cachepc-qemu

Fork of AMDESE/qemu with changes for cachepc side-channel attack
git clone https://git.sinitax.com/sinitax/cachepc-qemu
Log | Files | Refs | Submodules | LICENSE | sfeed.txt

ne2000.c (21044B)


      1/*
      2 * QEMU NE2000 emulation
      3 *
      4 * Copyright (c) 2003-2004 Fabrice Bellard
      5 *
      6 * Permission is hereby granted, free of charge, to any person obtaining a copy
      7 * of this software and associated documentation files (the "Software"), to deal
      8 * in the Software without restriction, including without limitation the rights
      9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
     10 * copies of the Software, and to permit persons to whom the Software is
     11 * furnished to do so, subject to the following conditions:
     12 *
     13 * The above copyright notice and this permission notice shall be included in
     14 * all copies or substantial portions of the Software.
     15 *
     16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
     17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
     18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
     19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
     20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
     21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
     22 * THE SOFTWARE.
     23 */
     24
     25#include "qemu/osdep.h"
     26#include "net/eth.h"
     27#include "qemu/module.h"
     28#include "exec/memory.h"
     29#include "hw/irq.h"
     30#include "migration/vmstate.h"
     31#include "ne2000.h"
     32#include "trace.h"
     33
     34/* debug NE2000 card */
     35//#define DEBUG_NE2000
     36
     37#define MAX_ETH_FRAME_SIZE 1514
     38
     39#define E8390_CMD	0x00  /* The command register (for all pages) */
     40/* Page 0 register offsets. */
     41#define EN0_CLDALO	0x01	/* Low byte of current local dma addr  RD */
     42#define EN0_STARTPG	0x01	/* Starting page of ring bfr WR */
     43#define EN0_CLDAHI	0x02	/* High byte of current local dma addr  RD */
     44#define EN0_STOPPG	0x02	/* Ending page +1 of ring bfr WR */
     45#define EN0_BOUNDARY	0x03	/* Boundary page of ring bfr RD WR */
     46#define EN0_TSR		0x04	/* Transmit status reg RD */
     47#define EN0_TPSR	0x04	/* Transmit starting page WR */
     48#define EN0_NCR		0x05	/* Number of collision reg RD */
     49#define EN0_TCNTLO	0x05	/* Low  byte of tx byte count WR */
     50#define EN0_FIFO	0x06	/* FIFO RD */
     51#define EN0_TCNTHI	0x06	/* High byte of tx byte count WR */
     52#define EN0_ISR		0x07	/* Interrupt status reg RD WR */
     53#define EN0_CRDALO	0x08	/* low byte of current remote dma address RD */
     54#define EN0_RSARLO	0x08	/* Remote start address reg 0 */
     55#define EN0_CRDAHI	0x09	/* high byte, current remote dma address RD */
     56#define EN0_RSARHI	0x09	/* Remote start address reg 1 */
     57#define EN0_RCNTLO	0x0a	/* Remote byte count reg WR */
     58#define EN0_RTL8029ID0	0x0a	/* Realtek ID byte #1 RD */
     59#define EN0_RCNTHI	0x0b	/* Remote byte count reg WR */
     60#define EN0_RTL8029ID1	0x0b	/* Realtek ID byte #2 RD */
     61#define EN0_RSR		0x0c	/* rx status reg RD */
     62#define EN0_RXCR	0x0c	/* RX configuration reg WR */
     63#define EN0_TXCR	0x0d	/* TX configuration reg WR */
     64#define EN0_COUNTER0	0x0d	/* Rcv alignment error counter RD */
     65#define EN0_DCFG	0x0e	/* Data configuration reg WR */
     66#define EN0_COUNTER1	0x0e	/* Rcv CRC error counter RD */
     67#define EN0_IMR		0x0f	/* Interrupt mask reg WR */
     68#define EN0_COUNTER2	0x0f	/* Rcv missed frame error counter RD */
     69
     70#define EN1_PHYS        0x11
     71#define EN1_CURPAG      0x17
