet3_PktStatus;
+
+static void
+vmxnet3_on_tx_done_update_stats(VMXNET3_State *s, int qidx,
+    Vmxnet3_PktStatus status)
+{
+    size_t tot_len = vmxnet_tx_pkt_get_total_len(s->tx_pkt);
+    struct UPT1_TxStats *stats = &s->txq_descr[qidx].txq_stats;
+
+    switch (status) {
+    case VMXNET3_PKT_STATUS_OK: {
+        switch (vmxnet_tx_pkt_get_packet_type(s->tx_pkt)) {
+        case ETH_PKT_BCAST:
+            stats->bcastPktsTxOK++;
+            stats->bcastBytesTxOK += tot_len;
+            break;
+        case ETH_PKT_MCAST:
+            stats->mcastPktsTxOK++;
+            stats->mcastBytesTxOK += tot_len;
+            break;
+        case ETH_PKT_UCAST:
+            stats->ucastPktsTxOK++;
+            stats->ucastBytesTxOK += tot_len;
+            break;
+        default:
+            assert(false);
+        }
+
+        if (VMXNET3_OM_TSO == s->offload_mode) {
+            /*
+             * According to VMWARE headers this statistic is a number
+             * of packets after segmentation but since we don't have
+             * this information in QEMU model, the best we can do is to
+             * provide number of non-segmented packets
+             */
+            stats->TSOPktsTxOK++;
+            stats->TSOBytesTxOK += tot_len;
+        }
+    }
+    break;
+
+    case VMXNET3_PKT_STATUS_DISCARD: {
+        stats->pktsTxDiscard++;
+    }
+    break;
+
+    case VMXNET3_PKT_STATUS_ERROR: {
+        stats->pktsTxError++;
+    }
+    break;
+
+    default:
+        assert(false);
+    }
+}
+
+static void
+vmxnet3_on_rx_done_update_stats(VMXNET3_State *s,
+                                int qidx,
+                                Vmxnet3_PktStatus status)
+{
+    struct UPT1_RxStats *stats = &s->rxq_descr[qidx].rxq_stats;
+    size_t tot_len = vmxnet_rx_pkt_get_total_len(s->rx_pkt);
+
+    switch (status) {
+    case VMXNET3_PKT_STATUS_OUT_OF_BUF:
+        stats->pktsRxOutOfBuf++;
+        break;
+
+    case VMXNET3_PKT_STATUS_ERROR:
+        stats->pktsRxError++;
+        break;
+    case VMXNET3_PKT_STATUS_OK:
+        switch (vmxnet_rx_pkt_get_packet_type(s->rx_pkt)) {
+        case ETH_PKT_BCAST:
+            stats->bcastPktsRxOK++;
+            stats->bcastBytesRxOK += tot_len;
+            break;
+        case ETH_PKT_MCAST:
+            stats->mcastPktsRxOK++;
+            stats->mcastBytesRxOK += tot_len;
+            break;
+        case ETH_PKT_UCAST:
+            stats->ucastPktsRxOK++;
+            stats->ucastBytesRxOK += tot_len;
+            break;
+        default:
+            assert(false);
+        }
+
+        if (tot_len > s->mtu) {
+            stats->LROPktsRxOK++;
+            stats->LROBytesRxOK += tot_len;
+        }
+        break;
+    default:
+        assert(false);
+    }
+}
+
+static inline bool
+vmxnet3_pop_next_tx_descr(VMXNET3_State *s,
+                          int qidx,
+                          struct Vmxnet3_TxDesc *txd,
+                          uint32_t *descr_idx)
+{
+    Vmxnet3Ring *ring = &s->txq_descr[qidx].tx_ring;
+
+    vmxnet3_ring_read_curr_cell(ring, txd);
+    if (txd->gen == vmxnet3_ring_curr_gen(ring)) {
+        vmxnet3_ring_dump(DRIPRINTF, "TX", qidx, ring);
+        *descr_idx = vmxnet3_ring_curr_cell_idx(ring);
+        vmxnet3_inc_tx_consumption_counter(s, qidx);
+        return true;
+    }
+
+    return false;
+}
+
+static bool
+vmxnet3_send_packet(VMXNET3_State *s, uint32_t qidx)
+{
+    size_t bytes_sent = 0;
+    bool res = true;
+    Vmxnet3_PktStatus status = VMXNET3_PKT_STATUS_OK;
+
+    res = vmxnet3_setup_tx_offloads(s);
+    if (!res) {
+        status = VMXNET3_PKT_STATUS_ERROR;
+        goto Exit;
+    }
+
+    /* debug prints */
+    vmxnet3_dump_virt_hdr(vmxnet_tx_pkt_get_vhdr(s->tx_pkt));
+    vmxnet_tx_pkt_dump(s->tx_pkt);
+
+    bytes_sent = vmxnet_tx_pkt_send(s->tx_pkt, &s->nic->nc);
+    if (!bytes_sent) {
+        res = false;
+        status = VMXNET3_PKT_STATUS_DISCARD;
+        goto Exit;
+    }
+
+Exit:
+    vmxnet3_on_tx_done_update_stats(s, qidx, status);
+    return res;
+}
+
+static void vmxnet3_process_tx_queue(VMXNET3_State *s, int qidx)
+{
+    struct Vmxnet3_TxDesc txd;
+    uint32_t txd_idx;
+    uint32_t data_len;
+    target_phys_addr_t data_pa;
+    size_t bytes_adopted;
+
+    for (;;) {
+        if (!vmxnet3_pop_next_tx_descr(s, qidx, &txd, &txd_idx)) {
+            break;
+        }
+
+        vmxnet3_dump_tx_descr(&txd);
+
+        if (!s->curr_txpkt_skip) {
+            data_len = (txd.len > 0) ? txd.len : VMXNET3_MAX_TX_BUF_SIZE;
+            data_pa = le64_to_cpu(txd.addr);
+
+            if (!s->curr_txpkt_header_processed) {
+                bytes_adopted = vmxnet_tx_pkt_prepare(s->tx_pkt,
+                    data_pa, data_len);
+                vmxnet3_tx_retrieve_metadata(s, &txd);
+                data_pa += bytes_adopted;
+                data_len -= bytes_adopted;
+                s->curr_txpkt_header_processed = true;
+            }
+
+            if (0 != data_len) {
+                vmxnet_tx_pkt_add_fragment(s->tx_pkt, data_pa, data_len);
+            }
+
+            if (txd.eop) {
+                s->curr_txpkt_skip = !vmxnet3_send_packet(s, qidx);
+            }
+        }
+
+        if (txd.eop) {
+            vmxnet3_complete_packet(s, qidx, txd_idx);
+            s->curr_txpkt_skip = false;
+            s->curr_txpkt_header_processed = false;
+            vmxnet_tx_pkt_reset(s->tx_pkt);
+        }
+    }
+}
+
+static inline void
+vmxnet3_read_next_rx_descr(VMXNET3_State *s, int qidx, int ridx,
+                           struct Vmxnet3_RxDesc *dbuf, uint32_t *didx)
+{
+    Vmxnet3Ring *ring = &s->rxq_descr[qidx].rx_ring[ridx];
+    *didx = vmxnet3_ring_curr_cell_idx(ring);
+    vmxnet3_ring_read_curr_cell(ring, dbuf);
+}
+
+static inline uint8_t
+vmxnet3_get_rx_ring_gen(VMXNET3_State *s, int qidx, int ridx)
+{
+    return s->rxq_descr[qidx].rx_ring[ridx].gen;
+}
+
+static inline target_phys_addr_t
+vmxnet3_pop_rxc_descr(VMXNET3_State *s, int qidx, uint32_t *descr_gen)
+{
+    uint8_t ring_gen;
+    struct Vmxnet3_RxCompDesc rxcd;
+
+    target_phys_addr_t daddr =
+        vmxnet3_ring_curr_cell_pa(&s->rxq_descr[qidx].comp_ring);
+
+    cpu_physical_memory_read(daddr, &rxcd, sizeof(struct Vmxnet3_RxCompDesc));
+    ring_gen = vmxnet3_ring_curr_gen(&s->rxq_descr[qidx].comp_ring);
+
+    if (rxcd.gen != ring_gen) {
+        *descr_gen = ring_gen;
+        vmxnet3_inc_rx_completion_counter(s, qidx);
+        return daddr;
+    }
+
+    return 0;
+}
+
+static inline void
+vmxnet3_revert_rxc_descr(VMXNET3_State *s, int qidx)
+{
+    vmxnet3_dec_rx_completion_counter(s, qidx);
+}
+
+#define RXQ_IDX      (0)
+#define RX_HEAD_BODY_RING (0)
+#define RX_BODY_ONLY_RING (1)
+
+static bool
+vmxnet3_get_next_head_rx_descr(VMXNET3_State *s,
+                               struct Vmxnet3_RxDesc *descr_buf,
+                               uint32_t *descr_idx,
+                               uint32_t *ridx)
+{
+    for (;;) {
+        uint32_t ring_gen;
+        vmxnet3_read_next_rx_descr(s, RXQ_IDX, RX_HEAD_BODY_RING,
+                                   descr_buf, descr_idx);
+
+        /* If no more free descriptors - return */
+        ring_gen = vmxnet3_get_rx_ring_gen(s, RXQ_IDX, RX_HEAD_BODY_RING);
+        if (descr_buf->gen != ring_gen) {
+            return false;
+        }
+
+        /* Mark current descriptor as used/skipped */
+        vmxnet3_inc_rx_consumption_counter(s, RXQ_IDX, RX_HEAD_BODY_RING);
+
+        /* If this is what we are looking for - return */
+        if (VMXNET3_RXD_BTYPE_HEAD == descr_buf->btype) {
+            *ridx = RX_HEAD_BODY_RING;
+            return true;
+        }
+    }
+}
+
+static bool
+vmxnet3_get_next_body_rx_descr(VMXNET3_State *s,
+                               struct Vmxnet3_RxDesc *d,
+                               uint32_t *didx,
+                               uint32_t *ridx)
+{
+    vmxnet3_read_next_rx_descr(s, RXQ_IDX, RX_HEAD_BODY_RING, d, didx);
+
+    /* Try to find corresponding descriptor in head/body ring */
+    if ((d->gen == vmxnet3_get_rx_ring_gen(s, RXQ_IDX, RX_HEAD_BODY_RING)) &&
+         (VMXNET3_RXD_BTYPE_BODY == d->btype)) {
+        vmxnet3_inc_rx_consumption_counter(s, RXQ_IDX, RX_HEAD_BODY_RING);
+        *ridx = RX_HEAD_BODY_RING;
+        return true;
+    }
+
+    /*
+     * If there is no free descriptors on head/body ring or next free
+     * descriptor is a head descriptor switch to body only ring
+     */
+    vmxnet3_read_next_rx_descr(s, RXQ_IDX, RX_BODY_ONLY_RING, d, didx);
+
+    /* If no more free descriptors - return */
+    if (d->gen == vmxnet3_get_rx_ring_gen(s, RXQ_IDX, RX_BODY_ONLY_RING)) {
+        assert(VMXNET3_RXD_BTYPE_BODY == d->btype);
+        *ridx = RX_BODY_ONLY_RING;
+        vmxnet3_inc_rx_consumption_counter(s, RXQ_IDX, RX_BODY_ONLY_RING);
+        return true;
+    }
+
+    return false;
+}
+
+static inline bool
+vmxnet3_get_next_rx_descr(VMXNET3_State *s, bool is_head,
+                          struct Vmxnet3_RxDesc *descr_buf,
+                          uint32_t *descr_idx,
+                          uint32_t *ridx)
+{
+    if (is_head || !s->rx_packets_compound) {
+        return vmxnet3_get_next_head_rx_descr(s, descr_buf, descr_idx, ridx);
+    } else {
+        return vmxnet3_get_next_body_rx_descr(s, descr_buf, descr_idx, ridx);
+    }
+}
+
+static void vmxnet3_rx_update_descr(Vmxnet_RxPkt_h pkt,
+    struct Vmxnet3_RxCompDesc *rxcd)
+{
+    int csum_ok, is_gso;
+    bool isip4, isip6, istcp, isudp;
+    uint8_t headers[ETH_MAX_L2_HDR_LEN + ETH_MAX_L3_HDR_LEN];
+    struct virtio_net_hdr *vhdr;
+    uint8_t offload_type;
+    uint32_t tot_len;
+
+    if (vmxnet_rx_pkt_is_vlan_stripped(pkt)) {
+        rxcd->ts = 1;
+        rxcd->tci = vmxnet_rx_pkt_get_vlan_tag(pkt);
+    }
+
+    if (!vmxnet_rx_pkt_has_virt_hdr(pkt)) {
+        goto nocsum;
+    }
+
+    vhdr = vmxnet_rx_pkt_get_vhdr(pkt);
+    /*
+     * Checksum is valid when lower level tell so or when lower level
+     * requires checksum offload telling that packet produced/bridged
+     * locally and did travel over network after last checksum calculation
+     * or production
+     */
+    csum_ok = VMXNET_FLAG_IS_SET(vhdr->flags, VIRTIO_NET_HDR_F_DATA_VALID) ||
+              VMXNET_FLAG_IS_SET(vhdr->flags, VIRTIO_NET_HDR_F_NEEDS_CSUM);
+
+    offload_type = vhdr->gso_type & ~VIRTIO_NET_HDR_GSO_ECN;
+    is_gso = (offload_type != VIRTIO_NET_HDR_GSO_NONE) ? 1 : 0;
+
+    if (!csum_ok && !is_gso) {
+        goto nocsum;
+    }
+
+    tot_len = vmxnet_rx_pkt_get_total_len(pkt);
+
+    /* Make linear copy of L2-L3 headers and parse it */
+    iov_to_buf(vmxnet_rx_pkt_get_iovec(pkt),
+               vmxnet_rx_pkt_get_num_frags(pkt),
+               headers, 0, MIN(sizeof(headers), tot_len));
+
+    eth_get_protocols(headers, MIN(sizeof(headers), tot_len),
+                      &isip4, &isip6, &isudp, &istcp);
+    if ((!istcp && !isudp) || (!isip4 && !isip6)) {
+        goto nocsum;
+    }
+
+    rxcd->cnc = 0;
+    rxcd->v4 = isip4 ? 1 : 0;
