net: add checks to validate ring buffer pointers(CVE-2015-5279)
[qemu.git] / hw / net / ne2000.c
1 /*
2 * QEMU NE2000 emulation
3 *
4 * Copyright (c) 2003-2004 Fabrice Bellard
5 *
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
12 *
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
15 *
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22 * THE SOFTWARE.
23 */
24 #include "hw/hw.h"
25 #include "hw/pci/pci.h"
26 #include "net/net.h"
27 #include "ne2000.h"
28 #include "hw/loader.h"
29 #include "sysemu/sysemu.h"
30
31 /* debug NE2000 card */
32 //#define DEBUG_NE2000
33
34 #define MAX_ETH_FRAME_SIZE 1514
35
36 #define E8390_CMD 0x00 /* The command register (for all pages) */
37 /* Page 0 register offsets. */
38 #define EN0_CLDALO 0x01 /* Low byte of current local dma addr RD */
39 #define EN0_STARTPG 0x01 /* Starting page of ring bfr WR */
40 #define EN0_CLDAHI 0x02 /* High byte of current local dma addr RD */
41 #define EN0_STOPPG 0x02 /* Ending page +1 of ring bfr WR */
42 #define EN0_BOUNDARY 0x03 /* Boundary page of ring bfr RD WR */
43 #define EN0_TSR 0x04 /* Transmit status reg RD */
44 #define EN0_TPSR 0x04 /* Transmit starting page WR */
45 #define EN0_NCR 0x05 /* Number of collision reg RD */
46 #define EN0_TCNTLO 0x05 /* Low byte of tx byte count WR */
47 #define EN0_FIFO 0x06 /* FIFO RD */
48 #define EN0_TCNTHI 0x06 /* High byte of tx byte count WR */
49 #define EN0_ISR 0x07 /* Interrupt status reg RD WR */
50 #define EN0_CRDALO 0x08 /* low byte of current remote dma address RD */
51 #define EN0_RSARLO 0x08 /* Remote start address reg 0 */
52 #define EN0_CRDAHI 0x09 /* high byte, current remote dma address RD */
53 #define EN0_RSARHI 0x09 /* Remote start address reg 1 */
54 #define EN0_RCNTLO 0x0a /* Remote byte count reg WR */
55 #define EN0_RTL8029ID0 0x0a /* Realtek ID byte #1 RD */
56 #define EN0_RCNTHI 0x0b /* Remote byte count reg WR */
57 #define EN0_RTL8029ID1 0x0b /* Realtek ID byte #2 RD */
58 #define EN0_RSR 0x0c /* rx status reg RD */
59 #define EN0_RXCR 0x0c /* RX configuration reg WR */
60 #define EN0_TXCR 0x0d /* TX configuration reg WR */
61 #define EN0_COUNTER0 0x0d /* Rcv alignment error counter RD */
62 #define EN0_DCFG 0x0e /* Data configuration reg WR */
63 #define EN0_COUNTER1 0x0e /* Rcv CRC error counter RD */
64 #define EN0_IMR 0x0f /* Interrupt mask reg WR */
65 #define EN0_COUNTER2 0x0f /* Rcv missed frame error counter RD */
66
67 #define EN1_PHYS 0x11
68 #define EN1_CURPAG 0x17
69 #define EN1_MULT 0x18
70
71 #define EN2_STARTPG 0x21 /* Starting page of ring bfr RD */
72 #define EN2_STOPPG 0x22 /* Ending page +1 of ring bfr RD */
73
74 #define EN3_CONFIG0 0x33
75 #define EN3_CONFIG1 0x34
76 #define EN3_CONFIG2 0x35
77 #define EN3_CONFIG3 0x36
78
79 /* Register accessed at EN_CMD, the 8390 base addr. */
80 #define E8390_STOP 0x01 /* Stop and reset the chip */
81 #define E8390_START 0x02 /* Start the chip, clear reset */
82 #define E8390_TRANS 0x04 /* Transmit a frame */
83 #define E8390_RREAD 0x08 /* Remote read */
84 #define E8390_RWRITE 0x10 /* Remote write */
85 #define E8390_NODMA 0x20 /* Remote DMA */
86 #define E8390_PAGE0 0x00 /* Select page chip registers */