     72#define EN1_MULT        0x18
     73
     74#define EN2_STARTPG	0x21	/* Starting page of ring bfr RD */
     75#define EN2_STOPPG	0x22	/* Ending page +1 of ring bfr RD */
     76
     77#define EN3_CONFIG0	0x33
     78#define EN3_CONFIG1	0x34
     79#define EN3_CONFIG2	0x35
     80#define EN3_CONFIG3	0x36
     81
     82/*  Register accessed at EN_CMD, the 8390 base addr.  */
     83#define E8390_STOP	0x01	/* Stop and reset the chip */
     84#define E8390_START	0x02	/* Start the chip, clear reset */
     85#define E8390_TRANS	0x04	/* Transmit a frame */
     86#define E8390_RREAD	0x08	/* Remote read */
     87#define E8390_RWRITE	0x10	/* Remote write  */
     88#define E8390_NODMA	0x20	/* Remote DMA */
     89#define E8390_PAGE0	0x00	/* Select page chip registers */
     90#define E8390_PAGE1	0x40	/* using the two high-order bits */
     91#define E8390_PAGE2	0x80	/* Page 3 is invalid. */
     92
     93/* Bits in EN0_ISR - Interrupt status register */
     94#define ENISR_RX	0x01	/* Receiver, no error */
     95#define ENISR_TX	0x02	/* Transmitter, no error */
     96#define ENISR_RX_ERR	0x04	/* Receiver, with error */
     97#define ENISR_TX_ERR	0x08	/* Transmitter, with error */
     98#define ENISR_OVER	0x10	/* Receiver overwrote the ring */
     99#define ENISR_COUNTERS	0x20	/* Counters need emptying */
    100#define ENISR_RDC	0x40	/* remote dma complete */
    101#define ENISR_RESET	0x80	/* Reset completed */
    102#define ENISR_ALL	0x3f	/* Interrupts we will enable */
    103
    104/* Bits in received packet status byte and EN0_RSR*/
    105#define ENRSR_RXOK	0x01	/* Received a good packet */
    106#define ENRSR_CRC	0x02	/* CRC error */
    107#define ENRSR_FAE	0x04	/* frame alignment error */
    108#define ENRSR_FO	0x08	/* FIFO overrun */
    109#define ENRSR_MPA	0x10	/* missed pkt */
    110#define ENRSR_PHY	0x20	/* physical/multicast address */
    111#define ENRSR_DIS	0x40	/* receiver disable. set in monitor mode */
    112#define ENRSR_DEF	0x80	/* deferring */
    113
    114/* Transmitted packet status, EN0_TSR. */
    115#define ENTSR_PTX 0x01	/* Packet transmitted without error */
    116#define ENTSR_ND  0x02	/* The transmit wasn't deferred. */
    117#define ENTSR_COL 0x04	/* The transmit collided at least once. */
    118#define ENTSR_ABT 0x08  /* The transmit collided 16 times, and was deferred. */
    119#define ENTSR_CRS 0x10	/* The carrier sense was lost. */
    120#define ENTSR_FU  0x20  /* A "FIFO underrun" occurred during transmit. */
    121#define ENTSR_CDH 0x40	/* The collision detect "heartbeat" signal was lost. */
    122#define ENTSR_OWC 0x80  /* There was an out-of-window collision. */
    123
    124void ne2000_reset(NE2000State *s)
    125{
    126    int i;
    127
    128    s->isr = ENISR_RESET;
    129    memcpy(s->mem, &s->c.macaddr, 6);
    130    s->mem[14] = 0x57;
    131    s->mem[15] = 0x57;
    132
    133    /* duplicate prom data */
    134    for(i = 15;i >= 0; i--) {
    135        s->mem[2 * i] = s->mem[i];
    136        s->mem[2 * i + 1] = s->mem[i];
    137    }
    138}
    139
    140static void ne2000_update_irq(NE2000State *s)
    141{
    142    int isr;
    143    isr = (s->isr & s->imr) & 0x7f;
    144#if defined(DEBUG_NE2000)
    145    printf("NE2000: Set IRQ to %d (%02x %02x)\n",
    146           isr ? 1 : 0, s->isr, s->imr);
    147#endif
    148    qemu_set_irq(s->irq, (isr != 0));
    149}
    150
    151static int ne2000_buffer_full(NE2000State *s)
    152{
    153    int avail, index, boundary;
    154
    155    if (s->stop <= s->start) {
    156        return 1;
    157    }
    158
    159    index = s->curpag << 8;
    160    boundary = s->boundary << 8;
