Index: hw/rtl8139.c
===================================================================
RCS file: /cvsroot/qemu/qemu/hw/rtl8139.c,v
retrieving revision 1.1
diff -u -r1.1 rtl8139.c
--- hw/rtl8139.c	5 Feb 2006 04:14:41 -0000	1.1
+++ hw/rtl8139.c	30 Jun 2006 16:46:50 -0000
@@ -30,7 +30,9 @@
 
 
 /* debug RTL8139 card */
-//#define DEBUG_RTL8139 1
+#define DEBUG_RTL8139 1
+
+#define PCI_FREQUENCY 33000000L
 
 /* debug RTL8139 card C+ mode only */
 //#define DEBUG_RTL8139CP 1
@@ -39,6 +41,8 @@
    ignored by most drivers, disabled by default */
 //#define RTL8139_CALCULATE_RXCRC 1
 
+/* Uncomment to enable on-board timer interrupts */
+//#define RTL8139_ONBOARD_TIMER 1
 
 #if defined(RTL8139_CALCULATE_RXCRC)
 /* For crc32 */
@@ -56,7 +60,8 @@
 enum RTL8139_registers {
     MAC0 = 0,        /* Ethernet hardware address. */
     MAR0 = 8,        /* Multicast filter. */
-    TxStatus0 = 0x10,    /* Transmit status (Four 32bit registers). */
+    TxStatus0 = 0x10,    /* Transmit status (Four 32bit registers). C mode only */
+						/* Dump Tally Conter control register(64bit). C+ mode only */
     TxAddr0 = 0x20,        /* Tx descriptors (also four 32bit). */
     RxBuf = 0x30,
     ChipCmd = 0x37,
@@ -315,6 +320,11 @@
     (b30<<30 | b29<<29 | b28<<28 | b27<<27 | b26<<26 | b23<<23 | b22<<22)
 #define HW_REVID_MASK    HW_REVID(1, 1, 1, 1, 1, 1, 1)
 
+#define RTL8139_PCI_REVID_8139      0x10
+#define RTL8139_PCI_REVID_8139CPLUS 0x20
+
+#define RTL8139_PCI_REVID           RTL8139_PCI_REVID_8139CPLUS
+
 /* Size is 64 * 16bit words */
 #define EEPROM_9346_ADDR_BITS 6
 #define EEPROM_9346_SIZE  (1 << EEPROM_9346_ADDR_BITS)
@@ -356,11 +366,41 @@
     uint8_t eedo;
 } EEprom9346;
 
+typedef struct RTL8139TallyCounters
+{
+	/* Tally counters */
+	uint64_t   TxOk;
+	uint64_t   RxOk;
+	uint64_t   TxERR;
+	uint32_t   RxERR;
+	uint16_t   MissPkt;
+	uint16_t   FAE;
+	uint32_t   Tx1Col;
+	uint32_t   TxMCol;
+	uint64_t   RxOkPhy;
+	uint64_t   RxOkBrd;
+	uint32_t   RxOkMul;
+	uint16_t   TxAbt;
+	uint16_t   TxUndrn;
+} RTL8139TallyCounters;
+
+/* Clears all tally counters */
+static void RTL8139TallyCounters_clear(RTL8139TallyCounters* counters);
+
+/* Writes tally counters to specified physical memory address */
+static void RTL8139TallyCounters_physical_memory_write(target_phys_addr_t tc_addr, RTL8139TallyCounters* counters);
+
+/* Loads values of tally counters from VM state file */
+static void RTL8139TallyCounters_load(QEMUFile* f, RTL8139TallyCounters *tally_counters);
+
+/* Saves values of tally counters to VM state file */
+static void RTL8139TallyCounters_save(QEMUFile* f, RTL8139TallyCounters *tally_counters);
+
 typedef struct RTL8139State {
     uint8_t phys[8]; /* mac address */
     uint8_t mult[8]; /* multicast mask array */
 
-    uint32_t TxStatus[4]; /* TxStatus0 */
+    uint32_t TxStatus[4]; /* TxStatus0 in C mode*/ /* also DTCCR[0] and DTCCR[1] in C+ mode */
     uint32_t TxAddr[4];   /* TxAddr0 */
     uint32_t RxBuf;       /* Receive buffer */
     uint32_t RxBufferSize;/* internal variable, receive ring buffer size in C mode */
@@ -414,7 +454,22 @@
     uint32_t   RxRingAddrHI;
 