+    rxcd->v6 = isip6 ? 1 : 0;
+    rxcd->tcp = istcp ? 1 : 0;
+    rxcd->udp = isudp ? 1 : 0;
+    rxcd->fcs = rxcd->tuc = rxcd->ipc = 1;
+    return;
+
+nocsum:
+    rxcd->cnc = 1;
+    return;
+}
+
+static void
+vmxnet3_physical_memory_writev(const struct iovec *iov,
+                               size_t start_iov_off,
+                               target_phys_addr_t target_addr,
+                               size_t bytes_to_copy)
+{
+    size_t curr_off = 0;
+    size_t copied = 0;
+
+    while (bytes_to_copy) {
+        if (start_iov_off < (curr_off + iov->iov_len)) {
+            size_t chunk_len =
+                MIN((curr_off + iov->iov_len) - start_iov_off, bytes_to_copy);
+
+            cpu_physical_memory_write(target_addr + copied,
+                                      iov->iov_base + start_iov_off - curr_off,
+                                      chunk_len);
+
+            copied += chunk_len;
+            start_iov_off += chunk_len;
+            curr_off = start_iov_off;
+            bytes_to_copy -= chunk_len;
+        } else {
+            curr_off += iov->iov_len;
+        }
+        iov++;
+    }
+}
+
+static bool
+vmxnet3_indicate_packet(VMXNET3_State *s)
+{
+    struct Vmxnet3_RxDesc rxd;
+    bool is_head = true;
+    uint32_t rxd_idx;
+    uint32_t rx_ridx;
+
+    struct Vmxnet3_RxCompDesc rxcd;
+    uint32_t new_rxcd_gen = VMXNET3_INIT_GEN;
+    target_phys_addr_t new_rxcd_pa = 0;
+    target_phys_addr_t ready_rxcd_pa = 0;
+    struct iovec *data = vmxnet_rx_pkt_get_iovec(s->rx_pkt);
+    size_t bytes_copied = 0;
+    size_t bytes_left = vmxnet_rx_pkt_get_total_len(s->rx_pkt);
+    uint16_t num_frags = 0;
+    size_t chunk_size;
+
+    vmxnet_rx_pkt_dump(s->rx_pkt);
+
+    while (bytes_left > 0) {
+
+        /* cannot add more frags to packet */
+        if (num_frags == s->max_rx_frags) {
+            break;
+        }
+
+        new_rxcd_pa = vmxnet3_pop_rxc_descr(s, RXQ_IDX, &new_rxcd_gen);
+        if (!new_rxcd_pa) {
+            break;
+        }
+
+        if (!vmxnet3_get_next_rx_descr(s, is_head, &rxd, &rxd_idx, &rx_ridx)) {
+            break;
+        }
+
+        chunk_size = MIN(bytes_left, rxd.len);
+        vmxnet3_physical_memory_writev(data, bytes_copied,
+                                       le64_to_cpu(rxd.addr), chunk_size);
+        bytes_copied += chunk_size;
+        bytes_left -= chunk_size;
+
+        vmxnet3_dump_rx_descr(&rxd);
+
+        if (0 != ready_rxcd_pa) {
+            cpu_physical_memory_write(ready_rxcd_pa, &rxcd, sizeof(rxcd));
+        }
+
+        memset(&rxcd, 0, sizeof(struct Vmxnet3_RxCompDesc));
+        rxcd.rxdIdx = rxd_idx;
+        rxcd.len = chunk_size;
+        rxcd.sop = is_head;
+        rxcd.gen = new_rxcd_gen;
+        rxcd.rqID = RXQ_IDX + rx_ridx*s->rxq_num;
+
+        if (0 == bytes_left) {
+            vmxnet3_rx_update_descr(s->rx_pkt, &rxcd);
+        }
+
+        DRIPRINTF("RX Completion descriptor: rxRing: %lu rxIdx %lu len %lu "
+                  "sop %d csum_correct %lu",
+                  (unsigned long) rx_ridx,
+                  (unsigned long) rxcd.rxdIdx,
+                  (unsigned long) rxcd.len,
+                  (int) rxcd.sop,
+                  (unsigned long) rxcd.tuc);
+
+        is_head = false;
+        ready_rxcd_pa = new_rxcd_pa;
+        new_rxcd_pa = 0;
+    }
+
+    if (0 != ready_rxcd_pa) {
+        rxcd.eop = 1;
+        rxcd.err = (0 != bytes_left);
+        cpu_physical_memory_write(ready_rxcd_pa, &rxcd, sizeof(rxcd));
+        vmxnet3_flush_shmem_changes();
+    }
+
+    if (0 != new_rxcd_pa) {
+        vmxnet3_revert_rxc_descr(s, RXQ_IDX);
+    }
+
+    vmxnet3_trigger_interrupt(s, s->rxq_descr[RXQ_IDX].intr_idx);
+
+    if (bytes_left == 0) {
+        vmxnet3_on_rx_done_update_stats(s, RXQ_IDX, VMXNET3_PKT_STATUS_OK);
+        return true;
+    } else if (num_frags == s->max_rx_frags) {
+        vmxnet3_on_rx_done_update_stats(s, RXQ_IDX, VMXNET3_PKT_STATUS_ERROR);
+        return false;
+    } else {
+        vmxnet3_on_rx_done_update_stats(s, RXQ_IDX,
+                                        VMXNET3_PKT_STATUS_OUT_OF_BUF);
+        return false;
+    }
+}
+
+static void
+vmxnet3_io_bar0_write(void *opaque, target_phys_addr_t addr,
+                      uint64_t val, unsigned size)
+{
+    VMXNET3_State *s = opaque;
+
+    if (IS_MULTIREG_ADDR(addr, VMXNET3_REG_TXPROD,
+                        VMXNET3_DEVICE_MAX_TX_QUEUES, VMXNET3_REG_ALIGN)) {
+        int tx_queue_idx =
+            MULTIREG_IDX_BY_ADDR(addr, VMXNET3_REG_TXPROD, VMXNET3_REG_ALIGN);
+        assert(tx_queue_idx <= s->txq_num);
+        vmxnet3_process_tx_queue(s, tx_queue_idx);
+        return;
+    }
+
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wtype-limits"
+    if (IS_MULTIREG_ADDR(addr, VMXNET3_REG_IMR,
+                        VMXNET3_MAX_INTRS, VMXNET3_REG_ALIGN)) {
+        int l = MULTIREG_IDX_BY_ADDR(addr, VMXNET3_REG_IMR, VMXNET3_REG_ALIGN);
+
+        DCBPRINTF("Interrupt mask for line %d written: 0x%" PRIx64, l, val);
+
+        vmxnet3_on_interrupt_mask_changed(s, l, val);
+        return;
+    }
+#pragma GCC diagnostic pop
+
+    if (IS_MULTIREG_ADDR(addr, VMXNET3_REG_RXPROD,
+                        VMXNET3_DEVICE_MAX_RX_QUEUES, VMXNET3_REG_ALIGN) ||
+       IS_MULTIREG_ADDR(addr, VMXNET3_REG_RXPROD2,
+                        VMXNET3_DEVICE_MAX_RX_QUEUES, VMXNET3_REG_ALIGN)) {
+        return;
+    }
+
+    DWRPRINTF("BAR0 unknown write [%" PRIx64 "] = %" PRIx64 ", size %d",
+              (uint64_t) addr, val, size);
+}
+
+static uint64_t
+vmxnet3_io_bar0_read(void *opaque, target_phys_addr_t addr, unsigned size)
+{
+#pragma GCC diagnostic push
+#pragma GCC diagnostic ignored "-Wtype-limits"
+    if (IS_MULTIREG_ADDR(addr, VMXNET3_REG_IMR,
+                        VMXNET3_MAX_INTRS, VMXNET3_REG_ALIGN)) {
+        assert(false);
+    }
+#pragma GCC diagnostic pop
+
+    DCBPRINTF("BAR0 unknown read [%" PRIx64 "], size %d", addr, size);
+    return 0;
+}
+
+static void vmxnet3_reset(VMXNET3_State *s)
+{
+    DCBPRINTF("Resetting vmxnet3...");
+
+    vmxnet_tx_pkt_reset(s->tx_pkt);
+    s->curr_txpkt_skip = false;
+    s->curr_txpkt_header_processed = false;
+}
+
+static void vmxnet3_deactivate_device(VMXNET3_State *s)
+{
+    DCBPRINTF("Deactivating vmxnet3...");
+    s->device_active = false;
+}
+
+static void vmxnet3_update_rx_mode(VMXNET3_State *s)
+{
+    s->rx_mode = VMXNET3_READ_DRV_SHARED32(s->drv_shmem,
+                                           devRead.rxFilterConf.rxMode);
+    DCFPRINTF("RX mode: 0x%08X", s->rx_mode);
+}
+
+static void vmxnet3_update_vlan_filters(VMXNET3_State *s)
+{
+    int i;
+
+    /* Copy configuration from shared memory */
+    VMXNET3_READ_DRV_SHARED(s->drv_shmem,
+                            devRead.rxFilterConf.vfTable,
+                            s->vlan_table,
+                            sizeof(s->vlan_table));
+
+    /* Invert byte order when needed */
+    for (i = 0; i < ARRAY_SIZE(s->vlan_table); i++) {
+        s->vlan_table[i] = le32_to_cpu(s->vlan_table[i]);
+    }
+
+    /* Dump configuration for debugging purposes */
+    DCFPRINTF("Configured VLANs:");
+    for (i = 0; i < sizeof(s->vlan_table) * 8; i++) {
+        if (VMXNET3_VFTABLE_ENTRY_IS_SET(s->vlan_table, i)) {
+            DCFPRINTF("\tVLAN %d is present", i);
+        }
+    }
+}
+
+static void vmxnet3_update_mcast_filters(VMXNET3_State *s)
+{
+    uint16_t list_bytes =
+        VMXNET3_READ_DRV_SHARED16(s->drv_shmem,
+                                  devRead.rxFilterConf.mfTableLen);
+
+    s->mcast_list_len = list_bytes / sizeof(s->mcast_list[0]);
+
+    s->mcast_list = g_realloc(s->mcast_list, list_bytes);
+    if (NULL == s->mcast_list) {
+        if (0 == s->mcast_list_len) {
+            DCFPRINTF("Current multicast list is empty");
+        } else {
+            DERPRINTF("Failed to allocate multicast list of %d elements",
+                      s->mcast_list_len);
+        }
+        s->mcast_list_len = 0;
+    } else {
+        int i;
+        target_phys_addr_t mcast_list_pa =
+            VMXNET3_READ_DRV_SHARED64(s->drv_shmem,
+                                      devRead.rxFilterConf.mfTablePA);
+
+        cpu_physical_memory_read(mcast_list_pa, s->mcast_list, list_bytes);
+        DCFPRINTF("Current multicast list len is %d:", s->mcast_list_len);
+        for (i = 0; i < s->mcast_list_len; i++) {
+            DCFPRINTF("\t" MAC_FMT, MAC_ARG(s->mcast_list[i].a));
+        }
+    }
+}
+
+static void vmxnet3_setup_rx_filtering(VMXNET3_State *s)
+{
+    vmxnet3_update_rx_mode(s);
+    vmxnet3_update_vlan_filters(s);
+    vmxnet3_update_mcast_filters(s);
+}
+
+static uint32_t vmxnet3_get_interrupt_config(VMXNET3_State *s)
+{
+    uint32_t interrupt_mode = VMXNET3_IT_AUTO | (VMXNET3_IMM_AUTO << 2);
+    DCFPRINTF("Interrupt config is 0x%X", interrupt_mode);
+    return interrupt_mode;
+}
+
+static void vmxnet3_fill_stats(VMXNET3_State *s)
+{
+    int i;
+    for (i = 0; i < s->txq_num; i++) {
+        cpu_physical_memory_write(s->txq_descr[i].tx_stats_pa,
+                                  &s->txq_descr[i].txq_stats,
+                                  sizeof(s->txq_descr[i].txq_stats));
+    }
+
+    for (i = 0; i < s->rxq_num; i++) {
+        cpu_physical_memory_write(s->rxq_descr[i].rx_stats_pa,
+                                  &s->rxq_descr[i].rxq_stats,
+                                  sizeof(s->rxq_descr[i].rxq_stats));
+    }
+}
+
+static void vmxnet3_adjust_by_guest_type(VMXNET3_State *s)
+{
+    struct Vmxnet3_GOSInfo gos;
+
+    VMXNET3_READ_DRV_SHARED(s->drv_shmem, devRead.misc.driverInfo.gos,
+                            &gos, sizeof(gos));
+    s->rx_packets_compound =
+        (VMXNET3_GOS_TYPE_WIN == gos.gosType) ? false : true;
+
+    DCFPRINTF("Guest type specifics: RXCOMPOUND: %d", s->rx_packets_compound);
+}
+
+static void
+vmxnet3_dump_conf_descr(const char *name,
+                        struct Vmxnet3_VariableLenConfDesc *pm_descr)
+{
+    DCFPRINTF("%s descriptor dump: Version %u, Length %u",
+              name, pm_descr->confVer, pm_descr->confLen);
+
+};
+
+static void vmxnet3_update_pm_state(VMXNET3_State *s)
+{
+    struct Vmxnet3_VariableLenConfDesc pm_descr;
+
+    pm_descr.confLen =
+        VMXNET3_READ_DRV_SHARED32(s->drv_shmem, devRead.pmConfDesc.confLen);
+    pm_descr.confVer =
+        VMXNET3_READ_DRV_SHARED32(s->drv_shmem, devRead.pmConfDesc.confVer);
+    pm_descr.confPA =
+        VMXNET3_READ_DRV_SHARED64(s->drv_shmem, devRead.pmConfDesc.confPA);
+
+    vmxnet3_dump_conf_descr("PM State", &pm_descr);
+}
+
+static void vmxnet3_update_features(VMXNET3_State *s)
+{
+    uint32_t guest_features;
+    int rxcso_supported;
+
+    guest_features = VMXNET3_READ_DRV_SHARED32(s->drv_shmem,
+                                               devRead.misc.uptFeatures);
+
+    rxcso_supported = VMXNET_FLAG_IS_SET(guest_features, UPT1_F_RXCSUM);
+    s->rx_vlan_stripping = VMXNET_FLAG_IS_SET(guest_features, UPT1_F_RXVLAN);
+    s->lro_supported = VMXNET_FLAG_IS_SET(guest_features, UPT1_F_LRO);