    161    if (index < boundary)
    162        avail = boundary - index;
    163    else
    164        avail = (s->stop - s->start) - (index - boundary);
    165    if (avail < (MAX_ETH_FRAME_SIZE + 4))
    166        return 1;
    167    return 0;
    168}
    169
    170#define MIN_BUF_SIZE 60
    171
    172ssize_t ne2000_receive(NetClientState *nc, const uint8_t *buf, size_t size_)
    173{
    174    NE2000State *s = qemu_get_nic_opaque(nc);
    175    size_t size = size_;
    176    uint8_t *p;
    177    unsigned int total_len, next, avail, len, index, mcast_idx;
    178    uint8_t buf1[60];
    179    static const uint8_t broadcast_macaddr[6] =
    180        { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
    181
    182#if defined(DEBUG_NE2000)
    183    printf("NE2000: received len=%zu\n", size);
    184#endif
    185
    186    if (s->cmd & E8390_STOP || ne2000_buffer_full(s))
    187        return -1;
    188
    189    /* XXX: check this */
    190    if (s->rxcr & 0x10) {
    191        /* promiscuous: receive all */
    192    } else {
    193        if (!memcmp(buf,  broadcast_macaddr, 6)) {
    194            /* broadcast address */
    195            if (!(s->rxcr & 0x04))
    196                return size;
    197        } else if (buf[0] & 0x01) {
    198            /* multicast */
    199            if (!(s->rxcr & 0x08))
    200                return size;
    201            mcast_idx = net_crc32(buf, ETH_ALEN) >> 26;
    202            if (!(s->mult[mcast_idx >> 3] & (1 << (mcast_idx & 7))))
    203                return size;
    204        } else if (s->mem[0] == buf[0] &&
    205                   s->mem[2] == buf[1] &&
    206                   s->mem[4] == buf[2] &&
    207                   s->mem[6] == buf[3] &&
    208                   s->mem[8] == buf[4] &&
    209                   s->mem[10] == buf[5]) {
    210            /* match */
    211        } else {
    212            return size;
    213        }
    214    }
    215
    216
    217    /* if too small buffer, then expand it */
    218    if (size < MIN_BUF_SIZE) {
    219        memcpy(buf1, buf, size);
    220        memset(buf1 + size, 0, MIN_BUF_SIZE - size);
    221        buf = buf1;
    222        size = MIN_BUF_SIZE;
    223    }
    224
    225    index = s->curpag << 8;
    226    if (index >= NE2000_PMEM_END) {
    227        index = s->start;
    228    }
    229    /* 4 bytes for header */
    230    total_len = size + 4;
    231    /* address for next packet (4 bytes for CRC) */
    232    next = index + ((total_len + 4 + 255) & ~0xff);
    233    if (next >= s->stop)
    234        next -= (s->stop - s->start);
    235    /* prepare packet header */
    236    p = s->mem + index;
    237    s->rsr = ENRSR_RXOK; /* receive status */
    238    /* XXX: check this */
    239    if (buf[0] & 0x01)
    240        s->rsr |= ENRSR_PHY;
    241    p[0] = s->rsr;
    242    p[1] = next >> 8;
    243    p[2] = total_len;
    244    p[3] = total_len >> 8;
    245    index += 4;
    246
    247    /* write packet data */
    248    while (size > 0) {
    249        if (index <= s->stop)
    250            avail = s->stop - index;
    251        else
    252            break;
    253        len = size;
    254        if (len > avail)
    255            len = avail;
    256        memcpy(s->mem + index, buf, len);
    257        buf += len;
    258        index += len;
    259        if (index == s->stop)
    260            index = s->start;
    261        size -= len;
    262    }
    263    s->curpag = next >> 8;
    264
    265    /* now we can signal we have received something */
    266    s->isr |= ENISR_RX;
    267    ne2000_update_irq(s);