     EEprom9346 eeprom;
-    
+
+	uint32_t   TCTR;
+	uint32_t   TimerInt;
+	int64_t    TCTR_base;
+
+	/* Tally counters */
+	RTL8139TallyCounters tally_counters;
+
+	/* Non-persistent data */
+	uint8_t   *cplus_txbuffer;
+	int        cplus_txbuffer_len;
+	int        cplus_txbuffer_offset;
+
+	/* PCI interrupt timer */
+	QEMUTimer *timer;
+
 } RTL8139State;
 
 void prom9346_decode_command(EEprom9346 *eeprom, uint8_t command)
@@ -512,6 +567,19 @@
             eeprom->output <<= 1;
             if (eeprom->tick == 16)
             {
+#if 1
+		// the FreeBSD drivers (rl and re) don't explicitly toggle
+		// CS between reads (or does setting Cfg9346 to 0 count too?),
+		// so we need to enter wait-for-command state here
+                eeprom->mode = Chip9346_enter_command_mode;
+                eeprom->input = 0;
+                eeprom->tick = 0;
+
+#if defined(DEBUG_RTL8139)
+                printf("eeprom: +++ end of read, awaiting next command\n");
+#endif
+#else
+		// original behaviour
                 ++eeprom->address;
                 eeprom->address &= EEPROM_9346_ADDR_MASK;
                 eeprom->output = eeprom->contents[eeprom->address];
@@ -521,6 +589,7 @@
                 printf("eeprom: +++ read next address 0x%02x data=0x%04x\n",
                        eeprom->address, eeprom->output);
 #endif
+#endif
             }
             break;
 
@@ -751,7 +820,7 @@
     }
 }
 
-static void rtl8139_receive(void *opaque, const uint8_t *buf, int size)
+static void rtl8139_do_receive(void *opaque, const uint8_t *buf, int size, int do_interrupt)
 {
     RTL8139State *s = opaque;
 
@@ -799,14 +868,22 @@
 #if defined(DEBUG_RTL8139)
                 printf(">>> RTL8139: broadcast packet rejected\n");
 #endif
-                return;
+
+				/* update tally counter */
+				++s->tally_counters.RxERR;
+
+				return;
             }
 
-            packet_header |= RxBroadcast;
+			packet_header |= RxBroadcast;
 
 #if defined(DEBUG_RTL8139)
             printf(">>> RTL8139: broadcast packet received\n");
 #endif
+
+			/* update tally counter */
+			++s->tally_counters.RxOkBrd;
+
         } else if (buf[0] & 0x01) {
             /* multicast */
             if (!(s->RxConfig & AcceptMulticast))
@@ -814,6 +891,10 @@
 #if defined(DEBUG_RTL8139)
                 printf(">>> RTL8139: multicast packet rejected\n");
 #endif
+
+				/* update tally counter */
+				++s->tally_counters.RxERR;
+
                 return;
             }
 
@@ -824,6 +905,10 @@
 #if defined(DEBUG_RTL8139)
                 printf(">>> RTL8139: multicast address mismatch\n");
 #endif
+
+				/* update tally counter */
+				++s->tally_counters.RxERR;
+
                 return;
             }
 
@@ -832,6 +917,10 @@
 #if defined(DEBUG_RTL8139)
             printf(">>> RTL8139: multicast packet received\n");
 #endif
+
+			/* update tally counter */
+			++s->tally_counters.RxOkMul;
+
         } else if (s->phys[0] == buf[0] &&
                    s->phys[1] == buf[1] &&                   
                    s->phys[2] == buf[2] &&            
@@ -844,7 +933,11 @@
 #if defined(DEBUG_RTL8139)
                 printf(">>> RTL8139: rejecting physical address matching packet\n");
 #endif
-                return;
+
+				/* update tally counter */
+				++s->tally_counters.RxERR;
+
+				return;
             }
 
             packet_header |= RxPhysical;
@@ -853,11 +946,18 @@
             printf(">>> RTL8139: physical address matching packet received\n");
 #endif
 
+			/* update tally counter */
+			++s->tally_counters.RxOkPhy;
+
         } else {
 
 #if defined(DEBUG_RTL8139)
-                printf(">>> RTL8139: unknown packet\n");
+            printf(">>> RTL8139: unknown packet\n");
 #endif
+
+			/* update tally counter */
+			++s->tally_counters.RxERR;
+
             return;
         }
     }
@@ -898,8 +998,8 @@
         cplus_rx_ring_desc += 16 * descriptor;
 
