Git Repo - qemu.git/blame_incremental

... / ...

Commit	Line	Data
	1	/**
	2	* QEMU RTL8139 emulation
	3	*
	4	* Copyright (c) 2006 Igor Kovalenko
	5	*
	6	* Permission is hereby granted, free of charge, to any person obtaining a copy
	7	* of this software and associated documentation files (the "Software"), to deal
	8	* in the Software without restriction, including without limitation the rights
	9	* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
	10	* copies of the Software, and to permit persons to whom the Software is
	11	* furnished to do so, subject to the following conditions:
	12	*
	13	* The above copyright notice and this permission notice shall be included in
	14	* all copies or substantial portions of the Software.
	15	*
	16	* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
	17	* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
	18	* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
	19	* THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
	20	* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
	21	* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
	22	* THE SOFTWARE.
	23
	24	* Modifications:
	25	* 2006-Jan-28 Mark Malakanov : TSAD and CSCR implementation (for Windows driver)
	26	*
	27	* 2006-Apr-28 Juergen Lock : EEPROM emulation changes for FreeBSD driver
	28	* HW revision ID changes for FreeBSD driver
	29	*
	30	* 2006-Jul-01 Igor Kovalenko : Implemented loopback mode for FreeBSD driver
	31	* Corrected packet transfer reassembly routine for 8139C+ mode
	32	* Rearranged debugging print statements
	33	* Implemented PCI timer interrupt (disabled by default)
	34	* Implemented Tally Counters, increased VM load/save version
	35	* Implemented IP/TCP/UDP checksum task offloading
	36	*
	37	* 2006-Jul-04 Igor Kovalenko : Implemented TCP segmentation offloading
	38	* Fixed MTU=1500 for produced ethernet frames
	39	*
	40	* 2006-Jul-09 Igor Kovalenko : Fixed TCP header length calculation while processing
	41	* segmentation offloading
	42	* Removed slirp.h dependency
	43	* Added rx/tx buffer reset when enabling rx/tx operation
	44	*/
	45
	46	#include "hw.h"
	47	#include "pci.h"
	48	#include "qemu-timer.h"
	49	#include "net.h"
	50	#include "loader.h"
	51
	52	/* debug RTL8139 card */
	53	//#define DEBUG_RTL8139 1
	54
	55	#define PCI_FREQUENCY 33000000L
	56
	57	/* debug RTL8139 card C+ mode only */
	58	//#define DEBUG_RTL8139CP 1
	59
	60	/* Calculate CRCs properly on Rx packets */
	61	#define RTL8139_CALCULATE_RXCRC 1
	62
	63	/* Uncomment to enable on-board timer interrupts */
	64	//#define RTL8139_ONBOARD_TIMER 1
	65
	66	#if defined(RTL8139_CALCULATE_RXCRC)
	67	/* For crc32 */
	68	#include <zlib.h>
	69	#endif
	70
	71	#define SET_MASKED(input, mask, curr) \
	72	( ( (input) & ~(mask) ) \| ( (curr) & (mask) ) )
	73
	74	/* arg % size for size which is a power of 2 */
	75	#define MOD2(input, size) \
	76	( ( input ) & ( size - 1 ) )
	77
	78	#if defined (DEBUG_RTL8139)
	79	# define DEBUG_PRINT(x) do { printf x ; } while (0)
	80	#else
	81	# define DEBUG_PRINT(x)
	82	#endif
	83
	84	/* Symbolic offsets to registers. */
	85	enum RTL8139_registers {
	86	MAC0 = 0, /* Ethernet hardware address. */
	87	MAR0 = 8, /* Multicast filter. */
	88	TxStatus0 = 0x10,/* Transmit status (Four 32bit registers). C mode only */
	89	/* Dump Tally Conter control register(64bit). C+ mode only */
	90	TxAddr0 = 0x20, /* Tx descriptors (also four 32bit). */
	91	RxBuf = 0x30,
	92	ChipCmd = 0x37,
	93	RxBufPtr = 0x38,
	94	RxBufAddr = 0x3A,
	95	IntrMask = 0x3C,
	96	IntrStatus = 0x3E,
	97	TxConfig = 0x40,
	98	RxConfig = 0x44,
	99	Timer = 0x48, /* A general-purpose counter. */
	100	RxMissed = 0x4C, /* 24 bits valid, write clears. */
	101	Cfg9346 = 0x50,
	102	Config0 = 0x51,
	103	Config1 = 0x52,
	104	FlashReg = 0x54,
	105	MediaStatus = 0x58,
	106	Config3 = 0x59,
	107	Config4 = 0x5A, /* absent on RTL-8139A */
	108	HltClk = 0x5B,
	109	MultiIntr = 0x5C,
	110	PCIRevisionID = 0x5E,
	111	TxSummary = 0x60, /* TSAD register. Transmit Status of All Descriptors*/
	112	BasicModeCtrl = 0x62,
	113	BasicModeStatus = 0x64,
	114	NWayAdvert = 0x66,
	115	NWayLPAR = 0x68,
	116	NWayExpansion = 0x6A,
	117	/* Undocumented registers, but required for proper operation. */
	118	FIFOTMS = 0x70, /* FIFO Control and test. */
	119	CSCR = 0x74, /* Chip Status and Configuration Register. */
	120	PARA78 = 0x78,
	121	PARA7c = 0x7c, /* Magic transceiver parameter register. */
	122	Config5 = 0xD8, /* absent on RTL-8139A */
	123	/* C+ mode */
	124	TxPoll = 0xD9, /* Tell chip to check Tx descriptors for work */
	125	RxMaxSize = 0xDA, /* Max size of an Rx packet (8169 only) */
	126	CpCmd = 0xE0, /* C+ Command register (C+ mode only) */
	127	IntrMitigate = 0xE2, /* rx/tx interrupt mitigation control */
	128	RxRingAddrLO = 0xE4, /* 64-bit start addr of Rx ring */
	129	RxRingAddrHI = 0xE8, /* 64-bit start addr of Rx ring */
	130	TxThresh = 0xEC, /* Early Tx threshold */
	131	};
	132
	133	enum ClearBitMasks {
	134	MultiIntrClear = 0xF000,
	135	ChipCmdClear = 0xE2,
	136	Config1Clear = (1<<7)\|(1<<6)\|(1<<3)\|(1<<2)\|(1<<1),
	137	};
	138
	139	enum ChipCmdBits {
	140	CmdReset = 0x10,
	141	CmdRxEnb = 0x08,
	142	CmdTxEnb = 0x04,
	143	RxBufEmpty = 0x01,
	144	};
	145
	146	/* C+ mode */
	147	enum CplusCmdBits {
	148	CPlusRxVLAN = 0x0040, /* enable receive VLAN detagging */
	149	CPlusRxChkSum = 0x0020, /* enable receive checksum offloading */
	150	CPlusRxEnb = 0x0002,
	151	CPlusTxEnb = 0x0001,
	152	};
	153
	154	/* Interrupt register bits, using my own meaningful names. */
	155	enum IntrStatusBits {
	156	PCIErr = 0x8000,
	157	PCSTimeout = 0x4000,
	158	RxFIFOOver = 0x40,
	159	RxUnderrun = 0x20,
	160	RxOverflow = 0x10,
	161	TxErr = 0x08,
	162	TxOK = 0x04,
	163	RxErr = 0x02,
	164	RxOK = 0x01,
	165
	166	RxAckBits = RxFIFOOver \| RxOverflow \| RxOK,
	167	};
	168
	169	enum TxStatusBits {
	170	TxHostOwns = 0x2000,
	171	TxUnderrun = 0x4000,
	172	TxStatOK = 0x8000,
	173	TxOutOfWindow = 0x20000000,
	174	TxAborted = 0x40000000,
	175	TxCarrierLost = 0x80000000,
	176	};
	177	enum RxStatusBits {
	178	RxMulticast = 0x8000,
	179	RxPhysical = 0x4000,
	180	RxBroadcast = 0x2000,
	181	RxBadSymbol = 0x0020,
	182	RxRunt = 0x0010,
	183	RxTooLong = 0x0008,
	184	RxCRCErr = 0x0004,
	185	RxBadAlign = 0x0002,
	186	RxStatusOK = 0x0001,
	187	};
	188
	189	/* Bits in RxConfig. */
	190	enum rx_mode_bits {
	191	AcceptErr = 0x20,
	192	AcceptRunt = 0x10,
	193	AcceptBroadcast = 0x08,
	194	AcceptMulticast = 0x04,
	195	AcceptMyPhys = 0x02,
	196	AcceptAllPhys = 0x01,
	197	};
	198
	199	/* Bits in TxConfig. */
	200	enum tx_config_bits {
	201
	202	/* Interframe Gap Time. Only TxIFG96 doesn't violate IEEE 802.3 */
	203	TxIFGShift = 24,
	204	TxIFG84 = (0 << TxIFGShift), /* 8.4us / 840ns (10 / 100Mbps) */
	205	TxIFG88 = (1 << TxIFGShift), /* 8.8us / 880ns (10 / 100Mbps) */
	206	TxIFG92 = (2 << TxIFGShift), /* 9.2us / 920ns (10 / 100Mbps) */
	207	TxIFG96 = (3 << TxIFGShift), /* 9.6us / 960ns (10 / 100Mbps) */
	208
	209	TxLoopBack = (1 << 18) \| (1 << 17), /* enable loopback test mode */
	210	TxCRC = (1 << 16), /* DISABLE appending CRC to end of Tx packets */
	211	TxClearAbt = (1 << 0), /* Clear abort (WO) */
	212	TxDMAShift = 8, /* DMA burst value (0-7) is shifted this many bits */
	213	TxRetryShift = 4, /* TXRR value (0-15) is shifted this many bits */
	214
	215	TxVersionMask = 0x7C800000, /* mask out version bits 30-26, 23 */
	216	};
	217
	218
	219	/* Transmit Status of All Descriptors (TSAD) Register */
	220	enum TSAD_bits {
	221	TSAD_TOK3 = 1<<15, // TOK bit of Descriptor 3
	222	TSAD_TOK2 = 1<<14, // TOK bit of Descriptor 2
	223	TSAD_TOK1 = 1<<13, // TOK bit of Descriptor 1
	224	TSAD_TOK0 = 1<<12, // TOK bit of Descriptor 0
	225	TSAD_TUN3 = 1<<11, // TUN bit of Descriptor 3
	226	TSAD_TUN2 = 1<<10, // TUN bit of Descriptor 2
	227	TSAD_TUN1 = 1<<9, // TUN bit of Descriptor 1
	228	TSAD_TUN0 = 1<<8, // TUN bit of Descriptor 0
	229	TSAD_TABT3 = 1<<07, // TABT bit of Descriptor 3
	230	TSAD_TABT2 = 1<<06, // TABT bit of Descriptor 2
	231	TSAD_TABT1 = 1<<05, // TABT bit of Descriptor 1
	232	TSAD_TABT0 = 1<<04, // TABT bit of Descriptor 0
	233	TSAD_OWN3 = 1<<03, // OWN bit of Descriptor 3
	234	TSAD_OWN2 = 1<<02, // OWN bit of Descriptor 2
	235	TSAD_OWN1 = 1<<01, // OWN bit of Descriptor 1
	236	TSAD_OWN0 = 1<<00, // OWN bit of Descriptor 0
	237	};
	238
	239
	240	/* Bits in Config1 */
	241	enum Config1Bits {
	242	Cfg1_PM_Enable = 0x01,
	243	Cfg1_VPD_Enable = 0x02,
	244	Cfg1_PIO = 0x04,
	245	Cfg1_MMIO = 0x08,
	246	LWAKE = 0x10, /* not on 8139, 8139A */
	247	Cfg1_Driver_Load = 0x20,
	248	Cfg1_LED0 = 0x40,
	249	Cfg1_LED1 = 0x80,
	250	SLEEP = (1 << 1), /* only on 8139, 8139A */
	251	PWRDN = (1 << 0), /* only on 8139, 8139A */
	252	};
	253
	254	/* Bits in Config3 */
	255	enum Config3Bits {
	256	Cfg3_FBtBEn = (1 << 0), /* 1 = Fast Back to Back */
	257	Cfg3_FuncRegEn = (1 << 1), /* 1 = enable CardBus Function registers */
	258	Cfg3_CLKRUN_En = (1 << 2), /* 1 = enable CLKRUN */
	259	Cfg3_CardB_En = (1 << 3), /* 1 = enable CardBus registers */
	260	Cfg3_LinkUp = (1 << 4), /* 1 = wake up on link up */
	261	Cfg3_Magic = (1 << 5), /* 1 = wake up on Magic Packet (tm) */
	262	Cfg3_PARM_En = (1 << 6), /* 0 = software can set twister parameters */
	263	Cfg3_GNTSel = (1 << 7), /* 1 = delay 1 clock from PCI GNT signal */
	264	};
	265
	266	/* Bits in Config4 */
	267	enum Config4Bits {
	268	LWPTN = (1 << 2), /* not on 8139, 8139A */
	269	};
	270
	271	/* Bits in Config5 */
	272	enum Config5Bits {
	273	Cfg5_PME_STS = (1 << 0), /* 1 = PCI reset resets PME_Status */
	274	Cfg5_LANWake = (1 << 1), /* 1 = enable LANWake signal */
	275	Cfg5_LDPS = (1 << 2), /* 0 = save power when link is down */
	276	Cfg5_FIFOAddrPtr = (1 << 3), /* Realtek internal SRAM testing */
	277	Cfg5_UWF = (1 << 4), /* 1 = accept unicast wakeup frame */
	278	Cfg5_MWF = (1 << 5), /* 1 = accept multicast wakeup frame */
	279	Cfg5_BWF = (1 << 6), /* 1 = accept broadcast wakeup frame */
	280	};
	281
	282	enum RxConfigBits {
	283	/* rx fifo threshold */
	284	RxCfgFIFOShift = 13,
	285	RxCfgFIFONone = (7 << RxCfgFIFOShift),
	286
	287	/* Max DMA burst */
	288	RxCfgDMAShift = 8,
	289	RxCfgDMAUnlimited = (7 << RxCfgDMAShift),
	290
	291	/* rx ring buffer length */
	292	RxCfgRcv8K = 0,
	293	RxCfgRcv16K = (1 << 11),
	294	RxCfgRcv32K = (1 << 12),
	295	RxCfgRcv64K = (1 << 11) \| (1 << 12),
	296
	297	/* Disable packet wrap at end of Rx buffer. (not possible with 64k) */
	298	RxNoWrap = (1 << 7),
	299	};
	300
	301	/* Twister tuning parameters from RealTek.