    268
    269    return size_;
    270}
    271
    272static void ne2000_ioport_write(void *opaque, uint32_t addr, uint32_t val)
    273{
    274    NE2000State *s = opaque;
    275    int offset, page, index;
    276
    277    addr &= 0xf;
    278    trace_ne2000_ioport_write(addr, val);
    279    if (addr == E8390_CMD) {
    280        /* control register */
    281        s->cmd = val;
    282        if (!(val & E8390_STOP)) { /* START bit makes no sense on RTL8029... */
    283            s->isr &= ~ENISR_RESET;
    284            /* test specific case: zero length transfer */
    285            if ((val & (E8390_RREAD | E8390_RWRITE)) &&
    286                s->rcnt == 0) {
    287                s->isr |= ENISR_RDC;
    288                ne2000_update_irq(s);
    289            }
    290            if (val & E8390_TRANS) {
    291                index = (s->tpsr << 8);
    292                /* XXX: next 2 lines are a hack to make netware 3.11 work */
    293                if (index >= NE2000_PMEM_END)
    294                    index -= NE2000_PMEM_SIZE;
    295                /* fail safe: check range on the transmitted length  */
    296                if (index + s->tcnt <= NE2000_PMEM_END) {
    297                    qemu_send_packet(qemu_get_queue(s->nic), s->mem + index,
    298                                     s->tcnt);
    299                }
    300                /* signal end of transfer */
    301                s->tsr = ENTSR_PTX;
    302                s->isr |= ENISR_TX;
    303                s->cmd &= ~E8390_TRANS;
    304                ne2000_update_irq(s);
    305            }
    306        }
    307    } else {
    308        page = s->cmd >> 6;
    309        offset = addr | (page << 4);
    310        switch(offset) {
    311        case EN0_STARTPG:
    312            if (val << 8 <= NE2000_PMEM_END) {
    313                s->start = val << 8;
    314            }
    315            break;
    316        case EN0_STOPPG:
    317            if (val << 8 <= NE2000_PMEM_END) {
    318                s->stop = val << 8;
    319            }
    320            break;
    321        case EN0_BOUNDARY:
    322            if (val << 8 < NE2000_PMEM_END) {
    323                s->boundary = val;
    324            }
    325            break;
    326        case EN0_IMR:
    327            s->imr = val;
    328            ne2000_update_irq(s);
    329            break;
    330        case EN0_TPSR:
    331            s->tpsr = val;
    332            break;
    333        case EN0_TCNTLO:
    334            s->tcnt = (s->tcnt & 0xff00) | val;
    335            break;
    336        case EN0_TCNTHI:
    337            s->tcnt = (s->tcnt & 0x00ff) | (val << 8);
    338            break;
    339        case EN0_RSARLO:
    340            s->rsar = (s->rsar & 0xff00) | val;
    341            break;
    342        case EN0_RSARHI:
    343            s->rsar = (s->rsar & 0x00ff) | (val << 8);
    344            break;
    345        case EN0_RCNTLO:
    346            s->rcnt = (s->rcnt & 0xff00) | val;
    347            break;
    348        case EN0_RCNTHI:
    349            s->rcnt = (s->rcnt & 0x00ff) | (val << 8);
    350            break;
    351        case EN0_RXCR:
    352            s->rxcr = val;
    353            break;
    354        case EN0_DCFG:
    355            s->dcfg = val;
    356            break;
    357        case EN0_ISR:
    358            s->isr &= ~(val & 0x7f);
    359            ne2000_update_irq(s);
    360            break;
    361        case EN1_PHYS ... EN1_PHYS + 5:
    362            s->phys[offset - EN1_PHYS] = val;
    363            break;