87 #define E8390_PAGE1 0x40 /* using the two high-order bits */
88 #define E8390_PAGE2 0x80 /* Page 3 is invalid. */
89
90 /* Bits in EN0_ISR - Interrupt status register */
91 #define ENISR_RX 0x01 /* Receiver, no error */
92 #define ENISR_TX 0x02 /* Transmitter, no error */
93 #define ENISR_RX_ERR 0x04 /* Receiver, with error */
94 #define ENISR_TX_ERR 0x08 /* Transmitter, with error */
95 #define ENISR_OVER 0x10 /* Receiver overwrote the ring */
96 #define ENISR_COUNTERS 0x20 /* Counters need emptying */
97 #define ENISR_RDC 0x40 /* remote dma complete */
98 #define ENISR_RESET 0x80 /* Reset completed */
99 #define ENISR_ALL 0x3f /* Interrupts we will enable */
100
101 /* Bits in received packet status byte and EN0_RSR*/
102 #define ENRSR_RXOK 0x01 /* Received a good packet */
103 #define ENRSR_CRC 0x02 /* CRC error */
104 #define ENRSR_FAE 0x04 /* frame alignment error */
105 #define ENRSR_FO 0x08 /* FIFO overrun */
106 #define ENRSR_MPA 0x10 /* missed pkt */
107 #define ENRSR_PHY 0x20 /* physical/multicast address */
108 #define ENRSR_DIS 0x40 /* receiver disable. set in monitor mode */
109 #define ENRSR_DEF 0x80 /* deferring */
110
111 /* Transmitted packet status, EN0_TSR. */
112 #define ENTSR_PTX 0x01 /* Packet transmitted without error */
113 #define ENTSR_ND 0x02 /* The transmit wasn't deferred. */
114 #define ENTSR_COL 0x04 /* The transmit collided at least once. */
115 #define ENTSR_ABT 0x08 /* The transmit collided 16 times, and was deferred. */
116 #define ENTSR_CRS 0x10 /* The carrier sense was lost. */
117 #define ENTSR_FU 0x20 /* A "FIFO underrun" occurred during transmit. */
118 #define ENTSR_CDH 0x40 /* The collision detect "heartbeat" signal was lost. */
119 #define ENTSR_OWC 0x80 /* There was an out-of-window collision. */
120
121 typedef struct PCINE2000State {
122 PCIDevice dev;
123 NE2000State ne2000;
124 } PCINE2000State;
125
126 void ne2000_reset(NE2000State *s)
127 {
128 int i;
129
130 s->isr = ENISR_RESET;
131 memcpy(s->mem, &s->c.macaddr, 6);
132 s->mem[14] = 0x57;
133 s->mem[15] = 0x57;
134
135 /* duplicate prom data */
136 for(i = 15;i >= 0; i--) {
137 s->mem[2 * i] = s->mem[i];
138 s->mem[2 * i + 1] = s->mem[i];
139 }
140 }
141
142 static void ne2000_update_irq(NE2000State *s)
143 {
144 int isr;
145 isr = (s->isr & s->imr) & 0x7f;
146 #if defined(DEBUG_NE2000)
147 printf("NE2000: Set IRQ to %d (%02x %02x)\n",
148 isr ? 1 : 0, s->isr, s->imr);
149 #endif
150 qemu_set_irq(s->irq, (isr != 0));
151 }
152
153 static int ne2000_buffer_full(NE2000State *s)
154 {
155 int avail, index, boundary;
156
157 index = s->curpag << 8;
158 boundary = s->boundary << 8;
159 if (index < boundary)
160 avail = boundary - index;
161 else
162 avail = (s->stop - s->start) - (index - boundary);
163 if (avail < (MAX_ETH_FRAME_SIZE + 4))
164 return 1;
165 return 0;
166 }
167
168 int ne2000_can_receive(NetClientState *nc)
169 {
170 NE2000State *s = qemu_get_nic_opaque(nc);
171
172 if (s->cmd & E8390_STOP)
173 return 1;
174 return !ne2000_buffer_full(s);
175 }
176
177 #define MIN_BUF_SIZE 60
178
179 ssize_t ne2000_receive(NetClientState *nc, const uint8_t *buf, size_t size_)
180 {
181 NE2000State *s = qemu_get_nic_opaque(nc);
