path: root/packages/qemu/qemu-0.9.1+svn/qemu-n800-support.patch

diff -urN 4242/cpu-all.h qemu-omap/cpu-all.h
--- 4242/cpu-all.h	2008-04-24 21:26:19.000000000 +0100
+++ qemu-omap/cpu-all.h	2008-04-23 09:57:55.000000000 +0100
@@ -816,7 +816,7 @@
 /* physical memory access */
 #define TLB_INVALID_MASK   (1 << 3)
 #define IO_MEM_SHIFT       4
-#define IO_MEM_NB_ENTRIES  (1 << (TARGET_PAGE_BITS  - IO_MEM_SHIFT))
+#define IO_MEM_NB_ENTRIES  (16 << (TARGET_PAGE_BITS  - IO_MEM_SHIFT))
 
 #define IO_MEM_RAM         (0 << IO_MEM_SHIFT) /* hardcoded offset */
 #define IO_MEM_ROM         (1 << IO_MEM_SHIFT) /* hardcoded offset */
diff -urN 4242/exec.c qemu-omap/exec.c
--- 4242/exec.c	2008-04-24 18:11:49.000000000 +0100
+++ qemu-omap/exec.c	2008-04-23 09:57:55.000000000 +0100
@@ -1664,7 +1664,7 @@
     {
         if ((pd & ~TARGET_PAGE_MASK) > IO_MEM_ROM && !(pd & IO_MEM_ROMD)) {
             /* IO memory case */
-            address = vaddr | pd;
+            address = vaddr | (pd & ~TARGET_PAGE_MASK);
             addend = paddr;
         } else {
             /* standard memory */
@@ -1698,7 +1698,9 @@
         } else {
             te->addr_read = -1;
         }
-        if (prot & PAGE_EXEC) {
+        if ((pd & ~TARGET_PAGE_MASK) > IO_MEM_ROM && !(pd & IO_MEM_ROMD)) {
+            te->addr_code = pd;
+        } else if (prot & PAGE_EXEC) {
             te->addr_code = address;
         } else {
             te->addr_code = -1;
@@ -2493,7 +2495,9 @@
     if (io_index <= 0) {
         if (io_mem_nb >= IO_MEM_NB_ENTRIES)
             return -1;
-        io_index = io_mem_nb++;
+        do io_index = io_mem_nb++;
+        while (((io_index << IO_MEM_SHIFT) & ~TARGET_PAGE_MASK)
+               <= IO_MEM_NOTDIRTY);
     } else {
         if (io_index >= IO_MEM_NB_ENTRIES)
             return -1;
diff -urN 4242/hw/max7310.c qemu-omap/hw/max7310.c
--- 4242/hw/max7310.c	2008-04-24 18:11:49.000000000 +0100
+++ qemu-omap/hw/max7310.c	2008-03-02 19:31:55.000000000 +0000
@@ -134,8 +134,8 @@
         s->i2c_command_byte = 1;
         break;
     case I2C_FINISH:
-        if (s->len == 1)
 #ifdef VERBOSE
+        if (s->len == 1)
             printf("%s: message too short (%i bytes)\n", __FUNCTION__, s->len);
 #endif
         break;
diff -urN 4242/hw/ndis.h qemu-omap/hw/ndis.h
--- 4242/hw/ndis.h	1970-01-01 01:00:00.000000000 +0100
+++ qemu-omap/hw/ndis.h	2008-04-23 09:57:56.000000000 +0100
@@ -0,0 +1,217 @@
+/*
+ * ndis.h 
+ * 
+ * ntddndis.h modified by Benedikt Spranger <b.spranger@pengutronix.de>
+ * 
+ * Thanks to the cygwin development team, 
+ * espacially to Casper S. Hornstrup <chorns@users.sourceforge.net>
+ * 
+ * THIS SOFTWARE IS NOT COPYRIGHTED
+ *
+ * This source code is offered for use in the public domain. You may
+ * use, modify or distribute it freely.
+ *
+ * This code is distributed in the hope that it will be useful but
+ * WITHOUT ANY WARRANTY. ALL WARRANTIES, EXPRESS OR IMPLIED ARE HEREBY
+ * DISCLAIMED. This includes but is not limited to warranties of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.
+ *
+ */
+
+#ifndef _LINUX_NDIS_H
+#define _LINUX_NDIS_H
+
+
+#define NDIS_STATUS_MULTICAST_FULL	  0xC0010009
+#define NDIS_STATUS_MULTICAST_EXISTS      0xC001000A
+#define NDIS_STATUS_MULTICAST_NOT_FOUND   0xC001000B
+
+enum NDIS_DEVICE_POWER_STATE {
+	NdisDeviceStateUnspecified = 0,
+	NdisDeviceStateD0,
+	NdisDeviceStateD1,
+	NdisDeviceStateD2,
+	NdisDeviceStateD3,
+	NdisDeviceStateMaximum
+};
+
+struct NDIS_PM_WAKE_UP_CAPABILITIES {
+	enum NDIS_DEVICE_POWER_STATE  MinMagicPacketWakeUp;
+	enum NDIS_DEVICE_POWER_STATE  MinPatternWakeUp;
+	enum NDIS_DEVICE_POWER_STATE  MinLinkChangeWakeUp;
+};
+
+/* NDIS_PNP_CAPABILITIES.Flags constants */
+#define NDIS_DEVICE_WAKE_UP_ENABLE                0x00000001
+#define NDIS_DEVICE_WAKE_ON_PATTERN_MATCH_ENABLE  0x00000002
+#define NDIS_DEVICE_WAKE_ON_MAGIC_PACKET_ENABLE   0x00000004
+
+struct NDIS_PNP_CAPABILITIES {
+	__le32					Flags;
+	struct NDIS_PM_WAKE_UP_CAPABILITIES	WakeUpCapabilities;
+};
+
+struct NDIS_PM_PACKET_PATTERN {
+	__le32	Priority;
+	__le32	Reserved;
+	__le32	MaskSize;
+	__le32	PatternOffset;
+	__le32	PatternSize;
+	__le32	PatternFlags;
+};
+
+
+/* Required Object IDs (OIDs) */
+#define OID_GEN_SUPPORTED_LIST            0x00010101
+#define OID_GEN_HARDWARE_STATUS           0x00010102
+#define OID_GEN_MEDIA_SUPPORTED           0x00010103
+#define OID_GEN_MEDIA_IN_USE              0x00010104
+#define OID_GEN_MAXIMUM_LOOKAHEAD         0x00010105
+#define OID_GEN_MAXIMUM_FRAME_SIZE        0x00010106
+#define OID_GEN_LINK_SPEED                0x00010107
+#define OID_GEN_TRANSMIT_BUFFER_SPACE     0x00010108
+#define OID_GEN_RECEIVE_BUFFER_SPACE      0x00010109
+#define OID_GEN_TRANSMIT_BLOCK_SIZE       0x0001010A
+#define OID_GEN_RECEIVE_BLOCK_SIZE        0x0001010B
+#define OID_GEN_VENDOR_ID                 0x0001010C
+#define OID_GEN_VENDOR_DESCRIPTION        0x0001010D
+#define OID_GEN_CURRENT_PACKET_FILTER     0x0001010E
+#define OID_GEN_CURRENT_LOOKAHEAD         0x0001010F
+#define OID_GEN_DRIVER_VERSION            0x00010110
+#define OID_GEN_MAXIMUM_TOTAL_SIZE        0x00010111
+#define OID_GEN_PROTOCOL_OPTIONS          0x00010112
+#define OID_GEN_MAC_OPTIONS               0x00010113
+#define OID_GEN_MEDIA_CONNECT_STATUS      0x00010114
+#define OID_GEN_MAXIMUM_SEND_PACKETS      0x00010115
+#define OID_GEN_VENDOR_DRIVER_VERSION     0x00010116
+#define OID_GEN_SUPPORTED_GUIDS           0x00010117
+#define OID_GEN_NETWORK_LAYER_ADDRESSES   0x00010118
+#define OID_GEN_TRANSPORT_HEADER_OFFSET   0x00010119
+#define OID_GEN_MACHINE_NAME              0x0001021A
+#define OID_GEN_RNDIS_CONFIG_PARAMETER    0x0001021B
+#define OID_GEN_VLAN_ID                   0x0001021C
+
+/* Optional OIDs */
+#define OID_GEN_MEDIA_CAPABILITIES        0x00010201
+#define OID_GEN_PHYSICAL_MEDIUM           0x00010202
+
+/* Required statistics OIDs */
+#define OID_GEN_XMIT_OK                   0x00020101
+#define OID_GEN_RCV_OK                    0x00020102
+#define OID_GEN_XMIT_ERROR                0x00020103
+#define OID_GEN_RCV_ERROR                 0x00020104
+#define OID_GEN_RCV_NO_BUFFER             0x00020105
+
+/* Optional statistics OIDs */
+#define OID_GEN_DIRECTED_BYTES_XMIT       0x00020201
+#define OID_GEN_DIRECTED_FRAMES_XMIT      0x00020202
+#define OID_GEN_MULTICAST_BYTES_XMIT      0x00020203
+#define OID_GEN_MULTICAST_FRAMES_XMIT     0x00020204
+#define OID_GEN_BROADCAST_BYTES_XMIT      0x00020205
+#define OID_GEN_BROADCAST_FRAMES_XMIT     0x00020206
+#define OID_GEN_DIRECTED_BYTES_RCV        0x00020207
+#define OID_GEN_DIRECTED_FRAMES_RCV       0x00020208
+#define OID_GEN_MULTICAST_BYTES_RCV       0x00020209
+#define OID_GEN_MULTICAST_FRAMES_RCV      0x0002020A
+#define OID_GEN_BROADCAST_BYTES_RCV       0x0002020B
+#define OID_GEN_BROADCAST_FRAMES_RCV      0x0002020C
+#define OID_GEN_RCV_CRC_ERROR             0x0002020D
+#define OID_GEN_TRANSMIT_QUEUE_LENGTH     0x0002020E
+#define OID_GEN_GET_TIME_CAPS             0x0002020F
+#define OID_GEN_GET_NETCARD_TIME          0x00020210
+#define OID_GEN_NETCARD_LOAD              0x00020211
+#define OID_GEN_DEVICE_PROFILE            0x00020212
+#define OID_GEN_INIT_TIME_MS              0x00020213
+#define OID_GEN_RESET_COUNTS              0x00020214
+#define OID_GEN_MEDIA_SENSE_COUNTS        0x00020215
+#define OID_GEN_FRIENDLY_NAME             0x00020216
+#define OID_GEN_MINIPORT_INFO             0x00020217
+#define OID_GEN_RESET_VERIFY_PARAMETERS   0x00020218
+
+/* IEEE 802.3 (Ethernet) OIDs */
+#define NDIS_802_3_MAC_OPTION_PRIORITY    0x00000001
+
+#define OID_802_3_PERMANENT_ADDRESS       0x01010101
+#define OID_802_3_CURRENT_ADDRESS         0x01010102
+#define OID_802_3_MULTICAST_LIST          0x01010103
+#define OID_802_3_MAXIMUM_LIST_SIZE       0x01010104
+#define OID_802_3_MAC_OPTIONS             0x01010105
+#define OID_802_3_RCV_ERROR_ALIGNMENT     0x01020101
+#define OID_802_3_XMIT_ONE_COLLISION      0x01020102
+#define OID_802_3_XMIT_MORE_COLLISIONS    0x01020103
+#define OID_802_3_XMIT_DEFERRED           0x01020201
+#define OID_802_3_XMIT_MAX_COLLISIONS     0x01020202
+#define OID_802_3_RCV_OVERRUN             0x01020203
+#define OID_802_3_XMIT_UNDERRUN           0x01020204
+#define OID_802_3_XMIT_HEARTBEAT_FAILURE  0x01020205
+#define OID_802_3_XMIT_TIMES_CRS_LOST     0x01020206
+#define OID_802_3_XMIT_LATE_COLLISIONS    0x01020207
+
+/* OID_GEN_MINIPORT_INFO constants */
+#define NDIS_MINIPORT_BUS_MASTER                      0x00000001
+#define NDIS_MINIPORT_WDM_DRIVER                      0x00000002
+#define NDIS_MINIPORT_SG_LIST                         0x00000004
+#define NDIS_MINIPORT_SUPPORTS_MEDIA_QUERY            0x00000008
+#define NDIS_MINIPORT_INDICATES_PACKETS               0x00000010
+#define NDIS_MINIPORT_IGNORE_PACKET_QUEUE             0x00000020
+#define NDIS_MINIPORT_IGNORE_REQUEST_QUEUE            0x00000040
+#define NDIS_MINIPORT_IGNORE_TOKEN_RING_ERRORS        0x00000080
+#define NDIS_MINIPORT_INTERMEDIATE_DRIVER             0x00000100
+#define NDIS_MINIPORT_IS_NDIS_5                       0x00000200
+#define NDIS_MINIPORT_IS_CO                           0x00000400
+#define NDIS_MINIPORT_DESERIALIZE                     0x00000800
+#define NDIS_MINIPORT_REQUIRES_MEDIA_POLLING          0x00001000
+#define NDIS_MINIPORT_SUPPORTS_MEDIA_SENSE            0x00002000
+#define NDIS_MINIPORT_NETBOOT_CARD                    0x00004000
+#define NDIS_MINIPORT_PM_SUPPORTED                    0x00008000
+#define NDIS_MINIPORT_SUPPORTS_MAC_ADDRESS_OVERWRITE  0x00010000
+#define NDIS_MINIPORT_USES_SAFE_BUFFER_APIS           0x00020000
+#define NDIS_MINIPORT_HIDDEN                          0x00040000
+#define NDIS_MINIPORT_SWENUM                          0x00080000
+#define NDIS_MINIPORT_SURPRISE_REMOVE_OK              0x00100000
+#define NDIS_MINIPORT_NO_HALT_ON_SUSPEND              0x00200000
+#define NDIS_MINIPORT_HARDWARE_DEVICE                 0x00400000
+#define NDIS_MINIPORT_SUPPORTS_CANCEL_SEND_PACKETS    0x00800000
+#define NDIS_MINIPORT_64BITS_DMA                      0x01000000
+
+#define NDIS_MEDIUM_802_3		0x00000000
+#define NDIS_MEDIUM_802_5		0x00000001
+#define NDIS_MEDIUM_FDDI		0x00000002
+#define NDIS_MEDIUM_WAN			0x00000003
+#define NDIS_MEDIUM_LOCAL_TALK		0x00000004
+#define NDIS_MEDIUM_DIX			0x00000005
+#define NDIS_MEDIUM_ARCENT_RAW		0x00000006
+#define NDIS_MEDIUM_ARCENT_878_2	0x00000007
+#define NDIS_MEDIUM_ATM			0x00000008
+#define NDIS_MEDIUM_WIRELESS_LAN	0x00000009
+#define NDIS_MEDIUM_IRDA		0x0000000A
+#define NDIS_MEDIUM_BPC			0x0000000B
+#define NDIS_MEDIUM_CO_WAN		0x0000000C
+#define NDIS_MEDIUM_1394		0x0000000D
+
+#define NDIS_PACKET_TYPE_DIRECTED	0x00000001
+#define NDIS_PACKET_TYPE_MULTICAST	0x00000002
+#define NDIS_PACKET_TYPE_ALL_MULTICAST	0x00000004
+#define NDIS_PACKET_TYPE_BROADCAST	0x00000008
+#define NDIS_PACKET_TYPE_SOURCE_ROUTING	0x00000010
+#define NDIS_PACKET_TYPE_PROMISCUOUS	0x00000020
+#define NDIS_PACKET_TYPE_SMT		0x00000040
+#define NDIS_PACKET_TYPE_ALL_LOCAL	0x00000080
+#define NDIS_PACKET_TYPE_GROUP		0x00000100
+#define NDIS_PACKET_TYPE_ALL_FUNCTIONAL	0x00000200
+#define NDIS_PACKET_TYPE_FUNCTIONAL	0x00000400
+#define NDIS_PACKET_TYPE_MAC_FRAME	0x00000800
+
+#define NDIS_MEDIA_STATE_CONNECTED	0x00000000
+#define NDIS_MEDIA_STATE_DISCONNECTED	0x00000001
+
+#define NDIS_MAC_OPTION_COPY_LOOKAHEAD_DATA     0x00000001
+#define NDIS_MAC_OPTION_RECEIVE_SERIALIZED      0x00000002
+#define NDIS_MAC_OPTION_TRANSFERS_NOT_PEND      0x00000004
+#define NDIS_MAC_OPTION_NO_LOOPBACK             0x00000008
+#define NDIS_MAC_OPTION_FULL_DUPLEX             0x00000010
+#define NDIS_MAC_OPTION_EOTX_INDICATION         0x00000020
+#define NDIS_MAC_OPTION_8021P_PRIORITY          0x00000040
+#define NDIS_MAC_OPTION_RESERVED                0x80000000
+
+#endif /* _LINUX_NDIS_H */
diff -urN 4242/hw/nseries.c qemu-omap/hw/nseries.c
--- 4242/hw/nseries.c	2008-04-24 18:11:49.000000000 +0100
+++ qemu-omap/hw/nseries.c	2008-04-23 09:57:56.000000000 +0100
@@ -602,6 +602,37 @@
                     (void *) &config7, sizeof(config7));
 }
 
