]> git.proxmox.com Git - mirror_qemu.git/blobdiff - hw/rtl8139.c
vmstate: Drop unused post_save handler
[mirror_qemu.git] / hw / rtl8139.c
index de5a68fc99f6b885ebd9c8606ca8dec5c5ae7e1b..72e224272307aed864313fe61aeb77d7444f21a3 100644 (file)
  *                                  segmentation offloading
  *                                  Removed slirp.h dependency
  *                                  Added rx/tx buffer reset when enabling rx/tx operation
+ *
+ *  2010-Feb-04  Frediano Ziglio:   Rewrote timer support using QEMU timer only
+ *                                  when strictly needed (required for for
+ *                                  Darwin)
  */
 
 #include "hw.h"
 #include "pci.h"
 #include "qemu-timer.h"
 #include "net.h"
+#include "loader.h"
 
 /* debug RTL8139 card */
 //#define DEBUG_RTL8139 1
@@ -59,9 +64,6 @@
 /* Calculate CRCs properly on Rx packets */
 #define RTL8139_CALCULATE_RXCRC 1
 
-/* Uncomment to enable on-board timer interrupts */
-//#define RTL8139_ONBOARD_TIMER 1
-
 #if defined(RTL8139_CALCULATE_RXCRC)
 /* For crc32 */
 #include <zlib.h>
@@ -416,13 +418,8 @@ static void RTL8139TallyCounters_clear(RTL8139TallyCounters* counters);
 /* Writes tally counters to specified physical memory address */
 static void RTL8139TallyCounters_physical_memory_write(target_phys_addr_t tc_addr, RTL8139TallyCounters* counters);
 
-/* Loads values of tally counters from VM state file */
-static void RTL8139TallyCounters_load(QEMUFile* f, RTL8139TallyCounters *tally_counters);
-
-/* Saves values of tally counters to VM state file */
-static void RTL8139TallyCounters_save(QEMUFile* f, RTL8139TallyCounters *tally_counters);
-
 typedef struct RTL8139State {
+    PCIDevice dev;
     uint8_t phys[8]; /* mac address */
     uint8_t mult[8]; /* multicast mask array */
 
@@ -463,9 +460,8 @@ typedef struct RTL8139State {
     uint16_t CpCmd;
     uint8_t  TxThresh;
 
-    PCIDevice *pci_dev;
-    VLANClientState *vc;
-    uint8_t macaddr[6];
+    NICState *nic;
+    NICConf conf;
     int rtl8139_mmio_io_addr;
 
     /* C ring mode */
@@ -496,9 +492,12 @@ typedef struct RTL8139State {
 
     /* PCI interrupt timer */
     QEMUTimer *timer;
+    int64_t TimerExpire;
 
 } RTL8139State;
 
+static void rtl8139_set_next_tctr_time(RTL8139State *s, int64_t current_time);
+
 static void prom9346_decode_command(EEprom9346 *eeprom, uint8_t command)
 {
     DEBUG_PRINT(("RTL8139: eeprom command 0x%02x\n", command));
@@ -692,7 +691,7 @@ static void rtl8139_update_irq(RTL8139State *s)
     DEBUG_PRINT(("RTL8139: Set IRQ to %d (%04x %04x)\n",
        isr ? 1 : 0, s->IntrStatus, s->IntrMask));
 
-    qemu_set_irq(s->pci_dev->irq[0], (isr != 0));
+    qemu_set_irq(s->dev.irq[0], (isr != 0));
 }
 
 #define POLYNOMIAL 0x04c11db6
@@ -790,9 +789,9 @@ static inline target_phys_addr_t rtl8139_addr64(uint32_t low, uint32_t high)
 #endif
 }
 
-static int rtl8139_can_receive(VLANClientState *vc)
+static int rtl8139_can_receive(VLANClientState *nc)
 {
-    RTL8139State *s = vc->opaque;
+    RTL8139State *s = DO_UPCAST(NICState, nc, nc)->opaque;
     int avail;
 
     /* Receive (drop) packets if card is disabled.  */
@@ -812,9 +811,9 @@ static int rtl8139_can_receive(VLANClientState *vc)
     }
 }
 
-static ssize_t rtl8139_do_receive(VLANClientState *vc, const uint8_t *buf, size_t size_, int do_interrupt)
+static ssize_t rtl8139_do_receive(VLANClientState *nc, const uint8_t *buf, size_t size_, int do_interrupt)
 {
-    RTL8139State *s = vc->opaque;
+    RTL8139State *s = DO_UPCAST(NICState, nc, nc)->opaque;
     int size = size_;
 
     uint32_t packet_header = 0;
@@ -1161,9 +1160,9 @@ static ssize_t rtl8139_do_receive(VLANClientState *vc, const uint8_t *buf, size_
     return size_;
 }
 
-static ssize_t rtl8139_receive(VLANClientState *vc, const uint8_t *buf, size_t size)
+static ssize_t rtl8139_receive(VLANClientState *nc, const uint8_t *buf, size_t size)
 {
-    return rtl8139_do_receive(vc, buf, size, 1);
+    return rtl8139_do_receive(nc, buf, size, 1);
 }
 
 static void rtl8139_reset_rxring(RTL8139State *s, uint32_t bufferSize)
@@ -1173,13 +1172,13 @@ static void rtl8139_reset_rxring(RTL8139State *s, uint32_t bufferSize)
     s->RxBufAddr = 0;
 }
 
-static void rtl8139_reset(void *opaque)
+static void rtl8139_reset(DeviceState *d)
 {
-    RTL8139State *s = opaque;
+    RTL8139State *s = container_of(d, RTL8139State, dev.qdev);
     int i;
 