 #ifdef DEBUG_RTL8139
-        printf("RTL8139: +++ C+ mode reading RX descriptor %d from host memory at %08x %08x = 0x%8lx\n",
-               descriptor, s->RxRingAddrHI, s->RxRingAddrLO, cplus_rx_ring_desc);
+        printf("RTL8139: +++ C+ mode reading RX descriptor %d from host memory at %08x %08x = %016" PRIx64 "\n",
+               descriptor, s->RxRingAddrHI, s->RxRingAddrLO, (uint64_t)cplus_rx_ring_desc);
 #endif
 
         uint32_t val, rxdw0,rxdw1,rxbufLO,rxbufHI;
@@ -926,7 +1026,12 @@
 #endif
             s->IntrStatus |= RxOverflow;
             ++s->RxMissed;
-            rtl8139_update_irq(s);
+
+			/* update tally counter */
+			++s->tally_counters.RxERR;
+			++s->tally_counters.MissPkt;
+
+			rtl8139_update_irq(s);
             return;
         }
 
@@ -940,7 +1045,12 @@
 #endif
             s->IntrStatus |= RxOverflow;
             ++s->RxMissed;
-            rtl8139_update_irq(s);
+
+			/* update tally counter */
+			++s->tally_counters.RxERR;
+			++s->tally_counters.MissPkt;
+
+			rtl8139_update_irq(s);
             return;
         }
 
@@ -1008,7 +1118,10 @@
         val = cpu_to_le32(rxdw1);
         cpu_physical_memory_write(cplus_rx_ring_desc+4,  (uint8_t *)&val, 4);
 
-        /* seek to next Rx descriptor */
+		/* update tally counter */
+		++s->tally_counters.RxOk;
+
+		/* seek to next Rx descriptor */
         if (rxdw0 & CP_RX_EOR)
         {
             s->currCPlusRxDesc = 0;
@@ -1078,7 +1191,16 @@
     }
 
     s->IntrStatus |= RxOK;
-    rtl8139_update_irq(s);
+
+	if (do_interrupt)
+	{
+		rtl8139_update_irq(s);
+	}
+}
+
+static void rtl8139_receive(void *opaque, const uint8_t *buf, int size)
+{
+	rtl8139_do_receive(opaque, buf, size, 1);
 }
 
 static void rtl8139_reset_rxring(RTL8139State *s, uint32_t bufferSize)
@@ -1103,6 +1225,11 @@
 
     /* prepare eeprom */
     s->eeprom.contents[0] = 0x8129;
+#if 1
+    // PCI vendor and device ID should be mirrored here
+    s->eeprom.contents[1] = 0x10ec;
+    s->eeprom.contents[2] = 0x8139;
+#endif
     memcpy(&s->eeprom.contents[7], s->macaddr, 6);
 
     /* mark all status registers as owned by host */
@@ -1129,7 +1256,7 @@
 //    s->TxConfig |= HW_REVID(1, 0, 0, 0, 0, 0, 0); // RTL-8139  HasHltClk
     s->clock_enabled = 0;
 #else
-    s->TxConfig |= HW_REVID(1, 1, 1, 0, 1, 0, 0); // RTL-8139C HasLWake
+    s->TxConfig |= HW_REVID(1, 1, 1, 0, 1, 1, 0); // RTL-8139C+ HasLWake
     s->clock_enabled = 1;
 #endif
 