182 int size = size_;
183 uint8_t *p;
184 unsigned int total_len, next, avail, len, index, mcast_idx;
185 uint8_t buf1[60];
186 static const uint8_t broadcast_macaddr[6] =
187 { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
188
189 #if defined(DEBUG_NE2000)
190 printf("NE2000: received len=%d\n", size);
191 #endif
192
193 if (s->cmd & E8390_STOP || ne2000_buffer_full(s))
194 return -1;
195
196 /* XXX: check this */
197 if (s->rxcr & 0x10) {
198 /* promiscuous: receive all */
199 } else {
200 if (!memcmp(buf, broadcast_macaddr, 6)) {
201 /* broadcast address */
202 if (!(s->rxcr & 0x04))
203 return size;
204 } else if (buf[0] & 0x01) {
205 /* multicast */
206 if (!(s->rxcr & 0x08))
207 return size;
208 mcast_idx = compute_mcast_idx(buf);
209 if (!(s->mult[mcast_idx >> 3] & (1 << (mcast_idx & 7))))
210 return size;
211 } else if (s->mem[0] == buf[0] &&
212 s->mem[2] == buf[1] &&
213 s->mem[4] == buf[2] &&
214 s->mem[6] == buf[3] &&
215 s->mem[8] == buf[4] &&
216 s->mem[10] == buf[5]) {
217 /* match */
218 } else {
219 return size;
220 }
221 }
222
223
224 /* if too small buffer, then expand it */
225 if (size < MIN_BUF_SIZE) {
226 memcpy(buf1, buf, size);
227 memset(buf1 + size, 0, MIN_BUF_SIZE - size);
228 buf = buf1;
229 size = MIN_BUF_SIZE;
230 }
231
232 index = s->curpag << 8;
233 if (index >= NE2000_PMEM_END) {
234 index = s->start;
235 }
236 /* 4 bytes for header */
237 total_len = size + 4;
238 /* address for next packet (4 bytes for CRC) */
239 next = index + ((total_len + 4 + 255) & ~0xff);
240 if (next >= s->stop)
241 next -= (s->stop - s->start);
242 /* prepare packet header */
243 p = s->mem + index;
244 s->rsr = ENRSR_RXOK; /* receive status */
245 /* XXX: check this */
246 if (buf[0] & 0x01)
247 s->rsr |= ENRSR_PHY;
248 p[0] = s->rsr;
249 p[1] = next >> 8;
250 p[2] = total_len;
251 p[3] = total_len >> 8;
252 index += 4;
253
254 /* write packet data */
255 while (size > 0) {
256 if (index <= s->stop)
257 avail = s->stop - index;
258 else
259 avail = 0;
260 len = size;
261 if (len > avail)
262 len = avail;
263 memcpy(s->mem + index, buf, len);
264 buf += len;
265 index += len;
266 if (index == s->stop)
267 index = s->start;
268 size -= len;
269 }
270 s->curpag = next >> 8;
271
272 /* now we can signal we have received something */
273 s->isr |= ENISR_RX;
274 ne2000_update_irq(s);
275
276 return size_;
277 }
278
279 static void ne2000_ioport_write(void *opaque, uint32_t addr, uint32_t val)
280 {
281 NE2000State *s = opaque;
282 int offset, page, index;
283
284 addr &= 0xf;
285 #ifdef DEBUG_NE2000
286 printf("NE2000: write addr=0x%x val=0x%02x\n", addr, val);
287 #endif
288 if (addr == E8390_CMD) {
289 /* control register */
290 s->cmd = val;
291 if (!(val & E8390_STOP)) { /* START bit makes no sense on RTL8029... */
292 s->isr &= ~ENISR_RESET;
293 /* test specific case: zero length transfer */
294 if ((val & (E8390_RREAD | E8390_RWRITE)) &&
295 s->rcnt == 0) {
296 s->isr |= ENISR_RDC;
297 ne2000_update_irq(s);
298 }
299 if (val & E8390_TRANS) {
300 index = (s->tpsr << 8);
301 /* XXX: next 2 lines are a hack to make netware 3.11 work */
302 if (index >= NE2000_PMEM_END)
