DevPCNet.cpp@ 532

Last change on this file since 532 was 512, checked in by vboxsync, 18 years ago
removed test code
Property svn:eol-style set to `native` Property svn:keywords set to `Author Date Id Revision`
File size: 159.2 KB

Line
1	/** @file
2	*
3	* VBox network devices:
4	* AMD PC-Net II (Am79C970A + Am79C973) Ethernet Controller
5	*/
6
7	/*
8	* Copyright (C) 2006 InnoTek Systemberatung GmbH
9	*
10	* This file is part of VirtualBox Open Source Edition (OSE), as
11	* available from http://www.virtualbox.org. This file is free software;
12	* you can redistribute it and/or modify it under the terms of the GNU
13	* General Public License as published by the Free Software Foundation,
14	* in version 2 as it comes in the "COPYING" file of the VirtualBox OSE
15	* distribution. VirtualBox OSE is distributed in the hope that it will
16	* be useful, but WITHOUT ANY WARRANTY of any kind.
17	*
18	* If you received this file as part of a commercial VirtualBox
19	* distribution, then only the terms of your commercial VirtualBox
20	* license agreement apply instead of the previous paragraph.
21	*
22	* --------------------------------------------------------------------
23	*
24	* This code is based on:
25	*
26	* AMD PC-Net II (Am79C970A) emulation
27	*
28	* Copyright (c) 2004 Antony T Curtis
29	*
30	* Permission is hereby granted, free of charge, to any person obtaining a copy
31	* of this software and associated documentation files (the "Software"), to deal
32	* in the Software without restriction, including without limitation the rights
33	* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
34	* copies of the Software, and to permit persons to whom the Software is
35	* furnished to do so, subject to the following conditions:
36	*
37	* The above copyright notice and this permission notice shall be included in
38	* all copies or substantial portions of the Software.
39	*
40	* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
41	* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
42	* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
43	* THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
44	* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
45	* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
46	* THE SOFTWARE.
47	*/
48
49	/* This software was written to be compatible with the specification:
50	* AMD Am79C970A PCnet-PCI II Ethernet Controller Data-Sheet
51	* AMD Publication# 19436 Rev:E Amendment/0 Issue Date: June 2000
52	*/
53
54	/*******************************************************************************
55	* Header Files *
56	*******************************************************************************/
57	#define LOG_GROUP LOG_GROUP_DEV_PCNET
58	#include <VBox/err.h>
59	#include <VBox/log.h>
60	#include <VBox/mm.h>
61	#include <VBox/pdm.h>
62	#include <VBox/pgm.h>
63	#include <VBox/stam.h>
64	#include <iprt/asm.h>
65	#include <iprt/assert.h>
66	#include <iprt/critsect.h>
67	#include <iprt/string.h>
68	#include <iprt/time.h>
69
70	#include "Builtins.h"
71	#include "vl_vbox.h"
72
73	/* Enable this to catch writes to the ring descriptors instead of using excessive polling */
74	/* #define PCNET_NO_POLLING */
75
76	/* Enable to handle frequent io reads in the guest context */
77	#define PCNET_GC_ENABLED
78
79	#ifdef __GNUC__
80	#define PACKED __attribute__ ((packed))
81	#else
82	#define PACKED
83	#endif
84
85	#if 0
86	#define LOG_REGISTER(a) LogRel(a)
87	#else
88	#define LOG_REGISTER(a)
89	#endif
90	#if 0
91	#define LOG_PACKET(name, buf, count) LogPkt(name, buf, count)
92	#define LOG_PACKETS
93	#else
94	#define LOG_PACKET(name, buf, count)
95	#undef LOG_PACKETS
96	#endif
97
98	#if defined(LOG_ENABLED)
99	#define PCNET_DEBUG_IO
100	#define PCNET_DEBUG_BCR
101	#define PCNET_DEBUG_CSR
102	#define PCNET_DEBUG_RMD
103	#define PCNET_DEBUG_TMD
104	#define PCNET_DEBUG_MATCH
105	#define PCNET_DEBUG_MII
106	#endif
107
108	#define PCNET_IOPORT_SIZE 0x20
109	#define PCNET_PNPMMIO_SIZE 0x20
110
111	#define PCNET_SAVEDSTATE_VERSION 5
112
113	#define BCR_MAX_RAP 50
114	#define MII_MAX_REG 32
115	#define CSR_MAX_REG 128
116
117	#define PCNET_TRQUEUE_DEPTH 8
118
119	typedef struct PCNetState_st PCNetState;
120
121	struct PCNetState_st
122	{
123	PCIDEVICE PciDev;
124	#ifndef PCNET_NO_POLLING
125	/** Poll timer (address for host context) */
126	PTMTIMERHC pTimerPollHC;
127	/** Poll timer (address for guest context) */
128	PTMTIMERGC pTimerPollGC;
129	#endif
130	/** Register Address Pointer */
131	uint32_t u32RAP;
132	/** Internal interrupt service */
133	int32_t iISR;
134	/** ??? */
135	uint32_t u32Lnkst;
136	/** Address of the RX descriptor table (ring). Loaded at init. */
137	RTGCPHYS GCRDRA;
138	/** Address of the TX descriptor table (ring). Loaded at init. */
139	RTGCPHYS GCTDRA;
140	uint8_t aPROM[16];
141	uint16_t aCSR[CSR_MAX_REG];
142	uint16_t aBCR[BCR_MAX_RAP];
143	uint16_t aMII[MII_MAX_REG];
144	uint16_t u16CSR0LastSeenByGuest; /** @todo SSM!! */
145	uint16_t Alignment0[HC_ARCH_BITS == 32 ? 2 : 4];
146	/** Last time we polled the queues */
147	uint64_t u64LastPoll;
148
149	/** Array of frames. */
150	struct PCNETFRAME
151	{
152	/** The buffer offset into abFrameBuf */
153	uint32_t off;
154	/** The current frame size. Starts at -1. Only the top frame can be expanded. */
155	int32_t cb;
156	/** The physical address of the frame if it was not copied to abFrameBuf.
157	* Set to NIL_RTR3PTR if frame was copied to abFrameBuf. */
158	RTR3PTR pvR3;
159	} aFrames[PCNET_TRQUEUE_DEPTH];
160	/** The current number of frames in aFrames to transmit. */
161	uint32_t iFrame;
162	/** The xmit buffer. */
163	uint8_t abFrameBuf[12288];
164	/** The recv buffer. */
165	uint8_t abRecvBuf[4096];
166
167	/** Size of a RX/TX descriptor (8 or 16 bytes according to SWSTYLE */
168	int iLog2DescSize;
169	/** Bits 16..23 in 16-bit mode */
170	RTGCPHYS GCUpperPhys;
171
172	/** Transmit signaller */
173	GCPTRTYPE(PPDMQUEUE) pXmitQueueGC;
174	HCPTRTYPE(PPDMQUEUE) pXmitQueueHC;
175
176	/** Receive signaller */
177	HCPTRTYPE(PPDMQUEUE) pCanRxQueueHC;
178	GCPTRTYPE(PPDMQUEUE) pCanRxQueueGC;
179	/** Pointer to the device instance. */
180	GCPTRTYPE(PPDMDEVINS) pDevInsGC;
181	/** Pointer to the device instance. */
182	HCPTRTYPE(PPDMDEVINS) pDevInsHC;
183	/** Restore timer.
184	* This is used to disconnect and reconnect the link after a restore. */
185	PTMTIMERHC pTimerRestore;
186	/** Pointer to the connector of the attached network driver. */
187	HCPTRTYPE(PPDMINETWORKCONNECTOR) pDrv;
188	/** Pointer to the attached network driver. */
189	HCPTRTYPE(PPDMIBASE) pDrvBase;
190	/** The base interface. */
191	PDMIBASE IBase;
192	/** The network port interface. */
193	PDMINETWORKPORT INetworkPort;
194	/** The network config port interface. */
195	PDMINETWORKCONFIG INetworkConfig;
196	/** Base address of the MMIO region. */
197	RTGCPHYS MMIOBase;
198	/** Base port of the I/O space region. */
199	RTIOPORT IOPortBase;
200	/** If set the link is currently up. */
201	bool fLinkUp;
202	/** If set the link is temporarily down because of a saved state load. */
203	bool fLinkTempDown;
204	/** If set we're currently doing pfnSend(), so don't call pcnetTransmit() or
205	* we might recurse for ever. */
206	bool fTransmitting;
207
208	/** Number of times we've reported the link down. */
209	RTUINT cLinkDownReported;
210	/** The configured MAC address. */
211	PDMMAC MacConfigured;
212
213	/** The LED. */
214	PDMLED Led;
215	/** The LED ports. */
216	PDMILEDPORTS ILeds;
217	/** Partner of ILeds. */
218	HCPTRTYPE(PPDMILEDCONNECTORS) pLedsConnector;
219
220	/** Access critical section. */
221	PDMCRITSECT CritSect;
222
223	#ifdef PCNET_NO_POLLING
224	RTGCPHYS TDRAPhysOld;
225	uint32_t cbTDRAOld;
226
227	RTGCPHYS RDRAPhysOld;
228	uint32_t cbRDRAOld;
229
230	DECLGCCALLBACKMEMBER(int, pfnEMInterpretInstructionGC, (PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize));
231	DECLR0CALLBACKMEMBER(int, pfnEMInterpretInstructionR0, (PVM pVM, PCPUMCTXCORE pRegFrame, RTGCPTR pvFault, uint32_t *pcbSize));
232	#endif
233
234	bool fGCEnabled;
235	bool fR0Enabled;
236	bool fAm79C973;
237	bool afAlignment[5];
238
239	#ifdef VBOX_WITH_STATISTICS
240	STAMPROFILEADV StatMMIOReadGC;
241	STAMPROFILEADV StatMMIOReadHC;
242	STAMPROFILEADV StatMMIOWriteGC;
243	STAMPROFILEADV StatMMIOWriteHC;
244	STAMPROFILEADV StatAPROMRead;
245	STAMPROFILEADV StatAPROMWrite;
246	STAMPROFILEADV StatIOReadGC;
247	STAMPROFILEADV StatIOReadHC;
248	STAMPROFILEADV StatIOWriteGC;
249	STAMPROFILEADV StatIOWriteHC;
250	STAMPROFILEADV StatTimer;
251	STAMPROFILEADV StatReceive;
252	STAMPROFILEADV StatTransmitGC;
253	STAMPROFILEADV StatTransmitHC;
254	STAMPROFILE StatXmitQueue;
255	STAMPROFILEADV StatXmitQueueFlushGC;
256	STAMCOUNTER aStatFlushCounts[PCNET_TRQUEUE_DEPTH+1];
257	STAMCOUNTER aStatXmitChainCounts[PCNET_TRQUEUE_DEPTH];
258	STAMPROFILEADV StatInterrupt;
259	STAMPROFILEADV StatPollTimer;
260	STAMCOUNTER StatMIIReads;
261	# ifdef PCNET_NO_POLLING
262	STAMCOUNTER StatRCVRingWrite;
263	STAMCOUNTER StatTXRingWrite;
264	STAMCOUNTER StatRingWriteHC;
265	STAMCOUNTER StatRingWriteR0;
266	STAMCOUNTER StatRingWriteGC;
267
268	STAMCOUNTER StatRingWriteFailedHC;
269	STAMCOUNTER StatRingWriteFailedR0;
270	STAMCOUNTER StatRingWriteFailedGC;
271
272	STAMCOUNTER StatRingWriteOutsideRangeHC;
273	STAMCOUNTER StatRingWriteOutsideRangeR0;
274	STAMCOUNTER StatRingWriteOutsideRangeGC;
275	# endif
276	#endif /* VBOX_WITH_STATISTICS */
277	};
278
279	#define PCNETSTATE_2_DEVINS(pPCNet) ( (pPCNet)->CTXSUFF(pDevIns) )
280	#define PCIDEV_2_PCNETSTATE(pPciDev) ( (PCNetState *)(pPciDev) )
281
282	/* BUS CONFIGURATION REGISTERS */
283	#define BCR_MSRDA 0
284	#define BCR_MSWRA 1
285	#define BCR_MC 2
286	#define BCR_RESERVED3 3
287	#define BCR_LNKST 4
288	#define BCR_LED1 5
289	#define BCR_LED2 6
290	#define BCR_LED3 7
291	#define BCR_RESERVED8 8
292	#define BCR_FDC 9
293	/* 10 - 15 = reserved */
294	#define BCR_IOBASEL 16 /* Reserved */
295	#define BCR_IOBASEU 16 /* Reserved */
296	#define BCR_BSBC 18
297	#define BCR_EECAS 19
298	#define BCR_SWS 20
299	#define BCR_INTCON 21 /* Reserved */
300	#define BCR_PLAT 22
301	#define BCR_PCISID 23
302	#define BCR_PCISVID 24
303	#define BCR_SRAMSIZ 25
304	#define BCR_SRAMB 26
305	#define BCR_SRAMIC 27
306	#define BCR_EBADDRL 28
307	#define BCR_EBADDRU 29
308	#define BCR_EBD 30
309	#define BCR_STVAL 31
310	#define BCR_MIICAS 32
311	#define BCR_MIIADDR 33
312	#define BCR_MIIMDR 34
313	#define BCR_PCIVID 35
314	#define BCR_PMC_A 36
315	#define BCR_DATA0 37
316	#define BCR_DATA1 38
317	#define BCR_DATA2 39
318	#define BCR_DATA3 40
319	#define BCR_DATA4 41
320	#define BCR_DATA5 42
321	#define BCR_DATA6 43
322	#define BCR_DATA7 44
323	#define BCR_PMR1 45
324	#define BCR_PMR2 46
325	#define BCR_PMR3 47
326
327	#define BCR_DWIO(S) !!((S)->aBCR[BCR_BSBC] & 0x0080)
328	#define BCR_SSIZE32(S) !!((S)->aBCR[BCR_SWS ] & 0x0100)
329	#define BCR_SWSTYLE(S) ((S)->aBCR[BCR_SWS ] & 0x00FF)
330
331	#define CSR_INIT(S) !!((S)->aCSR[0] & 0x0001) /*< Init assertion /
332	#define CSR_STRT(S) !!((S)->aCSR[0] & 0x0002) /*< Start assertion /
333	#define CSR_STOP(S) !!((S)->aCSR[0] & 0x0004) /*< Stop assertion /
334	#define CSR_TDMD(S) !!((S)->aCSR[0] & 0x0008) /**< Transmit demand. (perform xmit poll now
335	(readable, settable, not clearable) */
336	#define CSR_TXON(S) !!((S)->aCSR[0] & 0x0010) /*< Transmit on (readonly) /
337	#define CSR_RXON(S) !!((S)->aCSR[0] & 0x0020) /*< Receive On /
338	#define CSR_INEA(S) !!((S)->aCSR[0] & 0x0040) /*< Interrupt Enable /
339	#define CSR_LAPPEN(S) !!((S)->aCSR[3] & 0x0020) /*< Look Ahead Packet Processing Enable /
340	#define CSR_DXSUFLO(S) !!((S)->aCSR[3] & 0x0040) /**< Disable Transmit Stop on
341	Underflow error */
342	#define CSR_ASTRP_RCV(S) !!((S)->aCSR[4] & 0x0400) /*< Auto Strip Receive /
343	#define CSR_DPOLL(S) !!((S)->aCSR[4] & 0x1000) /*< Disable Transmit Polling /
344	#define CSR_SPND(S) !!((S)->aCSR[5] & 0x0001) /*< Suspend /
345	#define CSR_LTINTEN(S) !!((S)->aCSR[5] & 0x4000) /*< Last Transmit Interrupt Enable /
346	#define CSR_TOKINTD(S) !!((S)->aCSR[5] & 0x8000) /*< Transmit OK Interrupt Disable /
347	#define CSR_DRX(S) !!((S)->aCSR[15] & 0x0001) /*< Disable Receiver /
348	#define CSR_DTX(S) !!((S)->aCSR[15] & 0x0002) /*< Disable Transmit /
349	#define CSR_LOOP(S) !!((S)->aCSR[15] & 0x0004) /*< Loopback Enable /
350	#define CSR_DRCVPA(S) !!((S)->aCSR[15] & 0x2000) /*< Disable Receive Physical Address /
351	#define CSR_DRCVBC(S) !!((S)->aCSR[15] & 0x4000) /*< Disable Receive Broadcast /
352	#define CSR_PROM(S) !!((S)->aCSR[15] & 0x8000) /*< Promiscuous Mode /
353
354	#if !defined(__X86__) && !defined(__AMD64__)
355	#error fix macros (and more in this file) for big-endian machines
356	#endif
357
358	#define CSR_IADR(S) ((uint32_t)((S)->aCSR + 1)) /*< Initialization Block Address /
359	#define CSR_CRBA(S) ((uint32_t)((S)->aCSR + 18)) /*< Current Receive Buffer Address /
360	#define CSR_CXBA(S) ((uint32_t)((S)->aCSR + 20)) /*< Current Transmit Buffer Address /
361	#define CSR_NRBA(S) ((uint32_t)((S)->aCSR + 22)) /*< Next Receive Buffer Address /
362	#define CSR_BADR(S) ((uint32_t)((S)->aCSR + 24)) /*< Base Address of Receive Ring /
363	#define CSR_NRDA(S) ((uint32_t)((S)->aCSR + 26)) /*< Next Receive Descriptor Address /
364	#define CSR_CRDA(S) ((uint32_t)((S)->aCSR + 28)) /*< Current Receive Descriptor Address /
365	#define CSR_BADX(S) ((uint32_t)((S)->aCSR + 30)) /*< Base Address of Transmit Descriptor /
366	#define CSR_NXDA(S) ((uint32_t)((S)->aCSR + 32)) /*< Next Transmit Descriptor Address /
367	#define CSR_CXDA(S) ((uint32_t)((S)->aCSR + 34)) /*< Current Transmit Descriptor Address /
368	#define CSR_NNRD(S) ((uint32_t)((S)->aCSR + 36)) /*< Next Next Receive Descriptor Address /
369	#define CSR_NNXD(S) ((uint32_t)((S)->aCSR + 38)) /*< Next Next Transmit Descriptor Address /
370	#define CSR_CRBC(S) ((S)->aCSR[40]) /*< Current Receive Byte Count /
371	#define CSR_CRST(S) ((S)->aCSR[41]) /*< Current Receive Status /
372	#define CSR_CXBC(S) ((S)->aCSR[42]) /*< Current Transmit Byte Count /
373	#define CSR_CXST(S) ((S)->aCSR[43]) /*< Current transmit status /
374	#define CSR_NRBC(S) ((S)->aCSR[44]) /*< Next Receive Byte Count /
375	#define CSR_NRST(S) ((S)->aCSR[45]) /*< Next Receive Status /
376	#define CSR_POLL(S) ((S)->aCSR[46]) /*< Transmit Poll Time Counter /
377	#define CSR_PINT(S) ((S)->aCSR[47]) /*< Transmit Polling Interval /
378	#define CSR_PXDA(S) ((uint32_t)((S)->aCSR + 60)) /*< Previous Transmit Descriptor Address/
379	#define CSR_PXBC(S) ((S)->aCSR[62]) /*< Previous Transmit Byte Count /
380	#define CSR_PXST(S) ((S)->aCSR[63]) /*< Previous Transmit Status /
381	#define CSR_NXBA(S) ((uint32_t)((S)->aCSR + 64)) /*< Next Transmit Buffer Address /
382	#define CSR_NXBC(S) ((S)->aCSR[66]) /*< Next Transmit Byte Count /
383	#define CSR_NXST(S) ((S)->aCSR[67]) /*< Next Transmit Status /
384	#define CSR_RCVRC(S) ((S)->aCSR[72]) /*< Receive Descriptor Ring Counter /
385	#define CSR_XMTRC(S) ((S)->aCSR[74]) /*< Transmit Descriptor Ring Counter /
386	#define CSR_RCVRL(S) ((S)->aCSR[76]) /*< Receive Descriptor Ring Length /
387	#define CSR_XMTRL(S) ((S)->aCSR[78]) /*< Transmit Descriptor Ring Length /
388	#define CSR_MISSC(S) ((S)->aCSR[112]) /*< Missed Frame Count /
389
390	#define PHYSADDR(S,A) ((A) \| (S)->GCUpperPhys)
391
392	/* Version for the PCnet/FAST III 79C973 card */
393	#define CSR_VERSION_LOW_79C973 0x5003 /* the lower two bits must be 11b for AMD */
394	#define CSR_VERSION_LOW_79C970A 0x1003 /* the lower two bits must be 11b for AMD */
395	#define CSR_VERSION_HIGH 0x0262
396
397	/** @todo All structs: big endian? */
398
399	#pragma pack(1) /* bird: MSC paranoia */
400	/** frank: From the gcc manual: ``This attribute, attached to `struct' or `union' type
401	* definition, specifies that each member (other than zero-width bitfields) of
402	* the structure or union is placed to minimize the memory required. ...
403	* Specifying this attribute for `struct' and `union' types is equivalent to
404	* specifying the `packed attribute' on each the structure or union members.''
405	* @todo r=bird: #pragma pack(1) / __attribute__((packed)) isn't necessary here
406	* because of the way the alignment rules work.
407	*/
408	struct PACKED INITBLK16
409	{
410	uint16_t mode; /*< copied into csr15 /
411	uint16_t padr1; /*< MAC 0..15 /
412	uint16_t padr2; /*< MAC 16..32 /
413	uint16_t padr3; /*< MAC 33..47 /
414	uint16_t ladrf1; /*< logical address filter 0..15 /
415	uint16_t ladrf2; /*< logical address filter 16..31 /
416	uint16_t ladrf3; /*< logical address filter 32..47 /
417	uint16_t ladrf4; /*< logical address filter 48..63 /
418	uint32_t rdra:24; /*< address of receive descriptor ring /
419	uint32_t res1:5; /*< reserved /
420	uint32_t rlen:3; /*< number of receive descriptor ring entries /
421	uint32_t tdra:24; /*< address of transmit descriptor ring /
422	uint32_t res2:5; /*< reserved /
423	uint32_t tlen:3; /*< number of transmit descriptor ring entries /
424	};
425	AssertCompileSize(INITBLK16, 24);
426
427	/** bird: I've changed the type for the bitfields. They should only be 16-bit all together.
428	* frank: I've changed the bitfiled types to uint32_t to prevent compiler warnings. */
429	struct PACKED INITBLK32
430	{
431	uint16_t mode; /*< copied into csr15 /
432	uint16_t res1:4; /*< reserved /
433	uint16_t rlen:4; /*< number of receive descriptor ring entries /
434	uint16_t res2:4; /*< reserved /
435	uint16_t tlen:4; /*< number of transmit descriptor ring entries /
436	uint16_t padr1; /*< MAC 0..15 /
437	uint16_t padr2; /*< MAC 16..31 /
438	uint16_t padr3; /*< MAC 32..47 /
439	uint16_t res3; /*< reserved /
440	uint16_t ladrf1; /*< logical address filter 0..15 /
441	uint16_t ladrf2; /*< logical address filter 16..31 /
442	uint16_t ladrf3; /*< logibal address filter 32..47 /
443	uint16_t ladrf4; /*< logical address filter 48..63 /
444	uint32_t rdra; /*< address of receive descriptor ring /
445	uint32_t tdra; /*< address of transmit descriptor ring /
446	};
447	AssertCompileSize(INITBLK32, 28);
448
449	/** Transmit Message Descriptor */
450	typedef struct TMD
451	{
452	struct
453	{
454	uint32_t tbadr; /*< transmit buffer address /
455	} tmd0;
456	struct PACKED
457	{
458	uint32_t bcnt:12; /*< buffer byte count (two's complement) /
459	uint32_t ones:4; /*< must be 1111b /
460	uint32_t res:7; /*< reserved /
461	uint32_t bpe:1; /*< bus parity error /
462	uint32_t enp:1; /*< end of packet /
463	uint32_t stp:1; /*< start of packet /
464	uint32_t def:1; /*< deferred /
465	uint32_t one:1; /*< exactly one retry was needed to transmit a frame /
466	uint32_t ltint:1; /*< suppress interrupts after successful transmission /
467	uint32_t nofcs:1; /**< when set, the state of DXMTFCS is ignored and
468	transmitter FCS generation is activated. */
469	uint32_t err:1; /*< error occured /
470	uint32_t own:1; /*< 0=owned by guest driver, 1=owned by controller /
471	} tmd1;
472	struct PACKED
473	{
474	uint32_t trc:4; /*< transmit retry count /
475	uint32_t res:12; /*< reserved /
476	uint32_t tdr:10; /*< ??? /
477	uint32_t rtry:1; /*< retry error /
478	uint32_t lcar:1; /*< loss of carrier /
479	uint32_t lcol:1; /*< late collision /
480	uint32_t exdef:1; /*< excessive deferral /
481	uint32_t uflo:1; /*< underflow error /
482	uint32_t buff:1; /*< out of buffers (ENP not found) /
483	} tmd2;
484	struct
485	{
486	uint32_t res; /*< reserved for user defined space /
487	} tmd3;
488	} TMD;
489	AssertCompileSize(TMD, 16);
490
491	/** Receive Message Descriptor */
492	typedef struct RMD
493	{
494	struct
495	{
496	uint32_t rbadr; /*< receive buffer address /
497	} rmd0;
498	struct PACKED
499	{
500	uint32_t bcnt:12; /*< buffer byte count (two's complement) /
501	uint32_t ones:4; /*< must be 1111b /
502	uint32_t res:4; /*< reserved /
503	uint32_t bam:1; /*< broadcast address match /
504	uint32_t lafm:1; /*< logical filter address match /
505	uint32_t pam:1; /*< physcial address match /
506	uint32_t bpe:1; /*< bus parity error /
507	uint32_t enp:1; /*< end of packet /
508	uint32_t stp:1; /*< start of packet /
509	uint32_t buff:1; /*< buffer error /
510	uint32_t crc:1; /*< crc error on incoming frame /
511	uint32_t oflo:1; /*< overflow error (lost all or part of incoming frame) /
512	uint32_t fram:1; /*< frame error /
513	uint32_t err:1; /*< error occured /
514	uint32_t own:1; /*< 0=owned by guest driver, 1=owned by controller /
515	} rmd1;
516	struct PACKED
517	{
518	uint32_t mcnt:12; /*< message byte count /
519	uint32_t zeros:4; /*< 0000b /
520	uint32_t rpc:8; /*< receive frame tag /
521	uint32_t rcc:8; /*< receive frame tag + reserved /
522	} rmd2;
523	struct
524	{
525	uint32_t res; /*< reserved for user defined space /
526	} rmd3;
527	} RMD;
528	AssertCompileSize(RMD, 16);
529	#pragma pack()
530
531
532	#ifndef VBOX_DEVICE_STRUCT_TESTCASE
533	/*******************************************************************************
534	* Internal Functions *
535	*******************************************************************************/
536	#define PRINT_TMD(T) Log(( \
537	"TMD0 : TBADR=0x%08x\n" \
538	"TMD1 : OWN=%d, ERR=%d, FCS=%d, LTI=%d, " \
539	"ONE=%d, DEF=%d, STP=%d, ENP=%d,\n" \
540	" BPE=%d, BCNT=%d\n" \
541	"TMD2 : BUF=%d, UFL=%d, EXD=%d, LCO=%d, " \
542	"LCA=%d, RTR=%d,\n" \
543	" TDR=%d, TRC=%d\n", \
544	(T)->tmd0.tbadr, \
545	(T)->tmd1.own, (T)->tmd1.err, (T)->tmd1.nofcs, \
546	(T)->tmd1.ltint, (T)->tmd1.one, (T)->tmd1.def, \
547	(T)->tmd1.stp, (T)->tmd1.enp, (T)->tmd1.bpe, \
548	4096-(T)->tmd1.bcnt, \
549	(T)->tmd2.buff, (T)->tmd2.uflo, (T)->tmd2.exdef,\
550	(T)->tmd2.lcol, (T)->tmd2.lcar, (T)->tmd2.rtry, \
551	(T)->tmd2.tdr, (T)->tmd2.trc))
552
553	#define PRINT_RMD(R) Log(( \
554	"RMD0 : RBADR=0x%08x\n" \
555	"RMD1 : OWN=%d, ERR=%d, FRAM=%d, OFLO=%d, " \
556	"CRC=%d, BUFF=%d, STP=%d, ENP=%d,\n " \
557	"BPE=%d, PAM=%d, LAFM=%d, BAM=%d, ONES=%d, BCNT=%d\n" \
558	"RMD2 : RCC=%d, RPC=%d, MCNT=%d, ZEROS=%d\n", \
559	(R)->rmd0.rbadr, \
560	(R)->rmd1.own, (R)->rmd1.err, (R)->rmd1.fram, \
561	(R)->rmd1.oflo, (R)->rmd1.crc, (R)->rmd1.buff, \
562	(R)->rmd1.stp, (R)->rmd1.enp, (R)->rmd1.bpe, \
563	(R)->rmd1.pam, (R)->rmd1.lafm, (R)->rmd1.bam, \
564	(R)->rmd1.ones, 4096-(R)->rmd1.bcnt, \
565	(R)->rmd2.rcc, (R)->rmd2.rpc, (R)->rmd2.mcnt, \
566	(R)->rmd2.zeros))
567
568	/**
569	* Load transmit message descriptor
570	*/
571	DECLINLINE(void) pcnetTmdLoad(PCNetState pData, TMD tmd, RTGCPHYS addr)
572	{
573	PPDMDEVINS pDevIns = PCNETSTATE_2_DEVINS(pData);
574	if (!BCR_SWSTYLE(pData))
575	{
576	uint16_t xda[4];
577	PDMDevHlpPhysRead(pDevIns, addr, (void*)&xda[0], sizeof(xda));
578	((uint32_t *)tmd)[0] = (uint32_t)xda[0] \| ((uint32_t)(xda[1] & 0x00ff) << 16);
579	((uint32_t *)tmd)[1] = (uint32_t)xda[2] \| ((uint32_t)(xda[1] & 0xff00) << 16);
580	((uint32_t *)tmd)[2] = (uint32_t)xda[3] << 16;
581	((uint32_t *)tmd)[3] = 0;
582	}
583	else if (BCR_SWSTYLE(pData) != 3)
584	PDMDevHlpPhysRead(pDevIns, addr, (void*)tmd, 16);
585	else
586	{
587	uint32_t xda[4];
588	PDMDevHlpPhysRead(pDevIns, addr, (void*)&xda[0], sizeof(xda));
589	((uint32_t *)tmd)[0] = xda[2];
590	((uint32_t *)tmd)[1] = xda[1];
591	((uint32_t *)tmd)[2] = xda[0];
592	((uint32_t *)tmd)[3] = xda[3];
593	}
594	}
595
596	/**
597	* Store transmit message descriptor and hand it over to the host (the VM guest).