+#if 0
+static uint32_t n800_pinout[104] = {
+    0x080f00d8, 0x00d40808, 0x03080808, 0x080800d0,
+    0x00dc0808, 0x0b0f0f00, 0x080800b4, 0x00c00808,
+    0x08080808, 0x180800c4, 0x00b80000, 0x08080808,
+    0x080800bc, 0x00cc0808, 0x08081818, 0x18180128,
+    0x01241800, 0x18181818, 0x000000f0, 0x01300000,
+    0x00001b0b, 0x1b0f0138, 0x00e0181b, 0x1b031b0b,
+    0x180f0078, 0x00740018, 0x0f0f0f1a, 0x00000080,
+    0x007c0000, 0x00000000, 0x00000088, 0x00840000,
+    0x00000000, 0x00000094, 0x00980300, 0x0f180003,
+    0x0000008c, 0x00900f0f, 0x0f0f1b00, 0x0f00009c,
+    0x01140000, 0x1b1b0f18, 0x0818013c, 0x01400008,
+    0x00001818, 0x000b0110, 0x010c1800, 0x0b030b0f,
+    0x181800f4, 0x00f81818, 0x00000018, 0x000000fc,
+    0x00401808, 0x00000000, 0x0f1b0030, 0x003c0008,
+    0x00000000, 0x00000038, 0x00340000, 0x00000000,
+    0x1a080070, 0x00641a1a, 0x08080808, 0x08080060,
+    0x005c0808, 0x08080808, 0x08080058, 0x00540808,
+    0x08080808, 0x0808006c, 0x00680808, 0x08080808,
+    0x000000a8, 0x00b00000, 0x08080808, 0x000000a0,
+    0x00a40000, 0x00000000, 0x08ff0050, 0x004c0808,
+    0xffffffff, 0xffff0048, 0x0044ffff, 0xffffffff,
+    0x000000ac, 0x01040800, 0x08080b0f, 0x18180100,
+    0x01081818, 0x0b0b1808, 0x1a0300e4, 0x012c0b1a,
+    0x02020018, 0x0b000134, 0x011c0800, 0x0b1b1b00,
+    0x0f0000c8, 0x00ec181b, 0x000f0f02, 0x00180118,
+    0x01200000, 0x0f0b1b1b, 0x0f0200e8, 0x0000020b,
+};
+#endif
+
 /* Setup sequence done by the bootloader */
 static void n800_boot_init(void *opaque)
 {
@@ -942,3 +973,71 @@
     "Nokia N800 aka. RX-34 tablet (OMAP2420)",
     n800_init,
 };
+
+#if 0
+/* cx3110x.c */
+#define CY_ARM_INT		0x00
+#define CY_ARM_INT_ENA		0x00
+#define CY_HOST_INT		0x00
+#define CY_HOST_INT_ENA		0x00
+#define CY_HOST_INT_ACK		0x00
+#define CY_GP1_COMM		0x00
+#define CY_GP2_COMM		0x00
+#define CY_DEV_CTRL_STA		0x00
+#define CY_DMA_DATA		0x00	/* 16-bit */
+#define CY_DMA_WR_CTRL		0x00	/* 16-bit */
+#define CY_DMA_WR_LEN		0x00	/* 16-bit */
+#define CY_DMA_WR_BASE		0x00
+#define CY_DMA_RD_CTRL		0x00	/* 16-bit */
+#define CY_DMA_RD_LEN		0x00	/* 16-bit */
+#define CY_DMA_RD_BASE		0x00
+
+HW:
+(spi bus 1.0)
+  tsc2005
+(spi bus 1.1)
+  lcd_mipid
+(spi bus 2.0)
+  cx3110x (WLAN)
+(spi somewhere?)
+  pc2400m (WiMAX)
+(i2c bus 0)
+  TLV320AIC33 (audio codec on i2c)
+  TCM825x (camera on i2c)
+  lp5521 (LED on i2c)
+  tsl2563 (light sensor, hwmon on i2c)
+  lm8323 (keypad on i2c)
+(i2c bus 1)
+  tmp105 (temperature sensor, hwmon on i2c)
+  menelaus (power on i2c)
+
+GPIO   0: out hi
+GPIO   8: in  hi
+GPIO   9: out hi
+GPIO  10: out lo
+GPIO  12: out lo
+GPIO  15: out lo
+GPIO  23: out hi
+GPIO  26: in  hi, irq-186 rising
+GPIO  53: out lo
+GPIO  58: in  hi, irq-218 low wakeup
+GPIO  62: out lo
+GPIO  64: out hi
+GPIO  65: in  hi
+GPIO  66: out lo
+GPIO  93: out lo
+GPIO  94: in  hi
+GPIO  95: out lo
+GPIO  96: out hi
+GPIO 101: out lo
+GPIO 102: in  hi, irq-262 bothedge
+GPIO 106: in  hi, irq-266 falling wakeup
+GPIO 107: in  hi, irq-267 bothedge
+GPIO 108: in  lo, irq-268 rising wakeup
+GPIO 109: in  hi, irq-269 falling wakeup
+GPIO 110: in  hi, irq-270 bothedge
+GPIO 111: in  lo, irq-271 rising
+GPIO 112: out hi
+GPIO 118: out hi
+GPIO 125: in  lo, irq-285 rising
+#endif
diff -urN 4242/hw/omap2.c qemu-omap/hw/omap2.c
--- 4242/hw/omap2.c	2008-04-24 18:11:49.000000000 +0100
+++ qemu-omap/hw/omap2.c	2008-04-23 09:57:56.000000000 +0100
@@ -3675,152 +3675,152 @@
                     omap_findclk(s, "dss_l4_iclk"));
 