     /* restore MAC address */
-    memcpy(s->phys, s->macaddr, 6);
+    memcpy(s->phys, s->conf.macaddr.a, 6);
 
     /* reset interrupt mask */
     s->IntrStatus = 0;
@@ -1195,9 +1194,9 @@ static void rtl8139_reset(void *opaque)
     s->eeprom.contents[2] = PCI_DEVICE_ID_REALTEK_8139;
 #endif
 
-    s->eeprom.contents[7] = s->macaddr[0] | s->macaddr[1] << 8;
-    s->eeprom.contents[8] = s->macaddr[2] | s->macaddr[3] << 8;
-    s->eeprom.contents[9] = s->macaddr[4] | s->macaddr[5] << 8;
+    s->eeprom.contents[7] = s->conf.macaddr.a[0] | s->conf.macaddr.a[1] << 8;
+    s->eeprom.contents[8] = s->conf.macaddr.a[2] | s->conf.macaddr.a[3] << 8;
+    s->eeprom.contents[9] = s->conf.macaddr.a[4] | s->conf.macaddr.a[5] << 8;
 
     /* mark all status registers as owned by host */
     for (i = 0; i < 4; ++i)
@@ -1327,40 +1326,28 @@ static void RTL8139TallyCounters_physical_memory_write(target_phys_addr_t tc_add
 }
 
 /* Loads values of tally counters from VM state file */
-static void RTL8139TallyCounters_load(QEMUFile* f, RTL8139TallyCounters *tally_counters)
-{
-    qemu_get_be64s(f, &tally_counters->TxOk);
-    qemu_get_be64s(f, &tally_counters->RxOk);
-    qemu_get_be64s(f, &tally_counters->TxERR);
-    qemu_get_be32s(f, &tally_counters->RxERR);
-    qemu_get_be16s(f, &tally_counters->MissPkt);
-    qemu_get_be16s(f, &tally_counters->FAE);
-    qemu_get_be32s(f, &tally_counters->Tx1Col);
-    qemu_get_be32s(f, &tally_counters->TxMCol);
-    qemu_get_be64s(f, &tally_counters->RxOkPhy);
-    qemu_get_be64s(f, &tally_counters->RxOkBrd);
-    qemu_get_be32s(f, &tally_counters->RxOkMul);
-    qemu_get_be16s(f, &tally_counters->TxAbt);
-    qemu_get_be16s(f, &tally_counters->TxUndrn);
-}
-
-/* Saves values of tally counters to VM state file */
-static void RTL8139TallyCounters_save(QEMUFile* f, RTL8139TallyCounters *tally_counters)
-{
-    qemu_put_be64s(f, &tally_counters->TxOk);
-    qemu_put_be64s(f, &tally_counters->RxOk);
-    qemu_put_be64s(f, &tally_counters->TxERR);
-    qemu_put_be32s(f, &tally_counters->RxERR);
-    qemu_put_be16s(f, &tally_counters->MissPkt);
-    qemu_put_be16s(f, &tally_counters->FAE);
-    qemu_put_be32s(f, &tally_counters->Tx1Col);
-    qemu_put_be32s(f, &tally_counters->TxMCol);
-    qemu_put_be64s(f, &tally_counters->RxOkPhy);
-    qemu_put_be64s(f, &tally_counters->RxOkBrd);
-    qemu_put_be32s(f, &tally_counters->RxOkMul);
-    qemu_put_be16s(f, &tally_counters->TxAbt);
-    qemu_put_be16s(f, &tally_counters->TxUndrn);
-}
+
+static const VMStateDescription vmstate_tally_counters = {
+    .name = "tally_counters",
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields      = (VMStateField []) {
+        VMSTATE_UINT64(TxOk, RTL8139TallyCounters),
+        VMSTATE_UINT64(RxOk, RTL8139TallyCounters),
+        VMSTATE_UINT64(TxERR, RTL8139TallyCounters),
+        VMSTATE_UINT32(RxERR, RTL8139TallyCounters),
+        VMSTATE_UINT16(MissPkt, RTL8139TallyCounters),
+        VMSTATE_UINT16(FAE, RTL8139TallyCounters),
+        VMSTATE_UINT32(Tx1Col, RTL8139TallyCounters),
+        VMSTATE_UINT32(TxMCol, RTL8139TallyCounters),
+        VMSTATE_UINT64(RxOkPhy, RTL8139TallyCounters),
+        VMSTATE_UINT64(RxOkBrd, RTL8139TallyCounters),
+        VMSTATE_UINT16(TxAbt, RTL8139TallyCounters),
+        VMSTATE_UINT16(TxUndrn, RTL8139TallyCounters),
+        VMSTATE_END_OF_LIST()
+    }
+};
 
 static void rtl8139_ChipCmd_write(RTL8139State *s, uint32_t val)
 {
@@ -1371,7 +1358,7 @@ static void rtl8139_ChipCmd_write(RTL8139State *s, uint32_t val)
     if (val & CmdReset)
     {
         DEBUG_PRINT(("RTL8139: ChipCmd reset\n"));
-        rtl8139_reset(s);
+        rtl8139_reset(&s->dev.qdev);
     }
     if (val & CmdRxEnb)
     {
@@ -1544,7 +1531,7 @@ static void rtl8139_Cfg9346_write(RTL8139State *s, uint32_t val)
     } else if (opmode == 0x40) {
         /* Reset.  */
         val = 0;
-        rtl8139_reset(s);
+        rtl8139_reset(&s->dev.qdev);
     }
 
     s->Cfg9346 = val;
@@ -1761,11 +1748,11 @@ static void rtl8139_transfer_frame(RTL8139State *s, const uint8_t *buf, int size
     if (TxLoopBack == (s->TxConfig & TxLoopBack))
     {
         DEBUG_PRINT(("RTL8139: +++ transmit loopback mode\n"));
-        rtl8139_do_receive(s->vc, buf, size, do_interrupt);
+        rtl8139_do_receive(&s->nic->nc, buf, size, do_interrupt);
     }
     else
     {
-        qemu_send_packet(s->vc, buf, size);
+        qemu_send_packet(&s->nic->nc, buf, size);
     }
 }
 