	302	Completely undocumented, but required to tune bad links on some boards. */
	303	/*
	304	enum CSCRBits {
	305	CSCR_LinkOKBit = 0x0400,
	306	CSCR_LinkChangeBit = 0x0800,
	307	CSCR_LinkStatusBits = 0x0f000,
	308	CSCR_LinkDownOffCmd = 0x003c0,
	309	CSCR_LinkDownCmd = 0x0f3c0,
	310	*/
	311	enum CSCRBits {
	312	CSCR_Testfun = 1<<15, /* 1 = Auto-neg speeds up internal timer, WO, def 0 */
	313	CSCR_LD = 1<<9, /* Active low TPI link disable signal. When low, TPI still transmits link pulses and TPI stays in good link state. def 1*/
	314	CSCR_HEART_BIT = 1<<8, /* 1 = HEART BEAT enable, 0 = HEART BEAT disable. HEART BEAT function is only valid in 10Mbps mode. def 1*/
	315	CSCR_JBEN = 1<<7, /* 1 = enable jabber function. 0 = disable jabber function, def 1*/
	316	CSCR_F_LINK_100 = 1<<6, /* Used to login force good link in 100Mbps for diagnostic purposes. 1 = DISABLE, 0 = ENABLE. def 1*/
	317	CSCR_F_Connect = 1<<5, /* Assertion of this bit forces the disconnect function to be bypassed. def 0*/
	318	CSCR_Con_status = 1<<3, /* This bit indicates the status of the connection. 1 = valid connected link detected; 0 = disconnected link detected. RO def 0*/
	319	CSCR_Con_status_En = 1<<2, /* Assertion of this bit configures LED1 pin to indicate connection status. def 0*/
	320	CSCR_PASS_SCR = 1<<0, /* Bypass Scramble, def 0*/
	321	};
	322
	323	enum Cfg9346Bits {
	324	Cfg9346_Lock = 0x00,
	325	Cfg9346_Unlock = 0xC0,
	326	};
	327
	328	typedef enum {
	329	CH_8139 = 0,
	330	CH_8139_K,
	331	CH_8139A,
	332	CH_8139A_G,
	333	CH_8139B,
	334	CH_8130,
	335	CH_8139C,
	336	CH_8100,
	337	CH_8100B_8139D,
	338	CH_8101,
	339	} chip_t;
	340
	341	enum chip_flags {
	342	HasHltClk = (1 << 0),
	343	HasLWake = (1 << 1),
	344	};
	345
	346	#define HW_REVID(b30, b29, b28, b27, b26, b23, b22) \
	347	(b30<<30 \| b29<<29 \| b28<<28 \| b27<<27 \| b26<<26 \| b23<<23 \| b22<<22)
	348	#define HW_REVID_MASK HW_REVID(1, 1, 1, 1, 1, 1, 1)
	349
	350	#define RTL8139_PCI_REVID_8139 0x10
	351	#define RTL8139_PCI_REVID_8139CPLUS 0x20
	352
	353	#define RTL8139_PCI_REVID RTL8139_PCI_REVID_8139CPLUS
	354
	355	/* Size is 64 * 16bit words */
	356	#define EEPROM_9346_ADDR_BITS 6
	357	#define EEPROM_9346_SIZE (1 << EEPROM_9346_ADDR_BITS)
	358	#define EEPROM_9346_ADDR_MASK (EEPROM_9346_SIZE - 1)
	359
	360	enum Chip9346Operation
	361	{
	362	Chip9346_op_mask = 0xc0, /* 10 zzzzzz */
	363	Chip9346_op_read = 0x80, /* 10 AAAAAA */
	364	Chip9346_op_write = 0x40, /* 01 AAAAAA D(15)..D(0) */
	365	Chip9346_op_ext_mask = 0xf0, /* 11 zzzzzz */
	366	Chip9346_op_write_enable = 0x30, /* 00 11zzzz */
	367	Chip9346_op_write_all = 0x10, /* 00 01zzzz */
	368	Chip9346_op_write_disable = 0x00, /* 00 00zzzz */
	369	};
	370
	371	enum Chip9346Mode
	372	{
	373	Chip9346_none = 0,
	374	Chip9346_enter_command_mode,
	375	Chip9346_read_command,
	376	Chip9346_data_read, /* from output register */
	377	Chip9346_data_write, /* to input register, then to contents at specified address */
	378	Chip9346_data_write_all, /* to input register, then filling contents */
	379	};
	380
	381	typedef struct EEprom9346
	382	{
	383	uint16_t contents[EEPROM_9346_SIZE];
	384	int mode;
	385	uint32_t tick;
	386	uint8_t address;
	387	uint16_t input;
	388	uint16_t output;
	389
	390	uint8_t eecs;
	391	uint8_t eesk;
	392	uint8_t eedi;
	393	uint8_t eedo;
	394	} EEprom9346;
	395
	396	typedef struct RTL8139TallyCounters
	397	{
	398	/* Tally counters */
	399	uint64_t TxOk;
	400	uint64_t RxOk;
	401	uint64_t TxERR;
	402	uint32_t RxERR;
	403	uint16_t MissPkt;
	404	uint16_t FAE;
	405	uint32_t Tx1Col;
	406	uint32_t TxMCol;
	407	uint64_t RxOkPhy;
	408	uint64_t RxOkBrd;
	409	uint32_t RxOkMul;
	410	uint16_t TxAbt;
	411	uint16_t TxUndrn;
	412	} RTL8139TallyCounters;
	413
	414	/* Clears all tally counters */
	415	static void RTL8139TallyCounters_clear(RTL8139TallyCounters* counters);
	416
	417	/* Writes tally counters to specified physical memory address */
	418	static void RTL8139TallyCounters_physical_memory_write(target_phys_addr_t tc_addr, RTL8139TallyCounters* counters);
	419
	420	/* Loads values of tally counters from VM state file */
	421	static void RTL8139TallyCounters_load(QEMUFile* f, RTL8139TallyCounters *tally_counters);
	422
	423	/* Saves values of tally counters to VM state file */
	424	static void RTL8139TallyCounters_save(QEMUFile* f, RTL8139TallyCounters *tally_counters);
	425
	426	typedef struct RTL8139State {
	427	PCIDevice dev;
	428	uint8_t phys[8]; /* mac address */
	429	uint8_t mult[8]; /* multicast mask array */
	430
	431	uint32_t TxStatus[4]; /* TxStatus0 in C mode/ / also DTCCR[0] and DTCCR[1] in C+ mode */
	432	uint32_t TxAddr[4]; /* TxAddr0 */
	433	uint32_t RxBuf; /* Receive buffer */
	434	uint32_t RxBufferSize;/* internal variable, receive ring buffer size in C mode */
	435	uint32_t RxBufPtr;
	436	uint32_t RxBufAddr;
	437
	438	uint16_t IntrStatus;
	439	uint16_t IntrMask;
	440
	441	uint32_t TxConfig;
	442	uint32_t RxConfig;
	443	uint32_t RxMissed;
	444
	445	uint16_t CSCR;
	446
	447	uint8_t Cfg9346;
	448	uint8_t Config0;
	449	uint8_t Config1;
	450	uint8_t Config3;
	451	uint8_t Config4;
	452	uint8_t Config5;
	453
	454	uint8_t clock_enabled;
	455	uint8_t bChipCmdState;
	456
	457	uint16_t MultiIntr;
	458
	459	uint16_t BasicModeCtrl;
	460	uint16_t BasicModeStatus;
	461	uint16_t NWayAdvert;
	462	uint16_t NWayLPAR;
	463	uint16_t NWayExpansion;
	464
	465	uint16_t CpCmd;
	466	uint8_t TxThresh;
	467
	468	VLANClientState *vc;
	469	NICConf conf;
	470	int rtl8139_mmio_io_addr;
	471
	472	/* C ring mode */
	473	uint32_t currTxDesc;
	474
	475	/* C+ mode */
	476	uint32_t cplus_enabled;
	477
	478	uint32_t currCPlusRxDesc;
	479	uint32_t currCPlusTxDesc;
	480
	481	uint32_t RxRingAddrLO;
	482	uint32_t RxRingAddrHI;
	483
	484	EEprom9346 eeprom;
	485
	486	uint32_t TCTR;
	487	uint32_t TimerInt;
	488	int64_t TCTR_base;
	489
	490	/* Tally counters */
	491	RTL8139TallyCounters tally_counters;
	492
	493	/* Non-persistent data */
	494	uint8_t *cplus_txbuffer;
	495	int cplus_txbuffer_len;
	496	int cplus_txbuffer_offset;
	497
	498	/* PCI interrupt timer */
	499	QEMUTimer *timer;
	500
	501	} RTL8139State;
	502
	503	static void prom9346_decode_command(EEprom9346 *eeprom, uint8_t command)
	504	{
	505	DEBUG_PRINT(("RTL8139: eeprom command 0x%02x\n", command));
	506
	507	switch (command & Chip9346_op_mask)
	508	{
	509	case Chip9346_op_read:
	510	{
	511	eeprom->address = command & EEPROM_9346_ADDR_MASK;
	512	eeprom->output = eeprom->contents[eeprom->address];
	513	eeprom->eedo = 0;
	514	eeprom->tick = 0;
	515	eeprom->mode = Chip9346_data_read;
	516	DEBUG_PRINT(("RTL8139: eeprom read from address 0x%02x data=0x%04x\n",
	517	eeprom->address, eeprom->output));
	518	}
	519	break;
	520
	521	case Chip9346_op_write:
	522	{
	523	eeprom->address = command & EEPROM_9346_ADDR_MASK;
	524	eeprom->input = 0;
	525	eeprom->tick = 0;
	526	eeprom->mode = Chip9346_none; /* Chip9346_data_write */
	527	DEBUG_PRINT(("RTL8139: eeprom begin write to address 0x%02x\n",
	528	eeprom->address));
	529	}
	530	break;
	531	default:
	532	eeprom->mode = Chip9346_none;
	533	switch (command & Chip9346_op_ext_mask)
	534	{
	535	case Chip9346_op_write_enable:
	536	DEBUG_PRINT(("RTL8139: eeprom write enabled\n"));
	537	break;
	538	case Chip9346_op_write_all:
	539	DEBUG_PRINT(("RTL8139: eeprom begin write all\n"));
	540	break;
	541	case Chip9346_op_write_disable:
	542	DEBUG_PRINT(("RTL8139: eeprom write disabled\n"));
	543	break;
	544	}
	545	break;
	546	}
	547	}
	548
	549	static void prom9346_shift_clock(EEprom9346 *eeprom)
	550	{
	551	int bit = eeprom->eedi?1:0;
	552
	553	++ eeprom->tick;
	554
	555	DEBUG_PRINT(("eeprom: tick %d eedi=%d eedo=%d\n", eeprom->tick, eeprom->eedi, eeprom->eedo));
	556
	557	switch (eeprom->mode)
	558	{
	559	case Chip9346_enter_command_mode:
	560	if (bit)
	561	{
	562	eeprom->mode = Chip9346_read_command;
	563	eeprom->tick = 0;
	564	eeprom->input = 0;
	565	DEBUG_PRINT(("eeprom: +++ synchronized, begin command read\n"));
	566	}
	567	break;
	568
	569	case Chip9346_read_command:
	570	eeprom->input = (eeprom->input << 1) \| (bit & 1);
	571	if (eeprom->tick == 8)
	572	{
	573	prom9346_decode_command(eeprom, eeprom->input & 0xff);
	574	}
	575	break;
	576
	577	case Chip9346_data_read:
	578	eeprom->eedo = (eeprom->output & 0x8000)?1:0;
	579	eeprom->output <<= 1;
	580	if (eeprom->tick == 16)
	581	{
	582	#if 1
	583	// the FreeBSD drivers (rl and re) don't explicitly toggle
	584	// CS between reads (or does setting Cfg9346 to 0 count too?),
	585	// so we need to enter wait-for-command state here
	586	eeprom->mode = Chip9346_enter_command_mode;
	587	eeprom->input = 0;
	588	eeprom->tick = 0;
	589
	590	DEBUG_PRINT(("eeprom: +++ end of read, awaiting next command\n"));
	591	#else
	592	// original behaviour
	593	++eeprom->address;
	594	eeprom->address &= EEPROM_9346_ADDR_MASK;
	595	eeprom->output = eeprom->contents[eeprom->address];
	596	eeprom->tick = 0;
	597
	598	DEBUG_PRINT(("eeprom: +++ read next address 0x%02x data=0x%04x\n",
	599	eeprom->address, eeprom->output));
	600	#endif
	601	}
	602	break;
	603
	604	case Chip9346_data_write:
	605	eeprom->input = (eeprom->input << 1) \| (bit & 1);
	606	if (eeprom->tick == 16)
	607	{
	608	DEBUG_PRINT(("RTL8139: eeprom write to address 0x%02x data=0x%04x\n",
	609	eeprom->address, eeprom->input));
	610
	611	eeprom->contents[eeprom->address] = eeprom->input;
	612	eeprom->mode = Chip9346_none; /* waiting for next command after CS cycle */
	613	eeprom->tick = 0;
	614	eeprom->input = 0;
	615	}
	616	break;
	617
	618	case Chip9346_data_write_all:
	619	eeprom->input = (eeprom->input << 1) \| (bit & 1);
	620	if (eeprom->tick == 16)
	621	{
	622	int i;
	623	for (i = 0; i < EEPROM_9346_SIZE; i++)
	624	{
	625	eeprom->contents[i] = eeprom->input;
	626	}
	627	DEBUG_PRINT(("RTL8139: eeprom filled with data=0x%04x\n",
	628	eeprom->input));
	629
	630	eeprom->mode = Chip9346_enter_command_mode;
	631	eeprom->tick = 0;
	632	eeprom->input = 0;
	633	}
	634	break;
	635
	636	default:
	637	break;
	638	}
	639	}
	640
	641	static int prom9346_get_wire(RTL8139State *s)
	642	{
	643	EEprom9346 *eeprom = &s->eeprom;
	644	if (!eeprom->eecs)
	645	return 0;
	646
	647	return eeprom->eedo;
	648	}
	649
	650	/* FIXME: This should be merged into/replaced by eeprom93xx.c. */
	651	static void prom9346_set_wire(RTL8139State *s, int eecs, int eesk, int eedi)
	652	{
	653	EEprom9346 *eeprom = &s->eeprom;
	654	uint8_t old_eecs = eeprom->eecs;
	655	uint8_t old_eesk = eeprom->eesk;
	656
	657	eeprom->eecs = eecs;
	658	eeprom->eesk = eesk;
	659	eeprom->eedi = eedi;
	660
	661	DEBUG_PRINT(("eeprom: +++ wires CS=%d SK=%d DI=%d DO=%d\n",
	662	eeprom->eecs, eeprom->eesk, eeprom->eedi, eeprom->eedo));
	663
	664	if (!old_eecs && eecs)
	665	{
	666	/* Synchronize start */
	667	eeprom->tick = 0;
	668	eeprom->input = 0;
	669	eeprom->output = 0;
	670	eeprom->mode = Chip9346_enter_command_mode;
	671
	672	DEBUG_PRINT(("=== eeprom: begin access, enter command mode\n"));
	673	}
	674
	675	if (!eecs)
	676	{
	677	DEBUG_PRINT(("=== eeprom: end access\n"));
	678	return;
	679	}
	680
	681	if (!old_eesk && eesk)
	682	{
	683	/* SK front rules */
	684	prom9346_shift_clock(eeprom);
	685	}
	686	}
	687
	688	static void rtl8139_update_irq(RTL8139State *s)
	689	{
	690	int isr;
	691	isr = (s->IntrStatus & s->IntrMask) & 0xffff;
	692
	693	DEBUG_PRINT(("RTL8139: Set IRQ to %d (%04x %04x)\n",
	694	isr ? 1 : 0, s->IntrStatus, s->IntrMask));
	695
	696	qemu_set_irq(s->dev.irq[0], (isr != 0));
	697	}
	698
	699	#define POLYNOMIAL 0x04c11db6
	700
	701	/* From FreeBSD */
	702	/* XXX: optimize */
	703	static int compute_mcast_idx(const uint8_t *ep)
	704	{
	705	uint32_t crc;
	706	int carry, i, j;
	707	uint8_t b;
	708
	709	crc = 0xffffffff;
	710	for (i = 0; i < 6; i++) {
	711	b = *ep++;
	712	for (j = 0; j < 8; j++) {
	713	carry = ((crc & 0x80000000L) ? 1 : 0) ^ (b & 0x01);
	714	crc <<= 1;
	715	b >>= 1;
	716	if (carry)
	717	crc = ((crc ^ POLYNOMIAL) \| carry);
	718	}
	719	}
	720	return (crc >> 26);
	721	}
	722
	723	static int rtl8139_RxWrap(RTL8139State *s)
	724	{
	725	/* wrapping enabled; assume 1.5k more buffer space if size < 65536 */
	726	return (s->RxConfig & (1 << 7));
	727	}
	728
	729	static int rtl8139_receiver_enabled(RTL8139State *s)
	730	{
	731	return s->bChipCmdState & CmdRxEnb;
	732	}
	733
	734	static int rtl8139_transmitter_enabled(RTL8139State *s)
	735	{
	736	return s->bChipCmdState & CmdTxEnb;
	737	}
	738
	739	static int rtl8139_cp_receiver_enabled(RTL8139State *s)
	740	{
	741	return s->CpCmd & CPlusRxEnb;
	742	}
	743
	744	static int rtl8139_cp_transmitter_enabled(RTL8139State *s)
	745	{
	746	return s->CpCmd & CPlusTxEnb;
	747	}
	748
	749	static void rtl8139_write_buffer(RTL8139State s, const void buf, int size)
	750	{
	751	if (s->RxBufAddr + size > s->RxBufferSize)
	752	{
	753	int wrapped = MOD2(s->RxBufAddr + size, s->RxBufferSize);
	754
	755	/* write packet data */
	756	if (wrapped && !(s->RxBufferSize < 65536 && rtl8139_RxWrap(s)))
	757	{
	758	DEBUG_PRINT((">>> RTL8139: rx packet wrapped in buffer at %d\n", size-wrapped));
	759
	760	if (size > wrapped)
	761	{
	762	cpu_physical_memory_write( s->RxBuf + s->RxBufAddr,
	763	buf, size-wrapped );
	764	}
	765
	766	/* reset buffer pointer */
	767	s->RxBufAddr = 0;
	768
	769	cpu_physical_memory_write( s->RxBuf + s->RxBufAddr,
	770	buf + (size-wrapped), wrapped );
	771
	772	s->RxBufAddr = wrapped;
	773
	774	return;
	775	}
	776	}
	777
	778	/* non-wrapping path or overwrapping enabled */
	779	cpu_physical_memory_write( s->RxBuf + s->RxBufAddr, buf, size );
	780
	781	s->RxBufAddr += size;
	782	}
	783
	784	#define MIN_BUF_SIZE 60
	785	static inline target_phys_addr_t rtl8139_addr64(uint32_t low, uint32_t high)
	786	{
	787	#if TARGET_PHYS_ADDR_BITS > 32
	788	return low \| ((target_phys_addr_t)high << 32);
	789	#else
	790	return low;
	791	#endif
	792	}
	793
	794	static int rtl8139_can_receive(VLANClientState *vc)
	795	{
	796	RTL8139State *s = vc->opaque;
	797	int avail;
	798
	799	/* Receive (drop) packets if card is disabled. */
	800	if (!s->clock_enabled)
	801	return 1;
	802	if (!rtl8139_receiver_enabled(s))
	803	return 1;
	804
	805	if (rtl8139_cp_receiver_enabled(s)) {
	806	/* ??? Flow control not implemented in c+ mode.