+
+    DCFPRINTF("Features configuration: LRO: %d, RXCSUM: %d, VLANSTRIP: %d",
+              s->lro_supported, rxcso_supported,
+              s->rx_vlan_stripping);
+    if (s->peer_has_vhdr) {
+        tap_set_offload(s->nic->nc.peer,
+                        rxcso_supported,
+                        s->lro_supported,
+                        s->lro_supported,
+                        0,
+                        0);
+    }
+}
+
+static void vmxnet3_activate_device(VMXNET3_State *s)
+{
+    int i;
+    static const uint32_t VMXNET3_DEF_TX_THRESHOLD = 1;
+    target_phys_addr_t qdescr_table_pa;
+    uint64_t pa;
+    uint32_t size;
+
+    /* Verify configuration consistency */
+    if (!vmxnet3_verify_driver_magic(s->drv_shmem)) {
+        DERPRINTF("Device configuration received from driver is invalid");
+        return;
+    }
+
+    vmxnet3_adjust_by_guest_type(s);
+    vmxnet3_update_features(s);
+    vmxnet3_update_pm_state(s);
+    vmxnet3_setup_rx_filtering(s);
+    /* Cache fields from shared memory */
+    s->mtu = VMXNET3_READ_DRV_SHARED32(s->drv_shmem, devRead.misc.mtu);
+    DCFPRINTF("MTU is %u", s->mtu);
+
+    s->max_rx_frags =
+        VMXNET3_READ_DRV_SHARED16(s->drv_shmem, devRead.misc.maxNumRxSG);
+
+    DCFPRINTF("Max RX fragments is %u", s->max_rx_frags);
+
+    s->event_int_idx =
+        VMXNET3_READ_DRV_SHARED8(s->drv_shmem, devRead.intrConf.eventIntrIdx);
+    DCFPRINTF("Events interrupt line is %u", s->event_int_idx);
+
+    s->auto_int_masking =
+        VMXNET3_READ_DRV_SHARED8(s->drv_shmem, devRead.intrConf.autoMask);
+    DCFPRINTF("Automatic interrupt masking is %d", (int)s->auto_int_masking);
+
+    s->txq_num =
+        VMXNET3_READ_DRV_SHARED8(s->drv_shmem, devRead.misc.numTxQueues);
+    s->rxq_num =
+        VMXNET3_READ_DRV_SHARED8(s->drv_shmem, devRead.misc.numRxQueues);
+
+    DCFPRINTF("Number of TX/RX queues %u/%u", s->txq_num, s->rxq_num);
+    assert(s->txq_num <= VMXNET3_DEVICE_MAX_TX_QUEUES);
+
+    qdescr_table_pa =
+        VMXNET3_READ_DRV_SHARED64(s->drv_shmem, devRead.misc.queueDescPA);
+    DCFPRINTF("TX queues descriptors table is at 0x%" PRIx64, qdescr_table_pa);
+
+    /*
+     * Worst-case scenario is a packet that holds all TX rings space so
+     * we calculate total size of all TX rings for max TX fragments number
+     */
+    s->max_tx_frags = 0;
+
+    /* TX queues */
+    for (i = 0; i < s->txq_num; i++) {
+        target_phys_addr_t qdescr_pa =
+            qdescr_table_pa + i*sizeof(struct Vmxnet3_TxQueueDesc);
+
+        /* Read interrupt number for this TX queue */
+        s->txq_descr[i].intr_idx =
+            VMXNET3_READ_TX_QUEUE_DESCR8(qdescr_pa, conf.intrIdx);
+
+        DCFPRINTF("TX Queue %d interrupt: %d", i, s->txq_descr[i].intr_idx);
+
+        /* Read rings memory locations for TX queues */
+        pa = VMXNET3_READ_TX_QUEUE_DESCR64(qdescr_pa, conf.txRingBasePA);
+        size = VMXNET3_READ_TX_QUEUE_DESCR32(qdescr_pa, conf.txRingSize);
+
+        vmxnet3_ring_init(&s->txq_descr[i].tx_ring, pa, size,
+                          sizeof(struct Vmxnet3_TxDesc), false);
+        vmxnet3_ring_dump(DCFPRINTF, "TX", i, &s->txq_descr[i].tx_ring);
+
+        s->max_tx_frags += size;
+
+        /* TXC ring */
+        pa = VMXNET3_READ_TX_QUEUE_DESCR64(qdescr_pa, conf.compRingBasePA);
+        size = VMXNET3_READ_TX_QUEUE_DESCR32(qdescr_pa, conf.compRingSize);
+        vmxnet3_ring_init(&s->txq_descr[i].comp_ring, pa, size,
+                          sizeof(struct Vmxnet3_TxCompDesc), true);
+        vmxnet3_ring_dump(DCFPRINTF, "TXC", i, &s->txq_descr[i].comp_ring);
+
+        s->txq_descr[i].tx_stats_pa =
+            qdescr_pa + offsetof(struct Vmxnet3_TxQueueDesc, stats);
+
+        memset(&s->txq_descr[i].txq_stats, 0,
+               sizeof(s->txq_descr[i].txq_stats));
+
+        /* Fill device-managed parameters for queues */
+        VMXNET3_WRITE_TX_QUEUE_DESCR32(qdescr_pa,
+                                       ctrl.txThreshold,
+                                       VMXNET3_DEF_TX_THRESHOLD);
+    }
+
+    /* Preallocate TX packet wrapper */
+    DCFPRINTF("Max TX fragments is %u", s->max_tx_frags);
+    if (vmxnet_tx_pkt_init(&s->tx_pkt, s->max_tx_frags,
+                               s->peer_has_vhdr)) {
+        hw_error("TX pkt configuration problem");
+    }
+
+    if (vmxnet_rx_pkt_init(&s->rx_pkt, s->peer_has_vhdr)) {
+        hw_error("RX pkt configuration problem");
+    }
+
+    /* Read rings memory locations for RX queues */
+    for (i = 0; i < s->rxq_num; i++) {
+        int j;
+        target_phys_addr_t qd_pa =
+            qdescr_table_pa + s->txq_num*sizeof(struct Vmxnet3_TxQueueDesc) +
+            i*sizeof(struct Vmxnet3_RxQueueDesc);
+
+        /* Read interrupt number for this RX queue */
+        s->rxq_descr[i].intr_idx =
+            VMXNET3_READ_TX_QUEUE_DESCR8(qd_pa, conf.intrIdx);
+
+        DCFPRINTF("RX Queue %d interrupt: %d", i, s->rxq_descr[i].intr_idx);
+
+        /* Read rings memory locations */
+        for (j = 0; j < VMXNET3_RX_RINGS_PER_QUEUE; j++) {
+            /* RX rings */
+            pa = VMXNET3_READ_RX_QUEUE_DESCR64(qd_pa, conf.rxRingBasePA[j]);
+            size = VMXNET3_READ_RX_QUEUE_DESCR32(qd_pa, conf.rxRingSize[j]);
+            vmxnet3_ring_init(&s->rxq_descr[i].rx_ring[j], pa, size,
+                              sizeof(struct Vmxnet3_RxDesc), false);
+            DCFPRINTF("RX queue %d:%d: Base: %" PRIx64 ", Size: %d",
+                      i, j, pa, size);
+        }
+
+        /* RXC ring */
+        pa = VMXNET3_READ_RX_QUEUE_DESCR64(qd_pa, conf.compRingBasePA);
+        size = VMXNET3_READ_RX_QUEUE_DESCR32(qd_pa, conf.compRingSize);
+        vmxnet3_ring_init(&s->rxq_descr[i].comp_ring, pa, size,
+                          sizeof(struct Vmxnet3_RxCompDesc), true);
+        DCFPRINTF("RXC queue %d: Base: %" PRIx64 ", Size: %d", i, pa, size);
+
+        s->rxq_descr[i].rx_stats_pa =
+            qd_pa + offsetof(struct Vmxnet3_RxQueueDesc, stats);
+        memset(&s->rxq_descr[i].rxq_stats, 0,
+               sizeof(s->rxq_descr[i].rxq_stats));
+    }
+
+    vmxnet3_flush_shmem_changes();
+    s->device_active = true;
+}
+
+static void vmxnet3_handle_command(VMXNET3_State *s, uint64_t cmd)
+{
+    s->last_command = cmd;
+
+    switch (cmd) {
+    case VMXNET3_CMD_GET_PERM_MAC_HI:
+        DCBPRINTF("Set: Get upper part of permanent MAC");
+        break;
+
+    case VMXNET3_CMD_GET_PERM_MAC_LO:
+        DCBPRINTF("Set: Get lower part of permanent MAC");
+        break;
+
+    case VMXNET3_CMD_GET_STATS:
+        DCBPRINTF("Set: Get device statistics");
+        vmxnet3_fill_stats(s);
+        break;
+
+    case VMXNET3_CMD_ACTIVATE_DEV:
+        DCBPRINTF("Set: Activating vmxnet3 device");
+        vmxnet3_activate_device(s);
+        break;
+
+    case VMXNET3_CMD_UPDATE_RX_MODE:
+        DCBPRINTF("Set: Update rx mode");
+        vmxnet3_update_rx_mode(s);
+        break;
+
+    case VMXNET3_CMD_UPDATE_VLAN_FILTERS:
+        DCBPRINTF("Set: Update VLAN filters");
+        vmxnet3_update_vlan_filters(s);
+        break;
+
+    case VMXNET3_CMD_UPDATE_MAC_FILTERS:
+        DCBPRINTF("Set: Update MAC filters");
+        vmxnet3_update_mcast_filters(s);
+        break;
+
+    case VMXNET3_CMD_UPDATE_FEATURE:
+        DCBPRINTF("Set: Update features");
+        vmxnet3_update_features(s);
+        break;
+
+    case VMXNET3_CMD_UPDATE_PMCFG:
+        DCBPRINTF("Set: Update power management config");
+        vmxnet3_update_pm_state(s);
+        break;
+
+    case VMXNET3_CMD_GET_LINK:
+        DCBPRINTF("Set: Get link");
+        break;
+
+    case VMXNET3_CMD_RESET_DEV:
+        DCBPRINTF("Set: Reset device");
+        vmxnet3_reset(s);
+        break;
+
+    case VMXNET3_CMD_QUIESCE_DEV:
+        DCBPRINTF("Set: VMXNET3_CMD_QUIESCE_DEV - pause the device");
+        vmxnet3_deactivate_device(s);
+        break;
+
+    case VMXNET3_CMD_GET_CONF_INTR:
+        DCBPRINTF("Set: VMXNET3_CMD_GET_CONF_INTR - interrupt configuration");
+        break;
+
+    default:
+        DCBPRINTF("Received unknown command: %" PRIx64, cmd);
+        break;
+    }
+}
+
+static uint64_t vmxnet3_get_command_status(VMXNET3_State *s)
+{
+    uint64_t ret;
+
+    switch (s->last_command) {
+    case VMXNET3_CMD_ACTIVATE_DEV:
+        ret = (s->device_active) ? 0 : -1;
+        DCFPRINTF("Device active: %" PRIx64, ret);
+        break;
+
+    case VMXNET3_CMD_GET_LINK:
+        ret = s->link_status_and_speed;
+        DCFPRINTF("Link and speed: %" PRIx64, ret);
+        break;
+
+    case VMXNET3_CMD_GET_PERM_MAC_LO:
+        ret = vmxnet3_get_mac_low(&s->perm_mac);
+        break;
+
+    case VMXNET3_CMD_GET_PERM_MAC_HI:
+        ret = vmxnet3_get_mac_high(&s->perm_mac);
+        break;
+
+    case VMXNET3_CMD_GET_CONF_INTR:
+        ret = vmxnet3_get_interrupt_config(s);
+        break;
+
+    default:
+        DWRPRINTF("Received request for unknown command: %x", s->last_command);
+        ret = -1;
+        break;
+    }
+
+    return ret;
+}
+
+static void vmxnet3_set_events(VMXNET3_State *s, uint32_t val)
+{
+    uint32_t events;
+
+    DCBPRINTF("Setting events: 0x%x", val);
+    events = VMXNET3_READ_DRV_SHARED32(s->drv_shmem, ecr) | val;
+    VMXNET3_WRITE_DRV_SHARED32(s->drv_shmem, ecr, events);
+}
+
+static void vmxnet3_ack_events(VMXNET3_State *s, uint32_t val)
+{
+    uint32_t events;
+
+    DCBPRINTF("Clearing events: 0x%x", val);
+    events = VMXNET3_READ_DRV_SHARED32(s->drv_shmem, ecr) & ~val;
+    VMXNET3_WRITE_DRV_SHARED32(s->drv_shmem, ecr, events);
+}
+
+static void
+vmxnet3_io_bar1_write(void *opaque,
+                      target_phys_addr_t addr,
+                      uint64_t val,
+                      unsigned size)
+{
+    VMXNET3_State *s = opaque;
+
+    switch (addr) {
+    /* Vmxnet3 Revision Report Selection */
+    case VMXNET3_REG_VRRS:
+        DCBPRINTF("Write BAR1 [VMXNET3_REG_VRRS] = %" PRIx64 ", size %d",
+                  val, size);
+        break;
+
+    /* UPT Version Report Selection */
+    case VMXNET3_REG_UVRS:
+        DCBPRINTF("Write BAR1 [VMXNET3_REG_UVRS] = %" PRIx64 ", size %d",
+                  val, size);
+        break;
+
+    /* Driver Shared Address Low */
+    case VMXNET3_REG_DSAL:
+        DCBPRINTF("Write BAR1 [VMXNET3_REG_DSAL] = %" PRIx64 ", size %d",
+                  val, size);
+        /*
+         * Guest driver will first write the low part of the shared
+         * memory address. We save it to temp variable and set the
+         * shared address only after we get the high part
+         */
+        if (0 == val) {
+            s->device_active = false;
+        }
+        s->temp_shared_guest_driver_memory = val;
+        s->drv_shmem = 0;
+        break;
+
+    /* Driver Shared Address High */
+    case VMXNET3_REG_DSAH:
+        DCBPRINTF("Write BAR1 [VMXNET3_REG_DSAH] = %" PRIx64 ", size %d",
+                  val, size);
+        /*
+         * Set the shared memory between guest driver and device.