     /* All register mappings (includin those not currenlty implemented):
-     * SystemControlMod	48000000 - 48000fff
-     * SystemControlL4	48001000 - 48001fff
-     * 32kHz Timer Mod	48004000 - 48004fff
-     * 32kHz Timer L4	48005000 - 48005fff
-     * PRCM ModA	48008000 - 480087ff
+     * SystemControlMod	48000000 - 48000fff (REV 0x00000010)
+     * SystemControlL4	48001000 - 48001fff (0x00200010, 0x01000200, 0x00000000)
+     * 32kHz Timer Mod	48004000 - 48004fff (REV 0x00000011)
+     * 32kHz Timer L4	48005000 - 48005fff (0x00200010, 0x01000200, 0x00000000)
+     * PRCM ModA	48008000 - 480087ff (REV 0x00000010)
      * PRCM ModB	48008800 - 48008fff
-     * PRCM L4		48009000 - 48009fff
-     * TEST-BCM Mod	48012000 - 48012fff
-     * TEST-BCM L4	48013000 - 48013fff
-     * TEST-TAP Mod	48014000 - 48014fff
-     * TEST-TAP L4	48015000 - 48015fff
-     * GPIO1 Mod	48018000 - 48018fff
-     * GPIO Top		48019000 - 48019fff
-     * GPIO2 Mod	4801a000 - 4801afff
-     * GPIO L4		4801b000 - 4801bfff
-     * GPIO3 Mod	4801c000 - 4801cfff
-     * GPIO4 Mod	4801e000 - 4801efff
-     * WDTIMER1 Mod	48020000 - 48010fff
+     * PRCM L4		48009000 - 48009fff (0x00200010, 0x00000200, 0x00000000)
+     * TEST-BCM Mod	48012000 - 48012fff (REV 0x00000010)
+     * TEST-BCM L4	48013000 - 48013fff (0x00200010, 0x00000200, 0x00000000)
+     * TEST-TAP Mod	48014000 - 48014fff (REV 0x00000010)
+     * TEST-TAP L4	48015000 - 48015fff (0x00200010, 0x00000200, 0x00000000)
+     * GPIO1 Mod	48018000 - 48018fff (REV 0x00000018)
+     * GPIO Top		48019000 - 48019fff (REV 0x00000011)
+     * GPIO2 Mod	4801a000 - 4801afff (REV 0x00000018)
+     * GPIO L4		4801b000 - 4801bfff (0x00200010, 0x00000200, 0x00000000)
+     * GPIO3 Mod	4801c000 - 4801cfff (REV 0x00000018)
+     * GPIO4 Mod	4801e000 - 4801efff (REV 0x00000018)
+     * WDTIMER1 Mod	48020000 - 48010fff (REV Abort)
      * WDTIMER Top	48021000 - 48011fff
-     * WDTIMER2 Mod	48022000 - 48012fff
-     * WDTIMER L4	48023000 - 48013fff
-     * WDTIMER3 Mod	48024000 - 48014fff
-     * WDTIMER3 L4	48025000 - 48015fff
-     * WDTIMER4 Mod	48026000 - 48016fff
-     * WDTIMER4 L4	48027000 - 48017fff
-     * GPTIMER1 Mod	48028000 - 48018fff
-     * GPTIMER1 L4	48029000 - 48019fff
-     * GPTIMER2 Mod	4802a000 - 4801afff
-     * GPTIMER2 L4	4802b000 - 4801bfff
+     * WDTIMER2 Mod	48022000 - 48012fff (REV 0x00000011)
+     * WDTIMER L4	48023000 - 48013fff (0x00200010, 0x00000200, 0x00000000)
+     * WDTIMER3 Mod	48024000 - 48014fff (REV 0x00000011)
+     * WDTIMER3 L4	48025000 - 48015fff (0x00200010, 0x00000200, 0x00000000)
+     * WDTIMER4 Mod	48026000 - 48016fff (REV 0x00000011)
+     * WDTIMER4 L4	48027000 - 48017fff (0x00200010, 0x00000200, 0x00000000)
+     * GPTIMER1 Mod	48028000 - 48018fff (REV 0x00000013)
+     * GPTIMER1 L4	48029000 - 48019fff (0x00200010, 0x00000200, 0x00000000)
+     * GPTIMER2 Mod	4802a000 - 4801afff (REV Abort)
+     * GPTIMER2 L4	4802b000 - 4801bfff (0x00200010, 0x00000200, 0x00000000)
      * L4-Config AP	48040000 - 480407ff
      * L4-Config IP	48040800 - 48040fff
      * L4-Config LA	48041000 - 48041fff
-     * ARM11ETB Mod	48048000 - 48049fff
-     * ARM11ETB L4	4804a000 - 4804afff
-     * DISPLAY Top	48050000 - 480503ff
-     * DISPLAY DISPC	48050400 - 480507ff
-     * DISPLAY RFBI	48050800 - 48050bff
-     * DISPLAY VENC	48050c00 - 48050fff
-     * DISPLAY L4	48051000 - 48051fff
-     * CAMERA Top	48052000 - 480523ff
-     * CAMERA core	48052400 - 480527ff
-     * CAMERA DMA	48052800 - 48052bff
-     * CAMERA MMU	48052c00 - 48052fff
-     * CAMERA L4	48053000 - 48053fff
-     * SDMA Mod		48056000 - 48056fff
-     * SDMA L4		48057000 - 48057fff
-     * SSI Top		48058000 - 48058fff
-     * SSI GDD		48059000 - 48059fff
-     * SSI Port1	4805a000 - 4805afff
-     * SSI Port2	4805b000 - 4805bfff
-     * SSI L4		4805c000 - 4805cfff
-     * USB Mod		4805e000 - 480fefff
-     * USB L4		4805f000 - 480fffff
-     * WIN_TRACER1 Mod	48060000 - 48060fff
-     * WIN_TRACER1 L4	48061000 - 48061fff
-     * WIN_TRACER2 Mod	48062000 - 48062fff
-     * WIN_TRACER2 L4	48063000 - 48063fff
-     * WIN_TRACER3 Mod	48064000 - 48064fff
-     * WIN_TRACER3 L4	48065000 - 48065fff
-     * WIN_TRACER4 Top	48066000 - 480660ff
-     * WIN_TRACER4 ETT	48066100 - 480661ff
-     * WIN_TRACER4 WT	48066200 - 480662ff
-     * WIN_TRACER4 L4	48067000 - 48067fff
-     * XTI Mod		48068000 - 48068fff
-     * XTI L4		48069000 - 48069fff
-     * UART1 Mod	4806a000 - 4806afff
-     * UART1 L4		4806b000 - 4806bfff
-     * UART2 Mod	4806c000 - 4806cfff
-     * UART2 L4		4806d000 - 4806dfff
-     * UART3 Mod	4806e000 - 4806efff
-     * UART3 L4		4806f000 - 4806ffff
-     * I2C1 Mod		48070000 - 48070fff
-     * I2C1 L4		48071000 - 48071fff
-     * I2C2 Mod		48072000 - 48072fff
-     * I2C2 L4		48073000 - 48073fff
-     * McBSP1 Mod	48074000 - 48074fff
-     * McBSP1 L4	48075000 - 48075fff
-     * McBSP2 Mod	48076000 - 48076fff
-     * McBSP2 L4	48077000 - 48077fff
-     * GPTIMER3 Mod	48078000 - 48078fff
-     * GPTIMER3 L4	48079000 - 48079fff
-     * GPTIMER4 Mod	4807a000 - 4807afff
-     * GPTIMER4 L4	4807b000 - 4807bfff
-     * GPTIMER5 Mod	4807c000 - 4807cfff
-     * GPTIMER5 L4	4807d000 - 4807dfff
-     * GPTIMER6 Mod	4807e000 - 4807efff
-     * GPTIMER6 L4	4807f000 - 4807ffff
-     * GPTIMER7 Mod	48080000 - 48080fff
-     * GPTIMER7 L4	48081000 - 48081fff
-     * GPTIMER8 Mod	48082000 - 48082fff
-     * GPTIMER8 L4	48083000 - 48083fff
-     * GPTIMER9 Mod	48084000 - 48084fff
-     * GPTIMER9 L4	48085000 - 48085fff
-     * GPTIMER10 Mod	48086000 - 48086fff
-     * GPTIMER10 L4	48087000 - 48087fff
-     * GPTIMER11 Mod	48088000 - 48088fff
-     * GPTIMER11 L4	48089000 - 48089fff
-     * GPTIMER12 Mod	4808a000 - 4808afff
-     * GPTIMER12 L4	4808b000 - 4808bfff
-     * EAC Mod		48090000 - 48090fff
-     * EAC L4		48091000 - 48091fff
-     * FAC Mod		48092000 - 48092fff
-     * FAC L4		48093000 - 48093fff
-     * MAILBOX Mod	48094000 - 48094fff
-     * MAILBOX L4	48095000 - 48095fff
-     * SPI1 Mod		48098000 - 48098fff
-     * SPI1 L4		48099000 - 48099fff
-     * SPI2 Mod		4809a000 - 4809afff
-     * SPI2 L4		4809b000 - 4809bfff
-     * MMC/SDIO Mod	4809c000 - 4809cfff
-     * MMC/SDIO L4	4809d000 - 4809dfff
-     * MS_PRO Mod	4809e000 - 4809efff
-     * MS_PRO L4	4809f000 - 4809ffff
-     * RNG Mod		480a0000 - 480a0fff
-     * RNG L4		480a1000 - 480a1fff
-     * DES3DES Mod	480a2000 - 480a2fff
-     * DES3DES L4	480a3000 - 480a3fff
-     * SHA1MD5 Mod	480a4000 - 480a4fff
-     * SHA1MD5 L4	480a5000 - 480a5fff
-     * AES Mod		480a6000 - 480a6fff
-     * AES L4		480a7000 - 480a7fff
-     * PKA Mod		480a8000 - 480a9fff
-     * PKA L4		480aa000 - 480aafff
-     * MG Mod		480b0000 - 480b0fff
-     * MG L4		480b1000 - 480b1fff
-     * HDQ/1-wire Mod	480b2000 - 480b2fff
-     * HDQ/1-wire L4	480b3000 - 480b3fff
-     * MPU interrupt	480fe000 - 480fefff
-     * IVA RAM		5c000000 - 5c01ffff
-     * IVA ROM		5c020000 - 5c027fff
-     * IMG_BUF_A	5c040000 - 5c040fff
-     * IMG_BUF_B	5c042000 - 5c042fff
-     * VLCDS		5c048000 - 5c0487ff
-     * IMX_COEF		5c049000 - 5c04afff
-     * IMX_CMD		5c051000 - 5c051fff
-     * VLCDQ		5c053000 - 5c0533ff
-     * VLCDH		5c054000 - 5c054fff
-     * SEQ_CMD		5c055000 - 5c055fff
-     * IMX_REG		5c056000 - 5c0560ff
-     * VLCD_REG		5c056100 - 5c0561ff
-     * SEQ_REG		5c056200 - 5c0562ff
-     * IMG_BUF_REG	5c056300 - 5c0563ff
-     * SEQIRQ_REG	5c056400 - 5c0564ff
-     * OCP_REG		5c060000 - 5c060fff
-     * SYSC_REG		5c070000 - 5c070fff
-     * MMU_REG		5d000000 - 5d000fff
+     * ARM11ETB Mod	48048000 - 48049fff (REV 0x00000011)
+     * ARM11ETB L4	4804a000 - 4804afff (0x00200010, 0x00000200, 0x00000000)
+     * DISPLAY Top	48050000 - 480503ff (REV 0x00000003)
+     * DISPLAY DISPC	48050400 - 480507ff (REV 0x00000020)
+     * DISPLAY RFBI	48050800 - 48050bff (REV 0x00000010)
+     * DISPLAY VENC	48050c00 - 48050fff (REV Abort)
+     * DISPLAY L4	48051000 - 48051fff (0x00200010, 0x00000200, 0x00000100)
+     * CAMERA Top	48052000 - 480523ff (REV 0x00000020)
+     * CAMERA core	48052400 - 480527ff (REV 0x00000020)
+     * CAMERA DMA	48052800 - 48052bff (REV 0x00000020)
+     * CAMERA MMU	48052c00 - 48052fff (REV 0x00000010)
+     * CAMERA L4	48053000 - 48053fff (0x00200010, 0x00000200, 0x00000000)
+     * SDMA Mod		48056000 - 48056fff (REV 0x00000020)
+     * SDMA L4		48057000 - 48057fff (0x00200010, 0x00000200, 0x00000000)
+     * SSI Top		48058000 - 48058fff (REV Abort)
+     * SSI GDD		48059000 - 48059fff (REV Abort)
+     * SSI Port1	4805a000 - 4805afff (REV Abort)
+     * SSI Port2	4805b000 - 4805bfff (REV Abort)
+     * SSI L4		4805c000 - 4805cfff (0x00200010, 0x00000200, 0x00000100)
+     * USB Mod		4805e000 - 480fefff (REV Abort)
+     * USB L4		4805f000 - 480fffff (0x00200010, 0x01000200, 0x00000100)
+     * WIN_TRACER1 Mod	48060000 - 48060fff (REV 0x00000020)
+     * WIN_TRACER1 L4	48061000 - 48061fff (0x00200010, 0x00000200, 0x00000000)
+     * WIN_TRACER2 Mod	48062000 - 48062fff (REV 0x00000020)
+     * WIN_TRACER2 L4	48063000 - 48063fff (0x00200010, 0x00000200, 0x00000000)
+     * WIN_TRACER3 Mod	48064000 - 48064fff (REV 0x00000020)
+     * WIN_TRACER3 L4	48065000 - 48065fff (0x00200010, 0x00000200, 0x00000000)
+     * WIN_TRACER4 Top	48066000 - 480660ff (REV 0x00000011)
+     * WIN_TRACER4 ETT	48066100 - 480661ff (REV 0x00000011)
+     * WIN_TRACER4 WT	48066200 - 480662ff (REV 0x00000020)
+     * WIN_TRACER4 L4	48067000 - 48067fff (0x00200010, 0x00000200, 0x00000000)
+     * XTI Mod		48068000 - 48068fff (REV 0x00000010)
+     * XTI L4		48069000 - 48069fff (0x00200010, 0x00000200, 0x00000000)
+     * UART1 Mod	4806a000 - 4806afff (MVR Abort)
+     * UART1 L4		4806b000 - 4806bfff (0x00200010, 0x00000200, 0x00000000)
+     * UART2 Mod	4806c000 - 4806cfff (MVR Abort)
+     * UART2 L4		4806d000 - 4806dfff (0x00200010, 0x00000200, 0x00000000)
+     * UART3 Mod	4806e000 - 4806efff (MVR 0x20)
+     * UART3 L4		4806f000 - 4806ffff (0x00200010, 0x00000200, 0x00000000)
+     * I2C1 Mod		48070000 - 48070fff (REV 0x0034)
+     * I2C1 L4		48071000 - 48071fff (0x00200010, 0x01000200, 0x01000000)
+     * I2C2 Mod		48072000 - 48072fff (REV 0x0034)
+     * I2C2 L4		48073000 - 48073fff (0x00200010, 0x01000200, 0x01000000)
+     * McBSP1 Mod	48074000 - 48074fff (REV Abort)
+     * McBSP1 L4	48075000 - 48075fff (0x00200010, 0x01000200, 0x01000000)
+     * McBSP2 Mod	48076000 - 48076fff (REV Abort)
+     * McBSP2 L4	48077000 - 48077fff (0x00200010, 0x01000200, 0x01000000)
+     * GPTIMER3 Mod	48078000 - 48078fff (REV Abort)
+     * GPTIMER3 L4	48079000 - 48079fff (0x00200010, 0x00000200, 0x00000000)
+     * GPTIMER4 Mod	4807a000 - 4807afff (REV Abort)
+     * GPTIMER4 L4	4807b000 - 4807bfff (0x00200010, 0x00000200, 0x00000000)
+     * GPTIMER5 Mod	4807c000 - 4807cfff (REV Abort)
+     * GPTIMER5 L4	4807d000 - 4807dfff (0x00200010, 0x00000200, 0x00000000)
+     * GPTIMER6 Mod	4807e000 - 4807efff (REV Abort)
+     * GPTIMER6 L4	4807f000 - 4807ffff (0x00200010, 0x00000200, 0x00000000)
+     * GPTIMER7 Mod	48080000 - 48080fff (REV Abort)
+     * GPTIMER7 L4	48081000 - 48081fff (0x00200010, 0x00000200, 0x00000000)
+     * GPTIMER8 Mod	48082000 - 48082fff (REV Abort)
+     * GPTIMER8 L4	48083000 - 48083fff (0x00200010, 0x00000200, 0x00000000)
+     * GPTIMER9 Mod	48084000 - 48084fff (REV Abort)
+     * GPTIMER9 L4	48085000 - 48085fff (0x00200010, 0x00000200, 0x00000000)
+     * GPTIMER10 Mod	48086000 - 48086fff (REV Abort)
+     * GPTIMER10 L4	48087000 - 48087fff (0x00200010, 0x00000200, 0x00000000)
+     * GPTIMER11 Mod	48088000 - 48088fff (REV Abort)
+     * GPTIMER11 L4	48089000 - 48089fff (0x00200010, 0x00000200, 0x00000000)
+     * GPTIMER12 Mod	4808a000 - 4808afff (REV Abort)
+     * GPTIMER12 L4	4808b000 - 4808bfff (0x00200010, 0x00000200, 0x00000000)
+     * EAC Mod		48090000 - 48090fff (REV Abort)
+     * EAC L4		48091000 - 48091fff (0x00200010, 0x00000200, 0x00000000)
+     * FAC Mod		48092000 - 48092fff (REV Abort)
+     * FAC L4		48093000 - 48093fff (0x00200010, 0x00000200, 0x00000000)
+     * MAILBOX Mod	48094000 - 48094fff (REV 0x00000010)
+     * MAILBOX L4	48095000 - 48095fff (0x00200010, 0x00000200, 0x00000000)
+     * SPI1 Mod		48098000 - 48098fff (REV Abort)
+     * SPI1 L4		48099000 - 48099fff (0x00200010, 0x00000200, 0x00000000)
+     * SPI2 Mod		4809a000 - 4809afff (REV Abort)
+     * SPI2 L4		4809b000 - 4809bfff (0x00200010, 0x00000200, 0x00000000)
+     * MMC/SDIO Mod	4809c000 - 4809cfff (REV 0x0044)
+     * MMC/SDIO L4	4809d000 - 4809dfff (0x00200010, 0x01000200, 0x01000000)
+     * MS_PRO Mod	4809e000 - 4809efff (REV Abort)
+     * MS_PRO L4	4809f000 - 4809ffff (0x00200010, 0x01000200, 0x01000000)
+     * RNG Mod		480a0000 - 480a0fff (REV 0xFC066F93?)
+     * RNG L4		480a1000 - 480a1fff (0x00200010, 0x01000200, 0x00000000)
+     * DES3DES Mod	480a2000 - 480a2fff (REV 0x00000000?)
+     * DES3DES L4	480a3000 - 480a3fff (0x00200010, 0x01000200, 0x00000000)
+     * SHA1MD5 Mod	480a4000 - 480a4fff (REV 0x00000000?)
+     * SHA1MD5 L4	480a5000 - 480a5fff (0x00200010, 0x01000200, 0x00000000)
+     * AES Mod		480a6000 - 480a6fff (REV 0x00000000?)
+     * AES L4		480a7000 - 480a7fff (0x00200010, 0x00000200, 0x00000000)
+     * PKA Mod		480a8000 - 480a9fff (REV 0x00000000?)
+     * PKA L4		480aa000 - 480aafff (0x00200010, 0x00000200, 0x00000000)
+     * MG Mod		480b0000 - 480b0fff (REV Abort)
+     * MG L4		480b1000 - 480b1fff (0x00200010, 0x01000200, 0x01000000)
+     * HDQ/1-wire Mod	480b2000 - 480b2fff (REV 0x00000002)
+     * HDQ/1-wire L4	480b3000 - 480b3fff (0x00200010, 0x00000200, 0x00000000)
+     * MPU interrupt	480fe000 - 480fefff (REV 0x00000020)
+     * IVA RAM		5c000000 - 5c01ffff (REV Abort)
+     * IVA ROM		5c020000 - 5c027fff (REV Abort)
+     * IMG_BUF_A	5c040000 - 5c040fff (REV Abort)
+     * IMG_BUF_B	5c042000 - 5c042fff (REV Abort)
+     * VLCDS		5c048000 - 5c0487ff (REV Abort)
+     * IMX_COEF		5c049000 - 5c04afff (REV Abort)
+     * IMX_CMD		5c051000 - 5c051fff (REV Abort)
+     * VLCDQ		5c053000 - 5c0533ff (REV Abort)
+     * VLCDH		5c054000 - 5c054fff (REV Abort)
+     * SEQ_CMD		5c055000 - 5c055fff (REV Abort)
+     * IMX_REG		5c056000 - 5c0560ff (REV Abort)
+     * VLCD_REG		5c056100 - 5c0561ff (REV Abort)
+     * SEQ_REG		5c056200 - 5c0562ff (REV Abort)
+     * IMG_BUF_REG	5c056300 - 5c0563ff (REV Abort)
+     * SEQIRQ_REG	5c056400 - 5c0564ff (REV Abort)
+     * OCP_REG		5c060000 - 5c060fff (REV Abort)
+     * SYSC_REG		5c070000 - 5c070fff (REV Abort)
+     * MMU_REG		5d000000 - 5d000fff (REV Abort)
      * sDMA R		68000400 - 680005ff
      * sDMA W		68000600 - 680007ff
      * Display Control	68000800 - 680009ff
@@ -3849,9 +3849,9 @@
      * GPMC (firewall)	68006000 - 680063ff
      * GPMC (err login)	68006400 - 680067ff
      * SMS (err login)	68006c00 - 68006fff
-     * SMS registers	68008000 - 68008fff
-     * SDRC registers	68009000 - 68009fff
-     * GPMC registers	6800a000   6800afff
+     * SMS registers	68008000 - 68008fff (REV 0x00000020)
+     * SDRC registers	68009000 - 68009fff (REV 0x00000020)
+     * GPMC registers	6800a000   6800afff (REV 0x00000020)
      */
 
     qemu_register_reset(omap2_mpu_reset, s);
diff -urN 4242/hw/pc.c qemu-omap/hw/pc.c
--- 4242/hw/pc.c	2008-04-24 21:26:22.000000000 +0100
+++ qemu-omap/hw/pc.c	2008-04-23 09:57:56.000000000 +0100
@@ -445,6 +445,37 @@
     bdrv_set_boot_sector(drives_table[hda].bdrv, bootsect, sizeof(bootsect));
 }
 