	807	This is a hack to work around slirp deficiencies anyway. */
	808	return 1;
	809	} else {
	810	avail = MOD2(s->RxBufferSize + s->RxBufPtr - s->RxBufAddr,
	811	s->RxBufferSize);
	812	return (avail == 0 \|\| avail >= 1514);
	813	}
	814	}
	815
	816	static ssize_t rtl8139_do_receive(VLANClientState vc, const uint8_t buf, size_t size_, int do_interrupt)
	817	{
	818	RTL8139State *s = vc->opaque;
	819	int size = size_;
	820
	821	uint32_t packet_header = 0;
	822
	823	uint8_t buf1[60];
	824	static const uint8_t broadcast_macaddr[6] =
	825	{ 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
	826
	827	DEBUG_PRINT((">>> RTL8139: received len=%d\n", size));
	828
	829	/* test if board clock is stopped */
	830	if (!s->clock_enabled)
	831	{
	832	DEBUG_PRINT(("RTL8139: stopped ==========================\n"));
	833	return -1;
	834	}
	835
	836	/* first check if receiver is enabled */
	837
	838	if (!rtl8139_receiver_enabled(s))
	839	{
	840	DEBUG_PRINT(("RTL8139: receiver disabled ================\n"));
	841	return -1;
	842	}
	843
	844	/* XXX: check this */
	845	if (s->RxConfig & AcceptAllPhys) {
	846	/* promiscuous: receive all */
	847	DEBUG_PRINT((">>> RTL8139: packet received in promiscuous mode\n"));
	848
	849	} else {
	850	if (!memcmp(buf, broadcast_macaddr, 6)) {
	851	/* broadcast address */
	852	if (!(s->RxConfig & AcceptBroadcast))
	853	{
	854	DEBUG_PRINT((">>> RTL8139: broadcast packet rejected\n"));
	855
	856	/* update tally counter */
	857	++s->tally_counters.RxERR;
	858
	859	return size;
	860	}
	861
	862	packet_header \|= RxBroadcast;
	863
	864	DEBUG_PRINT((">>> RTL8139: broadcast packet received\n"));
	865
	866	/* update tally counter */
	867	++s->tally_counters.RxOkBrd;
	868
	869	} else if (buf[0] & 0x01) {
	870	/* multicast */
	871	if (!(s->RxConfig & AcceptMulticast))
	872	{
	873	DEBUG_PRINT((">>> RTL8139: multicast packet rejected\n"));
	874
	875	/* update tally counter */
	876	++s->tally_counters.RxERR;
	877
	878	return size;
	879	}
	880
	881	int mcast_idx = compute_mcast_idx(buf);
	882
	883	if (!(s->mult[mcast_idx >> 3] & (1 << (mcast_idx & 7))))
	884	{
	885	DEBUG_PRINT((">>> RTL8139: multicast address mismatch\n"));
	886
	887	/* update tally counter */
	888	++s->tally_counters.RxERR;
	889
	890	return size;
	891	}
	892
	893	packet_header \|= RxMulticast;
	894
	895	DEBUG_PRINT((">>> RTL8139: multicast packet received\n"));
	896
	897	/* update tally counter */
	898	++s->tally_counters.RxOkMul;
	899
	900	} else if (s->phys[0] == buf[0] &&
	901	s->phys[1] == buf[1] &&
	902	s->phys[2] == buf[2] &&
	903	s->phys[3] == buf[3] &&
	904	s->phys[4] == buf[4] &&
	905	s->phys[5] == buf[5]) {
	906	/* match */
	907	if (!(s->RxConfig & AcceptMyPhys))
	908	{
	909	DEBUG_PRINT((">>> RTL8139: rejecting physical address matching packet\n"));
	910
	911	/* update tally counter */
	912	++s->tally_counters.RxERR;
	913
	914	return size;
	915	}
	916
	917	packet_header \|= RxPhysical;
	918
	919	DEBUG_PRINT((">>> RTL8139: physical address matching packet received\n"));
	920
	921	/* update tally counter */
	922	++s->tally_counters.RxOkPhy;
	923
	924	} else {
	925
	926	DEBUG_PRINT((">>> RTL8139: unknown packet\n"));
	927
	928	/* update tally counter */
	929	++s->tally_counters.RxERR;
	930
	931	return size;
	932	}
	933	}
	934
	935	/* if too small buffer, then expand it */
	936	if (size < MIN_BUF_SIZE) {
	937	memcpy(buf1, buf, size);
	938	memset(buf1 + size, 0, MIN_BUF_SIZE - size);
	939	buf = buf1;
	940	size = MIN_BUF_SIZE;
	941	}
	942
	943	if (rtl8139_cp_receiver_enabled(s))
	944	{
	945	DEBUG_PRINT(("RTL8139: in C+ Rx mode ================\n"));
	946
	947	/* begin C+ receiver mode */
	948
	949	/* w0 ownership flag */
	950	#define CP_RX_OWN (1<<31)
	951	/* w0 end of ring flag */
	952	#define CP_RX_EOR (1<<30)
	953	/* w0 bits 0...12 : buffer size */
	954	#define CP_RX_BUFFER_SIZE_MASK ((1<<13) - 1)
	955	/* w1 tag available flag */
	956	#define CP_RX_TAVA (1<<16)
	957	/* w1 bits 0...15 : VLAN tag */
	958	#define CP_RX_VLAN_TAG_MASK ((1<<16) - 1)
	959	/* w2 low 32bit of Rx buffer ptr */
	960	/* w3 high 32bit of Rx buffer ptr */
	961
	962	int descriptor = s->currCPlusRxDesc;
	963	target_phys_addr_t cplus_rx_ring_desc;
	964
	965	cplus_rx_ring_desc = rtl8139_addr64(s->RxRingAddrLO, s->RxRingAddrHI);
	966	cplus_rx_ring_desc += 16 * descriptor;
	967
	968	DEBUG_PRINT(("RTL8139: +++ C+ mode reading RX descriptor %d from host memory at %08x %08x = %016" PRIx64 "\n",
	969	descriptor, s->RxRingAddrHI, s->RxRingAddrLO, (uint64_t)cplus_rx_ring_desc));
	970
	971	uint32_t val, rxdw0,rxdw1,rxbufLO,rxbufHI;
	972
	973	cpu_physical_memory_read(cplus_rx_ring_desc, (uint8_t *)&val, 4);
	974	rxdw0 = le32_to_cpu(val);
	975	cpu_physical_memory_read(cplus_rx_ring_desc+4, (uint8_t *)&val, 4);
	976	rxdw1 = le32_to_cpu(val);
	977	cpu_physical_memory_read(cplus_rx_ring_desc+8, (uint8_t *)&val, 4);
	978	rxbufLO = le32_to_cpu(val);
	979	cpu_physical_memory_read(cplus_rx_ring_desc+12, (uint8_t *)&val, 4);
	980	rxbufHI = le32_to_cpu(val);
	981
	982	DEBUG_PRINT(("RTL8139: +++ C+ mode RX descriptor %d %08x %08x %08x %08x\n",
	983	descriptor,
	984	rxdw0, rxdw1, rxbufLO, rxbufHI));
	985
	986	if (!(rxdw0 & CP_RX_OWN))
	987	{
	988	DEBUG_PRINT(("RTL8139: C+ Rx mode : descriptor %d is owned by host\n", descriptor));
	989
	990	s->IntrStatus \|= RxOverflow;
	991	++s->RxMissed;
	992
	993	/* update tally counter */
	994	++s->tally_counters.RxERR;
	995	++s->tally_counters.MissPkt;
	996
	997	rtl8139_update_irq(s);
	998	return size_;
	999	}
	1000
	1001	uint32_t rx_space = rxdw0 & CP_RX_BUFFER_SIZE_MASK;
	1002
	1003	/* TODO: scatter the packet over available receive ring descriptors space */
	1004
	1005	if (size+4 > rx_space)
	1006	{
	1007	DEBUG_PRINT(("RTL8139: C+ Rx mode : descriptor %d size %d received %d + 4\n",
	1008	descriptor, rx_space, size));
	1009
	1010	s->IntrStatus \|= RxOverflow;
	1011	++s->RxMissed;
	1012
	1013	/* update tally counter */
	1014	++s->tally_counters.RxERR;
	1015	++s->tally_counters.MissPkt;
	1016
	1017	rtl8139_update_irq(s);
	1018	return size_;
	1019	}
	1020
	1021	target_phys_addr_t rx_addr = rtl8139_addr64(rxbufLO, rxbufHI);
	1022
	1023	/* receive/copy to target memory */
	1024	cpu_physical_memory_write( rx_addr, buf, size );
	1025
	1026	if (s->CpCmd & CPlusRxChkSum)
	1027	{
	1028	/* do some packet checksumming */
	1029	}
	1030
	1031	/* write checksum */
	1032	#if defined (RTL8139_CALCULATE_RXCRC)
	1033	val = cpu_to_le32(crc32(0, buf, size));
	1034	#else
	1035	val = 0;
	1036	#endif
	1037	cpu_physical_memory_write( rx_addr+size, (uint8_t *)&val, 4);
	1038
	1039	/* first segment of received packet flag */
	1040	#define CP_RX_STATUS_FS (1<<29)
	1041	/* last segment of received packet flag */
	1042	#define CP_RX_STATUS_LS (1<<28)
	1043	/* multicast packet flag */
	1044	#define CP_RX_STATUS_MAR (1<<26)
	1045	/* physical-matching packet flag */
	1046	#define CP_RX_STATUS_PAM (1<<25)
	1047	/* broadcast packet flag */
	1048	#define CP_RX_STATUS_BAR (1<<24)
	1049	/* runt packet flag */
	1050	#define CP_RX_STATUS_RUNT (1<<19)
	1051	/* crc error flag */
	1052	#define CP_RX_STATUS_CRC (1<<18)
	1053	/* IP checksum error flag */
	1054	#define CP_RX_STATUS_IPF (1<<15)
	1055	/* UDP checksum error flag */
	1056	#define CP_RX_STATUS_UDPF (1<<14)
	1057	/* TCP checksum error flag */
	1058	#define CP_RX_STATUS_TCPF (1<<13)
	1059
	1060	/* transfer ownership to target */
	1061	rxdw0 &= ~CP_RX_OWN;
	1062
	1063	/* set first segment bit */
	1064	rxdw0 \|= CP_RX_STATUS_FS;
	1065
	1066	/* set last segment bit */
	1067	rxdw0 \|= CP_RX_STATUS_LS;
	1068
	1069	/* set received packet type flags */
	1070	if (packet_header & RxBroadcast)
	1071	rxdw0 \|= CP_RX_STATUS_BAR;
	1072	if (packet_header & RxMulticast)
	1073	rxdw0 \|= CP_RX_STATUS_MAR;
	1074	if (packet_header & RxPhysical)
	1075	rxdw0 \|= CP_RX_STATUS_PAM;
	1076
	1077	/* set received size */
	1078	rxdw0 &= ~CP_RX_BUFFER_SIZE_MASK;
	1079	rxdw0 \|= (size+4);
	1080
	1081	/* reset VLAN tag flag */
	1082	rxdw1 &= ~CP_RX_TAVA;
	1083
	1084	/* update ring data */
	1085	val = cpu_to_le32(rxdw0);
	1086	cpu_physical_memory_write(cplus_rx_ring_desc, (uint8_t *)&val, 4);
	1087	val = cpu_to_le32(rxdw1);
	1088	cpu_physical_memory_write(cplus_rx_ring_desc+4, (uint8_t *)&val, 4);
	1089
	1090	/* update tally counter */
	1091	++s->tally_counters.RxOk;
	1092
	1093	/* seek to next Rx descriptor */
	1094	if (rxdw0 & CP_RX_EOR)
	1095	{
	1096	s->currCPlusRxDesc = 0;
	1097	}
	1098	else
	1099	{
	1100	++s->currCPlusRxDesc;
	1101	}
	1102
	1103	DEBUG_PRINT(("RTL8139: done C+ Rx mode ----------------\n"));
	1104
	1105	}
	1106	else
	1107	{
	1108	DEBUG_PRINT(("RTL8139: in ring Rx mode ================\n"));
	1109
	1110	/* begin ring receiver mode */
	1111	int avail = MOD2(s->RxBufferSize + s->RxBufPtr - s->RxBufAddr, s->RxBufferSize);
	1112
	1113	/* if receiver buffer is empty then avail == 0 */
	1114
	1115	if (avail != 0 && size + 8 >= avail)
	1116	{
	1117	DEBUG_PRINT(("rx overflow: rx buffer length %d head 0x%04x read 0x%04x === available 0x%04x need 0x%04x\n",
	1118	s->RxBufferSize, s->RxBufAddr, s->RxBufPtr, avail, size + 8));
	1119
	1120	s->IntrStatus \|= RxOverflow;
	1121	++s->RxMissed;
	1122	rtl8139_update_irq(s);
	1123	return size_;
	1124	}
	1125
	1126	packet_header \|= RxStatusOK;
	1127
	1128	packet_header \|= (((size+4) << 16) & 0xffff0000);
	1129
	1130	/* write header */
	1131	uint32_t val = cpu_to_le32(packet_header);
	1132
	1133	rtl8139_write_buffer(s, (uint8_t *)&val, 4);
	1134
	1135	rtl8139_write_buffer(s, buf, size);
	1136
	1137	/* write checksum */
	1138	#if defined (RTL8139_CALCULATE_RXCRC)
	1139	val = cpu_to_le32(crc32(0, buf, size));
	1140	#else
	1141	val = 0;
	1142	#endif
	1143
	1144	rtl8139_write_buffer(s, (uint8_t *)&val, 4);
	1145
	1146	/* correct buffer write pointer */
	1147	s->RxBufAddr = MOD2((s->RxBufAddr + 3) & ~0x3, s->RxBufferSize);
	1148
	1149	/* now we can signal we have received something */
	1150
	1151	DEBUG_PRINT((" received: rx buffer length %d head 0x%04x read 0x%04x\n",
	1152	s->RxBufferSize, s->RxBufAddr, s->RxBufPtr));
	1153	}
	1154
	1155	s->IntrStatus \|= RxOK;
	1156
	1157	if (do_interrupt)
	1158	{
	1159	rtl8139_update_irq(s);
	1160	}
	1161
	1162	return size_;
	1163	}
	1164
	1165	static ssize_t rtl8139_receive(VLANClientState vc, const uint8_t buf, size_t size)
	1166	{
	1167	return rtl8139_do_receive(vc, buf, size, 1);
	1168	}
	1169
	1170	static void rtl8139_reset_rxring(RTL8139State *s, uint32_t bufferSize)
	1171	{
	1172	s->RxBufferSize = bufferSize;
	1173	s->RxBufPtr = 0;
	1174	s->RxBufAddr = 0;
	1175	}
	1176
	1177	static void rtl8139_reset(DeviceState *d)
	1178	{
	1179	RTL8139State *s = container_of(d, RTL8139State, dev.qdev);
	1180	int i;
	1181
	1182	/* restore MAC address */
	1183	memcpy(s->phys, s->conf.macaddr.a, 6);
	1184
	1185	/* reset interrupt mask */
	1186	s->IntrStatus = 0;
	1187	s->IntrMask = 0;
	1188
	1189	rtl8139_update_irq(s);
	1190
	1191	/* prepare eeprom */
	1192	s->eeprom.contents[0] = 0x8129;
	1193	#if 1
	1194	// PCI vendor and device ID should be mirrored here
	1195	s->eeprom.contents[1] = PCI_VENDOR_ID_REALTEK;
	1196	s->eeprom.contents[2] = PCI_DEVICE_ID_REALTEK_8139;
	1197	#endif
	1198
	1199	s->eeprom.contents[7] = s->conf.macaddr.a[0] \| s->conf.macaddr.a[1] << 8;
	1200	s->eeprom.contents[8] = s->conf.macaddr.a[2] \| s->conf.macaddr.a[3] << 8;
	1201	s->eeprom.contents[9] = s->conf.macaddr.a[4] \| s->conf.macaddr.a[5] << 8;
	1202
	1203	/* mark all status registers as owned by host */
	1204	for (i = 0; i < 4; ++i)
	1205	{
	1206	s->TxStatus[i] = TxHostOwns;
	1207	}
	1208
	1209	s->currTxDesc = 0;
	1210	s->currCPlusRxDesc = 0;
	1211	s->currCPlusTxDesc = 0;
	1212
	1213	s->RxRingAddrLO = 0;
	1214	s->RxRingAddrHI = 0;
	1215
	1216	s->RxBuf = 0;
	1217
	1218	rtl8139_reset_rxring(s, 8192);
	1219
	1220	/* ACK the reset */
	1221	s->TxConfig = 0;
	1222
	1223	#if 0
	1224	// s->TxConfig \|= HW_REVID(1, 0, 0, 0, 0, 0, 0); // RTL-8139 HasHltClk
	1225	s->clock_enabled = 0;
	1226	#else
	1227	s->TxConfig \|= HW_REVID(1, 1, 1, 0, 1, 1, 0); // RTL-8139C+ HasLWake
	1228	s->clock_enabled = 1;
	1229	#endif
	1230
	1231	s->bChipCmdState = CmdReset; /* RxBufEmpty bit is calculated on read from ChipCmd */;
	1232
	1233	/* set initial state data */
	1234	s->Config0 = 0x0; /* No boot ROM */
	1235	s->Config1 = 0xC; /* IO mapped and MEM mapped registers available */
	1236	s->Config3 = 0x1; /* fast back-to-back compatible */
	1237	s->Config5 = 0x0;
	1238
	1239	s->CSCR = CSCR_F_LINK_100 \| CSCR_HEART_BIT \| CSCR_LD;
	1240
	1241	s->CpCmd = 0x0; /* reset C+ mode */
	1242	s->cplus_enabled = 0;
	1243
	1244
	1245	// s->BasicModeCtrl = 0x3100; // 100Mbps, full duplex, autonegotiation
	1246	// s->BasicModeCtrl = 0x2100; // 100Mbps, full duplex
	1247	s->BasicModeCtrl = 0x1000; // autonegotiation
	1248
	1249	s->BasicModeStatus = 0x7809;
	1250	//s->BasicModeStatus \|= 0x0040; /* UTP medium */
	1251	s->BasicModeStatus \|= 0x0020; /* autonegotiation completed */
	1252	s->BasicModeStatus \|= 0x0004; /* link is up */
	1253
	1254	s->NWayAdvert = 0x05e1; /* all modes, full duplex */
	1255	s->NWayLPAR = 0x05e1; /* all modes, full duplex */
	1256	s->NWayExpansion = 0x0001; /* autonegotiation supported */
	1257
	1258	/* also reset timer and disable timer interrupt */
	1259	s->TCTR = 0;
	1260	s->TimerInt = 0;
	1261	s->TCTR_base = 0;