    364        case EN1_CURPAG:
    365            if (val << 8 < NE2000_PMEM_END) {
    366                s->curpag = val;
    367            }
    368            break;
    369        case EN1_MULT ... EN1_MULT + 7:
    370            s->mult[offset - EN1_MULT] = val;
    371            break;
    372        }
    373    }
    374}
    375
    376static uint32_t ne2000_ioport_read(void *opaque, uint32_t addr)
    377{
    378    NE2000State *s = opaque;
    379    int offset, page, ret;
    380
    381    addr &= 0xf;
    382    if (addr == E8390_CMD) {
    383        ret = s->cmd;
    384    } else {
    385        page = s->cmd >> 6;
    386        offset = addr | (page << 4);
    387        switch(offset) {
    388        case EN0_TSR:
    389            ret = s->tsr;
    390            break;
    391        case EN0_BOUNDARY:
    392            ret = s->boundary;
    393            break;
    394        case EN0_ISR:
    395            ret = s->isr;
    396            break;
    397        case EN0_RSARLO:
    398            ret = s->rsar & 0x00ff;
    399            break;
    400        case EN0_RSARHI:
    401            ret = s->rsar >> 8;
    402            break;
    403        case EN1_PHYS ... EN1_PHYS + 5:
    404            ret = s->phys[offset - EN1_PHYS];
    405            break;
    406        case EN1_CURPAG:
    407            ret = s->curpag;
    408            break;
    409        case EN1_MULT ... EN1_MULT + 7:
    410            ret = s->mult[offset - EN1_MULT];
    411            break;
    412        case EN0_RSR:
    413            ret = s->rsr;
    414            break;
    415        case EN2_STARTPG:
    416            ret = s->start >> 8;
    417            break;
    418        case EN2_STOPPG:
    419            ret = s->stop >> 8;
    420            break;
    421        case EN0_RTL8029ID0:
    422            ret = 0x50;
    423            break;
    424        case EN0_RTL8029ID1:
    425            ret = 0x43;
    426            break;
    427        case EN3_CONFIG0:
    428            ret = 0;		/* 10baseT media */
    429            break;
    430        case EN3_CONFIG2:
    431            ret = 0x40;		/* 10baseT active */
    432            break;
    433        case EN3_CONFIG3:
    434            ret = 0x40;		/* Full duplex */
    435            break;
    436        default:
    437            ret = 0x00;
    438            break;
    439        }
    440    }
    441    trace_ne2000_ioport_read(addr, ret);
    442    return ret;
    443}
    444
    445static inline void ne2000_mem_writeb(NE2000State *s, uint32_t addr,
    446                                     uint32_t val)
    447{
    448    if (addr < 32 ||
    449        (addr >= NE2000_PMEM_START && addr < NE2000_MEM_SIZE)) {
    450        s->mem[addr] = val;
    451    }
    452}
    453
    454static inline void ne2000_mem_writew(NE2000State *s, uint32_t addr,
    455                                     uint32_t val)
    456{
    457    addr &= ~1; /* XXX: check exact behaviour if not even */
    458    if (addr < 32 ||
    459        (addr >= NE2000_PMEM_START && addr < NE2000_MEM_SIZE)) {
    460        *(uint16_t *)(s->mem + addr) = cpu_to_le16(val);
    461    }
    462}
    463
    464static inline void ne2000_mem_writel(NE2000State *s, uint32_t addr,
    465                                     uint32_t val)
    466{
    467    addr &= ~1; /* XXX: check exact behaviour if not even */
    468    if (addr < 32
    469        || (addr >= NE2000_PMEM_START
    470            && addr + sizeof(uint32_t) <= NE2000_MEM_SIZE)) {
    471        stl_le_p(s->mem + addr, val);
    472    }
    473}
    474
    475static inline uint32_t ne2000_mem_readb(NE2000State *s, uint32_t addr)