+         * We already should have low address part.
+         */
+        s->drv_shmem = s->temp_shared_guest_driver_memory | (val << 32);
+        break;
+
+    /* Command */
+    case VMXNET3_REG_CMD:
+        DCBPRINTF("Write BAR1 [VMXNET3_REG_CMD] = %" PRIx64 ", size %d",
+                  val, size);
+        vmxnet3_handle_command(s, val);
+        break;
+
+    /* MAC Address Low */
+    case VMXNET3_REG_MACL:
+        DCBPRINTF("Write BAR1 [VMXNET3_REG_MACL] = %" PRIx64 ", size %d",
+                  val, size);
+        s->temp_mac = val;
+        break;
+
+    /* MAC Address High */
+    case VMXNET3_REG_MACH:
+        DCBPRINTF("Write BAR1 [VMXNET3_REG_MACH] = %" PRIx64 ", size %d",
+                  val, size);
+        vmxnet3_set_variable_mac(s, val, s->temp_mac);
+        break;
+
+    /* Interrupt Cause Register */
+    case VMXNET3_REG_ICR:
+        DCBPRINTF("Write BAR1 [VMXNET3_REG_ICR] = %" PRIx64 ", size %d",
+                  val, size);
+        assert(false);
+        break;
+
+    /* Event Cause Register */
+    case VMXNET3_REG_ECR:
+        DCBPRINTF("Write BAR1 [VMXNET3_REG_ECR] = %" PRIx64 ", size %d",
+                  val, size);
+        vmxnet3_ack_events(s, val);
+        break;
+
+    default:
+        DCBPRINTF("Unknown Write to BAR1 [%" PRIx64 "] = %" PRIx64 ", size %d",
+                  addr, val, size);
+        break;
+    }
+}
+
+static uint64_t
+vmxnet3_io_bar1_read(void *opaque, target_phys_addr_t addr, unsigned size)
+{
+        VMXNET3_State *s = opaque;
+        uint64_t ret = 0;
+
+        switch (addr) {
+        /* Vmxnet3 Revision Report Selection */
+        case VMXNET3_REG_VRRS:
+            DCBPRINTF("Read BAR1 [VMXNET3_REG_VRRS], size %d", size);
+            ret = VMXNET3_DEVICE_REVISION;
+            break;
+
+        /* UPT Version Report Selection */
+        case VMXNET3_REG_UVRS:
+            DCBPRINTF("Read BAR1 [VMXNET3_REG_UVRS], size %d", size);
+            ret = VMXNET3_DEVICE_VERSION;
+            break;
+
+        /* Command */
+        case VMXNET3_REG_CMD:
+            DCBPRINTF("Read BAR1 [VMXNET3_REG_CMD], size %d", size);
+            ret = vmxnet3_get_command_status(s);
+            break;
+
+        /* MAC Address Low */
+        case VMXNET3_REG_MACL:
+            DCBPRINTF("Read BAR1 [VMXNET3_REG_MACL], size %d", size);
+            ret = vmxnet3_get_mac_low(&s->conf.macaddr);
+            break;
+
+        /* MAC Address High */
+        case VMXNET3_REG_MACH:
+            DCBPRINTF("Read BAR1 [VMXNET3_REG_MACH], size %d", size);
+            ret = vmxnet3_get_mac_high(&s->conf.macaddr);
+            break;
+
+        /*
+         * Interrupt Cause Register
+         * Used for legacy interrupts only so interrupt index always 0
+         */
+        case VMXNET3_REG_ICR:
+            DCBPRINTF("Read BAR1 [VMXNET3_REG_ICR], size %d", size);
+            if (vmxnet3_interrupt_asserted(s, 0)) {
+                vmxnet3_clear_interrupt(s, 0);
+                ret = true;
+            } else {
+                ret = false;
+            }
+            break;
+
+        default:
+            DCBPRINTF("Unknow read BAR1[%" PRIx64 "], %d bytes", addr, size);
+            break;
+        }
+
+        return ret;
+}
+
+static int
+vmxnet3_can_receive(VLANClientState *nc)
+{
+    VMXNET3_State *s = DO_UPCAST(NICState, nc, nc)->opaque;
+    return s->device_active &&
+           VMXNET_FLAG_IS_SET(s->link_status_and_speed, VMXNET3_LINK_STATUS_UP);
+}
+
+static inline bool
+vmxnet3_is_registered_vlan(VMXNET3_State *s, const void *data)
+{
+    uint16_t vlan_tag = eth_get_pkt_vlan_tag(data) & VLAN_VID_MASK;
+
+    if (IS_SPECIAL_VLAN_ID(vlan_tag)) {
+        return true;
+    }
+
+    return VMXNET3_VFTABLE_ENTRY_IS_SET(s->vlan_table, vlan_tag);
+}
+
+static bool
+vmxnet3_is_allowed_mcast_group(VMXNET3_State *s, const uint8_t *group_mac)
+{
+    int i;
+    for (i = 0; i < s->mcast_list_len; i++) {
+        if (!memcmp(group_mac, s->mcast_list[i].a, sizeof(s->mcast_list[i]))) {
+            return true;
+        }
+    }
+    return false;
+}
+
+static bool
+vmxnet3_rx_filter_may_indicate(VMXNET3_State *s, const void *data,
+    size_t size)
+{
+    struct eth_header *ehdr = PKT_GET_ETH_HDR(data);
+
+    if (VMXNET_FLAG_IS_SET(s->rx_mode, VMXNET3_RXM_PROMISC)) {
+        return true;
+    }
+
+    if (!vmxnet3_is_registered_vlan(s, data)) {
+        return false;
+    }
+
+    switch (vmxnet_rx_pkt_get_packet_type(s->rx_pkt)) {
+    case ETH_PKT_UCAST:
+        if (!VMXNET_FLAG_IS_SET(s->rx_mode, VMXNET3_RXM_UCAST)) {
+            return false;
+        }
+        if (memcmp(s->conf.macaddr.a, ehdr->h_dest, ETH_ALEN)) {
+            return false;
+        }
+        break;
+
+    case ETH_PKT_BCAST:
+        if (!VMXNET_FLAG_IS_SET(s->rx_mode, VMXNET3_RXM_BCAST)) {
+            return false;
+        }
+        break;
+
+    case ETH_PKT_MCAST:
+        if (VMXNET_FLAG_IS_SET(s->rx_mode, VMXNET3_RXM_ALL_MULTI)) {
+            return true;
+        }
+        if (!VMXNET_FLAG_IS_SET(s->rx_mode, VMXNET3_RXM_MCAST)) {
+            return false;
+        }
+        if (!vmxnet3_is_allowed_mcast_group(s, ehdr->h_dest)) {
+            return false;
+        }
+        break;
+
+    default:
+        assert(false);
+    }
+
+    return true;
+}
+
+static ssize_t
+vmxnet3_receive(VLANClientState *nc, const uint8_t *buf, size_t size)
+{
+    VMXNET3_State *s = DO_UPCAST(NICState, nc, nc)->opaque;
+    size_t bytes_indicated;
+
+    if (!vmxnet3_can_receive(&s->nic->nc)) {
+        DPKPRINTF("Cannot receive now");
+        return -1;
+    }
+
+    if (s->peer_has_vhdr) {
+        vmxnet_rx_pkt_set_vhdr(s->rx_pkt, (struct virtio_net_hdr *)buf);
+        buf += sizeof(struct virtio_net_hdr);
+        size -= sizeof(struct virtio_net_hdr);
+    }
+
+    vmxnet_rx_pkt_set_packet_type(s->rx_pkt,
+        get_eth_packet_type(PKT_GET_ETH_HDR(buf)));
+
+    if (vmxnet3_rx_filter_may_indicate(s, buf, size)) {
+        vmxnet_rx_pkt_attach_data(s->rx_pkt, buf, size, s->rx_vlan_stripping);
+        bytes_indicated = vmxnet3_indicate_packet(s) ? size : -1;
+        if (bytes_indicated < size) {
+            DPKPRINTF("RX: %lu of %lu bytes indicated", bytes_indicated, size);
+        }
+    } else {
+        DPKPRINTF("Packet dropped by RX filter");
+        bytes_indicated = size;
+    }
+
+    assert(size > 0);
+    assert(bytes_indicated != 0);
+    return bytes_indicated;
+}
+
+static void vmxnet3_cleanup(VLANClientState *nc)
+{
+    VMXNET3_State *s = DO_UPCAST(NICState, nc, nc)->opaque;
+    s->nic = NULL;
+}
+
+static void vmxnet3_set_link_status(VLANClientState *nc)
+{
+    VMXNET3_State *s = DO_UPCAST(NICState, nc, nc)->opaque;
+
+    if (nc->link_down) {
+        s->link_status_and_speed &= ~VMXNET3_LINK_STATUS_UP;
+    } else {
+        s->link_status_and_speed |= VMXNET3_LINK_STATUS_UP;
+    }
+
+    vmxnet3_set_events(s, VMXNET3_ECR_LINK);
+    vmxnet3_trigger_interrupt(s, s->event_int_idx);
+}
+
+static NetClientInfo net_vmxnet3_info = {
+        .type = NET_CLIENT_TYPE_NIC,
+        .size = sizeof(NICState),
+        .can_receive = vmxnet3_can_receive,
+        .receive = vmxnet3_receive,
+        .cleanup = vmxnet3_cleanup,
+        .link_status_changed = vmxnet3_set_link_status,
+};
+
+static bool vmxnet3_peer_has_vnet_hdr(VMXNET3_State *s)
+{
+    VLANClientState *peer = s->nic->nc.peer;
+
+    if ((NULL != peer)                              &&
+        (NET_CLIENT_TYPE_TAP == peer->info->type)   &&
+        tap_has_vnet_hdr(peer)) {
+        return true;
+    }
+
+    DWRPRINTF("Peer has no virtio extension. Task offloads will be emulated.");
+    return false;
+}
+
+static void vmxnet3_net_uninit(VMXNET3_State *s)
+{
+    if (NULL != s->mcast_list) {
+        g_free(s->mcast_list);
+    }
+
+    vmxnet_tx_pkt_uninit(s->tx_pkt);
+    vmxnet_rx_pkt_uninit(s->rx_pkt);
+}
+
+static void vmxnet3_net_init(VMXNET3_State *s)
+{
+    DCBPRINTF("vmxnet3_net_init called...");
+
+    qemu_macaddr_default_if_unset(&s->conf.macaddr);
+
+    /* Windows guest will query the address that was set on init */
+    memcpy(&s->perm_mac.a, &s->conf.macaddr.a, sizeof(s->perm_mac.a));
+
+    s->mcast_list = NULL;
+    s->mcast_list_len = 0;
+
+    s->link_status_and_speed = VMXNET3_LINK_SPEED | VMXNET3_LINK_STATUS_UP;
+
+    DCFPRINTF("Permanent MAC: " MAC_FMT, MAC_ARG(s->perm_mac.a));
+
+    s->nic = qemu_new_nic(&net_vmxnet3_info, &s->conf,
+                          object_get_typename(OBJECT(s)),
+                          s->dev.qdev.id, s);
+
+    s->peer_has_vhdr = vmxnet3_peer_has_vnet_hdr(s);
+    s->curr_txpkt_skip = false;
+    s->curr_txpkt_header_processed = false;
+    s->tx_pkt = NULL;
+    s->rx_pkt = NULL;
+    s->rx_vlan_stripping = false;
+    s->lro_supported = false;
+
+    if (s->peer_has_vhdr) {
+        tap_set_vnet_hdr_len(s->nic->nc.peer, sizeof(struct virtio_net_hdr));
+        tap_using_vnet_hdr(s->nic->nc.peer, 1);
+    }
+
+    qemu_format_nic_info_str(&s->nic->nc, s->conf.macaddr.a);
+}
+
+static void
+vmxnet3_unuse_msix_vectors(VMXNET3_State *s, int num_vectors)
+{
+    int i;
+    for (i = 0; i < num_vectors; i++) {
+        msix_vector_unuse(&s->dev, i);
+    }
+}