@@ -1157,6 +1284,113 @@
     s->NWayAdvert    = 0x05e1; /* all modes, full duplex */
     s->NWayLPAR      = 0x05e1; /* all modes, full duplex */
     s->NWayExpansion = 0x0001; /* autonegotiation supported */
+
+	/* also reset timer and disable timer interrupt */
+	s->TCTR = 0;
+	s->TimerInt = 0;
+	s->TCTR_base = 0;
+
+	/* reset tally counters */
+	RTL8139TallyCounters_clear(&s->tally_counters);
+}
+
+void RTL8139TallyCounters_clear(RTL8139TallyCounters* counters)
+{
+	counters->TxOk = 0;
+	counters->RxOk = 0;
+	counters->TxERR = 0;
+	counters->RxERR = 0;
+	counters->MissPkt = 0;
+	counters->FAE = 0;
+	counters->Tx1Col = 0;
+	counters->TxMCol = 0;
+	counters->RxOkPhy = 0;
+	counters->RxOkBrd = 0;
+	counters->RxOkMul = 0;
+	counters->TxAbt = 0;
+	counters->TxUndrn = 0;
+}
+
+static void RTL8139TallyCounters_physical_memory_write(target_phys_addr_t tc_addr, RTL8139TallyCounters* tally_counters)
+{
+	uint16_t val16;
+	uint32_t val32;
+	uint64_t val64;
+
+	val64 = cpu_to_le64(tally_counters->TxOk);
+	cpu_physical_memory_write(tc_addr + 0,    (uint8_t *)&val64, 8);
+
+	val64 = cpu_to_le64(tally_counters->RxOk);
+	cpu_physical_memory_write(tc_addr + 8,    (uint8_t *)&val64, 8);
+
+	val64 = cpu_to_le64(tally_counters->TxERR);
+	cpu_physical_memory_write(tc_addr + 16,    (uint8_t *)&val64, 8);
+
+	val32 = cpu_to_le32(tally_counters->RxERR);
+	cpu_physical_memory_write(tc_addr + 24,    (uint8_t *)&val32, 4);
+
+	val16 = cpu_to_le16(tally_counters->MissPkt);
+	cpu_physical_memory_write(tc_addr + 28,    (uint8_t *)&val16, 2);
+
+	val16 = cpu_to_le16(tally_counters->FAE);
+	cpu_physical_memory_write(tc_addr + 30,    (uint8_t *)&val16, 2);
+
+	val32 = cpu_to_le32(tally_counters->Tx1Col);
+	cpu_physical_memory_write(tc_addr + 32,    (uint8_t *)&val32, 4);
+
+	val32 = cpu_to_le32(tally_counters->TxMCol);
+	cpu_physical_memory_write(tc_addr + 36,    (uint8_t *)&val32, 4);
+
+	val64 = cpu_to_le64(tally_counters->RxOkPhy);
+	cpu_physical_memory_write(tc_addr + 40,    (uint8_t *)&val64, 8);
+
+	val64 = cpu_to_le64(tally_counters->RxOkBrd);
+	cpu_physical_memory_write(tc_addr + 48,    (uint8_t *)&val64, 8);
+
+	val32 = cpu_to_le32(tally_counters->RxOkMul);
+	cpu_physical_memory_write(tc_addr + 56,    (uint8_t *)&val32, 4);
+
+	val16 = cpu_to_le16(tally_counters->TxAbt);
+	cpu_physical_memory_write(tc_addr + 60,    (uint8_t *)&val16, 2);
+
+	val16 = cpu_to_le16(tally_counters->TxUndrn);
+	cpu_physical_memory_write(tc_addr + 62,    (uint8_t *)&val16, 2);
+}
+
+/* Loads values of tally counters from VM state file */
+static void RTL8139TallyCounters_load(QEMUFile* f, RTL8139TallyCounters *tally_counters)
+{
+	qemu_get_be64s(f, &tally_counters->TxOk);
+	qemu_get_be64s(f, &tally_counters->RxOk);
+	qemu_get_be64s(f, &tally_counters->TxERR);
+	qemu_get_be32s(f, &tally_counters->RxERR);
+	qemu_get_be16s(f, &tally_counters->MissPkt);
+	qemu_get_be16s(f, &tally_counters->FAE);
+	qemu_get_be32s(f, &tally_counters->Tx1Col);
+	qemu_get_be32s(f, &tally_counters->TxMCol);
+	qemu_get_be64s(f, &tally_counters->RxOkPhy);
+	qemu_get_be64s(f, &tally_counters->RxOkBrd);
+	qemu_get_be32s(f, &tally_counters->RxOkMul);
+	qemu_get_be16s(f, &tally_counters->TxAbt);
+	qemu_get_be16s(f, &tally_counters->TxUndrn);
+}
+
+/* Saves values of tally counters to VM state file */
+static void RTL8139TallyCounters_save(QEMUFile* f, RTL8139TallyCounters *tally_counters)
+{
+	qemu_put_be64s(f, &tally_counters->TxOk);
+	qemu_put_be64s(f, &tally_counters->RxOk);
+	qemu_put_be64s(f, &tally_counters->TxERR);
+	qemu_put_be32s(f, &tally_counters->RxERR);
+	qemu_put_be16s(f, &tally_counters->MissPkt);
+	qemu_put_be16s(f, &tally_counters->FAE);
+	qemu_put_be32s(f, &tally_counters->Tx1Col);
+	qemu_put_be32s(f, &tally_counters->TxMCol);
+	qemu_put_be64s(f, &tally_counters->RxOkPhy);
+	qemu_put_be64s(f, &tally_counters->RxOkBrd);
+	qemu_put_be32s(f, &tally_counters->RxOkMul);
+	qemu_put_be16s(f, &tally_counters->TxAbt);
+	qemu_put_be16s(f, &tally_counters->TxUndrn);
 }
 
 static void rtl8139_ChipCmd_write(RTL8139State *s, uint32_t val)
@@ -1622,12 +1856,22 @@
 #endif
     cpu_physical_memory_read(s->TxAddr[descriptor], txbuffer, txsize);
 