+static int load_kernel(const char *filename, uint8_t *addr,
+                       uint8_t *real_addr)
+{
+    int fd, size;
+    int setup_sects;
+
+    fd = open(filename, O_RDONLY | O_BINARY);
+    if (fd < 0)
+        return -1;
+
+    /* load 16 bit code */
+    if (read(fd, real_addr, 512) != 512)
+        goto fail;
+    setup_sects = real_addr[0x1F1];
+    if (!setup_sects)
+        setup_sects = 4;
+    if (read(fd, real_addr + 512, setup_sects * 512) !=
+        setup_sects * 512)
+        goto fail;
+
+    /* load 32 bit code */
+    size = read(fd, addr, 16 * 1024 * 1024);
+    if (size < 0)
+        goto fail;
+    close(fd);
+    return size;
+ fail:
+    close(fd);
+    return -1;
+}
+
 static long get_file_size(FILE *f)
 {
     long where, size;
diff -urN 4242/hw/tusb6010.c qemu-omap/hw/tusb6010.c
--- 4242/hw/tusb6010.c	2008-04-23 12:18:54.000000000 +0100
+++ qemu-omap/hw/tusb6010.c	2008-04-23 09:57:56.000000000 +0100
@@ -287,9 +287,6 @@
     /* TODO: How is this signalled?  */
 }
 
-extern CPUReadMemoryFunc *musb_read[];
-extern CPUWriteMemoryFunc *musb_write[];
-
 static uint32_t tusb_async_readb(void *opaque, target_phys_addr_t addr)
 {
     struct tusb_s *s = (struct tusb_s *) opaque;
diff -urN 4242/hw/usb.h qemu-omap/hw/usb.h
--- 4242/hw/usb.h	2008-04-23 12:18:54.000000000 +0100
+++ qemu-omap/hw/usb.h	2008-04-23 09:57:56.000000000 +0100
@@ -219,6 +219,9 @@
 /* usb-msd.c */
 USBDevice *usb_msd_init(const char *filename);
 
+/* usb-net.c */
+USBDevice *usb_net_init(NICInfo *nd);
+
 /* usb-wacom.c */
 USBDevice *usb_wacom_init(void);
 
@@ -254,3 +257,7 @@
 uint32_t musb_core_intr_get(struct musb_s *s);
 void musb_core_intr_clear(struct musb_s *s, uint32_t mask);
 void musb_set_size(struct musb_s *s, int epnum, int size, int is_tx);
+#ifdef NEED_CPU_H
+extern CPUReadMemoryFunc *musb_read[];
+extern CPUWriteMemoryFunc *musb_write[];
+#endif
diff -urN 4242/hw/usb-hub.c qemu-omap/hw/usb-hub.c
--- 4242/hw/usb-hub.c	2008-04-23 11:43:37.000000000 +0100
+++ qemu-omap/hw/usb-hub.c	2008-04-23 09:57:56.000000000 +0100
@@ -146,8 +146,8 @@
 	0x07,       /*  u8  ep_bLength; */
 	0x05,       /*  u8  ep_bDescriptorType; Endpoint */
 	0x81,       /*  u8  ep_bEndpointAddress; IN Endpoint 1 */
- 	0x03,       /*  u8  ep_bmAttributes; Interrupt */
- 	0x02, 0x00, /*  u16 ep_wMaxPacketSize; 1 + (MAX_ROOT_PORTS / 8) */
+	0x03,       /*  u8  ep_bmAttributes; Interrupt */
+	0x02, 0x00, /*  u16 ep_wMaxPacketSize; 1 + (MAX_ROOT_PORTS / 8) */
 	0xff        /*  u8  ep_bInterval; (255ms -- usb 2.0 spec) */
 };
 