598	* Make sure that all data are transmitted before we clear the own flag.
599	*/
600	DECLINLINE(void) pcnetTmdStorePassHost(PCNetState pData, TMD tmd, RTGCPHYS addr)
601	{
602	PPDMDEVINS pDevIns = PCNETSTATE_2_DEVINS(pData);
603	if (!BCR_SWSTYLE(pData))
604	{
605	uint16_t xda[4];
606	xda[0] = ((uint32_t *)tmd)[0] & 0xffff;
607	xda[1] = ((((uint32_t )tmd)[0] >> 16) & 0xff) \| ((((uint32_t )tmd)[1]>>16) & 0xff00);
608	xda[2] = ((uint32_t *)tmd)[1] & 0xffff;
609	xda[3] = ((uint32_t *)tmd)[2] >> 16;
610	xda[1] \|= 0x8000;
611	PDMDevHlpPhysWrite(pDevIns, addr, (void*)&xda[0], sizeof(xda));
612	xda[1] &= ~0x8000;
613	PDMDevHlpPhysWrite(pDevIns, addr+3, (uint8_t*)xda + 3, 1);
614	}
615	else if (BCR_SWSTYLE(pData) != 3)
616	{
617	((uint32_t*)tmd)[1] \|= 0x80000000;
618	PDMDevHlpPhysWrite(pDevIns, addr, (void*)tmd, 16);
619	((uint32_t*)tmd)[1] &= ~0x80000000;
620	PDMDevHlpPhysWrite(pDevIns, addr+7, (uint8_t*)tmd + 7, 1);
621	}
622	else
623	{
624	uint32_t xda[4];
625	xda[0] = ((uint32_t *)tmd)[2];
626	xda[1] = ((uint32_t *)tmd)[1];
627	xda[2] = ((uint32_t *)tmd)[0];
628	xda[3] = ((uint32_t *)tmd)[3];
629	xda[1] \|= 0x80000000;
630	PDMDevHlpPhysWrite(pDevIns, addr, (void*)&xda[0], sizeof(xda));
631	xda[1] &= ~0x80000000;
632	PDMDevHlpPhysWrite(pDevIns, addr+7, (uint8_t*)xda + 7, 1);
633	}
634	}
635
636	/**
637	* Load receive message descriptor
638	*/
639	DECLINLINE(void) pcnetRmdLoad(PCNetState pData, RMD rmd, RTGCPHYS addr)
640	{
641	PPDMDEVINS pDevIns = PCNETSTATE_2_DEVINS(pData);
642	if (!BCR_SWSTYLE(pData))
643	{
644	uint16_t rda[4];
645	PDMDevHlpPhysRead(pDevIns, addr, (void*)&rda[0], sizeof(rda));
646	((uint32_t *)rmd)[0] = (uint32_t)rda[0] \| ((rda[1] & 0x00ff) << 16);
647	((uint32_t *)rmd)[1] = (uint32_t)rda[2] \| ((rda[1] & 0xff00) << 16);
648	((uint32_t *)rmd)[2] = (uint32_t)rda[3];
649	((uint32_t *)rmd)[3] = 0;
650	}
651	else if (BCR_SWSTYLE(pData) != 3)
652	PDMDevHlpPhysRead(pDevIns, addr, (void*)rmd, 16);
653	else
654	{
655	uint32_t rda[4];
656	PDMDevHlpPhysRead(pDevIns, addr, (void*)&rda[0], sizeof(rda));
657	((uint32_t *)rmd)[0] = rda[2];
658	((uint32_t *)rmd)[1] = rda[1];
659	((uint32_t *)rmd)[2] = rda[0];
660	((uint32_t *)rmd)[3] = rda[3];
661	}
662	}
663
664	/**
665	* Store receive message descriptor and hand it over to the host (the VM guest).
666	* Make sure that all data are transmitted before we clear the own flag.
667	*/
668	DECLINLINE(void) pcnetRmdStorePassHost(PCNetState pData, RMD rmd, RTGCPHYS addr)
669	{
670	PPDMDEVINS pDevIns = PCNETSTATE_2_DEVINS(pData);
671	if (!BCR_SWSTYLE(pData))
672	{
673	uint16_t rda[4];
674	rda[0] = ((uint32_t *)rmd)[0] & 0xffff;
675	rda[1] = ((((uint32_t )rmd)[0]>>16) & 0xff) \| ((((uint32_t )rmd)[1]>>16) & 0xff00);
676	rda[2] = ((uint32_t *)rmd)[1] & 0xffff;
677	rda[3] = ((uint32_t *)rmd)[2] & 0xffff;
678	rda[1] \|= 0x8000;
679	PDMDevHlpPhysWrite(pDevIns, addr, (void*)&rda[0], sizeof(rda));
680	rda[1] &= ~0x8000;
681	PDMDevHlpPhysWrite(pDevIns, addr+3, (uint8_t*)rda + 3, 1);
682	}
683	else if (BCR_SWSTYLE(pData) != 3)
684	{
685	((uint32_t*)rmd)[1] \|= 0x80000000;
686	PDMDevHlpPhysWrite(pDevIns, addr, (void*)rmd, 16);
687	((uint32_t*)rmd)[1] &= ~0x80000000;
688	PDMDevHlpPhysWrite(pDevIns, addr+7, (uint8_t*)rmd + 7, 1);
689	}
690	else
691	{
692	uint32_t rda[4];
693	rda[0] = ((uint32_t *)rmd)[2];
694	rda[1] = ((uint32_t *)rmd)[1];
695	rda[2] = ((uint32_t *)rmd)[0];
696	rda[3] = ((uint32_t *)rmd)[3];
697	rda[1] \|= 0x80000000;
698	PDMDevHlpPhysWrite(pDevIns, addr, (void*)&rda[0], sizeof(rda));
699	rda[1] &= ~0x80000000;
700	PDMDevHlpPhysWrite(pDevIns, addr+7, (uint8_t*)rda + 7, 1);
701	}
702	}
703
704	/** Checks if it's a bad (as in invalid) RMD.*/
705	#define IS_RMD_BAD(rmd) ((rmd).rmd1.ones != 15 \|\| (rmd).rmd2.zeros != 0)
706
707	/** The network card is the owner of the RDTE/TDTE, actually it is this driver */
708	#define CARD_IS_OWNER(desc) (((desc) & 0x8000))
709
710	/** The host is the owner of the RDTE/TDTE -- actually the VM guest. */
711	#define HOST_IS_OWNER(desc) (!((desc) & 0x8000))
712
713	#ifndef ETHER_IS_MULTICAST /* Net/Open BSD macro it seems */
714	#define ETHER_IS_MULTICAST(a) (((uint8_t )(a)) & 1)
715	#endif
716
717	#define ETHER_ADDR_LEN ETH_ALEN
718	#define ETH_ALEN 6
719	#pragma pack(1)
720	struct ether_header
721	{
722	uint8_t ether_dhost[ETH_ALEN]; /*< destination ethernet address /
723	uint8_t ether_shost[ETH_ALEN]; /*< source ethernet address /
724	uint16_t ether_type; /*< packet type ID field /
725	};
726	#pragma pack()
727
728	#ifdef LOG_PACKETS
729	static void LogPkt(const char name, const void const src, int count)
730	{
731	int i, j;
732	const uint8_t * const p = (const uint8_t * const)src;
733	LogRel(("%s: ", name));
734	i = 14; // length of MAC header
735	i += 4*(p[i] & 15); // length of IP header
736	i += 4*(p[i+12] >> 4); // length of TCP header
737	for (j=i; j<70 && j<count; j++)
738	LogRel((" %02x", p[j]));
739	LogRel((" ("));
740	for (j=i; j<70 && j<count; j++)
741	LogRel(("%c", p[j] >= 32 && p[j] < 127 ? p[j] : '.'));
742	LogRel((")\n"));
743	}
744	#endif
745
746	#define PRINT_PKTHDR(BUF) do { \
747	struct ether_header hdr = (struct ether_header )(BUF); \
748	Log(("packet dhost=%02x:%02x:%02x:%02x:%02x:%02x, " \
749	"shost=%02x:%02x:%02x:%02x:%02x:%02x, " \
750	"type=0x%04x (bcast=%d)\n", \
751	hdr->ether_dhost[0],hdr->ether_dhost[1],hdr->ether_dhost[2], \
752	hdr->ether_dhost[3],hdr->ether_dhost[4],hdr->ether_dhost[5], \
753	hdr->ether_shost[0],hdr->ether_shost[1],hdr->ether_shost[2], \
754	hdr->ether_shost[3],hdr->ether_shost[4],hdr->ether_shost[5], \
755	htons(hdr->ether_type), \
756	!!ETHER_IS_MULTICAST(hdr->ether_dhost))); \
757	} while (0)
758
759	#define MULTICAST_FILTER_LEN 8
760
761	DECLINLINE(uint32_t) lnc_mchash(const uint8_t *ether_addr)
762	{
763	#define LNC_POLYNOMIAL 0xEDB88320UL
764	uint32_t crc = 0xFFFFFFFF;
765	int idx, bit;
766	uint8_t data;
767
768	for (idx = 0; idx < ETHER_ADDR_LEN; idx++)
769	{
770	for (data = *ether_addr++, bit = 0; bit < MULTICAST_FILTER_LEN; bit++)
771	{
772	crc = (crc >> 1) ^ (((crc ^ data) & 1) ? LNC_POLYNOMIAL : 0);
773	data >>= 1;
774	}
775	}
776	return crc;
777	#undef LNC_POLYNOMIAL
778	}
779
780	#define CRC(crc, ch) (crc = (crc >> 8) ^ crctab[(crc ^ (ch)) & 0xff])
781
782	/* generated using the AUTODIN II polynomial
783	* x^32 + x^26 + x^23 + x^22 + x^16 +
784	* x^12 + x^11 + x^10 + x^8 + x^7 + x^5 + x^4 + x^2 + x^1 + 1
785	*/
786	static const uint32_t crctab[256] =
787	{
788	0x00000000, 0x77073096, 0xee0e612c, 0x990951ba,
789	0x076dc419, 0x706af48f, 0xe963a535, 0x9e6495a3,
790	0x0edb8832, 0x79dcb8a4, 0xe0d5e91e, 0x97d2d988,
791	0x09b64c2b, 0x7eb17cbd, 0xe7b82d07, 0x90bf1d91,
792	0x1db71064, 0x6ab020f2, 0xf3b97148, 0x84be41de,
793	0x1adad47d, 0x6ddde4eb, 0xf4d4b551, 0x83d385c7,
794	0x136c9856, 0x646ba8c0, 0xfd62f97a, 0x8a65c9ec,
795	0x14015c4f, 0x63066cd9, 0xfa0f3d63, 0x8d080df5,
796	0x3b6e20c8, 0x4c69105e, 0xd56041e4, 0xa2677172,
797	0x3c03e4d1, 0x4b04d447, 0xd20d85fd, 0xa50ab56b,
798	0x35b5a8fa, 0x42b2986c, 0xdbbbc9d6, 0xacbcf940,
799	0x32d86ce3, 0x45df5c75, 0xdcd60dcf, 0xabd13d59,
800	0x26d930ac, 0x51de003a, 0xc8d75180, 0xbfd06116,
801	0x21b4f4b5, 0x56b3c423, 0xcfba9599, 0xb8bda50f,
802	0x2802b89e, 0x5f058808, 0xc60cd9b2, 0xb10be924,
803	0x2f6f7c87, 0x58684c11, 0xc1611dab, 0xb6662d3d,
804	0x76dc4190, 0x01db7106, 0x98d220bc, 0xefd5102a,
805	0x71b18589, 0x06b6b51f, 0x9fbfe4a5, 0xe8b8d433,
806	0x7807c9a2, 0x0f00f934, 0x9609a88e, 0xe10e9818,
807	0x7f6a0dbb, 0x086d3d2d, 0x91646c97, 0xe6635c01,
808	0x6b6b51f4, 0x1c6c6162, 0x856530d8, 0xf262004e,
809	0x6c0695ed, 0x1b01a57b, 0x8208f4c1, 0xf50fc457,
810	0x65b0d9c6, 0x12b7e950, 0x8bbeb8ea, 0xfcb9887c,
811	0x62dd1ddf, 0x15da2d49, 0x8cd37cf3, 0xfbd44c65,
812	0x4db26158, 0x3ab551ce, 0xa3bc0074, 0xd4bb30e2,
813	0x4adfa541, 0x3dd895d7, 0xa4d1c46d, 0xd3d6f4fb,
814	0x4369e96a, 0x346ed9fc, 0xad678846, 0xda60b8d0,
815	0x44042d73, 0x33031de5, 0xaa0a4c5f, 0xdd0d7cc9,
816	0x5005713c, 0x270241aa, 0xbe0b1010, 0xc90c2086,
817	0x5768b525, 0x206f85b3, 0xb966d409, 0xce61e49f,
818	0x5edef90e, 0x29d9c998, 0xb0d09822, 0xc7d7a8b4,
819	0x59b33d17, 0x2eb40d81, 0xb7bd5c3b, 0xc0ba6cad,
820	0xedb88320, 0x9abfb3b6, 0x03b6e20c, 0x74b1d29a,
821	0xead54739, 0x9dd277af, 0x04db2615, 0x73dc1683,
822	0xe3630b12, 0x94643b84, 0x0d6d6a3e, 0x7a6a5aa8,
823	0xe40ecf0b, 0x9309ff9d, 0x0a00ae27, 0x7d079eb1,
824	0xf00f9344, 0x8708a3d2, 0x1e01f268, 0x6906c2fe,
825	0xf762575d, 0x806567cb, 0x196c3671, 0x6e6b06e7,
826	0xfed41b76, 0x89d32be0, 0x10da7a5a, 0x67dd4acc,
827	0xf9b9df6f, 0x8ebeeff9, 0x17b7be43, 0x60b08ed5,
828	0xd6d6a3e8, 0xa1d1937e, 0x38d8c2c4, 0x4fdff252,
829	0xd1bb67f1, 0xa6bc5767, 0x3fb506dd, 0x48b2364b,
830	0xd80d2bda, 0xaf0a1b4c, 0x36034af6, 0x41047a60,
831	0xdf60efc3, 0xa867df55, 0x316e8eef, 0x4669be79,
832	0xcb61b38c, 0xbc66831a, 0x256fd2a0, 0x5268e236,
833	0xcc0c7795, 0xbb0b4703, 0x220216b9, 0x5505262f,
834	0xc5ba3bbe, 0xb2bd0b28, 0x2bb45a92, 0x5cb36a04,
835	0xc2d7ffa7, 0xb5d0cf31, 0x2cd99e8b, 0x5bdeae1d,
836	0x9b64c2b0, 0xec63f226, 0x756aa39c, 0x026d930a,
837	0x9c0906a9, 0xeb0e363f, 0x72076785, 0x05005713,
838	0x95bf4a82, 0xe2b87a14, 0x7bb12bae, 0x0cb61b38,
839	0x92d28e9b, 0xe5d5be0d, 0x7cdcefb7, 0x0bdbdf21,
840	0x86d3d2d4, 0xf1d4e242, 0x68ddb3f8, 0x1fda836e,
841	0x81be16cd, 0xf6b9265b, 0x6fb077e1, 0x18b74777,
842	0x88085ae6, 0xff0f6a70, 0x66063bca, 0x11010b5c,
843	0x8f659eff, 0xf862ae69, 0x616bffd3, 0x166ccf45,
844	0xa00ae278, 0xd70dd2ee, 0x4e048354, 0x3903b3c2,
845	0xa7672661, 0xd06016f7, 0x4969474d, 0x3e6e77db,
846	0xaed16a4a, 0xd9d65adc, 0x40df0b66, 0x37d83bf0,
847	0xa9bcae53, 0xdebb9ec5, 0x47b2cf7f, 0x30b5ffe9,
848	0xbdbdf21c, 0xcabac28a, 0x53b39330, 0x24b4a3a6,
849	0xbad03605, 0xcdd70693, 0x54de5729, 0x23d967bf,
850	0xb3667a2e, 0xc4614ab8, 0x5d681b02, 0x2a6f2b94,
851	0xb40bbe37, 0xc30c8ea1, 0x5a05df1b, 0x2d02ef8d,
852	};
853
854	DECLINLINE(int) padr_match(PCNetState pData, const uint8_t buf, int size)
855	{
856	struct ether_header hdr = (struct ether_header )buf;
857	int result;
858	#if (defined(__X86__) \|\| defined(__AMD64__)) && !defined(PCNET_DEBUG_MATCH)
859	result = !CSR_DRCVPA(pData) && !memcmp(hdr->ether_dhost, pData->aCSR + 12, 6);
860	#else
861	uint8_t padr[6];
862	padr[0] = pData->aCSR[12] & 0xff;
863	padr[1] = pData->aCSR[12] >> 8;
864	padr[2] = pData->aCSR[13] & 0xff;
865	padr[3] = pData->aCSR[13] >> 8;
866	padr[4] = pData->aCSR[14] & 0xff;
867	padr[5] = pData->aCSR[14] >> 8;
868	result = !CSR_DRCVPA(pData) && !memcmp(hdr->ether_dhost, padr, 6);
869	#endif
870
871	#ifdef PCNET_DEBUG_MATCH
872	Log(("#%d packet dhost=%02x:%02x:%02x:%02x:%02x:%02x, "
873	"padr=%02x:%02x:%02x:%02x:%02x:%02x\n",
874	PCNETSTATE_2_DEVINS(pData)->iInstance,
875	hdr->ether_dhost[0],hdr->ether_dhost[1],hdr->ether_dhost[2],
876	hdr->ether_dhost[3],hdr->ether_dhost[4],hdr->ether_dhost[5],
877	padr[0],padr[1],padr[2],padr[3],padr[4],padr[5]));
878	Log(("padr_match result=%d\n", result));
879	#endif
880	return result;
881	}
882
883	DECLINLINE(int) padr_bcast(PCNetState pData, const uint8_t buf, int size)
884	{
885	static uint8_t aBCAST[6] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
886	struct ether_header hdr = (struct ether_header )buf;
887	int result = !CSR_DRCVBC(pData) && !memcmp(hdr->ether_dhost, aBCAST, 6);
888	#ifdef PCNET_DEBUG_MATCH
889	Log(("#%d padr_bcast result=%d\n", PCNETSTATE_2_DEVINS(pData)->iInstance, result));
890	#endif
891	return result;
892	}
893
894	static int ladr_match(PCNetState pData, const uint8_t buf, int size)
895	{
896	struct ether_header hdr = (struct ether_header )buf;
897	if (RT_UNLIKELY(hdr->ether_dhost[0] & 0x01) && ((uint64_t *)&pData->aCSR[8])[0] != 0LL)
898	{
899	int index;
900	#if defined(__X86__) \|\| defined(__AMD64__)
901	index = lnc_mchash(hdr->ether_dhost) >> 26;
902	return ((uint8_t*)(pData->aCSR + 8))[index >> 3] & (1 << (index & 7));
903	#else
904	uint8_t ladr[8];
905	ladr[0] = pData->aCSR[8] & 0xff;
906	ladr[1] = pData->aCSR[8] >> 8;
907	ladr[2] = pData->aCSR[9] & 0xff;
908	ladr[3] = pData->aCSR[9] >> 8;
909	ladr[4] = pData->aCSR[10] & 0xff;
910	ladr[5] = pData->aCSR[10] >> 8;
911	ladr[6] = pData->aCSR[11] & 0xff;
912	ladr[7] = pData->aCSR[11] >> 8;
913	index = lnc_mchash(hdr->ether_dhost) >> 26;
914	return (ladr[index >> 3] & (1 << (index & 7)));
915	#endif
916	}
917	return 0;
918	}
919
920	/**
921	* Get the receive descriptor ring address with a given index.
922	*/
923	DECLINLINE(RTGCPHYS) pcnetRdraAddr(PCNetState *pData, int idx)
924	{
925	return pData->GCRDRA + ((CSR_RCVRL(pData) - idx) << pData->iLog2DescSize);
926	}
927
928	/**
929	* Get the transmit descriptor ring address with a given index.
930	*/
931	DECLINLINE(RTGCPHYS) pcnetTdraAddr(PCNetState *pData, int idx)
932	{
933	return pData->GCTDRA + ((CSR_XMTRL(pData) - idx) << pData->iLog2DescSize);
934	}
935
936	__BEGIN_DECLS
937	PDMBOTHCBDECL(int) pcnetIOPortRead(PPDMDEVINS pDevIns, void *pvUser,
938	RTIOPORT Port, uint32_t *pu32, unsigned cb);
939	PDMBOTHCBDECL(int) pcnetIOPortWrite(PPDMDEVINS pDevIns, void *pvUser,
940	RTIOPORT Port, uint32_t u32, unsigned cb);
941	PDMBOTHCBDECL(int) pcnetIOPortAPromWrite(PPDMDEVINS pDevIns, void *pvUser,
942	RTIOPORT Port, uint32_t u32, unsigned cb);
943	PDMBOTHCBDECL(int) pcnetIOPortAPromRead(PPDMDEVINS pDevIns, void *pvUser,
944	RTIOPORT Port, uint32_t *pu32, unsigned cb);
945	PDMBOTHCBDECL(int) pcnetMMIORead(PPDMDEVINS pDevIns, void *pvUser,
946	RTGCPHYS GCPhysAddr, void *pv, unsigned cb);
947	PDMBOTHCBDECL(int) pcnetMMIOWrite(PPDMDEVINS pDevIns, void *pvUser,
948	RTGCPHYS GCPhysAddr, void *pv, unsigned cb);
949	#ifndef IN_RING3
950	DECLEXPORT(int) pcnetHandleRingWrite(PVM pVM, RTGCUINT uErrorCode, PCPUMCTXCORE pRegFrame,
951	RTGCPTR pvFault, RTGCPHYS GCPhysFault, void *pvUser);
952	#endif
953	__END_DECLS
954
955	#undef htonl
956	#define htonl(x) ASMByteSwapU32(x)
957	#undef htons
958	#define htons(x) ( (((x) & 0xff00) >> 8) \| (((x) & 0x00ff) << 8) )
959
960	static void pcnetPollRxTx(PCNetState *pData);
961	static void pcnetPollTimer(PCNetState *pData);
962	static void pcnetUpdateIrq(PCNetState *pData);
963	static uint32_t pcnetBCRReadU16(PCNetState *pData, uint32_t u32RAP);
964	static int pcnetBCRWriteU16(PCNetState *pData, uint32_t u32RAP, uint32_t val);
965
966
967	#ifdef PCNET_NO_POLLING
968	# ifndef IN_RING3
969
970	/**
971	* #PF Virtual Handler callback for Guest write access to the ring descriptor page(pData)
972	*
973	* @return VBox status code (appropritate for trap handling and GC return).
974	* @param pVM VM Handle.
975	* @param uErrorCode CPU Error code.
976	* @param pRegFrame Trap register frame.
977	* @param pvFault The fault address (cr2).
978	* @param GCPhysFault The GC physical address corresponding to pvFault.
979	* @param pvUser User argument.