    476{
    477    if (addr < 32 ||
    478        (addr >= NE2000_PMEM_START && addr < NE2000_MEM_SIZE)) {
    479        return s->mem[addr];
    480    } else {
    481        return 0xff;
    482    }
    483}
    484
    485static inline uint32_t ne2000_mem_readw(NE2000State *s, uint32_t addr)
    486{
    487    addr &= ~1; /* XXX: check exact behaviour if not even */
    488    if (addr < 32 ||
    489        (addr >= NE2000_PMEM_START && addr < NE2000_MEM_SIZE)) {
    490        return le16_to_cpu(*(uint16_t *)(s->mem + addr));
    491    } else {
    492        return 0xffff;
    493    }
    494}
    495
    496static inline uint32_t ne2000_mem_readl(NE2000State *s, uint32_t addr)
    497{
    498    addr &= ~1; /* XXX: check exact behaviour if not even */
    499    if (addr < 32
    500        || (addr >= NE2000_PMEM_START
    501            && addr + sizeof(uint32_t) <= NE2000_MEM_SIZE)) {
    502        return ldl_le_p(s->mem + addr);
    503    } else {
    504        return 0xffffffff;
    505    }
    506}
    507
    508static inline void ne2000_dma_update(NE2000State *s, int len)
    509{
    510    s->rsar += len;
    511    /* wrap */
    512    /* XXX: check what to do if rsar > stop */
    513    if (s->rsar == s->stop)
    514        s->rsar = s->start;
    515
    516    if (s->rcnt <= len) {
    517        s->rcnt = 0;
    518        /* signal end of transfer */
    519        s->isr |= ENISR_RDC;
    520        ne2000_update_irq(s);
    521    } else {
    522        s->rcnt -= len;
    523    }
    524}
    525
    526static void ne2000_asic_ioport_write(void *opaque, uint32_t addr, uint32_t val)
    527{
    528    NE2000State *s = opaque;
    529
    530#ifdef DEBUG_NE2000
    531    printf("NE2000: asic write val=0x%04x\n", val);
    532#endif
    533    if (s->rcnt == 0)
    534        return;
    535    if (s->dcfg & 0x01) {
    536        /* 16 bit access */
    537        ne2000_mem_writew(s, s->rsar, val);
    538        ne2000_dma_update(s, 2);
    539    } else {
    540        /* 8 bit access */
    541        ne2000_mem_writeb(s, s->rsar, val);
    542        ne2000_dma_update(s, 1);
    543    }
    544}
    545
    546static uint32_t ne2000_asic_ioport_read(void *opaque, uint32_t addr)
    547{
    548    NE2000State *s = opaque;
    549    int ret;
    550
    551    if (s->dcfg & 0x01) {
    552        /* 16 bit access */
    553        ret = ne2000_mem_readw(s, s->rsar);
    554        ne2000_dma_update(s, 2);
    555    } else {
    556        /* 8 bit access */
    557        ret = ne2000_mem_readb(s, s->rsar);
    558        ne2000_dma_update(s, 1);
    559    }
    560#ifdef DEBUG_NE2000
    561    printf("NE2000: asic read val=0x%04x\n", ret);
    562#endif
    563    return ret;
    564}
    565
    566static void ne2000_asic_ioport_writel(void *opaque, uint32_t addr, uint32_t val)
    567{
    568    NE2000State *s = opaque;
    569
    570#ifdef DEBUG_NE2000
    571    printf("NE2000: asic writel val=0x%04x\n", val);
    572#endif
    573    if (s->rcnt == 0)
    574        return;
    575    /* 32 bit access */
    576    ne2000_mem_writel(s, s->rsar, val);
    577    ne2000_dma_update(s, 4);
    578}
    579
    580static uint32_t ne2000_asic_ioport_readl(void *opaque, uint32_t addr)
    581{
    582    NE2000State *s = opaque;
    583    int ret;
    584
    585    /* 32 bit access */
    586    ret = ne2000_mem_readl(s, s->rsar);
    587    ne2000_dma_update(s, 4);
    588#ifdef DEBUG_NE2000
    589    printf("NE2000: asic readl val=0x%04x\n", ret);
    590#endif
    591    return ret;
    592}
    593
    594static void ne2000_reset_ioport_write(void *opaque, uint32_t addr, uint32_t val)