diff -urN 4242/hw/usb-net.c qemu-omap/hw/usb-net.c
--- 4242/hw/usb-net.c	1970-01-01 01:00:00.000000000 +0100
+++ qemu-omap/hw/usb-net.c	2008-04-23 09:57:56.000000000 +0100
@@ -0,0 +1,1334 @@
+/*
+ * QEMU USB Net devices
+ * 
+ * Copyright (c) 2006 Thomas Sailer
+ * based on usb-hid.c Copyright (c) 2005 Fabrice Bellard
+ * 
+ * Permission is hereby granted, free of charge, to any person obtaining a copy
+ * of this software and associated documentation files (the "Software"), to deal
+ * in the Software without restriction, including without limitation the rights
+ * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+ * copies of the Software, and to permit persons to whom the Software is
+ * furnished to do so, subject to the following conditions:
+ *
+ * The above copyright notice and this permission notice shall be included in
+ * all copies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
+ * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+ * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
+ * THE SOFTWARE.
+ */
+
+#include "qemu-common.h"
+#include "usb.h"
+#include "net.h"
+#include "../audio/sys-queue.h"
+
+typedef uint32_t __le32;
+#include "ndis.h"
+
+/*#define TRAFFIC_DEBUG*/
+/* Thanks to NetChip Technologies for donating this product ID.
+ * It's for devices with only CDC Ethernet configurations.
+ */
+#define CDC_VENDOR_NUM          0x0525  /* NetChip */
+#define CDC_PRODUCT_NUM         0xa4a1  /* Linux-USB Ethernet Gadget */
+/* For hardware that can talk RNDIS and either of the above protocols,
+ * use this ID ... the windows INF files will know it.
+ */
+#define RNDIS_VENDOR_NUM        0x0525  /* NetChip */
+#define RNDIS_PRODUCT_NUM       0xa4a2  /* Ethernet/RNDIS Gadget */
+
+#define STRING_MANUFACTURER             1
+#define STRING_PRODUCT                  2
+#define STRING_ETHADDR                  3
+#define STRING_DATA                     4
+#define STRING_CONTROL                  5
+#define STRING_RNDIS_CONTROL            6
+#define STRING_CDC                      7
+#define STRING_SUBSET                   8
+#define STRING_RNDIS                    9
+#define STRING_SERIALNUMBER             10
+
+#define DEV_CONFIG_VALUE        1       /* cdc or subset */
+#define DEV_RNDIS_CONFIG_VALUE  2       /* rndis; optional */
+
+#define USB_CDC_SUBCLASS_ACM                    0x02
+#define USB_CDC_SUBCLASS_ETHERNET               0x06
+
+#define USB_CDC_PROTO_NONE                      0
+#define USB_CDC_ACM_PROTO_VENDOR                0xff
+
+#define USB_CDC_HEADER_TYPE             0x00            /* header_desc */
+#define USB_CDC_CALL_MANAGEMENT_TYPE    0x01            /* call_mgmt_descriptor */
+#define USB_CDC_ACM_TYPE                0x02            /* acm_descriptor */
+#define USB_CDC_UNION_TYPE              0x06            /* union_desc */
+#define USB_CDC_ETHERNET_TYPE           0x0f            /* ether_desc */
+
+#define USB_DT_CS_INTERFACE             0x24
+#define USB_DT_CS_ENDPOINT              0x25
+
+#define ClassInterfaceRequest \
+        ((USB_DIR_IN|USB_TYPE_CLASS|USB_RECIP_INTERFACE)<<8)
+#define ClassInterfaceOutRequest \
+        ((USB_DIR_OUT|USB_TYPE_CLASS|USB_RECIP_INTERFACE)<<8)
+
+#define USB_CDC_SEND_ENCAPSULATED_COMMAND       0x00
+#define USB_CDC_GET_ENCAPSULATED_RESPONSE       0x01
+#define USB_CDC_REQ_SET_LINE_CODING             0x20
+#define USB_CDC_REQ_GET_LINE_CODING             0x21
+#define USB_CDC_REQ_SET_CONTROL_LINE_STATE      0x22
+#define USB_CDC_REQ_SEND_BREAK                  0x23
+#define USB_CDC_SET_ETHERNET_MULTICAST_FILTERS  0x40
+#define USB_CDC_SET_ETHERNET_PM_PATTERN_FILTER  0x41
+#define USB_CDC_GET_ETHERNET_PM_PATTERN_FILTER  0x42
+#define USB_CDC_SET_ETHERNET_PACKET_FILTER      0x43
+#define USB_CDC_GET_ETHERNET_STATISTIC          0x44
+
+#define USB_ENDPOINT_XFER_BULK          2
+#define USB_ENDPOINT_XFER_INT           3
+
+#define LOG2_STATUS_INTERVAL_MSEC       5       /* 1 << 5 == 32 msec */
+#define STATUS_BYTECOUNT                16      /* 8 byte header + data */
+
+#define ETH_FRAME_LEN                   1514    /* Max. octets in frame sans FCS */
+
+/*
+ * mostly the same descriptor as the linux gadget rndis driver
+ */
+static const uint8_t qemu_net_dev_descriptor[] = {
+	0x12,                /*  u8 bLength; */
+	USB_DT_DEVICE,       /*  u8 bDescriptorType; Device */
+	0x00, 0x02,          /*  u16 bcdUSB; v2.0 */
+	USB_CLASS_COMM,	     /*  u8  bDeviceClass; */
+	0x00,	             /*  u8  bDeviceSubClass; */
+	0x00,                /*  u8  bDeviceProtocol; [ low/full speeds only ] */
+	0x40,                /*  u8  bMaxPacketSize0 */
+	RNDIS_VENDOR_NUM & 0xff, RNDIS_VENDOR_NUM >> 8,   /*  u16 idVendor; */
+ 	RNDIS_PRODUCT_NUM & 0xff, RNDIS_PRODUCT_NUM >> 8, /*  u16 idProduct; */
+	0x00, 0x00,          /*  u16 bcdDevice */
+	STRING_MANUFACTURER, /*  u8  iManufacturer; */
+	STRING_PRODUCT,      /*  u8  iProduct; */
+	STRING_SERIALNUMBER, /*  u8  iSerialNumber; */
+	0x02                 /*  u8  bNumConfigurations; */
+};
+
+static const uint8_t qemu_net_rndis_config_descriptor[] = {
+	/* Configuration Descriptor */
+	0x09,                /*  u8  bLength */
+	USB_DT_CONFIG,       /*  u8  bDescriptorType */
+        0x43, 0x00,          /*  le16 wTotalLength */
+        0x02,                /*  u8  bNumInterfaces */
+        DEV_RNDIS_CONFIG_VALUE, /*  u8  bConfigurationValue */
+        STRING_RNDIS,        /*  u8  iConfiguration */
+        0xc0,                /*  u8  bmAttributes */
+        0x32,                /*  u8  bMaxPower */
+	/* RNDIS Control Interface */
+        0x09,                /*  u8  bLength */
+        USB_DT_INTERFACE,    /*  u8  bDescriptorType */
+        0x00,                /*  u8  bInterfaceNumber */
+        0x00,                /*  u8  bAlternateSetting */
+        0x01,                /*  u8  bNumEndpoints */
+        USB_CLASS_COMM,           /*  u8  bInterfaceClass */
+        USB_CDC_SUBCLASS_ACM,     /*  u8  bInterfaceSubClass */
+        USB_CDC_ACM_PROTO_VENDOR, /*  u8  bInterfaceProtocol */
+        STRING_RNDIS_CONTROL,     /*  u8  iInterface */
+	/* Header Descriptor */
+        0x05,                /*  u8    bLength */
+        USB_DT_CS_INTERFACE, /*  u8    bDescriptorType */
+        USB_CDC_HEADER_TYPE, /*  u8    bDescriptorSubType */
+        0x10, 0x01,          /*  le16  bcdCDC */
+	/* Call Management Descriptor */
+        0x05,                /*  u8    bLength */
+        USB_DT_CS_INTERFACE, /*  u8    bDescriptorType */
+        USB_CDC_CALL_MANAGEMENT_TYPE, /*  u8    bDescriptorSubType */
+        0x00,                /*  u8    bmCapabilities */
+        0x01,                /*  u8    bDataInterface */
+	/* ACM Descriptor */
+        0x04,                /*  u8    bLength */
+        USB_DT_CS_INTERFACE, /*  u8    bDescriptorType */
+        USB_CDC_ACM_TYPE,    /*  u8    bDescriptorSubType */
+        0x00,                /*  u8    bmCapabilities */
+	/* Union Descriptor */
+        0x05,                /*  u8    bLength */
+        USB_DT_CS_INTERFACE, /*  u8    bDescriptorType */
+        USB_CDC_UNION_TYPE,  /*  u8    bDescriptorSubType */
+        0x00,                /*  u8    bMasterInterface0 */
+        0x01,                /*  u8    bSlaveInterface0 */
+	/* Status Descriptor */
+        0x07,                /*  u8  bLength */
+        USB_DT_ENDPOINT,     /*  u8  bDescriptorType */
+        USB_DIR_IN | 1,      /*  u8  bEndpointAddress */
+        USB_ENDPOINT_XFER_INT, /*  u8  bmAttributes */
+        STATUS_BYTECOUNT & 0xff, STATUS_BYTECOUNT >> 8, /*  le16 wMaxPacketSize */
+        1 << LOG2_STATUS_INTERVAL_MSEC, /*  u8  bInterval */
+	/* RNDIS Data Interface */
+        0x09,                /*  u8  bLength */
+        USB_DT_INTERFACE,    /*  u8  bDescriptorType */
+        0x01,                /*  u8  bInterfaceNumber */
+        0x00,                /*  u8  bAlternateSetting */
+        0x02,                /*  u8  bNumEndpoints */
+        USB_CLASS_CDC_DATA,  /*  u8  bInterfaceClass */
+        0x00,                /*  u8  bInterfaceSubClass */
+        0x00,                /*  u8  bInterfaceProtocol */
+        STRING_DATA,         /*  u8  iInterface */
+	/* Source Endpoint */
+        0x07,                /*  u8  bLength */
+        USB_DT_ENDPOINT,     /*  u8  bDescriptorType */
+        USB_DIR_IN | 2,      /*  u8  bEndpointAddress */
+        USB_ENDPOINT_XFER_BULK, /*  u8  bmAttributes */
+        0x40, 0x00,          /*  le16 wMaxPacketSize */
+        0x00,                /*  u8  bInterval */
+	/* Sink Endpoint */
+        0x07,                /*  u8  bLength */
+        USB_DT_ENDPOINT,     /*  u8  bDescriptorType */
+        USB_DIR_OUT | 2,     /*  u8  bEndpointAddress */
+        USB_ENDPOINT_XFER_BULK, /*  u8  bmAttributes */
+        0x40, 0x00,          /*  le16 wMaxPacketSize */
+        0x00                 /*  u8  bInterval */
+};
+
+static const uint8_t qemu_net_cdc_config_descriptor[] = {
+	/* Configuration Descriptor */
+	0x09,                /*  u8  bLength */
+	USB_DT_CONFIG,       /*  u8  bDescriptorType */
+        0x50, 0x00,          /*  le16 wTotalLength */
+        0x02,                /*  u8  bNumInterfaces */
+        DEV_CONFIG_VALUE,    /*  u8  bConfigurationValue */
+        STRING_CDC,          /*  u8  iConfiguration */
+        0xc0,                /*  u8  bmAttributes */
+        0x32,                /*  u8  bMaxPower */
+	/* CDC Control Interface */
+        0x09,                /*  u8  bLength */
+        USB_DT_INTERFACE,    /*  u8  bDescriptorType */
+        0x00,                /*  u8  bInterfaceNumber */
+        0x00,                /*  u8  bAlternateSetting */
+        0x01,                /*  u8  bNumEndpoints */
+        USB_CLASS_COMM,            /*  u8  bInterfaceClass */
+        USB_CDC_SUBCLASS_ETHERNET, /*  u8  bInterfaceSubClass */
+        USB_CDC_PROTO_NONE,        /*  u8  bInterfaceProtocol */
+        STRING_CONTROL,            /*  u8  iInterface */
+	/* Header Descriptor */
+        0x05,                /*  u8    bLength */
+        USB_DT_CS_INTERFACE, /*  u8    bDescriptorType */
+        USB_CDC_HEADER_TYPE, /*  u8    bDescriptorSubType */
+        0x10, 0x01,          /*  le16  bcdCDC */
+	/* Union Descriptor */
+        0x05,                /*  u8    bLength */
+        USB_DT_CS_INTERFACE, /*  u8    bDescriptorType */
+        USB_CDC_UNION_TYPE,  /*  u8    bDescriptorSubType */
+        0x00,                /*  u8    bMasterInterface0 */
+        0x01,                /*  u8    bSlaveInterface0 */
+	/* Ethernet Descriptor */
+        0x0d,                /*  u8    bLength */
+        USB_DT_CS_INTERFACE, /*  u8    bDescriptorType */
+        USB_CDC_ETHERNET_TYPE,  /*  u8    bDescriptorSubType */
+        STRING_ETHADDR,         /*  u8    iMACAddress */
+        0x00, 0x00, 0x00, 0x00, /*  le32  bmEthernetStatistics */
+        ETH_FRAME_LEN & 0xff, ETH_FRAME_LEN >> 8, /*  le16  wMaxSegmentSize */
+        0x00, 0x00,          /*  le16  wNumberMCFilters */
+        0x00,                /*  u8    bNumberPowerFilters */
+	/* Status Descriptor */
+        0x07,                /*  u8  bLength */
+        USB_DT_ENDPOINT,     /*  u8  bDescriptorType */
+        USB_DIR_IN | 1,      /*  u8  bEndpointAddress */
+        USB_ENDPOINT_XFER_INT, /*  u8  bmAttributes */
+        STATUS_BYTECOUNT & 0xff, STATUS_BYTECOUNT >> 8, /*  le16 wMaxPacketSize */
+        1 << LOG2_STATUS_INTERVAL_MSEC, /*  u8  bInterval */
+	/* CDC Data (nop) Interface */
+        0x09,                /*  u8  bLength */
+        USB_DT_INTERFACE,    /*  u8  bDescriptorType */
+        0x01,                /*  u8  bInterfaceNumber */
+        0x00,                /*  u8  bAlternateSetting */
+        0x00,                /*  u8  bNumEndpoints */
+        USB_CLASS_CDC_DATA,  /*  u8  bInterfaceClass */
+        0x00,                /*  u8  bInterfaceSubClass */
+        0x00,                /*  u8  bInterfaceProtocol */
+        0x00,                /*  u8  iInterface */
+	/* CDC Data Interface */
+        0x09,                /*  u8  bLength */
+        USB_DT_INTERFACE,    /*  u8  bDescriptorType */
+        0x01,                /*  u8  bInterfaceNumber */
+        0x01,                /*  u8  bAlternateSetting */
+        0x02,                /*  u8  bNumEndpoints */
+        USB_CLASS_CDC_DATA,  /*  u8  bInterfaceClass */
+        0x00,                /*  u8  bInterfaceSubClass */
+        0x00,                /*  u8  bInterfaceProtocol */
+        STRING_DATA,         /*  u8  iInterface */
+	/* Source Endpoint */
+        0x07,                /*  u8  bLength */
+        USB_DT_ENDPOINT,     /*  u8  bDescriptorType */
+        USB_DIR_IN | 2,      /*  u8  bEndpointAddress */
+        USB_ENDPOINT_XFER_BULK, /*  u8  bmAttributes */
+        0x40, 0x00,          /*  le16 wMaxPacketSize */
+        0x00,                /*  u8  bInterval */
+	/* Sink Endpoint */
+        0x07,                /*  u8  bLength */
+        USB_DT_ENDPOINT,     /*  u8  bDescriptorType */
+        USB_DIR_OUT | 2,     /*  u8  bEndpointAddress */
+        USB_ENDPOINT_XFER_BULK, /*  u8  bmAttributes */
+        0x40, 0x00,          /*  le16 wMaxPacketSize */
+        0x00                 /*  u8  bInterval */
+};
+
+/*
+ * RNDIS Status
+ */
+
+#define RNDIS_MAXIMUM_FRAME_SIZE        1518
+#define RNDIS_MAX_TOTAL_SIZE            1558
+
+/* Remote NDIS Versions */
+#define RNDIS_MAJOR_VERSION             1
+#define RNDIS_MINOR_VERSION             0
+
+/* Status Values */
+#define RNDIS_STATUS_SUCCESS            0x00000000U     /* Success           */
+#define RNDIS_STATUS_FAILURE            0xC0000001U     /* Unspecified error */
+#define RNDIS_STATUS_INVALID_DATA       0xC0010015U     /* Invalid data      */
+#define RNDIS_STATUS_NOT_SUPPORTED      0xC00000BBU     /* Unsupported request */
+#define RNDIS_STATUS_MEDIA_CONNECT      0x4001000BU     /* Device connected  */
+#define RNDIS_STATUS_MEDIA_DISCONNECT   0x4001000CU     /* Device disconnected */
+
+/* Message Set for Connectionless (802.3) Devices */
+#define REMOTE_NDIS_PACKET_MSG          0x00000001U
+#define REMOTE_NDIS_INITIALIZE_MSG      0x00000002U     /* Initialize device */
+#define REMOTE_NDIS_HALT_MSG            0x00000003U
+#define REMOTE_NDIS_QUERY_MSG           0x00000004U
+#define REMOTE_NDIS_SET_MSG             0x00000005U
+#define REMOTE_NDIS_RESET_MSG           0x00000006U
+#define REMOTE_NDIS_INDICATE_STATUS_MSG 0x00000007U
+#define REMOTE_NDIS_KEEPALIVE_MSG       0x00000008U
+
+/* Message completion */
+#define REMOTE_NDIS_INITIALIZE_CMPLT    0x80000002U
+#define REMOTE_NDIS_QUERY_CMPLT         0x80000004U
+#define REMOTE_NDIS_SET_CMPLT           0x80000005U
+#define REMOTE_NDIS_RESET_CMPLT         0x80000006U
+#define REMOTE_NDIS_KEEPALIVE_CMPLT     0x80000008U
+
+/* Device Flags */
+#define RNDIS_DF_CONNECTIONLESS         0x00000001U
+#define RNDIS_DF_CONNECTION_ORIENTED    0x00000002U
+
+#define RNDIS_MEDIUM_802_3              0x00000000U
+
+/* from drivers/net/sk98lin/h/skgepnmi.h */
+#define OID_PNP_CAPABILITIES                    0xFD010100
+#define OID_PNP_SET_POWER                       0xFD010101
+#define OID_PNP_QUERY_POWER                     0xFD010102
+#define OID_PNP_ADD_WAKE_UP_PATTERN             0xFD010103
+#define OID_PNP_REMOVE_WAKE_UP_PATTERN          0xFD010104
+#define OID_PNP_ENABLE_WAKE_UP                  0xFD010106
+
+typedef struct rndis_init_msg_type
+{
+        __le32  MessageType;
+        __le32  MessageLength;
+        __le32  RequestID;
+        __le32  MajorVersion;
+        __le32  MinorVersion;
+        __le32  MaxTransferSize;
+} rndis_init_msg_type;
+
+typedef struct rndis_init_cmplt_type
+{
+        __le32  MessageType;
+        __le32  MessageLength;
+        __le32  RequestID;
+        __le32  Status;
+        __le32  MajorVersion;
+        __le32  MinorVersion;
+        __le32  DeviceFlags;
+        __le32  Medium;
+        __le32  MaxPacketsPerTransfer;
+        __le32  MaxTransferSize;
+        __le32  PacketAlignmentFactor;
+        __le32  AFListOffset;
+        __le32  AFListSize;
+} rndis_init_cmplt_type;
+
+typedef struct rndis_halt_msg_type
+{
+        __le32  MessageType;
+        __le32  MessageLength;
+        __le32  RequestID;
+} rndis_halt_msg_type;
+
+typedef struct rndis_query_msg_type
+{
+        __le32  MessageType;
+        __le32  MessageLength;
+        __le32  RequestID;
+        __le32  OID;
+        __le32  InformationBufferLength;
+        __le32  InformationBufferOffset;
+        __le32  DeviceVcHandle;
+} rndis_query_msg_type;
+
+typedef struct rndis_query_cmplt_type
+{
+        __le32  MessageType;
+        __le32  MessageLength;
+        __le32  RequestID;
+        __le32  Status;
+        __le32  InformationBufferLength;
+        __le32  InformationBufferOffset;
+} rndis_query_cmplt_type;
+
+typedef struct rndis_set_msg_type
+{
+        __le32  MessageType;
+        __le32  MessageLength;
+        __le32  RequestID;
+        __le32  OID;
+        __le32  InformationBufferLength;
+        __le32  InformationBufferOffset;
+        __le32  DeviceVcHandle;
+} rndis_set_msg_type;
+
+typedef struct rndis_set_cmplt_type
+{
+        __le32  MessageType;
+        __le32  MessageLength;
+        __le32  RequestID;
+        __le32  Status;
+} rndis_set_cmplt_type;
+
+typedef struct rndis_reset_msg_type
+{
+        __le32  MessageType;
+        __le32  MessageLength;
+        __le32  Reserved;
+} rndis_reset_msg_type;
+
+typedef struct rndis_reset_cmplt_type
+{
+        __le32  MessageType;
+        __le32  MessageLength;
+        __le32  Status;
+        __le32  AddressingReset;
+} rndis_reset_cmplt_type;
+
+typedef struct rndis_indicate_status_msg_type
+{
+        __le32  MessageType;
+        __le32  MessageLength;
+        __le32  Status;
+        __le32  StatusBufferLength;
+        __le32  StatusBufferOffset;
+} rndis_indicate_status_msg_type;
+
+typedef struct rndis_keepalive_msg_type
+{
+        __le32  MessageType;
+        __le32  MessageLength;
+        __le32  RequestID;
+} rndis_keepalive_msg_type;
+
+typedef struct rndis_keepalive_cmplt_type
+{
+        __le32  MessageType;
+        __le32  MessageLength;
+        __le32  RequestID;
+        __le32  Status;
+} rndis_keepalive_cmplt_type;
+
+struct rndis_packet_msg_type
+{
+        __le32  MessageType;
+        __le32  MessageLength;
+        __le32  DataOffset;
+        __le32  DataLength;
+        __le32  OOBDataOffset;
+        __le32  OOBDataLength;
+        __le32  NumOOBDataElements;
+        __le32  PerPacketInfoOffset;
+        __le32  PerPacketInfoLength;
+        __le32  VcHandle;
+        __le32  Reserved;
+};
+
+struct rndis_config_parameter
+{
+        __le32  ParameterNameOffset;
+        __le32  ParameterNameLength;
+        __le32  ParameterType;
+        __le32  ParameterValueOffset;
+        __le32  ParameterValueLength;
+};
+
+/* implementation specific */
+enum rndis_state
+{
+        RNDIS_UNINITIALIZED,
+        RNDIS_INITIALIZED,
+        RNDIS_DATA_INITIALIZED,
+};
+
+static const uint32_t oid_supported_list[] =
+{
+        /* the general stuff */
+        OID_GEN_SUPPORTED_LIST,
+        OID_GEN_HARDWARE_STATUS,
+        OID_GEN_MEDIA_SUPPORTED,
+        OID_GEN_MEDIA_IN_USE,
+        OID_GEN_MAXIMUM_FRAME_SIZE,
+        OID_GEN_LINK_SPEED,
+        OID_GEN_TRANSMIT_BLOCK_SIZE,
+        OID_GEN_RECEIVE_BLOCK_SIZE,
+        OID_GEN_VENDOR_ID,
+        OID_GEN_VENDOR_DESCRIPTION,
+        OID_GEN_VENDOR_DRIVER_VERSION,
+        OID_GEN_CURRENT_PACKET_FILTER,
+        OID_GEN_MAXIMUM_TOTAL_SIZE,
+        OID_GEN_MEDIA_CONNECT_STATUS,
+        OID_GEN_PHYSICAL_MEDIUM,
+        /* the statistical stuff */
+        OID_GEN_XMIT_OK,
+        OID_GEN_RCV_OK,
+        OID_GEN_XMIT_ERROR,
+        OID_GEN_RCV_ERROR,
+        OID_GEN_RCV_NO_BUFFER,
+        /* mandatory 802.3 */
+        /* the general stuff */
+        OID_802_3_PERMANENT_ADDRESS,
+        OID_802_3_CURRENT_ADDRESS,
+        OID_802_3_MULTICAST_LIST,
+        OID_802_3_MAC_OPTIONS,
+        OID_802_3_MAXIMUM_LIST_SIZE,
+
+        /* the statistical stuff */
+        OID_802_3_RCV_ERROR_ALIGNMENT,
+        OID_802_3_XMIT_ONE_COLLISION,
+        OID_802_3_XMIT_MORE_COLLISIONS
+};
+
+struct rndis_response {
+	TAILQ_ENTRY(rndis_response) entries;
+	uint32_t length;
+	uint8_t buf[0];
+};
+
+
+typedef struct USBNetState {
+	USBDevice dev;
+
+	unsigned int rndis;
+	enum rndis_state rndis_state;
+        uint32_t medium;
+        uint32_t speed;
+        uint32_t media_state;
+	uint16_t filter;
+       	uint32_t vendorid;
+	uint8_t mac[6];
+
+	unsigned int out_ptr;
+	uint8_t out_buf[2048];
+
+	USBPacket *inpkt;
+	unsigned int in_ptr, in_len;
+	uint8_t in_buf[2048];	
+
+	VLANClientState *vc;
+	TAILQ_HEAD(rndis_resp_head, rndis_response) rndis_resp;
+} USBNetState;
+
+
+static int ndis_query(USBNetState *s, uint32_t oid, uint8_t *inbuf, unsigned int inlen, uint8_t *outbuf)
+{
+	switch (oid) {
+        /* general oids (table 4-1) */
+        /* mandatory */
+        case OID_GEN_SUPPORTED_LIST:
+	{
+                unsigned int i, count = sizeof(oid_supported_list) / sizeof(uint32_t);
+                for (i = 0; i < count; i++)
+                        ((__le32 *)outbuf)[i] = cpu_to_le32(oid_supported_list[i]);
+                return sizeof(oid_supported_list);
+	}
+
+        /* mandatory */
+	case OID_GEN_HARDWARE_STATUS:
+		*((__le32 *)outbuf) = cpu_to_le32(0);
+		return sizeof(__le32);
+		
+        /* mandatory */
+        case OID_GEN_MEDIA_SUPPORTED:
+		*((__le32 *)outbuf) = cpu_to_le32(s->medium);
+		return sizeof(__le32);
