diff --git a/hw/rtl8139.c b/hw/rtl8139.c
index 3772ac1..312d362 100644
--- a/hw/rtl8139.c
+++ b/hw/rtl8139.c
@@ -72,6 +72,22 @@
 #define MOD2(input, size) \
     ( ( input ) & ( size - 1 )  )
 
+#define min(x, y) ({                \
+    typeof(x) _min1 = (x);          \
+    typeof(y) _min2 = (y);          \
+    (void) (&_min1 == &_min2);      \
+    _min1 < _min2 ? _min1 : _min2; })
+
+#define ETHER_ADDR_LEN 6
+#define ETHER_TYPE_LEN 2
+#define ETH_HLEN (ETHER_ADDR_LEN * 2 + ETHER_TYPE_LEN)
+#define ETH_P_IP    0x0800      /* Internet Protocol packet */
+#define ETH_P_8021Q 0x8100      /* 802.1Q VLAN Extended Header  */
+#define ETH_MTU     1500
+
+#define VLAN_TCI_LEN 2
+#define VLAN_HLEN (ETHER_TYPE_LEN + VLAN_TCI_LEN)
+
 #if defined (DEBUG_RTL8139)
 #  define DEBUG_PRINT(x) do { printf x ; } while (0)
 #else
@@ -777,6 +793,14 @@ static void rtl8139_write_buffer(RTL8139State *s, const void *buf, int size)
     s->RxBufAddr += size;
 }
 
+static unsigned long rtl8139_write_buffer_crc(RTL8139State *s, const void
+    *buf, int size, unsigned long crc)
+{
+    rtl8139_write_buffer(s, buf, size);
+    return crc32(crc, buf, size);
+}
+
+
 #define MIN_BUF_SIZE 60
 static inline target_phys_addr_t rtl8139_addr64(uint32_t low, uint32_t high)
 {
@@ -809,14 +833,20 @@ static int rtl8139_can_receive(VLANClientState *nc)
     }
 }
 
-static ssize_t rtl8139_do_receive(VLANClientState *nc, const uint8_t *buf, size_t size_, int do_interrupt)
+static ssize_t rtl8139_do_receive(VLANClientState *nc, const uint8_t *buf,
+    size_t buf_size, int do_interrupt, const uint8_t *dot1q_buf)
 {
     RTL8139State *s = DO_UPCAST(NICState, nc, nc)->opaque;
+    /* size_ is the total length of argument buffers */
+    const int size_ = buf_size + (dot1q_buf ? VLAN_HLEN : 0);
+    /* size is the length of the buffer passed to the driver */
     int size = size_;
+    const uint8_t *next_part;
+    size_t next_part_size;
 
     uint32_t packet_header = 0;
 
-    uint8_t buf1[60];
+    uint8_t buf1[MIN_BUF_SIZE];
     static const uint8_t broadcast_macaddr[6] =
         { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
 
@@ -930,10 +960,28 @@ static ssize_t rtl8139_do_receive(VLANClientState *nc, const uint8_t *buf, size_
 
     /* if too small buffer, then expand it */
     if (size < MIN_BUF_SIZE) {
-        memcpy(buf1, buf, size);
-        memset(buf1 + size, 0, MIN_BUF_SIZE - size);
+        size_t copied_size;
+
+        copied_size = min((size_t) ETHER_ADDR_LEN * 2, buf_size);
+        memcpy(buf1, buf, copied_size);
+        buf_size -= copied_size;
+
+        if (dot1q_buf) {
+            if (copied_size >= ETHER_ADDR_LEN * 2) {
+                memcpy(buf1 + copied_size, dot1q_buf, VLAN_HLEN);
+                copied_size += VLAN_HLEN;
+            }
+            dot1q_buf = NULL;
+        }
+
+        if (buf_size > 0) {
+            memcpy(buf1 + copied_size, &buf[ETHER_ADDR_LEN * 2], buf_size);
+            copied_size += buf_size;
+        }
+        memset(buf1 + copied_size, 0, MIN_BUF_SIZE - copied_size);
         buf = buf1;
         size = MIN_BUF_SIZE;
+        buf_size = MIN_BUF_SIZE;
     }
 
     if (rtl8139_cp_receiver_enabled(s))
@@ -996,6 +1044,37 @@ static ssize_t rtl8139_do_receive(VLANClientState *nc, const uint8_t *buf, size_
 
         uint32_t rx_space = rxdw0 & CP_RX_BUFFER_SIZE_MASK;
 
+        /* write VLAN info to descriptor variables.
+         * The "logical" packet is formed of:
+         * * buf[0..12[,
+         * * dot1q_buf (if offloading is enabled and tag is present or
+         *   dot1q_buf is passed in argument),
+         * * next_part[0..next_part_size[.
+         */
+        next_part = &buf[ETHER_ADDR_LEN * 2];
+        if (s->CpCmd & CPlusRxVLAN && (dot1q_buf || be16_to_cpup((uint16_t *)
+                    next_part) == ETH_P_8021Q)) {
+            if (!dot1q_buf) {
+                /* the tag is in the buffer */
+                dot1q_buf = next_part;
+                next_part += VLAN_HLEN;
+            }
+            size -= VLAN_HLEN;
+
+            rxdw1 &= ~CP_RX_VLAN_TAG_MASK;
+            /* BE + ~le_to_cpu()~ + cpu_to_le() = BE */
+            rxdw1 |= CP_RX_TAVA | le16_to_cpup((uint16_t *)
+                &dot1q_buf[ETHER_TYPE_LEN]);
+
+            DEBUG_PRINT(("RTL8139: C+ Rx mode : extracted vlan tag with tci: "
+                    "%u\n", be16_to_cpup((uint16_t *)
+                        &dot1q_buf[ETHER_TYPE_LEN])));
+        } else {
+            /* reset VLAN tag flag */
+            rxdw1 &= ~CP_RX_TAVA;
+        }
+        next_part_size = buf + buf_size - next_part;
+
         /* TODO: scatter the packet over available receive ring descriptors space */
 