303 index -= NE2000_PMEM_SIZE;
304 /* fail safe: check range on the transmitted length */
305 if (index + s->tcnt <= NE2000_PMEM_END) {
306 qemu_send_packet(qemu_get_queue(s->nic), s->mem + index,
307 s->tcnt);
308 }
309 /* signal end of transfer */
310 s->tsr = ENTSR_PTX;
311 s->isr |= ENISR_TX;
312 s->cmd &= ~E8390_TRANS;
313 ne2000_update_irq(s);
314 }
315 }
316 } else {
317 page = s->cmd >> 6;
318 offset = addr | (page << 4);
319 switch(offset) {
320 case EN0_STARTPG:
321 if (val << 8 <= NE2000_PMEM_END) {
322 s->start = val << 8;
323 }
324 break;
325 case EN0_STOPPG:
326 if (val << 8 <= NE2000_PMEM_END) {
327 s->stop = val << 8;
328 }
329 break;
330 case EN0_BOUNDARY:
331 if (val << 8 < NE2000_PMEM_END) {
332 s->boundary = val;
333 }
334 break;
335 case EN0_IMR:
336 s->imr = val;
337 ne2000_update_irq(s);
338 break;
339 case EN0_TPSR:
340 s->tpsr = val;
341 break;
342 case EN0_TCNTLO:
343 s->tcnt = (s->tcnt & 0xff00) | val;
344 break;
345 case EN0_TCNTHI:
346 s->tcnt = (s->tcnt & 0x00ff) | (val << 8);
347 break;
348 case EN0_RSARLO:
349 s->rsar = (s->rsar & 0xff00) | val;
350 break;
351 case EN0_RSARHI:
352 s->rsar = (s->rsar & 0x00ff) | (val << 8);
353 break;
354 case EN0_RCNTLO:
355 s->rcnt = (s->rcnt & 0xff00) | val;
356 break;
357 case EN0_RCNTHI:
358 s->rcnt = (s->rcnt & 0x00ff) | (val << 8);
359 break;
360 case EN0_RXCR:
361 s->rxcr = val;
362 break;
363 case EN0_DCFG:
364 s->dcfg = val;
365 break;
366 case EN0_ISR:
367 s->isr &= ~(val & 0x7f);
368 ne2000_update_irq(s);
369 break;
370 case EN1_PHYS ... EN1_PHYS + 5:
371 s->phys[offset - EN1_PHYS] = val;
372 break;
373 case EN1_CURPAG:
374 if (val << 8 < NE2000_PMEM_END) {
375 s->curpag = val;
376 }
377 break;
378 case EN1_MULT ... EN1_MULT + 7:
379 s->mult[offset - EN1_MULT] = val;
380 break;
381 }
382 }
383 }
384
385 static uint32_t ne2000_ioport_read(void *opaque, uint32_t addr)
386 {
387 NE2000State *s = opaque;
388 int offset, page, ret;
389
390 addr &= 0xf;
391 if (addr == E8390_CMD) {
392 ret = s->cmd;
393 } else {
394 page = s->cmd >> 6;
395 offset = addr | (page << 4);
396 switch(offset) {
397 case EN0_TSR:
398 ret = s->tsr;
399 break;
400 case EN0_BOUNDARY:
401 ret = s->boundary;
402 break;
403 case EN0_ISR:
404 ret = s->isr;
405 break;
406 case EN0_RSARLO:
407 ret = s->rsar & 0x00ff;
408 break;
409 case EN0_RSARHI:
410 ret = s->rsar >> 8;
411 break;
412 case EN1_PHYS ... EN1_PHYS + 5:
413 ret = s->phys[offset - EN1_PHYS];
414 break;
415 case EN1_CURPAG:
416 ret = s->curpag;
417 break;
418 case EN1_MULT ... EN1_MULT + 7:
419 ret = s->mult[offset - EN1_MULT];
420 break;
421 case EN0_RSR:
422 ret = s->rsr;
423 break;
424 case EN2_STARTPG:
425 ret = s->start >> 8;
426 break;
427 case EN2_STOPPG:
428 ret = s->stop >> 8;
429 break;
430 case EN0_RTL8029ID0:
431 ret = 0x50;
432 break;
433 case EN0_RTL8029ID1:
434 ret = 0x43;
435 break;
436 case EN3_CONFIG0:
437 ret = 0; /* 10baseT media */
438 break;
439 case EN3_CONFIG2:
440 ret = 0x40; /* 10baseT active */
441 break;
442 case EN3_CONFIG3:
443 ret = 0x40; /* Full duplex */
444 break;
445 default:
446 ret = 0x00;
447 break;
448 }
449 }
450 #ifdef DEBUG_NE2000
451 printf("NE2000: read addr=0x%x val=%02x\n", addr, ret);