-    qemu_send_packet(s->vc, txbuffer, txsize);
-
     /* Mark descriptor as transferred */
     s->TxStatus[descriptor] |= TxHostOwns;
     s->TxStatus[descriptor] |= TxStatOK;
 
+	if (TxLoopBack == (s->TxConfig & TxLoopBack))
+	{
+#ifdef DEBUG_RTL8139
+		printf("RTL8139: +++ transmit loopback mode\n");
+#endif
+		rtl8139_do_receive(s, txbuffer, txsize, 0);
+	}
+	else
+	{
+		qemu_send_packet(s->vc, txbuffer, txsize);
+	}
+
 #ifdef DEBUG_RTL8139
     printf("RTL8139: +++ transmitted %d bytes from descriptor %d\n", txsize, descriptor);
 #endif
@@ -1731,55 +1975,154 @@
 #if defined(DEBUG_RTL8139)
         printf("RTL8139: C+ Tx mode : descriptor %d is owned by host\n", descriptor);
 #endif
-        return 0 ;
+
+		return 0 ;
     }
 
 #ifdef DEBUG_RTL8139
     printf("RTL8139: +++ C+ Tx mode : transmitting from descriptor %d\n", descriptor);
 #endif
 
+	if (txdw0 & CP_TX_FS)
+	{
+#ifdef DEBUG_RTL8139
+		printf("RTL8139: +++ C+ Tx mode : descriptor %d is first segment descriptor\n", descriptor);
+#endif
+		/* reset internal buffer offset */
+		s->cplus_txbuffer_offset = 0;
+	}
+
     int txsize = txdw0 & CP_TX_BUFFER_SIZE_MASK;
     target_phys_addr_t tx_addr = rtl8139_addr64(txbufLO, txbufHI);
 
-    uint8_t txbuffer[CP_TX_BUFFER_SIZE];
+	/* make sure we have enough space to assemble the packet */
+	if (!s->cplus_txbuffer)
+	{
+		s->cplus_txbuffer_len = CP_TX_BUFFER_SIZE;
+		s->cplus_txbuffer = malloc(s->cplus_txbuffer_len);
+		s->cplus_txbuffer_offset = 0;
+	}
+
+	while (s->cplus_txbuffer && s->cplus_txbuffer_offset + txsize >= s->cplus_txbuffer_len)
+	{
+		s->cplus_txbuffer_len += CP_TX_BUFFER_SIZE;
+		s->cplus_txbuffer = realloc(s->cplus_txbuffer, s->cplus_txbuffer_len);
 
 #ifdef DEBUG_RTL8139
-    printf("RTL8139: +++ C+ mode transmit reading %d bytes from host memory at 0x%08x\n", txsize, tx_addr);
+		printf("RTL8139: +++ C+ mode transmission buffer space changed to %d\n", s->cplus_txbuffer_len);
 #endif
-    cpu_physical_memory_read(tx_addr, txbuffer, txsize);
+	}
 
-    /* transmit the packet */
-    qemu_send_packet(s->vc, txbuffer, txsize);
+	if (!s->cplus_txbuffer)
+	{
+		/* out of memory */
+
+#ifdef DEBUG_RTL8139
+		printf("RTL8139: +++ C+ mode transmiter failed to reallocate %d bytes\n", s->cplus_txbuffer_len);
+#endif
+
+		/* update tally counter */
+		++s->tally_counters.TxERR;
+		++s->tally_counters.TxAbt;
+
+		return 0;
+	}
+
+	/* append more data to the packet */
+
+#ifdef DEBUG_RTL8139
+	printf("RTL8139: +++ C+ mode transmit reading %d bytes from host memory at %016" PRIx64 " to offset %d\n",
+		   txsize, (uint64_t)tx_addr, s->cplus_txbuffer_offset);
+#endif
 
-    /* transfer ownership to target */
-    txdw0 &= ~CP_RX_OWN;
+	cpu_physical_memory_read(tx_addr, s->cplus_txbuffer + s->cplus_txbuffer_offset, txsize);
+	s->cplus_txbuffer_offset += txsize;
 