@@ -1926,6 +1913,7 @@ static int rtl8139_cplus_transmit_one(RTL8139State *s)
 
     cpu_physical_memory_read(cplus_tx_ring_desc,    (uint8_t *)&val, 4);
     txdw0 = le32_to_cpu(val);
+    /* TODO: implement VLAN tagging support, VLAN tag data is read to txdw1 */
     cpu_physical_memory_read(cplus_tx_ring_desc+4,  (uint8_t *)&val, 4);
     txdw1 = le32_to_cpu(val);
     cpu_physical_memory_read(cplus_tx_ring_desc+8,  (uint8_t *)&val, 4);
@@ -1937,6 +1925,9 @@ static int rtl8139_cplus_transmit_one(RTL8139State *s)
            descriptor,
            txdw0, txdw1, txbufLO, txbufHI));
 
+    /* TODO: the following discard cast should clean clang analyzer output */
+    (void)txdw1;
+
 /* w0 ownership flag */
 #define CP_TX_OWN (1<<31)
 /* w0 end of ring flag */
@@ -2002,7 +1993,7 @@ static int rtl8139_cplus_transmit_one(RTL8139State *s)
     if (!s->cplus_txbuffer)
     {
         s->cplus_txbuffer_len = CP_TX_BUFFER_SIZE;
-        s->cplus_txbuffer = malloc(s->cplus_txbuffer_len);
+        s->cplus_txbuffer = qemu_malloc(s->cplus_txbuffer_len);
         s->cplus_txbuffer_offset = 0;
 
         DEBUG_PRINT(("RTL8139: +++ C+ mode transmission buffer allocated space %d\n", s->cplus_txbuffer_len));
@@ -2062,6 +2053,7 @@ static int rtl8139_cplus_transmit_one(RTL8139State *s)
     /* update ring data */
     val = cpu_to_le32(txdw0);
     cpu_physical_memory_write(cplus_tx_ring_desc,    (uint8_t *)&val, 4);
+    /* TODO: implement VLAN tagging support, VLAN tag data is read to txdw1 */
 //    val = cpu_to_le32(txdw1);
 //    cpu_physical_memory_write(cplus_tx_ring_desc+4,  &val, 4);
 
@@ -2090,12 +2082,12 @@ static int rtl8139_cplus_transmit_one(RTL8139State *s)
             #define ETH_MTU     1500
 
             /* ip packet header */
-            ip_header *ip = 0;
+            ip_header *ip = NULL;
             int hlen = 0;
             uint8_t  ip_protocol = 0;
             uint16_t ip_data_len = 0;
 
-            uint8_t *eth_payload_data = 0;
+            uint8_t *eth_payload_data = NULL;
             size_t   eth_payload_len  = 0;
 
             int proto = be16_to_cpu(*(uint16_t *)(saved_buffer + 12));
@@ -2317,7 +2309,7 @@ static int rtl8139_cplus_transmit_one(RTL8139State *s)
         }
         else
         {
-            free(saved_buffer);
+            qemu_free(saved_buffer);
         }
     }
     else
@@ -2534,7 +2526,9 @@ static void rtl8139_IntrMask_write(RTL8139State *s, uint32_t val)
 
     s->IntrMask = val;
 
+    rtl8139_set_next_tctr_time(s, qemu_get_clock(vm_clock));
     rtl8139_update_irq(s);
+
 }
 
 static uint32_t rtl8139_IntrMask_read(RTL8139State *s)
@@ -2567,12 +2561,22 @@ static void rtl8139_IntrStatus_write(RTL8139State *s, uint32_t val)
     rtl8139_update_irq(s);
 
     s->IntrStatus = newStatus;
+    /*
+     * Computing if we miss an interrupt here is not that correct but
+     * considered that we should have had already an interrupt
+     * and probably emulated is slower is better to assume this resetting was
+     * done before testing on previous rtl8139_update_irq lead to IRQ loosing
+     */
+    rtl8139_set_next_tctr_time(s, qemu_get_clock(vm_clock));
     rtl8139_update_irq(s);
+
 #endif
 }
 
 static uint32_t rtl8139_IntrStatus_read(RTL8139State *s)
 {
+    rtl8139_set_next_tctr_time(s, qemu_get_clock(vm_clock));
+
     uint32_t ret = s->IntrStatus;
 
     DEBUG_PRINT(("RTL8139: IntrStatus read(w) val=0x%04x\n", ret));
@@ -2751,6 +2755,46 @@ static void rtl8139_io_writew(void *opaque, uint8_t addr, uint32_t val)
     }
 }
 