980	*/
981	DECLEXPORT(int) pcnetHandleRingWrite(PVM pVM, RTGCUINT uErrorCode, PCPUMCTXCORE pRegFrame,
982	RTGCPTR pvFault, RTGCPHYS GCPhysFault, void *pvUser)
983	{
984	PCNetState pData = (PCNetState )pvUser;
985
986	Log(("#%d pcnetHandleRingWriteGC: write to %08x\n", PCNETSTATE_2_DEVINS(pData)->iInstance, GCPhysFault));
987
988	uint32_t cb;
989	int rc = CTXALLSUFF(pData->pfnEMInterpretInstruction)(pVM, pRegFrame, pvFault, &cb);
990	if (VBOX_SUCCESS(rc) && cb)
991	{
992	if ( (GCPhysFault >= pData->GCTDRA && GCPhysFault + cb < pcnetTdraAddr(pData, 0))
993	#ifdef PCNET_MONITOR_RECEIVE_RING
994	\|\| (GCPhysFault >= pData->GCRDRA && GCPhysFault + cb < pcnetRdraAddr(pData, 0))
995	#endif
996	)
997	{
998	uint32_t offsetTDRA = (GCPhysFault - pData->GCTDRA);
999
1000	int rc = PDMCritSectEnter(&pData->CritSect, VERR_SEM_BUSY);
1001	if (VBOX_SUCCESS(rc))
1002	{
1003	STAM_COUNTER_INC(&CTXALLSUFF(pData->StatRingWrite)); ;
1004
1005	/* Check if we can do something now */
1006	pcnetPollRxTx(pData);
1007	pcnetUpdateIrq(pData);
1008
1009	PDMCritSectLeave(&pData->CritSect);
1010	return VINF_SUCCESS;
1011	}
1012	}
1013	else
1014	{
1015	STAM_COUNTER_INC(&CTXALLSUFF(pData->StatRingWriteOutsideRange)); ;
1016	return VINF_SUCCESS; /* outside of the ring range */
1017	}
1018	}
1019	STAM_COUNTER_INC(&CTXALLSUFF(pData->StatRingWriteFailed)); ;
1020	return VINF_IOM_HC_MMIO_WRITE; /* handle in ring3 */
1021	}
1022
1023	# else /* IN_RING3 */
1024
1025	/**
1026	* #PF Handler callback for physical access handler ranges (MMIO among others) in HC.
1027	*
1028	* The handler can not raise any faults, it's mainly for monitoring write access
1029	* to certain pages.
1030	*
1031	* @returns VINF_SUCCESS if the handler have carried out the operation.
1032	* @returns VINF_PGM_HANDLER_DO_DEFAULT if the caller should carry out the access operation.
1033	* @param pVM VM Handle.
1034	* @param GCPhys The physical address the guest is writing to.
1035	* @param pvPhys The HC mapping of that address.
1036	* @param pvBuf What the guest is reading/writing.
1037	* @param cbBuf How much it's reading/writing.
1038	* @param enmAccessType The access type.
1039	* @param pvUser User argument.
1040	*/
1041	static DECLCALLBACK(int) pcnetHandleRingWrite(PVM pVM, RTGCPHYS GCPhys, void pvPhys, void pvBuf,
1042	size_t cbBuf, PGMACCESSTYPE enmAccessType, void *pvUser)
1043	{
1044	PPDMDEVINS pDevIns = (PPDMDEVINS)pvUser;
1045	PCNetState pData = PDMINS2DATA(pDevIns, PCNetState );
1046
1047	Log(("#%d pcnetHandleRingWrite: write to %08x\n", PCNETSTATE_2_DEVINS(pData)->iInstance, GCPhys));
1048	#ifdef VBOX_WITH_STATISTICS
1049	STAM_COUNTER_INC(&CTXSUFF(pData->StatRingWrite));
1050	if (GCPhys >= pData->GCRDRA && GCPhys < pcnetRdraAddr(pData, 0))
1051	STAM_COUNTER_INC(&pData->StatRCVRingWrite);
1052	else if (GCPhys >= pData->GCTDRA && GCPhys < pcnetTdraAddr(pData, 0))
1053	STAM_COUNTER_INC(&pData->StatTXRingWrite);
1054	#endif
1055	/* Perform the actual write */
1056	memcpy((char *)pvPhys, pvBuf, cbBuf);
1057
1058	/* Writes done by our code don't require polling of course */
1059	if (PDMCritSectIsOwner(&pData->CritSect) == false)
1060	{
1061	if ( (GCPhys >= pData->GCTDRA && GCPhys + cbBuf < pcnetTdraAddr(pData, 0))
1062	#ifdef PCNET_MONITOR_RECEIVE_RING
1063	\|\| (GCPhys >= pData->GCRDRA && GCPhys + cbBuf < pcnetRdraAddr(pData, 0))
1064	#endif
1065	)
1066	{
1067	int rc = PDMCritSectEnter(&pData->CritSect, VERR_SEM_BUSY);
1068	AssertReleaseRC(rc);
1069	/* Check if we can do something now */
1070	pcnetPollRxTx(pData);
1071	pcnetUpdateIrq(pData);
1072	PDMCritSectLeave(&pData->CritSect);
1073	}
1074	}
1075	return VINF_SUCCESS;
1076	}
1077	# endif /* !IN_RING3 */
1078	#endif /* PCNET_NO_POLLING */
1079
1080	static void pcnetSoftReset(PCNetState *pData)
1081	{
1082	Log(("#%d pcnetSoftReset:\n", PCNETSTATE_2_DEVINS(pData)->iInstance));
1083
1084	pData->u32Lnkst = 0x40;
1085	pData->GCRDRA = 0;
1086	pData->GCTDRA = 0;
1087	pData->u32RAP = 0;
1088
1089	pData->aBCR[BCR_BSBC] &= ~0x0080;
1090
1091	pData->aCSR[0] = 0x0004;
1092	pData->aCSR[3] = 0x0000;
1093	pData->aCSR[4] = 0x0115;
1094	pData->aCSR[5] = 0x0000;
1095	pData->aCSR[6] = 0x0000;
1096	pData->aCSR[8] = 0;
1097	pData->aCSR[9] = 0;
1098	pData->aCSR[10] = 0;
1099	pData->aCSR[11] = 0;
1100	pData->aCSR[12] = le16_to_cpu(((uint16_t *)&pData->aPROM[0])[0]);
1101	pData->aCSR[13] = le16_to_cpu(((uint16_t *)&pData->aPROM[0])[1]);
1102	pData->aCSR[14] = le16_to_cpu(((uint16_t *)&pData->aPROM[0])[2]);
1103	pData->aCSR[15] &= 0x21c4;
1104	CSR_RCVRC(pData) = 1;
1105	CSR_XMTRC(pData) = 1;
1106	CSR_RCVRL(pData) = 1;
1107	CSR_XMTRL(pData) = 1;
1108	pData->aCSR[80] = 0x1410;
1109	pData->aCSR[88] = pData->fAm79C973 ? CSR_VERSION_LOW_79C973 : CSR_VERSION_LOW_79C970A;
1110	pData->aCSR[89] = CSR_VERSION_HIGH;
1111	pData->aCSR[94] = 0x0000;
1112	pData->aCSR[100] = 0x0200;
1113	pData->aCSR[103] = 0x0105;
1114	pData->aCSR[103] = 0x0105;
1115	CSR_MISSC(pData) = 0;
1116	pData->aCSR[114] = 0x0000;
1117	pData->aCSR[122] = 0x0000;
1118	pData->aCSR[124] = 0x0000;
1119	}
1120
1121	/**
1122	* Check if we have to send an interrupt to the guest. An interrupt can occur on
1123	* - csr0 (written quite often)
1124	* - csr4 (only written by pcnetSoftReset(), pcnetStop() or by the guest driver)
1125	* - csr5 (only written by pcnetSoftReset(), pcnetStop or by the driver guest)
1126	*/
1127	static void pcnetUpdateIrq(PCNetState *pData)
1128	{
1129	register int iISR = 0;
1130	register uint16_t csr0 = pData->aCSR[0];
1131
1132	csr0 &= ~0x0080; /* clear INTR */
1133
1134	STAM_PROFILE_ADV_START(&pData->StatInterrupt, a);
1135
1136	/* Linux guests set csr4=0x0915
1137	* W2k guests set csr3=0x4940 (disable BABL, MERR, IDON, DXSUFLO */
1138
1139	#if 1
1140	if ( ( (csr0 & ~pData->aCSR[3]) & 0x5f00)
1141	\|\| (((pData->aCSR[4]>>1) & ~pData->aCSR[4]) & 0x0115)
1142	\|\| (((pData->aCSR[5]>>1) & pData->aCSR[5]) & 0x0048))
1143	#else
1144	if ( ( !(pData->aCSR[3] & 0x4000) && !!(csr0 & 0x4000)) /* BABL */
1145	\|\|( !(pData->aCSR[3] & 0x1000) && !!(csr0 & 0x1000)) /* MISS */
1146	\|\|( !(pData->aCSR[3] & 0x0100) && !!(csr0 & 0x0100)) /* IDON */
1147	\|\|( !(pData->aCSR[3] & 0x0200) && !!(csr0 & 0x0200)) /* TINT */
1148	\|\|( !(pData->aCSR[3] & 0x0400) && !!(csr0 & 0x0400)) /* RINT */
1149	\|\|( !(pData->aCSR[3] & 0x0800) && !!(csr0 & 0x0800)) /* MERR */
1150	\|\|( !(pData->aCSR[4] & 0x0001) && !!(pData->aCSR[4] & 0x0002)) /* JAB */
1151	\|\|( !(pData->aCSR[4] & 0x0004) && !!(pData->aCSR[4] & 0x0008)) /* TXSTRT */
1152	\|\|( !(pData->aCSR[4] & 0x0010) && !!(pData->aCSR[4] & 0x0020)) /* RCVO */
1153	\|\|( !(pData->aCSR[4] & 0x0100) && !!(pData->aCSR[4] & 0x0200)) /* MFCO */
1154	\|\|(!!(pData->aCSR[5] & 0x0040) && !!(pData->aCSR[5] & 0x0080)) /* EXDINT */
1155	\|\|(!!(pData->aCSR[5] & 0x0008) && !!(pData->aCSR[5] & 0x0010)) /* MPINT */)
1156	#endif
1157	{
1158	iISR = !!(csr0 & 0x0040); /* CSR_INEA */
1159	csr0 \|= 0x0080; /* set INTR */
1160	}
1161
1162	#ifdef VBOX
1163	if (pData->aCSR[4] & 0x0080) /* UINTCMD */
1164	{
1165	pData->aCSR[4] &= ~0x0080; /* clear UINTCMD */
1166	pData->aCSR[4] \|= 0x0040; /* set UINT */
1167	Log(("#%d user int\n", PCNETSTATE_2_DEVINS(pData)->iInstance));
1168	}
1169	if (pData->aCSR[4] & csr0 & 0x0040 /* CSR_INEA */)
1170	{
1171	csr0 \|= 0x0080; /* set INTR */
1172	iISR = 1;
1173	}
1174	#else /* !VBOX */
1175	if (!!(pData->aCSR[4] & 0x0080) && CSR_INEA(pData)) /* UINTCMD */
1176	{
1177	pData->aCSR[4] &= ~0x0080;
1178	pData->aCSR[4] \|= 0x0040; /* set UINT */
1179	csr0 \|= 0x0080; /* set INTR */
1180	iISR = 1;
1181	Log(("#%d user int\n", PCNETSTATE_2_DEVINS(pData)->iInstance));
1182	}
1183	#endif /* !VBOX */
1184
1185	#if 1
1186	if (((pData->aCSR[5]>>1) & pData->aCSR[5]) & 0x0500)
1187	#else
1188	if ( (!!(pData->aCSR[5] & 0x0400) && !!(pData->aCSR[5] & 0x0800)) /* SINT */
1189	\|\|(!!(pData->aCSR[5] & 0x0100) && !!(pData->aCSR[5] & 0x0200)) /* SLPINT */)
1190	#endif
1191	{
1192	iISR = 1;
1193	csr0 \|= 0x0080; /* INTR */
1194	}
1195
1196	pData->aCSR[0] = csr0;
1197
1198	Log2(("#%d set irq iISR=%d\n", PCNETSTATE_2_DEVINS(pData)->iInstance, iISR));
1199
1200	/* normal path is to _not_ change the IRQ status */
1201	if (RT_UNLIKELY(iISR != pData->iISR))
1202	{
1203	Log(("#%d INTA=%d\n", PCNETSTATE_2_DEVINS(pData)->iInstance, iISR));
1204	PDMDevHlpPCISetIrqNoWait(PCNETSTATE_2_DEVINS(pData), 0, iISR);
1205	pData->iISR = iISR;
1206	}
1207	STAM_PROFILE_ADV_STOP(&pData->StatInterrupt, a);
1208	}
1209
1210	#ifdef IN_RING3
1211	#ifdef PCNET_NO_POLLING
1212	static void pcnetUpdateRingHandlers(PCNetState *pData)
1213	{
1214	PPDMDEVINS pDevIns = PCNETSTATE_2_DEVINS(pData);
1215	int rc;
1216
1217	Log(("pcnetUpdateRingHandlers TD %VGp size %x -> %VGp size %x\n", pData->TDRAPhysOld, pData->cbTDRAOld, pData->GCTDRA, pcnetTdraAddr(pData, 0)));
1218	Log(("pcnetUpdateRingHandlers RX %VGp size %x -> %VGp size %x\n", pData->RDRAPhysOld, pData->cbRDRAOld, pData->GCRDRA, pcnetRdraAddr(pData, 0)));
1219
1220	/** @todo unregister order not correct! */
1221
1222	#ifdef PCNET_MONITOR_RECEIVE_RING
1223	if (pData->GCRDRA != pData->RDRAPhysOld \|\| CSR_RCVRL(pData) != pData->cbRDRAOld)
1224	{
1225	if (pData->RDRAPhysOld != 0)
1226	PGMHandlerPhysicalDeregister(PDMDevHlpGetVM(pDevIns),
1227	pData->RDRAPhysOld & ~PAGE_OFFSET_MASK);
1228
1229	rc = PGMR3HandlerPhysicalRegister(PDMDevHlpGetVM(pDevIns),
1230	PGMPHYSHANDLERTYPE_PHYSICAL_WRITE,
1231	pData->GCRDRA & ~PAGE_OFFSET_MASK,
1232	RT_ALIGN(pcnetRdraAddr(pData, 0), PAGE_SIZE) - 1,
1233	pcnetHandleRingWrite, pDevIns,
1234	g_DevicePCNet.szR0Mod, "pcnetHandleRingWrite",
1235	pData->pDevInsHC->pvInstanceDataHC,
1236	g_DevicePCNet.szGCMod, "pcnetHandleRingWrite",
1237	pData->pDevInsHC->pvInstanceDataGC,
1238	"PCNet receive ring write access handler");
1239	AssertRC(rc);
1240
1241	pData->RDRAPhysOld = pData->GCRDRA;
1242	pData->cbRDRAOld = pcnetRdraAddr(pData, 0);
1243	}
1244	#endif
1245
1246	#ifdef PCNET_MONITOR_RECEIVE_RING
1247	/* 3 possibilities:
1248	* 1) TDRA on different physical page as RDRA
1249	* 2) TDRA completely on same physical page as RDRA
1250	* 3) TDRA & RDRA overlap partly with different physical pages
1251	*/
1252	RTGCPHYS RDRAPageStart = pData->GCRDRA & ~PAGE_OFFSET_MASK;
1253	RTGCPHYS RDRAPageEnd = (pcnetRdraAddr(pData, 0) - 1) & ~PAGE_OFFSET_MASK;
1254	RTGCPHYS TDRAPageStart = pData->GCTDRA & ~PAGE_OFFSET_MASK;
1255	RTGCPHYS TDRAPageEnd = (pcnetTdraAddr(pData, 0) - 1) & ~PAGE_OFFSET_MASK;
1256
1257	if ( RDRAPageStart > TDRAPageEnd
1258	\|\| TDRAPageStart > RDRAPageEnd)
1259	{
1260	#endif
1261	/* 1) */
1262	if (pData->GCTDRA != pData->TDRAPhysOld \|\| CSR_XMTRL(pData) != pData->cbTDRAOld)
1263	{
1264	if (pData->TDRAPhysOld != 0)
1265	PGMHandlerPhysicalDeregister(PDMDevHlpGetVM(pDevIns),
1266	pData->TDRAPhysOld & ~PAGE_OFFSET_MASK);
1267
1268	rc = PGMR3HandlerPhysicalRegister(PDMDevHlpGetVM(pDevIns),
1269	PGMPHYSHANDLERTYPE_PHYSICAL_WRITE,
1270	pData->GCTDRA & ~PAGE_OFFSET_MASK,
1271	RT_ALIGN(pcnetTdraAddr(pData, 0), PAGE_SIZE) - 1,
1272	pcnetHandleRingWrite, pDevIns,
1273	g_DevicePCNet.szR0Mod, "pcnetHandleRingWrite",
1274	pData->pDevInsHC->pvInstanceDataHC,
1275	g_DevicePCNet.szGCMod, "pcnetHandleRingWrite",
1276	pData->pDevInsHC->pvInstanceDataGC,
1277	"PCNet transmit ring write access handler");
1278	AssertRC(rc);
1279
1280	pData->TDRAPhysOld = pData->GCTDRA;
1281	pData->cbTDRAOld = pcnetTdraAddr(pData, 0);
1282	}
1283	#ifdef PCNET_MONITOR_RECEIVE_RING
1284	}
1285	else
1286	if ( RDRAPageStart != TDRAPageStart
1287	&& ( TDRAPageStart == RDRAPageEnd
1288	\|\| TDRAPageEnd == RDRAPageStart
1289	)
1290	)
1291	{
1292	/* 3) */
1293	AssertFailed();
1294	}
1295	/* else 2) */
1296	#endif
1297	}
1298	#endif /* PCNET_NO_POLLING */
1299
1300	static void pcnetInit(PCNetState *pData)
1301	{
1302	PPDMDEVINS pDevIns = PCNETSTATE_2_DEVINS(pData);
1303	Log(("#%d pcnetInit: init_addr=0x%08x\n", PCNETSTATE_2_DEVINS(pData)->iInstance,
1304	PHYSADDR(pData, CSR_IADR(pData))));
1305
1306	/** @todo Documentation says that RCVRL and XMTRL are stored as two's complement!
1307	* Software is allowed to write these registers directly. */
1308	#define PCNET_INIT() do { \
1309	PDMDevHlpPhysRead(pDevIns, PHYSADDR(pData, CSR_IADR(pData)), \
1310	(uint8_t *)&initblk, sizeof(initblk)); \
1311	pData->aCSR[15] = le16_to_cpu(initblk.mode); \
1312	CSR_RCVRL(pData) = (initblk.rlen < 9) ? (1 << initblk.rlen) : 512; \
1313	CSR_XMTRL(pData) = (initblk.tlen < 9) ? (1 << initblk.tlen) : 512; \
1314	pData->aCSR[ 6] = (initblk.tlen << 12) \| (initblk.rlen << 8); \
1315	pData->aCSR[ 8] = le16_to_cpu(initblk.ladrf1); \
1316	pData->aCSR[ 9] = le16_to_cpu(initblk.ladrf2); \
1317	pData->aCSR[10] = le16_to_cpu(initblk.ladrf3); \
1318	pData->aCSR[11] = le16_to_cpu(initblk.ladrf4); \
1319	pData->aCSR[12] = le16_to_cpu(initblk.padr1); \
1320	pData->aCSR[13] = le16_to_cpu(initblk.padr2); \
1321	pData->aCSR[14] = le16_to_cpu(initblk.padr3); \
1322	pData->GCRDRA = PHYSADDR(pData, initblk.rdra); \
1323	pData->GCTDRA = PHYSADDR(pData, initblk.tdra); \
1324	} while (0)
1325
1326	if (BCR_SSIZE32(pData))
1327	{
1328	struct INITBLK32 initblk;
1329	pData->GCUpperPhys = 0;
1330	PCNET_INIT();
1331	Log(("#%d initblk.rlen=0x%02x, initblk.tlen=0x%02x\n",
1332	PCNETSTATE_2_DEVINS(pData)->iInstance, initblk.rlen, initblk.tlen));
1333	}
1334	else
1335	{
1336	struct INITBLK16 initblk;
1337	pData->GCUpperPhys = (0xff00 & (uint32_t)pData->aCSR[2]) << 16;
1338	PCNET_INIT();
1339	Log(("#%d initblk.rlen=0x%02x, initblk.tlen=0x%02x\n",
1340	PCNETSTATE_2_DEVINS(pData)->iInstance, initblk.rlen, initblk.tlen));
1341	}
1342
1343	#undef PCNET_INIT
1344
1345	if (pData->pDrv)
1346	pData->pDrv->pfnSetPromiscuousMode(pData->pDrv, CSR_PROM(pData));
1347
1348	CSR_RCVRC(pData) = CSR_RCVRL(pData);
1349	CSR_XMTRC(pData) = CSR_XMTRL(pData);
1350
1351	#ifdef PCNET_NO_POLLING
1352	pcnetUpdateRingHandlers(pData);
1353	#endif
1354
1355	/* Reset cached RX and TX states */
1356	CSR_CRST(pData) = CSR_CRBC(pData) = CSR_NRST(pData) = CSR_NRBC(pData) = 0;
1357	CSR_CXST(pData) = CSR_CXBC(pData) = CSR_NXST(pData) = CSR_NXBC(pData) = 0;
1358
1359	LogRel(("PCNet#%d: Init: ss32=%d GCRDRA=0x%08x[%d] GCTDRA=0x%08x[%d]\n",
1360	PCNETSTATE_2_DEVINS(pData)->iInstance, BCR_SSIZE32(pData),
1361	pData->GCRDRA, CSR_RCVRL(pData), pData->GCTDRA, CSR_XMTRL(pData)));
1362
1363	pData->aCSR[0] \|= 0x0101; /* Initialization done */
1364	pData->aCSR[0] &= ~0x0004; /* clear STOP bit */
1365	}
1366	#endif /* IN_RING3 */
1367
1368	/**
1369	* Start RX/TX operation.
1370	*/
1371	static void pcnetStart(PCNetState *pData)
1372	{
1373	Log(("%#d pcnetStart:\n", PCNETSTATE_2_DEVINS(pData)->iInstance));
1374	if (!CSR_DTX(pData))
1375	pData->aCSR[0] \|= 0x0010; /* set TXON */
1376	if (!CSR_DRX(pData))
1377	pData->aCSR[0] \|= 0x0020; /* set RXON */
1378	pData->aCSR[0] &= ~0x0004; /* clear STOP bit */
1379	pData->aCSR[0] \|= 0x0002; /* STRT */
1380	}
1381
1382	/**
1383	* Stop RX/TX operation.
1384	*/
1385	static void pcnetStop(PCNetState *pData)
1386	{
1387	Log(("#%d pcnetStop:\n", PCNETSTATE_2_DEVINS(pData)->iInstance));
1388	pData->aCSR[0] &= ~0x7feb;
1389	pData->aCSR[0] \|= 0x0014;
1390	pData->aCSR[4] &= ~0x02c2;
1391	pData->aCSR[5] &= ~0x0011;
1392	pcnetPollTimer(pData);
1393	}
1394
1395	#ifdef IN_RING3
1396	static DECLCALLBACK(bool) pcnetCanRxQueueConsumer(PPDMDEVINS pDevIns, PPDMQUEUEITEMCORE pItem)
1397	{
1398	PCNetState pData = PDMINS2DATA(pDevIns, PCNetState );
1399	pData->pDrv->pfnNotifyCanReceive(pData->pDrv);
1400	return true;
1401	}
1402	#endif
1403
1404	/**
1405	* Poll Receive Descriptor Table Entry and cache the results in the appropriate registers.
1406	* Note: Once a descriptor belongs to the network card (this driver), it cannot be changed
1407	* by the host (the guest driver) anymore. Well, it could but the results are undefined by
1408	* definition.
1409	* @param fSkipCurrent if true, don't scan the current RDTE.
1410	*/
1411	static void pcnetRdtePoll(PCNetState *pData, bool fSkipCurrent=false)
1412	{
1413	/* assume lack of a next receive descriptor */
1414	CSR_NRST(pData) = 0;
1415
1416	if (RT_LIKELY(pData->GCRDRA))
1417	{
1418	/*
1419	* The current receive message descriptor.
1420	*/
1421	RMD rmd;
1422	int i = CSR_RCVRC(pData);
1423	RTGCPHYS addr;
1424
1425	if (i < 1)
1426	i = CSR_RCVRL(pData);
1427
1428	if (!fSkipCurrent)
1429	{
1430	addr = pcnetRdraAddr(pData, i);
1431	pcnetRmdLoad(pData, &rmd, PHYSADDR(pData, addr));
1432	CSR_CRDA(pData) = CSR_CRBA(pData) = 0;
1433	CSR_CRBC(pData) = CSR_CRST(pData) = 0;
1434	if (!rmd.rmd1.own)
1435	return;
1436	if (RT_LIKELY(!IS_RMD_BAD(rmd)))
1437	{
1438	CSR_CRDA(pData) = addr; /* Receive Descriptor Address */
1439	CSR_CRBA(pData) = rmd.rmd0.rbadr; /* Receive Buffer Address */
1440	CSR_CRBC(pData) = rmd.rmd1.bcnt; /* Receive Byte Count */
1441	CSR_CRST(pData) = ((uint32_t )&rmd)[1] >> 16; / Receive Status */
1442	#ifdef IN_RING3
1443	pData->pDrv->pfnNotifyCanReceive(pData->pDrv);
1444	#else
1445	PPDMQUEUEITEMCORE pItem = PDMQueueAlloc(CTXSUFF(pData->pCanRxQueue));
1446	if (pItem)
1447	PDMQueueInsert(CTXSUFF(pData->pCanRxQueue), pItem);
1448	#endif
1449	}
1450	else
1451	{
1452	/* This is not problematic since we don't own the descriptor */
1453	LogRel(("PCNet#%d: BAD RMD ENTRIES AT 0x%08x (i=%d)\n",
1454	PCNETSTATE_2_DEVINS(pData)->iInstance, addr, i));
1455	return;
1456	}
1457	}
1458
1459	/*
1460	* The next descriptor.
1461	*/
1462	if (--i < 1)
1463	i = CSR_RCVRL(pData);
1464	addr = pcnetRdraAddr(pData, i);
1465	pcnetRmdLoad(pData, &rmd, PHYSADDR(pData, addr));
1466	CSR_NRDA(pData) = CSR_NRBA(pData) = 0;
1467	CSR_NRBC(pData) = 0;
1468	if (!rmd.rmd1.own)
1469	return;
1470	if (RT_LIKELY(!IS_RMD_BAD(rmd)))
1471	{
1472	CSR_NRDA(pData) = addr; /* Receive Descriptor Address */
1473	CSR_NRBA(pData) = rmd.rmd0.rbadr; /* Receive Buffer Address */
1474	CSR_NRBC(pData) = rmd.rmd1.bcnt; /* Receive Byte Count */
1475	CSR_NRST(pData) = ((uint32_t )&rmd)[1] >> 16; / Receive Status */
1476	}
1477	else
1478	{
1479	/* This is not problematic since we don't own the descriptor */
1480	LogRel(("PCNet#%d: BAD RMD ENTRIES + AT 0x%08x (i=%d)\n",
1481	PCNETSTATE_2_DEVINS(pData)->iInstance, addr, i));
1482	return;
1483	}
1484
1485	/**
1486	* @todo NNRD
1487	*/
1488	}
1489	else
1490	{
1491	CSR_CRDA(pData) = CSR_CRBA(pData) = CSR_NRDA(pData) = CSR_NRBA(pData) = 0;
1492	CSR_CRBC(pData) = CSR_NRBC(pData) = CSR_CRST(pData) = 0;
1493	}
1494	}
1495
1496	/**
1497	* Poll Transmit Descriptor Table Entry
1498	* @return true if transmit descriptors available
1499	*/
1500	static int pcnetTdtePoll(PCNetState pData, TMD tmd)
1501	{
1502	if (RT_LIKELY(pData->GCTDRA))
1503	{
1504	RTGCPHYS cxda = pcnetTdraAddr(pData, CSR_XMTRC(pData));
1505
1506	pcnetTmdLoad(pData, tmd, PHYSADDR(pData, cxda));
1507
1508	if (!tmd->tmd1.own)
1509	return 0;
1510
1511	if (RT_UNLIKELY(tmd->tmd1.ones != 15))
1512	{
1513	LogRel(("PCNet#%d: BAD TMD XDA=0x%08x\n",
1514	PCNETSTATE_2_DEVINS(pData)->iInstance, PHYSADDR(pData, cxda)));
1515	return 0;
1516	}
1517
1518	/* previous xmit descriptor */
1519	CSR_PXDA(pData) = CSR_CXDA(pData);
1520	CSR_PXBC(pData) = CSR_CXBC(pData);
1521	CSR_PXST(pData) = CSR_CXST(pData);
1522
1523	/* set current trasmit decriptor. */
1524	CSR_CXDA(pData) = cxda;
1525	CSR_CXBC(pData) = tmd->tmd1.bcnt;
1526	CSR_CXST(pData) = ((uint32_t *)tmd)[1] >> 16;
1527	return CARD_IS_OWNER(CSR_CXST(pData));
1528	}
1529	else
1530	{
1531	/** @todo consistency with previous receive descriptor */
1532	CSR_CXDA(pData) = 0;
1533	CSR_CXBC(pData) = CSR_CXST(pData) = 0;
1534	return 0;
1535	}
1536	}
1537
1538	#ifdef IN_RING3
1539	/**
1540	* Check if there is at least one free receive buffer available.