	1262
	1263	/* reset tally counters */
	1264	RTL8139TallyCounters_clear(&s->tally_counters);
	1265	}
	1266
	1267	static void RTL8139TallyCounters_clear(RTL8139TallyCounters* counters)
	1268	{
	1269	counters->TxOk = 0;
	1270	counters->RxOk = 0;
	1271	counters->TxERR = 0;
	1272	counters->RxERR = 0;
	1273	counters->MissPkt = 0;
	1274	counters->FAE = 0;
	1275	counters->Tx1Col = 0;
	1276	counters->TxMCol = 0;
	1277	counters->RxOkPhy = 0;
	1278	counters->RxOkBrd = 0;
	1279	counters->RxOkMul = 0;
	1280	counters->TxAbt = 0;
	1281	counters->TxUndrn = 0;
	1282	}
	1283
	1284	static void RTL8139TallyCounters_physical_memory_write(target_phys_addr_t tc_addr, RTL8139TallyCounters* tally_counters)
	1285	{
	1286	uint16_t val16;
	1287	uint32_t val32;
	1288	uint64_t val64;
	1289
	1290	val64 = cpu_to_le64(tally_counters->TxOk);
	1291	cpu_physical_memory_write(tc_addr + 0, (uint8_t *)&val64, 8);
	1292
	1293	val64 = cpu_to_le64(tally_counters->RxOk);
	1294	cpu_physical_memory_write(tc_addr + 8, (uint8_t *)&val64, 8);
	1295
	1296	val64 = cpu_to_le64(tally_counters->TxERR);
	1297	cpu_physical_memory_write(tc_addr + 16, (uint8_t *)&val64, 8);
	1298
	1299	val32 = cpu_to_le32(tally_counters->RxERR);
	1300	cpu_physical_memory_write(tc_addr + 24, (uint8_t *)&val32, 4);
	1301
	1302	val16 = cpu_to_le16(tally_counters->MissPkt);
	1303	cpu_physical_memory_write(tc_addr + 28, (uint8_t *)&val16, 2);
	1304
	1305	val16 = cpu_to_le16(tally_counters->FAE);
	1306	cpu_physical_memory_write(tc_addr + 30, (uint8_t *)&val16, 2);
	1307
	1308	val32 = cpu_to_le32(tally_counters->Tx1Col);
	1309	cpu_physical_memory_write(tc_addr + 32, (uint8_t *)&val32, 4);
	1310
	1311	val32 = cpu_to_le32(tally_counters->TxMCol);
	1312	cpu_physical_memory_write(tc_addr + 36, (uint8_t *)&val32, 4);
	1313
	1314	val64 = cpu_to_le64(tally_counters->RxOkPhy);
	1315	cpu_physical_memory_write(tc_addr + 40, (uint8_t *)&val64, 8);
	1316
	1317	val64 = cpu_to_le64(tally_counters->RxOkBrd);
	1318	cpu_physical_memory_write(tc_addr + 48, (uint8_t *)&val64, 8);
	1319
	1320	val32 = cpu_to_le32(tally_counters->RxOkMul);
	1321	cpu_physical_memory_write(tc_addr + 56, (uint8_t *)&val32, 4);
	1322
	1323	val16 = cpu_to_le16(tally_counters->TxAbt);
	1324	cpu_physical_memory_write(tc_addr + 60, (uint8_t *)&val16, 2);
	1325
	1326	val16 = cpu_to_le16(tally_counters->TxUndrn);
	1327	cpu_physical_memory_write(tc_addr + 62, (uint8_t *)&val16, 2);
	1328	}
	1329
	1330	/* Loads values of tally counters from VM state file */
	1331	static void RTL8139TallyCounters_load(QEMUFile* f, RTL8139TallyCounters *tally_counters)
	1332	{
	1333	qemu_get_be64s(f, &tally_counters->TxOk);
	1334	qemu_get_be64s(f, &tally_counters->RxOk);
	1335	qemu_get_be64s(f, &tally_counters->TxERR);
	1336	qemu_get_be32s(f, &tally_counters->RxERR);
	1337	qemu_get_be16s(f, &tally_counters->MissPkt);
	1338	qemu_get_be16s(f, &tally_counters->FAE);
	1339	qemu_get_be32s(f, &tally_counters->Tx1Col);
	1340	qemu_get_be32s(f, &tally_counters->TxMCol);
	1341	qemu_get_be64s(f, &tally_counters->RxOkPhy);
	1342	qemu_get_be64s(f, &tally_counters->RxOkBrd);
	1343	qemu_get_be32s(f, &tally_counters->RxOkMul);
	1344	qemu_get_be16s(f, &tally_counters->TxAbt);
	1345	qemu_get_be16s(f, &tally_counters->TxUndrn);
	1346	}
	1347
	1348	/* Saves values of tally counters to VM state file */
	1349	static void RTL8139TallyCounters_save(QEMUFile* f, RTL8139TallyCounters *tally_counters)
	1350	{
	1351	qemu_put_be64s(f, &tally_counters->TxOk);
	1352	qemu_put_be64s(f, &tally_counters->RxOk);
	1353	qemu_put_be64s(f, &tally_counters->TxERR);
	1354	qemu_put_be32s(f, &tally_counters->RxERR);
	1355	qemu_put_be16s(f, &tally_counters->MissPkt);
	1356	qemu_put_be16s(f, &tally_counters->FAE);
	1357	qemu_put_be32s(f, &tally_counters->Tx1Col);
	1358	qemu_put_be32s(f, &tally_counters->TxMCol);
	1359	qemu_put_be64s(f, &tally_counters->RxOkPhy);
	1360	qemu_put_be64s(f, &tally_counters->RxOkBrd);
	1361	qemu_put_be32s(f, &tally_counters->RxOkMul);
	1362	qemu_put_be16s(f, &tally_counters->TxAbt);
	1363	qemu_put_be16s(f, &tally_counters->TxUndrn);
	1364	}
	1365
	1366	static void rtl8139_ChipCmd_write(RTL8139State *s, uint32_t val)
	1367	{
	1368	val &= 0xff;
	1369
	1370	DEBUG_PRINT(("RTL8139: ChipCmd write val=0x%08x\n", val));
	1371
	1372	if (val & CmdReset)
	1373	{
	1374	DEBUG_PRINT(("RTL8139: ChipCmd reset\n"));
	1375	rtl8139_reset(&s->dev.qdev);
	1376	}
	1377	if (val & CmdRxEnb)
	1378	{
	1379	DEBUG_PRINT(("RTL8139: ChipCmd enable receiver\n"));
	1380
	1381	s->currCPlusRxDesc = 0;
	1382	}
	1383	if (val & CmdTxEnb)
	1384	{
	1385	DEBUG_PRINT(("RTL8139: ChipCmd enable transmitter\n"));
	1386
	1387	s->currCPlusTxDesc = 0;
	1388	}
	1389
	1390	/* mask unwriteable bits */
	1391	val = SET_MASKED(val, 0xe3, s->bChipCmdState);
	1392
	1393	/* Deassert reset pin before next read */
	1394	val &= ~CmdReset;
	1395
	1396	s->bChipCmdState = val;
	1397	}
	1398
	1399	static int rtl8139_RxBufferEmpty(RTL8139State *s)
	1400	{
	1401	int unread = MOD2(s->RxBufferSize + s->RxBufAddr - s->RxBufPtr, s->RxBufferSize);
	1402
	1403	if (unread != 0)
	1404	{
	1405	DEBUG_PRINT(("RTL8139: receiver buffer data available 0x%04x\n", unread));
	1406	return 0;
	1407	}
	1408
	1409	DEBUG_PRINT(("RTL8139: receiver buffer is empty\n"));
	1410
	1411	return 1;
	1412	}
	1413
	1414	static uint32_t rtl8139_ChipCmd_read(RTL8139State *s)
	1415	{
	1416	uint32_t ret = s->bChipCmdState;
	1417
	1418	if (rtl8139_RxBufferEmpty(s))
	1419	ret \|= RxBufEmpty;
	1420
	1421	DEBUG_PRINT(("RTL8139: ChipCmd read val=0x%04x\n", ret));
	1422
	1423	return ret;
	1424	}
	1425
	1426	static void rtl8139_CpCmd_write(RTL8139State *s, uint32_t val)
	1427	{
	1428	val &= 0xffff;
	1429
	1430	DEBUG_PRINT(("RTL8139C+ command register write(w) val=0x%04x\n", val));
	1431
	1432	s->cplus_enabled = 1;
	1433
	1434	/* mask unwriteable bits */
	1435	val = SET_MASKED(val, 0xff84, s->CpCmd);
	1436
	1437	s->CpCmd = val;
	1438	}
	1439
	1440	static uint32_t rtl8139_CpCmd_read(RTL8139State *s)
	1441	{
	1442	uint32_t ret = s->CpCmd;
	1443
	1444	DEBUG_PRINT(("RTL8139C+ command register read(w) val=0x%04x\n", ret));
	1445
	1446	return ret;
	1447	}
	1448
	1449	static void rtl8139_IntrMitigate_write(RTL8139State *s, uint32_t val)
	1450	{
	1451	DEBUG_PRINT(("RTL8139C+ IntrMitigate register write(w) val=0x%04x\n", val));
	1452	}
	1453
	1454	static uint32_t rtl8139_IntrMitigate_read(RTL8139State *s)
	1455	{
	1456	uint32_t ret = 0;
	1457
	1458	DEBUG_PRINT(("RTL8139C+ IntrMitigate register read(w) val=0x%04x\n", ret));
	1459
	1460	return ret;
	1461	}
	1462
	1463	static int rtl8139_config_writeable(RTL8139State *s)
	1464	{
	1465	if (s->Cfg9346 & Cfg9346_Unlock)
	1466	{
	1467	return 1;
	1468	}
	1469
	1470	DEBUG_PRINT(("RTL8139: Configuration registers are write-protected\n"));
	1471
	1472	return 0;
	1473	}
	1474
	1475	static void rtl8139_BasicModeCtrl_write(RTL8139State *s, uint32_t val)
	1476	{
	1477	val &= 0xffff;
	1478
	1479	DEBUG_PRINT(("RTL8139: BasicModeCtrl register write(w) val=0x%04x\n", val));
	1480
	1481	/* mask unwriteable bits */
	1482	uint32_t mask = 0x4cff;
	1483
	1484	if (1 \|\| !rtl8139_config_writeable(s))
	1485	{
	1486	/* Speed setting and autonegotiation enable bits are read-only */
	1487	mask \|= 0x3000;
	1488	/* Duplex mode setting is read-only */
	1489	mask \|= 0x0100;
	1490	}
	1491
	1492	val = SET_MASKED(val, mask, s->BasicModeCtrl);
	1493
	1494	s->BasicModeCtrl = val;
	1495	}
	1496
	1497	static uint32_t rtl8139_BasicModeCtrl_read(RTL8139State *s)
	1498	{
	1499	uint32_t ret = s->BasicModeCtrl;
	1500
	1501	DEBUG_PRINT(("RTL8139: BasicModeCtrl register read(w) val=0x%04x\n", ret));
	1502
	1503	return ret;
	1504	}
	1505
	1506	static void rtl8139_BasicModeStatus_write(RTL8139State *s, uint32_t val)
	1507	{
	1508	val &= 0xffff;
	1509
	1510	DEBUG_PRINT(("RTL8139: BasicModeStatus register write(w) val=0x%04x\n", val));
	1511
	1512	/* mask unwriteable bits */
	1513	val = SET_MASKED(val, 0xff3f, s->BasicModeStatus);
	1514
	1515	s->BasicModeStatus = val;
	1516	}
	1517
	1518	static uint32_t rtl8139_BasicModeStatus_read(RTL8139State *s)
	1519	{
	1520	uint32_t ret = s->BasicModeStatus;
	1521
	1522	DEBUG_PRINT(("RTL8139: BasicModeStatus register read(w) val=0x%04x\n", ret));
	1523
	1524	return ret;
	1525	}
	1526
	1527	static void rtl8139_Cfg9346_write(RTL8139State *s, uint32_t val)
	1528	{
	1529	val &= 0xff;
	1530
	1531	DEBUG_PRINT(("RTL8139: Cfg9346 write val=0x%02x\n", val));
	1532
	1533	/* mask unwriteable bits */
	1534	val = SET_MASKED(val, 0x31, s->Cfg9346);
	1535
	1536	uint32_t opmode = val & 0xc0;
	1537	uint32_t eeprom_val = val & 0xf;
	1538
	1539	if (opmode == 0x80) {
	1540	/* eeprom access */
	1541	int eecs = (eeprom_val & 0x08)?1:0;
	1542	int eesk = (eeprom_val & 0x04)?1:0;
	1543	int eedi = (eeprom_val & 0x02)?1:0;
	1544	prom9346_set_wire(s, eecs, eesk, eedi);
	1545	} else if (opmode == 0x40) {
	1546	/* Reset. */
	1547	val = 0;
	1548	rtl8139_reset(&s->dev.qdev);
	1549	}
	1550
	1551	s->Cfg9346 = val;
	1552	}
	1553
	1554	static uint32_t rtl8139_Cfg9346_read(RTL8139State *s)
	1555	{
	1556	uint32_t ret = s->Cfg9346;
	1557
	1558	uint32_t opmode = ret & 0xc0;
	1559
	1560	if (opmode == 0x80)
	1561	{
	1562	/* eeprom access */
	1563	int eedo = prom9346_get_wire(s);
	1564	if (eedo)
	1565	{
	1566	ret \|= 0x01;
	1567	}
	1568	else
	1569	{
	1570	ret &= ~0x01;
	1571	}
	1572	}
	1573
	1574	DEBUG_PRINT(("RTL8139: Cfg9346 read val=0x%02x\n", ret));
	1575
	1576	return ret;
	1577	}
	1578
	1579	static void rtl8139_Config0_write(RTL8139State *s, uint32_t val)
	1580	{
	1581	val &= 0xff;
	1582
	1583	DEBUG_PRINT(("RTL8139: Config0 write val=0x%02x\n", val));
	1584
	1585	if (!rtl8139_config_writeable(s))
	1586	return;
	1587
	1588	/* mask unwriteable bits */
	1589	val = SET_MASKED(val, 0xf8, s->Config0);
	1590
	1591	s->Config0 = val;
	1592	}
	1593
	1594	static uint32_t rtl8139_Config0_read(RTL8139State *s)
	1595	{
	1596	uint32_t ret = s->Config0;
	1597
	1598	DEBUG_PRINT(("RTL8139: Config0 read val=0x%02x\n", ret));
	1599
	1600	return ret;
	1601	}
	1602
	1603	static void rtl8139_Config1_write(RTL8139State *s, uint32_t val)
	1604	{
	1605	val &= 0xff;
	1606
	1607	DEBUG_PRINT(("RTL8139: Config1 write val=0x%02x\n", val));
	1608
	1609	if (!rtl8139_config_writeable(s))
	1610	return;
	1611
	1612	/* mask unwriteable bits */
	1613	val = SET_MASKED(val, 0xC, s->Config1);
	1614
	1615	s->Config1 = val;
	1616	}
	1617
	1618	static uint32_t rtl8139_Config1_read(RTL8139State *s)
	1619	{
	1620	uint32_t ret = s->Config1;
	1621
	1622	DEBUG_PRINT(("RTL8139: Config1 read val=0x%02x\n", ret));
	1623
	1624	return ret;
	1625	}
	1626
	1627	static void rtl8139_Config3_write(RTL8139State *s, uint32_t val)
	1628	{
	1629	val &= 0xff;
	1630
	1631	DEBUG_PRINT(("RTL8139: Config3 write val=0x%02x\n", val));
	1632
	1633	if (!rtl8139_config_writeable(s))
	1634	return;
	1635
	1636	/* mask unwriteable bits */
	1637	val = SET_MASKED(val, 0x8F, s->Config3);
	1638
	1639	s->Config3 = val;
	1640	}
	1641
	1642	static uint32_t rtl8139_Config3_read(RTL8139State *s)
	1643	{
	1644	uint32_t ret = s->Config3;
	1645
	1646	DEBUG_PRINT(("RTL8139: Config3 read val=0x%02x\n", ret));
	1647
	1648	return ret;
	1649	}
	1650
	1651	static void rtl8139_Config4_write(RTL8139State *s, uint32_t val)
	1652	{
	1653	val &= 0xff;
	1654
	1655	DEBUG_PRINT(("RTL8139: Config4 write val=0x%02x\n", val));
	1656
	1657	if (!rtl8139_config_writeable(s))
	1658	return;
	1659
	1660	/* mask unwriteable bits */
	1661	val = SET_MASKED(val, 0x0a, s->Config4);
	1662
	1663	s->Config4 = val;
	1664	}
	1665
	1666	static uint32_t rtl8139_Config4_read(RTL8139State *s)
	1667	{
	1668	uint32_t ret = s->Config4;
	1669
	1670	DEBUG_PRINT(("RTL8139: Config4 read val=0x%02x\n", ret));
	1671
	1672	return ret;
	1673	}
	1674
	1675	static void rtl8139_Config5_write(RTL8139State *s, uint32_t val)
	1676	{
	1677	val &= 0xff;
	1678
	1679	DEBUG_PRINT(("RTL8139: Config5 write val=0x%02x\n", val));
	1680
	1681	/* mask unwriteable bits */
	1682	val = SET_MASKED(val, 0x80, s->Config5);
	1683
	1684	s->Config5 = val;
	1685	}
	1686
	1687	static uint32_t rtl8139_Config5_read(RTL8139State *s)
	1688	{
	1689	uint32_t ret = s->Config5;
	1690
	1691	DEBUG_PRINT(("RTL8139: Config5 read val=0x%02x\n", ret));
	1692
	1693	return ret;
	1694	}
	1695
	1696	static void rtl8139_TxConfig_write(RTL8139State *s, uint32_t val)
	1697	{
	1698	if (!rtl8139_transmitter_enabled(s))
	1699	{
	1700	DEBUG_PRINT(("RTL8139: transmitter disabled; no TxConfig write val=0x%08x\n", val));
	1701	return;
	1702	}
	1703
	1704	DEBUG_PRINT(("RTL8139: TxConfig write val=0x%08x\n", val));
	1705
	1706	val = SET_MASKED(val, TxVersionMask \| 0x8070f80f, s->TxConfig);
	1707
	1708	s->TxConfig = val;
	1709	}
	1710
	1711	static void rtl8139_TxConfig_writeb(RTL8139State *s, uint32_t val)
	1712	{
	1713	DEBUG_PRINT(("RTL8139C TxConfig via write(b) val=0x%02x\n", val));
	1714
	1715	uint32_t tc = s->TxConfig;
	1716	tc &= 0xFFFFFF00;
	1717	tc \|= (val & 0x000000FF);
	1718	rtl8139_TxConfig_write(s, tc);
	1719	}
	1720
	1721	static uint32_t rtl8139_TxConfig_read(RTL8139State *s)
	1722	{
	1723	uint32_t ret = s->TxConfig;
	1724
	1725	DEBUG_PRINT(("RTL8139: TxConfig read val=0x%04x\n", ret));
	1726
	1727	return ret;
	1728	}
	1729
	1730	static void rtl8139_RxConfig_write(RTL8139State *s, uint32_t val)
	1731	{