+
+static bool
+vmxnet3_use_msix_vectors(VMXNET3_State *s, int num_vectors)
+{
+    int i;
+    for (i = 0; i < num_vectors; i++) {
+        int res = msix_vector_use(&s->dev, i);
+        if (0 > res) {
+            DWRPRINTF("Failed to use MSI-X vector %d, error %d", i, res);
+            vmxnet3_unuse_msix_vectors(s, i);
+            return false;
+        }
+    }
+    return true;
+}
+
+static bool
+vmxnet3_init_msix(VMXNET3_State *s)
+{
+    int res = msix_init(&s->dev, VMXNET3_MAX_INTRS,
+                        &s->msix_bar, VMXNET3_MSIX_BAR_IDX, 0);
+    if (0 > res) {
+        DWRPRINTF("Failed to initialize MSI-X, error %d", res);
+        s->msix_used = false;
+    } else {
+        if (!vmxnet3_use_msix_vectors(s, VMXNET3_MAX_INTRS)) {
+            DWRPRINTF("Failed to use MSI-X vectors, error %d", res);
+            msix_uninit(&s->dev, &s->msix_bar);
+            s->msix_used = false;
+        } else {
+            s->msix_used = true;
+        }
+    }
+    return s->msix_used;
+}
+
+static void
+vmxnet3_cleanup_msix(VMXNET3_State *s)
+{
+    if (s->msix_used) {
+        msix_vector_unuse(&s->dev, VMXNET3_MAX_INTRS);
+        msix_uninit(&s->dev, &s->msix_bar);
+    }
+}
+
+static bool
+vmxnet3_init_msi(VMXNET3_State *s)
+{
+#define VMXNET3_MSI_NUM_VECTORS   (1)
+#define VMXNET3_MSI_OFFSET        (0x50)
+#define VMXNET3_USE_64BIT         (true)
+#define VMXNET3_PER_VECTOR_MASK   (false)
+
+    int res;
+    res = msi_init(&s->dev, VMXNET3_MSI_OFFSET, VMXNET3_MSI_NUM_VECTORS,
+                   VMXNET3_USE_64BIT, VMXNET3_PER_VECTOR_MASK);
+    if (0 > res) {
+        DWRPRINTF("Failed to initialize MSI, error %d", res);
+        s->msi_used = false;
+    } else {
+        s->msi_used = true;
+    }
+
+    return s->msi_used;
+}
+
+static void
+vmxnet3_cleanup_msi(VMXNET3_State *s)
+{
+    if (s->msi_used) {
+        msi_uninit(&s->dev);
+    }
+}
+
+static void
+vmxnet3_msix_save(QEMUFile *f, void *opaque)
+{
+    msix_save(&((VMXNET3_State *)opaque)->dev, f);
+}
+
+static int
+vmxnet3_msix_load(QEMUFile *f, void *opaque, int version_id)
+{
+    msix_load(&((VMXNET3_State *)opaque)->dev, f);
+    return 0;
+}
+
+static int vmxnet3_pci_init(PCIDevice *dev)
+{
+    static const MemoryRegionOps b0_ops = {
+        .read = vmxnet3_io_bar0_read,
+        .write = vmxnet3_io_bar0_write,
+        .endianness = DEVICE_LITTLE_ENDIAN,
+        .impl = {
+                .min_access_size = 4,
+                .max_access_size = 4,
+        },
+    };
+
+    static const MemoryRegionOps b1_ops = {
+        .read = vmxnet3_io_bar1_read,
+        .write = vmxnet3_io_bar1_write,
+        .endianness = DEVICE_LITTLE_ENDIAN,
+        .impl = {
+                .min_access_size = 4,
+                .max_access_size = 4,
+        },
+    };
+
+    VMXNET3_State *s = DO_UPCAST(VMXNET3_State, dev, dev);
+    int i;
+
+    DCBPRINTF("Starting init...");
+
+    memory_region_init_io(&s->bar0, &b0_ops, s,
+                          "vmxnet3-b0", VMXNET3_PT_REG_SIZE);
+    pci_register_bar(&s->dev, VMXNET3_BAR0_IDX,
+                     PCI_BASE_ADDRESS_SPACE_MEMORY, &s->bar0);
+
+    memory_region_init_io(&s->bar1, &b1_ops, s,
+                          "vmxnet3-b1", VMXNET3_VD_REG_SIZE);
+    pci_register_bar(&s->dev, VMXNET3_BAR1_IDX,
+                     PCI_BASE_ADDRESS_SPACE_MEMORY, &s->bar1);
+
+    memory_region_init(&s->msix_bar, "vmxnet3-msix-bar",
+                       VMXNET3_MSIX_BAR_SIZE);
+    pci_register_bar(&s->dev, VMXNET3_MSIX_BAR_IDX,
+                     PCI_BASE_ADDRESS_SPACE_MEMORY, &s->msix_bar);
+
+    for (i = 0; i < ARRAY_SIZE(s->interrupt_states); i++) {
+        s->interrupt_states[i].is_asserted = false;
+        s->interrupt_states[i].is_pending = false;
+        s->interrupt_states[i].is_masked = true;
+    }
+
+    /* Interrupt pin A */
+    s->dev.config[PCI_INTERRUPT_PIN] = 0x01;
+
+    if (!vmxnet3_init_msix(s)) {
+        DWRPRINTF("Failed to initialize MSI-X, configuration is inconsistent.");
+    }
+
+    if (!vmxnet3_init_msi(s)) {
+        DWRPRINTF("Failed to initialize MSI, configuration is inconsistent.");
+    }
+
+    vmxnet3_net_init(s);
+
+    register_savevm(&dev->qdev, "vmxnet3-msix", -1, 1,
+                    vmxnet3_msix_save, vmxnet3_msix_load, s);
+
+    add_boot_device_path(s->conf.bootindex, &dev->qdev, "/ethernet-phy@0");
+
+    return 0;
+}
+
+
+static int vmxnet3_pci_uninit(PCIDevice *dev)
+{
+    VMXNET3_State *s = DO_UPCAST(VMXNET3_State, dev, dev);
+
+    DCBPRINTF("Starting uninit...");
+
+    unregister_savevm(&dev->qdev, "vmxnet3-msix", s);
+
+    vmxnet3_net_uninit(s);
+
+    vmxnet3_cleanup_msix(s);
+
+    vmxnet3_cleanup_msi(s);
+
+    memory_region_destroy(&s->bar0);
+    memory_region_destroy(&s->bar1);
+    memory_region_destroy(&s->msix_bar);
+
+    return 0;
+}
+
+static void vmxnet3_qdev_reset(DeviceState *dev)
+{
+    VMXNET3_State *s = DO_UPCAST(VMXNET3_State, dev.qdev, dev);
+    DCBPRINTF("Starting QDEV reset...");
+    vmxnet3_reset(s);
+}
+
+static bool vmxnet3_mc_list_needed(void *opaque)
+{
+    return true;
+}
+
+static int vmxnet3_mcast_list_pre_load(void *opaque)
+{
+    VMXNET3_State *s = opaque;
+
+    s->mcast_list = g_malloc(s->mcast_list_buff_size);
+
+    return s->mcast_list ? 0 : 1;
+}
+
+
+static void vmxnet3_pre_save(void *opaque)
+{
+    VMXNET3_State *s = opaque;
+
+    s->mcast_list_buff_size = s->mcast_list_len * sizeof(MACAddr);
+}
+
+static const VMStateDescription vmxtate_vmxnet3_mcast_list = {
+    .name = "vmxnet3/mcast_list",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .pre_load = vmxnet3_mcast_list_pre_load,
+    .fields = (VMStateField[]) {
+        VMSTATE_VBUFFER_UINT32(mcast_list, VMXNET3_State, 0, NULL, 0,
+            mcast_list_buff_size),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static void vmxnet3_get_ring_from_file(QEMUFile *f, Vmxnet3Ring *r)
+{
+#if TARGET_PHYS_ADDR_BITS == 64
+    r->pa = qemu_get_be64(f);
+#else
+    r->pa = qemu_get_be32(f);
+#endif
+    r->size = qemu_get_be32(f);
+    r->cell_size = qemu_get_be32(f);
+    r->next = qemu_get_be32(f);
+    r->gen = qemu_get_byte(f);
+}
+
+static void vmxnet3_put_ring_to_file(QEMUFile *f, Vmxnet3Ring *r)
+{
+#if TARGET_PHYS_ADDR_BITS == 64
+    qemu_put_be64(f, r->pa);
+#else
+    qemu_put_be32(f, r->pa);
+#endif
+    qemu_put_be32(f, r->size);
+    qemu_put_be32(f, r->cell_size);
+    qemu_put_be32(f, r->next);
+    qemu_put_byte(f, r->gen);
+}
+
+static void vmxnet3_get_tx_stats_from_file(QEMUFile *f,
+    struct UPT1_TxStats *tx_stat)
+{
+   tx_stat->TSOPktsTxOK = qemu_get_be64(f);
+   tx_stat->TSOBytesTxOK = qemu_get_be64(f);
+   tx_stat->ucastPktsTxOK = qemu_get_be64(f);
+   tx_stat->ucastBytesTxOK = qemu_get_be64(f);
+   tx_stat->mcastPktsTxOK = qemu_get_be64(f);
+   tx_stat->mcastBytesTxOK = qemu_get_be64(f);
+   tx_stat->bcastPktsTxOK = qemu_get_be64(f);
+   tx_stat->bcastBytesTxOK = qemu_get_be64(f);
+   tx_stat->pktsTxError = qemu_get_be64(f);
+   tx_stat->pktsTxDiscard = qemu_get_be64(f);
+}
+
+static void vmxnet3_put_tx_stats_to_file(QEMUFile *f,
+    struct UPT1_TxStats *tx_stat)
+{
+   qemu_put_be64(f, tx_stat->TSOPktsTxOK);
+   qemu_put_be64(f, tx_stat->TSOBytesTxOK);
+   qemu_put_be64(f, tx_stat->ucastPktsTxOK);
+   qemu_put_be64(f, tx_stat->ucastBytesTxOK);
+   qemu_put_be64(f, tx_stat->mcastPktsTxOK);
+   qemu_put_be64(f, tx_stat->mcastBytesTxOK);
+   qemu_put_be64(f, tx_stat->bcastPktsTxOK);
+   qemu_put_be64(f, tx_stat->bcastBytesTxOK);
+   qemu_put_be64(f, tx_stat->pktsTxError);
+   qemu_put_be64(f, tx_stat->pktsTxDiscard);
+}
+
+static int vmxnet3_get_txq_descr(QEMUFile *f, void *pv, size_t size)
+{
+    Vmxnet3_TxqDescr *r = pv;
+
+    vmxnet3_get_ring_from_file(f, &r->tx_ring);
+    vmxnet3_get_ring_from_file(f, &r->comp_ring);
+    r->intr_idx = qemu_get_byte(f);
+
+#if TARGET_PHYS_ADDR_BITS == 64
+    r->tx_stats_pa = qemu_get_be64(f);
+#else
+    r->tx_stats_pa = qemu_get_be32(f);
+#endif
+
+    vmxnet3_get_tx_stats_from_file(f, &r->txq_stats);
+
+    return 0;
+}
+
+static void vmxnet3_put_txq_descr(QEMUFile *f, void *pv, size_t size)
+{
+    Vmxnet3_TxqDescr *r = pv;
+
+    vmxnet3_put_ring_to_file(f, &r->tx_ring);
+    vmxnet3_put_ring_to_file(f, &r->comp_ring);
+    qemu_put_byte(f, r->intr_idx);
+#if TARGET_PHYS_ADDR_BITS == 64
+    qemu_put_be64(f, r->tx_stats_pa);
+#else
+    qemu_put_be32(f, r->tx_stats_pa);
+#endif
+    vmxnet3_put_tx_stats_to_file(f, &r->txq_stats);
+}
+
+const VMStateInfo txq_descr_info = {
+    .name = "txq_descr",
+    .get = vmxnet3_get_txq_descr,
+    .put = vmxnet3_put_txq_descr
+};
+
+static void vmxnet3_get_rx_stats_from_file(QEMUFile *f,
+    struct UPT1_RxStats *rx_stat)
+{
+   rx_stat->LROPktsRxOK = qemu_get_be64(f);
+   rx_stat->LROBytesRxOK = qemu_get_be64(f);
+   rx_stat->ucastPktsRxOK = qemu_get_be64(f);
+   rx_stat->ucastBytesRxOK = qemu_get_be64(f);
+   rx_stat->mcastPktsRxOK = qemu_get_be64(f);
+   rx_stat->mcastBytesRxOK = qemu_get_be64(f);
+   rx_stat->bcastPktsRxOK = qemu_get_be64(f);
+   rx_stat->bcastBytesRxOK = qemu_get_be64(f);
+   rx_stat->pktsRxOutOfBuf = qemu_get_be64(f);
+   rx_stat->pktsRxError = qemu_get_be64(f);
+}
+
+static void vmxnet3_put_rx_stats_to_file(QEMUFile *f,