+static void rtl8139_set_next_tctr_time(RTL8139State *s, int64_t current_time)
+{
+    int64_t pci_time, next_time;
+    uint32_t low_pci;
+
+    DEBUG_PRINT(("RTL8139: entered rtl8139_set_next_tctr_time\n"));
+
+    if (s->TimerExpire && current_time >= s->TimerExpire) {
+        s->IntrStatus |= PCSTimeout;
+        rtl8139_update_irq(s);
+    }
+
+    /* Set QEMU timer only if needed that is
+     * - TimerInt <> 0 (we have a timer)
+     * - mask = 1 (we want an interrupt timer)
+     * - irq = 0  (irq is not already active)
+     * If any of above change we need to compute timer again
+     * Also we must check if timer is passed without QEMU timer
+     */
+    s->TimerExpire = 0;
+    if (!s->TimerInt) {
+        return;
+    }
+
+    pci_time = muldiv64(current_time - s->TCTR_base, PCI_FREQUENCY,
+                                get_ticks_per_sec());
+    low_pci = pci_time & 0xffffffff;
+    pci_time = pci_time - low_pci + s->TimerInt;
+    if (low_pci >= s->TimerInt) {
+        pci_time += 0x100000000LL;
+    }
+    next_time = s->TCTR_base + muldiv64(pci_time, get_ticks_per_sec(),
+                                                PCI_FREQUENCY);
+    s->TimerExpire = next_time;
+
+    if ((s->IntrMask & PCSTimeout) != 0 && (s->IntrStatus & PCSTimeout) == 0) {
+        qemu_mod_timer(s->timer, next_time);
+    }
+}
+
 static void rtl8139_io_writel(void *opaque, uint8_t addr, uint32_t val)
 {
     RTL8139State *s = opaque;
@@ -2796,13 +2840,16 @@ static void rtl8139_io_writel(void *opaque, uint8_t addr, uint32_t val)
 
         case Timer:
             DEBUG_PRINT(("RTL8139: TCTR Timer reset on write\n"));
-            s->TCTR = 0;
             s->TCTR_base = qemu_get_clock(vm_clock);
+            rtl8139_set_next_tctr_time(s, s->TCTR_base);
             break;
 
         case FlashReg:
             DEBUG_PRINT(("RTL8139: FlashReg TimerInt write val=0x%08x\n", val));
-            s->TimerInt = val;
+            if (s->TimerInt != val) {
+                s->TimerInt = val;
+                rtl8139_set_next_tctr_time(s, qemu_get_clock(vm_clock));
+            }
             break;
 
         default:
@@ -3012,7 +3059,8 @@ static uint32_t rtl8139_io_readl(void *opaque, uint8_t addr)
             break;
 
         case Timer:
-            ret = s->TCTR;
+            ret = muldiv64(qemu_get_clock(vm_clock) - s->TCTR_base,
+                           PCI_FREQUENCY, get_ticks_per_sec());
             DEBUG_PRINT(("RTL8139: TCTR Timer read val=0x%08x\n", ret));
             break;
 
@@ -3114,236 +3162,125 @@ static uint32_t rtl8139_mmio_readl(void *opaque, target_phys_addr_t addr)
     return val;
 }
 