         if (size+4 > rx_space)
@@ -1017,7 +1096,18 @@ static ssize_t rtl8139_do_receive(VLANClientState *nc, const uint8_t *buf, size_
         target_phys_addr_t rx_addr = rtl8139_addr64(rxbufLO, rxbufHI);
 
         /* receive/copy to target memory */
-        cpu_physical_memory_write( rx_addr, buf, size );
+        cpu_physical_memory_write(rx_addr, buf, 2 * ETHER_ADDR_LEN);
+        val = crc32(0, buf, 2 * ETHER_ADDR_LEN);
+        if (dot1q_buf) {
+            if (!(s->CpCmd & CPlusRxVLAN)) {
+                cpu_physical_memory_write(rx_addr + 2 * ETHER_ADDR_LEN,
+                    dot1q_buf, VLAN_HLEN);
+            }
+            val = crc32(val, dot1q_buf, VLAN_HLEN);
+        }
+        cpu_physical_memory_write(rx_addr + size - next_part_size, next_part,
+            next_part_size);
+        val = crc32(val, next_part, next_part_size);
 
         if (s->CpCmd & CPlusRxChkSum)
         {
@@ -1025,7 +1115,7 @@ static ssize_t rtl8139_do_receive(VLANClientState *nc, const uint8_t *buf, size_
         }
 
         /* write checksum */
-        val = cpu_to_le32(crc32(0, buf, size));
+        val = cpu_to_le32(val);
         cpu_physical_memory_write( rx_addr+size, (uint8_t *)&val, 4);
 
 /* first segment of received packet flag */
@@ -1070,9 +1160,6 @@ static ssize_t rtl8139_do_receive(VLANClientState *nc, const uint8_t *buf, size_
         rxdw0 &= ~CP_RX_BUFFER_SIZE_MASK;
         rxdw0 |= (size+4);
 
-        /* reset VLAN tag flag */
-        rxdw1 &= ~CP_RX_TAVA;
-
         /* update ring data */
         val = cpu_to_le32(rxdw0);
         cpu_physical_memory_write(cplus_rx_ring_desc,    (uint8_t *)&val, 4);
@@ -1124,10 +1211,18 @@ static ssize_t rtl8139_do_receive(VLANClientState *nc, const uint8_t *buf, size_
 
         rtl8139_write_buffer(s, (uint8_t *)&val, 4);
 
-        rtl8139_write_buffer(s, buf, size);
+        /* receive/copy to target memory */
+        if (dot1q_buf) {
+            val = rtl8139_write_buffer_crc(s, buf, 2 * ETHER_ADDR_LEN, 0);
+            val = rtl8139_write_buffer_crc(s, dot1q_buf, VLAN_HLEN, val);
+            val = rtl8139_write_buffer_crc(s, buf + 2 * ETHER_ADDR_LEN,
+                buf_size - 2 * ETHER_ADDR_LEN, val);
+        } else {
+            val = rtl8139_write_buffer_crc(s, buf, size, 0);
+        }
 
         /* write checksum */
-        val = cpu_to_le32(crc32(0, buf, size));
+        val = cpu_to_le32(val);
         rtl8139_write_buffer(s, (uint8_t *)&val, 4);
 
         /* correct buffer write pointer */
@@ -1151,7 +1246,7 @@ static ssize_t rtl8139_do_receive(VLANClientState *nc, const uint8_t *buf, size_
 
 static ssize_t rtl8139_receive(VLANClientState *nc, const uint8_t *buf, size_t size)
 {
-    return rtl8139_do_receive(nc, buf, size, 1);
+    return rtl8139_do_receive(nc, buf, size, 1, NULL);
 }
 
 static void rtl8139_reset_rxring(RTL8139State *s, uint32_t bufferSize)
@@ -1737,7 +1832,7 @@ static void rtl8139_transfer_frame(RTL8139State *s, const uint8_t *buf, int size
     if (TxLoopBack == (s->TxConfig & TxLoopBack))
     {
         DEBUG_PRINT(("RTL8139: +++ transmit loopback mode\n"));
-        rtl8139_do_receive(&s->nic->nc, buf, size, do_interrupt);
+        rtl8139_do_receive(&s->nic->nc, buf, size, do_interrupt, NULL);
     }
     else
     {
@@ -2066,10 +2161,6 @@ static int rtl8139_cplus_transmit_one(RTL8139State *s)
         {
             DEBUG_PRINT(("RTL8139: +++ C+ mode offloaded task checksum\n"));
 
-            #define ETH_P_IP	0x0800		/* Internet Protocol packet	*/
-            #define ETH_HLEN    14
-            #define ETH_MTU     1500
-
             /* ip packet header */
             ip_header *ip = NULL;
             int hlen = 0;