452 #endif
453 return ret;
454 }
455
456 static inline void ne2000_mem_writeb(NE2000State *s, uint32_t addr,
457 uint32_t val)
458 {
459 if (addr < 32 ||
460 (addr >= NE2000_PMEM_START && addr < NE2000_MEM_SIZE)) {
461 s->mem[addr] = val;
462 }
463 }
464
465 static inline void ne2000_mem_writew(NE2000State *s, uint32_t addr,
466 uint32_t val)
467 {
468 addr &= ~1; /* XXX: check exact behaviour if not even */
469 if (addr < 32 ||
470 (addr >= NE2000_PMEM_START && addr < NE2000_MEM_SIZE)) {
471 *(uint16_t *)(s->mem + addr) = cpu_to_le16(val);
472 }
473 }
474
475 static inline void ne2000_mem_writel(NE2000State *s, uint32_t addr,
476 uint32_t val)
477 {
478 addr &= ~1; /* XXX: check exact behaviour if not even */
479 if (addr < 32 ||
480 (addr >= NE2000_PMEM_START && addr < NE2000_MEM_SIZE)) {
481 stl_le_p(s->mem + addr, val);
482 }
483 }
484
485 static inline uint32_t ne2000_mem_readb(NE2000State *s, uint32_t addr)
486 {
487 if (addr < 32 ||
488 (addr >= NE2000_PMEM_START && addr < NE2000_MEM_SIZE)) {
489 return s->mem[addr];
490 } else {
491 return 0xff;
492 }
493 }
494
495 static inline uint32_t ne2000_mem_readw(NE2000State *s, uint32_t addr)
496 {
497 addr &= ~1; /* XXX: check exact behaviour if not even */
498 if (addr < 32 ||
499 (addr >= NE2000_PMEM_START && addr < NE2000_MEM_SIZE)) {
500 return le16_to_cpu(*(uint16_t *)(s->mem + addr));
501 } else {
502 return 0xffff;
503 }
504 }
505
506 static inline uint32_t ne2000_mem_readl(NE2000State *s, uint32_t addr)
507 {
508 addr &= ~1; /* XXX: check exact behaviour if not even */
509 if (addr < 32 ||
510 (addr >= NE2000_PMEM_START && addr < NE2000_MEM_SIZE)) {
511 return ldl_le_p(s->mem + addr);
512 } else {
513 return 0xffffffff;
514 }
515 }
516
517 static inline void ne2000_dma_update(NE2000State *s, int len)
518 {
519 s->rsar += len;
520 /* wrap */
521 /* XXX: check what to do if rsar > stop */
522 if (s->rsar == s->stop)
523 s->rsar = s->start;
524
525 if (s->rcnt <= len) {
526 s->rcnt = 0;
527 /* signal end of transfer */
528 s->isr |= ENISR_RDC;
529 ne2000_update_irq(s);
530 } else {
531 s->rcnt -= len;
532 }
533 }
534
535 static void ne2000_asic_ioport_write(void *opaque, uint32_t addr, uint32_t val)
536 {
537 NE2000State *s = opaque;
538
539 #ifdef DEBUG_NE2000
540 printf("NE2000: asic write val=0x%04x\n", val);
541 #endif
542 if (s->rcnt == 0)
543 return;
544 if (s->dcfg & 0x01) {
545 /* 16 bit access */
546 ne2000_mem_writew(s, s->rsar, val);
547 ne2000_dma_update(s, 2);
548 } else {
549 /* 8 bit access */
550 ne2000_mem_writeb(s, s->rsar, val);
551 ne2000_dma_update(s, 1);
552 }
553 }
554
555 static uint32_t ne2000_asic_ioport_read(void *opaque, uint32_t addr)
556 {
557 NE2000State *s = opaque;
558 int ret;
559
560 if (s->dcfg & 0x01) {
561 /* 16 bit access */
562 ret = ne2000_mem_readw(s, s->rsar);
563 ne2000_dma_update(s, 2);
564 } else {
565 /* 8 bit access */
566 ret = ne2000_mem_readb(s, s->rsar);
567 ne2000_dma_update(s, 1);
568 }
569 #ifdef DEBUG_NE2000
570 printf("NE2000: asic read val=0x%04x\n", ret);
571 #endif
572 return ret;
573 }
574
575 static void ne2000_asic_ioport_writel(void *opaque, uint32_t addr, uint32_t val)