-/* */
-
-static void rtl8139_save(QEMUFile* f,void* opaque)
-{
-    RTL8139State* s=(RTL8139State*)opaque;
-    unsigned int i;
-
-    pci_device_save(s->pci_dev, f);
-
-    qemu_put_buffer(f, s->phys, 6);
-    qemu_put_buffer(f, s->mult, 8);
-
-    for (i=0; i<4; ++i)
-    {
-        qemu_put_be32s(f, &s->TxStatus[i]); /* TxStatus0 */
-    }
-    for (i=0; i<4; ++i)
-    {
-        qemu_put_be32s(f, &s->TxAddr[i]); /* TxAddr0 */
-    }
-
-    qemu_put_be32s(f, &s->RxBuf); /* Receive buffer */
-    qemu_put_be32s(f, &s->RxBufferSize);/* internal variable, receive ring buffer size in C mode */
-    qemu_put_be32s(f, &s->RxBufPtr);
-    qemu_put_be32s(f, &s->RxBufAddr);
-
-    qemu_put_be16s(f, &s->IntrStatus);
-    qemu_put_be16s(f, &s->IntrMask);
-
-    qemu_put_be32s(f, &s->TxConfig);
-    qemu_put_be32s(f, &s->RxConfig);
-    qemu_put_be32s(f, &s->RxMissed);
-    qemu_put_be16s(f, &s->CSCR);
-
-    qemu_put_8s(f, &s->Cfg9346);
-    qemu_put_8s(f, &s->Config0);
-    qemu_put_8s(f, &s->Config1);
-    qemu_put_8s(f, &s->Config3);
-    qemu_put_8s(f, &s->Config4);
-    qemu_put_8s(f, &s->Config5);
-
-    qemu_put_8s(f, &s->clock_enabled);
-    qemu_put_8s(f, &s->bChipCmdState);
-
-    qemu_put_be16s(f, &s->MultiIntr);
-
-    qemu_put_be16s(f, &s->BasicModeCtrl);
-    qemu_put_be16s(f, &s->BasicModeStatus);
-    qemu_put_be16s(f, &s->NWayAdvert);
-    qemu_put_be16s(f, &s->NWayLPAR);
-    qemu_put_be16s(f, &s->NWayExpansion);
-
-    qemu_put_be16s(f, &s->CpCmd);
-    qemu_put_8s(f, &s->TxThresh);
-
-    i = 0;
-    qemu_put_be32s(f, &i); /* unused.  */
-    qemu_put_buffer(f, s->macaddr, 6);
-    qemu_put_be32(f, s->rtl8139_mmio_io_addr);
-
-    qemu_put_be32s(f, &s->currTxDesc);
-    qemu_put_be32s(f, &s->currCPlusRxDesc);
-    qemu_put_be32s(f, &s->currCPlusTxDesc);
-    qemu_put_be32s(f, &s->RxRingAddrLO);
-    qemu_put_be32s(f, &s->RxRingAddrHI);
-
-    for (i=0; i<EEPROM_9346_SIZE; ++i)
-    {
-        qemu_put_be16s(f, &s->eeprom.contents[i]);
-    }
-    qemu_put_be32(f, s->eeprom.mode);
-    qemu_put_be32s(f, &s->eeprom.tick);
-    qemu_put_8s(f, &s->eeprom.address);
-    qemu_put_be16s(f, &s->eeprom.input);
-    qemu_put_be16s(f, &s->eeprom.output);
-
-    qemu_put_8s(f, &s->eeprom.eecs);
-    qemu_put_8s(f, &s->eeprom.eesk);
-    qemu_put_8s(f, &s->eeprom.eedi);
-    qemu_put_8s(f, &s->eeprom.eedo);
-
-    qemu_put_be32s(f, &s->TCTR);
-    qemu_put_be32s(f, &s->TimerInt);
-    qemu_put_be64(f, s->TCTR_base);
-
-    RTL8139TallyCounters_save(f, &s->tally_counters);
-
-    qemu_put_be32s(f, &s->cplus_enabled);
-}
-
-static int rtl8139_load(QEMUFile* f,void* opaque,int version_id)
+static int rtl8139_post_load(void *opaque, int version_id)
 {
-    RTL8139State* s=(RTL8139State*)opaque;
-    unsigned int i;
-    int ret;
-
-    /* just 2 versions for now */
-    if (version_id > 4)
-            return -EINVAL;
-
-    if (version_id >= 3) {
-        ret = pci_device_load(s->pci_dev, f);
-        if (ret < 0)
-            return ret;
-    }
-
-    /* saved since version 1 */
-    qemu_get_buffer(f, s->phys, 6);
-    qemu_get_buffer(f, s->mult, 8);
-
-    for (i=0; i<4; ++i)
-    {
-        qemu_get_be32s(f, &s->TxStatus[i]); /* TxStatus0 */
-    }
-    for (i=0; i<4; ++i)
-    {
-        qemu_get_be32s(f, &s->TxAddr[i]); /* TxAddr0 */
-    }
-
-    qemu_get_be32s(f, &s->RxBuf); /* Receive buffer */
-    qemu_get_be32s(f, &s->RxBufferSize);/* internal variable, receive ring buffer size in C mode */
-    qemu_get_be32s(f, &s->RxBufPtr);
-    qemu_get_be32s(f, &s->RxBufAddr);
-
-    qemu_get_be16s(f, &s->IntrStatus);
-    qemu_get_be16s(f, &s->IntrMask);
-
-    qemu_get_be32s(f, &s->TxConfig);
-    qemu_get_be32s(f, &s->RxConfig);
-    qemu_get_be32s(f, &s->RxMissed);
-    qemu_get_be16s(f, &s->CSCR);
-
-    qemu_get_8s(f, &s->Cfg9346);
-    qemu_get_8s(f, &s->Config0);
-    qemu_get_8s(f, &s->Config1);
-    qemu_get_8s(f, &s->Config3);
-    qemu_get_8s(f, &s->Config4);
-    qemu_get_8s(f, &s->Config5);
-
-    qemu_get_8s(f, &s->clock_enabled);
-    qemu_get_8s(f, &s->bChipCmdState);
-
-    qemu_get_be16s(f, &s->MultiIntr);
-
-    qemu_get_be16s(f, &s->BasicModeCtrl);
-    qemu_get_be16s(f, &s->BasicModeStatus);
-    qemu_get_be16s(f, &s->NWayAdvert);
-    qemu_get_be16s(f, &s->NWayLPAR);
-    qemu_get_be16s(f, &s->NWayExpansion);
-
-    qemu_get_be16s(f, &s->CpCmd);
-    qemu_get_8s(f, &s->TxThresh);
-
-    qemu_get_be32s(f, &i); /* unused.  */
-    qemu_get_buffer(f, s->macaddr, 6);
-    s->rtl8139_mmio_io_addr=qemu_get_be32(f);
-
-    qemu_get_be32s(f, &s->currTxDesc);
-    qemu_get_be32s(f, &s->currCPlusRxDesc);
-    qemu_get_be32s(f, &s->currCPlusTxDesc);
-    qemu_get_be32s(f, &s->RxRingAddrLO);
-    qemu_get_be32s(f, &s->RxRingAddrHI);
-
-    for (i=0; i<EEPROM_9346_SIZE; ++i)
-    {
-        qemu_get_be16s(f, &s->eeprom.contents[i]);
-    }
-    s->eeprom.mode=qemu_get_be32(f);
-    qemu_get_be32s(f, &s->eeprom.tick);
-    qemu_get_8s(f, &s->eeprom.address);
-    qemu_get_be16s(f, &s->eeprom.input);
-    qemu_get_be16s(f, &s->eeprom.output);
-
-    qemu_get_8s(f, &s->eeprom.eecs);
-    qemu_get_8s(f, &s->eeprom.eesk);
-    qemu_get_8s(f, &s->eeprom.eedi);
-    qemu_get_8s(f, &s->eeprom.eedo);
-
-    /* saved since version 2 */
-    if (version_id >= 2)
-    {
-        qemu_get_be32s(f, &s->TCTR);
-        qemu_get_be32s(f, &s->TimerInt);
-        s->TCTR_base=qemu_get_be64(f);
-
-        RTL8139TallyCounters_load(f, &s->tally_counters);
-    }
-    else
-    {
-        /* not saved, use default */
-        s->TCTR = 0;
-        s->TimerInt = 0;
-        s->TCTR_base = 0;
-
-        RTL8139TallyCounters_clear(&s->tally_counters);
-    }
-
-    if (version_id >= 4) {
-        qemu_get_be32s(f, &s->cplus_enabled);
-    } else {
+    RTL8139State* s = opaque;
+    rtl8139_set_next_tctr_time(s, qemu_get_clock(vm_clock));
+    if (version_id < 4) {
         s->cplus_enabled = s->CpCmd != 0;
     }
 