1541	*/
1542	static int pcnetCanReceiveNoSync(PCNetState *pData)
1543	{
1544	if (RT_UNLIKELY(CSR_DRX(pData) \|\| CSR_STOP(pData) \|\| CSR_SPND(pData)))
1545	return 0;
1546
1547	if (HOST_IS_OWNER(CSR_CRST(pData)) && pData->GCRDRA)
1548	pcnetRdtePoll(pData);
1549
1550	if (HOST_IS_OWNER(CSR_CRST(pData)))
1551	{
1552	/** @todo Notify the guest _now_. Will potentially increase the interrupt load */
1553	pData->aCSR[0] \|= 0x1000; /* Set MISS flag */
1554	return 0;
1555	}
1556
1557	/* byte count stored in two's complement 12 bits wide */
1558	Log(("#%d pcnetCanReceiveNoSync %d bytes\n", PCNETSTATE_2_DEVINS(pData)->iInstance,
1559	4096 - CSR_CRBC(pData)));
1560	return 4096 - CSR_CRBC(pData);
1561	}
1562	#endif
1563
1564	/**
1565	* Write data into guest receive buffers.
1566	*/
1567	static void pcnetReceiveNoSync(PCNetState pData, const uint8_t buf, int size)
1568	{
1569	PPDMDEVINS pDevIns = PCNETSTATE_2_DEVINS(pData);
1570	int is_padr = 0, is_bcast = 0, is_ladr = 0;
1571
1572	if (RT_UNLIKELY(CSR_DRX(pData) \|\| CSR_STOP(pData) \|\| CSR_SPND(pData) \|\| !size))
1573	return;
1574
1575	Log(("#%d pcnetReceiveNoSync: size=%d\n", PCNETSTATE_2_DEVINS(pData)->iInstance, size));
1576
1577	LOG_PACKET("rraw", buf, size);
1578
1579	/*
1580	* Perform address matching.
1581	*/
1582	if ( CSR_PROM(pData)
1583	\|\| (is_padr = padr_match(pData, buf, size))
1584	\|\| (is_bcast = padr_bcast(pData, buf, size))
1585	\|\| (is_ladr = ladr_match(pData, buf, size)))
1586	{
1587	if (HOST_IS_OWNER(CSR_CRST(pData)))
1588	pcnetRdtePoll(pData);
1589	if (RT_UNLIKELY(HOST_IS_OWNER(CSR_CRST(pData))))
1590	{
1591	/* Not owned by controller. This should not be possible as
1592	* we already called pcnetCanReceive(). */
1593	LogRel(("PCNet#%d: no buffer: RCVRC=%d\n",
1594	PCNETSTATE_2_DEVINS(pData)->iInstance, CSR_RCVRC(pData)));
1595	/* Dump the status of all RX descriptors */
1596	const unsigned cb = 1 << pData->iLog2DescSize;
1597	RTGCPHYS GCPhys = pData->GCRDRA;
1598	unsigned i = CSR_RCVRL(pData);
1599	while (i-- > 0)
1600	{
1601	RMD rmd;
1602	pcnetRmdLoad(pData, &rmd, PHYSADDR(pData, GCPhys));
1603	LogRel((" %08x\n", rmd.rmd1));
1604	GCPhys += cb;
1605	}
1606	pData->aCSR[0] \|= 0x1000; /* Set MISS flag */
1607	CSR_MISSC(pData)++;
1608	}
1609	else
1610	{
1611	uint8_t *src = &pData->abRecvBuf[8];
1612	RTGCPHYS crda = CSR_CRDA(pData);
1613	RMD rmd;
1614	int pktcount = 0;
1615
1616	memcpy(src, buf, size);
1617	if (!CSR_ASTRP_RCV(pData))
1618	{
1619	uint32_t fcs = ~0;
1620	uint8_t *p = src;
1621
1622	while (size < 60)
1623	src[size++] = 0;
1624	while (p != &src[size])
1625	CRC(fcs, *p++);
1626	((uint32_t *)&src[size])[0] = htonl(fcs);
1627	/* FCS at end of packet */
1628	}
1629	size += 4;
1630
1631	#ifdef PCNET_DEBUG_MATCH
1632	PRINT_PKTHDR(buf);
1633	#endif
1634
1635	pcnetRmdLoad(pData, &rmd, PHYSADDR(pData, crda));
1636	/if (!CSR_LAPPEN(pData))/
1637	rmd.rmd1.stp = 1;
1638
1639	int count = RT_MIN(4096 - (int)rmd.rmd1.bcnt, size);
1640	RTGCPHYS rbadr = PHYSADDR(pData, rmd.rmd0.rbadr);
1641	PDMDevHlpPhysWrite(pDevIns, rbadr, src, count);
1642	src += count;
1643	size -= count;
1644	rmd.rmd2.mcnt = count;
1645	pktcount++;
1646	if (size > 0)
1647	{
1648	if (HOST_IS_OWNER(CSR_NRST(pData)))
1649	{
1650	/* From the manual: ``Regardless of ownership of the second receive
1651	* descriptor, the Am79C972 controller will continue to perform receive
1652	* data DMA transfers to the first buffer. If the frame length exceeds
1653	* the length of the first buffer, and the Am79C972 controller does not
1654	* own the second buffer, ownership of the current descriptor will be
1655	* passed back to the system by writing a 0 to the OWN bit of RMD1.
1656	* Status will be written indicating buffer (BUFF = 1) and possibly
1657	* overflow (OFLO = 1) errors.
1658	* If the frame length exceeds the length of the first (current) buffer,
1659	* and the Am79C972 controller does own the second (next) buffer,
1660	* ownership will be passed back to the system by writing a 0 to the OWN
1661	* bit of RMD1 when the first buffer is full. The OWN bit is the only bit
1662	* modified in the descriptor. Receive data transfers to the second buffer
1663	* may occur before the Am79C972 controller proceeds to look ahead to the
1664	* ownership of the third buffer. Such action will depend upon the state
1665	* of the FIFO when the OWN bit has been updated in the first descriptor.
1666	* In any case, lookahead will be performed to the third buffer and the
1667	* information gathered will be stored in the chip, regardless of the state
1668	* of the ownership bit.'' */
1669	pcnetRdtePoll(pData, true);
1670	}
1671	if (CARD_IS_OWNER(CSR_NRST(pData)))
1672	{
1673	/* write back, clear the own bit */
1674	pcnetRmdStorePassHost(pData, &rmd, PHYSADDR(pData, crda));
1675	crda = CSR_NRDA(pData);
1676	pcnetRmdLoad(pData, &rmd, PHYSADDR(pData, crda));
1677	count = RT_MIN(4096 - (int)rmd.rmd1.bcnt, size);
1678	rbadr = PHYSADDR(pData, rmd.rmd0.rbadr);
1679	PDMDevHlpPhysWrite(pDevIns, rbadr, src, count);
1680	src += count;
1681	size -= count;
1682	rmd.rmd2.mcnt = count;
1683	pktcount++;
1684	}
1685	}
1686
1687	if (RT_LIKELY(size == 0))
1688	{
1689	rmd.rmd1.enp = 1;
1690	rmd.rmd1.pam = !CSR_PROM(pData) && is_padr;
1691	rmd.rmd1.lafm = !CSR_PROM(pData) && is_ladr;
1692	rmd.rmd1.bam = !CSR_PROM(pData) && is_bcast;
1693	}
1694	else
1695	{
1696	LogRel(("PCNet#%d: Overflow by %ubytes\n",
1697	PCNETSTATE_2_DEVINS(pData)->iInstance, size));
1698	rmd.rmd1.oflo = 1;
1699	rmd.rmd1.buff = 1;
1700	rmd.rmd1.err = 1;
1701	}
1702	/* write back, clear the own bit */
1703	pcnetRmdStorePassHost(pData, &rmd, PHYSADDR(pData, crda));
1704
1705	pData->aCSR[0] \|= 0x0400;
1706
1707	Log(("#%d RCVRC=%d CRDA=0x%08x BLKS=%d\n", PCNETSTATE_2_DEVINS(pData)->iInstance,
1708	CSR_RCVRC(pData), PHYSADDR(pData, CSR_CRDA(pData)), pktcount));
1709	#ifdef PCNET_DEBUG_RMD
1710	PRINT_RMD(&rmd);
1711	#endif
1712
1713	while (pktcount--)
1714	{
1715	if (CSR_RCVRC(pData) < 2)
1716	CSR_RCVRC(pData) = CSR_RCVRL(pData);
1717	else
1718	CSR_RCVRC(pData)--;
1719	}
1720	/* guest driver is owner: force repoll of current and next RDTEs */
1721	CSR_CRST(pData) = 0;
1722	}
1723	}
1724
1725	/* see description of TXDPOLL:
1726	* ``transmit polling will take place following receive activities'' */
1727	pcnetPollRxTx(pData);
1728	pcnetUpdateIrq(pData);
1729	}
1730
1731
1732	/**
1733	* Checks if the link is up.
1734	* @returns true if the link is up.
1735	* @returns false if the link is down.
1736	*/
1737	DECLINLINE(bool) pcnetIsLinkUp(PCNetState *pData)
1738	{
1739	return pData->pDrv && !pData->fLinkTempDown && pData->fLinkUp;
1740	}
1741
1742	#ifdef IN_RING3
1743	/**
1744	* Transmit queue consumer
1745	* This is just a very simple way of delaying sending to R3.
1746	*
1747	* @returns Success indicator.
1748	* If false the item will not be removed and the flushing will stop.
1749	* @param pDevIns The device instance.
1750	* @param pItem The item to consume. Upon return this item will be freed.
1751	*/
1752	static DECLCALLBACK(bool) pcnetXmitQueueConsumer(PPDMDEVINS pDevIns, PPDMQUEUEITEMCORE pItem)
1753	{
1754	PCNetState pData = PDMINS2DATA(pDevIns, PCNetState );
1755	unsigned i;
1756	int rc;
1757
1758	STAM_PROFILE_START(&pData->StatXmitQueue, a);
1759	STAM_COUNTER_INC(&pData->aStatFlushCounts[pData->iFrame]);
1760	rc = PDMCritSectEnter(&pData->CritSect, VERR_PERMISSION_DENIED);
1761	AssertReleaseRC(rc);
1762	Log(("#%d pcnetXmitQueueConsumer: iFrame=%d\n", PCNETSTATE_2_DEVINS(pData)->iInstance, pData->iFrame));
1763
1764	pData->fTransmitting = true;
1765	for (i = 0; i < pData->iFrame; i++)
1766	{
1767	RTR3PTR pv = pData->aFrames[i].pvR3 != NIL_RTR3PTR
1768	? pData->aFrames[i].pvR3
1769	: &pData->abFrameBuf[pData->aFrames[i].off];
1770	if (pData->aFrames[i].cb > 70) /* unqualified guess */
1771	pData->Led.Asserted.s.fWriting = pData->Led.Actual.s.fWriting = 1;
1772	if (pcnetIsLinkUp(pData))
1773	{
1774	pData->pDrv->pfnSend(pData->pDrv, pv, pData->aFrames[i].cb);
1775	LOG_PACKET("xmit", pv, pData->aFrames[i].cb);
1776	}
1777	}
1778
1779	pData->fTransmitting = false;
1780
1781	pData->aFrames[0].off = 0;
1782	pData->aFrames[0].cb = -1;
1783	pData->aFrames[0].pvR3 = NIL_RTR3PTR;
1784	pData->iFrame = 0;
1785	pData->Led.Actual.s.fWriting = 0;
1786
1787	PDMCritSectLeave(&pData->CritSect);
1788	STAM_PROFILE_STOP(&pData->StatXmitQueue, a);
1789	NOREF(pItem);
1790	return true;
1791	}
1792	#endif /* IN_RING3 */
1793
1794
1795	/**
1796	* Flushes queued frames.
1797	*/
1798	DECLINLINE(void) pcnetXmitFlushFrames(PCNetState *pData)
1799	{
1800	if (pData->iFrame)
1801	{
1802	#ifdef IN_RING3
1803	Log(("#%d HC: pcnetXmitFlushFrames: flushing %d frames\n", PCNETSTATE_2_DEVINS(pData)->iInstance, pData->iFrame));
1804	pcnetXmitQueueConsumer(CTXSUFF(pData->pDevIns), NULL);
1805	#else
1806	Log(("#%d GC: pcnetXmitFlushFrames: flushing %d frames\n", PCNETSTATE_2_DEVINS(pData)->iInstance, pData->iFrame));
1807	STAM_PROFILE_ADV_START(&pData->StatXmitQueueFlushGC, a);
1808	PDMQueueFlush(pData->CTXSUFF(pXmitQueue));
1809	STAM_PROFILE_ADV_STOP(&pData->StatXmitQueueFlushGC, a);
1810	#endif
1811	}
1812	pData->aFrames[0].off = 0;
1813	pData->aFrames[0].cb = -1;
1814	pData->aFrames[0].pvR3 = NIL_RTR3PTR;
1815	pData->iFrame = 0;
1816	}
1817
1818
1819	/**
1820	* Scraps the top frame.
1821	* This is done as a precaution against mess left over by on
1822	*/
1823	DECLINLINE(void) pcnetXmitScrapFrame(PCNetState *pData)
1824	{
1825	const uint32_t iFrame = pData->iFrame;
1826	pData->aFrames[iFrame].cb = -1;
1827	}
1828
1829
1830	/**
1831	* Ensures that we've got enough buffer space for the frame.
1832	*/
1833	DECLINLINE(void) pcnetXmitEnsureSpace(PCNetState *pData, const unsigned cb, const bool fForceFlush)
1834	{
1835	const uint32_t iFrame = pData->iFrame;
1836	if ( fForceFlush
1837	\|\| cb > sizeof(pData->abFrameBuf) - pData->aFrames[iFrame].off)
1838	pcnetXmitFlushFrames(pData);
1839	}
1840
1841
1842	#ifdef IN_RING3
1843	/**
1844	* If we are in RING3 don't copy the frame from GC here but only store the address. We
1845	* don't need to buffer the frames because we will flush all pending frames at the end of
1846	* pcnetTransmit anyway.
1847	*/
1848	DECLINLINE(void) pcnetXmitZeroCopyFrame(PCNetState *pData, RTR3PTR pv, const unsigned cbFrame)
1849	{
1850	const uint32_t iFrame = pData->iFrame;
1851	pData->aFrames[iFrame].pvR3 = pv;
1852	pData->aFrames[iFrame].cb = cbFrame;
1853	}
1854	#endif
1855
1856
1857	/**
1858	* Reads the first part of a frame
1859	*/
1860	DECLINLINE(void) pcnetXmitRead1st(PCNetState *pData, RTGCPHYS GCPhysFrame, const unsigned cbFrame)
1861	{
1862	const uint32_t iFrame = pData->iFrame;
1863	PDMDevHlpPhysRead(pData->CTXSUFF(pDevIns), GCPhysFrame,
1864	&pData->abFrameBuf[pData->aFrames[iFrame].off],
1865	cbFrame);
1866	pData->aFrames[iFrame].cb = cbFrame;
1867	}
1868
1869
1870	/**
1871	* Reads more into the current frame.
1872	*/
1873	DECLINLINE(void) pcnetXmitReadMore(PCNetState *pData, RTGCPHYS GCPhysFrame, const unsigned cbFrame)
1874	{
1875	const uint32_t iFrame = pData->iFrame;
1876	PDMDevHlpPhysRead(pData->CTXSUFF(pDevIns), GCPhysFrame,
1877	&pData->abFrameBuf[pData->aFrames[iFrame].off + pData->aFrames[iFrame].cb],
1878	cbFrame);
1879	pData->aFrames[iFrame].cb += cbFrame;
1880	}
1881
1882
1883	/**
1884	* Completes the current frame.
1885	* If we've reached the maxium number of frames, they will be flushed.
1886	*/
1887	DECLINLINE(void) pcnetXmitCompleteFrame(PCNetState *pData)
1888	{
1889	const uint32_t iFrame = ++pData->iFrame;
1890	if (iFrame == ELEMENTS(pData->aFrames))
1891	pcnetXmitFlushFrames(pData);
1892	else
1893	{
1894	/* initialize next frame */
1895	pData->aFrames[iFrame].off = pData->aFrames[iFrame - 1].off
1896	+ RT_ALIGN_32(pData->aFrames[iFrame - 1].cb, 16);
1897	pData->aFrames[iFrame].cb = -1;
1898	pData->aFrames[iFrame].pvR3 = NIL_RTR3PTR;
1899	}
1900	}
1901
1902
1903	/**
1904	* Fails a TMD with a link down error.
1905	*/
1906	static void pcnetXmitFailTMDLinkDown(PCNetState pData, TMD pTmd)
1907	{
1908	/* make carrier error - hope this is correct. */
1909	pData->cLinkDownReported++;
1910	pTmd->tmd2.lcar = pTmd->tmd1.err = 1;
1911	pData->aCSR[0] \|= BIT(15) \| BIT(13); /* ERR \| CERR */
1912	pData->Led.Asserted.s.fError = pData->Led.Actual.s.fError = 1;
1913	Log(("#%d pcnetTransmit: Signaling send error. swstyle=%#x\n",
1914	PCNETSTATE_2_DEVINS(pData)->iInstance, pData->aBCR[BCR_SWS]));
1915	}
1916
1917
1918	/**
1919	* Transmit a loopback frame.
1920	*/
1921	DECLINLINE(void) pcnetXmitLoopbackFrame(PCNetState *pData)
1922	{
1923	Assert(pData->iFrame == 0);
1924	pData->Led.Asserted.s.fReading = pData->Led.Actual.s.fReading = 1;
1925	if (HOST_IS_OWNER(CSR_CRST(pData)))
1926	pcnetRdtePoll(pData);
1927	pcnetReceiveNoSync(pData, &pData->abFrameBuf[pData->aFrames[0].off], pData->aFrames[0].cb);
1928	pcnetXmitScrapFrame(pData);
1929	pData->Led.Actual.s.fReading = 0;
1930	}
1931
1932
1933	/**
1934	* Try to transmit frames
1935	*/
1936	static void pcnetTransmit(PCNetState *pData)
1937	{
1938	/*
1939	* Prevent various pollers (esp the one in pcnetReceiveNoSync) from causing
1940	* recursion when flushing a queue.
1941	*/
1942	if (pData->fTransmitting)
1943	return;
1944
1945	if (RT_UNLIKELY(!CSR_TXON(pData)))
1946	{
1947	pData->aCSR[0] &= ~0x0008; /* Clear TDMD */
1948	return;
1949	}
1950
1951	/*
1952	* Iterate the transmit descriptors.
1953	*/
1954	STAM_PROFILE_ADV_START(&pData->CTXSUFF(StatTransmit), a);
1955	do
1956	{
1957	#ifdef VBOX_WITH_STATISTICS
1958	unsigned cBuffers = 1;
1959	#endif
1960	TMD tmd;
1961	if (!pcnetTdtePoll(pData, &tmd))
1962	break;
1963
1964	#ifdef PCNET_DEBUG_TMD
1965	Log(("#%d TMDLOAD 0x%08x\n", PCNETSTATE_2_DEVINS(pData)->iInstance, PHYSADDR(pData, CSR_CXDA(pData))));
1966	PRINT_TMD(&tmd);
1967	#endif
1968	pcnetXmitScrapFrame(pData);
1969
1970	/*
1971	* The typical case - a complete packet.
1972	* This can be performed with zero copy in Ring-3.
1973	*/
1974	if (tmd.tmd1.stp && tmd.tmd1.enp)
1975	{
1976	const unsigned cb = 4096 - tmd.tmd1.bcnt;
1977	Log(("#%d pcnetTransmit: stp&enp: cb=%d xmtrc=%#x\n", PCNETSTATE_2_DEVINS(pData)->iInstance, cb, CSR_XMTRC(pData)));
1978	if (RT_LIKELY(pcnetIsLinkUp(pData) \|\| CSR_LOOP(pData)))
1979	{
1980	#ifdef IN_RING3
1981	RTR3PTR pv;
1982	int rc = PDMDevHlpPhys2HCVirt(pData->pDevInsHC,
1983	PHYSADDR(pData, tmd.tmd0.tbadr), cb, &pv);
1984	if (RT_SUCCESS(rc))
1985	pcnetXmitZeroCopyFrame(pData, pv, cb);
1986	else
1987	#endif
1988	{
1989	pcnetXmitEnsureSpace(pData, cb, CSR_LOOP(pData));
1990	pcnetXmitRead1st(pData, PHYSADDR(pData, tmd.tmd0.tbadr), cb);
1991	}
1992	if (CSR_LOOP(pData))
1993	pcnetXmitLoopbackFrame(pData);
1994	else
1995	pcnetXmitCompleteFrame(pData);
1996	}
1997	else
1998	pcnetXmitFailTMDLinkDown(pData, &tmd);
1999
2000	/* Write back the TMD and pass it to the host (clear own bit). */
2001	pcnetTmdStorePassHost(pData, &tmd, PHYSADDR(pData, CSR_CXDA(pData)));
2002
2003	/* advance the ring counter register */
2004	if (CSR_XMTRC(pData) < 2)
2005	CSR_XMTRC(pData) = CSR_XMTRL(pData);
2006	else
2007	CSR_XMTRC(pData)--;
2008	}
2009	else if (tmd.tmd1.stp)
2010	{
2011	/*
2012	* Read TMDs until end-of-packet or tdte poll fails (underflow).
2013	*/
2014	const unsigned cbMaxFrame = 4096;
2015	bool fDropFrame = false;
2016	unsigned cb = 4096 - tmd.tmd1.bcnt;
2017	pcnetXmitEnsureSpace(pData, cbMaxFrame, CSR_LOOP(pData));
2018	pcnetXmitRead1st(pData, PHYSADDR(pData, tmd.tmd0.tbadr), cb);
2019	for (;;)
2020	{
2021	/*
2022	* Advance the ring counter register and check the next tmd.
2023	*/
2024	#ifdef LOG_ENABLED
2025	const uint32_t iStart = CSR_XMTRC(pData);
2026	#endif
2027	const uint32_t GCPhysPrevTmd = PHYSADDR(pData, CSR_CXDA(pData));
2028	if (CSR_XMTRC(pData) < 2)
2029	CSR_XMTRC(pData) = CSR_XMTRL(pData);
2030	else
2031	CSR_XMTRC(pData)--;
2032
2033	TMD dummy;
2034	if (!pcnetTdtePoll(pData, &dummy))
2035	{
2036	/*
2037	* Underflow!
2038	*/
2039	tmd.tmd2.buff = tmd.tmd2.uflo = tmd.tmd1.err = 1;
2040	pData->aCSR[0] \|= 0x0200; /* set TINT */
2041	if (!CSR_DXSUFLO(pData)) /* stop on xmit underflow */
2042	pData->aCSR[0] &= ~0x0010; /* clear TXON */
2043	pcnetTmdStorePassHost(pData, &tmd, GCPhysPrevTmd);
2044	AssertMsgFailed(("pcnetTransmit: Underflow!!!\n"));
2045	break;
2046	}
2047
2048	/* release & save the previous tmd, pass it to the host */
2049	pcnetTmdStorePassHost(pData, &tmd, GCPhysPrevTmd);
2050
2051	/*
2052	* The next tdm.
2053	*/
2054	#ifdef VBOX_WITH_STATISTICS
2055	cBuffers++;
2056	#endif
2057	pcnetTmdLoad(pData, &tmd, PHYSADDR(pData, CSR_CXDA(pData)));
2058	cb = 4096 - tmd.tmd1.bcnt;
2059	if ( pData->aFrames[pData->iFrame].cb + cb < cbMaxFrame
2060	&& !fDropFrame)
2061	pcnetXmitReadMore(pData, PHYSADDR(pData, tmd.tmd0.tbadr), cb);
2062	else
2063	{
2064	AssertMsg(fDropFrame, ("pcnetTransmit: Frame is too big!!! %d bytes\n",
2065	pData->aFrames[pData->iFrame].cb + cb));
2066	fDropFrame = true;
2067	}
2068	if (tmd.tmd1.enp)
2069	{
2070	Log(("#%d pcnetTransmit: stp: cb=%d xmtrc=%#x-%#x\n", PCNETSTATE_2_DEVINS(pData)->iInstance,
2071	pData->aFrames[pData->iFrame].cb, iStart, CSR_XMTRC(pData)));
2072	if (pcnetIsLinkUp(pData) && !fDropFrame)
2073	pcnetXmitCompleteFrame(pData);
2074	else if (CSR_LOOP(pData) && !fDropFrame)
2075	pcnetXmitLoopbackFrame(pData);
2076	else
2077	{
2078	if (!fDropFrame)
2079	pcnetXmitFailTMDLinkDown(pData, &tmd);
2080	pcnetXmitScrapFrame(pData);
2081	}
2082
2083	/* Write back the TMD, pass it to the host */
2084	pcnetTmdStorePassHost(pData, &tmd, PHYSADDR(pData, CSR_CXDA(pData)));
2085
2086	/* advance the ring counter register */
2087	if (CSR_XMTRC(pData) < 2)
2088	CSR_XMTRC(pData) = CSR_XMTRL(pData);
2089	else
2090	CSR_XMTRC(pData)--;
2091	break;
2092	}
2093	}
2094	}
2095	else
2096	{
2097	/*
2098	* We underflowed in a previous transfer, or the driver is giving us shit.
2099	* Simply stop the transmitting for now.