+
+        /* mandatory */
+        case OID_GEN_MEDIA_IN_USE:
+		*((__le32 *)outbuf) = cpu_to_le32(s->medium);
+		return sizeof(__le32);
+
+        /* mandatory */
+        case OID_GEN_MAXIMUM_FRAME_SIZE:
+		*((__le32 *)outbuf) = cpu_to_le32(ETH_FRAME_LEN);
+		return sizeof(__le32);
+		
+        /* mandatory */
+        case OID_GEN_LINK_SPEED:
+		*((__le32 *)outbuf) = cpu_to_le32(s->speed);
+		return sizeof(__le32);
+
+        /* mandatory */
+        case OID_GEN_TRANSMIT_BLOCK_SIZE:
+		*((__le32 *)outbuf) = cpu_to_le32(ETH_FRAME_LEN);
+		return sizeof(__le32);
+		
+        /* mandatory */
+        case OID_GEN_RECEIVE_BLOCK_SIZE:
+		*((__le32 *)outbuf) = cpu_to_le32(ETH_FRAME_LEN);
+		return sizeof(__le32);
+
+        /* mandatory */
+        case OID_GEN_VENDOR_ID:
+		*((__le32 *)outbuf) = cpu_to_le32(0x1234);
+		return sizeof(__le32);
+
+        /* mandatory */
+        case OID_GEN_VENDOR_DESCRIPTION:
+		strcpy(outbuf, "QEMU USB RNDIS Net");
+		return strlen(outbuf) + 1;
+
+       case OID_GEN_VENDOR_DRIVER_VERSION:
+		*((__le32 *)outbuf) = cpu_to_le32(1);
+		return sizeof(__le32);
+
+        /* mandatory */
+        case OID_GEN_CURRENT_PACKET_FILTER:
+		*((__le32 *)outbuf) = cpu_to_le32(s->filter);
+		return sizeof(__le32);
+
+        /* mandatory */
+        case OID_GEN_MAXIMUM_TOTAL_SIZE:
+		*((__le32 *)outbuf) = cpu_to_le32(RNDIS_MAX_TOTAL_SIZE);
+		return sizeof(__le32);
+
+        /* mandatory */
+        case OID_GEN_MEDIA_CONNECT_STATUS:
+		*((__le32 *)outbuf) = cpu_to_le32(s->media_state);
+		return sizeof(__le32);
+
+        case OID_GEN_PHYSICAL_MEDIUM:
+		*((__le32 *)outbuf) = cpu_to_le32(0);
+		return sizeof(__le32);
+
+        case OID_GEN_MAC_OPTIONS:
+		*((__le32 *)outbuf) = cpu_to_le32(NDIS_MAC_OPTION_RECEIVE_SERIALIZED | NDIS_MAC_OPTION_FULL_DUPLEX);
+		return sizeof(__le32);
+
+        /* statistics OIDs (table 4-2) */
+        /* mandatory */
+        case OID_GEN_XMIT_OK:
+		*((__le32 *)outbuf) = cpu_to_le32(0);
+		return sizeof(__le32);
+
+        /* mandatory */
+        case OID_GEN_RCV_OK:
+		*((__le32 *)outbuf) = cpu_to_le32(0);
+		return sizeof(__le32);
+
+        /* mandatory */
+        case OID_GEN_XMIT_ERROR:
+		*((__le32 *)outbuf) = cpu_to_le32(0);
+		return sizeof(__le32);
+
+        /* mandatory */
+        case OID_GEN_RCV_ERROR:
+		*((__le32 *)outbuf) = cpu_to_le32(0);
+		return sizeof(__le32);
+
+        /* mandatory */
+        case OID_GEN_RCV_NO_BUFFER:
+		*((__le32 *)outbuf) = cpu_to_le32(0);
+		return sizeof(__le32);
+
+        /* ieee802.3 OIDs (table 4-3) */
+        /* mandatory */
+        case OID_802_3_PERMANENT_ADDRESS:
+		memcpy(outbuf, s->mac, 6);
+		return 6;
+
+        /* mandatory */
+        case OID_802_3_CURRENT_ADDRESS:
+		memcpy(outbuf, s->mac, 6);
+		return 6;
+
+        /* mandatory */
+        case OID_802_3_MULTICAST_LIST:
+		*((__le32 *)outbuf) = cpu_to_le32(0xE0000000);
+		return sizeof(__le32);
+
+        /* mandatory */
+        case OID_802_3_MAXIMUM_LIST_SIZE:
+		*((__le32 *)outbuf) = cpu_to_le32(1);
+		return sizeof(__le32);
+
+        case OID_802_3_MAC_OPTIONS:
+		return 0;
+
+        /* ieee802.3 statistics OIDs (table 4-4) */
+        /* mandatory */
+        case OID_802_3_RCV_ERROR_ALIGNMENT:
+		*((__le32 *)outbuf) = cpu_to_le32(0);
+		return sizeof(__le32);
+
+        /* mandatory */
+        case OID_802_3_XMIT_ONE_COLLISION:
+		*((__le32 *)outbuf) = cpu_to_le32(0);
+		return sizeof(__le32);
+
+        /* mandatory */
+        case OID_802_3_XMIT_MORE_COLLISIONS:
+		*((__le32 *)outbuf) = cpu_to_le32(0);
+		return sizeof(__le32);
+
+	default:
+		fprintf(stderr, "usbnet: unknown OID 0x%08x\n", oid);
+		return 0;
+	}
+	return -1;
+}
+
+static int ndis_set(USBNetState *s, uint32_t oid, uint8_t *inbuf, unsigned int inlen)
+{
+	switch (oid) {
+        case OID_GEN_CURRENT_PACKET_FILTER:
+		s->filter = le32_to_cpup((__le32 *)inbuf);
+		if (s->filter) {
+			s->rndis_state = RNDIS_DATA_INITIALIZED;
+		} else {
+			s->rndis_state = RNDIS_INITIALIZED;
+		}
+		return 0;
+
+        case OID_802_3_MULTICAST_LIST:
+		return 0;
+
+	}
+	return -1;
+}
+
+static int rndis_get_response(USBNetState *s, uint8_t *buf)
+{
+	int ret = 0;
+	struct rndis_response *r = s->rndis_resp.tqh_first;
+	if (!r)
+		return ret;
+	TAILQ_REMOVE(&s->rndis_resp, r, entries);
+	ret = r->length;
+	memcpy(buf, r->buf, r->length);
+	qemu_free(r);
+	return ret;
+}
+
+static void *rndis_queue_response(USBNetState *s, unsigned int length)
+{
+	struct rndis_response *r = qemu_mallocz(sizeof(struct rndis_response) + length);
+	if (!r)
+		return NULL;
+	TAILQ_INSERT_TAIL(&s->rndis_resp, r, entries);
+	r->length = length;
+	return &r->buf[0];
+}
+
+static void rndis_clear_responsequeue(USBNetState *s)
+{
+	struct rndis_response *r;
+	
+	while ((r = s->rndis_resp.tqh_first)) {
+		TAILQ_REMOVE(&s->rndis_resp, r, entries);
+		qemu_free(r);
+	}
+}
+
+static int rndis_init_response(USBNetState *s, rndis_init_msg_type *buf)
+{
+	rndis_init_cmplt_type *resp = rndis_queue_response(s, sizeof(rndis_init_cmplt_type));
+	if (!resp)
+		return USB_RET_STALL;
+	resp->MessageType = cpu_to_le32(REMOTE_NDIS_INITIALIZE_CMPLT);
+        resp->MessageLength = cpu_to_le32(sizeof(rndis_init_cmplt_type));
+        resp->RequestID = buf->RequestID; /* Still LE in msg buffer */
+        resp->Status = cpu_to_le32(RNDIS_STATUS_SUCCESS);
+        resp->MajorVersion = cpu_to_le32(RNDIS_MAJOR_VERSION);
+        resp->MinorVersion = cpu_to_le32(RNDIS_MINOR_VERSION);
+        resp->DeviceFlags = cpu_to_le32(RNDIS_DF_CONNECTIONLESS);
+        resp->Medium = cpu_to_le32(RNDIS_MEDIUM_802_3);
+        resp->MaxPacketsPerTransfer = cpu_to_le32(1);
+        resp->MaxTransferSize = cpu_to_le32(ETH_FRAME_LEN + sizeof(struct rndis_packet_msg_type) + 22);
+        resp->PacketAlignmentFactor = cpu_to_le32(0);
+        resp->AFListOffset = cpu_to_le32(0);
+        resp->AFListSize = cpu_to_le32(0);
+        return 0;
+}
+
+static int rndis_query_response(USBNetState *s, rndis_query_msg_type *buf, unsigned int length)
+{
+        rndis_query_cmplt_type *resp;
+	uint8_t infobuf[sizeof(oid_supported_list)]; /* oid_supported_list is the largest data reply */
+	uint32_t bufoffs, buflen;
+	int infobuflen;
+	unsigned int resplen;
+	bufoffs = le32_to_cpu(buf->InformationBufferOffset) + 8;
+	buflen = le32_to_cpu(buf->InformationBufferLength);
+	if (bufoffs + buflen > length)
+		return USB_RET_STALL;
+	infobuflen = ndis_query(s, le32_to_cpu(buf->OID), bufoffs + (uint8_t *)buf, buflen, infobuf);
+	resplen = sizeof(rndis_query_cmplt_type) + ((infobuflen < 0) ? 0 : infobuflen);
+	resp = rndis_queue_response(s, resplen);
+	if (!resp)
+		return USB_RET_STALL;
+        resp->MessageType = cpu_to_le32(REMOTE_NDIS_QUERY_CMPLT);
+        resp->RequestID = buf->RequestID; /* Still LE in msg buffer */
+	resp->MessageLength = cpu_to_le32(resplen);
+	if (infobuflen < 0) {
+		/* OID not supported */
+                resp->Status = cpu_to_le32(RNDIS_STATUS_NOT_SUPPORTED);
+		resp->InformationBufferLength = cpu_to_le32(0);
+                resp->InformationBufferOffset = cpu_to_le32(0);
+		return 0;
+	}
+	resp->Status = cpu_to_le32(RNDIS_STATUS_SUCCESS);
+	resp->InformationBufferOffset = cpu_to_le32(infobuflen ? sizeof(rndis_query_cmplt_type) - 8 : 0);
+	resp->InformationBufferLength = cpu_to_le32(infobuflen);
+	memcpy(resp + 1, infobuf, infobuflen);
+	return 0;
+}
+
+static int rndis_set_response(USBNetState *s, rndis_set_msg_type *buf, unsigned int length)
+{
+        rndis_set_cmplt_type *resp = rndis_queue_response(s, sizeof(rndis_set_cmplt_type));
+	uint32_t bufoffs, buflen;
+	if (!resp)
+		return USB_RET_STALL;
+	bufoffs = le32_to_cpu(buf->InformationBufferOffset) + 8;
+	buflen = le32_to_cpu(buf->InformationBufferLength);
+	if (bufoffs + buflen > length)
+		return USB_RET_STALL;
+	int ret = ndis_set(s, le32_to_cpu(buf->OID), bufoffs + (uint8_t *)buf, buflen);
+        resp->MessageType = cpu_to_le32(REMOTE_NDIS_SET_CMPLT);
+        resp->RequestID = buf->RequestID; /* Still LE in msg buffer */
+	resp->MessageLength = cpu_to_le32(sizeof(rndis_set_cmplt_type));
+	if (ret < 0) {
+		/* OID not supported */
+                resp->Status = cpu_to_le32(RNDIS_STATUS_NOT_SUPPORTED);
+		return 0;
+	}
+	resp->Status = cpu_to_le32(RNDIS_STATUS_SUCCESS);
+	return 0;
+}
+
+static int rndis_reset_response(USBNetState *s, rndis_reset_msg_type *buf)
+{
+        rndis_reset_cmplt_type *resp = rndis_queue_response(s, sizeof(rndis_reset_cmplt_type));
+	if (!resp)
+		return USB_RET_STALL;
+        resp->MessageType = cpu_to_le32(REMOTE_NDIS_RESET_CMPLT);
+        resp->MessageLength = cpu_to_le32(sizeof(rndis_reset_cmplt_type));
+        resp->Status = cpu_to_le32(RNDIS_STATUS_SUCCESS);
+        /* resent information */
+        resp->AddressingReset = cpu_to_le32(1);
+	return 0;
+}
+
+static int rndis_keepalive_response(USBNetState *s, rndis_keepalive_msg_type *buf)
+{
+        rndis_keepalive_cmplt_type *resp = rndis_queue_response(s, sizeof(rndis_keepalive_cmplt_type));
+	if (!resp)
+		return USB_RET_STALL;
+        resp->MessageType = cpu_to_le32(REMOTE_NDIS_KEEPALIVE_CMPLT);
+        resp->MessageLength = cpu_to_le32(sizeof(rndis_keepalive_cmplt_type));
+        resp->RequestID = buf->RequestID; /* Still LE in msg buffer */
+        resp->Status = cpu_to_le32(RNDIS_STATUS_SUCCESS);
+	return 0;
+}
+
+static int rndis_parse(USBNetState *s, uint8_t *data, int length)
+{
+        uint32_t MsgType, MsgLength;
+        __le32 *tmp = (__le32 *)data;
+        MsgType = le32_to_cpup(tmp++);
+        MsgLength = le32_to_cpup(tmp++);
+	
+	switch (MsgType) {
+	case REMOTE_NDIS_INITIALIZE_MSG:
+		s->rndis_state = RNDIS_INITIALIZED;
+		return rndis_init_response(s, (rndis_init_msg_type *)data);
+
+        case REMOTE_NDIS_HALT_MSG:
+		s->rndis_state = RNDIS_UNINITIALIZED;
+                return 0;
+
+	case REMOTE_NDIS_QUERY_MSG:
+                return rndis_query_response(s, (rndis_query_msg_type *)data, length);
+
+        case REMOTE_NDIS_SET_MSG:
+                return rndis_set_response(s, (rndis_set_msg_type *)data, length);
+
+        case REMOTE_NDIS_RESET_MSG:
+		rndis_clear_responsequeue(s);
+		s->out_ptr = s->in_ptr = s->in_len = 0;
+                return rndis_reset_response(s, (rndis_reset_msg_type *)data);
+
+        case REMOTE_NDIS_KEEPALIVE_MSG:
+                /* For USB: host does this every 5 seconds */
+                return rndis_keepalive_response(s, (rndis_keepalive_msg_type *)data);	
+	}
+	return USB_RET_STALL;
+}
+
+static void usb_net_handle_reset(USBDevice *dev)
+{
+}
+
+static int usb_net_handle_control(USBDevice *dev, int request, int value,
+                                  int index, int length, uint8_t *data)
+{
+	USBNetState *s = (USBNetState *)dev;
+	int ret = 0;
+
+	switch(request) {
+	case DeviceRequest | USB_REQ_GET_STATUS:
+		data[0] = (1 << USB_DEVICE_SELF_POWERED) |
+			(dev->remote_wakeup << USB_DEVICE_REMOTE_WAKEUP);
+		data[1] = 0x00;
+		ret = 2;
+		break;
+
+	case DeviceOutRequest | USB_REQ_CLEAR_FEATURE:
+		if (value == USB_DEVICE_REMOTE_WAKEUP) {
+			dev->remote_wakeup = 0;
+		} else {
+			goto fail;
+		}
+		ret = 0;
+		break;
+
+	case DeviceOutRequest | USB_REQ_SET_FEATURE:
+		if (value == USB_DEVICE_REMOTE_WAKEUP) {
+			dev->remote_wakeup = 1;
+		} else {
+			goto fail;
+		}
+		ret = 0;
+		break;
+
+	case DeviceOutRequest | USB_REQ_SET_ADDRESS:
+		dev->addr = value;
+		ret = 0;
+		break;
+
+	case ClassInterfaceOutRequest | USB_CDC_SEND_ENCAPSULATED_COMMAND:
+		if (!s->rndis || value || index != 0)
+			goto fail;
+#if TRAFFIC_DEBUG
+		{
+			unsigned int i;
+			fprintf(stderr, "SEND_ENCAPSULATED_COMMAND:");
+			for (i = 0; i < length; i++) {
+				if (!(i & 15))
+					fprintf(stderr, "\n%04X:", i);
+				fprintf(stderr, " %02X", data[i]);
+			}
+			fprintf(stderr, "\n\n");
+		}
+#endif
+		ret = rndis_parse(s, data, length);
+		break;
+
+	case ClassInterfaceRequest | USB_CDC_GET_ENCAPSULATED_RESPONSE:
+		if (!s->rndis || value || index != 0)
+			goto fail;
+		ret = rndis_get_response(s, data);
+		if (!ret) {
+			data[0] = 0;
+			ret = 1;
+		}
+#if TRAFFIC_DEBUG
+		{
+			unsigned int i;
+			fprintf(stderr, "GET_ENCAPSULATED_RESPONSE:");
+			for (i = 0; i < ret; i++) {
+				if (!(i & 15))
+					fprintf(stderr, "\n%04X:", i);
+				fprintf(stderr, " %02X", data[i]);
+			}
+			fprintf(stderr, "\n\n");
+		}
+#endif
+		break;
+
+	case DeviceRequest | USB_REQ_GET_DESCRIPTOR:
+		switch(value >> 8) {
+		case USB_DT_DEVICE:
+			ret = sizeof(qemu_net_dev_descriptor);
+			memcpy(data, qemu_net_dev_descriptor, ret);
+			break;
+
+		case USB_DT_CONFIG:
+			switch (value & 0xff) {
+			case 0:
+				ret = sizeof(qemu_net_rndis_config_descriptor);
+				memcpy(data, qemu_net_rndis_config_descriptor,
+						ret);
+				break;
+
+			case 1:
+				ret = sizeof(qemu_net_cdc_config_descriptor);
+				memcpy(data, qemu_net_cdc_config_descriptor,
+						ret);
+				break;
+
+			default:
+				goto fail;
+			}
+			data[2] = ret & 0xff;
+			data[3] = ret >> 8;
+			break;
+
+		case USB_DT_STRING:
+			switch (value & 0xff) {
+			case 0:
+				/* language ids */
+				data[0] = 4;
+				data[1] = 3;
+				data[2] = 0x09;
+				data[3] = 0x04;
+				ret = 4;
+				break;
+				
+			case STRING_MANUFACTURER:
+				ret = set_usb_string(data, "QEMU");
+				break;
+
+			case STRING_PRODUCT:
+				ret = set_usb_string(data, "RNDIS/QEMU USB Network Device");
+				break;
+
+			case STRING_ETHADDR:
+				ret = set_usb_string(data, "400102030405");
+				break;
+
+			case STRING_DATA:
+				ret = set_usb_string(data, "QEMU USB Net Data Interface");
+				break;
+
+			case STRING_CONTROL:
+				ret = set_usb_string(data, "QEMU USB Net Control Interface");
+				break;
+
+			case STRING_RNDIS_CONTROL:
+				ret = set_usb_string(data, "QEMU USB Net RNDIS Control Interface");
+				break;
+
+			case STRING_CDC:
+				ret = set_usb_string(data, "QEMU USB Net CDC");
+				break;
+
+			case STRING_SUBSET:
+				ret = set_usb_string(data, "QEMU USB Net Subset");
+				break;
+
+			case STRING_RNDIS:
+				ret = set_usb_string(data, "QEMU USB Net RNDIS");
+				break;
+
+			case STRING_SERIALNUMBER:
+				ret = set_usb_string(data, "1");
+				break;
+
+			default:
+				goto fail;
+			}
+			break;
+
+		default:
+			goto fail;
+		}
+		break;
+
+	case DeviceRequest | USB_REQ_GET_CONFIGURATION:
+		data[0] = s->rndis ? DEV_RNDIS_CONFIG_VALUE : DEV_CONFIG_VALUE;
+		ret = 1;
+		break;
+
+	case DeviceOutRequest | USB_REQ_SET_CONFIGURATION:
+		switch (value & 0xff) {
+		case DEV_CONFIG_VALUE:
+			s->rndis = 0;
+			break;
+
+		case DEV_RNDIS_CONFIG_VALUE:
+			s->rndis = 1;
+			break;
+
+		default:
+			goto fail;
+		}
+		ret = 0;
+		break;
+
+	case DeviceRequest | USB_REQ_GET_INTERFACE:
+	case InterfaceRequest | USB_REQ_GET_INTERFACE:
+		data[0] = 0;
+		ret = 1;
+		break;
+
+	case DeviceOutRequest | USB_REQ_SET_INTERFACE:
+	case InterfaceOutRequest | USB_REQ_SET_INTERFACE:
+		ret = 0;
+		break;
+
+	default:
+	fail:
+		fprintf(stderr, "usbnet: failed control transaction: request 0x%x value 0x%x index 0x%x length 0x%x\n",
+			request, value, index, length);
+		ret = USB_RET_STALL;
+		break;
+	}
+	return ret;
+}
+
+static int usb_net_handle_statusin(USBNetState *s, USBPacket *p)
+{
+	int ret = 8;
+	if (p->len < 8)
+		return USB_RET_STALL;
+	((__le32 *)p->data)[0] = cpu_to_le32(1);
+	((__le32 *)p->data)[1] = cpu_to_le32(0);
+	if (!s->rndis_resp.tqh_first)
+		ret = USB_RET_NAK;
+#if DEBUG
+	fprintf(stderr, "usbnet: interrupt poll len %u return %d", p->len, ret);
+	{
+		int i;
+		fprintf(stderr, ":");
+		for (i = 0; i < ret; i++) {
+			if (!(i & 15))
+				fprintf(stderr, "\n%04X:", i);
+			fprintf(stderr, " %02X", p->data[i]);
+		}
+		fprintf(stderr, "\n\n");
+	}
+#endif
+	return ret;
+}
+
+static int usb_net_handle_datain(USBNetState *s, USBPacket *p)
+{
+	int ret = USB_RET_NAK;
+
+	if (s->in_ptr > s->in_len) {
+		s->in_ptr = s->in_len = 0;
+		ret = USB_RET_NAK;
+		return ret;
+	}
+	if (!s->in_len) {
+		ret = USB_RET_NAK;
+		return ret;
+	}
+	ret = s->in_len - s->in_ptr;
+	if (ret > p->len)
+		ret = p->len;
+	memcpy(p->data, &s->in_buf[s->in_ptr], ret);
+	s->in_ptr += ret;
+	if (s->in_ptr >= s->in_len && (s->rndis || (s->in_len & (64-1)) || !ret)) {
+		/* no short packet necessary */
+		s->in_ptr = s->in_len = 0;
+	}
+#if TRAFFIC_DEBUG
+	fprintf(stderr, "usbnet: data in len %u return %d", p->len, ret);
+	{
+		int i;
+		fprintf(stderr, ":");
+		for (i = 0; i < ret; i++) {
+			if (!(i & 15))
+				fprintf(stderr, "\n%04X:", i);
+			fprintf(stderr, " %02X", p->data[i]);
+		}
+		fprintf(stderr, "\n\n");
+	}
+#endif
+	return ret;
+}
+
+static int usb_net_handle_dataout(USBNetState *s, USBPacket *p)
+{
+	int ret = p->len;
+	int sz = sizeof(s->out_buf) - s->out_ptr;
+	struct rndis_packet_msg_type *msg = (struct rndis_packet_msg_type *)s->out_buf;
+	uint32_t len;
+
+#if TRAFFIC_DEBUG
+	fprintf(stderr, "usbnet: data out len %u\n", p->len);
+	{
+		int i;
+		fprintf(stderr, ":");
+		for (i = 0; i < p->len; i++) {
+			if (!(i & 15))
+				fprintf(stderr, "\n%04X:", i);
+			fprintf(stderr, " %02X", p->data[i]);
+		}
+		fprintf(stderr, "\n\n");
+	}
+#endif
+	if (sz > ret)
+		sz = ret;
+	memcpy(&s->out_buf[s->out_ptr], p->data, sz);
+	s->out_ptr += sz;
+	if (!s->rndis) {
+		if (ret < 64) {
+			qemu_send_packet(s->vc, s->out_buf, s->out_ptr);
+			s->out_ptr = 0;
+		}
+		return ret;
+	}
+	len = le32_to_cpu(msg->MessageLength);
+	if (s->out_ptr < 8 || s->out_ptr < len)
+		return ret;
+	if (le32_to_cpu(msg->MessageType) == REMOTE_NDIS_PACKET_MSG) {
+		uint32_t offs = 8 + le32_to_cpu(msg->DataOffset);
+		uint32_t size = le32_to_cpu(msg->DataLength);
+		if (offs + size <= len)
+			qemu_send_packet(s->vc, s->out_buf + offs, size);
+	}
+	s->out_ptr -= len;
+	memmove(s->out_buf, &s->out_buf[len], s->out_ptr);
+	return ret;
+}
+
+static int usb_net_handle_data(USBDevice *dev, USBPacket *p)
+{
+	USBNetState *s = (USBNetState *)dev;
+	int ret = 0;
+
+	switch(p->pid) {
+	case USB_TOKEN_IN:
+		switch (p->devep) {
+		case 1:
+			ret = usb_net_handle_statusin(s, p);
+			break;
+
+		case 2:
+			ret = usb_net_handle_datain(s, p);
+			break;
+
+		default:
+			goto fail;
+		}
+		break;
+
+	case USB_TOKEN_OUT:
+		switch (p->devep) {
+		case 2:
+			ret = usb_net_handle_dataout(s, p);
+			break;
+
+		default:
+			goto fail;
+		}
+		break;
+
+	default:
+	fail:
+		ret = USB_RET_STALL;
+		break;
+	}
+	if (ret == USB_RET_STALL)
+		fprintf(stderr, "usbnet: failed data transaction: pid 0x%x ep 0x%x len 0x%x\n", p->pid, p->devep, p->len);
+	return ret;
+}
+
+static void usbnet_receive(void *opaque, const uint8_t *buf, int size)
+{
+	USBNetState *s = opaque;
+
+	if (s->rndis) {
+		struct rndis_packet_msg_type *msg = (struct rndis_packet_msg_type *)s->in_buf;
+		if (!s->rndis_state == RNDIS_DATA_INITIALIZED)
+			return;
+		if (size + sizeof(struct rndis_packet_msg_type) > sizeof(s->in_buf))
+			return;
+		memset(msg, 0, sizeof(struct rndis_packet_msg_type));
+		msg->MessageType = cpu_to_le32(REMOTE_NDIS_PACKET_MSG);
+		msg->MessageLength = cpu_to_le32(size + sizeof(struct rndis_packet_msg_type));
+		msg->DataOffset = cpu_to_le32(sizeof(struct rndis_packet_msg_type) - 8);
+		msg->DataLength = cpu_to_le32(size);
+		//msg->OOBDataOffset;
+		//msg->OOBDataLength;
+		//msg->NumOOBDataElements;
+		//msg->PerPacketInfoOffset;
+		//msg->PerPacketInfoLength;
+		//msg->VcHandle;
+		//msg->Reserved;
+		memcpy(msg + 1, buf, size);
+		s->in_len = size + sizeof(struct rndis_packet_msg_type);
+	} else {
+		if (size > sizeof(s->in_buf))
+			return;
+		memcpy(s->in_buf, buf, size);
+		s->in_len = size;
+	}
+	s->in_ptr = 0;
+}
+
+static int usbnet_can_receive(void *opaque)
+{
+	USBNetState *s = opaque;
+
+	if (s->rndis && !s->rndis_state == RNDIS_DATA_INITIALIZED)
+		return 1;
+	return !s->in_len;
+}
+
+static void usb_net_handle_destroy(USBDevice *dev)
+{
+	USBNetState *s = (USBNetState *)dev;
+	rndis_clear_responsequeue(s);
+	qemu_free(s);
+}
+
+USBDevice *usb_net_init(NICInfo *nd)
+{
+	USBNetState *s;
+
+	s = qemu_mallocz(sizeof(USBNetState));
+	if (!s)
+		return NULL;
+	s->dev.speed = USB_SPEED_FULL;
+	s->dev.handle_packet = usb_generic_handle_packet;
+
+	s->dev.handle_reset = usb_net_handle_reset;
+	s->dev.handle_control = usb_net_handle_control;
+	s->dev.handle_data = usb_net_handle_data;
+	s->dev.handle_destroy = usb_net_handle_destroy;
+
+	s->rndis = 1;
+	s->rndis_state = RNDIS_UNINITIALIZED;
+        s->medium = NDIS_MEDIUM_802_3;
+        s->speed = 1000000; /* 100MBps, in 100Bps units */
+        s->media_state = NDIS_MEDIA_STATE_CONNECTED;
+	s->filter = 0;
+        s->vendorid = 0x1234;
+	memcpy(s->mac, nd->macaddr, 6);
+	TAILQ_INIT(&s->rndis_resp);
+
+	pstrcpy(s->dev.devname, sizeof(s->dev.devname), "QEMU USB Network Interface");
+	s->vc = qemu_new_vlan_client(nd->vlan, usbnet_receive, usbnet_can_receive, s);
+	snprintf(s->vc->info_str, sizeof(s->vc->info_str),
+		 "usbnet macaddr=%02x:%02x:%02x:%02x:%02x:%02x",
+		 s->mac[0], s->mac[1], s->mac[2],
+		 s->mac[3], s->mac[4], s->mac[5]);
+	fprintf(stderr, "usbnet: initialized mac %02x:%02x:%02x:%02x:%02x:%02x\n",
+		s->mac[0], s->mac[1], s->mac[2],
+		s->mac[3], s->mac[4], s->mac[5]);
+	return (USBDevice *)s;
+}
diff -urN 4242/Makefile qemu-omap/Makefile
--- 4242/Makefile	2008-04-24 20:17:05.000000000 +0100
+++ qemu-omap/Makefile	2008-04-23 09:57:55.000000000 +0100
@@ -55,7 +55,8 @@
 OBJS+=tmp105.o
 OBJS+=scsi-disk.o cdrom.o
 OBJS+=scsi-generic.o
-OBJS+=usb.o usb-hub.o usb-linux.o usb-hid.o usb-msd.o usb-wacom.o usb-serial.o
+OBJS+=usb.o usb-hub.o usb-linux.o usb-hid.o usb-msd.o usb-net.o
+OBJS+=usb-wacom.o usb-serial.o
 OBJS+=sd.o ssi-sd.o
 