	1732	DEBUG_PRINT(("RTL8139: RxConfig write val=0x%08x\n", val));
	1733
	1734	/* mask unwriteable bits */
	1735	val = SET_MASKED(val, 0xf0fc0040, s->RxConfig);
	1736
	1737	s->RxConfig = val;
	1738
	1739	/* reset buffer size and read/write pointers */
	1740	rtl8139_reset_rxring(s, 8192 << ((s->RxConfig >> 11) & 0x3));
	1741
	1742	DEBUG_PRINT(("RTL8139: RxConfig write reset buffer size to %d\n", s->RxBufferSize));
	1743	}
	1744
	1745	static uint32_t rtl8139_RxConfig_read(RTL8139State *s)
	1746	{
	1747	uint32_t ret = s->RxConfig;
	1748
	1749	DEBUG_PRINT(("RTL8139: RxConfig read val=0x%08x\n", ret));
	1750
	1751	return ret;
	1752	}
	1753
	1754	static void rtl8139_transfer_frame(RTL8139State s, const uint8_t buf, int size, int do_interrupt)
	1755	{
	1756	if (!size)
	1757	{
	1758	DEBUG_PRINT(("RTL8139: +++ empty ethernet frame\n"));
	1759	return;
	1760	}
	1761
	1762	if (TxLoopBack == (s->TxConfig & TxLoopBack))
	1763	{
	1764	DEBUG_PRINT(("RTL8139: +++ transmit loopback mode\n"));
	1765	rtl8139_do_receive(s->vc, buf, size, do_interrupt);
	1766	}
	1767	else
	1768	{
	1769	qemu_send_packet(s->vc, buf, size);
	1770	}
	1771	}
	1772
	1773	static int rtl8139_transmit_one(RTL8139State *s, int descriptor)
	1774	{
	1775	if (!rtl8139_transmitter_enabled(s))
	1776	{
	1777	DEBUG_PRINT(("RTL8139: +++ cannot transmit from descriptor %d: transmitter disabled\n",
	1778	descriptor));
	1779	return 0;
	1780	}
	1781
	1782	if (s->TxStatus[descriptor] & TxHostOwns)
	1783	{
	1784	DEBUG_PRINT(("RTL8139: +++ cannot transmit from descriptor %d: owned by host (%08x)\n",
	1785	descriptor, s->TxStatus[descriptor]));
	1786	return 0;
	1787	}
	1788
	1789	DEBUG_PRINT(("RTL8139: +++ transmitting from descriptor %d\n", descriptor));
	1790
	1791	int txsize = s->TxStatus[descriptor] & 0x1fff;
	1792	uint8_t txbuffer[0x2000];
	1793
	1794	DEBUG_PRINT(("RTL8139: +++ transmit reading %d bytes from host memory at 0x%08x\n",
	1795	txsize, s->TxAddr[descriptor]));
	1796
	1797	cpu_physical_memory_read(s->TxAddr[descriptor], txbuffer, txsize);
	1798
	1799	/* Mark descriptor as transferred */
	1800	s->TxStatus[descriptor] \|= TxHostOwns;
	1801	s->TxStatus[descriptor] \|= TxStatOK;
	1802
	1803	rtl8139_transfer_frame(s, txbuffer, txsize, 0);
	1804
	1805	DEBUG_PRINT(("RTL8139: +++ transmitted %d bytes from descriptor %d\n", txsize, descriptor));
	1806
	1807	/* update interrupt */
	1808	s->IntrStatus \|= TxOK;
	1809	rtl8139_update_irq(s);
	1810
	1811	return 1;
	1812	}
	1813
	1814	/* structures and macros for task offloading */
	1815	typedef struct ip_header
	1816	{
	1817	uint8_t ip_ver_len; /* version and header length */
	1818	uint8_t ip_tos; /* type of service */
	1819	uint16_t ip_len; /* total length */
	1820	uint16_t ip_id; /* identification */
	1821	uint16_t ip_off; /* fragment offset field */
	1822	uint8_t ip_ttl; /* time to live */
	1823	uint8_t ip_p; /* protocol */
	1824	uint16_t ip_sum; /* checksum */
	1825	uint32_t ip_src,ip_dst; /* source and dest address */
	1826	} ip_header;
	1827
	1828	#define IP_HEADER_VERSION_4 4
	1829	#define IP_HEADER_VERSION(ip) ((ip->ip_ver_len >> 4)&0xf)
	1830	#define IP_HEADER_LENGTH(ip) (((ip->ip_ver_len)&0xf) << 2)
	1831
	1832	typedef struct tcp_header
	1833	{
	1834	uint16_t th_sport; /* source port */
	1835	uint16_t th_dport; /* destination port */
	1836	uint32_t th_seq; /* sequence number */
	1837	uint32_t th_ack; /* acknowledgement number */
	1838	uint16_t th_offset_flags; /* data offset, reserved 6 bits, TCP protocol flags */
	1839	uint16_t th_win; /* window */
	1840	uint16_t th_sum; /* checksum */
	1841	uint16_t th_urp; /* urgent pointer */
	1842	} tcp_header;
	1843
	1844	typedef struct udp_header
	1845	{
	1846	uint16_t uh_sport; /* source port */
	1847	uint16_t uh_dport; /* destination port */
	1848	uint16_t uh_ulen; /* udp length */
	1849	uint16_t uh_sum; /* udp checksum */
	1850	} udp_header;
	1851
	1852	typedef struct ip_pseudo_header
	1853	{
	1854	uint32_t ip_src;
	1855	uint32_t ip_dst;
	1856	uint8_t zeros;
	1857	uint8_t ip_proto;
	1858	uint16_t ip_payload;
	1859	} ip_pseudo_header;
	1860
	1861	#define IP_PROTO_TCP 6
	1862	#define IP_PROTO_UDP 17
	1863
	1864	#define TCP_HEADER_DATA_OFFSET(tcp) (((be16_to_cpu(tcp->th_offset_flags) >> 12)&0xf) << 2)
	1865	#define TCP_FLAGS_ONLY(flags) ((flags)&0x3f)
	1866	#define TCP_HEADER_FLAGS(tcp) TCP_FLAGS_ONLY(be16_to_cpu(tcp->th_offset_flags))
	1867
	1868	#define TCP_HEADER_CLEAR_FLAGS(tcp, off) ((tcp)->th_offset_flags &= cpu_to_be16(~TCP_FLAGS_ONLY(off)))
	1869
	1870	#define TCP_FLAG_FIN 0x01
	1871	#define TCP_FLAG_PUSH 0x08
	1872
	1873	/* produces ones' complement sum of data */
	1874	static uint16_t ones_complement_sum(uint8_t *data, size_t len)
	1875	{
	1876	uint32_t result = 0;
	1877
	1878	for (; len > 1; data+=2, len-=2)
	1879	{
	1880	result += (uint16_t)data;
	1881	}
	1882
	1883	/* add the remainder byte */
	1884	if (len)
	1885	{
	1886	uint8_t odd[2] = {*data, 0};
	1887	result += (uint16_t)odd;
	1888	}
	1889
	1890	while (result>>16)
	1891	result = (result & 0xffff) + (result >> 16);
	1892
	1893	return result;
	1894	}
	1895
	1896	static uint16_t ip_checksum(void *data, size_t len)
	1897	{
	1898	return ~ones_complement_sum((uint8_t*)data, len);
	1899	}
	1900
	1901	static int rtl8139_cplus_transmit_one(RTL8139State *s)
	1902	{
	1903	if (!rtl8139_transmitter_enabled(s))
	1904	{
	1905	DEBUG_PRINT(("RTL8139: +++ C+ mode: transmitter disabled\n"));
	1906	return 0;
	1907	}
	1908
	1909	if (!rtl8139_cp_transmitter_enabled(s))
	1910	{
	1911	DEBUG_PRINT(("RTL8139: +++ C+ mode: C+ transmitter disabled\n"));
	1912	return 0 ;
	1913	}
	1914
	1915	int descriptor = s->currCPlusTxDesc;
	1916
	1917	target_phys_addr_t cplus_tx_ring_desc =
	1918	rtl8139_addr64(s->TxAddr[0], s->TxAddr[1]);
	1919
	1920	/* Normal priority ring */
	1921	cplus_tx_ring_desc += 16 * descriptor;
	1922
	1923	DEBUG_PRINT(("RTL8139: +++ C+ mode reading TX descriptor %d from host memory at %08x0x%08x = 0x%8lx\n",
	1924	descriptor, s->TxAddr[1], s->TxAddr[0], cplus_tx_ring_desc));
	1925
	1926	uint32_t val, txdw0,txdw1,txbufLO,txbufHI;
	1927
	1928	cpu_physical_memory_read(cplus_tx_ring_desc, (uint8_t *)&val, 4);
	1929	txdw0 = le32_to_cpu(val);
	1930	cpu_physical_memory_read(cplus_tx_ring_desc+4, (uint8_t *)&val, 4);
	1931	txdw1 = le32_to_cpu(val);
	1932	cpu_physical_memory_read(cplus_tx_ring_desc+8, (uint8_t *)&val, 4);
	1933	txbufLO = le32_to_cpu(val);
	1934	cpu_physical_memory_read(cplus_tx_ring_desc+12, (uint8_t *)&val, 4);
	1935	txbufHI = le32_to_cpu(val);
	1936
	1937	DEBUG_PRINT(("RTL8139: +++ C+ mode TX descriptor %d %08x %08x %08x %08x\n",
	1938	descriptor,
	1939	txdw0, txdw1, txbufLO, txbufHI));
	1940
	1941	/* w0 ownership flag */
	1942	#define CP_TX_OWN (1<<31)
	1943	/* w0 end of ring flag */
	1944	#define CP_TX_EOR (1<<30)
	1945	/* first segment of received packet flag */
	1946	#define CP_TX_FS (1<<29)
	1947	/* last segment of received packet flag */
	1948	#define CP_TX_LS (1<<28)
	1949	/* large send packet flag */
	1950	#define CP_TX_LGSEN (1<<27)
	1951	/* large send MSS mask, bits 16...25 */
	1952	#define CP_TC_LGSEN_MSS_MASK ((1 << 12) - 1)
	1953
	1954	/* IP checksum offload flag */
	1955	#define CP_TX_IPCS (1<<18)
	1956	/* UDP checksum offload flag */
	1957	#define CP_TX_UDPCS (1<<17)
	1958	/* TCP checksum offload flag */
	1959	#define CP_TX_TCPCS (1<<16)
	1960
	1961	/* w0 bits 0...15 : buffer size */
	1962	#define CP_TX_BUFFER_SIZE (1<<16)
	1963	#define CP_TX_BUFFER_SIZE_MASK (CP_TX_BUFFER_SIZE - 1)
	1964	/* w1 tag available flag */
	1965	#define CP_RX_TAGC (1<<17)
	1966	/* w1 bits 0...15 : VLAN tag */
	1967	#define CP_TX_VLAN_TAG_MASK ((1<<16) - 1)
	1968	/* w2 low 32bit of Rx buffer ptr */
	1969	/* w3 high 32bit of Rx buffer ptr */
	1970
	1971	/* set after transmission */
	1972	/* FIFO underrun flag */
	1973	#define CP_TX_STATUS_UNF (1<<25)
	1974	/* transmit error summary flag, valid if set any of three below */
	1975	#define CP_TX_STATUS_TES (1<<23)
	1976	/* out-of-window collision flag */
	1977	#define CP_TX_STATUS_OWC (1<<22)
	1978	/* link failure flag */
	1979	#define CP_TX_STATUS_LNKF (1<<21)
	1980	/* excessive collisions flag */
	1981	#define CP_TX_STATUS_EXC (1<<20)
	1982
	1983	if (!(txdw0 & CP_TX_OWN))
	1984	{
	1985	DEBUG_PRINT(("RTL8139: C+ Tx mode : descriptor %d is owned by host\n", descriptor));
	1986	return 0 ;
	1987	}
	1988
	1989	DEBUG_PRINT(("RTL8139: +++ C+ Tx mode : transmitting from descriptor %d\n", descriptor));
	1990
	1991	if (txdw0 & CP_TX_FS)
	1992	{
	1993	DEBUG_PRINT(("RTL8139: +++ C+ Tx mode : descriptor %d is first segment descriptor\n", descriptor));
	1994
	1995	/* reset internal buffer offset */
	1996	s->cplus_txbuffer_offset = 0;
	1997	}
	1998
	1999	int txsize = txdw0 & CP_TX_BUFFER_SIZE_MASK;
	2000	target_phys_addr_t tx_addr = rtl8139_addr64(txbufLO, txbufHI);
	2001
	2002	/* make sure we have enough space to assemble the packet */
	2003	if (!s->cplus_txbuffer)
	2004	{
	2005	s->cplus_txbuffer_len = CP_TX_BUFFER_SIZE;
	2006	s->cplus_txbuffer = malloc(s->cplus_txbuffer_len);
	2007	s->cplus_txbuffer_offset = 0;
	2008
	2009	DEBUG_PRINT(("RTL8139: +++ C+ mode transmission buffer allocated space %d\n", s->cplus_txbuffer_len));
	2010	}
	2011
	2012	while (s->cplus_txbuffer && s->cplus_txbuffer_offset + txsize >= s->cplus_txbuffer_len)
	2013	{
	2014	s->cplus_txbuffer_len += CP_TX_BUFFER_SIZE;
	2015	s->cplus_txbuffer = qemu_realloc(s->cplus_txbuffer, s->cplus_txbuffer_len);
	2016
	2017	DEBUG_PRINT(("RTL8139: +++ C+ mode transmission buffer space changed to %d\n", s->cplus_txbuffer_len));
	2018	}
	2019
	2020	if (!s->cplus_txbuffer)
	2021	{
	2022	/* out of memory */
	2023
	2024	DEBUG_PRINT(("RTL8139: +++ C+ mode transmiter failed to reallocate %d bytes\n", s->cplus_txbuffer_len));
	2025
	2026	/* update tally counter */
	2027	++s->tally_counters.TxERR;
	2028	++s->tally_counters.TxAbt;
	2029
	2030	return 0;
	2031	}
	2032
	2033	/* append more data to the packet */
	2034
	2035	DEBUG_PRINT(("RTL8139: +++ C+ mode transmit reading %d bytes from host memory at %016" PRIx64 " to offset %d\n",
	2036	txsize, (uint64_t)tx_addr, s->cplus_txbuffer_offset));
	2037
	2038	cpu_physical_memory_read(tx_addr, s->cplus_txbuffer + s->cplus_txbuffer_offset, txsize);
	2039	s->cplus_txbuffer_offset += txsize;
	2040
	2041	/* seek to next Rx descriptor */
	2042	if (txdw0 & CP_TX_EOR)
	2043	{
	2044	s->currCPlusTxDesc = 0;
	2045	}
	2046	else
	2047	{
	2048	++s->currCPlusTxDesc;
	2049	if (s->currCPlusTxDesc >= 64)
	2050	s->currCPlusTxDesc = 0;
	2051	}
	2052
	2053	/* transfer ownership to target */
	2054	txdw0 &= ~CP_RX_OWN;
	2055
	2056	/* reset error indicator bits */
	2057	txdw0 &= ~CP_TX_STATUS_UNF;
	2058	txdw0 &= ~CP_TX_STATUS_TES;
	2059	txdw0 &= ~CP_TX_STATUS_OWC;
	2060	txdw0 &= ~CP_TX_STATUS_LNKF;
	2061	txdw0 &= ~CP_TX_STATUS_EXC;
	2062
	2063	/* update ring data */
	2064	val = cpu_to_le32(txdw0);
	2065	cpu_physical_memory_write(cplus_tx_ring_desc, (uint8_t *)&val, 4);
	2066	// val = cpu_to_le32(txdw1);
	2067	// cpu_physical_memory_write(cplus_tx_ring_desc+4, &val, 4);
	2068
	2069	/* Now decide if descriptor being processed is holding the last segment of packet */
	2070	if (txdw0 & CP_TX_LS)
	2071	{
	2072	DEBUG_PRINT(("RTL8139: +++ C+ Tx mode : descriptor %d is last segment descriptor\n", descriptor));
	2073
	2074	/* can transfer fully assembled packet */
	2075
	2076	uint8_t *saved_buffer = s->cplus_txbuffer;
	2077	int saved_size = s->cplus_txbuffer_offset;
	2078	int saved_buffer_len = s->cplus_txbuffer_len;
	2079
	2080	/* reset the card space to protect from recursive call */
	2081	s->cplus_txbuffer = NULL;
	2082	s->cplus_txbuffer_offset = 0;
	2083	s->cplus_txbuffer_len = 0;
	2084
	2085	if (txdw0 & (CP_TX_IPCS \| CP_TX_UDPCS \| CP_TX_TCPCS \| CP_TX_LGSEN))
	2086	{
	2087	DEBUG_PRINT(("RTL8139: +++ C+ mode offloaded task checksum\n"));
	2088
	2089	#define ETH_P_IP 0x0800 /* Internet Protocol packet */
	2090	#define ETH_HLEN 14
	2091	#define ETH_MTU 1500
	2092
	2093	/* ip packet header */
	2094	ip_header *ip = NULL;
	2095	int hlen = 0;
	2096	uint8_t ip_protocol = 0;
	2097	uint16_t ip_data_len = 0;
	2098
	2099	uint8_t *eth_payload_data = NULL;
	2100	size_t eth_payload_len = 0;
	2101
	2102	int proto = be16_to_cpu((uint16_t )(saved_buffer + 12));
	2103	if (proto == ETH_P_IP)
	2104	{
	2105	DEBUG_PRINT(("RTL8139: +++ C+ mode has IP packet\n"));
	2106
	2107	/* not aligned */
	2108	eth_payload_data = saved_buffer + ETH_HLEN;
	2109	eth_payload_len = saved_size - ETH_HLEN;
	2110
	2111	ip = (ip_header*)eth_payload_data;
	2112
	2113	if (IP_HEADER_VERSION(ip) != IP_HEADER_VERSION_4) {
	2114	DEBUG_PRINT(("RTL8139: +++ C+ mode packet has bad IP version %d expected %d\n", IP_HEADER_VERSION(ip), IP_HEADER_VERSION_4));
	2115	ip = NULL;
	2116	} else {
	2117	hlen = IP_HEADER_LENGTH(ip);
	2118	ip_protocol = ip->ip_p;
	2119	ip_data_len = be16_to_cpu(ip->ip_len) - hlen;
	2120	}
	2121	}
	2122
	2123	if (ip)
	2124	{
	2125	if (txdw0 & CP_TX_IPCS)
	2126	{
	2127	DEBUG_PRINT(("RTL8139: +++ C+ mode need IP checksum\n"));
	2128
	2129	if (hlen<sizeof(ip_header) \|\| hlen>eth_payload_len) {/* min header length */
	2130	/* bad packet header len */
	2131	/* or packet too short */
	2132	}
	2133	else
	2134	{
	2135	ip->ip_sum = 0;
	2136	ip->ip_sum = ip_checksum(ip, hlen);
	2137	DEBUG_PRINT(("RTL8139: +++ C+ mode IP header len=%d checksum=%04x\n", hlen, ip->ip_sum));