+    struct UPT1_RxStats *rx_stat)
+{
+   qemu_put_be64(f, rx_stat->LROPktsRxOK);
+   qemu_put_be64(f, rx_stat->LROBytesRxOK);
+   qemu_put_be64(f, rx_stat->ucastPktsRxOK);
+   qemu_put_be64(f, rx_stat->ucastBytesRxOK);
+   qemu_put_be64(f, rx_stat->mcastPktsRxOK);
+   qemu_put_be64(f, rx_stat->mcastBytesRxOK);
+   qemu_put_be64(f, rx_stat->bcastPktsRxOK);
+   qemu_put_be64(f, rx_stat->bcastBytesRxOK);
+   qemu_put_be64(f, rx_stat->pktsRxOutOfBuf);
+   qemu_put_be64(f, rx_stat->pktsRxError);
+}
+
+static int vmxnet3_get_rxq_descr(QEMUFile *f, void *pv, size_t size)
+{
+    Vmxnet3_RxqDescr *r = pv;
+    int i;
+
+    for (i = 0; i < VMXNET3_RX_RINGS_PER_QUEUE; i++) {
+        vmxnet3_get_ring_from_file(f, &r->rx_ring[i]);
+    }
+
+    vmxnet3_get_ring_from_file(f, &r->comp_ring);
+    r->intr_idx = qemu_get_byte(f);
+#if TARGET_PHYS_ADDR_BITS == 64
+    r->rx_stats_pa = qemu_get_be64(f);
+#else
+    r->rx_stats_pa = qemu_get_be32(f);
+#endif
+
+    vmxnet3_get_rx_stats_from_file(f, &r->rxq_stats);
+
+    return 0;
+}
+
+static void vmxnet3_put_rxq_descr(QEMUFile *f, void *pv, size_t size)
+{
+    Vmxnet3_RxqDescr *r = pv;
+    int i;
+
+    for (i = 0; i < VMXNET3_RX_RINGS_PER_QUEUE; i++) {
+        vmxnet3_put_ring_to_file(f, &r->rx_ring[i]);
+    }
+
+    vmxnet3_put_ring_to_file(f, &r->comp_ring);
+    qemu_put_byte(f, r->intr_idx);
+#if TARGET_PHYS_ADDR_BITS == 64
+    qemu_put_be64(f, r->rx_stats_pa);
+#else
+    qemu_put_be32(f, r->rx_stats_pa);
+#endif
+    vmxnet3_put_rx_stats_to_file(f, &r->rxq_stats);
+}
+
+static int vmxnet3_post_load(void *opaque, int version_id)
+{
+    VMXNET3_State *s = opaque;
+
+    if (vmxnet_tx_pkt_init(&s->tx_pkt, s->max_tx_frags,
+        s->peer_has_vhdr)) {
+        DERPRINTF("TX pkt configuration problem");
+        return -1;
+    }
+
+    if (vmxnet_rx_pkt_init(&s->rx_pkt, s->peer_has_vhdr)) {
+        DERPRINTF("RX pkt configuration problem");
+        return -1;
+    }
+
+    if (s->msix_used) {
+        if  (!vmxnet3_use_msix_vectors(s, VMXNET3_MAX_INTRS)) {
+            DWRPRINTF("Failed to re-use MSI-X vectors");
+            msix_uninit(&s->dev, &s->msix_bar);
+            s->msix_used = false;
+            return -1;
+        }
+    }
+
+    return 0;
+}
+
+const VMStateInfo rxq_descr_info = {
+    .name = "rxq_descr",
+    .get = vmxnet3_get_rxq_descr,
+    .put = vmxnet3_put_rxq_descr
+};
+
+static int vmxnet3_get_int_state(QEMUFile *f, void *pv, size_t size)
+{
+    Vmxnet3_IntState *r = pv;
+
+    r->is_masked = qemu_get_byte(f);
+    r->is_pending = qemu_get_byte(f);
+    r->is_asserted = qemu_get_byte(f);
+
+    return 0;
+}
+
+static void vmxnet3_put_int_state(QEMUFile *f, void *pv, size_t size)
+{
+    Vmxnet3_IntState *r = pv;
+
+    qemu_put_byte(f, r->is_masked);
+    qemu_put_byte(f, r->is_pending);
+    qemu_put_byte(f, r->is_asserted);
+}
+
+const VMStateInfo int_state_info = {
+    .name = "int_state",
+    .get = vmxnet3_get_int_state,
+    .put = vmxnet3_put_int_state
+};
+
+static const VMStateDescription vmstate_vmxnet3 = {
+    .name = "vmxnet3",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .pre_save = vmxnet3_pre_save,
+    .post_load = vmxnet3_post_load,
+    .fields      = (VMStateField[]) {
+            VMSTATE_PCI_DEVICE(dev, VMXNET3_State),
+            VMSTATE_BOOL(rx_packets_compound, VMXNET3_State),
+            VMSTATE_BOOL(rx_vlan_stripping, VMXNET3_State),
+            VMSTATE_BOOL(lro_supported, VMXNET3_State),
+            VMSTATE_UINT32(rx_mode, VMXNET3_State),
+            VMSTATE_UINT32(mcast_list_len, VMXNET3_State),
+            VMSTATE_UINT32(mcast_list_buff_size, VMXNET3_State),
+            VMSTATE_UINT32_ARRAY(vlan_table, VMXNET3_State, VMXNET3_VFT_SIZE),
+            VMSTATE_UINT32(mtu, VMXNET3_State),
+            VMSTATE_UINT16(max_rx_frags, VMXNET3_State),
+            VMSTATE_UINT32(max_tx_frags, VMXNET3_State),
+            VMSTATE_UINT8(event_int_idx, VMXNET3_State),
+            VMSTATE_UINT8(auto_int_masking, VMXNET3_State),
+            VMSTATE_UINT8(txq_num, VMXNET3_State),
+            VMSTATE_UINT8(rxq_num, VMXNET3_State),
+            VMSTATE_UINT32(device_active, VMXNET3_State),
+            VMSTATE_UINT32(last_command, VMXNET3_State),
+            VMSTATE_UINT32(link_status_and_speed, VMXNET3_State),
+            VMSTATE_UINT32(temp_mac, VMXNET3_State),
+#if TARGET_PHYS_ADDR_BITS == 64
+            VMSTATE_UINT64(drv_shmem, VMXNET3_State),
+            VMSTATE_UINT64(temp_shared_guest_driver_memory, VMXNET3_State),
+#else
+            VMSTATE_UINT32(drv_shmem, VMXNET3_State),
+            VMSTATE_UINT32(temp_shared_guest_driver_memory, VMXNET3_State),
+#endif
+
+            VMSTATE_ARRAY(txq_descr, VMXNET3_State,
+                VMXNET3_DEVICE_MAX_TX_QUEUES, 0, txq_descr_info,
+                Vmxnet3_TxqDescr),
+            VMSTATE_ARRAY(rxq_descr, VMXNET3_State,
+                VMXNET3_DEVICE_MAX_RX_QUEUES, 0, rxq_descr_info,
+                Vmxnet3_RxqDescr),
+            VMSTATE_ARRAY(interrupt_states, VMXNET3_State, VMXNET3_MAX_INTRS,
+                0, int_state_info, Vmxnet3_IntState),
+
+            VMSTATE_END_OF_LIST()
+    },
+    .subsections = (VMStateSubsection[]) {
+        {
+            .vmsd = &vmxtate_vmxnet3_mcast_list,
+            .needed = vmxnet3_mc_list_needed
+        },
+        {
+            /* empty element. */
+        }
+    }
+};
+
+static void
+vmxnet3_write_config(PCIDevice *pci, uint32_t addr, uint32_t val, int len)
+{
+    pci_default_write_config(pci, addr, val, len);
+    msix_write_config(pci, addr, val, len);
+    msi_write_config(pci, addr, val, len);
+}
+
+static Property vmxnet3_properties[] = {
+    DEFINE_NIC_PROPERTIES(VMXNET3_State, conf),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void vmxnet3_class_init(ObjectClass *class, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(class);
+    PCIDeviceClass *c = PCI_DEVICE_CLASS(class);
+
+    c->init = vmxnet3_pci_init;
+    c->exit = vmxnet3_pci_uninit;
+    c->vendor_id = PCI_VENDOR_ID_VMWARE;
+    c->device_id = PCI_DEVICE_ID_VMWARE_VMXNET3;
+    c->revision = PCI_DEVICE_ID_VMWARE_VMXNET3_REVISION;
+    c->class_id = PCI_CLASS_NETWORK_ETHERNET;
+    c->subsystem_vendor_id = PCI_VENDOR_ID_VMWARE;
+    c->subsystem_id = PCI_DEVICE_ID_VMWARE_VMXNET3;
+    c->config_write = vmxnet3_write_config,
+    dc->desc = "VMWare Paravirtualized Ethernet v3";
+    dc->reset = vmxnet3_qdev_reset;
+    dc->vmsd = &vmstate_vmxnet3;
+    dc->props = vmxnet3_properties;
+}
+
+static TypeInfo vmxnet3_info = {
+    .name          = "vmxnet3",
+    .parent        = TYPE_PCI_DEVICE,
+    .instance_size = sizeof(VMXNET3_State),
+    .class_init    = vmxnet3_class_init,
+};
+
+static void vmxnet3_register_types(void)
+{
+    DCBPRINTF("vmxnet3_register_types called...");
+    type_register_static(&vmxnet3_info);
+}
+
+type_init(vmxnet3_register_types)
diff --git a/hw/vmxnet3.h b/hw/vmxnet3.h
new file mode 100644
index 0000000..32ad9da
--- /dev/null
+++ b/hw/vmxnet3.h
@@ -0,0 +1,757 @@ 
+/*
+ * QEMU VMWARE VMXNET3 paravirtual NIC
+ *
+ * Copyright (c) 2012 Ravello Systems LTD (http://ravellosystems.com)
+ *
+ * Developed by Daynix Computing LTD (http://www.daynix.com)
+ *
+ * Authors:
+ * Dmitry Fleytman <dmitry@daynix.com>
+ * Tamir Shomer <tamirs@daynix.com>
+ * Yan Vugenfirer <yan@daynix.com>
+ *
+ * This work is licensed under the terms of the GNU GPL, version 2 or later.
+ * See the COPYING file in the top-level directory.
+ *
+ */
+
+#ifndef _QEMU_VMXNET3_H
+#define _QEMU_VMXNET3_H
+
+#define VMXNET_VERSION_3
+
+#define VMXNET3_DEVICE_MAX_TX_QUEUES 8
+#define VMXNET3_DEVICE_MAX_RX_QUEUES 8   /* Keep this value as a power of 2 */
+
+/* Defines needed to integrate VMWARE headers */
+#define u64     uint64_t
+#define u32     uint32_t
+#define u16     uint16_t
+#define u8      uint8_t
+#define __le16  uint16_t
+#define __le32  uint32_t
+#define __le64  uint64_t
+#define __packed QEMU_PACKED
+
+#if defined(HOST_WORDS_BIGENDIAN)
+#define const_cpu_to_le64(x) bswap_64(x)
+#define __BIG_ENDIAN_BITFIELD
+#else
+#define const_cpu_to_le64(x) (x)
+#endif
+
+/*
+ * Following is an interface definition for
+ * VMXNET3 device as provided by VMWARE
+ * See original copyright from Linux kernel v3.2.8
+ * header file drivers/net/vmxnet3/vmxnet3_defs.h below.
+ */
+
+/*
+ * Linux driver for VMware's vmxnet3 ethernet NIC.
+ *
+ * Copyright (C) 2008-2009, VMware, Inc. All Rights Reserved.
+ *
+ * This program is free software; you can redistribute it and/or modify it
+ * under the terms of the GNU General Public License as published by the
+ * Free Software Foundation; version 2 of the License and no later version.
+ *
+ * This program is distributed in the hope that it will be useful, but
+ * WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY OR FITNESS FOR A PARTICULAR PURPOSE, GOOD TITLE or
+ * NON INFRINGEMENT.  See the GNU General Public License for more
+ * details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program; if not, write to the Free Software
+ * Foundation, Inc., 51 Franklin St, Fifth Floor, Boston, MA 02110-1301 USA.
+ *
+ * The full GNU General Public License is included in this distribution in
+ * the file called "COPYING".