-    /* reset error indicator bits */
-    txdw0 &= ~CP_TX_STATUS_UNF;
-    txdw0 &= ~CP_TX_STATUS_TES;
-    txdw0 &= ~CP_TX_STATUS_OWC;
-    txdw0 &= ~CP_TX_STATUS_LNKF;
-    txdw0 &= ~CP_TX_STATUS_EXC;
+	/* transfer ownership to target */
+	txdw0 &= ~CP_RX_OWN;
 
-    /* update ring data */
-    val = cpu_to_le32(txdw0);
-    cpu_physical_memory_write(cplus_tx_ring_desc,    (uint8_t *)&val, 4);
+	/* reset error indicator bits */
+	txdw0 &= ~CP_TX_STATUS_UNF;
+	txdw0 &= ~CP_TX_STATUS_TES;
+	txdw0 &= ~CP_TX_STATUS_OWC;
+	txdw0 &= ~CP_TX_STATUS_LNKF;
+	txdw0 &= ~CP_TX_STATUS_EXC;
+
+	/* update ring data */
+	val = cpu_to_le32(txdw0);
+	cpu_physical_memory_write(cplus_tx_ring_desc,    (uint8_t *)&val, 4);
 //    val = cpu_to_le32(txdw1);
 //    cpu_physical_memory_write(cplus_tx_ring_desc+4,  &val, 4);
 
-    /* seek to next Rx descriptor */
-    if (txdw0 & CP_TX_EOR)
-    {
-        s->currCPlusTxDesc = 0;
-    }
-    else
-    {
-        ++s->currCPlusTxDesc;
-    }
-
+	/* seek to next Rx descriptor */
+	if (txdw0 & CP_TX_EOR)
+	{
+		s->currCPlusTxDesc = 0;
+	}
+	else
+	{
+		++s->currCPlusTxDesc;
+		if (s->currCPlusTxDesc >= 64)
+			s->currCPlusTxDesc = 0;
+	}
+
+	/* Now decide if descriptor being processed is holding the last segment of packet */
+	if (txdw0 & CP_TX_LS)
+	{
+#ifdef DEBUG_RTL8139
+		printf("RTL8139: +++ C+ Tx mode : descriptor %d is last segment descriptor\n", descriptor);
+#endif
+
+		/* can transfer fully assembled packet */
+
+		uint8_t *saved_buffer  = s->cplus_txbuffer;
+		int      saved_size    = s->cplus_txbuffer_offset;
+		int      saved_buffer_len = s->cplus_txbuffer_len;
+
+		/* reset the card space to protect from recursive call */
+		s->cplus_txbuffer = NULL;
+		s->cplus_txbuffer_offset = 0;
+		s->cplus_txbuffer_len = 0;
+
+		/* update tally counter */
+		++s->tally_counters.TxOk;
+
+#ifdef DEBUG_RTL8139
+		printf("RTL8139: +++ C+ mode transmitting %d bytes packet\n", saved_size);
+#endif
+
+		if (TxLoopBack == (s->TxConfig & TxLoopBack))
+		{
+#ifdef DEBUG_RTL8139
+			printf("RTL8139: +++ C+ transmit loopback mode\n");
+#endif
+			rtl8139_receive(s, saved_buffer, saved_size);
+		}
+		else
+		{
+			/* transmit the packet */
+			qemu_send_packet(s->vc, saved_buffer, saved_size);
+		}
+
+		/* restore card space if there was no recursion and reset offset */
+		if (!s->cplus_txbuffer)
+		{
+			s->cplus_txbuffer        = saved_buffer;
+			s->cplus_txbuffer_len    = saved_buffer_len;
+			s->cplus_txbuffer_offset = 0;
+		}
+		else
+		{
+			free(saved_buffer);
+		}
+	}
+	else
+	{
 #ifdef DEBUG_RTL8139
-    printf("RTL8139: +++ C+ mode transmitted %d bytes from descriptor %d\n", txsize, descriptor);
+		printf("RTL8139: +++ C+ mode transmission continue to next descriptor\n");
 #endif
+	}
+
     return 1;
 }
 
@@ -1832,6 +2175,31 @@
 {
 
     int descriptor = txRegOffset/4;
+
+	/* handle C+ transmit mode register configuration */
+
+	if (rtl8139_cp_transmitter_enabled(s))
+	{
+#ifdef DEBUG_RTL8139
+		printf("RTL8139C+ DTCCR write offset=0x%x val=0x%08x descriptor=%d\n", txRegOffset, val, descriptor);
+#endif
+		/* handle Dump Tally Counters command */
+		s->TxStatus[descriptor] = val;
+
+		if (descriptor == 0 && (val & 0x8))
+		{
+			target_phys_addr_t tc_addr = rtl8139_addr64(s->TxStatus[0] & ~0x3f, s->TxStatus[1]);
+
+			/* dump tally counters to specified memory location */
+			RTL8139TallyCounters_physical_memory_write( tc_addr, &s->tally_counters);
+
+			/* mark dump completed */
+			s->TxStatus[0] &= ~0x8;
+		}
+
+		return;
+	}
+
 #ifdef DEBUG_RTL8139
     printf("RTL8139: TxStatus write offset=0x%x val=0x%08x descriptor=%d\n", txRegOffset, val, descriptor);
 #endif
@@ -1909,6 +2277,8 @@
 #endif
 