2100	*/
2101	Log(("#%d pcnetTransmit: guest is giving us shit!\n", PCNETSTATE_2_DEVINS(pData)->iInstance));
2102	break;
2103	}
2104
2105	/* Update TDMD, TXSTRT and TINT. */
2106	pData->aCSR[0] &= ~0x0008; /* clear TDMD */
2107	pData->aCSR[4] \|= 0x0004; /* set TXSTRT */
2108	if ( !CSR_TOKINTD(pData) /* Transmit OK Interrupt Disable, no infl. on errors. */
2109	\|\| (CSR_LTINTEN(pData) && tmd.tmd1.ltint)
2110	\|\| tmd.tmd1.err)
2111	pData->aCSR[0] \|= 0x0200; /* set TINT */
2112
2113	STAM_COUNTER_INC(&pData->aStatXmitChainCounts[RT_MIN(cBuffers,
2114	ELEMENTS(pData->aStatXmitChainCounts)) - 1]);
2115	} while (CSR_TXON(pData)); /* transfer on */
2116
2117	STAM_PROFILE_ADV_STOP(&pData->CTXSUFF(StatTransmit), a);
2118
2119	/*
2120	* If we're in Ring-3 we should flush the queue now, in GC/R0 we'll queue a flush job.
2121	*/
2122	#ifdef IN_RING3
2123	pcnetXmitFlushFrames(pData);
2124	#else
2125	if (pData->iFrame)
2126	{
2127	PPDMQUEUEITEMCORE pItem = PDMQueueAlloc(CTXSUFF(pData->pXmitQueue));
2128	if (pItem)
2129	# if 0 /* send before resuming guest (last argument isn't implemented yet and read as 0). */
2130	PDMQueueInsertEx(CTXSUFF(pData->pXmitQueue), pItem, 50000);
2131	# else /* send when going back to r3. */
2132	PDMQueueInsert(CTXSUFF(pData->pXmitQueue), pItem);
2133	# endif
2134	}
2135	#endif
2136
2137	}
2138
2139	/**
2140	* Poll for changes in RX and TX descriptor rings.
2141	*/
2142	static void pcnetPollRxTx(PCNetState *pData)
2143	{
2144	if (CSR_RXON(pData))
2145	if (HOST_IS_OWNER(CSR_CRST(pData))) /* Only poll RDTEs if none available */
2146	pcnetRdtePoll(pData);
2147
2148	if (CSR_TDMD(pData) \|\| CSR_TXON(pData) && !CSR_DPOLL(pData))
2149	pcnetTransmit(pData);
2150	}
2151
2152	/**
2153	* Update the poller timer
2154	* @thread EMT,
2155	*/
2156	static void pcnetPollTimer(PCNetState *pData)
2157	{
2158	STAM_PROFILE_ADV_START(&pData->StatPollTimer, a);
2159
2160	#ifdef LOG_ENABLED
2161	TMD dummy;
2162	Log2(("#%d pcnetPollTimer time=%08x TDMD=%d TXON=%d POLL=%d TDTE=%d TDRA=%x\n",
2163	PCNETSTATE_2_DEVINS(pData)->iInstance, RTTimeMilliTS(), CSR_TDMD(pData), CSR_TXON(pData),
2164	!CSR_DPOLL(pData), pcnetTdtePoll(pData, &dummy), pData->GCTDRA));
2165	Log2(("#%d pcnetPollTimer: CSR_CXDA=%x CSR_XMTRL=%d CSR_XMTRC=%d\n",
2166	PCNETSTATE_2_DEVINS(pData)->iInstance, CSR_CXDA(pData), CSR_XMTRL(pData), CSR_XMTRC(pData)));
2167	#endif
2168	#ifdef PCNET_DEBUG_TMD
2169	if (CSR_CXDA(pData))
2170	{
2171	TMD tmd;
2172	pcnetTmdLoad(pData, &tmd, PHYSADDR(pData, CSR_CXDA(pData)));
2173	Log2(("#%d pcnetPollTimer: TMDLOAD 0x%08x\n", PCNETSTATE_2_DEVINS(pData)->iInstance, PHYSADDR(pData, CSR_CXDA(pData))));
2174	PRINT_TMD(&tmd);
2175	}
2176	#endif
2177	if (CSR_TDMD(pData))
2178	pcnetTransmit(pData);
2179
2180	pcnetUpdateIrq(pData);
2181
2182	if (RT_LIKELY(!CSR_STOP(pData) && !CSR_SPND(pData) && !CSR_DPOLL(pData)))
2183	{
2184	/* We ensure that we poll at least every 2ms (500Hz) but not more often than
2185	* 5000 times per second. This way we completely prevent the overhead from
2186	* heavy reprogramming the timer which turned out to be very CPU-intensive.
2187	* The drawback is that csr46 and csr47 are not updated properly anymore
2188	* but so far I have not seen any guest depending on these values. The 2ms
2189	* interval is the default polling interval of the PCNet card (65536/33MHz). */
2190	#ifdef PCNET_NO_POLLING
2191	pcnetPollRxTx(pData);
2192	#else
2193	uint64_t u64Now = TMTimerGet(pData->CTXSUFF(pTimerPoll));
2194	if (RT_UNLIKELY(u64Now - pData->u64LastPoll > 200000))
2195	{
2196	pData->u64LastPoll = u64Now;
2197	pcnetPollRxTx(pData);
2198	}
2199	if (!TMTimerIsActive(pData->CTXSUFF(pTimerPoll)))
2200	/* Poll timer interval is fixed to 500Hz. Don't stop it. */
2201	TMTimerSet(pData->CTXSUFF(pTimerPoll),
2202	TMTimerGet(pData->CTXSUFF(pTimerPoll)) + 2000000);
2203	#endif
2204	}
2205	STAM_PROFILE_ADV_STOP(&pData->StatPollTimer, a);
2206	}
2207
2208
2209	static int pcnetCSRWriteU16(PCNetState *pData, uint32_t u32RAP, uint32_t new_value)
2210	{
2211	uint16_t val = new_value;
2212	int rc = VINF_SUCCESS;
2213	#ifdef PCNET_DEBUG_CSR
2214	Log(("#%d pcnetCSRWriteU16: rap=%d val=0x%04x\n", PCNETSTATE_2_DEVINS(pData)->iInstance, u32RAP, val));
2215	#endif
2216	switch (u32RAP)
2217	{
2218	case 0:
2219	{
2220	uint16_t csr0 = pData->aCSR[0];
2221	/* Clear any interrupt flags.
2222	* Don't clear an interrupt flag which was not seen by the guest yet. */
2223	csr0 &= ~(val & 0x7f00 & pData->u16CSR0LastSeenByGuest);
2224	csr0 = (csr0 & ~0x0040) \| (val & 0x0048);
2225	val = (val & 0x007f) \| (csr0 & 0x7f00);
2226
2227	/* Iff STOP, STRT and INIT are set, clear STRT and INIT */
2228	if ((val & 7) == 7)
2229	val &= ~3;
2230
2231	#ifndef IN_RING3
2232	if (!(csr0 & 0x0001/init/) && (val & 1))
2233	{
2234	Log(("#%d pcnetCSRWriteU16: pcnetInit requested => HC\n", PCNETSTATE_2_DEVINS(pData)->iInstance));
2235	return VINF_IOM_HC_IOPORT_WRITE;
2236	}
2237	#endif
2238	LOG_REGISTER(("PCNet#%d: WRITE CSR%d, %04x => %04x (%04x)\n",
2239	PCNETSTATE_2_DEVINS(pData)->iInstance,
2240	u32RAP, new_value, csr0, pData->aCSR[0]));
2241	pData->aCSR[0] = csr0;
2242
2243	if (!CSR_STOP(pData) && (val & 4))
2244	pcnetStop(pData);
2245
2246	#ifdef IN_RING3
2247	if (!CSR_INIT(pData) && (val & 1))
2248	pcnetInit(pData);
2249	#endif
2250
2251	if (!CSR_STRT(pData) && (val & 2))
2252	pcnetStart(pData);
2253
2254	if (CSR_TDMD(pData))
2255	pcnetTransmit(pData);
2256
2257	return rc;
2258	}
2259	case 1: /* IADRL */
2260	case 2: /* IADRH */
2261	case 8: /* LADRF 0..15 */
2262	case 9: /* LADRF 16..31 */
2263	case 10: /* LADRF 32..47 */
2264	case 11: /* LADRF 48..63 */
2265	case 12: /* PADR 0..15 */
2266	case 13: /* PADR 16..31 */
2267	case 14: /* PADR 32..47 */
2268	case 18: /* CRBAL */
2269	case 19: /* CRBAU */
2270	case 20: /* CXBAL */
2271	case 21: /* CXBAU */
2272	case 22: /* NRBAL */
2273	case 23: /* NRBAU */
2274	case 24: /* BADRL */
2275	case 25: /* BADRU */
2276	case 26: /* NRDAL */
2277	case 27: /* NRDAU */
2278	case 28: /* CRDAL */
2279	case 29: /* CRDAU */
2280	case 30: /* BADXL */
2281	case 31: /* BADXU */
2282	case 32: /* NXDAL */
2283	case 33: /* NXDAU */
2284	case 34: /* CXDAL */
2285	case 35: /* CXDAU */
2286	case 36: /* NNRDL */
2287	case 37: /* NNRDU */
2288	case 38: /* NNXDL */
2289	case 39: /* NNXDU */
2290	case 40: /* CRBCL */
2291	case 41: /* CRBCU */
2292	case 42: /* CXBCL */
2293	case 43: /* CXBCU */
2294	case 44: /* NRBCL */
2295	case 45: /* NRBCU */
2296	case 46: /* POLL */
2297	case 47: /* POLLINT */
2298	case 72: /* RCVRC */
2299	case 74: /* XMTRC */
2300	case 76: /* RCVRL / /* @todo call pcnetUpdateRingHandlers */
2301	/** @todo receive ring length is stored in two's complement! */
2302	case 78: /* XMTRL / /* @todo call pcnetUpdateRingHandlers */
2303	/** @todo transmit ring length is stored in two's complement! */
2304	case 112: /* MISSC */
2305	if (CSR_STOP(pData) \|\| CSR_SPND(pData))
2306	break;
2307	LOG_REGISTER(("PCNet#%d: WRITE CSR%d, %04x\n",
2308	PCNETSTATE_2_DEVINS(pData)->iInstance, u32RAP, val));
2309	return rc;
2310	case 3: /* Interrupt Mask and Deferral Control */
2311	LOG_REGISTER(("PCNet#%d: WRITE CSR%d, %04x\n",
2312	PCNETSTATE_2_DEVINS(pData)->iInstance, u32RAP, val));
2313	break;
2314	case 4: /* Test and Features Control */
2315	LOG_REGISTER(("PCNet#%d: WRITE CSR%d, %04x\n",
2316	PCNETSTATE_2_DEVINS(pData)->iInstance, u32RAP, val));
2317	pData->aCSR[4] &= ~(val & 0x026a);
2318	val &= ~0x026a;
2319	val \|= pData->aCSR[4] & 0x026a;
2320	break;
2321	case 5: /* Extended Control and Interrupt 1 */
2322	LOG_REGISTER(("PCNet#%d: WRITE CSR%d, %04x\n",
2323	PCNETSTATE_2_DEVINS(pData)->iInstance, u32RAP, val));
2324	pData->aCSR[5] &= ~(val & 0x0a90);
2325	val &= ~0x0a90;
2326	val \|= pData->aCSR[5] & 0x0a90;
2327	break;
2328	case 15: /* Mode */
2329	if ((pData->aCSR[15] & 0x8000) != (val & 0x8000) && pData->pDrv)
2330	{
2331	Log(("PCNet#%d: promiscuous mode changed to %d\n",
2332	PCNETSTATE_2_DEVINS(pData)->iInstance, !!(val & 0x8000)));
2333	#ifndef IN_RING3
2334	return VINF_IOM_HC_IOPORT_WRITE;
2335	#else
2336	/* check for promiscuous mode change */
2337	pData->pDrv->pfnSetPromiscuousMode(pData->pDrv, !!(val & 0x8000));
2338	#endif
2339	}
2340	break;
2341	case 16: /* IADRL */
2342	return pcnetCSRWriteU16(pData, 1, val);
2343	case 17: /* IADRH */
2344	return pcnetCSRWriteU16(pData, 2, val);
2345	case 58: /* Software Style */
2346	LOG_REGISTER(("PCNet#%d: WRITE SW_STYLE, %04x\n",
2347	PCNETSTATE_2_DEVINS(pData)->iInstance, val));
2348	rc = pcnetBCRWriteU16(pData, BCR_SWS, val);
2349	break;
2350	default:
2351	return rc;
2352	}
2353	pData->aCSR[u32RAP] = val;
2354	return rc;
2355	}
2356
2357	static uint32_t pcnetCSRReadU16(PCNetState *pData, uint32_t u32RAP)
2358	{
2359	uint32_t val;
2360	switch (u32RAP)
2361	{
2362	case 0:
2363	pcnetUpdateIrq(pData);
2364	val = pData->aCSR[0];
2365	val \|= (val & 0x7800) ? 0x8000 : 0;
2366	pData->u16CSR0LastSeenByGuest = val;
2367	break;
2368	case 16:
2369	return pcnetCSRReadU16(pData, 1);
2370	case 17:
2371	return pcnetCSRReadU16(pData, 2);
2372	case 58:
2373	return pcnetBCRReadU16(pData, BCR_SWS);
2374	case 88:
2375	val = pData->aCSR[89];
2376	val <<= 16;
2377	val \|= pData->aCSR[88];
2378	break;
2379	default:
2380	val = pData->aCSR[u32RAP];
2381	LOG_REGISTER(("PCNet#%d: read CSR%d => %04x\n",
2382	PCNETSTATE_2_DEVINS(pData)->iInstance, u32RAP, val));
2383	}
2384	#ifdef PCNET_DEBUG_CSR
2385	Log(("#%d pcnetCSRReadU16: u32RAP=%d val=0x%04x\n", PCNETSTATE_2_DEVINS(pData)->iInstance,
2386	u32RAP, val));
2387	#endif
2388	return val;
2389	}
2390
2391	static int pcnetBCRWriteU16(PCNetState *pData, uint32_t u32RAP, uint32_t val)
2392	{
2393	int rc = VINF_SUCCESS;
2394	u32RAP &= 0x7f;
2395	#ifdef PCNET_DEBUG_BCR
2396	Log(("#%d pcnetBCRWriteU16: u32RAP=%d val=0x%04x\n", PCNETSTATE_2_DEVINS(pData)->iInstance,
2397	u32RAP, val));
2398	#endif
2399	switch (u32RAP)
2400	{
2401	case BCR_SWS:
2402	if (!(CSR_STOP(pData) \|\| CSR_SPND(pData)))
2403	return rc;
2404	val &= ~0x0300;
2405	switch (val & 0x00ff)
2406	{
2407	default:
2408	Log(("Bad SWSTYLE=0x%02x\n", val & 0xff));
2409	// fall through
2410	case 0:
2411	val \|= 0x0200; /* 16 bit */
2412	pData->iLog2DescSize = 3;
2413	pData->GCUpperPhys = (0xff00 & (uint32_t)pData->aCSR[2]) << 16;
2414	break;
2415	case 1:
2416	val \|= 0x0100; /* 32 bit */
2417	pData->iLog2DescSize = 4;
2418	pData->GCUpperPhys = 0;
2419	break;
2420	case 2:
2421	case 3:
2422	val \|= 0x0300; /* 32 bit */
2423	pData->iLog2DescSize = 4;
2424	pData->GCUpperPhys = 0;
2425	break;
2426	}
2427	LOG_REGISTER(("PCNet#%d: WRITE SW_STYLE, %04x\n",
2428	PCNETSTATE_2_DEVINS(pData)->iInstance, val));
2429	Log(("BCR_SWS=0x%04x\n", val));
2430	pData->aCSR[58] = val;
2431	/* fall through */
2432	case BCR_LNKST:
2433	case BCR_LED1:
2434	case BCR_LED2:
2435	case BCR_LED3:
2436	case BCR_MC:
2437	case BCR_FDC:
2438	case BCR_BSBC:
2439	case BCR_EECAS:
2440	case BCR_PLAT:
2441	case BCR_MIIADDR:
2442	LOG_REGISTER(("PCNet#%d: WRITE BCR%d, %04x\n",
2443	PCNETSTATE_2_DEVINS(pData)->iInstance, u32RAP, val));
2444	pData->aBCR[u32RAP] = val;
2445	break;
2446
2447	case BCR_MIIMDR:
2448	LOG_REGISTER(("PCNet#%d: WRITE MII%d, %04x\n",
2449	PCNETSTATE_2_DEVINS(pData)->iInstance, u32RAP, val));
2450	pData->aMII[pData->aBCR[BCR_MIIADDR] & 0x1f] = val;
2451	break;
2452
2453	default:
2454	break;
2455	}
2456	return rc;
2457	}
2458
2459	static uint32_t pcnetMIIReadU16(PCNetState *pData, uint32_t miiaddr)
2460	{
2461	uint32_t val;
2462	STAM_COUNTER_INC(&pData->StatMIIReads);
2463
2464	switch (miiaddr)
2465	{
2466	case 0:
2467	/* MII basic mode control register. */
2468	val = 0x1000; /* Enable auto negotiation. */
2469	break;
2470
2471	case 1:
2472	/* MII basic mode status register. */
2473	if (pData->fLinkUp && !pData->fLinkTempDown)
2474	val = 0x7800 /* Can do 100mbps FD/HD and 10mbps FD/HD. */
2475	\| 0x0020 /* Auto-negotiation complete. */
2476	\| 0x0008 /* Able to do auto-negotiation. */
2477	\| 0x0004 /* Link status. */
2478	\| 0x0001; /* Extended Capability, i.e. registers 4+ valid. */
2479	else
2480	{
2481	val = 0x7800 /* Can do 100mbps FD/HD and 10mbps FD/HD. */
2482	\| 0x0008 /* Able to do auto-negotiation. */
2483	\| 0x0001; /* Extended Capability, i.e. registers 4+ valid. */
2484	pData->cLinkDownReported++;
2485	}
2486	break;
2487
2488	case 2:
2489	/* PHY identifier 1. */
2490	val = 0; /* No name PHY. */
2491	break;
2492
2493	case 3:
2494	/* PHY identifier 2. */
2495	val = 0; /* No name PHY. */
2496	break;
2497
2498	case 4:
2499	/* Advertisement control register. */
2500	val = 0x05e0 /* Try flow control, 100mbps FD/HD and 10mbps FD/HD. */
2501	\| 0x0001; /* CSMA selector. */
2502	break;
2503
2504	case 5:
2505	/* Link partner ability register. */
2506	if (pData->fLinkUp && !pData->fLinkTempDown)
2507	val = 0x8000 /* Next page bit. */
2508	\| 0x4000 /* Link partner acked us. */
2509	\| 0x05e0 /* Can do flow control, 100mbps FD/HD and 10mbps FD/HD. */
2510	\| 0x0001; /* Use CSMA selector. */
2511	else
2512	{
2513	val = 0;
2514	pData->cLinkDownReported++;
2515	}
2516	break;
2517
2518	case 6:
2519	/* Auto negotiation expansion register. */
2520	if (pData->fLinkUp && !pData->fLinkTempDown)
2521	val = 0x0008 /* Link partner supports npage. */
2522	\| 0x0004 /* Enable npage words. */
2523	\| 0x0001; /* Can do N-way auto-negotiation. */
2524	else
2525	{
2526	val = 0;
2527	pData->cLinkDownReported++;
2528	}
2529	break;
2530
2531	default:
2532	val = 0;
2533	break;
2534	}
2535
2536	#ifdef PCNET_DEBUG_MII
2537	Log(("#%d pcnet: mii read %d -> %#x\n", PCNETSTATE_2_DEVINS(pData)->iInstance,
2538	miiaddr, val));
2539	#endif
2540	return val;
2541	}
2542
2543	static uint32_t pcnetBCRReadU16(PCNetState *pData, uint32_t u32RAP)
2544	{
2545	uint32_t val;
2546	u32RAP &= 0x7f;
2547	switch (u32RAP)
2548	{
2549	case BCR_LNKST:
2550	case BCR_LED1:
2551	case BCR_LED2:
2552	case BCR_LED3:
2553	val = pData->aBCR[u32RAP] & ~0x8000;
2554	/* Clear LNKSTE if we're not connected or if we've just loaded a VM state. */
2555	if (!pData->pDrv \|\| pData->fLinkTempDown \|\| !pData->fLinkUp)
2556	{
2557	if (u32RAP == 4)
2558	pData->cLinkDownReported++;
2559	val &= ~0x40;
2560	}
2561	val \|= (val & 0x017f & pData->u32Lnkst) ? 0x8000 : 0;
2562	break;
2563
2564	case BCR_MIIMDR:
2565	if (pData->fAm79C973 && (pData->aBCR[BCR_MIIADDR] >> 5 & 0x1f) == 0)
2566	{
2567	size_t miiaddr = pData->aBCR[BCR_MIIADDR] & 0x1f;
2568	val = pcnetMIIReadU16(pData, miiaddr);
2569	}
2570	else
2571	val = 0xffff;
2572	break;
2573
2574	default:
2575	val = u32RAP < BCR_MAX_RAP ? pData->aBCR[u32RAP] : 0;
2576	break;
2577	}
2578	#ifdef PCNET_DEBUG_BCR
2579	Log(("#%d pcnetBCRReadU16: u32RAP=%d val=0x%04x\n", PCNETSTATE_2_DEVINS(pData)->iInstance,
2580	u32RAP, val));
2581	#endif
2582	return val;
2583	}
2584
2585	#ifdef IN_RING3 /* move down */
2586	static void pcnetHardReset(PCNetState *pData)
2587	{
2588	int i;
2589	uint16_t checksum;
2590
2591	/* Initialize the PROM */
2592	Assert(sizeof(pData->MacConfigured) == 6);
2593	memcpy(pData->aPROM, &pData->MacConfigured, sizeof(pData->MacConfigured));
2594	pData->aPROM[12] = pData->aPROM[13] = 0x00;
2595	pData->aPROM[14] = pData->aPROM[15] = 0x57;
2596
2597	for (i = 0, checksum = 0; i < 16; i++)
2598	checksum += pData->aPROM[i];
2599	(uint16_t )&pData->aPROM[12] = cpu_to_le16(checksum);
2600
2601	pData->aBCR[BCR_MSRDA] = 0x0005;
2602	pData->aBCR[BCR_MSWRA] = 0x0005;
2603	pData->aBCR[BCR_MC ] = 0x0002;
2604	pData->aBCR[BCR_LNKST] = 0x00c0;
2605	pData->aBCR[BCR_LED1 ] = 0x0084;
2606	pData->aBCR[BCR_LED2 ] = 0x0088;
2607	pData->aBCR[BCR_LED3 ] = 0x0090;
2608	pData->aBCR[BCR_FDC ] = 0x0000;
2609	pData->aBCR[BCR_BSBC ] = 0x9001;
2610	pData->aBCR[BCR_EECAS] = 0x0002;
2611	pData->aBCR[BCR_SWS ] = 0x0200;
2612	pData->iLog2DescSize = 3;
2613	pData->aBCR[BCR_PLAT ] = 0xff06;
2614
2615	pcnetSoftReset(pData);
2616	}
2617	#endif /* IN_RING3 */
2618
2619	static void pcnetAPROMWriteU8(PCNetState *pData, uint32_t addr, uint32_t val)
2620	{
2621	addr &= 0x0f;
2622	val &= 0xff;
2623	Log(("#%d pcnetAPROMWriteU8: addr=0x%08x val=0x%02x\n", PCNETSTATE_2_DEVINS(pData)->iInstance,
2624	addr, val));
2625	/* Check APROMWE bit to enable write access */
2626	if (pcnetBCRReadU16(pData, 2) & 0x80)
2627	pData->aPROM[addr] = val;
2628	}
2629
2630	static uint32_t pcnetAPROMReadU8(PCNetState *pData, uint32_t addr)
2631	{
2632	uint32_t val = pData->aPROM[addr &= 0x0f];
2633	Log(("#%d pcnetAPROMReadU8: addr=0x%08x val=0x%02x\n", PCNETSTATE_2_DEVINS(pData)->iInstance,
2634	addr, val));
2635	return val;
2636	}
2637
2638	static int pcnetIoportWriteU16(PCNetState *pData, uint32_t addr, uint32_t val)
2639	{
2640	int rc = VINF_SUCCESS;
2641
2642	#ifdef PCNET_DEBUG_IO
2643	Log(("#%d pcnetIoportWriteU16: addr=0x%08x val=0x%04x\n", PCNETSTATE_2_DEVINS(pData)->iInstance,
2644	addr, val));
2645	#endif
2646	if (!BCR_DWIO(pData))
2647	{
2648	switch (addr & 0x0f)
2649	{
2650	case 0x00: /* RDP */
2651	pcnetPollTimer(pData);
2652	rc = pcnetCSRWriteU16(pData, pData->u32RAP, val);
2653	pcnetUpdateIrq(pData);
2654	break;
2655	case 0x02: /* RAP */
2656	pData->u32RAP = val & 0x7f;
2657	break;
2658	case 0x06: /* BDP */
2659	rc = pcnetBCRWriteU16(pData, pData->u32RAP, val);
2660	break;
2661	}
2662	}
2663
2664	return rc;
2665	}
2666
2667	static uint32_t pcnetIoportReadU16(PCNetState pData, uint32_t addr, int pRC)
2668	{
2669	uint32_t val = ~0U;
2670
2671	*pRC = VINF_SUCCESS;
2672
2673	if (!BCR_DWIO(pData))
2674	{
2675	switch (addr & 0x0f)
2676	{
2677	case 0x00: /* RDP */
2678	pcnetPollTimer(pData);
2679	val = pcnetCSRReadU16(pData, pData->u32RAP);
2680	if (pData->u32RAP == 0) // pcnetUpdateIrq() already called by pcnetCSRReadU16()
2681	goto skip_update_irq;
2682	break;
2683	case 0x02: /* RAP */
2684	val = pData->u32RAP;
2685	goto skip_update_irq;
2686	case 0x04: /* RESET */
2687	pcnetSoftReset(pData);
2688	val = 0;
2689	break;
2690	case 0x06: /* BDP */
2691	val = pcnetBCRReadU16(pData, pData->u32RAP);
2692	break;
2693	}
2694	}
2695	pcnetUpdateIrq(pData);
2696
2697	skip_update_irq:
2698	#ifdef PCNET_DEBUG_IO
2699	Log(("#%d pcnetIoportReadU16: addr=0x%08x val=0x%04x\n", PCNETSTATE_2_DEVINS(pData)->iInstance,
2700	addr, val & 0xffff));
2701	#endif
2702	return val;
2703	}
2704
2705	static int pcnetIoportWriteU32(PCNetState *pData, uint32_t addr, uint32_t val)
2706	{
2707	int rc = VINF_SUCCESS;
2708
2709	#ifdef PCNET_DEBUG_IO
2710	Log(("#%d pcnetIoportWriteU32: addr=0x%08x val=0x%08x\n", PCNETSTATE_2_DEVINS(pData)->iInstance,
2711	addr, val));
2712	#endif
2713	if (RT_LIKELY(BCR_DWIO(pData)))
2714	{
2715	switch (addr & 0x0f)
2716	{
2717	case 0x00: /* RDP */
2718	pcnetPollTimer(pData);
2719	rc = pcnetCSRWriteU16(pData, pData->u32RAP, val & 0xffff);
2720	pcnetUpdateIrq(pData);
2721	break;
2722	case 0x04: /* RAP */
2723	pData->u32RAP = val & 0x7f;
2724	break;
2725	case 0x0c: /* BDP */
2726	rc = pcnetBCRWriteU16(pData, pData->u32RAP, val & 0xffff);
2727	break;
2728	}
2729	}
2730	else if (addr == 0)
2731	{
2732	/* switch device to dword I/O mode */
2733	pcnetBCRWriteU16(pData, BCR_BSBC, pcnetBCRReadU16(pData, BCR_BSBC) \| 0x0080);
2734	#ifdef PCNET_DEBUG_IO
2735	Log(("device switched into dword i/o mode\n"));
2736	#endif
2737	}
2738
2739	return rc;
2740	}
2741
2742	static uint32_t pcnetIoportReadU32(PCNetState pData, uint32_t addr, int pRC)
2743	{
2744	uint32_t val = ~0U;
2745
2746	*pRC = VINF_SUCCESS;
2747
2748	if (RT_LIKELY(BCR_DWIO(pData)))
2749	{
2750	switch (addr & 0x0f)
2751	{
2752	case 0x00: /* RDP */
2753	pcnetPollTimer(pData);
2754	val = pcnetCSRReadU16(pData, pData->u32RAP);
2755	if (pData->u32RAP == 0) // pcnetUpdateIrq() already called by pcnetCSRReadU16()
2756	goto skip_update_irq;
2757	break;
2758	case 0x04: /* RAP */
2759	val = pData->u32RAP;
2760	goto skip_update_irq;
2761	case 0x08: /* RESET */
2762	pcnetSoftReset(pData);
2763	val = 0;
2764	break;
2765	case 0x0c: /* BDP */
2766	val = pcnetBCRReadU16(pData, pData->u32RAP);
2767	break;
2768	}
2769	}
2770	pcnetUpdateIrq(pData);
2771
2772	skip_update_irq:
2773	#ifdef PCNET_DEBUG_IO
2774	Log(("#%d pcnetIoportReadU32: addr=0x%08x val=0x%08x\n", PCNETSTATE_2_DEVINS(pData)->iInstance,
2775	addr, val));
2776	#endif
2777	return val;
2778	}
2779
2780	static void pcnetMMIOWriteU8(PCNetState *pData, RTGCPHYS addr, uint32_t val)
2781	{
2782	#ifdef PCNET_DEBUG_IO
2783	Log(("#%d pcnetMMIOWriteU8: addr=0x%08x val=0x%02x\n", PCNETSTATE_2_DEVINS(pData)->iInstance,
2784	addr, val));
2785	#endif
2786	if (!(addr & 0x10))
2787	pcnetAPROMWriteU8(pData, addr, val);
2788	}
2789
2790	static uint32_t pcnetMMIOReadU8(PCNetState *pData, RTGCPHYS addr)
2791	{
2792	uint32_t val = ~0U;
2793	if (!(addr & 0x10))
2794	val = pcnetAPROMReadU8(pData, addr);
2795	#ifdef PCNET_DEBUG_IO
2796	Log(("#%d pcnetMMIOReadU8: addr=0x%08x val=0x%02x\n", PCNETSTATE_2_DEVINS(pData)->iInstance,
2797	addr, val & 0xff));
2798	#endif
2799	return val;
2800	}
2801
2802	static void pcnetMMIOWriteU16(PCNetState *pData, RTGCPHYS addr, uint32_t val)
2803	{
2804	#ifdef PCNET_DEBUG_IO
2805	Log(("#%d pcnetMMIOWriteU16: addr=0x%08x val=0x%04x\n", PCNETSTATE_2_DEVINS(pData)->iInstance,
2806	addr, val));
2807	#endif
2808	if (addr & 0x10)
2809	pcnetIoportWriteU16(pData, addr & 0x0f, val);
2810	else
2811	{
2812	pcnetAPROMWriteU8(pData, addr, val );
2813	pcnetAPROMWriteU8(pData, addr+1, val >> 8);
2814	}
2815	}
2816
2817	static uint32_t pcnetMMIOReadU16(PCNetState *pData, RTGCPHYS addr)
2818	{
2819	uint32_t val = ~0U;
2820	int rc;
2821
2822	if (addr & 0x10)
2823	val = pcnetIoportReadU16(pData, addr & 0x0f, &rc);
2824	else
2825	{
2826	val = pcnetAPROMReadU8(pData, addr+1);
2827	val <<= 8;
2828	val \|= pcnetAPROMReadU8(pData, addr);
2829	}
2830	#ifdef PCNET_DEBUG_IO
2831	Log(("#%d pcnetMMIOReadU16: addr=0x%08x val = 0x%04x\n", PCNETSTATE_2_DEVINS(pData)->iInstance,
2832	addr, val & 0xffff));
2833	#endif
2834	return val;
2835	}
2836
2837	static void pcnetMMIOWriteU32(PCNetState *pData, RTGCPHYS addr, uint32_t val)
2838	{
2839	#ifdef PCNET_DEBUG_IO
2840	Log(("#%d pcnetMMIOWriteU32: addr=0x%08x val=0x%08x\n", PCNETSTATE_2_DEVINS(pData)->iInstance,
2841	addr, val));
2842	#endif
2843	if (addr & 0x10)
2844	pcnetIoportWriteU32(pData, addr & 0x0f, val);
2845	else
2846	{
2847	pcnetAPROMWriteU8(pData, addr, val );
2848	pcnetAPROMWriteU8(pData, addr+1, val >> 8);
2849	pcnetAPROMWriteU8(pData, addr+2, val >> 16);
2850	pcnetAPROMWriteU8(pData, addr+3, val >> 24);
2851	}
2852	}
2853
2854	static uint32_t pcnetMMIOReadU32(PCNetState *pData, RTGCPHYS addr)
2855	{
2856	uint32_t val;
2857	int rc;
2858
2859	if (addr & 0x10)
2860	val = pcnetIoportReadU32(pData, addr & 0x0f, &rc);
2861	else
2862	{
2863	val = pcnetAPROMReadU8(pData, addr+3);
2864	val <<= 8;
2865	val \|= pcnetAPROMReadU8(pData, addr+2);
2866	val <<= 8;
2867	val \|= pcnetAPROMReadU8(pData, addr+1);
2868	val <<= 8;
2869	val \|= pcnetAPROMReadU8(pData, addr );
2870	}
2871	#ifdef PCNET_DEBUG_IO
2872	Log(("#%d pcnetMMIOReadU32: addr=0x%08x val=0x%08x\n", PCNETSTATE_2_DEVINS(pData)->iInstance,
2873	addr, val));
2874	#endif
2875	return val;
2876	}
2877
2878
2879	/**
2880	* Port I/O Handler for IN operations.