	2138	}
	2139	}
	2140
	2141	if ((txdw0 & CP_TX_LGSEN) && ip_protocol == IP_PROTO_TCP)
	2142	{
	2143	#if defined (DEBUG_RTL8139)
	2144	int large_send_mss = (txdw0 >> 16) & CP_TC_LGSEN_MSS_MASK;
	2145	#endif
	2146	DEBUG_PRINT(("RTL8139: +++ C+ mode offloaded task TSO MTU=%d IP data %d frame data %d specified MSS=%d\n",
	2147	ETH_MTU, ip_data_len, saved_size - ETH_HLEN, large_send_mss));
	2148
	2149	int tcp_send_offset = 0;
	2150	int send_count = 0;
	2151
	2152	/* maximum IP header length is 60 bytes */
	2153	uint8_t saved_ip_header[60];
	2154
	2155	/* save IP header template; data area is used in tcp checksum calculation */
	2156	memcpy(saved_ip_header, eth_payload_data, hlen);
	2157
	2158	/* a placeholder for checksum calculation routine in tcp case */
	2159	uint8_t *data_to_checksum = eth_payload_data + hlen - 12;
	2160	// size_t data_to_checksum_len = eth_payload_len - hlen + 12;
	2161
	2162	/* pointer to TCP header */
	2163	tcp_header p_tcp_hdr = (tcp_header)(eth_payload_data + hlen);
	2164
	2165	int tcp_hlen = TCP_HEADER_DATA_OFFSET(p_tcp_hdr);
	2166
	2167	/* ETH_MTU = ip header len + tcp header len + payload */
	2168	int tcp_data_len = ip_data_len - tcp_hlen;
	2169	int tcp_chunk_size = ETH_MTU - hlen - tcp_hlen;
	2170
	2171	DEBUG_PRINT(("RTL8139: +++ C+ mode TSO IP data len %d TCP hlen %d TCP data len %d TCP chunk size %d\n",
	2172	ip_data_len, tcp_hlen, tcp_data_len, tcp_chunk_size));
	2173
	2174	/* note the cycle below overwrites IP header data,
	2175	but restores it from saved_ip_header before sending packet */
	2176
	2177	int is_last_frame = 0;
	2178
	2179	for (tcp_send_offset = 0; tcp_send_offset < tcp_data_len; tcp_send_offset += tcp_chunk_size)
	2180	{
	2181	uint16_t chunk_size = tcp_chunk_size;
	2182
	2183	/* check if this is the last frame */
	2184	if (tcp_send_offset + tcp_chunk_size >= tcp_data_len)
	2185	{
	2186	is_last_frame = 1;
	2187	chunk_size = tcp_data_len - tcp_send_offset;
	2188	}
	2189
	2190	DEBUG_PRINT(("RTL8139: +++ C+ mode TSO TCP seqno %08x\n", be32_to_cpu(p_tcp_hdr->th_seq)));
	2191
	2192	/* add 4 TCP pseudoheader fields */
	2193	/* copy IP source and destination fields */
	2194	memcpy(data_to_checksum, saved_ip_header + 12, 8);
	2195
	2196	DEBUG_PRINT(("RTL8139: +++ C+ mode TSO calculating TCP checksum for packet with %d bytes data\n", tcp_hlen + chunk_size));
	2197
	2198	if (tcp_send_offset)
	2199	{
	2200	memcpy((uint8_t)p_tcp_hdr + tcp_hlen, (uint8_t)p_tcp_hdr + tcp_hlen + tcp_send_offset, chunk_size);
	2201	}
	2202
	2203	/* keep PUSH and FIN flags only for the last frame */
	2204	if (!is_last_frame)
	2205	{
	2206	TCP_HEADER_CLEAR_FLAGS(p_tcp_hdr, TCP_FLAG_PUSH\|TCP_FLAG_FIN);
	2207	}
	2208
	2209	/* recalculate TCP checksum */
	2210	ip_pseudo_header p_tcpip_hdr = (ip_pseudo_header )data_to_checksum;
	2211	p_tcpip_hdr->zeros = 0;
	2212	p_tcpip_hdr->ip_proto = IP_PROTO_TCP;
	2213	p_tcpip_hdr->ip_payload = cpu_to_be16(tcp_hlen + chunk_size);
	2214
	2215	p_tcp_hdr->th_sum = 0;
	2216
	2217	int tcp_checksum = ip_checksum(data_to_checksum, tcp_hlen + chunk_size + 12);
	2218	DEBUG_PRINT(("RTL8139: +++ C+ mode TSO TCP checksum %04x\n", tcp_checksum));
	2219
	2220	p_tcp_hdr->th_sum = tcp_checksum;
	2221
	2222	/* restore IP header */
	2223	memcpy(eth_payload_data, saved_ip_header, hlen);
	2224
	2225	/* set IP data length and recalculate IP checksum */
	2226	ip->ip_len = cpu_to_be16(hlen + tcp_hlen + chunk_size);
	2227
	2228	/* increment IP id for subsequent frames */
	2229	ip->ip_id = cpu_to_be16(tcp_send_offset/tcp_chunk_size + be16_to_cpu(ip->ip_id));
	2230
	2231	ip->ip_sum = 0;
	2232	ip->ip_sum = ip_checksum(eth_payload_data, hlen);
	2233	DEBUG_PRINT(("RTL8139: +++ C+ mode TSO IP header len=%d checksum=%04x\n", hlen, ip->ip_sum));
	2234
	2235	int tso_send_size = ETH_HLEN + hlen + tcp_hlen + chunk_size;
	2236	DEBUG_PRINT(("RTL8139: +++ C+ mode TSO transferring packet size %d\n", tso_send_size));
	2237	rtl8139_transfer_frame(s, saved_buffer, tso_send_size, 0);
	2238
	2239	/* add transferred count to TCP sequence number */
	2240	p_tcp_hdr->th_seq = cpu_to_be32(chunk_size + be32_to_cpu(p_tcp_hdr->th_seq));
	2241	++send_count;
	2242	}
	2243
	2244	/* Stop sending this frame */
	2245	saved_size = 0;
	2246	}
	2247	else if (txdw0 & (CP_TX_TCPCS\|CP_TX_UDPCS))
	2248	{
	2249	DEBUG_PRINT(("RTL8139: +++ C+ mode need TCP or UDP checksum\n"));
	2250
	2251	/* maximum IP header length is 60 bytes */
	2252	uint8_t saved_ip_header[60];
	2253	memcpy(saved_ip_header, eth_payload_data, hlen);
	2254
	2255	uint8_t *data_to_checksum = eth_payload_data + hlen - 12;
	2256	// size_t data_to_checksum_len = eth_payload_len - hlen + 12;
	2257
	2258	/* add 4 TCP pseudoheader fields */
	2259	/* copy IP source and destination fields */
	2260	memcpy(data_to_checksum, saved_ip_header + 12, 8);
	2261
	2262	if ((txdw0 & CP_TX_TCPCS) && ip_protocol == IP_PROTO_TCP)
	2263	{
	2264	DEBUG_PRINT(("RTL8139: +++ C+ mode calculating TCP checksum for packet with %d bytes data\n", ip_data_len));
	2265
	2266	ip_pseudo_header p_tcpip_hdr = (ip_pseudo_header )data_to_checksum;
	2267	p_tcpip_hdr->zeros = 0;
	2268	p_tcpip_hdr->ip_proto = IP_PROTO_TCP;
	2269	p_tcpip_hdr->ip_payload = cpu_to_be16(ip_data_len);
	2270
	2271	tcp_header* p_tcp_hdr = (tcp_header *) (data_to_checksum+12);
	2272
	2273	p_tcp_hdr->th_sum = 0;
	2274
	2275	int tcp_checksum = ip_checksum(data_to_checksum, ip_data_len + 12);
	2276	DEBUG_PRINT(("RTL8139: +++ C+ mode TCP checksum %04x\n", tcp_checksum));
	2277
	2278	p_tcp_hdr->th_sum = tcp_checksum;
	2279	}
	2280	else if ((txdw0 & CP_TX_UDPCS) && ip_protocol == IP_PROTO_UDP)
	2281	{
	2282	DEBUG_PRINT(("RTL8139: +++ C+ mode calculating UDP checksum for packet with %d bytes data\n", ip_data_len));
	2283
	2284	ip_pseudo_header p_udpip_hdr = (ip_pseudo_header )data_to_checksum;
	2285	p_udpip_hdr->zeros = 0;
	2286	p_udpip_hdr->ip_proto = IP_PROTO_UDP;
	2287	p_udpip_hdr->ip_payload = cpu_to_be16(ip_data_len);
	2288
	2289	udp_header p_udp_hdr = (udp_header ) (data_to_checksum+12);
	2290
	2291	p_udp_hdr->uh_sum = 0;
	2292
	2293	int udp_checksum = ip_checksum(data_to_checksum, ip_data_len + 12);
	2294	DEBUG_PRINT(("RTL8139: +++ C+ mode UDP checksum %04x\n", udp_checksum));
	2295
	2296	p_udp_hdr->uh_sum = udp_checksum;
	2297	}
	2298
	2299	/* restore IP header */
	2300	memcpy(eth_payload_data, saved_ip_header, hlen);
	2301	}
	2302	}
	2303	}
	2304
	2305	/* update tally counter */
	2306	++s->tally_counters.TxOk;
	2307
	2308	DEBUG_PRINT(("RTL8139: +++ C+ mode transmitting %d bytes packet\n", saved_size));
	2309
	2310	rtl8139_transfer_frame(s, saved_buffer, saved_size, 1);
	2311
	2312	/* restore card space if there was no recursion and reset offset */
	2313	if (!s->cplus_txbuffer)
	2314	{
	2315	s->cplus_txbuffer = saved_buffer;
	2316	s->cplus_txbuffer_len = saved_buffer_len;
	2317	s->cplus_txbuffer_offset = 0;
	2318	}
	2319	else
	2320	{
	2321	free(saved_buffer);
	2322	}
	2323	}
	2324	else
	2325	{
	2326	DEBUG_PRINT(("RTL8139: +++ C+ mode transmission continue to next descriptor\n"));
	2327	}
	2328
	2329	return 1;
	2330	}
	2331
	2332	static void rtl8139_cplus_transmit(RTL8139State *s)
	2333	{
	2334	int txcount = 0;
	2335
	2336	while (rtl8139_cplus_transmit_one(s))
	2337	{
	2338	++txcount;
	2339	}
	2340
	2341	/* Mark transfer completed */
	2342	if (!txcount)
	2343	{
	2344	DEBUG_PRINT(("RTL8139: C+ mode : transmitter queue stalled, current TxDesc = %d\n",
	2345	s->currCPlusTxDesc));
	2346	}
	2347	else
	2348	{
	2349	/* update interrupt status */
	2350	s->IntrStatus \|= TxOK;
	2351	rtl8139_update_irq(s);
	2352	}
	2353	}
	2354
	2355	static void rtl8139_transmit(RTL8139State *s)
	2356	{
	2357	int descriptor = s->currTxDesc, txcount = 0;
	2358
	2359	/while/
	2360	if (rtl8139_transmit_one(s, descriptor))
	2361	{
	2362	++s->currTxDesc;
	2363	s->currTxDesc %= 4;
	2364	++txcount;
	2365	}
	2366
	2367	/* Mark transfer completed */
	2368	if (!txcount)
	2369	{
	2370	DEBUG_PRINT(("RTL8139: transmitter queue stalled, current TxDesc = %d\n", s->currTxDesc));
	2371	}
	2372	}
	2373
	2374	static void rtl8139_TxStatus_write(RTL8139State *s, uint32_t txRegOffset, uint32_t val)
	2375	{
	2376
	2377	int descriptor = txRegOffset/4;
	2378
	2379	/* handle C+ transmit mode register configuration */
	2380
	2381	if (s->cplus_enabled)
	2382	{
	2383	DEBUG_PRINT(("RTL8139C+ DTCCR write offset=0x%x val=0x%08x descriptor=%d\n", txRegOffset, val, descriptor));
	2384
	2385	/* handle Dump Tally Counters command */
	2386	s->TxStatus[descriptor] = val;
	2387
	2388	if (descriptor == 0 && (val & 0x8))
	2389	{
	2390	target_phys_addr_t tc_addr = rtl8139_addr64(s->TxStatus[0] & ~0x3f, s->TxStatus[1]);
	2391
	2392	/* dump tally counters to specified memory location */
	2393	RTL8139TallyCounters_physical_memory_write( tc_addr, &s->tally_counters);
	2394
	2395	/* mark dump completed */
	2396	s->TxStatus[0] &= ~0x8;
	2397	}
	2398
	2399	return;
	2400	}
	2401
	2402	DEBUG_PRINT(("RTL8139: TxStatus write offset=0x%x val=0x%08x descriptor=%d\n", txRegOffset, val, descriptor));
	2403
	2404	/* mask only reserved bits */
	2405	val &= ~0xff00c000; /* these bits are reset on write */
	2406	val = SET_MASKED(val, 0x00c00000, s->TxStatus[descriptor]);
	2407
	2408	s->TxStatus[descriptor] = val;
	2409
	2410	/* attempt to start transmission */
	2411	rtl8139_transmit(s);
	2412	}
	2413
	2414	static uint32_t rtl8139_TxStatus_read(RTL8139State *s, uint32_t txRegOffset)
	2415	{
	2416	uint32_t ret = s->TxStatus[txRegOffset/4];
	2417
	2418	DEBUG_PRINT(("RTL8139: TxStatus read offset=0x%x val=0x%08x\n", txRegOffset, ret));
	2419
	2420	return ret;
	2421	}
	2422
	2423	static uint16_t rtl8139_TSAD_read(RTL8139State *s)
	2424	{
	2425	uint16_t ret = 0;
	2426
	2427	/* Simulate TSAD, it is read only anyway */
	2428
	2429	ret = ((s->TxStatus[3] & TxStatOK )?TSAD_TOK3:0)
	2430	\|((s->TxStatus[2] & TxStatOK )?TSAD_TOK2:0)
	2431	\|((s->TxStatus[1] & TxStatOK )?TSAD_TOK1:0)
	2432	\|((s->TxStatus[0] & TxStatOK )?TSAD_TOK0:0)
	2433
	2434	\|((s->TxStatus[3] & TxUnderrun)?TSAD_TUN3:0)
	2435	\|((s->TxStatus[2] & TxUnderrun)?TSAD_TUN2:0)
	2436	\|((s->TxStatus[1] & TxUnderrun)?TSAD_TUN1:0)
	2437	\|((s->TxStatus[0] & TxUnderrun)?TSAD_TUN0:0)
	2438
	2439	\|((s->TxStatus[3] & TxAborted )?TSAD_TABT3:0)
	2440	\|((s->TxStatus[2] & TxAborted )?TSAD_TABT2:0)
	2441	\|((s->TxStatus[1] & TxAborted )?TSAD_TABT1:0)
	2442	\|((s->TxStatus[0] & TxAborted )?TSAD_TABT0:0)
	2443
	2444	\|((s->TxStatus[3] & TxHostOwns )?TSAD_OWN3:0)
	2445	\|((s->TxStatus[2] & TxHostOwns )?TSAD_OWN2:0)
	2446	\|((s->TxStatus[1] & TxHostOwns )?TSAD_OWN1:0)
	2447	\|((s->TxStatus[0] & TxHostOwns )?TSAD_OWN0:0) ;
	2448
	2449
	2450	DEBUG_PRINT(("RTL8139: TSAD read val=0x%04x\n", ret));
	2451
	2452	return ret;
	2453	}
	2454
	2455	static uint16_t rtl8139_CSCR_read(RTL8139State *s)
	2456	{
	2457	uint16_t ret = s->CSCR;
	2458
	2459	DEBUG_PRINT(("RTL8139: CSCR read val=0x%04x\n", ret));
	2460
	2461	return ret;
	2462	}
	2463
	2464	static void rtl8139_TxAddr_write(RTL8139State *s, uint32_t txAddrOffset, uint32_t val)
	2465	{
	2466	DEBUG_PRINT(("RTL8139: TxAddr write offset=0x%x val=0x%08x\n", txAddrOffset, val));
	2467
	2468	s->TxAddr[txAddrOffset/4] = val;
	2469	}
	2470
	2471	static uint32_t rtl8139_TxAddr_read(RTL8139State *s, uint32_t txAddrOffset)
	2472	{
	2473	uint32_t ret = s->TxAddr[txAddrOffset/4];
	2474
	2475	DEBUG_PRINT(("RTL8139: TxAddr read offset=0x%x val=0x%08x\n", txAddrOffset, ret));
	2476
	2477	return ret;
	2478	}
	2479
	2480	static void rtl8139_RxBufPtr_write(RTL8139State *s, uint32_t val)
	2481	{
	2482	DEBUG_PRINT(("RTL8139: RxBufPtr write val=0x%04x\n", val));
	2483
	2484	/* this value is off by 16 */
	2485	s->RxBufPtr = MOD2(val + 0x10, s->RxBufferSize);
	2486
	2487	DEBUG_PRINT((" CAPR write: rx buffer length %d head 0x%04x read 0x%04x\n",
	2488	s->RxBufferSize, s->RxBufAddr, s->RxBufPtr));
	2489	}
	2490
	2491	static uint32_t rtl8139_RxBufPtr_read(RTL8139State *s)
	2492	{
	2493	/* this value is off by 16 */
	2494	uint32_t ret = s->RxBufPtr - 0x10;
	2495
	2496	DEBUG_PRINT(("RTL8139: RxBufPtr read val=0x%04x\n", ret));
	2497
	2498	return ret;
	2499	}
	2500
	2501	static uint32_t rtl8139_RxBufAddr_read(RTL8139State *s)
	2502	{
	2503	/* this value is NOT off by 16 */
	2504	uint32_t ret = s->RxBufAddr;
	2505
	2506	DEBUG_PRINT(("RTL8139: RxBufAddr read val=0x%04x\n", ret));
	2507
	2508	return ret;
	2509	}
	2510
	2511	static void rtl8139_RxBuf_write(RTL8139State *s, uint32_t val)
	2512	{
	2513	DEBUG_PRINT(("RTL8139: RxBuf write val=0x%08x\n", val));
	2514
	2515	s->RxBuf = val;
	2516
	2517	/* may need to reset rxring here */
	2518	}
	2519
	2520	static uint32_t rtl8139_RxBuf_read(RTL8139State *s)
	2521	{
	2522	uint32_t ret = s->RxBuf;
	2523
	2524	DEBUG_PRINT(("RTL8139: RxBuf read val=0x%08x\n", ret));
	2525
	2526	return ret;
	2527	}
	2528
	2529	static void rtl8139_IntrMask_write(RTL8139State *s, uint32_t val)
	2530	{
	2531	DEBUG_PRINT(("RTL8139: IntrMask write(w) val=0x%04x\n", val));
	2532
	2533	/* mask unwriteable bits */
	2534	val = SET_MASKED(val, 0x1e00, s->IntrMask);
	2535
	2536	s->IntrMask = val;
	2537
	2538	rtl8139_update_irq(s);
	2539	}
	2540
	2541	static uint32_t rtl8139_IntrMask_read(RTL8139State *s)
	2542	{
	2543	uint32_t ret = s->IntrMask;
	2544
	2545	DEBUG_PRINT(("RTL8139: IntrMask read(w) val=0x%04x\n", ret));
	2546