-    rtl8139_update_irq(s);
-
     return 0;
 }
 
+static void rtl8139_pre_save(void *opaque)
+{
+    RTL8139State* s = opaque;
+    int64_t current_time = qemu_get_clock(vm_clock);
+
+    /* set IntrStatus correctly */
+    rtl8139_set_next_tctr_time(s, current_time);
+    s->TCTR = muldiv64(current_time - s->TCTR_base, PCI_FREQUENCY,
+                       get_ticks_per_sec());
+}
+
+static const VMStateDescription vmstate_rtl8139 = {
+    .name = "rtl8139",
+    .version_id = 4,
+    .minimum_version_id = 3,
+    .minimum_version_id_old = 3,
+    .post_load = rtl8139_post_load,
+    .pre_save  = rtl8139_pre_save,
+    .fields      = (VMStateField []) {
+        VMSTATE_PCI_DEVICE(dev, RTL8139State),
+        VMSTATE_PARTIAL_BUFFER(phys, RTL8139State, 6),
+        VMSTATE_BUFFER(mult, RTL8139State),
+        VMSTATE_UINT32_ARRAY(TxStatus, RTL8139State, 4),
+        VMSTATE_UINT32_ARRAY(TxAddr, RTL8139State, 4),
+
+        VMSTATE_UINT32(RxBuf, RTL8139State),
+        VMSTATE_UINT32(RxBufferSize, RTL8139State),
+        VMSTATE_UINT32(RxBufPtr, RTL8139State),
+        VMSTATE_UINT32(RxBufAddr, RTL8139State),
+
+        VMSTATE_UINT16(IntrStatus, RTL8139State),
+        VMSTATE_UINT16(IntrMask, RTL8139State),
+
+        VMSTATE_UINT32(TxConfig, RTL8139State),
+        VMSTATE_UINT32(RxConfig, RTL8139State),
+        VMSTATE_UINT32(RxMissed, RTL8139State),
+        VMSTATE_UINT16(CSCR, RTL8139State),
+
+        VMSTATE_UINT8(Cfg9346, RTL8139State),
+        VMSTATE_UINT8(Config0, RTL8139State),
+        VMSTATE_UINT8(Config1, RTL8139State),
+        VMSTATE_UINT8(Config3, RTL8139State),
+        VMSTATE_UINT8(Config4, RTL8139State),
+        VMSTATE_UINT8(Config5, RTL8139State),
+
+        VMSTATE_UINT8(clock_enabled, RTL8139State),
+        VMSTATE_UINT8(bChipCmdState, RTL8139State),
+
+        VMSTATE_UINT16(MultiIntr, RTL8139State),
+
+        VMSTATE_UINT16(BasicModeCtrl, RTL8139State),
+        VMSTATE_UINT16(BasicModeStatus, RTL8139State),
+        VMSTATE_UINT16(NWayAdvert, RTL8139State),
+        VMSTATE_UINT16(NWayLPAR, RTL8139State),
+        VMSTATE_UINT16(NWayExpansion, RTL8139State),
+
+        VMSTATE_UINT16(CpCmd, RTL8139State),
+        VMSTATE_UINT8(TxThresh, RTL8139State),
+
+        VMSTATE_UNUSED(4),
+        VMSTATE_MACADDR(conf.macaddr, RTL8139State),
+        VMSTATE_INT32(rtl8139_mmio_io_addr, RTL8139State),
+
+        VMSTATE_UINT32(currTxDesc, RTL8139State),
+        VMSTATE_UINT32(currCPlusRxDesc, RTL8139State),
+        VMSTATE_UINT32(currCPlusTxDesc, RTL8139State),
+        VMSTATE_UINT32(RxRingAddrLO, RTL8139State),
+        VMSTATE_UINT32(RxRingAddrHI, RTL8139State),
+
+        VMSTATE_UINT16_ARRAY(eeprom.contents, RTL8139State, EEPROM_9346_SIZE),
+        VMSTATE_INT32(eeprom.mode, RTL8139State),
+        VMSTATE_UINT32(eeprom.tick, RTL8139State),
+        VMSTATE_UINT8(eeprom.address, RTL8139State),
+        VMSTATE_UINT16(eeprom.input, RTL8139State),
+        VMSTATE_UINT16(eeprom.output, RTL8139State),
+
+        VMSTATE_UINT8(eeprom.eecs, RTL8139State),
+        VMSTATE_UINT8(eeprom.eesk, RTL8139State),
+        VMSTATE_UINT8(eeprom.eedi, RTL8139State),
+        VMSTATE_UINT8(eeprom.eedo, RTL8139State),
+
+        VMSTATE_UINT32(TCTR, RTL8139State),
+        VMSTATE_UINT32(TimerInt, RTL8139State),
+        VMSTATE_INT64(TCTR_base, RTL8139State),
+
+        VMSTATE_STRUCT(tally_counters, RTL8139State, 0,
+                       vmstate_tally_counters, RTL8139TallyCounters),
+
+        VMSTATE_UINT32_V(cplus_enabled, RTL8139State, 4),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
 /***********************************************************/
 /* PCI RTL8139 definitions */
 