     s->TxAddr[txAddrOffset/4] = le32_to_cpu(val);
+
+	s->currCPlusTxDesc = 0;
 }
 
 static uint32_t rtl8139_TxAddr_read(RTL8139State *s, uint32_t txAddrOffset)
@@ -1949,6 +2319,18 @@
     return ret;
 }
 
+static uint32_t rtl8139_RxBufAddr_read(RTL8139State *s)
+{
+    /* this value is NOT off by 16 */
+    uint32_t ret = s->RxBufAddr;
+
+#ifdef DEBUG_RTL8139
+    printf("RTL8139: RxBufAddr read val=0x%04x\n", ret);
+#endif
+
+    return ret;
+}
+
 static void rtl8139_RxBuf_write(RTL8139State *s, uint32_t val)
 {
 #ifdef DEBUG_RTL8139
@@ -2281,6 +2663,21 @@
             s->RxRingAddrHI = val;
             break;
 
+		case Timer:
+#ifdef DEBUG_RTL8139
+			printf("RTL8139: TCTR Timer reset on write\n");
+#endif
+			s->TCTR = 0;
+			s->TCTR_base = qemu_get_clock(vm_clock);
+			break;
+
+		case FlashReg:
+#ifdef DEBUG_RTL8139
+			printf("RTL8139: FlashReg TimerInt write val=0x%08x\n", val);
+#endif
+			s->TimerInt = val;
+			break;
+
         default:
 #ifdef DEBUG_RTL8139
             printf("RTL8139: ioport write(l) addr=0x%x val=0x%08x via write(b)\n", addr, val);
@@ -2355,7 +2752,7 @@
             break;
 
         case PCIRevisionID:
-            ret = 0x10;
+            ret = RTL8139_PCI_REVID;
 #ifdef DEBUG_RTL8139
             printf("RTL8139: PCI Revision ID read 0x%x\n", ret);
 #endif
@@ -2411,6 +2808,10 @@
             ret = rtl8139_RxBufPtr_read(s);
             break;
 
+        case RxBufAddr:
+            ret = rtl8139_RxBufAddr_read(s);
+            break;
+
         case BasicModeCtrl:
             ret = rtl8139_BasicModeCtrl_read(s);
             break;
@@ -2521,6 +2922,20 @@
 #endif
             break;
 
+		case Timer:
+			ret = s->TCTR;
+#ifdef DEBUG_RTL8139
+			printf("RTL8139: TCTR Timer read val=0x%08x\n", ret);
+#endif
+			break;
+
+		case FlashReg:
+			ret = s->TimerInt;
+#ifdef DEBUG_RTL8139
+			printf("RTL8139: FlashReg TimerInt read val=0x%08x\n", ret);
+#endif
+			break;
+
         default:
 #ifdef DEBUG_RTL8139
             printf("RTL8139: ioport read(l) addr=0x%x via read(b)\n", addr);
@@ -2688,6 +3103,12 @@
     qemu_put_8s(f, &s->eeprom.eesk);
     qemu_put_8s(f, &s->eeprom.eedi);
     qemu_put_8s(f, &s->eeprom.eedo);
+
+	qemu_put_be32s(f, &s->TCTR);
+	qemu_put_be32s(f, &s->TimerInt);
+	qemu_put_be64s(f, &s->TCTR_base);
+
+	RTL8139TallyCounters_save(f, &s->tally_counters);
 }
 
 static int rtl8139_load(QEMUFile* f,void* opaque,int version_id)
@@ -2695,9 +3116,11 @@
     RTL8139State* s=(RTL8139State*)opaque;
     int i;
 
-    if (version_id != 1)
+	/* just 2 versions for now */
+    if (version_id > 2)
             return -EINVAL;
 
+	/* saved since version 1 */
     qemu_get_buffer(f, s->phys, 6);
     qemu_get_buffer(f, s->mult, 8);
 
@@ -2769,7 +3192,26 @@
     qemu_get_8s(f, &s->eeprom.eedi);
     qemu_get_8s(f, &s->eeprom.eedo);
 