+ *
+ * Maintained by: Shreyas Bhatewara <pv-drivers@vmware.com>
+ *
+ */
+
+struct UPT1_TxStats {
+    u64            TSOPktsTxOK;  /* TSO pkts post-segmentation */
+    u64            TSOBytesTxOK;
+    u64            ucastPktsTxOK;
+    u64            ucastBytesTxOK;
+    u64            mcastPktsTxOK;
+    u64            mcastBytesTxOK;
+    u64            bcastPktsTxOK;
+    u64            bcastBytesTxOK;
+    u64            pktsTxError;
+    u64            pktsTxDiscard;
+};
+
+struct UPT1_RxStats {
+    u64            LROPktsRxOK;    /* LRO pkts */
+    u64            LROBytesRxOK;   /* bytes from LRO pkts */
+    /* the following counters are for pkts from the wire, i.e., pre-LRO */
+    u64            ucastPktsRxOK;
+    u64            ucastBytesRxOK;
+    u64            mcastPktsRxOK;
+    u64            mcastBytesRxOK;
+    u64            bcastPktsRxOK;
+    u64            bcastBytesRxOK;
+    u64            pktsRxOutOfBuf;
+    u64            pktsRxError;
+};
+
+/* interrupt moderation level */
+enum {
+    UPT1_IML_NONE        = 0, /* no interrupt moderation */
+    UPT1_IML_HIGHEST    = 7, /* least intr generated */
+    UPT1_IML_ADAPTIVE    = 8, /* adpative intr moderation */
+};
+/* values for UPT1_RSSConf.hashFunc */
+enum {
+    UPT1_RSS_HASH_TYPE_NONE      = 0x0,
+    UPT1_RSS_HASH_TYPE_IPV4      = 0x01,
+    UPT1_RSS_HASH_TYPE_TCP_IPV4  = 0x02,
+    UPT1_RSS_HASH_TYPE_IPV6      = 0x04,
+    UPT1_RSS_HASH_TYPE_TCP_IPV6  = 0x08,
+};
+
+enum {
+    UPT1_RSS_HASH_FUNC_NONE      = 0x0,
+    UPT1_RSS_HASH_FUNC_TOEPLITZ  = 0x01,
+};
+
+#define UPT1_RSS_MAX_KEY_SIZE        40
+#define UPT1_RSS_MAX_IND_TABLE_SIZE  128
+
+struct UPT1_RSSConf {
+    u16            hashType;
+    u16            hashFunc;
+    u16            hashKeySize;
+    u16            indTableSize;
+    u8            hashKey[UPT1_RSS_MAX_KEY_SIZE];
+    u8            indTable[UPT1_RSS_MAX_IND_TABLE_SIZE];
+};
+
+/* features */
+enum {
+    UPT1_F_RXCSUM        = const_cpu_to_le64(0x0001), /* rx csum verification */
+    UPT1_F_RSS        = const_cpu_to_le64(0x0002),
+    UPT1_F_RXVLAN        = const_cpu_to_le64(0x0004), /* VLAN tag stripping */
+    UPT1_F_LRO        = const_cpu_to_le64(0x0008),
+};
+
+/* all registers are 32 bit wide */
+/* BAR 1 */
+enum {
+    VMXNET3_REG_VRRS    = 0x0,    /* Vmxnet3 Revision Report Selection */
+    VMXNET3_REG_UVRS    = 0x8,    /* UPT Version Report Selection */
+    VMXNET3_REG_DSAL    = 0x10,    /* Driver Shared Address Low */
+    VMXNET3_REG_DSAH    = 0x18,    /* Driver Shared Address High */
+    VMXNET3_REG_CMD        = 0x20,    /* Command */
+    VMXNET3_REG_MACL    = 0x28,    /* MAC Address Low */
+    VMXNET3_REG_MACH    = 0x30,    /* MAC Address High */
+    VMXNET3_REG_ICR        = 0x38,    /* Interrupt Cause Register */
+    VMXNET3_REG_ECR        = 0x40    /* Event Cause Register */
+};
+
+/* BAR 0 */
+enum {
+    VMXNET3_REG_IMR        = 0x0,     /* Interrupt Mask Register */
+    VMXNET3_REG_TXPROD    = 0x600, /* Tx Producer Index */
+    VMXNET3_REG_RXPROD    = 0x800, /* Rx Producer Index for ring 1 */
+    VMXNET3_REG_RXPROD2    = 0xA00     /* Rx Producer Index for ring 2 */
+};
+
+#define VMXNET3_PT_REG_SIZE     4096    /* BAR 0 */
+#define VMXNET3_VD_REG_SIZE     4096    /* BAR 1 */
+
+#define VMXNET3_REG_ALIGN       8    /* All registers are 8-byte aligned. */
+#define VMXNET3_REG_ALIGN_MASK  0x7
+
+/* I/O Mapped access to registers */
+#define VMXNET3_IO_TYPE_PT              0
+#define VMXNET3_IO_TYPE_VD              1
+#define VMXNET3_IO_ADDR(type, reg)      (((type) << 24) | ((reg) & 0xFFFFFF))
+#define VMXNET3_IO_TYPE(addr)           ((addr) >> 24)
+#define VMXNET3_IO_REG(addr)            ((addr) & 0xFFFFFF)
+
+enum {
+    VMXNET3_CMD_FIRST_SET = 0xCAFE0000,
+    VMXNET3_CMD_ACTIVATE_DEV = VMXNET3_CMD_FIRST_SET, /* 0xCAFE0000 */
+    VMXNET3_CMD_QUIESCE_DEV,                          /* 0xCAFE0001 */
+    VMXNET3_CMD_RESET_DEV,                            /* 0xCAFE0002 */
+    VMXNET3_CMD_UPDATE_RX_MODE,                       /* 0xCAFE0003 */
+    VMXNET3_CMD_UPDATE_MAC_FILTERS,                   /* 0xCAFE0004 */
+    VMXNET3_CMD_UPDATE_VLAN_FILTERS,                  /* 0xCAFE0005 */
+    VMXNET3_CMD_UPDATE_RSSIDT,                        /* 0xCAFE0006 */
+    VMXNET3_CMD_UPDATE_IML,                           /* 0xCAFE0007 */
+    VMXNET3_CMD_UPDATE_PMCFG,                         /* 0xCAFE0008 */
+    VMXNET3_CMD_UPDATE_FEATURE,                       /* 0xCAFE0009 */
+    VMXNET3_CMD_LOAD_PLUGIN,                          /* 0xCAFE000A */
+
+    VMXNET3_CMD_FIRST_GET = 0xF00D0000,
+    VMXNET3_CMD_GET_QUEUE_STATUS = VMXNET3_CMD_FIRST_GET, /* 0xF00D0000 */
+    VMXNET3_CMD_GET_STATS,                                /* 0xF00D0001 */
+    VMXNET3_CMD_GET_LINK,                                 /* 0xF00D0002 */
+    VMXNET3_CMD_GET_PERM_MAC_LO,                          /* 0xF00D0003 */
+    VMXNET3_CMD_GET_PERM_MAC_HI,                          /* 0xF00D0004 */
+    VMXNET3_CMD_GET_DID_LO,                               /* 0xF00D0005 */
+    VMXNET3_CMD_GET_DID_HI,                               /* 0xF00D0006 */
+    VMXNET3_CMD_GET_DEV_EXTRA_INFO,                       /* 0xF00D0007 */
+    VMXNET3_CMD_GET_CONF_INTR                             /* 0xF00D0008 */
+};
+
+/*
+ *    Little Endian layout of bitfields -
+ *    Byte 0 :    7.....len.....0
+ *    Byte 1 :    rsvd gen 13.len.8
+ *    Byte 2 :     5.msscof.0 ext1  dtype
+ *    Byte 3 :     13...msscof...6
+ *
+ *    Big Endian layout of bitfields -
+ *    Byte 0:        13...msscof...6
+ *    Byte 1 :     5.msscof.0 ext1  dtype
+ *    Byte 2 :    rsvd gen 13.len.8
+ *    Byte 3 :    7.....len.....0
+ *
+ *    Thus, le32_to_cpu on the dword will allow the big endian driver to read
+ *    the bit fields correctly. And cpu_to_le32 will convert bitfields
+ *    bit fields written by big endian driver to format required by device.
+ */
+
+struct Vmxnet3_TxDesc {
+    __le64 addr;
+
+#ifdef __BIG_ENDIAN_BITFIELD
+    u32 msscof:14;  /* MSS, checksum offset, flags */
+    u32 ext1:1;
+    u32 dtype:1;    /* descriptor type */
+    u32 rsvd:1;
+    u32 gen:1;      /* generation bit */
+    u32 len:14;
+#else
+    u32 len:14;
+    u32 gen:1;      /* generation bit */
+    u32 rsvd:1;
+    u32 dtype:1;    /* descriptor type */
+    u32 ext1:1;
+    u32 msscof:14;  /* MSS, checksum offset, flags */
+#endif  /* __BIG_ENDIAN_BITFIELD */
+
+#ifdef __BIG_ENDIAN_BITFIELD
+    u32 tci:16;     /* Tag to Insert */
+    u32 ti:1;       /* VLAN Tag Insertion */
+    u32 ext2:1;
+    u32 cq:1;       /* completion request */
+    u32 eop:1;      /* End Of Packet */
+    u32 om:2;       /* offload mode */
+    u32 hlen:10;    /* header len */
+#else
+    u32 hlen:10;    /* header len */
+    u32 om:2;       /* offload mode */
+    u32 eop:1;      /* End Of Packet */
+    u32 cq:1;       /* completion request */
+    u32 ext2:1;
+    u32 ti:1;       /* VLAN Tag Insertion */
+    u32 tci:16;     /* Tag to Insert */
+#endif  /* __BIG_ENDIAN_BITFIELD */
+};
+
+/* TxDesc.OM values */
+#define VMXNET3_OM_NONE        0
+#define VMXNET3_OM_CSUM        2
+#define VMXNET3_OM_TSO        3
+
+/* fields in TxDesc we access w/o using bit fields */
+#define VMXNET3_TXD_EOP_SHIFT    12
+#define VMXNET3_TXD_CQ_SHIFT    13
+#define VMXNET3_TXD_GEN_SHIFT    14
+#define VMXNET3_TXD_EOP_DWORD_SHIFT 3
+#define VMXNET3_TXD_GEN_DWORD_SHIFT 2
+
+#define VMXNET3_TXD_CQ        (1 << VMXNET3_TXD_CQ_SHIFT)
+#define VMXNET3_TXD_EOP        (1 << VMXNET3_TXD_EOP_SHIFT)
+#define VMXNET3_TXD_GEN        (1 << VMXNET3_TXD_GEN_SHIFT)
+
+#define VMXNET3_HDR_COPY_SIZE   128
+
+
+struct Vmxnet3_TxDataDesc {
+    u8        data[VMXNET3_HDR_COPY_SIZE];
+};
+
+#define VMXNET3_TCD_GEN_SHIFT    31
+#define VMXNET3_TCD_GEN_SIZE    1
+#define VMXNET3_TCD_TXIDX_SHIFT    0
+#define VMXNET3_TCD_TXIDX_SIZE    12
+#define VMXNET3_TCD_GEN_DWORD_SHIFT    3
+
+struct Vmxnet3_TxCompDesc {
+    u32        txdIdx:12;    /* Index of the EOP TxDesc */
+    u32        ext1:20;
+
+    __le32        ext2;
+    __le32        ext3;
+
+    u32        rsvd:24;
+    u32        type:7;       /* completion type */
+    u32        gen:1;        /* generation bit */
+};
+
+struct Vmxnet3_RxDesc {
+    __le64        addr;
+
+#ifdef __BIG_ENDIAN_BITFIELD
+    u32        gen:1;        /* Generation bit */
+    u32        rsvd:15;
+    u32        dtype:1;      /* Descriptor type */
+    u32        btype:1;      /* Buffer Type */
+    u32        len:14;
+#else
+    u32        len:14;
+    u32        btype:1;      /* Buffer Type */
+    u32        dtype:1;      /* Descriptor type */
+    u32        rsvd:15;
+    u32        gen:1;        /* Generation bit */
+#endif
+    u32        ext1;
+};
+
+/* values of RXD.BTYPE */
+#define VMXNET3_RXD_BTYPE_HEAD   0    /* head only */
+#define VMXNET3_RXD_BTYPE_BODY   1    /* body only */
+
+/* fields in RxDesc we access w/o using bit fields */
+#define VMXNET3_RXD_BTYPE_SHIFT  14
+#define VMXNET3_RXD_GEN_SHIFT    31
+
+struct Vmxnet3_RxCompDesc {
+#ifdef __BIG_ENDIAN_BITFIELD
+    u32        ext2:1;
+    u32        cnc:1;        /* Checksum Not Calculated */
+    u32        rssType:4;    /* RSS hash type used */
+    u32        rqID:10;      /* rx queue/ring ID */
+    u32        sop:1;        /* Start of Packet */
+    u32        eop:1;        /* End of Packet */
+    u32        ext1:2;
+    u32        rxdIdx:12;    /* Index of the RxDesc */
+#else
+    u32        rxdIdx:12;    /* Index of the RxDesc */
+    u32        ext1:2;
+    u32        eop:1;        /* End of Packet */
+    u32        sop:1;        /* Start of Packet */
+    u32        rqID:10;      /* rx queue/ring ID */
+    u32        rssType:4;    /* RSS hash type used */
+    u32        cnc:1;        /* Checksum Not Calculated */
+    u32        ext2:1;
+#endif  /* __BIG_ENDIAN_BITFIELD */
+
+    __le32        rssHash;      /* RSS hash value */
+
+#ifdef __BIG_ENDIAN_BITFIELD
+    u32        tci:16;       /* Tag stripped */
+    u32        ts:1;         /* Tag is stripped */
+    u32        err:1;        /* Error */
+    u32        len:14;       /* data length */
+#else
+    u32        len:14;       /* data length */
+    u32        err:1;        /* Error */
+    u32        ts:1;         /* Tag is stripped */
+    u32        tci:16;       /* Tag stripped */
+#endif  /* __BIG_ENDIAN_BITFIELD */
+
+
+#ifdef __BIG_ENDIAN_BITFIELD
+    u32        gen:1;        /* generation bit */
+    u32        type:7;       /* completion type */
+    u32        fcs:1;        /* Frame CRC correct */
+    u32        frg:1;        /* IP Fragment */
+    u32        v4:1;         /* IPv4 */
+    u32        v6:1;         /* IPv6 */
+    u32        ipc:1;        /* IP Checksum Correct */
+    u32        tcp:1;        /* TCP packet */
+    u32        udp:1;        /* UDP packet */
+    u32        tuc:1;        /* TCP/UDP Checksum Correct */
+    u32        csum:16;
+#else
+    u32        csum:16;
+    u32        tuc:1;        /* TCP/UDP Checksum Correct */
+    u32        udp:1;        /* UDP packet */
+    u32        tcp:1;        /* TCP packet */
+    u32        ipc:1;        /* IP Checksum Correct */
+    u32        v6:1;         /* IPv6 */
+    u32        v4:1;         /* IPv4 */
+    u32        frg:1;        /* IP Fragment */
+    u32        fcs:1;        /* Frame CRC correct */
+    u32        type:7;       /* completion type */
+    u32        gen:1;        /* generation bit */
+#endif  /* __BIG_ENDIAN_BITFIELD */
+};
+
+/* fields in RxCompDesc we access via Vmxnet3_GenericDesc.dword[3] */
+#define VMXNET3_RCD_TUC_SHIFT    16
+#define VMXNET3_RCD_IPC_SHIFT    19
+
+/* fields in RxCompDesc we access via Vmxnet3_GenericDesc.qword[1] */
+#define VMXNET3_RCD_TYPE_SHIFT    56
+#define VMXNET3_RCD_GEN_SHIFT    63
+
+/* csum OK for TCP/UDP pkts over IP */
+#define VMXNET3_RCD_CSUM_OK (1 << VMXNET3_RCD_TUC_SHIFT | \
+                     1 << VMXNET3_RCD_IPC_SHIFT)
+#define VMXNET3_TXD_GEN_SIZE 1
+#define VMXNET3_TXD_EOP_SIZE 1
+
+/* value of RxCompDesc.rssType */
+enum {
+    VMXNET3_RCD_RSS_TYPE_NONE     = 0,
+    VMXNET3_RCD_RSS_TYPE_IPV4     = 1,
+    VMXNET3_RCD_RSS_TYPE_TCPIPV4  = 2,
+    VMXNET3_RCD_RSS_TYPE_IPV6     = 3,
+    VMXNET3_RCD_RSS_TYPE_TCPIPV6  = 4,
+};
+
+
+/* a union for accessing all cmd/completion descriptors */
+union Vmxnet3_GenericDesc {
+    __le64                qword[2];
+    __le32                dword[4];
+    __le16                word[8];
+    struct Vmxnet3_TxDesc        txd;
+    struct Vmxnet3_RxDesc        rxd;
+    struct Vmxnet3_TxCompDesc    tcd;
+    struct Vmxnet3_RxCompDesc    rcd;
+};
+
+#define VMXNET3_INIT_GEN       1
+
+/* Max size of a single tx buffer */
+#define VMXNET3_MAX_TX_BUF_SIZE  (1 << 14)
+
+/* # of tx desc needed for a tx buffer size */
+#define VMXNET3_TXD_NEEDED(size) (((size) + VMXNET3_MAX_TX_BUF_SIZE - 1) / \
+                    VMXNET3_MAX_TX_BUF_SIZE)
+
+/* max # of tx descs for a non-tso pkt */
+#define VMXNET3_MAX_TXD_PER_PKT 16
+
+/* Max size of a single rx buffer */
+#define VMXNET3_MAX_RX_BUF_SIZE  ((1 << 14) - 1)
+/* Minimum size of a type 0 buffer */
+#define VMXNET3_MIN_T0_BUF_SIZE  128
+#define VMXNET3_MAX_CSUM_OFFSET  1024
+
+/* Ring base address alignment */
+#define VMXNET3_RING_BA_ALIGN   512
+#define VMXNET3_RING_BA_MASK    (VMXNET3_RING_BA_ALIGN - 1)
+
+/* Ring size must be a multiple of 32 */
+#define VMXNET3_RING_SIZE_ALIGN 32
+#define VMXNET3_RING_SIZE_MASK  (VMXNET3_RING_SIZE_ALIGN - 1)
+
+/* Max ring size */
+#define VMXNET3_TX_RING_MAX_SIZE   4096
+#define VMXNET3_TC_RING_MAX_SIZE   4096
+#define VMXNET3_RX_RING_MAX_SIZE   4096
+#define VMXNET3_RC_RING_MAX_SIZE   8192
+
+/* a list of reasons for queue stop */
+
+enum {
+ VMXNET3_ERR_NOEOP        = 0x80000000, /* cannot find the EOP desc of a pkt */
+ VMXNET3_ERR_TXD_REUSE    = 0x80000001, /* reuse TxDesc before tx completion */
+ VMXNET3_ERR_BIG_PKT      = 0x80000002, /* too many TxDesc for a pkt */
+ VMXNET3_ERR_DESC_NOT_SPT = 0x80000003, /* descriptor type not supported */
+ VMXNET3_ERR_SMALL_BUF    = 0x80000004, /* type 0 buffer too small */
+ VMXNET3_ERR_STRESS       = 0x80000005, /* stress option firing in vmkernel */
+ VMXNET3_ERR_SWITCH       = 0x80000006, /* mode switch failure */
+ VMXNET3_ERR_TXD_INVALID  = 0x80000007, /* invalid TxDesc */
+};
+
+/* completion descriptor types */
+#define VMXNET3_CDTYPE_TXCOMP      0    /* Tx Completion Descriptor */
+#define VMXNET3_CDTYPE_RXCOMP      3    /* Rx Completion Descriptor */
+
+enum {
+    VMXNET3_GOS_BITS_UNK    = 0,   /* unknown */
+    VMXNET3_GOS_BITS_32     = 1,
+    VMXNET3_GOS_BITS_64     = 2,
+};
+
+#define VMXNET3_GOS_TYPE_UNK        0 /* unknown */
+#define VMXNET3_GOS_TYPE_LINUX      1
+#define VMXNET3_GOS_TYPE_WIN        2
+#define VMXNET3_GOS_TYPE_SOLARIS    3
+#define VMXNET3_GOS_TYPE_FREEBSD    4
+#define VMXNET3_GOS_TYPE_PXE        5
+
+struct Vmxnet3_GOSInfo {
+#ifdef __BIG_ENDIAN_BITFIELD
+    u32        gosMisc:10;    /* other info about gos */
+    u32        gosVer:16;     /* gos version */
+    u32        gosType:4;     /* which guest */
+    u32        gosBits:2;    /* 32-bit or 64-bit? */
+#else
+    u32        gosBits:2;     /* 32-bit or 64-bit? */
+    u32        gosType:4;     /* which guest */
+    u32        gosVer:16;     /* gos version */
+    u32        gosMisc:10;    /* other info about gos */
+#endif  /* __BIG_ENDIAN_BITFIELD */
+};
+
+struct Vmxnet3_DriverInfo {
+    __le32                version;
+    struct Vmxnet3_GOSInfo        gos;
+    __le32                vmxnet3RevSpt;
+    __le32                uptVerSpt;
+};
+
+
+#define VMXNET3_REV1_MAGIC  0xbabefee1
+
+/*
+ * QueueDescPA must be 128 bytes aligned. It points to an array of
+ * Vmxnet3_TxQueueDesc followed by an array of Vmxnet3_RxQueueDesc.