576 {
577 NE2000State *s = opaque;
578
579 #ifdef DEBUG_NE2000
580 printf("NE2000: asic writel val=0x%04x\n", val);
581 #endif
582 if (s->rcnt == 0)
583 return;
584 /* 32 bit access */
585 ne2000_mem_writel(s, s->rsar, val);
586 ne2000_dma_update(s, 4);
587 }
588
589 static uint32_t ne2000_asic_ioport_readl(void *opaque, uint32_t addr)
590 {
591 NE2000State *s = opaque;
592 int ret;
593
594 /* 32 bit access */
595 ret = ne2000_mem_readl(s, s->rsar);
596 ne2000_dma_update(s, 4);
597 #ifdef DEBUG_NE2000
598 printf("NE2000: asic readl val=0x%04x\n", ret);
599 #endif
600 return ret;
601 }
602
603 static void ne2000_reset_ioport_write(void *opaque, uint32_t addr, uint32_t val)
604 {
605 /* nothing to do (end of reset pulse) */
606 }
607
608 static uint32_t ne2000_reset_ioport_read(void *opaque, uint32_t addr)
609 {
610 NE2000State *s = opaque;
611 ne2000_reset(s);
612 return 0;
613 }
614
615 static int ne2000_post_load(void* opaque, int version_id)
616 {
617 NE2000State* s = opaque;
618
619 if (version_id < 2) {
620 s->rxcr = 0x0c;
621 }
622 return 0;
623 }
624
625 const VMStateDescription vmstate_ne2000 = {
626 .name = "ne2000",
627 .version_id = 2,
628 .minimum_version_id = 0,
629 .post_load = ne2000_post_load,
630 .fields = (VMStateField[]) {
631 VMSTATE_UINT8_V(rxcr, NE2000State, 2),
632 VMSTATE_UINT8(cmd, NE2000State),
633 VMSTATE_UINT32(start, NE2000State),
634 VMSTATE_UINT32(stop, NE2000State),
635 VMSTATE_UINT8(boundary, NE2000State),
636 VMSTATE_UINT8(tsr, NE2000State),
637 VMSTATE_UINT8(tpsr, NE2000State),
638 VMSTATE_UINT16(tcnt, NE2000State),
639 VMSTATE_UINT16(rcnt, NE2000State),
640 VMSTATE_UINT32(rsar, NE2000State),
641 VMSTATE_UINT8(rsr, NE2000State),
642 VMSTATE_UINT8(isr, NE2000State),
643 VMSTATE_UINT8(dcfg, NE2000State),
644 VMSTATE_UINT8(imr, NE2000State),
645 VMSTATE_BUFFER(phys, NE2000State),
646 VMSTATE_UINT8(curpag, NE2000State),
647 VMSTATE_BUFFER(mult, NE2000State),
648 VMSTATE_UNUSED(4), /* was irq */
649 VMSTATE_BUFFER(mem, NE2000State),
650 VMSTATE_END_OF_LIST()
651 }
652 };
653
654 static const VMStateDescription vmstate_pci_ne2000 = {
655 .name = "ne2000",
656 .version_id = 3,
657 .minimum_version_id = 3,
658 .fields = (VMStateField[]) {
659 VMSTATE_PCI_DEVICE(dev, PCINE2000State),
660 VMSTATE_STRUCT(ne2000, PCINE2000State, 0, vmstate_ne2000, NE2000State),
661 VMSTATE_END_OF_LIST()
662 }
663 };
664
665 static uint64_t ne2000_read(void *opaque, hwaddr addr,
666 unsigned size)
667 {
668 NE2000State *s = opaque;
669
670 if (addr < 0x10 && size == 1) {
671 return ne2000_ioport_read(s, addr);
672 } else if (addr == 0x10) {
673 if (size <= 2) {
674 return ne2000_asic_ioport_read(s, addr);
675 } else {
676 return ne2000_asic_ioport_readl(s, addr);
677 }
678 } else if (addr == 0x1f && size == 1) {
679 return ne2000_reset_ioport_read(s, addr);
680 }
681 return ((uint64_t)1 << (size * 8)) - 1;
682 }
683
684 static void ne2000_write(void *opaque, hwaddr addr,
685 uint64_t data, unsigned size)
686 {
687 NE2000State *s = opaque;
688
689 if (addr < 0x10 && size == 1) {
690 ne2000_ioport_write(s, addr, data);
691 } else if (addr == 0x10) {
692 if (size <= 2) {
693 ne2000_asic_ioport_write(s, addr, data);