-typedef struct PCIRTL8139State {
-    PCIDevice dev;
-    RTL8139State rtl8139;
-} PCIRTL8139State;
-
 static void rtl8139_mmio_map(PCIDevice *pci_dev, int region_num,
-                       uint32_t addr, uint32_t size, int type)
+                       pcibus_t addr, pcibus_t size, int type)
 {
-    PCIRTL8139State *d = (PCIRTL8139State *)pci_dev;
-    RTL8139State *s = &d->rtl8139;
+    RTL8139State *s = DO_UPCAST(RTL8139State, dev, pci_dev);
 
     cpu_register_physical_memory(addr + 0, 0x100, s->rtl8139_mmio_io_addr);
 }
 
 static void rtl8139_ioport_map(PCIDevice *pci_dev, int region_num,
-                       uint32_t addr, uint32_t size, int type)
+                       pcibus_t addr, pcibus_t size, int type)
 {
-    PCIRTL8139State *d = (PCIRTL8139State *)pci_dev;
-    RTL8139State *s = &d->rtl8139;
+    RTL8139State *s = DO_UPCAST(RTL8139State, dev, pci_dev);
 
     register_ioport_write(addr, 0x100, 1, rtl8139_ioport_writeb, s);
     register_ioport_read( addr, 0x100, 1, rtl8139_ioport_readb,  s);
@@ -3355,155 +3292,125 @@ static void rtl8139_ioport_map(PCIDevice *pci_dev, int region_num,
     register_ioport_read( addr, 0x100, 4, rtl8139_ioport_readl,  s);
 }
 
-static CPUReadMemoryFunc *rtl8139_mmio_read[3] = {
+static CPUReadMemoryFunc * const rtl8139_mmio_read[3] = {
     rtl8139_mmio_readb,
     rtl8139_mmio_readw,
     rtl8139_mmio_readl,
 };
 
-static CPUWriteMemoryFunc *rtl8139_mmio_write[3] = {
+static CPUWriteMemoryFunc * const rtl8139_mmio_write[3] = {
     rtl8139_mmio_writeb,
     rtl8139_mmio_writew,
     rtl8139_mmio_writel,
 };
 
-static inline int64_t rtl8139_get_next_tctr_time(RTL8139State *s, int64_t current_time)
-{
-    int64_t next_time = current_time +
-        muldiv64(1, ticks_per_sec, PCI_FREQUENCY);
-    if (next_time <= current_time)
-        next_time = current_time + 1;
-    return next_time;
-}
-
-#ifdef RTL8139_ONBOARD_TIMER
 static void rtl8139_timer(void *opaque)
 {
     RTL8139State *s = opaque;
 
-    int is_timeout = 0;
-
-    int64_t  curr_time;
-    uint32_t curr_tick;
-
     if (!s->clock_enabled)
     {
         DEBUG_PRINT(("RTL8139: >>> timer: clock is not running\n"));
         return;
     }
 
-    curr_time = qemu_get_clock(vm_clock);
-
-    curr_tick = muldiv64(curr_time - s->TCTR_base, PCI_FREQUENCY, ticks_per_sec);
-
-    if (s->TimerInt && curr_tick >= s->TimerInt)
-    {
-        if (s->TCTR < s->TimerInt || curr_tick < s->TCTR)
-        {
-            is_timeout = 1;
-        }
-    }
-
-    s->TCTR = curr_tick;
-
-//  DEBUG_PRINT(("RTL8139: >>> timer: tick=%08u\n", s->TCTR));
+    s->IntrStatus |= PCSTimeout;
+    rtl8139_update_irq(s);
+    rtl8139_set_next_tctr_time(s, qemu_get_clock(vm_clock));
+}
 
-    if (is_timeout)
-    {
-        DEBUG_PRINT(("RTL8139: >>> timer: timeout tick=%08u\n", s->TCTR));
-        s->IntrStatus |= PCSTimeout;
-        rtl8139_update_irq(s);
-    }
+static void rtl8139_cleanup(VLANClientState *nc)
+{
+    RTL8139State *s = DO_UPCAST(NICState, nc, nc)->opaque;
 
-    qemu_mod_timer(s->timer,
-        rtl8139_get_next_tctr_time(s,curr_time));
+    s->nic = NULL;
 }
-#endif /* RTL8139_ONBOARD_TIMER */
 
-static void rtl8139_cleanup(VLANClientState *vc)
+static int pci_rtl8139_uninit(PCIDevice *dev)
 {
-    RTL8139State *s = vc->opaque;
+    RTL8139State *s = DO_UPCAST(RTL8139State, dev, dev);
 
+    cpu_unregister_io_memory(s->rtl8139_mmio_io_addr);
     if (s->cplus_txbuffer) {
         qemu_free(s->cplus_txbuffer);
         s->cplus_txbuffer = NULL;
     }
-
-#ifdef RTL8139_ONBOARD_TIMER
     qemu_del_timer(s->timer);
     qemu_free_timer(s->timer);
-#endif
-
-    unregister_savevm("rtl8139", s);
-}
-
-static int pci_rtl8139_uninit(PCIDevice *dev)
-{
-    PCIRTL8139State *d = (PCIRTL8139State *)dev;
-    RTL8139State *s = &d->rtl8139;
-
-    cpu_unregister_io_memory(s->rtl8139_mmio_io_addr);
-
+    qemu_del_vlan_client(&s->nic->nc);
     return 0;
 }
 