	2547	return ret;
	2548	}
	2549
	2550	static void rtl8139_IntrStatus_write(RTL8139State *s, uint32_t val)
	2551	{
	2552	DEBUG_PRINT(("RTL8139: IntrStatus write(w) val=0x%04x\n", val));
	2553
	2554	#if 0
	2555
	2556	/* writing to ISR has no effect */
	2557
	2558	return;
	2559
	2560	#else
	2561	uint16_t newStatus = s->IntrStatus & ~val;
	2562
	2563	/* mask unwriteable bits */
	2564	newStatus = SET_MASKED(newStatus, 0x1e00, s->IntrStatus);
	2565
	2566	/* writing 1 to interrupt status register bit clears it */
	2567	s->IntrStatus = 0;
	2568	rtl8139_update_irq(s);
	2569
	2570	s->IntrStatus = newStatus;
	2571	rtl8139_update_irq(s);
	2572	#endif
	2573	}
	2574
	2575	static uint32_t rtl8139_IntrStatus_read(RTL8139State *s)
	2576	{
	2577	uint32_t ret = s->IntrStatus;
	2578
	2579	DEBUG_PRINT(("RTL8139: IntrStatus read(w) val=0x%04x\n", ret));
	2580
	2581	#if 0
	2582
	2583	/* reading ISR clears all interrupts */
	2584	s->IntrStatus = 0;
	2585
	2586	rtl8139_update_irq(s);
	2587
	2588	#endif
	2589
	2590	return ret;
	2591	}
	2592
	2593	static void rtl8139_MultiIntr_write(RTL8139State *s, uint32_t val)
	2594	{
	2595	DEBUG_PRINT(("RTL8139: MultiIntr write(w) val=0x%04x\n", val));
	2596
	2597	/* mask unwriteable bits */
	2598	val = SET_MASKED(val, 0xf000, s->MultiIntr);
	2599
	2600	s->MultiIntr = val;
	2601	}
	2602
	2603	static uint32_t rtl8139_MultiIntr_read(RTL8139State *s)
	2604	{
	2605	uint32_t ret = s->MultiIntr;
	2606
	2607	DEBUG_PRINT(("RTL8139: MultiIntr read(w) val=0x%04x\n", ret));
	2608
	2609	return ret;
	2610	}
	2611
	2612	static void rtl8139_io_writeb(void *opaque, uint8_t addr, uint32_t val)
	2613	{
	2614	RTL8139State *s = opaque;
	2615
	2616	addr &= 0xff;
	2617
	2618	switch (addr)
	2619	{
	2620	case MAC0 ... MAC0+5:
	2621	s->phys[addr - MAC0] = val;
	2622	break;
	2623	case MAC0+6 ... MAC0+7:
	2624	/* reserved */
	2625	break;
	2626	case MAR0 ... MAR0+7:
	2627	s->mult[addr - MAR0] = val;
	2628	break;
	2629	case ChipCmd:
	2630	rtl8139_ChipCmd_write(s, val);
	2631	break;
	2632	case Cfg9346:
	2633	rtl8139_Cfg9346_write(s, val);
	2634	break;
	2635	case TxConfig: /* windows driver sometimes writes using byte-lenth call */
	2636	rtl8139_TxConfig_writeb(s, val);
	2637	break;
	2638	case Config0:
	2639	rtl8139_Config0_write(s, val);
	2640	break;
	2641	case Config1:
	2642	rtl8139_Config1_write(s, val);
	2643	break;
	2644	case Config3:
	2645	rtl8139_Config3_write(s, val);
	2646	break;
	2647	case Config4:
	2648	rtl8139_Config4_write(s, val);
	2649	break;
	2650	case Config5:
	2651	rtl8139_Config5_write(s, val);
	2652	break;
	2653	case MediaStatus:
	2654	/* ignore */
	2655	DEBUG_PRINT(("RTL8139: not implemented write(b) to MediaStatus val=0x%02x\n", val));
	2656	break;
	2657
	2658	case HltClk:
	2659	DEBUG_PRINT(("RTL8139: HltClk write val=0x%08x\n", val));
	2660	if (val == 'R')
	2661	{
	2662	s->clock_enabled = 1;
	2663	}
	2664	else if (val == 'H')
	2665	{
	2666	s->clock_enabled = 0;
	2667	}
	2668	break;
	2669
	2670	case TxThresh:
	2671	DEBUG_PRINT(("RTL8139C+ TxThresh write(b) val=0x%02x\n", val));
	2672	s->TxThresh = val;
	2673	break;
	2674
	2675	case TxPoll:
	2676	DEBUG_PRINT(("RTL8139C+ TxPoll write(b) val=0x%02x\n", val));
	2677	if (val & (1 << 7))
	2678	{
	2679	DEBUG_PRINT(("RTL8139C+ TxPoll high priority transmission (not implemented)\n"));
	2680	//rtl8139_cplus_transmit(s);
	2681	}
	2682	if (val & (1 << 6))
	2683	{
	2684	DEBUG_PRINT(("RTL8139C+ TxPoll normal priority transmission\n"));
	2685	rtl8139_cplus_transmit(s);
	2686	}
	2687
	2688	break;
	2689
	2690	default:
	2691	DEBUG_PRINT(("RTL8139: not implemented write(b) addr=0x%x val=0x%02x\n", addr, val));
	2692	break;
	2693	}
	2694	}
	2695
	2696	static void rtl8139_io_writew(void *opaque, uint8_t addr, uint32_t val)
	2697	{
	2698	RTL8139State *s = opaque;
	2699
	2700	addr &= 0xfe;
	2701
	2702	switch (addr)
	2703	{
	2704	case IntrMask:
	2705	rtl8139_IntrMask_write(s, val);
	2706	break;
	2707
	2708	case IntrStatus:
	2709	rtl8139_IntrStatus_write(s, val);
	2710	break;
	2711
	2712	case MultiIntr:
	2713	rtl8139_MultiIntr_write(s, val);
	2714	break;
	2715
	2716	case RxBufPtr:
	2717	rtl8139_RxBufPtr_write(s, val);
	2718	break;
	2719
	2720	case BasicModeCtrl:
	2721	rtl8139_BasicModeCtrl_write(s, val);
	2722	break;
	2723	case BasicModeStatus:
	2724	rtl8139_BasicModeStatus_write(s, val);
	2725	break;
	2726	case NWayAdvert:
	2727	DEBUG_PRINT(("RTL8139: NWayAdvert write(w) val=0x%04x\n", val));
	2728	s->NWayAdvert = val;
	2729	break;
	2730	case NWayLPAR:
	2731	DEBUG_PRINT(("RTL8139: forbidden NWayLPAR write(w) val=0x%04x\n", val));
	2732	break;
	2733	case NWayExpansion:
	2734	DEBUG_PRINT(("RTL8139: NWayExpansion write(w) val=0x%04x\n", val));
	2735	s->NWayExpansion = val;
	2736	break;
	2737
	2738	case CpCmd:
	2739	rtl8139_CpCmd_write(s, val);
	2740	break;
	2741
	2742	case IntrMitigate:
	2743	rtl8139_IntrMitigate_write(s, val);
	2744	break;
	2745
	2746	default:
	2747	DEBUG_PRINT(("RTL8139: ioport write(w) addr=0x%x val=0x%04x via write(b)\n", addr, val));
	2748
	2749	rtl8139_io_writeb(opaque, addr, val & 0xff);
	2750	rtl8139_io_writeb(opaque, addr + 1, (val >> 8) & 0xff);
	2751	break;
	2752	}
	2753	}
	2754
	2755	static void rtl8139_io_writel(void *opaque, uint8_t addr, uint32_t val)
	2756	{
	2757	RTL8139State *s = opaque;
	2758
	2759	addr &= 0xfc;
	2760
	2761	switch (addr)
	2762	{
	2763	case RxMissed:
	2764	DEBUG_PRINT(("RTL8139: RxMissed clearing on write\n"));
	2765	s->RxMissed = 0;
	2766	break;
	2767
	2768	case TxConfig:
	2769	rtl8139_TxConfig_write(s, val);
	2770	break;
	2771
	2772	case RxConfig:
	2773	rtl8139_RxConfig_write(s, val);
	2774	break;
	2775
	2776	case TxStatus0 ... TxStatus0+4*4-1:
	2777	rtl8139_TxStatus_write(s, addr-TxStatus0, val);
	2778	break;
	2779
	2780	case TxAddr0 ... TxAddr0+4*4-1:
	2781	rtl8139_TxAddr_write(s, addr-TxAddr0, val);
	2782	break;
	2783
	2784	case RxBuf:
	2785	rtl8139_RxBuf_write(s, val);
	2786	break;
	2787
	2788	case RxRingAddrLO:
	2789	DEBUG_PRINT(("RTL8139: C+ RxRing low bits write val=0x%08x\n", val));
	2790	s->RxRingAddrLO = val;
	2791	break;
	2792
	2793	case RxRingAddrHI:
	2794	DEBUG_PRINT(("RTL8139: C+ RxRing high bits write val=0x%08x\n", val));
	2795	s->RxRingAddrHI = val;
	2796	break;
	2797
	2798	case Timer:
	2799	DEBUG_PRINT(("RTL8139: TCTR Timer reset on write\n"));
	2800	s->TCTR = 0;
	2801	s->TCTR_base = qemu_get_clock(vm_clock);
	2802	break;
	2803
	2804	case FlashReg:
	2805	DEBUG_PRINT(("RTL8139: FlashReg TimerInt write val=0x%08x\n", val));
	2806	s->TimerInt = val;
	2807	break;
	2808
	2809	default:
	2810	DEBUG_PRINT(("RTL8139: ioport write(l) addr=0x%x val=0x%08x via write(b)\n", addr, val));
	2811	rtl8139_io_writeb(opaque, addr, val & 0xff);
	2812	rtl8139_io_writeb(opaque, addr + 1, (val >> 8) & 0xff);
	2813	rtl8139_io_writeb(opaque, addr + 2, (val >> 16) & 0xff);
	2814	rtl8139_io_writeb(opaque, addr + 3, (val >> 24) & 0xff);
	2815	break;
	2816	}
	2817	}
	2818
	2819	static uint32_t rtl8139_io_readb(void *opaque, uint8_t addr)
	2820	{
	2821	RTL8139State *s = opaque;
	2822	int ret;
	2823
	2824	addr &= 0xff;
	2825
	2826	switch (addr)
	2827	{
	2828	case MAC0 ... MAC0+5:
	2829	ret = s->phys[addr - MAC0];
	2830	break;
	2831	case MAC0+6 ... MAC0+7:
	2832	ret = 0;
	2833	break;
	2834	case MAR0 ... MAR0+7:
	2835	ret = s->mult[addr - MAR0];
	2836	break;
	2837	case ChipCmd:
	2838	ret = rtl8139_ChipCmd_read(s);
	2839	break;
	2840	case Cfg9346:
	2841	ret = rtl8139_Cfg9346_read(s);
	2842	break;
	2843	case Config0:
	2844	ret = rtl8139_Config0_read(s);
	2845	break;
	2846	case Config1:
	2847	ret = rtl8139_Config1_read(s);
	2848	break;
	2849	case Config3:
	2850	ret = rtl8139_Config3_read(s);
	2851	break;
	2852	case Config4:
	2853	ret = rtl8139_Config4_read(s);
	2854	break;
	2855	case Config5:
	2856	ret = rtl8139_Config5_read(s);
	2857	break;
	2858
	2859	case MediaStatus:
	2860	ret = 0xd0;
	2861	DEBUG_PRINT(("RTL8139: MediaStatus read 0x%x\n", ret));
	2862	break;
	2863
	2864	case HltClk:
	2865	ret = s->clock_enabled;
	2866	DEBUG_PRINT(("RTL8139: HltClk read 0x%x\n", ret));
	2867	break;
	2868
	2869	case PCIRevisionID:
	2870	ret = RTL8139_PCI_REVID;
	2871	DEBUG_PRINT(("RTL8139: PCI Revision ID read 0x%x\n", ret));
	2872	break;
	2873
	2874	case TxThresh:
	2875	ret = s->TxThresh;
	2876	DEBUG_PRINT(("RTL8139C+ TxThresh read(b) val=0x%02x\n", ret));
	2877	break;
	2878
	2879	case 0x43: /* Part of TxConfig register. Windows driver tries to read it */
	2880	ret = s->TxConfig >> 24;
	2881	DEBUG_PRINT(("RTL8139C TxConfig at 0x43 read(b) val=0x%02x\n", ret));
	2882	break;
	2883
	2884	default:
	2885	DEBUG_PRINT(("RTL8139: not implemented read(b) addr=0x%x\n", addr));
	2886	ret = 0;
	2887	break;
	2888	}
	2889
	2890	return ret;
	2891	}
	2892
	2893	static uint32_t rtl8139_io_readw(void *opaque, uint8_t addr)
	2894	{
	2895	RTL8139State *s = opaque;
	2896	uint32_t ret;
	2897
	2898	addr &= 0xfe; /* mask lower bit */
	2899
	2900	switch (addr)
	2901	{
	2902	case IntrMask:
	2903	ret = rtl8139_IntrMask_read(s);
	2904	break;
	2905
	2906	case IntrStatus:
	2907	ret = rtl8139_IntrStatus_read(s);
	2908	break;
	2909
	2910	case MultiIntr:
	2911	ret = rtl8139_MultiIntr_read(s);
	2912	break;
	2913
	2914	case RxBufPtr:
	2915	ret = rtl8139_RxBufPtr_read(s);
	2916	break;
	2917
	2918	case RxBufAddr:
	2919	ret = rtl8139_RxBufAddr_read(s);
	2920	break;
	2921
	2922	case BasicModeCtrl:
	2923	ret = rtl8139_BasicModeCtrl_read(s);
	2924	break;
	2925	case BasicModeStatus:
	2926	ret = rtl8139_BasicModeStatus_read(s);
	2927	break;
	2928	case NWayAdvert:
	2929	ret = s->NWayAdvert;
	2930	DEBUG_PRINT(("RTL8139: NWayAdvert read(w) val=0x%04x\n", ret));
	2931	break;
	2932	case NWayLPAR:
	2933	ret = s->NWayLPAR;
	2934	DEBUG_PRINT(("RTL8139: NWayLPAR read(w) val=0x%04x\n", ret));
	2935	break;
	2936	case NWayExpansion:
	2937	ret = s->NWayExpansion;
	2938	DEBUG_PRINT(("RTL8139: NWayExpansion read(w) val=0x%04x\n", ret));
	2939	break;
	2940
	2941	case CpCmd:
	2942	ret = rtl8139_CpCmd_read(s);
	2943	break;
	2944
	2945	case IntrMitigate:
	2946	ret = rtl8139_IntrMitigate_read(s);
	2947	break;
	2948
	2949	case TxSummary:
	2950	ret = rtl8139_TSAD_read(s);
	2951	break;
	2952
	2953	case CSCR:
	2954	ret = rtl8139_CSCR_read(s);
	2955	break;
	2956
	2957	default:
	2958	DEBUG_PRINT(("RTL8139: ioport read(w) addr=0x%x via read(b)\n", addr));
	2959
	2960	ret = rtl8139_io_readb(opaque, addr);
	2961	ret \|= rtl8139_io_readb(opaque, addr + 1) << 8;
	2962
	2963	DEBUG_PRINT(("RTL8139: ioport read(w) addr=0x%x val=0x%04x\n", addr, ret));
	2964	break;
	2965	}
	2966
	2967	return ret;
	2968	}
	2969
	2970	static uint32_t rtl8139_io_readl(void *opaque, uint8_t addr)
	2971	{
	2972	RTL8139State *s = opaque;
	2973	uint32_t ret;
	2974
	2975	addr &= 0xfc; /* also mask low 2 bits */
	2976
	2977	switch (addr)
	2978	{
	2979	case RxMissed:
	2980	ret = s->RxMissed;
	2981
	2982	DEBUG_PRINT(("RTL8139: RxMissed read val=0x%08x\n", ret));
	2983	break;
	2984
	2985	case TxConfig:
	2986	ret = rtl8139_TxConfig_read(s);
	2987	break;
	2988
	2989	case RxConfig:
	2990	ret = rtl8139_RxConfig_read(s);
	2991	break;
	2992
	2993	case TxStatus0 ... TxStatus0+4*4-1:
	2994	ret = rtl8139_TxStatus_read(s, addr-TxStatus0);
	2995	break;
	2996
	2997	case TxAddr0 ... TxAddr0+4*4-1:
	2998	ret = rtl8139_TxAddr_read(s, addr-TxAddr0);
	2999	break;
	3000
	3001	case RxBuf:
	3002	ret = rtl8139_RxBuf_read(s);
	3003	break;
	3004
	3005	case RxRingAddrLO:
	3006	ret = s->RxRingAddrLO;
	3007	DEBUG_PRINT(("RTL8139: C+ RxRing low bits read val=0x%08x\n", ret));
	3008	break;
	3009
	3010	case RxRingAddrHI:
	3011	ret = s->RxRingAddrHI;
	3012	DEBUG_PRINT(("RTL8139: C+ RxRing high bits read val=0x%08x\n", ret));
	3013	break;
	3014
	3015	case Timer:
	3016	ret = s->TCTR;
	3017	DEBUG_PRINT(("RTL8139: TCTR Timer read val=0x%08x\n", ret));
	3018	break;
	3019
	3020	case FlashReg:
	3021	ret = s->TimerInt;
	3022	DEBUG_PRINT(("RTL8139: FlashReg TimerInt read val=0x%08x\n", ret));
	3023	break;
	3024
	3025	default:
	3026	DEBUG_PRINT(("RTL8139: ioport read(l) addr=0x%x via read(b)\n", addr));
	3027
	3028	ret = rtl8139_io_readb(opaque, addr);
	3029	ret \|= rtl8139_io_readb(opaque, addr + 1) << 8;
	3030	ret \|= rtl8139_io_readb(opaque, addr + 2) << 16;
	3031	ret \|= rtl8139_io_readb(opaque, addr + 3) << 24;
	3032
	3033	DEBUG_PRINT(("RTL8139: read(l) addr=0x%x val=%08x\n", addr, ret));
	3034	break;
	3035	}
	3036
	3037	return ret;
	3038	}
	3039
	3040	/* */
	3041
	3042	static void rtl8139_ioport_writeb(void *opaque, uint32_t addr, uint32_t val)
	3043	{
	3044	rtl8139_io_writeb(opaque, addr & 0xFF, val);
	3045	}
	3046
	3047	static void rtl8139_ioport_writew(void *opaque, uint32_t addr, uint32_t val)
	3048	{
	3049	rtl8139_io_writew(opaque, addr & 0xFF, val);
	3050	}
	3051
	3052	static void rtl8139_ioport_writel(void *opaque, uint32_t addr, uint32_t val)
	3053	{
	3054	rtl8139_io_writel(opaque, addr & 0xFF, val);
	3055	}
	3056
	3057	static uint32_t rtl8139_ioport_readb(void *opaque, uint32_t addr)
	3058	{
	3059	return rtl8139_io_readb(opaque, addr & 0xFF);
	3060	}
	3061
	3062	static uint32_t rtl8139_ioport_readw(void *opaque, uint32_t addr)
	3063	{
	3064	return rtl8139_io_readw(opaque, addr & 0xFF);
	3065	}
	3066
	3067	static uint32_t rtl8139_ioport_readl(void *opaque, uint32_t addr)
	3068	{
	3069	return rtl8139_io_readl(opaque, addr & 0xFF);
	3070	}
	3071
	3072	/* */
	3073