+ * The number of Vmxnet3_TxQueueDesc/Vmxnet3_RxQueueDesc are specified by
+ * Vmxnet3_MiscConf.numTxQueues/numRxQueues, respectively.
+ */
+#define VMXNET3_QUEUE_DESC_ALIGN  128
+
+
+struct Vmxnet3_MiscConf {
+    struct Vmxnet3_DriverInfo driverInfo;
+    __le64        uptFeatures;
+    __le64        ddPA;         /* driver data PA */
+    __le64        queueDescPA;  /* queue descriptor table PA */
+    __le32        ddLen;        /* driver data len */
+    __le32        queueDescLen; /* queue desc. table len in bytes */
+    __le32        mtu;
+    __le16        maxNumRxSG;
+    u8        numTxQueues;
+    u8        numRxQueues;
+    __le32        reserved[4];
+};
+
+
+struct Vmxnet3_TxQueueConf {
+    __le64        txRingBasePA;
+    __le64        dataRingBasePA;
+    __le64        compRingBasePA;
+    __le64        ddPA;         /* driver data */
+    __le64        reserved;
+    __le32        txRingSize;   /* # of tx desc */
+    __le32        dataRingSize; /* # of data desc */
+    __le32        compRingSize; /* # of comp desc */
+    __le32        ddLen;        /* size of driver data */
+    u8        intrIdx;
+    u8        _pad[7];
+};
+
+
+struct Vmxnet3_RxQueueConf {
+    __le64        rxRingBasePA[2];
+    __le64        compRingBasePA;
+    __le64        ddPA;            /* driver data */
+    __le64        reserved;
+    __le32        rxRingSize[2];   /* # of rx desc */
+    __le32        compRingSize;    /* # of rx comp desc */
+    __le32        ddLen;           /* size of driver data */
+    u8        intrIdx;
+    u8        _pad[7];
+};
+
+
+enum vmxnet3_intr_mask_mode {
+    VMXNET3_IMM_AUTO   = 0,
+    VMXNET3_IMM_ACTIVE = 1,
+    VMXNET3_IMM_LAZY   = 2
+};
+
+enum vmxnet3_intr_type {
+    VMXNET3_IT_AUTO = 0,
+    VMXNET3_IT_INTX = 1,
+    VMXNET3_IT_MSI  = 2,
+    VMXNET3_IT_MSIX = 3
+};
+
+#define VMXNET3_MAX_TX_QUEUES  8
+#define VMXNET3_MAX_RX_QUEUES  16
+/* addition 1 for events */
+#define VMXNET3_MAX_INTRS      25
+
+/* value of intrCtrl */
+#define VMXNET3_IC_DISABLE_ALL  0x1   /* bit 0 */
+
+
+struct Vmxnet3_IntrConf {
+    bool        autoMask;
+    u8        numIntrs;      /* # of interrupts */
+    u8        eventIntrIdx;
+    u8        modLevels[VMXNET3_MAX_INTRS];    /* moderation level for
+                             * each intr */
+    __le32        intrCtrl;
+    __le32        reserved[2];
+};
+
+/* one bit per VLAN ID, the size is in the units of u32 */
+#define VMXNET3_VFT_SIZE  (4096/(sizeof(uint32_t)*8))
+
+
+struct Vmxnet3_QueueStatus {
+    bool        stopped;
+    u8        _pad[3];
+    __le32        error;
+};
+
+
+struct Vmxnet3_TxQueueCtrl {
+    __le32        txNumDeferred;
+    __le32        txThreshold;
+    __le64        reserved;
+};
+
+
+struct Vmxnet3_RxQueueCtrl {
+    bool        updateRxProd;
+    u8        _pad[7];
+    __le64        reserved;
+};
+
+enum {
+    VMXNET3_RXM_UCAST     = 0x01,  /* unicast only */
+    VMXNET3_RXM_MCAST     = 0x02,  /* multicast passing the filters */
+    VMXNET3_RXM_BCAST     = 0x04,  /* broadcast only */
+    VMXNET3_RXM_ALL_MULTI = 0x08,  /* all multicast */
+    VMXNET3_RXM_PROMISC   = 0x10  /* promiscuous */
+};
+
+struct Vmxnet3_RxFilterConf {
+    __le32        rxMode;       /* VMXNET3_RXM_xxx */
+    __le16        mfTableLen;   /* size of the multicast filter table */
+    __le16        _pad1;
+    __le64        mfTablePA;    /* PA of the multicast filters table */
+    __le32        vfTable[VMXNET3_VFT_SIZE]; /* vlan filter */
+};
+
+
+#define VMXNET3_PM_MAX_FILTERS        6
+#define VMXNET3_PM_MAX_PATTERN_SIZE   128
+#define VMXNET3_PM_MAX_MASK_SIZE      (VMXNET3_PM_MAX_PATTERN_SIZE / 8)
+
+#define VMXNET3_PM_WAKEUP_MAGIC  cpu_to_le16(0x01)  /* wake up on magic pkts */
+#define VMXNET3_PM_WAKEUP_FILTER cpu_to_le16(0x02)  /* wake up on pkts matching
+                                                     * filters */
+
+
+struct Vmxnet3_PM_PktFilter {
+    u8        maskSize;
+    u8        patternSize;
+    u8        mask[VMXNET3_PM_MAX_MASK_SIZE];
+    u8        pattern[VMXNET3_PM_MAX_PATTERN_SIZE];
+    u8        pad[6];
+};
+
+
+struct Vmxnet3_PMConf {
+    __le16        wakeUpEvents;  /* VMXNET3_PM_WAKEUP_xxx */
+    u8        numFilters;
+    u8        pad[5];
+    struct Vmxnet3_PM_PktFilter filters[VMXNET3_PM_MAX_FILTERS];
+};
+
+
+struct Vmxnet3_VariableLenConfDesc {
+    __le32        confVer;
+    __le32        confLen;
+    __le64        confPA;
+};
+
+
+struct Vmxnet3_TxQueueDesc {
+    struct Vmxnet3_TxQueueCtrl        ctrl;
+    struct Vmxnet3_TxQueueConf        conf;
+
+    /* Driver read after a GET command */
+    struct Vmxnet3_QueueStatus        status;
+    struct UPT1_TxStats            stats;
+    u8                    _pad[88]; /* 128 aligned */
+};
+
+
+struct Vmxnet3_RxQueueDesc {
+    struct Vmxnet3_RxQueueCtrl        ctrl;
+    struct Vmxnet3_RxQueueConf        conf;
+    /* Driver read after a GET commad */
+    struct Vmxnet3_QueueStatus        status;
+    struct UPT1_RxStats            stats;
+    u8                      __pad[88]; /* 128 aligned */
+};
+
+
+struct Vmxnet3_DSDevRead {
+    /* read-only region for device, read by dev in response to a SET cmd */
+    struct Vmxnet3_MiscConf            misc;
+    struct Vmxnet3_IntrConf            intrConf;
+    struct Vmxnet3_RxFilterConf        rxFilterConf;
+    struct Vmxnet3_VariableLenConfDesc    rssConfDesc;
+    struct Vmxnet3_VariableLenConfDesc    pmConfDesc;
+    struct Vmxnet3_VariableLenConfDesc    pluginConfDesc;
+};
+
+/* All structures in DriverShared are padded to multiples of 8 bytes */
+struct Vmxnet3_DriverShared {
+    __le32              magic;
+    /* make devRead start at 64bit boundaries */
+    __le32              pad;
+    struct Vmxnet3_DSDevRead    devRead;
+    __le32              ecr;
+    __le32              reserved[5];
+};
+
+
+#define VMXNET3_ECR_RQERR       (1 << 0)
+#define VMXNET3_ECR_TQERR       (1 << 1)
+#define VMXNET3_ECR_LINK        (1 << 2)
+#define VMXNET3_ECR_DIC         (1 << 3)
+#define VMXNET3_ECR_DEBUG       (1 << 4)
+
+/* flip the gen bit of a ring */
+#define VMXNET3_FLIP_RING_GEN(gen) ((gen) = (gen) ^ 0x1)
+
+/* only use this if moving the idx won't affect the gen bit */
+#define VMXNET3_INC_RING_IDX_ONLY(idx, ring_size) \
+    do {\
+        (idx)++;\
+        if (unlikely((idx) == (ring_size))) {\
+            (idx) = 0;\
+        } \
+    } while (0)
+
+#define VMXNET3_SET_VFTABLE_ENTRY(vfTable, vid) \
+    (vfTable[vid >> 5] |= (1 << (vid & 31)))
+#define VMXNET3_CLEAR_VFTABLE_ENTRY(vfTable, vid) \
+    (vfTable[vid >> 5] &= ~(1 << (vid & 31)))
+
+#define VMXNET3_VFTABLE_ENTRY_IS_SET(vfTable, vid) \
+    ((vfTable[vid >> 5] & (1 << (vid & 31))) != 0)
+
+#define VMXNET3_MAX_MTU     9000
+#define VMXNET3_MIN_MTU     60
+
+#define VMXNET3_LINK_UP         (10000 << 16 | 1)    /* 10 Gbps, up */
+#define VMXNET3_LINK_DOWN       0
+
+#undef u64
+#undef u32
+#undef u16
+#undef u8
+#undef __le16
+#undef __le32
+#undef __le64
+#undef __packed
+#undef const_cpu_to_le64
+#if defined(HOST_WORDS_BIGENDIAN)
+#undef __BIG_ENDIAN_BITFIELD
+#endif
+
+#endif
diff --git a/net.c b/net.c
index c34474f..e2f586c 100644
--- a/net.c
+++ b/net.c
@@ -857,7 +857,7 @@  static const struct {
             }, {
                 .name = "model",
                 .type = QEMU_OPT_STRING,
-                .help = "device model (e1000, rtl8139, virtio etc.)",
+                .help = "device model (e1000, rtl8139, virtio, vmxnet3 etc.)",
             }, {
                 .name = "addr",
                 .type = QEMU_OPT_STRING,