2881	*
2882	* @returns VBox status code.
2883	*
2884	* @param pDevIns The device instance.
2885	* @param pvUser User argument.
2886	* @param Port Port number used for the IN operation.
2887	* @param pu32 Where to store the result.
2888	* @param cb Number of bytes read.
2889	*/
2890	PDMBOTHCBDECL(int) pcnetIOPortAPromRead(PPDMDEVINS pDevIns, void *pvUser,
2891	RTIOPORT Port, uint32_t *pu32, unsigned cb)
2892	{
2893	PCNetState pData = PDMINS2DATA(pDevIns, PCNetState );
2894	int rc;
2895	if (cb == 1)
2896	{
2897	STAM_PROFILE_ADV_START(&pData->StatAPROMRead, a);
2898	rc = PDMCritSectEnter(&pData->CritSect, VINF_IOM_HC_IOPORT_WRITE);
2899	if (rc == VINF_SUCCESS)
2900	{
2901	*pu32 = pcnetAPROMReadU8(pData, Port);
2902	PDMCritSectLeave(&pData->CritSect);
2903	}
2904	STAM_PROFILE_ADV_STOP(&pData->StatAPROMRead, a);
2905	}
2906	else
2907	rc = VERR_IOM_IOPORT_UNUSED;
2908	LogFlow(("#%d pcnetIOPortAPromRead: Port=%RTiop *pu32=%#RX32 cb=%d rc=%Vrc\n",
2909	PCNETSTATE_2_DEVINS(pData)->iInstance, Port, *pu32, cb, rc));
2910	return rc;
2911	}
2912
2913
2914	/**
2915	* Port I/O Handler for OUT operations.
2916	*
2917	* @returns VBox status code.
2918	*
2919	* @param pDevIns The device instance.
2920	* @param pvUser User argument.
2921	* @param Port Port number used for the IN operation.
2922	* @param u32 The value to output.
2923	* @param cb The value size in bytes.
2924	*/
2925	PDMBOTHCBDECL(int) pcnetIOPortAPromWrite(PPDMDEVINS pDevIns, void *pvUser,
2926	RTIOPORT Port, uint32_t u32, unsigned cb)
2927	{
2928	PCNetState pData = PDMINS2DATA(pDevIns, PCNetState );
2929	int rc;
2930
2931	if (cb == 1)
2932	{
2933	STAM_PROFILE_ADV_START(&pData->StatAPROMWrite, a);
2934	rc = PDMCritSectEnter(&pData->CritSect, VINF_IOM_HC_IOPORT_WRITE);
2935	if (rc == VINF_SUCCESS)
2936	{
2937	pcnetAPROMWriteU8(pData, Port, u32);
2938	PDMCritSectLeave(&pData->CritSect);
2939	}
2940	STAM_PROFILE_ADV_STOP(&pData->StatAPROMWrite, a);
2941	}
2942	else
2943	{
2944	AssertMsgFailed(("Port=%#x cb=%d u32=%#x\n", Port, cb, u32));
2945	rc = VINF_SUCCESS;
2946	}
2947	LogFlow(("#%d pcnetIOPortAPromWrite: Port=%RTiop u32=%#RX32 cb=%d rc=%Vrc\n",
2948	PCNETSTATE_2_DEVINS(pData)->iInstance, Port, u32, cb, rc));
2949	return rc;
2950	}
2951
2952
2953	/**
2954	* Port I/O Handler for IN operations.
2955	*
2956	* @returns VBox status code.
2957	*
2958	* @param pDevIns The device instance.
2959	* @param pvUser User argument.
2960	* @param Port Port number used for the IN operation.
2961	* @param pu32 Where to store the result.
2962	* @param cb Number of bytes read.
2963	*/
2964	PDMBOTHCBDECL(int) pcnetIOPortRead(PPDMDEVINS pDevIns, void *pvUser,
2965	RTIOPORT Port, uint32_t *pu32, unsigned cb)
2966	{
2967	PCNetState pData = PDMINS2DATA(pDevIns, PCNetState );
2968	int rc = VINF_SUCCESS;
2969
2970	STAM_PROFILE_ADV_START(&pData->CTXSUFF(StatIORead), a);
2971	rc = PDMCritSectEnter(&pData->CritSect, VINF_IOM_HC_IOPORT_READ);
2972	if (rc == VINF_SUCCESS)
2973	{
2974	switch (cb)
2975	{
2976	case 2: *pu32 = pcnetIoportReadU16(pData, Port, &rc); break;
2977	case 4: *pu32 = pcnetIoportReadU32(pData, Port, &rc); break;
2978	default:
2979	rc = VERR_IOM_IOPORT_UNUSED;
2980	break;
2981	}
2982	PDMCritSectLeave(&pData->CritSect);
2983	}
2984	STAM_PROFILE_ADV_STOP(&pData->CTXSUFF(StatIORead), a);
2985	LogFlow(("#%d pcnetIOPortRead: Port=%RTiop *pu32=%#RX32 cb=%d rc=%Vrc\n",
2986	PCNETSTATE_2_DEVINS(pData)->iInstance, Port, *pu32, cb, rc));
2987	return rc;
2988	}
2989
2990
2991	/**
2992	* Port I/O Handler for OUT operations.
2993	*
2994	* @returns VBox status code.
2995	*
2996	* @param pDevIns The device instance.
2997	* @param pvUser User argument.
2998	* @param Port Port number used for the IN operation.
2999	* @param u32 The value to output.
3000	* @param cb The value size in bytes.
3001	*/
3002	PDMBOTHCBDECL(int) pcnetIOPortWrite(PPDMDEVINS pDevIns, void *pvUser,
3003	RTIOPORT Port, uint32_t u32, unsigned cb)
3004	{
3005	PCNetState pData = PDMINS2DATA(pDevIns, PCNetState );
3006	int rc = VINF_SUCCESS;
3007
3008	STAM_PROFILE_ADV_START(&pData->CTXSUFF(StatIOWrite), a);
3009	rc = PDMCritSectEnter(&pData->CritSect, VINF_IOM_HC_IOPORT_WRITE);
3010	if (rc == VINF_SUCCESS)
3011	{
3012	switch (cb)
3013	{
3014	case 2: rc = pcnetIoportWriteU16(pData, Port, u32); break;
3015	case 4: rc = pcnetIoportWriteU32(pData, Port, u32); break;
3016	default:
3017	AssertMsgFailed(("Port=%#x cb=%d u32=%#x\n", Port, cb, u32));
3018	rc = VERR_INTERNAL_ERROR;
3019	break;
3020	}
3021	PDMCritSectLeave(&pData->CritSect);
3022	}
3023	STAM_PROFILE_ADV_STOP(&pData->CTXSUFF(StatIOWrite), a);
3024	LogFlow(("#%d pcnetIOPortWrite: Port=%RTiop u32=%#RX32 cb=%d rc=%Vrc\n",
3025	PCNETSTATE_2_DEVINS(pData)->iInstance, Port, u32, cb, rc));
3026	return rc;
3027	}
3028
3029
3030	/**
3031	* Memory mapped I/O Handler for read operations.
3032	*
3033	* @returns VBox status code.
3034	*
3035	* @param pDevIns The device instance.
3036	* @param pvUser User argument.
3037	* @param GCPhysAddr Physical address (in GC) where the read starts.
3038	* @param pv Where to store the result.
3039	* @param cb Number of bytes read.
3040	*/
3041	PDMBOTHCBDECL(int) pcnetMMIORead(PPDMDEVINS pDevIns, void *pvUser,
3042	RTGCPHYS GCPhysAddr, void *pv, unsigned cb)
3043	{
3044	PCNetState pData = (PCNetState )pvUser;
3045	int rc = VINF_SUCCESS;
3046
3047	/*
3048	* We have to check the range, because we're page aligning the MMIO stuff presently.
3049	*/
3050	if (GCPhysAddr - pData->MMIOBase < PCNET_PNPMMIO_SIZE)
3051	{
3052	STAM_PROFILE_ADV_START(&pData->CTXSUFF(StatMMIORead), a);
3053	rc = PDMCritSectEnter(&pData->CritSect, VINF_IOM_HC_MMIO_READ);
3054	if (rc == VINF_SUCCESS)
3055	{
3056	switch (cb)
3057	{
3058	case 1: (uint8_t )pv = pcnetMMIOReadU8 (pData, GCPhysAddr); break;
3059	case 2: (uint16_t )pv = pcnetMMIOReadU16(pData, GCPhysAddr); break;
3060	case 4: (uint32_t )pv = pcnetMMIOReadU32(pData, GCPhysAddr); break;
3061	default:
3062	AssertMsgFailed(("cb=%d\n", cb));
3063	rc = VERR_INTERNAL_ERROR;
3064	break;
3065	}
3066	PDMCritSectLeave(&pData->CritSect);
3067	}
3068	STAM_PROFILE_ADV_STOP(&pData->CTXSUFF(StatMMIORead), a);
3069	}
3070	else
3071	memset(pv, 0, cb);
3072
3073	LogFlow(("#%d pcnetMMIORead: pvUser=%p:{%.*Rhxs} cb=%d GCPhysAddr=%RGp rc=%Vrc\n",
3074	PCNETSTATE_2_DEVINS(pData)->iInstance, pv, cb, pv, cb, GCPhysAddr, rc));
3075	return rc;
3076	}
3077
3078
3079	/**
3080	* Port I/O Handler for write operations.
3081	*
3082	* @returns VBox status code.
3083	*
3084	* @param pDevIns The device instance.
3085	* @param pvUser User argument.
3086	* @param GCPhysAddr Physical address (in GC) where the read starts.
3087	* @param pv Where to fetch the result.
3088	* @param cb Number of bytes to write.
3089	*/
3090	PDMBOTHCBDECL(int) pcnetMMIOWrite(PPDMDEVINS pDevIns, void *pvUser,
3091	RTGCPHYS GCPhysAddr, void *pv, unsigned cb)
3092	{
3093	PCNetState pData = (PCNetState )pvUser;
3094	int rc = VINF_SUCCESS;
3095
3096	/*
3097	* We have to check the range, because we're page aligning the MMIO stuff presently.
3098	*/
3099	if (GCPhysAddr - pData->MMIOBase < PCNET_PNPMMIO_SIZE)
3100	{
3101	STAM_PROFILE_ADV_START(&pData->CTXSUFF(StatMMIOWrite), a);
3102	rc = PDMCritSectEnter(&pData->CritSect, VINF_IOM_HC_MMIO_WRITE);
3103	if (rc == VINF_SUCCESS)
3104	{
3105	switch (cb)
3106	{
3107	case 1: pcnetMMIOWriteU8 (pData, GCPhysAddr, (uint8_t )pv); break;
3108	case 2: pcnetMMIOWriteU16(pData, GCPhysAddr, (uint16_t )pv); break;
3109	case 4: pcnetMMIOWriteU32(pData, GCPhysAddr, (uint32_t )pv); break;
3110	default:
3111	AssertMsgFailed(("cb=%d\n", cb));
3112	rc = VERR_INTERNAL_ERROR;
3113	break;
3114	}
3115	PDMCritSectLeave(&pData->CritSect);
3116	}
3117	// else rc == VINF_IOM_HC_MMIO_WRITE => handle in ring3
3118
3119	STAM_PROFILE_ADV_STOP(&pData->CTXSUFF(StatMMIOWrite), a);
3120	}
3121	LogFlow(("#%d pcnetMMIOWrite: pvUser=%p:{%.*Rhxs} cb=%d GCPhysAddr=%RGp rc=%Vrc\n",
3122	PCNETSTATE_2_DEVINS(pData)->iInstance, pv, cb, pv, cb, GCPhysAddr, rc));
3123	return rc;
3124	}
3125
3126
3127	#ifdef IN_RING3
3128	/**
3129	* Device timer callback function.
3130	*
3131	* @param pDevIns Device instance of the device which registered the timer.
3132	* @param pTimer The timer handle.
3133	* @thread EMT
3134	*/
3135	static DECLCALLBACK(void) pcnetTimer(PPDMDEVINS pDevIns, PTMTIMER pTimer)
3136	{
3137	PCNetState pData = PDMINS2DATA(pDevIns, PCNetState );
3138	int rc;
3139
3140	STAM_PROFILE_ADV_START(&pData->StatTimer, a);
3141	rc = PDMCritSectEnter(&pData->CritSect, VERR_PERMISSION_DENIED);
3142	AssertReleaseRC(rc);
3143
3144	pcnetPollTimer(pData);
3145
3146	PDMCritSectLeave(&pData->CritSect);
3147	STAM_PROFILE_ADV_STOP(&pData->StatTimer, a);
3148	}
3149
3150
3151	/**
3152	* Restore timer callback.
3153	*
3154	* This is only called when've restored a saved state and temporarily
3155	* disconnected the network link to inform the guest that network connections
3156	* should be considered lost.
3157	*
3158	* @param pDevIns Device instance of the device which registered the timer.
3159	* @param pTimer The timer handle.
3160	*/
3161	static DECLCALLBACK(void) pcnetTimerRestore(PPDMDEVINS pDevIns, PTMTIMER pTimer)
3162	{
3163	PCNetState pData = PDMINS2DATA(pDevIns, PCNetState );
3164	int rc = PDMCritSectEnter(&pData->CritSect, VERR_PERMISSION_DENIED);
3165	AssertReleaseRC(rc);
3166
3167	rc = VERR_GENERAL_FAILURE;
3168	if (pData->cLinkDownReported <= 3)
3169	rc = TMTimerSetMillies(pData->pTimerRestore, 1500);
3170	if (VBOX_FAILURE(rc))
3171	{
3172	pData->fLinkTempDown = false;
3173	if (pData->fLinkUp)
3174	{
3175	LogRel(("PCNet#%d: The link is back up again after the restore.\n",
3176	pDevIns->iInstance));
3177	Log(("#%d pcnetTimerRestore: Clearing ERR and CERR after load. cLinkDownReported=%d\n",
3178	pDevIns->iInstance, pData->cLinkDownReported));
3179	pData->aCSR[0] &= ~(BIT(15) \| BIT(13)); /* ERR \| CERR - probably not 100% correct either... */
3180	pData->Led.Actual.s.fError = 0;
3181	}
3182	}
3183	else
3184	Log(("#%d pcnetTimerRestore: cLinkDownReported=%d, wait another 1500ms...\n",
3185	pDevIns->iInstance, pData->cLinkDownReported));
3186
3187	PDMCritSectLeave(&pData->CritSect);
3188	}
3189
3190
3191	/**
3192	* Callback function for mapping an PCI I/O region.
3193	*
3194	* @return VBox status code.
3195	* @param pPciDev Pointer to PCI device. Use pPciDev->pDevIns to get the device instance.
3196	* @param iRegion The region number.
3197	* @param GCPhysAddress Physical address of the region. If iType is PCI_ADDRESS_SPACE_IO, this is an
3198	* I/O port, else it's a physical address.
3199	* This address is NOT relative to pci_mem_base like earlier!
3200	* @param cb Region size.
3201	* @param enmType One of the PCI_ADDRESS_SPACE_* values.
3202	*/
3203	static DECLCALLBACK(int) pcnetIOPortMap(PPCIDEVICE pPciDev, /unsigned/ int iRegion,
3204	RTGCPHYS GCPhysAddress, uint32_t cb, PCIADDRESSSPACE enmType)
3205	{
3206	int rc;
3207	PPDMDEVINS pDevIns = pPciDev->pDevIns;
3208	RTIOPORT Port = (RTIOPORT)GCPhysAddress;
3209	PCNetState *pData = PCIDEV_2_PCNETSTATE(pPciDev);
3210
3211	Assert(enmType == PCI_ADDRESS_SPACE_IO);
3212	Assert(cb >= 0x20);
3213
3214	rc = PDMDevHlpIOPortRegister(pDevIns, Port, 0x10, 0, pcnetIOPortAPromWrite,
3215	pcnetIOPortAPromRead, NULL, NULL, "PCNet ARPOM");
3216	if (VBOX_FAILURE(rc))
3217	return rc;
3218	rc = PDMDevHlpIOPortRegister(pDevIns, Port + 0x10, 0x10, 0, pcnetIOPortWrite,
3219	pcnetIOPortRead, NULL, NULL, "PCNet");
3220	if (VBOX_FAILURE(rc))
3221	return rc;
3222
3223	if (pData->fGCEnabled)
3224	{
3225	rc = PDMDevHlpIOPortRegisterGC(pDevIns, Port, 0x10, 0, "pcnetIOPortAPromWrite",
3226	"pcnetIOPortAPromRead", NULL, NULL, "PCNet aprom");
3227	if (VBOX_FAILURE(rc))
3228	return rc;
3229	rc = PDMDevHlpIOPortRegisterGC(pDevIns, Port + 0x10, 0x10, 0, "pcnetIOPortWrite",
3230	"pcnetIOPortRead", NULL, NULL, "PCNet");
3231	if (VBOX_FAILURE(rc))
3232	return rc;
3233	}
3234	if (pData->fR0Enabled)
3235	{
3236	rc = PDMDevHlpIOPortRegisterR0(pDevIns, Port, 0x10, 0, "pcnetIOPortAPromWrite",
3237	"pcnetIOPortAPromRead", NULL, NULL, "PCNet aprom");
3238	if (VBOX_FAILURE(rc))
3239	return rc;
3240	rc = PDMDevHlpIOPortRegisterR0(pDevIns, Port + 0x10, 0x10, 0, "pcnetIOPortWrite",
3241	"pcnetIOPortRead", NULL, NULL, "PCNet");
3242	if (VBOX_FAILURE(rc))
3243	return rc;
3244	}
3245
3246	pData->IOPortBase = Port;
3247	return VINF_SUCCESS;
3248	}
3249
3250
3251	/**
3252	* Callback function for mapping the MMIO region.
3253	*
3254	* @return VBox status code.
3255	* @param pPciDev Pointer to PCI device. Use pPciDev->pDevIns to get the device instance.
3256	* @param iRegion The region number.
3257	* @param GCPhysAddress Physical address of the region. If iType is PCI_ADDRESS_SPACE_IO, this is an
3258	* I/O port, else it's a physical address.
3259	* This address is NOT relative to pci_mem_base like earlier!
3260	* @param cb Region size.
3261	* @param enmType One of the PCI_ADDRESS_SPACE_* values.
3262	*/
3263	static DECLCALLBACK(int) pcnetMMIOMap(PPCIDEVICE pPciDev, /unsigned/ int iRegion,
3264	RTGCPHYS GCPhysAddress, uint32_t cb, PCIADDRESSSPACE enmType)
3265	{
3266	PCNetState *pData = PCIDEV_2_PCNETSTATE(pPciDev);
3267	int rc;
3268
3269	Assert(enmType == PCI_ADDRESS_SPACE_MEM);
3270	Assert(cb >= PCNET_PNPMMIO_SIZE);
3271
3272	/* We use the assigned size here, because we currently only support page aligned MMIO ranges. */
3273	rc = PDMDevHlpMMIORegister(pPciDev->pDevIns, GCPhysAddress, cb, pData,
3274	pcnetMMIOWrite, pcnetMMIORead, NULL, "PCNet");
3275	if (VBOX_FAILURE(rc))
3276	return rc;
3277	pData->MMIOBase = GCPhysAddress;
3278	return rc;
3279	}
3280
3281
3282	/**
3283	* PCNET status info callback.
3284	*
3285	* @param pDevIns The device instance.
3286	* @param pHlp The output helpers.
3287	* @param pszArgs The arguments.
3288	*/
3289	static DECLCALLBACK(void) pcnetInfo(PPDMDEVINS pDevIns, PCDBGFINFOHLP pHlp, const char *pszArgs)
3290	{
3291	PCNetState pData = PDMINS2DATA(pDevIns, PCNetState );
3292	bool fRcvRing = false;
3293	bool fXmtRing = false;
3294
3295	/*
3296	* Parse args.
3297	*/
3298	if (pszArgs)
3299	{
3300	fRcvRing = strstr(pszArgs, "verbose") \|\| strstr(pszArgs, "rcv");
3301	fXmtRing = strstr(pszArgs, "verbose") \|\| strstr(pszArgs, "xmt");
3302	}
3303
3304	/*
3305	* Show info.