 ifdef CONFIG_BRLAPI
diff -urN 4242/softmmu_template.h qemu-omap/softmmu_template.h
--- 4242/softmmu_template.h	2008-04-24 18:11:49.000000000 +0100
+++ qemu-omap/softmmu_template.h	2008-04-23 09:57:56.000000000 +0100
@@ -51,12 +51,15 @@
                                                         int mmu_idx,
                                                         void *retaddr);
 static inline DATA_TYPE glue(io_read, SUFFIX)(target_phys_addr_t physaddr,
-                                              target_ulong tlb_addr)
+                                              target_ulong tlb_addr,
+                                              target_ulong tlb_io)
 {
     DATA_TYPE res;
     int index;
 
-    index = (tlb_addr >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
+    index = (tlb_addr & ~TARGET_PAGE_MASK) >> IO_MEM_SHIFT;
+    if (index > 4)
+        index = (tlb_io >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
 #if SHIFT <= 2
     res = io_mem_read[index][SHIFT](io_mem_opaque[index], physaddr);
 #else
@@ -95,7 +98,9 @@
             /* IO access */
             if ((addr & (DATA_SIZE - 1)) != 0)
                 goto do_unaligned_access;
-            res = glue(io_read, SUFFIX)(physaddr, tlb_addr);
+            res = glue(io_read, SUFFIX)(physaddr, tlb_addr,
+                                        env->tlb_table[mmu_idx]
+                                        [index].addr_code);
         } else if (((addr & ~TARGET_PAGE_MASK) + DATA_SIZE - 1) >= TARGET_PAGE_SIZE) {
             /* slow unaligned access (it spans two pages or IO) */
         do_unaligned_access:
@@ -147,7 +152,9 @@
             /* IO access */
             if ((addr & (DATA_SIZE - 1)) != 0)
                 goto do_unaligned_access;
-            res = glue(io_read, SUFFIX)(physaddr, tlb_addr);
+            res = glue(io_read, SUFFIX)(physaddr, tlb_addr,
+                                        env->tlb_table[mmu_idx]
+                                        [index].addr_code);
         } else if (((addr & ~TARGET_PAGE_MASK) + DATA_SIZE - 1) >= TARGET_PAGE_SIZE) {
         do_unaligned_access:
             /* slow unaligned access (it spans two pages) */
@@ -186,11 +193,14 @@
 static inline void glue(io_write, SUFFIX)(target_phys_addr_t physaddr,
                                           DATA_TYPE val,
                                           target_ulong tlb_addr,
-                                          void *retaddr)
+                                          void *retaddr,
+                                          target_ulong tlb_io)
 {
     int index;
 
-    index = (tlb_addr >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
+    index = (tlb_addr & ~TARGET_PAGE_MASK) >> IO_MEM_SHIFT;
+    if (index > 4)
+        index = (tlb_io >> IO_MEM_SHIFT) & (IO_MEM_NB_ENTRIES - 1);
     env->mem_write_vaddr = tlb_addr;
     env->mem_write_pc = (unsigned long)retaddr;
 #if SHIFT <= 2
@@ -228,7 +238,8 @@
             if ((addr & (DATA_SIZE - 1)) != 0)
                 goto do_unaligned_access;
             retaddr = GETPC();
-            glue(io_write, SUFFIX)(physaddr, val, tlb_addr, retaddr);
+            glue(io_write, SUFFIX)(physaddr, val, tlb_addr, retaddr,
+                                   env->tlb_table[mmu_idx][index].addr_code);
         } else if (((addr & ~TARGET_PAGE_MASK) + DATA_SIZE - 1) >= TARGET_PAGE_SIZE) {
         do_unaligned_access:
             retaddr = GETPC();
@@ -278,7 +289,8 @@
             /* IO access */
             if ((addr & (DATA_SIZE - 1)) != 0)
                 goto do_unaligned_access;
-            glue(io_write, SUFFIX)(physaddr, val, tlb_addr, retaddr);
+            glue(io_write, SUFFIX)(physaddr, val, tlb_addr, retaddr,
+                                   env->tlb_table[mmu_idx][index].addr_code);
         } else if (((addr & ~TARGET_PAGE_MASK) + DATA_SIZE - 1) >= TARGET_PAGE_SIZE) {
         do_unaligned_access:
             /* XXX: not efficient, but simple */
diff -urN 4242/target-i386/cpu.h qemu-omap/target-i386/cpu.h
--- 4242/target-i386/cpu.h	2008-04-23 12:18:51.000000000 +0100
+++ qemu-omap/target-i386/cpu.h	2008-04-23 09:57:56.000000000 +0100
@@ -499,7 +499,7 @@
     SegmentCache idt; /* only base and limit are used */
 
     target_ulong cr[9]; /* NOTE: cr1, cr5-7 are unused */
-    uint64_t a20_mask;
+    uint32_t a20_mask;
 
     /* FPU state */
     unsigned int fpstt; /* top of stack index */
diff -urN 4242/target-i386/helper2.c qemu-omap/target-i386/helper2.c
--- 4242/target-i386/helper2.c	2008-04-23 12:18:51.000000000 +0100
+++ qemu-omap/target-i386/helper2.c	2008-04-23 09:57:56.000000000 +0100
@@ -377,7 +377,7 @@
     env->hflags |= HF_GIF_MASK;
 
     cpu_x86_update_cr0(env, 0x60000010);
-    env->a20_mask = ~0x0;
+    env->a20_mask = 0xffffffff;
     env->smbase = 0x30000;
 
     env->idt.limit = 0xffff;
@@ -695,7 +695,7 @@
         /* when a20 is changed, all the MMU mappings are invalid, so
            we must flush everything */
         tlb_flush(env, 1);
-        env->a20_mask = (~0x100000) | (a20_state << 20);
+        env->a20_mask = 0xffefffff | (a20_state << 20);
     }
 }
 
@@ -800,8 +800,7 @@
 
 #else
 
-/* Bits 52-62 of a PTE are reserved. Bit 63 is the NX bit. */
-#define PHYS_ADDR_MASK 0xffffffffff000L
+#define PHYS_ADDR_MASK 0xfffff000
 
 /* return value:
    -1 = cannot handle fault
@@ -813,10 +812,9 @@
                              int is_write1, int mmu_idx, int is_softmmu)
 {
     uint64_t ptep, pte;
-    target_ulong pde_addr, pte_addr;
+    uint32_t pdpe_addr, pde_addr, pte_addr;
     int error_code, is_dirty, prot, page_size, ret, is_write, is_user;
-    target_phys_addr_t paddr;
-    uint32_t page_offset;
+    unsigned long paddr, page_offset;
     target_ulong vaddr, virt_addr;
 
     is_user = mmu_idx == MMU_USER_IDX;
@@ -836,11 +834,12 @@
 
     if (env->cr[4] & CR4_PAE_MASK) {
         uint64_t pde, pdpe;
-        target_ulong pdpe_addr;
 
+        /* XXX: we only use 32 bit physical addresses */
 #ifdef TARGET_X86_64
         if (env->hflags & HF_LMA_MASK) {
-            uint64_t pml4e_addr, pml4e;
+            uint32_t pml4e_addr;
+            uint64_t pml4e;
             int32_t sext;
 
             /* test virtual address sign extension */
@@ -1102,19 +1101,17 @@
 
 target_phys_addr_t cpu_get_phys_page_debug(CPUState *env, target_ulong addr)
 {
-    target_ulong pde_addr, pte_addr;
-    uint64_t pte;
-    target_phys_addr_t paddr;
-    uint32_t page_offset;
-    int page_size;
+    uint32_t pde_addr, pte_addr;
+    uint32_t pde, pte, paddr, page_offset, page_size;
 
     if (env->cr[4] & CR4_PAE_MASK) {
-        target_ulong pdpe_addr;
-        uint64_t pde, pdpe;
+        uint32_t pdpe_addr, pde_addr, pte_addr;
+        uint32_t pdpe;
 
+        /* XXX: we only use 32 bit physical addresses */
 #ifdef TARGET_X86_64
         if (env->hflags & HF_LMA_MASK) {
-            uint64_t pml4e_addr, pml4e;
+            uint32_t pml4e_addr, pml4e;
             int32_t sext;
 
             /* test virtual address sign extension */
@@ -1124,13 +1121,13 @@
 
             pml4e_addr = ((env->cr[3] & ~0xfff) + (((addr >> 39) & 0x1ff) << 3)) &
                 env->a20_mask;
-            pml4e = ldq_phys(pml4e_addr);
+            pml4e = ldl_phys(pml4e_addr);
             if (!(pml4e & PG_PRESENT_MASK))
                 return -1;
 
             pdpe_addr = ((pml4e & ~0xfff) + (((addr >> 30) & 0x1ff) << 3)) &
                 env->a20_mask;
-            pdpe = ldq_phys(pdpe_addr);
+            pdpe = ldl_phys(pdpe_addr);
             if (!(pdpe & PG_PRESENT_MASK))
                 return -1;
         } else
@@ -1138,14 +1135,14 @@
         {
             pdpe_addr = ((env->cr[3] & ~0x1f) + ((addr >> 27) & 0x18)) &
                 env->a20_mask;
-            pdpe = ldq_phys(pdpe_addr);
+            pdpe = ldl_phys(pdpe_addr);
             if (!(pdpe & PG_PRESENT_MASK))
                 return -1;
         }
 
         pde_addr = ((pdpe & ~0xfff) + (((addr >> 21) & 0x1ff) << 3)) &
             env->a20_mask;
-        pde = ldq_phys(pde_addr);
+        pde = ldl_phys(pde_addr);
         if (!(pde & PG_PRESENT_MASK)) {
             return -1;
         }
@@ -1158,11 +1155,9 @@
             pte_addr = ((pde & ~0xfff) + (((addr >> 12) & 0x1ff) << 3)) &
                 env->a20_mask;
             page_size = 4096;
-            pte = ldq_phys(pte_addr);
+            pte = ldl_phys(pte_addr);
         }
     } else {
-        uint32_t pde;
-
         if (!(env->cr[0] & CR0_PG_MASK)) {
             pte = addr;
             page_size = 4096;
diff -urN 4242/vl.c qemu-omap/vl.c
--- 4242/vl.c	2008-04-24 21:26:21.000000000 +0100
+++ qemu-omap/vl.c	2008-04-23 09:57:57.000000000 +0100
@@ -5284,6 +5284,11 @@
         dev = usb_keyboard_init();
     } else if (strstart(devname, "disk:", &p)) {
         dev = usb_msd_init(p);
+    } else if (strstart(devname, "net:", &p)) {
+        unsigned int nr = strtoul(p, NULL, 0);
+        if (nr >= (unsigned int) nb_nics || strcmp(nd_table[nr].model, "usb"))
+            return -1;
+        dev = usb_net_init(&nd_table[nr]);
     } else if (!strcmp(devname, "wacom-tablet")) {
         dev = usb_wacom_init();
     } else if (strstart(devname, "serial:", &p)) {