	3074	static void rtl8139_mmio_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
	3075	{
	3076	rtl8139_io_writeb(opaque, addr & 0xFF, val);
	3077	}
	3078
	3079	static void rtl8139_mmio_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
	3080	{
	3081	#ifdef TARGET_WORDS_BIGENDIAN
	3082	val = bswap16(val);
	3083	#endif
	3084	rtl8139_io_writew(opaque, addr & 0xFF, val);
	3085	}
	3086
	3087	static void rtl8139_mmio_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
	3088	{
	3089	#ifdef TARGET_WORDS_BIGENDIAN
	3090	val = bswap32(val);
	3091	#endif
	3092	rtl8139_io_writel(opaque, addr & 0xFF, val);
	3093	}
	3094
	3095	static uint32_t rtl8139_mmio_readb(void *opaque, target_phys_addr_t addr)
	3096	{
	3097	return rtl8139_io_readb(opaque, addr & 0xFF);
	3098	}
	3099
	3100	static uint32_t rtl8139_mmio_readw(void *opaque, target_phys_addr_t addr)
	3101	{
	3102	uint32_t val = rtl8139_io_readw(opaque, addr & 0xFF);
	3103	#ifdef TARGET_WORDS_BIGENDIAN
	3104	val = bswap16(val);
	3105	#endif
	3106	return val;
	3107	}
	3108
	3109	static uint32_t rtl8139_mmio_readl(void *opaque, target_phys_addr_t addr)
	3110	{
	3111	uint32_t val = rtl8139_io_readl(opaque, addr & 0xFF);
	3112	#ifdef TARGET_WORDS_BIGENDIAN
	3113	val = bswap32(val);
	3114	#endif
	3115	return val;
	3116	}
	3117
	3118	/* */
	3119
	3120	static void rtl8139_save(QEMUFile* f,void* opaque)
	3121	{
	3122	RTL8139State* s = opaque;
	3123	unsigned int i;
	3124
	3125	pci_device_save(&s->dev, f);
	3126
	3127	qemu_put_buffer(f, s->phys, 6);
	3128	qemu_put_buffer(f, s->mult, 8);
	3129
	3130	for (i=0; i<4; ++i)
	3131	{
	3132	qemu_put_be32s(f, &s->TxStatus[i]); /* TxStatus0 */
	3133	}
	3134	for (i=0; i<4; ++i)
	3135	{
	3136	qemu_put_be32s(f, &s->TxAddr[i]); /* TxAddr0 */
	3137	}
	3138
	3139	qemu_put_be32s(f, &s->RxBuf); /* Receive buffer */
	3140	qemu_put_be32s(f, &s->RxBufferSize);/* internal variable, receive ring buffer size in C mode */
	3141	qemu_put_be32s(f, &s->RxBufPtr);
	3142	qemu_put_be32s(f, &s->RxBufAddr);
	3143
	3144	qemu_put_be16s(f, &s->IntrStatus);
	3145	qemu_put_be16s(f, &s->IntrMask);
	3146
	3147	qemu_put_be32s(f, &s->TxConfig);
	3148	qemu_put_be32s(f, &s->RxConfig);
	3149	qemu_put_be32s(f, &s->RxMissed);
	3150	qemu_put_be16s(f, &s->CSCR);
	3151
	3152	qemu_put_8s(f, &s->Cfg9346);
	3153	qemu_put_8s(f, &s->Config0);
	3154	qemu_put_8s(f, &s->Config1);
	3155	qemu_put_8s(f, &s->Config3);
	3156	qemu_put_8s(f, &s->Config4);
	3157	qemu_put_8s(f, &s->Config5);
	3158
	3159	qemu_put_8s(f, &s->clock_enabled);
	3160	qemu_put_8s(f, &s->bChipCmdState);
	3161
	3162	qemu_put_be16s(f, &s->MultiIntr);
	3163
	3164	qemu_put_be16s(f, &s->BasicModeCtrl);
	3165	qemu_put_be16s(f, &s->BasicModeStatus);
	3166	qemu_put_be16s(f, &s->NWayAdvert);
	3167	qemu_put_be16s(f, &s->NWayLPAR);
	3168	qemu_put_be16s(f, &s->NWayExpansion);
	3169
	3170	qemu_put_be16s(f, &s->CpCmd);
	3171	qemu_put_8s(f, &s->TxThresh);
	3172
	3173	i = 0;
	3174	qemu_put_be32s(f, &i); /* unused. */
	3175	qemu_put_buffer(f, s->conf.macaddr.a, 6);
	3176	qemu_put_be32(f, s->rtl8139_mmio_io_addr);
	3177
	3178	qemu_put_be32s(f, &s->currTxDesc);
	3179	qemu_put_be32s(f, &s->currCPlusRxDesc);
	3180	qemu_put_be32s(f, &s->currCPlusTxDesc);
	3181	qemu_put_be32s(f, &s->RxRingAddrLO);
	3182	qemu_put_be32s(f, &s->RxRingAddrHI);
	3183
	3184	for (i=0; i<EEPROM_9346_SIZE; ++i)
	3185	{
	3186	qemu_put_be16s(f, &s->eeprom.contents[i]);
	3187	}
	3188	qemu_put_be32(f, s->eeprom.mode);
	3189	qemu_put_be32s(f, &s->eeprom.tick);
	3190	qemu_put_8s(f, &s->eeprom.address);
	3191	qemu_put_be16s(f, &s->eeprom.input);
	3192	qemu_put_be16s(f, &s->eeprom.output);
	3193
	3194	qemu_put_8s(f, &s->eeprom.eecs);
	3195	qemu_put_8s(f, &s->eeprom.eesk);
	3196	qemu_put_8s(f, &s->eeprom.eedi);
	3197	qemu_put_8s(f, &s->eeprom.eedo);
	3198
	3199	qemu_put_be32s(f, &s->TCTR);
	3200	qemu_put_be32s(f, &s->TimerInt);
	3201	qemu_put_be64(f, s->TCTR_base);
	3202
	3203	RTL8139TallyCounters_save(f, &s->tally_counters);
	3204
	3205	qemu_put_be32s(f, &s->cplus_enabled);
	3206	}
	3207
	3208	static int rtl8139_load(QEMUFile* f,void* opaque,int version_id)
	3209	{
	3210	RTL8139State* s = opaque;
	3211	unsigned int i;
	3212	int ret;
	3213
	3214	/* just 2 versions for now */
	3215	if (version_id > 4)
	3216	return -EINVAL;
	3217
	3218	if (version_id >= 3) {
	3219	ret = pci_device_load(&s->dev, f);
	3220	if (ret < 0)
	3221	return ret;
	3222	}
	3223
	3224	/* saved since version 1 */
	3225	qemu_get_buffer(f, s->phys, 6);
	3226	qemu_get_buffer(f, s->mult, 8);
	3227
	3228	for (i=0; i<4; ++i)
	3229	{
	3230	qemu_get_be32s(f, &s->TxStatus[i]); /* TxStatus0 */
	3231	}
	3232	for (i=0; i<4; ++i)
	3233	{
	3234	qemu_get_be32s(f, &s->TxAddr[i]); /* TxAddr0 */
	3235	}
	3236
	3237	qemu_get_be32s(f, &s->RxBuf); /* Receive buffer */
	3238	qemu_get_be32s(f, &s->RxBufferSize);/* internal variable, receive ring buffer size in C mode */
	3239	qemu_get_be32s(f, &s->RxBufPtr);
	3240	qemu_get_be32s(f, &s->RxBufAddr);
	3241
	3242	qemu_get_be16s(f, &s->IntrStatus);
	3243	qemu_get_be16s(f, &s->IntrMask);
	3244
	3245	qemu_get_be32s(f, &s->TxConfig);
	3246	qemu_get_be32s(f, &s->RxConfig);
	3247	qemu_get_be32s(f, &s->RxMissed);
	3248	qemu_get_be16s(f, &s->CSCR);
	3249
	3250	qemu_get_8s(f, &s->Cfg9346);
	3251	qemu_get_8s(f, &s->Config0);
	3252	qemu_get_8s(f, &s->Config1);
	3253	qemu_get_8s(f, &s->Config3);
	3254	qemu_get_8s(f, &s->Config4);
	3255	qemu_get_8s(f, &s->Config5);
	3256
	3257	qemu_get_8s(f, &s->clock_enabled);
	3258	qemu_get_8s(f, &s->bChipCmdState);
	3259
	3260	qemu_get_be16s(f, &s->MultiIntr);
	3261
	3262	qemu_get_be16s(f, &s->BasicModeCtrl);
	3263	qemu_get_be16s(f, &s->BasicModeStatus);
	3264	qemu_get_be16s(f, &s->NWayAdvert);
	3265	qemu_get_be16s(f, &s->NWayLPAR);
	3266	qemu_get_be16s(f, &s->NWayExpansion);
	3267
	3268	qemu_get_be16s(f, &s->CpCmd);
	3269	qemu_get_8s(f, &s->TxThresh);
	3270
	3271	qemu_get_be32s(f, &i); /* unused. */
	3272	qemu_get_buffer(f, s->conf.macaddr.a, 6);
	3273	s->rtl8139_mmio_io_addr=qemu_get_be32(f);
	3274
	3275	qemu_get_be32s(f, &s->currTxDesc);
	3276	qemu_get_be32s(f, &s->currCPlusRxDesc);
	3277	qemu_get_be32s(f, &s->currCPlusTxDesc);
	3278	qemu_get_be32s(f, &s->RxRingAddrLO);
	3279	qemu_get_be32s(f, &s->RxRingAddrHI);
	3280
	3281	for (i=0; i<EEPROM_9346_SIZE; ++i)
	3282	{
	3283	qemu_get_be16s(f, &s->eeprom.contents[i]);
	3284	}
	3285	s->eeprom.mode=qemu_get_be32(f);
	3286	qemu_get_be32s(f, &s->eeprom.tick);
	3287	qemu_get_8s(f, &s->eeprom.address);
	3288	qemu_get_be16s(f, &s->eeprom.input);
	3289	qemu_get_be16s(f, &s->eeprom.output);
	3290
	3291	qemu_get_8s(f, &s->eeprom.eecs);
	3292	qemu_get_8s(f, &s->eeprom.eesk);
	3293	qemu_get_8s(f, &s->eeprom.eedi);
	3294	qemu_get_8s(f, &s->eeprom.eedo);
	3295
	3296	/* saved since version 2 */
	3297	if (version_id >= 2)
	3298	{
	3299	qemu_get_be32s(f, &s->TCTR);
	3300	qemu_get_be32s(f, &s->TimerInt);
	3301	s->TCTR_base=qemu_get_be64(f);
	3302
	3303	RTL8139TallyCounters_load(f, &s->tally_counters);
	3304	}
	3305	else
	3306	{
	3307	/* not saved, use default */
	3308	s->TCTR = 0;
	3309	s->TimerInt = 0;
	3310	s->TCTR_base = 0;
	3311
	3312	RTL8139TallyCounters_clear(&s->tally_counters);
	3313	}
	3314
	3315	if (version_id >= 4) {
	3316	qemu_get_be32s(f, &s->cplus_enabled);
	3317	} else {
	3318	s->cplus_enabled = s->CpCmd != 0;
	3319	}
	3320
	3321	return 0;
	3322	}
	3323
	3324	/***********************************************************/
	3325	/* PCI RTL8139 definitions */
	3326
	3327	static void rtl8139_mmio_map(PCIDevice *pci_dev, int region_num,
	3328	uint32_t addr, uint32_t size, int type)
	3329	{
	3330	RTL8139State *s = DO_UPCAST(RTL8139State, dev, pci_dev);
	3331
	3332	cpu_register_physical_memory(addr + 0, 0x100, s->rtl8139_mmio_io_addr);
	3333	}
	3334
	3335	static void rtl8139_ioport_map(PCIDevice *pci_dev, int region_num,
	3336	uint32_t addr, uint32_t size, int type)
	3337	{
	3338	RTL8139State *s = DO_UPCAST(RTL8139State, dev, pci_dev);
	3339
	3340	register_ioport_write(addr, 0x100, 1, rtl8139_ioport_writeb, s);
	3341	register_ioport_read( addr, 0x100, 1, rtl8139_ioport_readb, s);
	3342
	3343	register_ioport_write(addr, 0x100, 2, rtl8139_ioport_writew, s);
	3344	register_ioport_read( addr, 0x100, 2, rtl8139_ioport_readw, s);
	3345
	3346	register_ioport_write(addr, 0x100, 4, rtl8139_ioport_writel, s);
	3347	register_ioport_read( addr, 0x100, 4, rtl8139_ioport_readl, s);
	3348	}
	3349
	3350	static CPUReadMemoryFunc * const rtl8139_mmio_read[3] = {
	3351	rtl8139_mmio_readb,
	3352	rtl8139_mmio_readw,
	3353	rtl8139_mmio_readl,
	3354	};
	3355
	3356	static CPUWriteMemoryFunc * const rtl8139_mmio_write[3] = {
	3357	rtl8139_mmio_writeb,
	3358	rtl8139_mmio_writew,
	3359	rtl8139_mmio_writel,
	3360	};
	3361
	3362	static inline int64_t rtl8139_get_next_tctr_time(RTL8139State *s, int64_t current_time)
	3363	{
	3364	int64_t next_time = current_time +
	3365	muldiv64(1, get_ticks_per_sec(), PCI_FREQUENCY);
	3366	if (next_time <= current_time)
	3367	next_time = current_time + 1;
	3368	return next_time;
	3369	}
	3370
	3371	#ifdef RTL8139_ONBOARD_TIMER
	3372	static void rtl8139_timer(void *opaque)
	3373	{
	3374	RTL8139State *s = opaque;
	3375
	3376	int is_timeout = 0;
	3377
	3378	int64_t curr_time;
	3379	uint32_t curr_tick;
	3380
	3381	if (!s->clock_enabled)
	3382	{
	3383	DEBUG_PRINT(("RTL8139: >>> timer: clock is not running\n"));
	3384	return;
	3385	}
	3386
	3387	curr_time = qemu_get_clock(vm_clock);
	3388
	3389	curr_tick = muldiv64(curr_time - s->TCTR_base, PCI_FREQUENCY,
	3390	get_ticks_per_sec());
	3391
	3392	if (s->TimerInt && curr_tick >= s->TimerInt)
	3393	{
	3394	if (s->TCTR < s->TimerInt \|\| curr_tick < s->TCTR)
	3395	{
	3396	is_timeout = 1;
	3397	}
	3398	}
	3399
	3400	s->TCTR = curr_tick;
	3401
	3402	// DEBUG_PRINT(("RTL8139: >>> timer: tick=%08u\n", s->TCTR));
	3403
	3404	if (is_timeout)
	3405	{
	3406	DEBUG_PRINT(("RTL8139: >>> timer: timeout tick=%08u\n", s->TCTR));
	3407	s->IntrStatus \|= PCSTimeout;
	3408	rtl8139_update_irq(s);
	3409	}
	3410
	3411	qemu_mod_timer(s->timer,
	3412	rtl8139_get_next_tctr_time(s,curr_time));
	3413	}
	3414	#endif /* RTL8139_ONBOARD_TIMER */
	3415
	3416	static void rtl8139_cleanup(VLANClientState *vc)
	3417	{
	3418	RTL8139State *s = vc->opaque;
	3419
	3420	s->vc = NULL;
	3421	}
	3422
	3423	static int pci_rtl8139_uninit(PCIDevice *dev)
	3424	{
	3425	RTL8139State *s = DO_UPCAST(RTL8139State, dev, dev);
	3426
	3427	cpu_unregister_io_memory(s->rtl8139_mmio_io_addr);
	3428	if (s->cplus_txbuffer) {
	3429	qemu_free(s->cplus_txbuffer);
	3430	s->cplus_txbuffer = NULL;
	3431	}
	3432	#ifdef RTL8139_ONBOARD_TIMER
	3433	qemu_del_timer(s->timer);
	3434	qemu_free_timer(s->timer);
	3435	#endif
	3436	unregister_savevm("rtl8139", s);
	3437	qemu_del_vlan_client(s->vc);
	3438	return 0;
	3439	}
	3440
	3441	static int pci_rtl8139_init(PCIDevice *dev)
	3442	{
	3443	RTL8139State * s = DO_UPCAST(RTL8139State, dev, dev);
	3444	uint8_t *pci_conf;
	3445
	3446	pci_conf = s->dev.config;
	3447	pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_REALTEK);
	3448	pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_REALTEK_8139);
	3449	pci_conf[0x04] = 0x05; /* command = I/O space, Bus Master */
	3450	pci_conf[0x08] = RTL8139_PCI_REVID; /* PCI revision ID; >=0x20 is for 8139C+ */
	3451	pci_config_set_class(pci_conf, PCI_CLASS_NETWORK_ETHERNET);
	3452	pci_conf[PCI_HEADER_TYPE] = PCI_HEADER_TYPE_NORMAL; /* header_type */
	3453	pci_conf[0x3d] = 1; /* interrupt pin 0 */
	3454	pci_conf[0x34] = 0xdc;
	3455
	3456	/* I/O handler for memory-mapped I/O */
	3457	s->rtl8139_mmio_io_addr =
	3458	cpu_register_io_memory(rtl8139_mmio_read, rtl8139_mmio_write, s);
	3459
	3460	pci_register_bar(&s->dev, 0, 0x100,
	3461	PCI_ADDRESS_SPACE_IO, rtl8139_ioport_map);
	3462
	3463	pci_register_bar(&s->dev, 1, 0x100,
	3464	PCI_ADDRESS_SPACE_MEM, rtl8139_mmio_map);
	3465
	3466	qemu_macaddr_default_if_unset(&s->conf.macaddr);
	3467	rtl8139_reset(&s->dev.qdev);
	3468	s->vc = qemu_new_vlan_client(NET_CLIENT_TYPE_NIC,
	3469	s->conf.vlan, s->conf.peer,
	3470	dev->qdev.info->name, dev->qdev.id,
	3471	rtl8139_can_receive, rtl8139_receive, NULL,
	3472	NULL, rtl8139_cleanup, s);
	3473	qemu_format_nic_info_str(s->vc, s->conf.macaddr.a);
	3474
	3475	s->cplus_txbuffer = NULL;
	3476	s->cplus_txbuffer_len = 0;
	3477	s->cplus_txbuffer_offset = 0;
	3478
	3479	register_savevm("rtl8139", -1, 4, rtl8139_save, rtl8139_load, s);
	3480
	3481	#ifdef RTL8139_ONBOARD_TIMER
	3482	s->timer = qemu_new_timer(vm_clock, rtl8139_timer, s);
	3483
	3484	qemu_mod_timer(s->timer,
	3485	rtl8139_get_next_tctr_time(s,qemu_get_clock(vm_clock)));
	3486	#endif /* RTL8139_ONBOARD_TIMER */
	3487
	3488	if (!dev->qdev.hotplugged) {
	3489	static int loaded = 0;
	3490	if (!loaded) {
	3491	rom_add_option("pxe-rtl8139.bin");
	3492	loaded = 1;
	3493	}
	3494	}
	3495	return 0;
	3496	}
	3497
	3498	static PCIDeviceInfo rtl8139_info = {
	3499	.qdev.name = "rtl8139",
	3500	.qdev.size = sizeof(RTL8139State),
	3501	.qdev.reset = rtl8139_reset,
	3502	.init = pci_rtl8139_init,
	3503	.exit = pci_rtl8139_uninit,
	3504	.qdev.props = (Property[]) {
	3505	DEFINE_NIC_PROPERTIES(RTL8139State, conf),
	3506	DEFINE_PROP_END_OF_LIST(),
	3507	}
	3508	};
	3509
	3510	static void rtl8139_register_devices(void)
	3511	{
	3512	pci_qdev_register(&rtl8139_info);
	3513	}
	3514
	3515	device_init(rtl8139_register_devices)