-    return 0;
+	/* saved since version 2 */
+	if (version_id >= 2)
+	{
+		qemu_get_be32s(f, &s->TCTR);
+		qemu_get_be32s(f, &s->TimerInt);
+		qemu_get_be64s(f, &s->TCTR_base);
+
+		RTL8139TallyCounters_load(f, &s->tally_counters);
+	}
+	else
+	{
+		/* not saved, use default */
+		s->TCTR = 0;
+		s->TimerInt = 0;
+		s->TCTR_base = 0;
+
+		RTL8139TallyCounters_clear(&s->tally_counters);
+	}
+
+	return 0;
 }
 
 /***********************************************************/
@@ -2817,6 +3259,65 @@
     rtl8139_mmio_writel,
 };
 
+static inline int64_t rtl8139_get_next_tctr_time(RTL8139State *s, int64_t current_time)
+{
+    int64_t next_time = current_time + 
+        muldiv64(1, ticks_per_sec, PCI_FREQUENCY);
+    if (next_time <= current_time)
+        next_time = current_time + 1;
+    return next_time;
+}
+
+#if RTL8139_ONBOARD_TIMER
+static void rtl8139_timer(void *opaque)
+{
+	RTL8139State *s = opaque;
+
+	int is_timeout = 0;
+
+	int64_t  curr_time;
+	uint32_t curr_tick;
+
+	if (!s->clock_enabled)
+	{
+#ifdef DEBUG_RTL8139
+		printf("RTL8139: >>> timer: clock is not running\n");
+#endif
+		return;
+	}
+
+	curr_time = qemu_get_clock(vm_clock);
+
+	curr_tick = muldiv64(curr_time - s->TCTR_base, PCI_FREQUENCY, ticks_per_sec);
+
+	if (s->TimerInt && curr_tick >= s->TimerInt)
+	{
+		if (s->TCTR < s->TimerInt || curr_tick < s->TCTR)
+		{
+			is_timeout = 1;
+		}
+	}
+
+	s->TCTR = curr_tick;
+
+#ifdef DEBUG_RTL8139
+//	printf("RTL8139: >>> timer: tick=%08u\n", s->TCTR);
+#endif
+
+	if (is_timeout)
+	{
+#ifdef DEBUG_RTL8139
+		printf("RTL8139: >>> timer: timeout tick=%08u\n", s->TCTR);
+#endif
+		s->IntrStatus |= PCSTimeout;
+		rtl8139_update_irq(s);
+	}
+
+	qemu_mod_timer(s->timer, 
+		rtl8139_get_next_tctr_time(s,curr_time));
+}
+#endif /* RTL8139_ONBOARD_TIMER */
+
 void pci_rtl8139_init(PCIBus *bus, NICInfo *nd)
 {
     PCIRTL8139State *d;
@@ -2833,7 +3334,7 @@
     pci_conf[0x02] = 0x39;
     pci_conf[0x03] = 0x81;
     pci_conf[0x04] = 0x05; /* command = I/O space, Bus Master */
-    pci_conf[0x08] = 0x20; /* 0x10 */ /* PCI revision ID; >=0x20 is for 8139C+ */
+    pci_conf[0x08] = RTL8139_PCI_REVID; /* PCI revision ID; >=0x20 is for 8139C+ */
     pci_conf[0x0a] = 0x00; /* ethernet network controller */
     pci_conf[0x0b] = 0x02;
     pci_conf[0x0e] = 0x00; /* header_type */
@@ -2867,9 +3368,21 @@
              s->macaddr[3],
              s->macaddr[4],
              s->macaddr[5]);
+
+	s->cplus_txbuffer = NULL;
+	s->cplus_txbuffer_len = 0;
+	s->cplus_txbuffer_offset = 0;
              
     /* XXX: instance number ? */
-    register_savevm("rtl8139", 0, 1, rtl8139_save, rtl8139_load, s);
+    register_savevm("rtl8139", 0, 2, rtl8139_save, rtl8139_load, s);
     register_savevm("rtl8139_pci", 0, 1, generic_pci_save, generic_pci_load, 
                     &d->dev);
+
+#if RTL8139_ONBOARD_TIMER
+	s->timer = qemu_new_timer(vm_clock, rtl8139_timer, s);
+
+	qemu_mod_timer(s->timer, 
+		rtl8139_get_next_tctr_time(s,qemu_get_clock(vm_clock)));
+#endif /* RTL8139_ONBOARD_TIMER */
 }
+