3306	*/
3307	pHlp->pfnPrintf(pHlp,
3308	"pcnet #%d: port=%RTiop mmio=%RGp mac-cfg=%.*Rhxs %s\n",
3309	pDevIns->iInstance,
3310	pData->IOPortBase, pData->MMIOBase, sizeof(pData->MacConfigured), &pData->MacConfigured,
3311	pData->fAm79C973 ? "Am79C973" : "Am79C970A", pData->fGCEnabled ? " GC" : "", pData->fR0Enabled ? " R0" : "");
3312
3313	PDMCritSectEnter(&pData->CritSect, VERR_INTERNAL_ERROR); /* Take it here so we know why we're hanging... */
3314
3315	pHlp->pfnPrintf(pHlp,
3316	"CSR0=%04RX32:\n",
3317	pData->aCSR[0]);
3318
3319	pHlp->pfnPrintf(pHlp,
3320	"CSR1=%04RX32:\n",
3321	pData->aCSR[1]);
3322
3323	pHlp->pfnPrintf(pHlp,
3324	"CSR2=%04RX32:\n",
3325	pData->aCSR[2]);
3326
3327	pHlp->pfnPrintf(pHlp,
3328	"CSR3=%04RX32: BSWP=%d EMBA=%d DXMT2PD=%d LAPPEN=%d DXSUFLO=%d IDONM=%d TINTM=%d RINTM=%d MERRM=%d MISSM=%d BABLM=%d\n",
3329	pData->aCSR[3],
3330	!!(pData->aCSR[3] & BIT(2)), !!(pData->aCSR[3] & BIT(3)), !!(pData->aCSR[3] & BIT(4)), CSR_LAPPEN(pData),
3331	CSR_DXSUFLO(pData), !!(pData->aCSR[3] & BIT(8)), !!(pData->aCSR[3] & BIT(9)), !!(pData->aCSR[3] & BIT(10)),
3332	!!(pData->aCSR[3] & BIT(11)), !!(pData->aCSR[3] & BIT(12)), !!(pData->aCSR[3] & BIT(14)));
3333
3334	pHlp->pfnPrintf(pHlp,
3335	"CSR4=%04RX32: JABM=%d JAB=%d TXSTRM=%d TXSTRT=%d RCVCOOM=%d RCVCCO=%d UINT=%d UINTCMD=%d\n"
3336	" MFCOM=%d MFCO=%d ASTRP_RCV=%d APAD_XMT=%d DPOLL=%d TIMER=%d EMAPLUS=%d EN124=%d\n",
3337	pData->aCSR[4],
3338	!!(pData->aCSR[4] & BIT( 0)), !!(pData->aCSR[4] & BIT( 1)), !!(pData->aCSR[4] & BIT( 2)), !!(pData->aCSR[4] & BIT( 3)),
3339	!!(pData->aCSR[4] & BIT( 4)), !!(pData->aCSR[4] & BIT( 5)), !!(pData->aCSR[4] & BIT( 6)), !!(pData->aCSR[4] & BIT( 7)),
3340	!!(pData->aCSR[4] & BIT( 8)), !!(pData->aCSR[4] & BIT( 9)), !!(pData->aCSR[4] & BIT(10)), !!(pData->aCSR[4] & BIT(11)),
3341	!!(pData->aCSR[4] & BIT(12)), !!(pData->aCSR[4] & BIT(13)), !!(pData->aCSR[4] & BIT(14)), !!(pData->aCSR[4] & BIT(15)));
3342
3343	pHlp->pfnPrintf(pHlp,
3344	"CSR5=%04RX32:\n",
3345	pData->aCSR[5]);
3346
3347	pHlp->pfnPrintf(pHlp,
3348	"CSR6=%04RX32: RLEN=%03x* TLEN=%03x* [* encoded]\n",
3349	pData->aCSR[6],
3350	(pData->aCSR[6] >> 8) & 0xf, (pData->aCSR[6] >> 12) & 0xf);
3351
3352	pHlp->pfnPrintf(pHlp,
3353	"CSR8..11=%04RX32,%04RX32,%04RX32,%04RX32: LADRF=%016RX64\n",
3354	pData->aCSR[8], pData->aCSR[9], pData->aCSR[10], pData->aCSR[11],
3355	(uint64_t)(pData->aCSR[ 8] & 0xffff)
3356	\| (uint64_t)(pData->aCSR[ 9] & 0xffff) << 16
3357	\| (uint64_t)(pData->aCSR[10] & 0xffff) << 32
3358	\| (uint64_t)(pData->aCSR[11] & 0xffff) << 48);
3359
3360	pHlp->pfnPrintf(pHlp,
3361	"CSR12..14=%04RX32,%04RX32,%04RX32: PADR=%02x %02x %02x %02x %02x %02x (Current MAC Address)\n",
3362	pData->aCSR[12], pData->aCSR[13], pData->aCSR[14],
3363	pData->aCSR[12] & 0xff,
3364	(pData->aCSR[12] >> 8) & 0xff,
3365	pData->aCSR[13] & 0xff,
3366	(pData->aCSR[13] >> 8) & 0xff,
3367	pData->aCSR[14] & 0xff,
3368	(pData->aCSR[14] >> 8) & 0xff);
3369
3370	pHlp->pfnPrintf(pHlp,
3371	"CSR15=%04RX32: DXR=%d DTX=%d LOOP=%d DXMTFCS=%d FCOLL=%d DRTY=%d INTL=%d PORTSEL=%d LTR=%d\n"
3372	" MENDECL=%d DAPC=%d DLNKTST=%d DRCVPV=%d DRCVBC=%d PROM=%d\n",
3373	pData->aCSR[15],
3374	!!(pData->aCSR[15] & BIT( 0)), !!(pData->aCSR[15] & BIT( 1)), !!(pData->aCSR[15] & BIT( 2)), !!(pData->aCSR[15] & BIT( 3)),
3375	!!(pData->aCSR[15] & BIT( 4)), !!(pData->aCSR[15] & BIT( 5)), !!(pData->aCSR[15] & BIT( 6)), (pData->aCSR[15] >> 7) & 3,
3376	!!(pData->aCSR[15] & BIT( 9)), !!(pData->aCSR[15] & BIT(10)), !!(pData->aCSR[15] & BIT(11)),
3377	!!(pData->aCSR[15] & BIT(12)), !!(pData->aCSR[15] & BIT(13)), !!(pData->aCSR[15] & BIT(14)), !!(pData->aCSR[15] & BIT(15)));
3378
3379	pHlp->pfnPrintf(pHlp,
3380	"CSR46=%04RX32: POLL=%04x (Poll Time Counter)\n",
3381	pData->aCSR[46], pData->aCSR[46] & 0xffff);
3382
3383	pHlp->pfnPrintf(pHlp,
3384	"CSR47=%04RX32: POLLINT=%04x (Poll Time Interval)\n",
3385	pData->aCSR[47], pData->aCSR[47] & 0xffff);
3386
3387	pHlp->pfnPrintf(pHlp,
3388	"CSR58=%04RX32: SWSTYLE=%02x %s SSIZE32=%d CSRPCNET=%d APERRENT=%d\n",
3389	pData->aCSR[58],
3390	pData->aCSR[58] & 0x7f,
3391	(pData->aCSR[58] & 0x7f) == 0 ? "C-LANCE / PCnet-ISA"
3392	: (pData->aCSR[58] & 0x7f) == 1 ? "ILACC"
3393	: (pData->aCSR[58] & 0x7f) == 2 ? "PCNet-PCI II"
3394	: (pData->aCSR[58] & 0x7f) == 3 ? "PCNet-PCI II controller"
3395	: "!!reserved!!",
3396	!!(pData->aCSR[58] & BIT(8)), !!(pData->aCSR[58] & BIT(9)), !!(pData->aCSR[58] & BIT(10)));
3397
3398	pHlp->pfnPrintf(pHlp,
3399	"CSR112=%04RX32: MFC=%04x (Missed receive Frame Count)\n",
3400	pData->aCSR[112], pData->aCSR[112] & 0xffff);
3401
3402	pHlp->pfnPrintf(pHlp,
3403	"CSR122=%04RX32: RCVALGN=%04x (Receive Frame Align)\n",
3404	pData->aCSR[122], !!(pData->aCSR[122] & BIT(0)));
3405
3406	pHlp->pfnPrintf(pHlp,
3407	"CSR124=%04RX32: RPA=%04x (Runt Packet Accept)\n",
3408	pData->aCSR[122], !!(pData->aCSR[122] & BIT(3)));
3409
3410
3411	/*
3412	* Dump the receive ring.
3413	*/
3414	pHlp->pfnPrintf(pHlp,
3415	"RCVRL=%04x RCVRC=%04x GCRDRA=%RX32 \n"
3416	"CRDA=%08RX32 CRBA=%08RX32 CRBC=%03x CRST=%04x\n"
3417	"NRDA=%08RX32 NRBA=%08RX32 NRBC=%03x NRST=%04x\n"
3418	"NNRDA=%08RX32\n"
3419	,
3420	CSR_RCVRL(pData), CSR_RCVRC(pData), pData->GCRDRA,
3421	CSR_CRDA(pData), CSR_CRBA(pData), CSR_CRBC(pData), CSR_CRST(pData),
3422	CSR_NRDA(pData), CSR_NRBA(pData), CSR_NRBC(pData), CSR_NRST(pData),
3423	CSR_NNRD(pData));
3424	if (fRcvRing)
3425	{
3426	const unsigned cb = 1 << pData->iLog2DescSize;
3427	RTGCPHYS GCPhys = pData->GCRDRA;
3428	unsigned i = CSR_RCVRL(pData);
3429	while (i-- > 0)
3430	{
3431	RMD rmd;
3432	pcnetRmdLoad(pData, &rmd, PHYSADDR(pData, GCPhys));
3433	pHlp->pfnPrintf(pHlp,
3434	"%04x %RGp:%c%c RBADR=%08RX32 BCNT=%03x MCNT=%03x "
3435	"OWN=%d ERR=%d FRAM=%d OFLO=%d CRC=%d BUFF=%d STP=%d ENP=%d BPE=%d "
3436	"PAM=%d LAFM=%d BAM=%d RCC=%02x RPC=%02x ONES=%x ZEROS=%d\n",
3437	i, GCPhys, i + 1 == CSR_RCVRC(pData) ? '' : ' ', GCPhys == CSR_CRDA(pData) ? '' : ' ',
3438	rmd.rmd0.rbadr, 4096 - rmd.rmd1.bcnt, rmd.rmd2.mcnt,
3439	rmd.rmd1.own, rmd.rmd1.err, rmd.rmd1.fram, rmd.rmd1.oflo, rmd.rmd1.crc, rmd.rmd1.buff,
3440	rmd.rmd1.stp, rmd.rmd1.enp, rmd.rmd1.bpe,
3441	rmd.rmd1.pam, rmd.rmd1.lafm, rmd.rmd1.bam, rmd.rmd2.rcc, rmd.rmd2.rpc,
3442	rmd.rmd1.ones, rmd.rmd2.zeros);
3443
3444	GCPhys += cb;
3445	}
3446	}
3447
3448	/*
3449	* Dump the transmit ring.
3450	*/
3451	pHlp->pfnPrintf(pHlp,
3452	"XMTRL=%04x XMTRC=%04x GCTDRA=%08RX32 BADX=%08RX32\n"
3453	"PXDA=%08RX32 PXBC=%03x PXST=%04x\n"
3454	"CXDA=%08RX32 CXBA=%08RX32 CXBC=%03x CXST=%04x\n"
3455	"NXDA=%08RX32 NXBA=%08RX32 NXBC=%03x NXST=%04x\n"
3456	"NNXDA=%08RX32\n"
3457	,
3458	CSR_XMTRL(pData), CSR_XMTRC(pData),
3459	pData->GCTDRA, CSR_BADX(pData),
3460	CSR_PXDA(pData), CSR_PXBC(pData), CSR_PXST(pData),
3461	CSR_CXDA(pData), CSR_CXBA(pData), CSR_CXBC(pData), CSR_CXST(pData),
3462	CSR_NXDA(pData), CSR_NXBA(pData), CSR_NXBC(pData), CSR_NXST(pData),
3463	CSR_NNXD(pData));
3464	if (fXmtRing)
3465	{
3466	const unsigned cb = 1 << pData->iLog2DescSize;
3467	RTGCPHYS GCPhys = pData->GCTDRA;
3468	unsigned i = CSR_RCVRL(pData);
3469	while (i-- > 0)
3470	{
3471	TMD tmd;
3472	pcnetTmdLoad(pData, &tmd, PHYSADDR(pData, GCPhys));
3473	pHlp->pfnPrintf(pHlp,
3474	"%04x %RGp:%c%c TBADR=%08RX32 BCNT=%03x OWN=%d "
3475	"ERR=%d NOFCS=%d LTINT=%d ONE=%d DEF=%d STP=%d ENP=%d BPE=%d "
3476	"BUFF=%d UFLO=%d EXDEF=%d LCOL=%d LCAR=%d RTRY=%d TDR=%03x TRC=%x ONES=%x\n"
3477	,
3478	i, GCPhys, i + 1 == CSR_XMTRC(pData) ? '' : ' ', GCPhys == CSR_CXDA(pData) ? '' : ' ',
3479	tmd.tmd0.tbadr, 4096 - tmd.tmd1.bcnt,
3480	tmd.tmd2.tdr,
3481	tmd.tmd2.trc,
3482	tmd.tmd1.own,
3483	tmd.tmd1.err,
3484	tmd.tmd1.nofcs,
3485	tmd.tmd1.ltint,
3486	tmd.tmd1.one,
3487	tmd.tmd1.def,
3488	tmd.tmd1.stp,
3489	tmd.tmd1.enp,
3490	tmd.tmd1.bpe,
3491	tmd.tmd2.buff,
3492	tmd.tmd2.uflo,
3493	tmd.tmd2.exdef,
3494	tmd.tmd2.lcol,
3495	tmd.tmd2.lcar,
3496	tmd.tmd2.rtry,
3497	tmd.tmd2.tdr,
3498	tmd.tmd2.trc,
3499	tmd.tmd1.ones);
3500
3501	GCPhys += cb;
3502	}
3503	}
3504
3505	PDMCritSectLeave(&pData->CritSect);
3506	}
3507
3508
3509	/**
3510	* Saves a state of the PC-Net II device.
3511	*
3512	* @returns VBox status code.
3513	* @param pDevIns The device instance.
3514	* @param pSSMHandle The handle to save the state to.
3515	*/
3516	static DECLCALLBACK(int) pcnetSaveExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSMHandle)
3517	{
3518	PCNetState pData = PDMINS2DATA(pDevIns, PCNetState );
3519
3520	SSMR3PutBool(pSSMHandle, pData->fLinkUp);
3521	SSMR3PutU32(pSSMHandle, pData->u32RAP);
3522	SSMR3PutS32(pSSMHandle, pData->iISR);
3523	SSMR3PutU32(pSSMHandle, pData->u32Lnkst);
3524	SSMR3PutGCPhys(pSSMHandle, pData->GCRDRA);
3525	SSMR3PutGCPhys(pSSMHandle, pData->GCTDRA);
3526	SSMR3PutMem(pSSMHandle, pData->aPROM, sizeof(pData->aPROM));
3527	SSMR3PutMem(pSSMHandle, pData->aCSR, sizeof(pData->aCSR));
3528	SSMR3PutMem(pSSMHandle, pData->aBCR, sizeof(pData->aBCR));
3529	SSMR3PutMem(pSSMHandle, pData->aMII, sizeof(pData->aMII));
3530	SSMR3PutU64(pSSMHandle, pData->u64LastPoll);
3531	SSMR3PutMem(pSSMHandle, &pData->MacConfigured, sizeof(pData->MacConfigured));
3532	SSMR3PutBool(pSSMHandle, pData->fAm79C973);
3533	#ifdef PCNET_NO_POLLING
3534	return VINF_SUCCESS;
3535	#else
3536	return TMR3TimerSave(pData->CTXSUFF(pTimerPoll), pSSMHandle);
3537	#endif
3538	}
3539
3540
3541	/**
3542	* Loads a saved PC-Net II device state.
3543	*
3544	* @returns VBox status code.
3545	* @param pDevIns The device instance.
3546	* @param pSSMHandle The handle to the saved state.
3547	* @param u32Version The data unit version number.
3548	*/
3549	static DECLCALLBACK(int) pcnetLoadExec(PPDMDEVINS pDevIns, PSSMHANDLE pSSMHandle, uint32_t u32Version)
3550	{
3551	PCNetState pData = PDMINS2DATA(pDevIns, PCNetState );
3552	PDMMAC Mac;
3553	if (u32Version != PCNET_SAVEDSTATE_VERSION)
3554	return VERR_SSM_UNSUPPORTED_DATA_UNIT_VERSION;
3555
3556	/* restore data */
3557	SSMR3GetBool(pSSMHandle, &pData->fLinkUp);
3558	SSMR3GetU32(pSSMHandle, &pData->u32RAP);
3559	SSMR3GetS32(pSSMHandle, &pData->iISR);
3560	SSMR3GetU32(pSSMHandle, &pData->u32Lnkst);
3561	SSMR3GetGCPhys(pSSMHandle, &pData->GCRDRA);
3562	SSMR3GetGCPhys(pSSMHandle, &pData->GCTDRA);
3563	SSMR3GetMem(pSSMHandle, &pData->aPROM, sizeof(pData->aPROM));
3564	SSMR3GetMem(pSSMHandle, &pData->aCSR, sizeof(pData->aCSR));
3565	SSMR3GetMem(pSSMHandle, &pData->aBCR, sizeof(pData->aBCR));
3566	SSMR3GetMem(pSSMHandle, &pData->aMII, sizeof(pData->aMII));
3567	SSMR3GetU64(pSSMHandle, &pData->u64LastPoll);
3568	SSMR3GetMem(pSSMHandle, &Mac, sizeof(Mac));
3569	Assert(!memcmp(&Mac, &pData->MacConfigured, sizeof(Mac)));
3570	SSMR3GetBool(pSSMHandle, &pData->fAm79C973);
3571	#ifndef PCNET_NO_POLLING
3572	TMR3TimerLoad(pData->CTXSUFF(pTimerPoll), pSSMHandle);
3573	#endif
3574
3575	pData->iLog2DescSize = BCR_SWSTYLE(pData)
3576	? 4
3577	: 3;
3578	pData->GCUpperPhys = BCR_SSIZE32(pData)
3579	? 0
3580	: (0xff00 & (uint32_t)pData->aCSR[2]) << 16;
3581
3582	/* Initialize stuff we don't store. */
3583	pData->iFrame = 0;
3584
3585	/* update promiscuous mode. */
3586	if (pData->pDrv)
3587	pData->pDrv->pfnSetPromiscuousMode(pData->pDrv, CSR_PROM(pData));
3588
3589	#ifdef PCNET_NO_POLLING
3590	/* Enable physical monitoring again (!) */
3591	pcnetUpdateRingHandlers(pData);
3592	#endif
3593	/* Indicate link down to the guest OS that all network connections have been lost. */
3594	if (pData->fLinkUp)
3595	{
3596	pData->fLinkTempDown = true;
3597	pData->cLinkDownReported = 0;
3598	pData->aCSR[0] \|= BIT(15) \| BIT(13); /* ERR \| CERR (this is probably wrong) */
3599	pData->Led.Asserted.s.fError = pData->Led.Actual.s.fError = 1;
3600	return TMTimerSetMillies(pData->pTimerRestore, 5000);
3601	}
3602	return VINF_SUCCESS;
3603	}
3604
3605
3606	/**
3607	* Queries an interface to the driver.
3608	*
3609	* @returns Pointer to interface.
3610	* @returns NULL if the interface was not supported by the driver.
3611	* @param pInterface Pointer to this interface structure.
3612	* @param enmInterface The requested interface identification.
3613	* @thread Any thread.
3614	*/
3615	static DECLCALLBACK(void ) pcnetQueryInterface(struct PDMIBASE pInterface, PDMINTERFACE enmInterface)
3616	{
3617	PCNetState pData = (PCNetState )((uintptr_t)pInterface - RT_OFFSETOF(PCNetState, IBase));
3618	Assert(&pData->IBase == pInterface);
3619	switch (enmInterface)
3620	{
3621	case PDMINTERFACE_BASE:
3622	return &pData->IBase;
3623	case PDMINTERFACE_NETWORK_PORT:
3624	return &pData->INetworkPort;
3625	case PDMINTERFACE_NETWORK_CONFIG:
3626	return &pData->INetworkConfig;
3627	case PDMINTERFACE_LED_PORTS:
3628	return &pData->ILeds;
3629	default:
3630	return NULL;
3631	}
3632	}
3633
3634	/** Converts a pointer to PCNetState::INetworkPort to a PCNetState pointer. */
3635	#define INETWORKPORT_2_DATA(pInterface) ( (PCNetState *)((uintptr_t)pInterface - RT_OFFSETOF(PCNetState, INetworkPort)) )
3636
3637
3638	/**
3639	* Check if the device/driver can receive data now.
3640	* This must be called before the pfnRecieve() method is called.
3641	*
3642	* @returns Number of bytes the driver can receive.
3643	* @param pInterface Pointer to the interface structure containing the called function pointer.
3644	* @thread EMT
3645	*/
3646	static DECLCALLBACK(size_t) pcnetCanReceive(PPDMINETWORKPORT pInterface)
3647	{
3648	size_t cb;
3649	int rc;
3650	PCNetState *pData = INETWORKPORT_2_DATA(pInterface);
3651
3652	rc = PDMCritSectEnter(&pData->CritSect, VERR_PERMISSION_DENIED);
3653	AssertReleaseRC(rc);
3654
3655	cb = pcnetCanReceiveNoSync(pData);
3656
3657	PDMCritSectLeave(&pData->CritSect);
3658	return cb;
3659	}
3660
3661
3662	/**
3663	* Receive data from the network.
3664	*
3665	* @returns VBox status code.
3666	* @param pInterface Pointer to the interface structure containing the called function pointer.
3667	* @param pvBuf The available data.
3668	* @param cb Number of bytes available in the buffer.
3669	* @thread EMT
3670	*/
3671	static DECLCALLBACK(int) pcnetReceive(PPDMINETWORKPORT pInterface, const void *pvBuf, size_t cb)
3672	{
3673	PCNetState *pData = INETWORKPORT_2_DATA(pInterface);
3674	int rc;
3675
3676	STAM_PROFILE_ADV_START(&pData->StatReceive, a);
3677	rc = PDMCritSectEnter(&pData->CritSect, VERR_PERMISSION_DENIED);
3678	AssertReleaseRC(rc);
3679
3680	if (cb > 70) /* unqualified guess */
3681	pData->Led.Asserted.s.fReading = pData->Led.Actual.s.fReading = 1;
3682	pcnetReceiveNoSync(pData, (const uint8_t*)pvBuf, cb);
3683	pData->Led.Actual.s.fReading = 0;
3684
3685	PDMCritSectLeave(&pData->CritSect);
3686	STAM_PROFILE_ADV_STOP(&pData->StatReceive, a);
3687
3688	return VINF_SUCCESS;
3689	}
3690
3691	/** Converts a pointer to PCNetState::INetworkConfig to a PCNetState pointer. */
3692	#define INETWORKCONFIG_2_DATA(pInterface) ( (PCNetState *)((uintptr_t)pInterface - RT_OFFSETOF(PCNetState, INetworkConfig)) )
3693
3694
3695	/**
3696	* Gets the current Media Access Control (MAC) address.
3697	*
3698	* @returns VBox status code.
3699	* @param pInterface Pointer to the interface structure containing the called function pointer.
3700	* @param pMac Where to store the MAC address.
3701	* @thread EMT
3702	*/
3703	static DECLCALLBACK(int) pcnetGetMac(PPDMINETWORKCONFIG pInterface, PPDMMAC *pMac)
3704	{
3705	PCNetState *pData = INETWORKCONFIG_2_DATA(pInterface);
3706	memcpy(pMac, pData->aPROM, sizeof(*pMac));
3707	return VINF_SUCCESS;
3708	}
3709
3710
3711	/**
3712	* Gets the new link state.
3713	*
3714	* @returns The current link state.
3715	* @param pInterface Pointer to the interface structure containing the called function pointer.
3716	* @thread EMT
3717	*/
3718	static DECLCALLBACK(PDMNETWORKLINKSTATE) pcnetGetLinkState(PPDMINETWORKCONFIG pInterface)
3719	{
3720	PCNetState *pData = INETWORKCONFIG_2_DATA(pInterface);
3721	if (pData->fLinkUp && !pData->fLinkTempDown)
3722	return PDMNETWORKLINKSTATE_UP;
3723	if (!pData->fLinkUp)
3724	return PDMNETWORKLINKSTATE_DOWN;
3725	if (pData->fLinkTempDown)
3726	return PDMNETWORKLINKSTATE_DOWN_RESUME;
3727	AssertMsgFailed(("Invalid link state!\n"));
3728	return PDMNETWORKLINKSTATE_INVALID;
3729	}
3730
3731
3732	/**
3733	* Sets the new link state.
3734	*
3735	* @returns VBox status code.
3736	* @param pInterface Pointer to the interface structure containing the called function pointer.
3737	* @param enmState The new link state
3738	* @thread EMT
3739	*/
3740	static DECLCALLBACK(int) pcnetSetLinkState(PPDMINETWORKCONFIG pInterface, PDMNETWORKLINKSTATE enmState)
3741	{
3742	PCNetState *pData = INETWORKCONFIG_2_DATA(pInterface);
3743	bool fLinkUp;
3744	if ( enmState != PDMNETWORKLINKSTATE_DOWN
3745	&& enmState != PDMNETWORKLINKSTATE_UP)
3746	{
3747	AssertMsgFailed(("Invalid parameter enmState=%d\n", enmState));
3748	return VERR_INVALID_PARAMETER;
3749	}
3750
3751	/* has the state changed? */
3752	fLinkUp = enmState == PDMNETWORKLINKSTATE_UP;
3753	if (pData->fLinkUp != fLinkUp)
3754	{
3755	pData->fLinkUp = fLinkUp;
3756	if (fLinkUp)
3757	{
3758	/* connect */
3759	pData->aCSR[0] &= ~(BIT(15) \| BIT(13)); /* ERR \| CERR - probably not 100% correct either... */
3760	pData->Led.Actual.s.fError = 0;
3761	}
3762	else
3763	{
3764	/* disconnect */
3765	pData->cLinkDownReported = 0;
3766	pData->aCSR[0] \|= BIT(15) \| BIT(13); /* ERR \| CERR (this is probably wrong) */
3767	pData->Led.Asserted.s.fError = pData->Led.Actual.s.fError = 1;
3768	}
3769	pData->pDrv->pfnNotifyLinkChanged(pData->pDrv, enmState);
3770	}
3771	return VINF_SUCCESS;
3772	}
3773
3774
3775	/**
3776	* Gets the pointer to the status LED of a unit.
3777	*
3778	* @returns VBox status code.
3779	* @param pInterface Pointer to the interface structure containing the called function pointer.
3780	* @param iLUN The unit which status LED we desire.
3781	* @param ppLed Where to store the LED pointer.
3782	*/
3783	static DECLCALLBACK(int) pcnetQueryStatusLed(PPDMILEDPORTS pInterface, unsigned iLUN, PPDMLED *ppLed)
3784	{
3785	PCNetState pData = (PCNetState )( (uintptr_t)pInterface - RT_OFFSETOF(PCNetState, ILeds) );
3786	if (iLUN == 0)
3787	{
3788	*ppLed = &pData->Led;
3789	return VINF_SUCCESS;
3790	}
3791	return VERR_PDM_LUN_NOT_FOUND;
3792	}
3793
3794
3795	/**
3796	* @copydoc FNPDMDEVRESET
3797	*/
3798	static DECLCALLBACK(void) pcnetReset(PPDMDEVINS pDevIns)
3799	{
3800	PCNetState pData = PDMINS2DATA(pDevIns, PCNetState );
3801	if (pData->fLinkTempDown)
3802	{
3803	pData->cLinkDownReported = 0x10000;
3804	TMTimerStop(pData->pTimerRestore);
3805	pcnetTimerRestore(pDevIns, pData->pTimerRestore);
3806	}
3807
3808	/** @todo figure out what else which have to reset. I'm sure there is some stuff... */
3809	}
3810
3811
3812	/**
3813	* @copydoc FNPDMDEVRELOCATE
3814	*/
3815	static DECLCALLBACK(void) pcnetRelocate(PPDMDEVINS pDevIns, RTGCINTPTR offDelta)
3816	{
3817	PCNetState pData = PDMINS2DATA(pDevIns, PCNetState );
3818	pData->pDevInsGC = PDMDEVINS_2_GCPTR(pDevIns);
3819	pData->pXmitQueueGC = PDMQueueGCPtr(pData->pXmitQueueHC);
3820	pData->pCanRxQueueGC = PDMQueueGCPtr(pData->pCanRxQueueHC);
3821	#ifdef PCNET_NO_POLLING
3822	(RTHCUINTPTR )&pData->pfnEMInterpretInstructionGC += offDelta;
3823	#else
3824	pData->pTimerPollGC = TMTimerGCPtr(pData->pTimerPollHC);
3825	#endif
3826	}
3827
3828
3829	/**
3830	* Destruct a device instance.