    595{
    596    /* nothing to do (end of reset pulse) */
    597}
    598
    599static uint32_t ne2000_reset_ioport_read(void *opaque, uint32_t addr)
    600{
    601    NE2000State *s = opaque;
    602    ne2000_reset(s);
    603    return 0;
    604}
    605
    606static int ne2000_post_load(void* opaque, int version_id)
    607{
    608    NE2000State* s = opaque;
    609
    610    if (version_id < 2) {
    611        s->rxcr = 0x0c;
    612    }
    613    return 0;
    614}
    615
    616const VMStateDescription vmstate_ne2000 = {
    617    .name = "ne2000",
    618    .version_id = 2,
    619    .minimum_version_id = 0,
    620    .post_load = ne2000_post_load,
    621    .fields = (VMStateField[]) {
    622        VMSTATE_UINT8_V(rxcr, NE2000State, 2),
    623        VMSTATE_UINT8(cmd, NE2000State),
    624        VMSTATE_UINT32(start, NE2000State),
    625        VMSTATE_UINT32(stop, NE2000State),
    626        VMSTATE_UINT8(boundary, NE2000State),
    627        VMSTATE_UINT8(tsr, NE2000State),
    628        VMSTATE_UINT8(tpsr, NE2000State),
    629        VMSTATE_UINT16(tcnt, NE2000State),
    630        VMSTATE_UINT16(rcnt, NE2000State),
    631        VMSTATE_UINT32(rsar, NE2000State),
    632        VMSTATE_UINT8(rsr, NE2000State),
    633        VMSTATE_UINT8(isr, NE2000State),
    634        VMSTATE_UINT8(dcfg, NE2000State),
    635        VMSTATE_UINT8(imr, NE2000State),
    636        VMSTATE_BUFFER(phys, NE2000State),
    637        VMSTATE_UINT8(curpag, NE2000State),
    638        VMSTATE_BUFFER(mult, NE2000State),
    639        VMSTATE_UNUSED(4), /* was irq */
    640        VMSTATE_BUFFER(mem, NE2000State),
    641        VMSTATE_END_OF_LIST()
    642    }
    643};
    644
    645static uint64_t ne2000_read(void *opaque, hwaddr addr,
    646                            unsigned size)
    647{
    648    NE2000State *s = opaque;
    649    uint64_t val;
    650
    651    if (addr < 0x10 && size == 1) {
    652        val = ne2000_ioport_read(s, addr);
    653    } else if (addr == 0x10) {
    654        if (size <= 2) {
    655            val = ne2000_asic_ioport_read(s, addr);
    656        } else {
    657            val = ne2000_asic_ioport_readl(s, addr);
    658        }
    659    } else if (addr == 0x1f && size == 1) {
    660        val = ne2000_reset_ioport_read(s, addr);
    661    } else {
    662        val = ((uint64_t)1 << (size * 8)) - 1;
    663    }
    664    trace_ne2000_read(addr, val);
    665
    666    return val;
    667}
    668
    669static void ne2000_write(void *opaque, hwaddr addr,
    670                         uint64_t data, unsigned size)
    671{
    672    NE2000State *s = opaque;
    673
    674    trace_ne2000_write(addr, data);
    675    if (addr < 0x10 && size == 1) {
    676        ne2000_ioport_write(s, addr, data);
    677    } else if (addr == 0x10) {
    678        if (size <= 2) {
    679            ne2000_asic_ioport_write(s, addr, data);
    680        } else {
    681            ne2000_asic_ioport_writel(s, addr, data);
    682        }
    683    } else if (addr == 0x1f && size == 1) {
    684        ne2000_reset_ioport_write(s, addr, data);
    685    }
    686}
    687
    688static const MemoryRegionOps ne2000_ops = {
    689    .read = ne2000_read,
    690    .write = ne2000_write,
    691    .endianness = DEVICE_LITTLE_ENDIAN,
    692};
    693
    694/***********************************************************/
    695/* PCI NE2000 definitions */
    696
    697void ne2000_setup_io(NE2000State *s, DeviceState *dev, unsigned size)
    698{
    699    memory_region_init_io(&s->io, OBJECT(dev), &ne2000_ops, s, "ne2000", size);
    700}