-static void pci_rtl8139_init(PCIDevice *dev)
+static NetClientInfo net_rtl8139_info = {
+    .type = NET_CLIENT_TYPE_NIC,
+    .size = sizeof(NICState),
+    .can_receive = rtl8139_can_receive,
+    .receive = rtl8139_receive,
+    .cleanup = rtl8139_cleanup,
+};
+
+static int pci_rtl8139_init(PCIDevice *dev)
 {
-    PCIRTL8139State *d = (PCIRTL8139State *)dev;
-    RTL8139State *s;
+    RTL8139State * s = DO_UPCAST(RTL8139State, dev, dev);
     uint8_t *pci_conf;
 
-    d->dev.unregister = pci_rtl8139_uninit;
-
-    pci_conf = d->dev.config;
+    pci_conf = s->dev.config;
     pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_REALTEK);
     pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_REALTEK_8139);
-    pci_conf[0x04] = 0x05; /* command = I/O space, Bus Master */
-    pci_conf[0x08] = RTL8139_PCI_REVID; /* PCI revision ID; >=0x20 is for 8139C+ */
+    /* TODO: value should be 0 at RST#. */
+    pci_conf[PCI_COMMAND] = PCI_COMMAND_IO | PCI_COMMAND_MASTER;
+    pci_conf[PCI_REVISION_ID] = RTL8139_PCI_REVID; /* >=0x20 is for 8139C+ */
     pci_config_set_class(pci_conf, PCI_CLASS_NETWORK_ETHERNET);
-    pci_conf[PCI_HEADER_TYPE] = PCI_HEADER_TYPE_NORMAL; /* header_type */
-    pci_conf[0x3d] = 1;    /* interrupt pin 0 */
-    pci_conf[0x34] = 0xdc;
-
-    s = &d->rtl8139;
+    pci_conf[PCI_HEADER_TYPE] = PCI_HEADER_TYPE_NORMAL;
+    /* TODO: value should be 0 at RST# */
+    pci_conf[PCI_INTERRUPT_PIN] = 1;    /* interrupt pin 0 */
+    /* TODO: start of capability list, but no capability
+     * list bit in status register, and offset 0xdc seems unused. */
+    pci_conf[PCI_CAPABILITY_LIST] = 0xdc;
 
     /* I/O handler for memory-mapped I/O */
     s->rtl8139_mmio_io_addr =
-    cpu_register_io_memory(0, rtl8139_mmio_read, rtl8139_mmio_write, s);
+        cpu_register_io_memory(rtl8139_mmio_read, rtl8139_mmio_write, s);
 
-    pci_register_io_region(&d->dev, 0, 0x100,
-                           PCI_ADDRESS_SPACE_IO,  rtl8139_ioport_map);
+    pci_register_bar(&s->dev, 0, 0x100,
+                           PCI_BASE_ADDRESS_SPACE_IO,  rtl8139_ioport_map);
 
-    pci_register_io_region(&d->dev, 1, 0x100,
-                           PCI_ADDRESS_SPACE_MEM, rtl8139_mmio_map);
+    pci_register_bar(&s->dev, 1, 0x100,
+                           PCI_BASE_ADDRESS_SPACE_MEMORY, rtl8139_mmio_map);
 
-    s->pci_dev = (PCIDevice *)d;
-    qdev_get_macaddr(&dev->qdev, s->macaddr);
-    qemu_register_reset(rtl8139_reset, 0, s);
-    rtl8139_reset(s);
-    s->vc = qdev_get_vlan_client(&dev->qdev,
-                                 rtl8139_can_receive, rtl8139_receive, NULL,
-                                 rtl8139_cleanup, s);
+    qemu_macaddr_default_if_unset(&s->conf.macaddr);
 
-    qemu_format_nic_info_str(s->vc, s->macaddr);
+    s->nic = qemu_new_nic(&net_rtl8139_info, &s->conf,
+                          dev->qdev.info->name, dev->qdev.id, s);
+    qemu_format_nic_info_str(&s->nic->nc, s->conf.macaddr.a);
 
     s->cplus_txbuffer = NULL;
     s->cplus_txbuffer_len = 0;
     s->cplus_txbuffer_offset = 0;
 
-    register_savevm("rtl8139", -1, 4, rtl8139_save, rtl8139_load, s);
-
-#ifdef RTL8139_ONBOARD_TIMER
+    s->TimerExpire = 0;
     s->timer = qemu_new_timer(vm_clock, rtl8139_timer, s);
-
-    qemu_mod_timer(s->timer,
-        rtl8139_get_next_tctr_time(s,qemu_get_clock(vm_clock)));
-#endif /* RTL8139_ONBOARD_TIMER */
+    rtl8139_set_next_tctr_time(s, qemu_get_clock(vm_clock));
+    return 0;
 }
 
+static PCIDeviceInfo rtl8139_info = {
+    .qdev.name  = "rtl8139",
+    .qdev.size  = sizeof(RTL8139State),
+    .qdev.reset = rtl8139_reset,
+    .qdev.vmsd  = &vmstate_rtl8139,
+    .init       = pci_rtl8139_init,
+    .exit       = pci_rtl8139_uninit,
+    .romfile    = "pxe-rtl8139.bin",
+    .qdev.props = (Property[]) {
+        DEFINE_NIC_PROPERTIES(RTL8139State, conf),
+        DEFINE_PROP_END_OF_LIST(),
+    }
+};
+
 static void rtl8139_register_devices(void)
 {
-    pci_qdev_register("rtl8139", sizeof(PCIRTL8139State), pci_rtl8139_init);
+    pci_qdev_register(&rtl8139_info);
 }
 
 device_init(rtl8139_register_devices)