694 } else {
695 ne2000_asic_ioport_writel(s, addr, data);
696 }
697 } else if (addr == 0x1f && size == 1) {
698 ne2000_reset_ioport_write(s, addr, data);
699 }
700 }
701
702 static const MemoryRegionOps ne2000_ops = {
703 .read = ne2000_read,
704 .write = ne2000_write,
705 .endianness = DEVICE_LITTLE_ENDIAN,
706 };
707
708 /***********************************************************/
709 /* PCI NE2000 definitions */
710
711 void ne2000_setup_io(NE2000State *s, DeviceState *dev, unsigned size)
712 {
713 memory_region_init_io(&s->io, OBJECT(dev), &ne2000_ops, s, "ne2000", size);
714 }
715
716 static NetClientInfo net_ne2000_info = {
717 .type = NET_CLIENT_OPTIONS_KIND_NIC,
718 .size = sizeof(NICState),
719 .can_receive = ne2000_can_receive,
720 .receive = ne2000_receive,
721 };
722
723 static void pci_ne2000_realize(PCIDevice *pci_dev, Error **errp)
724 {
725 PCINE2000State *d = DO_UPCAST(PCINE2000State, dev, pci_dev);
726 NE2000State *s;
727 uint8_t *pci_conf;
728
729 pci_conf = d->dev.config;
730 pci_conf[PCI_INTERRUPT_PIN] = 1; /* interrupt pin A */
731
732 s = &d->ne2000;
733 ne2000_setup_io(s, DEVICE(pci_dev), 0x100);
734 pci_register_bar(&d->dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->io);
735 s->irq = pci_allocate_irq(&d->dev);
736
737 qemu_macaddr_default_if_unset(&s->c.macaddr);
738 ne2000_reset(s);
739
740 s->nic = qemu_new_nic(&net_ne2000_info, &s->c,
741 object_get_typename(OBJECT(pci_dev)), pci_dev->qdev.id, s);
742 qemu_format_nic_info_str(qemu_get_queue(s->nic), s->c.macaddr.a);
743 }
744
745 static void pci_ne2000_exit(PCIDevice *pci_dev)
746 {
747 PCINE2000State *d = DO_UPCAST(PCINE2000State, dev, pci_dev);
748 NE2000State *s = &d->ne2000;
749
750 qemu_del_nic(s->nic);
751 qemu_free_irq(s->irq);
752 }
753
754 static void ne2000_instance_init(Object *obj)
755 {
756 PCIDevice *pci_dev = PCI_DEVICE(obj);
757 PCINE2000State *d = DO_UPCAST(PCINE2000State, dev, pci_dev);
758 NE2000State *s = &d->ne2000;
759
760 device_add_bootindex_property(obj, &s->c.bootindex,
761 "bootindex", "/ethernet-phy@0",
762 &pci_dev->qdev, NULL);
763 }
764
765 static Property ne2000_properties[] = {
766 DEFINE_NIC_PROPERTIES(PCINE2000State, ne2000.c),
767 DEFINE_PROP_END_OF_LIST(),
768 };
769
770 static void ne2000_class_init(ObjectClass *klass, void *data)
771 {
772 DeviceClass *dc = DEVICE_CLASS(klass);
773 PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
774
775 k->realize = pci_ne2000_realize;
776 k->exit = pci_ne2000_exit;
777 k->romfile = "efi-ne2k_pci.rom",
778 k->vendor_id = PCI_VENDOR_ID_REALTEK;
779 k->device_id = PCI_DEVICE_ID_REALTEK_8029;
780 k->class_id = PCI_CLASS_NETWORK_ETHERNET;
781 dc->vmsd = &vmstate_pci_ne2000;
782 dc->props = ne2000_properties;
783 set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
784 }
785
786 static const TypeInfo ne2000_info = {
787 .name = "ne2k_pci",
788 .parent = TYPE_PCI_DEVICE,
789 .instance_size = sizeof(PCINE2000State),
790 .class_init = ne2000_class_init,
791 .instance_init = ne2000_instance_init,
792 };
793
794 static void ne2000_register_types(void)
795 {
796 type_register_static(&ne2000_info);
797 }
798
799 type_init(ne2000_register_types)