3831	*
3832	* Most VM resources are freed by the VM. This callback is provided so that any non-VM
3833	* resources can be freed correctly.
3834	*
3835	* @returns VBox status.
3836	* @param pDevIns The device instance data.
3837	*/
3838	static DECLCALLBACK(int) pcnetDestruct(PPDMDEVINS pDevIns)
3839	{
3840	PCNetState pData = PDMINS2DATA(pDevIns, PCNetState );
3841	PDMR3CritSectDelete(&pData->CritSect);
3842	return VINF_SUCCESS;
3843	}
3844
3845
3846	/**
3847	* Construct a device instance for a VM.
3848	*
3849	* @returns VBox status.
3850	* @param pDevIns The device instance data.
3851	* If the registration structure is needed, pDevIns->pDevReg points to it.
3852	* @param iInstance Instance number. Use this to figure out which registers and such to use.
3853	* The device number is also found in pDevIns->iInstance, but since it's
3854	* likely to be freqently used PDM passes it as parameter.
3855	* @param pCfgHandle Configuration node handle for the device. Use this to obtain the configuration
3856	* of the device instance. It's also found in pDevIns->pCfgHandle, but like
3857	* iInstance it's expected to be used a bit in this function.
3858	*/
3859	static DECLCALLBACK(int) pcnetConstruct(PPDMDEVINS pDevIns, int iInstance, PCFGMNODE pCfgHandle)
3860	{
3861	PCNetState pData = PDMINS2DATA(pDevIns, PCNetState );
3862	PPDMIBASE pBase;
3863	char szTmp[128];
3864	int rc;
3865
3866	/* up to four instances are supported */
3867	Assert((iInstance >= 0) && (iInstance < 4));
3868
3869	Assert(RT_ELEMENTS(pData->aBCR) == BCR_MAX_RAP);
3870	Assert(RT_ELEMENTS(pData->aMII) == MII_MAX_REG);
3871	Assert(sizeof(pData->abFrameBuf) == RT_ALIGN_Z(sizeof(pData->abFrameBuf), 16));
3872	Assert(PCNET_TRQUEUE_DEPTH*1536 <= sizeof(pData->abFrameBuf));
3873
3874	/*
3875	* Validate configuration.
3876	*/
3877	if (!CFGMR3AreValuesValid(pCfgHandle, "MAC\0CableConnected\0Am79C973\0GCEnabled\0R0Enabled\0"))
3878	return PDMDEV_SET_ERROR(pDevIns, VERR_PDM_DEVINS_UNKNOWN_CFG_VALUES,
3879	N_("Invalid configuraton for pcnet device"));
3880
3881	/*
3882	* Read the configuration.
3883	*/
3884	rc = CFGMR3QueryBytes(pCfgHandle, "MAC", &pData->MacConfigured, sizeof(pData->MacConfigured));
3885	if (VBOX_FAILURE(rc))
3886	return PDMDEV_SET_ERROR(pDevIns, rc,
3887	N_("Configuration error: Failed to get the \"MAC\" value"));
3888	rc = CFGMR3QueryBool(pCfgHandle, "CableConnected", &pData->fLinkUp);
3889	if (rc == VERR_CFGM_VALUE_NOT_FOUND)
3890	pData->fLinkUp = true;
3891	else if (VBOX_FAILURE(rc))
3892	return PDMDEV_SET_ERROR(pDevIns, rc,
3893	N_("Configuration error: Failed to get the \"CableConnected\" value"));
3894
3895	rc = CFGMR3QueryBool(pCfgHandle, "Am79C973", &pData->fAm79C973);
3896	if (rc == VERR_CFGM_VALUE_NOT_FOUND)
3897	pData->fAm79C973 = false;
3898	else if (VBOX_FAILURE(rc))
3899	return PDMDEV_SET_ERROR(pDevIns, rc,
3900	N_("Configuration error: Failed to get the \"Am79C973\" value"));
3901
3902	#ifdef PCNET_GC_ENABLED
3903	rc = CFGMR3QueryBool(pCfgHandle, "GCEnabled", &pData->fGCEnabled);
3904	if (rc == VERR_CFGM_VALUE_NOT_FOUND)
3905	pData->fGCEnabled = true;
3906	else if (VBOX_FAILURE(rc))
3907	return PDMDEV_SET_ERROR(pDevIns, rc,
3908	N_("Configuration error: Failed to get the \"GCEnabled\" value"));
3909
3910	rc = CFGMR3QueryBool(pCfgHandle, "R0Enabled", &pData->fR0Enabled);
3911	if (rc == VERR_CFGM_VALUE_NOT_FOUND)
3912	pData->fR0Enabled = true;
3913	else if (VBOX_FAILURE(rc))
3914	return PDMDEV_SET_ERROR(pDevIns, rc,
3915	N_("Configuration error: Failed to get the \"R0Enabled\" value"));
3916
3917	#else /* !PCNET_GC_ENABLED */
3918	pData->fGCEnabled = false;
3919	pData->fR0Enabled = false;
3920	#endif /* !PCNET_GC_ENABLED */
3921
3922
3923	/*
3924	* Initialize data (most of it anyway).
3925	*/
3926	pData->pDevInsHC = pDevIns;
3927	pData->pDevInsGC = PDMDEVINS_2_GCPTR(pDevIns);
3928	pData->Led.u32Magic = PDMLED_MAGIC;
3929	/* IBase */
3930	pData->IBase.pfnQueryInterface = pcnetQueryInterface;
3931	/* INeworkPort */
3932	pData->INetworkPort.pfnCanReceive = pcnetCanReceive;
3933	pData->INetworkPort.pfnReceive = pcnetReceive;
3934	/* INetworkConfig */
3935	pData->INetworkConfig.pfnGetMac = pcnetGetMac;
3936	pData->INetworkConfig.pfnGetLinkState = pcnetGetLinkState;
3937	pData->INetworkConfig.pfnSetLinkState = pcnetSetLinkState;
3938	/* ILeds */
3939	pData->ILeds.pfnQueryStatusLed = pcnetQueryStatusLed;
3940
3941	/* PCI Device */
3942	pData->PciDev.config[0x00] = 0x22; /* vendor id */
3943	pData->PciDev.config[0x01] = 0x10;
3944	pData->PciDev.config[0x02] = 0x00; /* device id */
3945	pData->PciDev.config[0x03] = 0x20;
3946	pData->PciDev.config[0x04] = 0x07; /* command */
3947	pData->PciDev.config[0x05] = 0x00;
3948	pData->PciDev.config[0x06] = 0x80; /* status */
3949	pData->PciDev.config[0x07] = 0x02;
3950	pData->PciDev.config[0x08] = pData->fAm79C973 ? 0x30 : 0x10; /* revision */
3951	pData->PciDev.config[0x09] = 0x00;
3952	pData->PciDev.config[0x0a] = 0x00; /* ethernet network controller */
3953	pData->PciDev.config[0x0b] = 0x02;
3954	pData->PciDev.config[0x0e] = 0x00; /* header_type */
3955
3956	pData->PciDev.config[0x10] = 0x01; /* IO Base */
3957	pData->PciDev.config[0x11] = 0x00;
3958	pData->PciDev.config[0x12] = 0x00;
3959	pData->PciDev.config[0x13] = 0x00;
3960	pData->PciDev.config[0x14] = 0x00; /* MMIO Base */
3961	pData->PciDev.config[0x15] = 0x00;
3962	pData->PciDev.config[0x16] = 0x00;
3963	pData->PciDev.config[0x17] = 0x00;
3964
3965	/* subsystem and subvendor IDs */
3966	pData->PciDev.config[0x2c] = 0x22; /* subsystem vendor id */
3967	pData->PciDev.config[0x2d] = 0x10;
3968	pData->PciDev.config[0x2e] = 0x00; /* subsystem id */
3969	pData->PciDev.config[0x2f] = 0x20;
3970	pData->PciDev.config[0x3d] = 1; /* interrupt pin 0 */
3971	pData->PciDev.config[0x3e] = 0x06;
3972	pData->PciDev.config[0x3f] = 0xff;
3973
3974	/*
3975	* Register the PCI device, its I/O regions, the timer and the saved state item.
3976	*/
3977	rc = PDMDevHlpPCIRegister(pDevIns, &pData->PciDev);
3978	if (VBOX_FAILURE(rc))
3979	return rc;
3980	rc = PDMDevHlpPCIIORegionRegister(pDevIns, 0, PCNET_IOPORT_SIZE,
3981	PCI_ADDRESS_SPACE_IO, pcnetIOPortMap);
3982	if (VBOX_FAILURE(rc))
3983	return rc;
3984	rc = PDMDevHlpPCIIORegionRegister(pDevIns, 1, PCNET_PNPMMIO_SIZE,
3985	PCI_ADDRESS_SPACE_MEM, pcnetMMIOMap);
3986	if (VBOX_FAILURE(rc))
3987	return rc;
3988
3989	#ifdef PCNET_NO_POLLING
3990	rc = PDMR3GetSymbolR0Lazy(PDMDevHlpGetVM(pDevIns), NULL, "EMInterpretInstruction", (void **)&pData->pfnEMInterpretInstructionR0);
3991	if (VBOX_SUCCESS(rc))
3992	{
3993	/*
3994	* Resolve the GC handler.
3995	*/
3996	RTGCPTR pfnHandlerGC;
3997	rc = PDMR3GetSymbolGCLazy(PDMDevHlpGetVM(pDevIns), NULL, "EMInterpretInstruction", (RTGCPTR *)&pData->pfnEMInterpretInstructionGC);
3998	}
3999	if (VBOX_FAILURE(rc))
4000	{
4001	AssertMsgFailed(("PDMR3GetSymbolGCLazy -> %Vrc\n", rc));
4002	return rc;
4003	}
4004	#else
4005	rc = PDMDevHlpTMTimerCreate(pDevIns, TMCLOCK_VIRTUAL, pcnetTimer,
4006	"PCNet Poll Timer", &pData->pTimerPollHC);
4007	if (VBOX_FAILURE(rc))
4008	{
4009	AssertMsgFailed(("pfnTMTimerCreate -> %Vrc\n", rc));
4010	return rc;
4011	}
4012	#endif
4013	rc = PDMDevHlpTMTimerCreate(pDevIns, TMCLOCK_VIRTUAL, pcnetTimerRestore,
4014	"PCNet Restore Timer", &pData->pTimerRestore);
4015	if (VBOX_FAILURE(rc))
4016	{
4017	AssertMsgFailed(("pfnTMTimerCreate -> %Vrc\n", rc));
4018	return rc;
4019	}
4020	/** @todo r=bird: we're not locking down pcnet properly during saving and loading! */
4021	rc = PDMDevHlpSSMRegister(pDevIns, pDevIns->pDevReg->szDeviceName, iInstance,
4022	PCNET_SAVEDSTATE_VERSION, sizeof(*pData),
4023	NULL, pcnetSaveExec, NULL,
4024	NULL, pcnetLoadExec, NULL);
4025	if (VBOX_FAILURE(rc))
4026	return rc;
4027
4028	/*
4029	* Initialize critical section.
4030	* This must of course be done before attaching drivers or anything else which can call us back..
4031	*/
4032	char szName[24];
4033	RTStrPrintf(szName, sizeof(szName), "PCNet#%d", iInstance);
4034	rc = PDMDevHlpCritSectInit(pDevIns, &pData->CritSect, szName);
4035	if (VBOX_FAILURE(rc))
4036	return rc;
4037
4038	/*
4039	* Create the transmit queue.
4040	*/
4041	rc = PDMDevHlpPDMQueueCreate(pDevIns, sizeof(PDMQUEUEITEMCORE), 1, 0,
4042	pcnetXmitQueueConsumer, true, &pData->pXmitQueueHC);
4043	if (VBOX_FAILURE(rc))
4044	return rc;
4045	pData->pXmitQueueGC = PDMQueueGCPtr(pData->pXmitQueueHC);
4046
4047	/*
4048	* Create the RX notifer signaller.
4049	*/
4050	rc = PDMDevHlpPDMQueueCreate(pDevIns, sizeof(PDMQUEUEITEMCORE), 1, 0,
4051	pcnetCanRxQueueConsumer, true, &pData->pCanRxQueueHC);
4052	if (VBOX_FAILURE(rc))
4053	return rc;
4054	pData->pCanRxQueueGC = PDMQueueGCPtr(pData->pCanRxQueueHC);
4055
4056	/*
4057	* Register the info item.
4058	*/
4059	RTStrPrintf(szTmp, sizeof(szTmp), "pcnet%d", pDevIns->iInstance);
4060	PDMDevHlpDBGFInfoRegister(pDevIns, szTmp, "PCNET info.", pcnetInfo);
4061
4062	/*
4063	* Attach status driver (optional).
4064	*/
4065	rc = PDMDevHlpDriverAttach(pDevIns, PDM_STATUS_LUN, &pData->IBase, &pBase, "Status Port");
4066	if (VBOX_SUCCESS(rc))
4067	pData->pLedsConnector = (PPDMILEDCONNECTORS)
4068	pBase->pfnQueryInterface(pBase, PDMINTERFACE_LED_CONNECTORS);
4069	else if (rc != VERR_PDM_NO_ATTACHED_DRIVER)
4070	{
4071	AssertMsgFailed(("Failed to attach to status driver. rc=%Vrc\n", rc));
4072	return rc;
4073	}
4074
4075	/*
4076	* Attach driver.
4077	*/
4078	rc = PDMDevHlpDriverAttach(pDevIns, 0, &pData->IBase, &pData->pDrvBase, "Network Port");
4079	if (VBOX_SUCCESS(rc))
4080	{
4081	pData->pDrv = (PPDMINETWORKCONNECTOR)
4082	pData->pDrvBase->pfnQueryInterface(pData->pDrvBase, PDMINTERFACE_NETWORK_CONNECTOR);
4083	if (!pData->pDrv)
4084	{
4085	AssertMsgFailed(("Failed to obtain the PDMINTERFACE_NETWORK_CONNECTOR interface!\n"));
4086	return VERR_PDM_MISSING_INTERFACE_BELOW;
4087	}
4088	}
4089	else if (rc == VERR_PDM_NO_ATTACHED_DRIVER)
4090	Log(("No attached driver!\n"));
4091	else
4092	return rc;
4093
4094	/*
4095	* Reset the device state. (Do after attaching.)
4096	*/
4097	pcnetHardReset(pData);
4098
4099	#ifdef VBOX_WITH_STATISTICS
4100	PDMDevHlpSTAMRegisterF(pDevIns, &pData->StatMMIOReadGC, STAMTYPE_PROFILE, STAMVISIBILITY_ALWAYS, STAMUNIT_TICKS_PER_CALL, "Profiling MMIO reads in GC", "/Devices/PCNet%d/MMIO/ReadGC", iInstance);
4101	PDMDevHlpSTAMRegisterF(pDevIns, &pData->StatMMIOReadHC, STAMTYPE_PROFILE, STAMVISIBILITY_ALWAYS, STAMUNIT_TICKS_PER_CALL, "Profiling MMIO reads in HC", "/Devices/PCNet%d/MMIO/ReadHC", iInstance);
4102	PDMDevHlpSTAMRegisterF(pDevIns, &pData->StatMMIOWriteGC, STAMTYPE_PROFILE, STAMVISIBILITY_ALWAYS, STAMUNIT_TICKS_PER_CALL, "Profiling MMIO writes in GC", "/Devices/PCNet%d/MMIO/WriteGC", iInstance);
4103	PDMDevHlpSTAMRegisterF(pDevIns, &pData->StatMMIOWriteHC, STAMTYPE_PROFILE, STAMVISIBILITY_ALWAYS, STAMUNIT_TICKS_PER_CALL, "Profiling MMIO writes in HC", "/Devices/PCNet%d/MMIO/WriteHC", iInstance);
4104	PDMDevHlpSTAMRegisterF(pDevIns, &pData->StatAPROMRead, STAMTYPE_PROFILE, STAMVISIBILITY_ALWAYS, STAMUNIT_TICKS_PER_CALL, "Profiling APROM reads", "/Devices/PCNet%d/IO/APROMRead", iInstance);
4105	PDMDevHlpSTAMRegisterF(pDevIns, &pData->StatAPROMWrite, STAMTYPE_PROFILE, STAMVISIBILITY_ALWAYS, STAMUNIT_TICKS_PER_CALL, "Profiling APROM writes", "/Devices/PCNet%d/IO/APROMWrite", iInstance);
4106	PDMDevHlpSTAMRegisterF(pDevIns, &pData->StatIOReadGC, STAMTYPE_PROFILE, STAMVISIBILITY_ALWAYS, STAMUNIT_TICKS_PER_CALL, "Profiling PCNetIO reads in GC", "/Devices/PCNet%d/IO/ReadGC", iInstance);
4107	PDMDevHlpSTAMRegisterF(pDevIns, &pData->StatIOReadHC, STAMTYPE_PROFILE, STAMVISIBILITY_ALWAYS, STAMUNIT_TICKS_PER_CALL, "Profiling PCNetIO reads in HC", "/Devices/PCNet%d/IO/ReadHC", iInstance);
4108	PDMDevHlpSTAMRegisterF(pDevIns, &pData->StatIOWriteGC, STAMTYPE_PROFILE, STAMVISIBILITY_ALWAYS, STAMUNIT_TICKS_PER_CALL, "Profiling PCNet IO writes in GC", "/Devices/PCNet%d/IO/WriteGC", iInstance);
4109	PDMDevHlpSTAMRegisterF(pDevIns, &pData->StatIOWriteHC, STAMTYPE_PROFILE, STAMVISIBILITY_ALWAYS, STAMUNIT_TICKS_PER_CALL, "Profiling PCNet IO writes in HC", "/Devices/PCNet%d/IO/WriteHC", iInstance);
4110	PDMDevHlpSTAMRegisterF(pDevIns, &pData->StatTimer, STAMTYPE_PROFILE, STAMVISIBILITY_ALWAYS, STAMUNIT_TICKS_PER_CALL, "Profiling PCNet Timer", "/Devices/PCNet%d/Timer", iInstance);
4111	PDMDevHlpSTAMRegisterF(pDevIns, &pData->StatReceive, STAMTYPE_PROFILE, STAMVISIBILITY_ALWAYS, STAMUNIT_TICKS_PER_CALL, "Profiling PCNet receive", "/Devices/PCNet%d/Receive", iInstance);
4112	PDMDevHlpSTAMRegisterF(pDevIns, &pData->StatTransmitGC, STAMTYPE_PROFILE, STAMVISIBILITY_ALWAYS, STAMUNIT_TICKS_PER_CALL, "Profiling PCNet transmit in GC", "/Devices/PCNet%d/TransmitGC", iInstance);
4113	PDMDevHlpSTAMRegisterF(pDevIns, &pData->StatTransmitHC, STAMTYPE_PROFILE, STAMVISIBILITY_ALWAYS, STAMUNIT_TICKS_PER_CALL, "Profiling PCNet transmit in HC", "/Devices/PCNet%d/TransmitHC", iInstance);
4114	PDMDevHlpSTAMRegisterF(pDevIns, &pData->StatXmitQueue, STAMTYPE_PROFILE, STAMVISIBILITY_ALWAYS, STAMUNIT_TICKS_PER_CALL, "Profiling PCNet xmit queue", "/Devices/PCNet%d/XmitQueue", iInstance);
4115	PDMDevHlpSTAMRegisterF(pDevIns, &pData->StatXmitQueueFlushGC, STAMTYPE_PROFILE, STAMVISIBILITY_ALWAYS, STAMUNIT_TICKS_PER_CALL, "Profiling PCNet xmit queue flushes from GC", "/Devices/PCNet%d/XmitQueueFlushGC", iInstance);
4116	unsigned i;
4117	for (i = 0; i < ELEMENTS(pData->aStatFlushCounts); i++)
4118	PDMDevHlpSTAMRegisterF(pDevIns, &pData->aStatFlushCounts[i],STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "", "/Devices/PCNet%d/FlushCounts/Depth-%d", iInstance, i);
4119	Assert(ELEMENTS(pData->aStatFlushCounts) - 1 == ELEMENTS(pData->aFrames));
4120	for (i = 0; i < ELEMENTS(pData->aStatXmitChainCounts) - 1; i++)
4121	PDMDevHlpSTAMRegisterF(pDevIns, &pData->aStatXmitChainCounts[i], STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "", "/Devices/PCNet%d/XmitChainCounts/%d", iInstance, i + 1);
4122	PDMDevHlpSTAMRegisterF(pDevIns, &pData->aStatXmitChainCounts[i], STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "", "/Devices/PCNet%d/XmitChainCounts/%d+", iInstance, i + 1);
4123	PDMDevHlpSTAMRegisterF(pDevIns, &pData->StatInterrupt, STAMTYPE_PROFILE, STAMVISIBILITY_ALWAYS, STAMUNIT_TICKS_PER_CALL, "Profiling PCNet interrupt checks", "/Devices/PCNet%d/Interrupt", iInstance);
4124	PDMDevHlpSTAMRegisterF(pDevIns, &pData->StatPollTimer, STAMTYPE_PROFILE, STAMVISIBILITY_ALWAYS, STAMUNIT_TICKS_PER_CALL, "Profiling PCNet poll timer", "/Devices/PCNet%d/PollTimer", iInstance);
4125	PDMDevHlpSTAMRegisterF(pDevIns, &pData->StatMIIReads, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Number of MII reads", "/Devices/PCNet%d/MIIReads", iInstance);
4126	# ifdef PCNET_NO_POLLING
4127	PDMDevHlpSTAMRegisterF(pDevIns, &pData->StatRCVRingWrite, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Nr of receive ring writes", "/Devices/PCNet%d/Ring/RCVWrites", iInstance);
4128	PDMDevHlpSTAMRegisterF(pDevIns, &pData->StatTXRingWrite, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Nr of transmit ring writes", "/Devices/PCNet%d/Ring/TXWrites", iInstance);
4129	PDMDevHlpSTAMRegisterF(pDevIns, &pData->StatRingWriteHC, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Nr of monitored ring page writes", "/Devices/PCNet%d/Ring/HC/Writes", iInstance);
4130	PDMDevHlpSTAMRegisterF(pDevIns, &pData->StatRingWriteR0, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Nr of monitored ring page writes", "/Devices/PCNet%d/Ring/R0/Writes", iInstance);
4131	PDMDevHlpSTAMRegisterF(pDevIns, &pData->StatRingWriteGC, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Nr of monitored ring page writes", "/Devices/PCNet%d/Ring/GC/Writes", iInstance);
4132	PDMDevHlpSTAMRegisterF(pDevIns, &pData->StatRingWriteFailedHC, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Nr of failed ring page writes", "/Devices/PCNet%d/Ring/HC/Failed", iInstance);
4133	PDMDevHlpSTAMRegisterF(pDevIns, &pData->StatRingWriteFailedR0, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Nr of failed ring page writes", "/Devices/PCNet%d/Ring/R0/Failed", iInstance);
4134	PDMDevHlpSTAMRegisterF(pDevIns, &pData->StatRingWriteFailedGC, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Nr of failed ring page writes", "/Devices/PCNet%d/Ring/GC/Failed", iInstance);
4135	PDMDevHlpSTAMRegisterF(pDevIns, &pData->StatRingWriteOutsideRangeHC, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Nr of monitored writes outside ring range", "/Devices/PCNet%d/Ring/HC/Outside", iInstance);
4136	PDMDevHlpSTAMRegisterF(pDevIns, &pData->StatRingWriteOutsideRangeR0, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Nr of monitored writes outside ring range", "/Devices/PCNet%d/Ring/R0/Outside", iInstance);
4137	PDMDevHlpSTAMRegisterF(pDevIns, &pData->StatRingWriteOutsideRangeGC, STAMTYPE_COUNTER, STAMVISIBILITY_ALWAYS, STAMUNIT_OCCURENCES, "Nr of monitored writes outside ring range", "/Devices/PCNet%d/Ring/GC/Outside", iInstance);
4138	# endif /* PCNET_NO_POLLING */
4139	#endif
4140
4141	return VINF_SUCCESS;
4142	}
4143
4144
4145	/**
4146	* The device registration structure.
4147	*/
4148	const PDMDEVREG g_DevicePCNet =
4149	{
4150	/* u32Version */
4151	PDM_DEVREG_VERSION,
4152	/* szDeviceName */
4153	"pcnet",
4154	/* szGCMod */
4155	#ifdef PCNET_GC_ENABLED
4156	"VBoxDDGC.gc",
4157	"VBoxDDR0.r0",
4158	#else
4159	"",
4160	"",
4161	#endif
4162	/* pszDescription */
4163	"AMD PC-Net II Ethernet controller.\n",
4164	/* fFlags */
4165	#ifdef PCNET_GC_ENABLED
4166	PDM_DEVREG_FLAGS_HOST_BITS_DEFAULT \| PDM_DEVREG_FLAGS_GUEST_BITS_DEFAULT \| PDM_DEVREG_FLAGS_GC \| PDM_DEVREG_FLAGS_R0,
4167	#else
4168	PDM_DEVREG_FLAGS_HOST_BITS_DEFAULT \| PDM_DEVREG_FLAGS_GUEST_BITS_DEFAULT,
4169	#endif
4170	/* fClass */
4171	PDM_DEVREG_CLASS_NETWORK,
4172	/* cMaxInstances */
4173	4,
4174	/* cbInstance */
4175	sizeof(PCNetState),
4176	/* pfnConstruct */
4177	pcnetConstruct,
4178	/* pfnDestruct */
4179	pcnetDestruct,
4180	/* pfnRelocate */
4181	pcnetRelocate,
4182	/* pfnIOCtl */
4183	NULL,
4184	/* pfnPowerOn */
4185	NULL,
4186	/* pfnReset */
4187	pcnetReset,
4188	/* pfnSuspend */
4189	NULL,
4190	/* pfnResume */
4191	NULL,
4192	/* pfnAttach */
4193	NULL,
4194	/* pfnDetach */
4195	NULL,
4196	/* pfnQueryInterface. */
4197	NULL
4198	};
4199
4200	#endif /* IN_RING3 */
4201	#endif /* !VBOX_DEVICE_STRUCT_TESTCASE */
4202

Note: See TracBrowser for help on using the repository browser.

source: vbox/trunk/src/VBox/Devices/Network/DevPCNet.cpp@ 532

Download in other formats: