diff --git a/hw/net/Makefile.objs b/hw/net/Makefile.objs
index 610ed3e..7cded99 100644
--- a/hw/net/Makefile.objs
+++ b/hw/net/Makefile.objs
@@ -27,6 +27,8 @@ common-obj-$(CONFIG_CADENCE) += cadence_gem.o
 common-obj-$(CONFIG_STELLARIS_ENET) += stellaris_enet.o
 common-obj-$(CONFIG_LANCE) += lance.o
 
+common-obj-$(CONFIG_SUNGEM) += sungem.o
+
 obj-$(CONFIG_ETRAXFS) += etraxfs_eth.o
 obj-$(CONFIG_COLDFIRE) += mcf_fec.o
 obj-$(CONFIG_MILKYMIST) += milkymist-minimac2.o
diff --git a/hw/net/sungem.c b/hw/net/sungem.c
new file mode 100644
index 0000000..2081bda
--- /dev/null
+++ b/hw/net/sungem.c
@@ -0,0 +1,1036 @@
+/*
+ * QEMU model of SUN GEM ethernet controller
+ *
+ * As found in Apple ASICs among others
+ *
+ * Copyright 2016 Ben Herrenschmidt
+ */
+#include "qemu/osdep.h"
+#include "hw/pci/pci.h"
+#include "qemu/log.h"
+#include "net/net.h"
+#include "net/checksum.h"
+#include "hw/net/mii.h"
+/* For crc32 */
+#include <zlib.h>
+
+#include "sungem.h"
+
+#define SUNGEM_DEBUG
+
+#ifdef SUNGEM_DEBUG
+enum {
+        DEBUG_ERR, DEBUG_GEN, DEBUG_MII, DEBUG_MMIO, DEBUG_INTERRUPT,
+        DEBUG_RX, DEBUG_TX,
+};
+#define DBGBIT(x)    (1<<DEBUG_##x)
+static int debugflags = DBGBIT(ERR);
+//static int debugflags = DBGBIT(ERR) | DBGBIT(INTERRUPT) | DBGBIT(RX) | DBGBIT(TX);
+
+#define DBGOUT(what, fmt, ...) do { \
+    if (debugflags & DBGBIT(what)) \
+        fprintf(stderr, "sungem: " fmt, ## __VA_ARGS__); \
+    } while (0)
+#else
+#define DBGOUT(what, fmt, ...) do {} while (0)
+#endif
+
+#define TYPE_SUNGEM "sungem"
+
+#define SUNGEM(obj) OBJECT_CHECK(SunGEMState, (obj), TYPE_SUNGEM)
+
+#define MAX_PACKET_SIZE 9016
+
+typedef struct {
+    PCIDevice pdev;
+    MemoryRegion mmio;
+    NICState *nic;
+    NICConf conf;
+    uint32_t nregsblocks;
+    uint32_t **regs;
+    uint32_t phy_addr;
+
+    /* Cache some useful things */
+    uint32_t rx_mask;
+    uint32_t tx_mask;
+
+    /* Current tx packet */
+    uint8_t tx_data[MAX_PACKET_SIZE];
+    uint32_t tx_size;
+    uint64_t tx_first_ctl;
+} SunGEMState;
+
+static const struct RegBlock {
+    uint32_t base;      /* Base offset */
+    uint32_t count;     /* Number of registers */
+} RegBlocks[] = {
+    { 0x0000, 0x0006 },      /* 0x0000..0x001c : GREG bank 0 */
+    { 0x1000, 0x0005 },      /* 0x1000..0x1010 : GREG bank 1 */
+    { 0x2000, 0x000e },      /* 0x2000..0x2034 : TX DMA bank 0 */
+    { 0x2100, 0x0007 },      /* 0x2100..0x2118 : TX DMA bank 1 */
+    { 0x3000, 0x0005 },      /* 0x3000..0x3010 : WakeOnLan */
+    { 0x4000, 0x000b },      /* 0x4000..0c4028 : RX DMA bank 0 */
+    { 0x4100, 0x0009 },      /* 0x4100..0x4120 : RX DMA bank 1 */
+    { 0x6000, 0x004e },      /* 0x6000..0x6134 : MAC */
+    { 0x6200, 0x0008 },      /* 0x6200..0x621c : MIF */
+    { 0x9000, 0x0007 },      /* 0x9000..0x9018 : PCS */
+    { 0x9050, 0x0004 },      /* 0x9050..0x905c : PCS */
+};
+
+/* Fast access, hopefully optimized out by the compiler */
+static uint32_t *sungem_get_reg(SunGEMState *s, uint32_t reg)
+{
+        uint32_t idx = (reg & 0xff) >> 2;
+        if (reg <= 0x1c)
+                return &s->regs[0][idx];
+        else if (reg >= 0x1000 && reg <= 0x1010)
+                return &s->regs[1][idx];
+        else if (reg >= 0x2000 && reg <= 0x2034)
+                return &s->regs[2][idx];
+        else if (reg >= 0x2100 && reg <= 0x2118)
+                return &s->regs[3][idx];
+        else if (reg >= 0x3000 && reg <= 0x3010)
+                return &s->regs[4][idx];
+        else if (reg >= 0x4000 && reg <= 0x4028)
+                return &s->regs[5][idx];
+        else if (reg >= 0x4100 && reg <= 0x4120)
+                return &s->regs[6][idx];
+        else if (reg >= 0x6000 && reg <= 0x6134)
+                return &s->regs[7][idx];
+        else if (reg >= 0x6200 && reg <= 0x621c)
+                return &s->regs[8][idx];
+        else if (reg >= 0x9000 && reg <= 0x9018)
+                return &s->regs[9][idx];
+        else if (reg >= 0x9050 && reg <= 0x905c)
+                return &s->regs[10][idx];
+        return NULL;
+}
+
+#define SET_REG(s, reg, val)                                    \
+    do {                                                        \
+        uint32_t *regp = sungem_get_reg(s, reg);                \
+        assert(regp);                                           \
+        *regp = val;                                            \
+    } while(0)
+
+#define GET_REG(s, reg)                                         \
+    ({                                                      \
+        uint32_t *regp = sungem_get_reg(s, reg);                \
+        assert(regp);                                           \
+        *regp;                                                  \
+    })
+
+static void sungem_eval_irq(SunGEMState *s)
+{
+    uint32_t stat, mask;
+
+    mask = GET_REG(s, GREG_IMASK);
+    stat = GET_REG(s, GREG_STAT) & ~GREG_STAT_TXNR;
+    if (stat & ~mask) {
+        pci_set_irq(PCI_DEVICE(s), 1);
+    } else {
+        pci_set_irq(PCI_DEVICE(s), 0);
+    }
+}
+
+static void sungem_update_status(SunGEMState *s, uint32_t bits, bool val)
+{
+    uint32_t stat;
+
+    stat = GET_REG(s, GREG_STAT);
+    if (val) {
+        stat |= bits;
+    } else {
+        stat &= ~bits;
+    }
+    SET_REG(s, GREG_STAT, stat);
+    sungem_eval_irq(s);
+}
+
+static void sungem_eval_cascade_irq(SunGEMState *s)
+{
+    uint32_t stat, mask;
+
+    mask = GET_REG(s, MAC_TXSTAT);
+    stat = GET_REG(s, MAC_TXMASK);
+    if (stat & ~mask) {
+        sungem_update_status(s, GREG_STAT_TXMAC, true);
+    } else {
+        sungem_update_status(s, GREG_STAT_TXMAC, false);
+    }
+
+    mask = GET_REG(s, MAC_RXSTAT);
+    stat = GET_REG(s, MAC_RXMASK);
+    if (stat & ~mask) {
+        sungem_update_status(s, GREG_STAT_RXMAC, true);
+    } else {
+        sungem_update_status(s, GREG_STAT_RXMAC, false);
+    }
+
+    mask = GET_REG(s, MAC_CSTAT);
+    stat = GET_REG(s, MAC_MCMASK) & ~MAC_CSTAT_PTR;
+    if (stat & ~mask) {
+        sungem_update_status(s, GREG_STAT_MAC, true);
+    } else {
+        sungem_update_status(s, GREG_STAT_MAC, false);
+    }
+}
+
+static void sungem_do_tx_csum(SunGEMState *s)
+{
+    uint16_t start, off;
+    uint32_t csum;
+
+    start = (s->tx_first_ctl & TXDCTRL_CSTART) >> 15;
+    off = (s->tx_first_ctl & TXDCTRL_COFF) >> 21;
+
+    DBGOUT(TX, "TX checksumming from byte %d, inserting at %d\n",
+           start, off);
+
+    if (start > (s->tx_size - 2) || off > (s->tx_size - 2)) {
+        DBGOUT(ERR, "TX checksum out of packet bounds\n");
+        return;
+    }
+
+    csum = net_raw_checksum(s->tx_data + start, s->tx_size - start);
+    stw_be_p(s->tx_data + off, csum);
+}
+
+static void sungem_send_packet(SunGEMState *s, const uint8_t *buf,
+                               int size)
+{
+    NetClientState *nc = qemu_get_queue(s->nic);
+
+    if (GET_REG(s, MAC_XIFCFG) & MAC_XIFCFG_LBCK) {
+        nc->info->receive(nc, buf, size);
+    } else {
+        qemu_send_packet(nc, buf, size);
+    }
+}
+
+static void sungem_process_tx_desc(SunGEMState *s, struct gem_txd *desc)
+{
+    PCIDevice *d = PCI_DEVICE(s);
+    uint32_t len;
+
+    /* If it's a start of frame, discard anything we had in the
+     * buffer and start again. This should be an error condition
+     * if we had something ... for now we ignore it
+     */
+    if (desc->control_word & TXDCTRL_SOF) {
+        if (s->tx_first_ctl) {
+            DBGOUT(ERR, "TX packet started without finishing"
+                   " the previous one !\n");
+        }
+        s->tx_size = 0;
+        s->tx_first_ctl = desc->control_word;
+    }
+
+    /* Grab data size */
+    len = desc->control_word & TXDCTRL_BUFSZ;
+
+    /* Clamp it to our max size */
+    if ((s->tx_size + len) > MAX_PACKET_SIZE) {
+        DBGOUT(ERR, "TX packet queue overflow !\n");
+        len = MAX_PACKET_SIZE - s->tx_size;
+    }
+
+    /* Read the data */
+    pci_dma_read(d, desc->buffer, &s->tx_data[s->tx_size], len);
+    s->tx_size += len;
+
+    /* If end of frame, send packet */
+    if (desc->control_word & TXDCTRL_EOF) {
+        DBGOUT(TX, "TX completing %d bytes packet\n", s->tx_size);
+
+        /* Handle csum */
+        if (s->tx_first_ctl & TXDCTRL_CENAB) {
+            sungem_do_tx_csum(s);
+        }
+
+        /* Send it */
+        sungem_send_packet(s, s->tx_data, s->tx_size);
+
+        /* No more pending packet */
+        s->tx_size = 0;
+        s->tx_first_ctl = 0;
+    }
+}
+
+static void sungem_tx_kick(SunGEMState *s)
+{
+    PCIDevice *d = PCI_DEVICE(s);
+    uint32_t comp, kick;
+    uint32_t txdma_cfg, txmac_cfg, ints;
+    uint64_t dbase;
+
+    DBGOUT(TX, "TX Kick !...\n");
+
+    /* Check that both TX MAC and TX DMA are enabled. We don't
+     * handle DMA-less direct FIFO operations (we don't emulate
+     * the FIFO at all).
+     *
+     * A write to TXDMA_KICK while DMA isn't enabled can happen
+     * when the driver is resetting the pointer.
+     */
+    txdma_cfg = GET_REG(s, TXDMA_CFG);
+    txmac_cfg = GET_REG(s, MAC_TXCFG);
+    if (!(txdma_cfg & TXDMA_CFG_ENABLE) ||
+        !(txmac_cfg & MAC_TXCFG_ENAB)) {
+        DBGOUT(TX, "TX not enabled !\n");
+        return;
+    }
+
+    /* XXX Test min frame size register ? */
+    /* XXX Test max frame size register ? */
+
+    dbase = GET_REG(s, TXDMA_DBHI);
+    dbase = (dbase << 32) | GET_REG(s, TXDMA_DBLOW);
+
+    comp = GET_REG(s, TXDMA_TXDONE) & s->tx_mask;
+    kick = GET_REG(s, TXDMA_KICK) & s->tx_mask;
+
+    DBGOUT(TX, "TX processing comp=%d, kick=%d out of %d\n",
+           comp, kick, s->tx_mask + 1);
+
+    /* This is rather primitive for now, we just send everything we
+     * can in one go, like e1000. Ideally we should do the sending
+     * from some kind of background task
+     */
+    while (comp != kick) {
+        struct gem_txd desc;
+
+        /* Read the next descriptor */
+        pci_dma_read(d, dbase + comp * sizeof(desc), &desc, sizeof(desc));
+
+        /* Byteswap descriptor */
+        desc.control_word = le64_to_cpu(desc.control_word);
+        desc.buffer = le64_to_cpu(desc.buffer);
+        DBGOUT(TX, "TX desc %d: %016llx %016llx\n", comp,
+               (unsigned long long)desc.control_word,
+               (unsigned long long)desc.buffer);
+
+        /* Send it for processing */
+        sungem_process_tx_desc(s, &desc);
+
+        /* Interrupt */
+        ints = GREG_STAT_TXDONE;
+        if (desc.control_word & TXDCTRL_INTME) {
+            ints |= GREG_STAT_TXINTME;
+        }
+        sungem_update_status(s, ints, true);
+
+        /* Next ! */
+        comp = (comp + 1) & s->tx_mask;
+        SET_REG(s, TXDMA_TXDONE, comp);
+    }
+
+    /* We sent everything, set status/irq bit */
+    sungem_update_status(s, GREG_STAT_TXALL, true);
+}
+
+static bool sungem_rx_full(SunGEMState *s, uint32_t kick, uint32_t done)
+{
+    return kick == ((done + 1) & s->rx_mask);
+}
+
+static int sungem_can_receive(NetClientState *nc)
+{
+    SunGEMState *s = qemu_get_nic_opaque(nc);
+    uint32_t kick, done, rxdma_cfg, rxmac_cfg;
+    bool full;
+
+    rxmac_cfg = GET_REG(s, MAC_RXCFG);
+    rxdma_cfg = GET_REG(s, RXDMA_CFG);
+
+    /* If MAC disabled, can't receive */
+    if ((rxmac_cfg & MAC_RXCFG_ENAB) == 0) {
+        DBGOUT(RX, "Check RX MAC disabled\n");
+        return 0;
+    }
+    if ((rxdma_cfg & RXDMA_CFG_ENABLE) == 0) {
+        DBGOUT(RX, "Check RX TXDMA disabled\n");
+        return 0;
+    }
+
+    /* Check RX availability */
+    kick = GET_REG(s, RXDMA_KICK);
+    done = GET_REG(s, RXDMA_DONE);
+    full = sungem_rx_full(s, kick, done);
+
+    DBGOUT(RX, "Check RX %d (kick=%d, done=%d)\n",
+           !full, kick, done);
+
+    return !full;
+}
+
+enum {
+        rx_no_match,
+        rx_match_promisc,
+        rx_match_bcast,
+        rx_match_allmcast,
+        rx_match_mcast,
+        rx_match_mac,
+        rx_match_altmac,
+};
+
+static int sungem_check_rx_mac(SunGEMState *s, const uint8_t *mac, uint32_t crc)
+{
+    uint32_t rxcfg = GET_REG(s, MAC_RXCFG);
+    uint32_t mac0, mac1, mac2;
+
+    /* Promisc enabled ? */
+    if (rxcfg & MAC_RXCFG_PROM) {
+        return rx_match_promisc;
+    }
+
+    /* Format MAC address into dwords */
+    mac0 = (mac[4] << 8) | mac[5];
+    mac1 = (mac[2] << 8) | mac[3];
+    mac2 = (mac[0] << 8) | mac[1];
+
+    DBGOUT(RX, "Word MAC: %04x %04x %04x\n", mac0, mac1, mac2);
+
+    /* Is this a broadcast frame ? */
+    if (mac0 == 0xffff && mac1 == 0xffff && mac2 == 0xffff) {
+        return rx_match_bcast;
+    }
+
+    /* TODO: Implement address filter registers (or we don't care ?) */
+
+    /* Is this a multicast frame ? */
+    if (mac[0] & 1) {
+        DBGOUT(RX, "Multicast !\n");
+
+        /* Promisc group enabled ? */
+        if (rxcfg & MAC_RXCFG_PGRP) {
+            return rx_match_allmcast;
+        }
+
+        /* TODO: Check MAC control frames (or we don't care) ? */
+
+        /* Check hash filter (somebody check that's correct ?) */
+        if (rxcfg & MAC_RXCFG_HFE) {
+            uint32_t hash, idx;
+
+            crc >>= 24;
+            idx = (crc >> 2) & 0x3c;
+            hash = GET_REG(s, MAC_HASH0 + idx);
+            if (hash & (1 << (15 - (crc & 0xf)))) {
+                return rx_match_mcast;
+            }
+        }
+        return rx_no_match;
+    }
+
+    /* Main MAC check */
+    DBGOUT(RX, "Compare MAC to %04x %04x %04x..\n",
+           GET_REG(s, MAC_ADDR0),
+           GET_REG(s, MAC_ADDR1),
+           GET_REG(s, MAC_ADDR2));
+    if (mac0 == GET_REG(s, MAC_ADDR0) &&
+        mac1 == GET_REG(s, MAC_ADDR1) &&
+        mac2 == GET_REG(s, MAC_ADDR2)) {
+        return rx_match_mac;
+    }
+
+    /* Alt MAC check */
+    if (mac0 == GET_REG(s, MAC_ADDR3) &&
+        mac1 == GET_REG(s, MAC_ADDR4) &&
+        mac2 == GET_REG(s, MAC_ADDR5)) {
+        return rx_match_altmac;
+    }
+
+    return rx_no_match;
+}
+
+static ssize_t sungem_receive(NetClientState *nc, const uint8_t *buf,
+                              size_t size)
+{
+    SunGEMState *s = qemu_get_nic_opaque(nc);
+    PCIDevice *d = PCI_DEVICE(s);
+    uint32_t mac_crc, done, kick, max_fsize;
+    uint32_t fcs_size, ints, rxdma_cfg, rxmac_cfg, csum, coff;
+    uint8_t smallbuf[60];
+    struct gem_rxd desc;
+    uint64_t dbase, baddr;
+    unsigned int rx_cond;
+
+    DBGOUT(RX, "RX got %ld bytes packet\n", size);
+
+    rxmac_cfg = GET_REG(s, MAC_RXCFG);
+    rxdma_cfg = GET_REG(s, RXDMA_CFG);
+    max_fsize = GET_REG(s, MAC_MAXFSZ) & 0x7fff;
+
+    /* If MAC or DMA disabled, can't receive */
+    if (!(rxdma_cfg & RXDMA_CFG_ENABLE) ||
+        !(rxmac_cfg & MAC_RXCFG_ENAB)) {
+        DBGOUT(RX, "RX not enabled !\n");
+        return 0;
+    }
+
+    /* Size adjustment for FCS */
+    if (rxmac_cfg & MAC_RXCFG_SFCS) {
+        fcs_size = 0;
+    } else {
+        fcs_size = 4;
+    }
+
+    /* Discard frame smaller than a MAC or larger than max frame size
+     * (when accounting for FCS)
+     */
+    if (size < 6 || (size + 4) > max_fsize) {
+        DBGOUT(ERR, "RX bad frame size %ld, dropped !\n", size);
+        /* XXX Increment error statistics ? */
+        return size;
+    }
+
+    /* We don't drop too small frames since we get them in qemu, we pad
+     * them instead. We should probably use the min frame size register
+     * but I don't want to use a variable size staging buffer and I
+     * know both MacOS and Linux use the default 64 anyway. We use 60
+     * here to account for the non-existent FCS.
+     */
+    if (size < 60) {
+        memcpy(smallbuf, buf, size);
+        memset(&smallbuf[size], 0, 60 - size);
+        buf = smallbuf;
+        size = 60;
+    }
+
+    /* Get MAC crc */
+    mac_crc = crc32(~0, buf, 6);
+
+    /* Packet isn't for me ? */
+    rx_cond = sungem_check_rx_mac(s, buf, mac_crc);
+    if (rx_cond == rx_no_match) {
+        /* Just drop it */
+        DBGOUT(RX, "No match, dropped !\n");
+        return size;
+    }
+
+    /* Get ring pointers */
+    kick = GET_REG(s, RXDMA_KICK) & s->rx_mask;
+    done = GET_REG(s, RXDMA_DONE) & s->rx_mask;
+
+    DBGOUT(RX, "RX processing done=%d, kick=%d out of %d\n",
+           done, kick, s->rx_mask + 1);
+
+    /* Ring full ? Can't receive */
+    if (sungem_rx_full(s, kick, done)) {
+        DBGOUT(RX, "RX ring full !\n");
+        return 0;
+    }
+
+    /* Note: The real GEM will fetch descriptors in blocks of 4,
+     * for now we handle them one at a time, I think the driver will
+     * cope
+     */
+
+    dbase = GET_REG(s, RXDMA_DBHI);
+    dbase = (dbase << 32) | GET_REG(s, RXDMA_DBLOW);
+
+    /* Read the next descriptor */
+    pci_dma_read(d, dbase + done * sizeof(desc), &desc, sizeof(desc));
+
+    DBGOUT(RX, "RX desc: %016llx %016llx\n",
+           (unsigned long long)le64_to_cpu(desc.status_word),
+           (unsigned long long)le64_to_cpu(desc.buffer));
+
+    /* Effective buffer address */
+    baddr = le64_to_cpu(desc.buffer) & ~7ull;
+    baddr |= (rxdma_cfg & RXDMA_CFG_FBOFF) >> 10;
+
+    /* Write buffer out */
+    pci_dma_write(d, baddr, buf, size);
+
+    if (fcs_size) {
+        /* Should we add an FCS ? Linux doesn't ask us to strip it,
+         * however I believe nothing checks it... For now we just
+         * do nothing. It's faster this way.
+         */
+    }
+
+    /* Calculate the checksum */
+    coff = (rxdma_cfg & RXDMA_CFG_CSUMOFF) >> 13;
+    csum = net_raw_checksum(buf + coff, size - coff);
+
+    /* Build the updated descriptor */
+    desc.status_word = (size + fcs_size) << 16;
+    desc.status_word |= ((uint64_t)(mac_crc >> 16)) << 44;
+    desc.status_word |= csum;
+    if (rx_cond == rx_match_mcast) {
+        desc.status_word |= RXDCTRL_HPASS;
+    }
+    if (rx_cond == rx_match_altmac) {
+        desc.status_word |= RXDCTRL_ALTMAC;
+    }
+    desc.status_word = cpu_to_le64(desc.status_word);
+
+    pci_dma_write(d, dbase + done * sizeof(desc), &desc, sizeof(desc));
+
+    done = (done + 1) & s->rx_mask;
+    SET_REG(s, RXDMA_DONE, done);
+
+    /* XXX Unconditionally set RX interrupt for now. The interrupt
+     * mitigation timer might well end up adding more overhead than
+     * helping here...
+     */
+    ints = GREG_STAT_RXDONE;
+    if (sungem_rx_full(s, kick, done)) {
+        ints |= GREG_STAT_RXNOBUF;
+    }
+    sungem_update_status(s, ints, true);
+
+    return size;
+}
+
+static void sungem_set_link_status(NetClientState *nc)
+{
+    /* We don't do anything for now as I believe none of the OSes
+     * drivers use the MIF autopoll feature nor the PHY interrupt
+     */
+}
+
+static void sungem_update_masks(SunGEMState *s)
+{
+    uint32_t sz;
+
+    sz = 1 << (((GET_REG(s, RXDMA_CFG) & RXDMA_CFG_RINGSZ) >> 1) + 5);
+    s->rx_mask = sz - 1;
+
+    sz = 1 << (((GET_REG(s, TXDMA_CFG) & TXDMA_CFG_RINGSZ) >> 1) + 5);
+    s->tx_mask = sz - 1;
+}
+
+static void sungem_reset_rx(SunGEMState *s)
+{
+    DBGOUT(GEN, "RX reset\n");
+
+    /* XXX Do RXCFG */
+    /* XXX Check value */
+    SET_REG(s, RXDMA_FSZ, 0x140);
+    SET_REG(s, RXDMA_DONE, 0);
+    SET_REG(s, RXDMA_KICK, 0);
+    SET_REG(s, RXDMA_CFG, 0x1000010);
+    SET_REG(s, RXDMA_PTHRESH, 0xf8);
+    SET_REG(s, RXDMA_BLANK, 0);
+
+    sungem_update_masks(s);
+}
+
+static void sungem_reset_tx(SunGEMState *s)
+{
+    DBGOUT(GEN, "TX reset\n");
+
+    /* XXX Do TXCFG */
+    /* XXX Check value */
+    SET_REG(s, TXDMA_FSZ, 0x90);
+    SET_REG(s, TXDMA_TXDONE, 0);
+    SET_REG(s, TXDMA_KICK, 0);
+    SET_REG(s, TXDMA_CFG, 0x118010);
+
+    sungem_update_masks(s);
+
+    s->tx_size = 0;
+    s->tx_first_ctl = 0;
+}
+
+static void sungem_reset_all(SunGEMState *s, bool pci_reset)
+{
+    DBGOUT(GEN, "Full reset (PCI:%d)\n", pci_reset);
+
+    sungem_reset_rx(s);
+    sungem_reset_tx(s);
+
+    SET_REG(s, GREG_IMASK, 0xFFFFFFF);
+    SET_REG(s, GREG_STAT, 0);
+    if (pci_reset) {
+        uint8_t *ma = s->conf.macaddr.a;
+
+        SET_REG(s, GREG_SWRST, 0);
+        SET_REG(s, MAC_ADDR0, (ma[4] << 8) | ma[5]);
+        SET_REG(s, MAC_ADDR1, (ma[2] << 8) | ma[3]);
+        SET_REG(s, MAC_ADDR2, (ma[0] << 8) | ma[1]);
+    } else {
+        SET_REG(s, GREG_SWRST, GET_REG(s, GREG_SWRST) & GREG_SWRST_RSTOUT);
+    }
+    SET_REG(s, MIF_CFG, MIF_CFG_MDI0);
+}
+
+static void sungem_mii_write(SunGEMState *s, uint8_t phy_addr,
+                             uint8_t reg_addr, uint16_t val)
+{
+    DBGOUT(MII, "MII write addr %x reg %02x val %04x\n",
+           phy_addr, reg_addr, val);
+
+    /* XXX TODO */
+}
+
+static uint16_t __sungem_mii_read(SunGEMState *s, uint8_t phy_addr,
+                                uint8_t reg_addr)
+{
+    if (phy_addr != s->phy_addr) {
+        return 0xffff;
+    }
+    /* Primitive emulation of a BCM5201 to please the driver,
+     * ID is 0x00406210. TODO: Do a gigabit PHY like BCM5400
+     */
+    switch(reg_addr) {
+    case MII_BMCR:
+        return 0;
+    case MII_PHYID1:
+        return 0x0040;
+    case MII_PHYID2:
+        return 0x6210;
+    case MII_BMSR:
+        if (qemu_get_queue(s->nic)->link_down) {
+            return MII_BMSR_100TX_FD  | MII_BMSR_AUTONEG;
+        } else {
+            return MII_BMSR_100TX_FD | MII_BMSR_AN_COMP |
+                    MII_BMSR_AUTONEG | MII_BMSR_LINK_ST;
+        }
+    case MII_ANLPAR:
+    case MII_ANAR:
+        return MII_ANLPAR_TXFD;
+    case 0x18: /* 5201 AUX status */
+        return 3; /* 100FD */
+    default:
+        return 0;
+    };
+}
+static uint16_t sungem_mii_read(SunGEMState *s, uint8_t phy_addr,
+                                uint8_t reg_addr)
+{
+    uint16_t val;
+
+    val = __sungem_mii_read(s, phy_addr, reg_addr);
+
+    DBGOUT(MII, "MII read addr %x reg %02x val %04x\n",
+           phy_addr, reg_addr, val);
+
+    return val;
+}
+
+static uint32_t sungem_mii_op(SunGEMState *s, uint32_t val)
+{
+    uint8_t phy_addr, reg_addr, op;
+
+    /* Ignore not start of frame */
+    if ((val >> 30) != 1) {
+        DBGOUT(ERR, "MII op, invalid SOF field %x\n", val >> 30);
+        return 0xffff;
+    }
+    phy_addr = (val & MIF_FRAME_PHYAD) >> 23;
+    reg_addr = (val & MIF_FRAME_REGAD) >> 18;
+    op = (val & MIF_FRAME_OP) >> 28;
+    switch (op) {
+    case 1:
+        sungem_mii_write(s, phy_addr, reg_addr, val & MIF_FRAME_DATA);
+        return val | MIF_FRAME_TALSB;
+    case 2:
+        return sungem_mii_read(s, phy_addr, reg_addr) | MIF_FRAME_TALSB;
+    default:
+        DBGOUT(ERR, "MII op, invalid op field %x\n", op);
+    }
+    return 0xffff | MIF_FRAME_TALSB;
+}
+
+static void sungem_mmio_write(void *opaque, hwaddr addr, uint64_t val,
+                              unsigned size)
+{
+    SunGEMState *s = opaque;
+    uint32_t *regp;
+
+    /* Drop writes to PROM image */
+    if (addr > PROM_START) {
+        return;
+    }
+
+    regp = sungem_get_reg(s, addr);
+    if (!regp) {
+        DBGOUT(ERR, "MMIO write to unknown register 0x%04x\n",
+               (unsigned int)addr);
+        return;
+    }
+
+    DBGOUT(MMIO, "MMIO write to %04x val=%08x\n",
+           (uint32_t)addr, (uint32_t)val);
+
+    /* Pre-write filter */
+    switch(addr) {
+    /* Read only registers */
+    case GREG_SEBSTATE:
+    case GREG_STAT:
+    case GREG_STAT2:
+    case GREG_PCIESTAT:
+    case TXDMA_TXDONE:
+    case TXDMA_PCNT:
+    case TXDMA_SMACHINE:
+    case TXDMA_DPLOW:
+    case TXDMA_DPHI:
+    case TXDMA_FSZ:
+    case TXDMA_FTAG:
+    case RXDMA_DONE:
+    case RXDMA_PCNT:
+    case RXDMA_SMACHINE:
+    case RXDMA_DPLOW:
+    case RXDMA_DPHI:
+    case RXDMA_FSZ:
+    case RXDMA_FTAG:
+    case MAC_TXRST: /* Not technically read-only but will do for now */
+    case MAC_RXRST: /* Not technically read-only but will do for now */
+    case MAC_TXSTAT:
+    case MAC_RXSTAT:
+    case MAC_CSTAT:
+    case MAC_PATMPS:
+    case MAC_SMACHINE:
+    case MIF_STATUS:
+    case MIF_SMACHINE:
+    case PCS_MIISTAT:
+    case PCS_ISTAT:
+    case PCS_SSTATE:
+        return; /* No actual write */
+    case GREG_IACK:
+        val &= GREG_STAT_LATCH;
+        SET_REG(s, GREG_STAT, GET_REG(s, GREG_STAT) & ~val);
+        sungem_eval_irq(s);
+        return; /* No actual write */
+    case GREG_PCIEMASK:
+        val &= 0x7;
+        break;
+    case MIF_CFG:
+        /* Maintain the RO MDI bits to advertize an MDIO PHY on MDI0 */
+        val &= ~MIF_CFG_MDI1;
+        val |= MIF_CFG_MDI0;
+        break;
+    case MAC_MINFSZ:
+        /* 10-bits implemented */
+        val &= 0x3ff;
+        break;
+    }
+
+    *regp = val;
+
+    /* Post write action */
+    switch(addr) {
+    case GREG_IMASK:
+        /* Re-evaluate interrupt */
+        sungem_eval_irq(s);
+        break;
+    case MAC_TXMASK:
+    case MAC_RXMASK:
+    case MAC_MCMASK:
+        sungem_eval_cascade_irq(s);
+        break;
+    case GREG_SWRST:
+        switch(val & (GREG_SWRST_TXRST | GREG_SWRST_RXRST)) {
+        case GREG_SWRST_RXRST:
+            sungem_reset_rx(s);
+            break;
+        case GREG_SWRST_TXRST:
+            sungem_reset_tx(s);
+            break;
+        case GREG_SWRST_RXRST | GREG_SWRST_TXRST:
+            sungem_reset_all(s, false);
+        }
+        break;
+    case TXDMA_KICK:
+        sungem_tx_kick(s);
+        break;
+    case MIF_FRAME:
+        *regp = sungem_mii_op(s, val);
+        break;
+    case RXDMA_KICK:
+            DBGOUT(TX, "RXDMA_KICK written to %d\n", (int)val);
+         /* Through */
+    case MAC_RXCFG:
+    case RXDMA_CFG:
+        sungem_update_masks(s);
+        if ((GET_REG(s, MAC_RXCFG) & MAC_RXCFG_ENAB) != 0 &&
+            (GET_REG(s, RXDMA_CFG) & RXDMA_CFG_ENABLE) != 0) {
+            qemu_flush_queued_packets(qemu_get_queue(s->nic));
+        }
+        break;
+    case TXDMA_CFG:
+        sungem_update_masks(s);
+    }
+}
+
+static uint64_t sungem_mmio_read(void *opaque, hwaddr addr, unsigned size)
+{
+    SunGEMState *s = opaque;
+    uint32_t val, *regp;
+
+    /* No PROM image to read for now... */
+    if (addr > PROM_START) {
+        return 0xffffffff;
+    }
+
+    regp = sungem_get_reg(s, addr);
+    if (!regp) {
+        qemu_log_mask(LOG_GUEST_ERROR,"%s: read from unknown register 0x%04x\n",
+                      __func__, (unsigned int)addr);
+        return 0;
+    }
+    val = *regp;
+
+    DBGOUT(MMIO, "MMIO read from %04x val=%08x\n", (uint32_t)addr, val);
+
+    switch(addr) {
+    case GREG_STAT:
+        /* Side effect, clear bottom 7 bits */
+        *regp = val & ~GREG_STAT_LATCH;
+        sungem_eval_irq(s);
+
+        /* Inject TX completion in returned value */
+        val = (val & ~GREG_STAT_TXNR) |
+                (GET_REG(s, TXDMA_TXDONE) << GREG_STAT_TXNR_SHIFT);
+        break;
+    case GREG_STAT2:
+        /* Return the status reg without side effect
+         * (and inject TX completion in returned value)
+         */
+        return (GET_REG(s, GREG_STAT) & ~GREG_STAT_TXNR) |
+                (GET_REG(s, TXDMA_TXDONE) << GREG_STAT_TXNR_SHIFT);
+    case MAC_TXSTAT:
+        *regp = 0; /* Side effect, clear all */
+        sungem_update_status(s, GREG_STAT_TXMAC, false);
+        break;
+    case MAC_RXSTAT:
+        *regp = 0; /* Side effect, clear all */
+        sungem_update_status(s, GREG_STAT_RXMAC, false);
+        break;
+    case MAC_CSTAT:
+        *regp &= MAC_CSTAT_PTR; /* Side effect, interrupt bits */
+        sungem_update_status(s, GREG_STAT_MAC, false);
+        break;
+    }
+
+    return val;
+}
+
+static void sungem_init_regs(SunGEMState *s)
+{
+    uint32_t i;
+
+    s->nregsblocks = ARRAY_SIZE(RegBlocks);
+    s->regs = g_malloc0(sizeof(uint32_t *) * s->nregsblocks);
+    for (i = 0; i < s->nregsblocks; i++) {
+        s->regs[i] = g_malloc0(sizeof(uint32_t) * RegBlocks[i].count);
+    }
+    sungem_reset_all(s, true);
+}
+
+/* PCI interface */
+
+static const MemoryRegionOps sungem_mmio_ops = {
+    .read = sungem_mmio_read,
+    .write = sungem_mmio_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .impl = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    },
+};
+
+static void sungem_uninit(PCIDevice *dev)
+{
+    SunGEMState *s = SUNGEM(dev);
+
+    qemu_del_nic(s->nic);
+}
+
+static NetClientInfo net_sungem_info = {
+    .type = NET_CLIENT_DRIVER_NIC,
+    .size = sizeof(NICState),
+    .can_receive = sungem_can_receive,
+    .receive = sungem_receive,
+    .link_status_changed = sungem_set_link_status,
+};
+
+static void sungem_realize(PCIDevice *pci_dev, Error **errp)
+{
+    DeviceState *dev = DEVICE(pci_dev);
+    SunGEMState *s = SUNGEM(pci_dev);
+    uint8_t *pci_conf;
+
+    pci_conf = pci_dev->config;
+
+    pci_set_word(pci_conf + PCI_STATUS,
+                 PCI_STATUS_FAST_BACK |
+                 PCI_STATUS_DEVSEL_MEDIUM |
+                 PCI_STATUS_66MHZ);
+
+    pci_set_word(pci_conf + PCI_SUBSYSTEM_VENDOR_ID, 0x0);
+    pci_set_word(pci_conf + PCI_SUBSYSTEM_ID, 0x0);
+
+    pci_conf[PCI_INTERRUPT_PIN] = 1; /* interrupt pin A */
+    pci_conf[PCI_MIN_GNT] = 0x40;
+    pci_conf[PCI_MAX_LAT] = 0x40;
+
+    sungem_init_regs(s);
+    memory_region_init_io(&s->mmio, OBJECT(s), &sungem_mmio_ops, s,
+                          "sungem-mmio", SUNGEM_MMIO_SIZE);
+    pci_register_bar(pci_dev, 0, 0, &s->mmio);
+
+    qemu_macaddr_default_if_unset(&s->conf.macaddr);
+    s->nic = qemu_new_nic(&net_sungem_info, &s->conf,
+                          object_get_typename(OBJECT(dev)),
+                          dev->id, s);
+    qemu_format_nic_info_str(qemu_get_queue(s->nic),
+                             s->conf.macaddr.a);
+}
+
+static void sungem_reset(DeviceState *dev)
+{
+    SunGEMState *s = SUNGEM(dev);
+
+    sungem_reset_all(s, true);
+}
+
+static void sungem_instance_init(Object *obj)
+{
+    /* XXX bootindex stuff */
+}
+
+static Property sungem_properties[] = {
+    DEFINE_NIC_PROPERTIES(SunGEMState, conf),
+    /* Phy address should be 0 for most Apple machines except
+     * for K2 in which case it's 1. Will be set by a machine
+     * override.
+     */
+    DEFINE_PROP_UINT32("phy_addr", SunGEMState, phy_addr, 0),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void sungem_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+
+    k->realize = sungem_realize;
+    k->exit = sungem_uninit;
+    k->vendor_id = PCI_VENDOR_ID_APPLE;
+    k->device_id = PCI_DEVICE_ID_APPLE_UNI_N_GMAC;
+    k->revision = 0x01;
+    k->class_id = PCI_CLASS_NETWORK_ETHERNET;
+    dc->reset = sungem_reset;
+    dc->props = sungem_properties;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
+}
+
+static const TypeInfo sungem_info = {
+    .name          = TYPE_SUNGEM,
+    .parent        = TYPE_PCI_DEVICE,
+    .instance_size = sizeof(SunGEMState),
+    .class_init    = sungem_class_init,
+    .instance_init = sungem_instance_init,
+};
+
+static void sungem_register_types(void)
+{
+    type_register_static(&sungem_info);
+}
+
+type_init(sungem_register_types)
diff --git a/hw/net/sungem.h b/hw/net/sungem.h
new file mode 100644
index 0000000..0421a4a
--- /dev/null
+++ b/hw/net/sungem.h
@@ -0,0 +1,885 @@
+/*
+ * sungem.h: Definitions for Sun GEM ethernet model
+ *
+ * Taken from Linux sungem driver
+ *
+ * Copyright (C) 2000 David S. Miller (davem@redhat.com)
+ */
+
+#ifndef _SUNGEM_H
+#define _SUNGEM_H
+
+/* Total MMIO size */
+#define SUNGEM_MMIO_SIZE        0x200000
+
+/* Global Registers */
+#define GREG_SEBSTATE	0x0000UL	/* SEB State Register		*/
+#define GREG_CFG	0x0004UL	/* Configuration Register	*/
+#define GREG_STAT	0x000CUL	/* Status Register		*/
+#define GREG_IMASK	0x0010UL	/* Interrupt Mask Register	*/
+#define GREG_IACK	0x0014UL	/* Interrupt ACK Register	*/
+#define GREG_STAT2	0x001CUL	/* Alias of GREG_STAT		*/
+#define GREG_PCIESTAT	0x1000UL	/* PCI Error Status Register	*/
+#define GREG_PCIEMASK	0x1004UL	/* PCI Error Mask Register	*/
+#define GREG_BIFCFG	0x1008UL	/* BIF Configuration Register	*/
+#define GREG_BIFDIAG	0x100CUL	/* BIF Diagnostics Register	*/
+#define GREG_SWRST	0x1010UL	/* Software Reset Register	*/
+
+/* Global SEB State Register */
+#define GREG_SEBSTATE_ARB	0x00000003	/* State of Arbiter		*/
+#define GREG_SEBSTATE_RXWON	0x00000004	/* RX won internal arbitration	*/
+
+/* Global Configuration Register */
+#define GREG_CFG_IBURST		0x00000001	/* Infinite Burst		*/
+#define GREG_CFG_TXDMALIM	0x0000003e	/* TX DMA grant limit		*/
+#define GREG_CFG_RXDMALIM	0x000007c0	/* RX DMA grant limit		*/
+#define GREG_CFG_RONPAULBIT	0x00000800	/* Use mem read multiple for PCI read
+						 * after infinite burst (Apple) */
+#define GREG_CFG_ENBUG2FIX	0x00001000	/* Fix Rx hang after overflow */
+
+/* Global Interrupt Status Register.
+ *
+ * Reading this register automatically clears bits 0 through 6.
+ * This auto-clearing does not occur when the alias at GREG_STAT2
+ * is read instead.  The rest of the interrupt bits only clear when
+ * the secondary interrupt status register corresponding to that
+ * bit is read (ie. if GREG_STAT_PCS is set, it will be cleared by
+ * reading PCS_ISTAT).
+ */
+#define GREG_STAT_TXINTME	0x00000001	/* TX INTME frame transferred	*/
+#define GREG_STAT_TXALL		0x00000002	/* All TX frames transferred	*/
+#define GREG_STAT_TXDONE	0x00000004	/* One TX frame transferred	*/
+#define GREG_STAT_RXDONE	0x00000010	/* One RX frame arrived		*/
+#define GREG_STAT_RXNOBUF	0x00000020	/* No free RX buffers available	*/
+#define GREG_STAT_RXTAGERR	0x00000040	/* RX tag framing is corrupt	*/
+#define GREG_STAT_PCS		0x00002000	/* PCS signalled interrupt	*/
+#define GREG_STAT_TXMAC		0x00004000	/* TX MAC signalled interrupt	*/
+#define GREG_STAT_RXMAC		0x00008000	/* RX MAC signalled interrupt	*/
+#define GREG_STAT_MAC		0x00010000	/* MAC Control signalled irq	*/
+#define GREG_STAT_MIF		0x00020000	/* MIF signalled interrupt	*/
+#define GREG_STAT_PCIERR	0x00040000	/* PCI Error interrupt		*/
+#define GREG_STAT_TXNR		0xfff80000	/* == TXDMA_TXDONE reg val	*/
+#define GREG_STAT_TXNR_SHIFT	19
+
+/* These interrupts are edge latches in the status register,
+ * reading it (or writing the corresponding bit in IACK) will
+ * clear them
+ */
+#define GREG_STAT_LATCH	       (GREG_STAT_TXALL  | GREG_STAT_TXINTME | \
+                                GREG_STAT_RXDONE | GREG_STAT_RXDONE |  \
+                                GREG_STAT_RXNOBUF | GREG_STAT_RXTAGERR)
+
+/* The layout of GREG_IMASK and GREG_IACK is identical to GREG_STAT.
+ * Bits set in GREG_IMASK will prevent that interrupt type from being
+ * signalled to the cpu.  GREG_IACK can be used to clear specific top-level
+ * interrupt conditions in GREG_STAT, ie. it only works for bits 0 through 6.
+ * Setting the bit will clear that interrupt, clear bits will have no effect
+ * on GREG_STAT.
+ */
+
+/* Global PCI Error Status Register */
+#define GREG_PCIESTAT_BADACK	0x00000001	/* No ACK64# during ABS64 cycle	*/
+#define GREG_PCIESTAT_DTRTO	0x00000002	/* Delayed transaction timeout	*/
+#define GREG_PCIESTAT_OTHER	0x00000004	/* Other PCI error, check cfg space */
+
+/* The layout of the GREG_PCIEMASK is identical to that of GREG_PCIESTAT.
+ * Bits set in GREG_PCIEMASK will prevent that interrupt type from being
+ * signalled to the cpu.
+ */
+
+/* Global BIF Configuration Register */
+#define GREG_BIFCFG_SLOWCLK	0x00000001	/* Set if PCI runs < 25Mhz	*/
+#define GREG_BIFCFG_B64DIS	0x00000002	/* Disable 64bit wide data cycle*/
+#define GREG_BIFCFG_M66EN	0x00000004	/* Set if on 66Mhz PCI segment	*/
+
+/* Global BIF Diagnostics Register */
+#define GREG_BIFDIAG_BURSTSM	0x007f0000	/* PCI Burst state machine	*/
+#define GREG_BIFDIAG_BIFSM	0xff000000	/* BIF state machine		*/
+
+/* Global Software Reset Register.
+ *
+ * This register is used to perform a global reset of the RX and TX portions
+ * of the GEM asic.  Setting the RX or TX reset bit will start the reset.
+ * The driver _MUST_ poll these bits until they clear.  One may not attempt
+ * to program any other part of GEM until the bits clear.
+ */
+#define GREG_SWRST_TXRST	0x00000001	/* TX Software Reset		*/
+#define GREG_SWRST_RXRST	0x00000002	/* RX Software Reset		*/
+#define GREG_SWRST_RSTOUT	0x00000004	/* Force RST# pin active	*/
+#define GREG_SWRST_CACHESIZE	0x00ff0000	/* RIO only: cache line size	*/
+#define GREG_SWRST_CACHE_SHIFT	16
+
+/* TX DMA Registers */
+#define TXDMA_KICK	0x2000UL	/* TX Kick Register		*/
+#define TXDMA_CFG	0x2004UL	/* TX Configuration Register	*/
+#define TXDMA_DBLOW	0x2008UL	/* TX Desc. Base Low		*/
+#define TXDMA_DBHI	0x200CUL	/* TX Desc. Base High		*/
+#define TXDMA_FWPTR	0x2014UL	/* TX FIFO Write Pointer	*/
+#define TXDMA_FSWPTR	0x2018UL	/* TX FIFO Shadow Write Pointer	*/
+#define TXDMA_FRPTR	0x201CUL	/* TX FIFO Read Pointer		*/
+#define TXDMA_FSRPTR	0x2020UL	/* TX FIFO Shadow Read Pointer	*/
+#define TXDMA_PCNT	0x2024UL	/* TX FIFO Packet Counter	*/
+#define TXDMA_SMACHINE	0x2028UL	/* TX State Machine Register	*/
+#define TXDMA_DPLOW	0x2030UL	/* TX Data Pointer Low		*/
+#define TXDMA_DPHI	0x2034UL	/* TX Data Pointer High		*/
+#define TXDMA_TXDONE	0x2100UL	/* TX Completion Register	*/
+#define TXDMA_FADDR	0x2104UL	/* TX FIFO Address		*/
+#define TXDMA_FTAG	0x2108UL	/* TX FIFO Tag			*/
+#define TXDMA_DLOW	0x210CUL	/* TX FIFO Data Low		*/
+#define TXDMA_DHIT1	0x2110UL	/* TX FIFO Data HighT1		*/
+#define TXDMA_DHIT0	0x2114UL	/* TX FIFO Data HighT0		*/
+#define TXDMA_FSZ	0x2118UL	/* TX FIFO Size			*/
+
+/* TX Kick Register.
+ *
+ * This 13-bit register is programmed by the driver to hold the descriptor
+ * entry index which follows the last valid transmit descriptor.
+ */
+
+/* TX Completion Register.
+ *
+ * This 13-bit register is updated by GEM to hold to descriptor entry index
+ * which follows the last descriptor already processed by GEM.  Note that
+ * this value is mirrored in GREG_STAT which eliminates the need to even
+ * access this register in the driver during interrupt processing.
+ */
+
+/* TX Configuration Register.
+ *
+ * Note that TXDMA_CFG_FTHRESH, the TX FIFO Threshold, is an obsolete feature
+ * that was meant to be used with jumbo packets.  It should be set to the
+ * maximum value of 0x4ff, else one risks getting TX MAC Underrun errors.
+ */
+#define TXDMA_CFG_ENABLE	0x00000001	/* Enable TX DMA channel	*/
+#define TXDMA_CFG_RINGSZ	0x0000001e	/* TX descriptor ring size	*/
+#define TXDMA_CFG_RINGSZ_32	0x00000000	/* 32 TX descriptors		*/
+#define TXDMA_CFG_RINGSZ_64	0x00000002	/* 64 TX descriptors		*/
+#define TXDMA_CFG_RINGSZ_128	0x00000004	/* 128 TX descriptors		*/
+#define TXDMA_CFG_RINGSZ_256	0x00000006	/* 256 TX descriptors		*/
+#define TXDMA_CFG_RINGSZ_512	0x00000008	/* 512 TX descriptors		*/
+#define TXDMA_CFG_RINGSZ_1K	0x0000000a	/* 1024 TX descriptors		*/
+#define TXDMA_CFG_RINGSZ_2K	0x0000000c	/* 2048 TX descriptors		*/
+#define TXDMA_CFG_RINGSZ_4K	0x0000000e	/* 4096 TX descriptors		*/
+#define TXDMA_CFG_RINGSZ_8K	0x00000010	/* 8192 TX descriptors		*/
+#define TXDMA_CFG_PIOSEL	0x00000020	/* Enable TX FIFO PIO from cpu	*/
+#define TXDMA_CFG_FTHRESH	0x001ffc00	/* TX FIFO Threshold, obsolete	*/
+#define TXDMA_CFG_PMODE		0x00200000	/* TXALL irq means TX FIFO empty*/
+
+/* TX Descriptor Base Low/High.
+ *
+ * These two registers store the 53 most significant bits of the base address
+ * of the TX descriptor table.  The 11 least significant bits are always
+ * zero.  As a result, the TX descriptor table must be 2K aligned.
+ */
+
+/* The rest of the TXDMA_* registers are for diagnostics and debug, I will document
+ * them later. -DaveM
+ */
+
+/* WakeOnLan Registers	*/
+#define WOL_MATCH0	0x3000UL
+#define WOL_MATCH1	0x3004UL
+#define WOL_MATCH2	0x3008UL
+#define WOL_MCOUNT	0x300CUL
+#define WOL_WAKECSR	0x3010UL
+
+/* WOL Match count register
+ */
+#define WOL_MCOUNT_N		0x00000010
+#define WOL_MCOUNT_M		0x00000000 /* 0 << 8 */
+
+#define WOL_WAKECSR_ENABLE	0x00000001
+#define WOL_WAKECSR_MII		0x00000002
+#define WOL_WAKECSR_SEEN	0x00000004
+#define WOL_WAKECSR_FILT_UCAST	0x00000008
+#define WOL_WAKECSR_FILT_MCAST	0x00000010
+#define WOL_WAKECSR_FILT_BCAST	0x00000020
+#define WOL_WAKECSR_FILT_SEEN	0x00000040
+
+
+/* Receive DMA Registers */
+#define RXDMA_CFG	0x4000UL	/* RX Configuration Register	*/
+#define RXDMA_DBLOW	0x4004UL	/* RX Descriptor Base Low	*/
+#define RXDMA_DBHI	0x4008UL	/* RX Descriptor Base High	*/
+#define RXDMA_FWPTR	0x400CUL	/* RX FIFO Write Pointer	*/
+#define RXDMA_FSWPTR	0x4010UL	/* RX FIFO Shadow Write Pointer	*/
+#define RXDMA_FRPTR	0x4014UL	/* RX FIFO Read Pointer		*/
+#define RXDMA_PCNT	0x4018UL	/* RX FIFO Packet Counter	*/
+#define RXDMA_SMACHINE	0x401CUL	/* RX State Machine Register	*/
+#define RXDMA_PTHRESH	0x4020UL	/* Pause Thresholds		*/
+#define RXDMA_DPLOW	0x4024UL	/* RX Data Pointer Low		*/
+#define RXDMA_DPHI	0x4028UL	/* RX Data Pointer High		*/
+#define RXDMA_KICK	0x4100UL	/* RX Kick Register		*/
+#define RXDMA_DONE	0x4104UL	/* RX Completion Register	*/
+#define RXDMA_BLANK	0x4108UL	/* RX Blanking Register		*/
+#define RXDMA_FADDR	0x410CUL	/* RX FIFO Address		*/
+#define RXDMA_FTAG	0x4110UL	/* RX FIFO Tag			*/
+#define RXDMA_DLOW	0x4114UL	/* RX FIFO Data Low		*/
+#define RXDMA_DHIT1	0x4118UL	/* RX FIFO Data HighT0		*/
+#define RXDMA_DHIT0	0x411CUL	/* RX FIFO Data HighT1		*/
+#define RXDMA_FSZ	0x4120UL	/* RX FIFO Size			*/
+
+/* RX Configuration Register. */
+#define RXDMA_CFG_ENABLE	0x00000001	/* Enable RX DMA channel	*/
+#define RXDMA_CFG_RINGSZ	0x0000001e	/* RX descriptor ring size	*/
+#define RXDMA_CFG_RINGSZ_32	0x00000000	/* - 32   entries		*/
+#define RXDMA_CFG_RINGSZ_64	0x00000002	/* - 64   entries		*/
+#define RXDMA_CFG_RINGSZ_128	0x00000004	/* - 128  entries		*/
+#define RXDMA_CFG_RINGSZ_256	0x00000006	/* - 256  entries		*/
+#define RXDMA_CFG_RINGSZ_512	0x00000008	/* - 512  entries		*/
+#define RXDMA_CFG_RINGSZ_1K	0x0000000a	/* - 1024 entries		*/
+#define RXDMA_CFG_RINGSZ_2K	0x0000000c	/* - 2048 entries		*/
+#define RXDMA_CFG_RINGSZ_4K	0x0000000e	/* - 4096 entries		*/
+#define RXDMA_CFG_RINGSZ_8K	0x00000010	/* - 8192 entries		*/
+#define RXDMA_CFG_RINGSZ_BDISAB	0x00000020	/* Disable RX desc batching	*/
+#define RXDMA_CFG_FBOFF		0x00001c00	/* Offset of first data byte	*/
+#define RXDMA_CFG_CSUMOFF	0x000fe000	/* Skip bytes before csum calc	*/
+#define RXDMA_CFG_FTHRESH	0x07000000	/* RX FIFO dma start threshold	*/
+#define RXDMA_CFG_FTHRESH_64	0x00000000	/* - 64   bytes			*/
+#define RXDMA_CFG_FTHRESH_128	0x01000000	/* - 128  bytes			*/
+#define RXDMA_CFG_FTHRESH_256	0x02000000	/* - 256  bytes			*/
+#define RXDMA_CFG_FTHRESH_512	0x03000000	/* - 512  bytes			*/
+#define RXDMA_CFG_FTHRESH_1K	0x04000000	/* - 1024 bytes			*/
+#define RXDMA_CFG_FTHRESH_2K	0x05000000	/* - 2048 bytes			*/
+
+/* RX Descriptor Base Low/High.
+ *
+ * These two registers store the 53 most significant bits of the base address
+ * of the RX descriptor table.  The 11 least significant bits are always
+ * zero.  As a result, the RX descriptor table must be 2K aligned.
+ */
+
+/* RX PAUSE Thresholds.
+ *
+ * These values determine when XOFF and XON PAUSE frames are emitted by
+ * GEM.  The thresholds measure RX FIFO occupancy in units of 64 bytes.
+ */
+#define RXDMA_PTHRESH_OFF	0x000001ff	/* XOFF emitted w/FIFO > this	*/
+#define RXDMA_PTHRESH_ON	0x001ff000	/* XON emitted w/FIFO < this	*/
+
+/* RX Kick Register.
+ *
+ * This 13-bit register is written by the host CPU and holds the last
+ * valid RX descriptor number plus one.  This is, if 'N' is written to
+ * this register, it means that all RX descriptors up to but excluding
+ * 'N' are valid.
+ *
+ * The hardware requires that RX descriptors are posted in increments
+ * of 4.  This means 'N' must be a multiple of four.  For the best
+ * performance, the first new descriptor being posted should be (PCI)
+ * cache line aligned.
+ */
+
+/* RX Completion Register.
+ *
+ * This 13-bit register is updated by GEM to indicate which RX descriptors
+ * have already been used for receive frames.  All descriptors up to but
+ * excluding the value in this register are ready to be processed.  GEM
+ * updates this register value after the RX FIFO empties completely into
+ * the RX descriptor's buffer, but before the RX_DONE bit is set in the
+ * interrupt status register.
+ */
+
+/* RX Blanking Register. */
+#define RXDMA_BLANK_IPKTS	0x000001ff	/* RX_DONE asserted after this
+						 * many packets received since
+						 * previous RX_DONE.
+						 */
+#define RXDMA_BLANK_ITIME	0x000ff000	/* RX_DONE asserted after this
+						 * many clocks (measured in 2048
+						 * PCI clocks) were counted since
+						 * the previous RX_DONE.
+						 */
+
+/* RX FIFO Size.
+ *
+ * This 11-bit read-only register indicates how large, in units of 64-bytes,
+ * the RX FIFO is.  The driver uses this to properly configure the RX PAUSE
+ * thresholds.
+ */
+
+/* The rest of the RXDMA_* registers are for diagnostics and debug, I will document
+ * them later. -DaveM
+ */
+
+/* MAC Registers */
+#define MAC_TXRST	0x6000UL	/* TX MAC Software Reset Command*/
+#define MAC_RXRST	0x6004UL	/* RX MAC Software Reset Command*/
+#define MAC_SNDPAUSE	0x6008UL	/* Send Pause Command Register	*/
+#define MAC_TXSTAT	0x6010UL	/* TX MAC Status Register	*/
+#define MAC_RXSTAT	0x6014UL	/* RX MAC Status Register	*/
+#define MAC_CSTAT	0x6018UL	/* MAC Control Status Register	*/
+#define MAC_TXMASK	0x6020UL	/* TX MAC Mask Register		*/
+#define MAC_RXMASK	0x6024UL	/* RX MAC Mask Register		*/
+#define MAC_MCMASK	0x6028UL	/* MAC Control Mask Register	*/
+#define MAC_TXCFG	0x6030UL	/* TX MAC Configuration Register*/
+#define MAC_RXCFG	0x6034UL	/* RX MAC Configuration Register*/
+#define MAC_MCCFG	0x6038UL	/* MAC Control Config Register	*/
+#define MAC_XIFCFG	0x603CUL	/* XIF Configuration Register	*/
+#define MAC_IPG0	0x6040UL	/* InterPacketGap0 Register	*/
+#define MAC_IPG1	0x6044UL	/* InterPacketGap1 Register	*/
+#define MAC_IPG2	0x6048UL	/* InterPacketGap2 Register	*/
+#define MAC_STIME	0x604CUL	/* SlotTime Register		*/
+#define MAC_MINFSZ	0x6050UL	/* MinFrameSize Register	*/
+#define MAC_MAXFSZ	0x6054UL	/* MaxFrameSize Register	*/
+#define MAC_PASIZE	0x6058UL	/* PA Size Register		*/
+#define MAC_JAMSIZE	0x605CUL	/* JamSize Register		*/
+#define MAC_ATTLIM	0x6060UL	/* Attempt Limit Register	*/
+#define MAC_MCTYPE	0x6064UL	/* MAC Control Type Register	*/
+#define MAC_ADDR0	0x6080UL	/* MAC Address 0 Register	*/
+#define MAC_ADDR1	0x6084UL	/* MAC Address 1 Register	*/
+#define MAC_ADDR2	0x6088UL	/* MAC Address 2 Register	*/
+#define MAC_ADDR3	0x608CUL	/* MAC Address 3 Register	*/
+#define MAC_ADDR4	0x6090UL	/* MAC Address 4 Register	*/
+#define MAC_ADDR5	0x6094UL	/* MAC Address 5 Register	*/
+#define MAC_ADDR6	0x6098UL	/* MAC Address 6 Register	*/
+#define MAC_ADDR7	0x609CUL	/* MAC Address 7 Register	*/
+#define MAC_ADDR8	0x60A0UL	/* MAC Address 8 Register	*/
+#define MAC_AFILT0	0x60A4UL	/* Address Filter 0 Register	*/
+#define MAC_AFILT1	0x60A8UL	/* Address Filter 1 Register	*/
+#define MAC_AFILT2	0x60ACUL	/* Address Filter 2 Register	*/
+#define MAC_AF21MSK	0x60B0UL	/* Address Filter 2&1 Mask Reg	*/
+#define MAC_AF0MSK	0x60B4UL	/* Address Filter 0 Mask Reg	*/
+#define MAC_HASH0	0x60C0UL	/* Hash Table 0 Register	*/
+#define MAC_HASH1	0x60C4UL	/* Hash Table 1 Register	*/
+#define MAC_HASH2	0x60C8UL	/* Hash Table 2 Register	*/
+#define MAC_HASH3	0x60CCUL	/* Hash Table 3 Register	*/
+#define MAC_HASH4	0x60D0UL	/* Hash Table 4 Register	*/
+#define MAC_HASH5	0x60D4UL	/* Hash Table 5 Register	*/
+#define MAC_HASH6	0x60D8UL	/* Hash Table 6 Register	*/
+#define MAC_HASH7	0x60DCUL	/* Hash Table 7 Register	*/
+#define MAC_HASH8	0x60E0UL	/* Hash Table 8 Register	*/
+#define MAC_HASH9	0x60E4UL	/* Hash Table 9 Register	*/
+#define MAC_HASH10	0x60E8UL	/* Hash Table 10 Register	*/
+#define MAC_HASH11	0x60ECUL	/* Hash Table 11 Register	*/
+#define MAC_HASH12	0x60F0UL	/* Hash Table 12 Register	*/
+#define MAC_HASH13	0x60F4UL	/* Hash Table 13 Register	*/
+#define MAC_HASH14	0x60F8UL	/* Hash Table 14 Register	*/
+#define MAC_HASH15	0x60FCUL	/* Hash Table 15 Register	*/
+#define MAC_NCOLL	0x6100UL	/* Normal Collision Counter	*/
+#define MAC_FASUCC	0x6104UL	/* First Attmpt. Succ Coll Ctr.	*/
+#define MAC_ECOLL	0x6108UL	/* Excessive Collision Counter	*/
+#define MAC_LCOLL	0x610CUL	/* Late Collision Counter	*/
+#define MAC_DTIMER	0x6110UL	/* Defer Timer			*/
+#define MAC_PATMPS	0x6114UL	/* Peak Attempts Register	*/
+#define MAC_RFCTR	0x6118UL	/* Receive Frame Counter	*/
+#define MAC_LERR	0x611CUL	/* Length Error Counter		*/
+#define MAC_AERR	0x6120UL	/* Alignment Error Counter	*/
+#define MAC_FCSERR	0x6124UL	/* FCS Error Counter		*/
+#define MAC_RXCVERR	0x6128UL	/* RX code Violation Error Ctr	*/
+#define MAC_RANDSEED	0x6130UL	/* Random Number Seed Register	*/
+#define MAC_SMACHINE	0x6134UL	/* State Machine Register	*/
+
+/* TX MAC Software Reset Command. */
+#define MAC_TXRST_CMD	0x00000001	/* Start sw reset, self-clears	*/
+
+/* RX MAC Software Reset Command. */
+#define MAC_RXRST_CMD	0x00000001	/* Start sw reset, self-clears	*/
+
+/* Send Pause Command. */
+#define MAC_SNDPAUSE_TS	0x0000ffff	/* The pause_time operand used in
+					 * Send_Pause and flow-control
+					 * handshakes.
+					 */
+#define MAC_SNDPAUSE_SP	0x00010000	/* Setting this bit instructs the MAC
+					 * to send a Pause Flow Control
+					 * frame onto the network.
+					 */
+
+/* TX MAC Status Register. */
+#define MAC_TXSTAT_XMIT	0x00000001	/* Frame Transmitted		*/
+#define MAC_TXSTAT_URUN	0x00000002	/* TX Underrun			*/
+#define MAC_TXSTAT_MPE	0x00000004	/* Max Packet Size Error	*/
+#define MAC_TXSTAT_NCE	0x00000008	/* Normal Collision Cntr Expire	*/
+#define MAC_TXSTAT_ECE	0x00000010	/* Excess Collision Cntr Expire	*/
+#define MAC_TXSTAT_LCE	0x00000020	/* Late Collision Cntr Expire	*/
+#define MAC_TXSTAT_FCE	0x00000040	/* First Collision Cntr Expire	*/
+#define MAC_TXSTAT_DTE	0x00000080	/* Defer Timer Expire		*/
+#define MAC_TXSTAT_PCE	0x00000100	/* Peak Attempts Cntr Expire	*/
+
+/* RX MAC Status Register. */
+#define MAC_RXSTAT_RCV	0x00000001	/* Frame Received		*/
+#define MAC_RXSTAT_OFLW	0x00000002	/* Receive Overflow		*/
+#define MAC_RXSTAT_FCE	0x00000004	/* Frame Cntr Expire		*/
+#define MAC_RXSTAT_ACE	0x00000008	/* Align Error Cntr Expire	*/
+#define MAC_RXSTAT_CCE	0x00000010	/* CRC Error Cntr Expire	*/
+#define MAC_RXSTAT_LCE	0x00000020	/* Length Error Cntr Expire	*/
+#define MAC_RXSTAT_VCE	0x00000040	/* Code Violation Cntr Expire	*/
+
+/* MAC Control Status Register. */
+#define MAC_CSTAT_PRCV	0x00000001	/* Pause Received		*/
+#define MAC_CSTAT_PS	0x00000002	/* Paused State			*/
+#define MAC_CSTAT_NPS	0x00000004	/* Not Paused State		*/
+#define MAC_CSTAT_PTR	0xffff0000	/* Pause Time Received		*/
+
+/* The layout of the MAC_{TX,RX,C}MASK registers is identical to that
+ * of MAC_{TX,RX,C}STAT.  Bits set in MAC_{TX,RX,C}MASK will prevent
+ * that interrupt type from being signalled to front end of GEM.  For
+ * the interrupt to actually get sent to the cpu, it is necessary to
+ * properly set the appropriate GREG_IMASK_{TX,RX,}MAC bits as well.
+ */
+
+/* TX MAC Configuration Register.
+ *
+ * NOTE: The TX MAC Enable bit must be cleared and polled until
+ *	 zero before any other bits in this register are changed.
+ *
+ *	 Also, enabling the Carrier Extension feature of GEM is
+ *	 a 3 step process 1) Set TX Carrier Extension 2) Set
+ *	 RX Carrier Extension 3) Set Slot Time to 0x200.  This
+ *	 mode must be enabled when in half-duplex at 1Gbps, else
+ *	 it must be disabled.
+ */
+#define MAC_TXCFG_ENAB	0x00000001	/* TX MAC Enable		*/
+#define MAC_TXCFG_ICS	0x00000002	/* Ignore Carrier Sense		*/
+#define MAC_TXCFG_ICOLL	0x00000004	/* Ignore Collisions		*/
+#define MAC_TXCFG_EIPG0	0x00000008	/* Enable IPG0			*/
+#define MAC_TXCFG_NGU	0x00000010	/* Never Give Up		*/
+#define MAC_TXCFG_NGUL	0x00000020	/* Never Give Up Limit		*/
+#define MAC_TXCFG_NBO	0x00000040	/* No Backoff			*/
+#define MAC_TXCFG_SD	0x00000080	/* Slow Down			*/
+#define MAC_TXCFG_NFCS	0x00000100	/* No FCS			*/
+#define MAC_TXCFG_TCE	0x00000200	/* TX Carrier Extension		*/
+
+/* RX MAC Configuration Register.
+ *
+ * NOTE: The RX MAC Enable bit must be cleared and polled until
+ *	 zero before any other bits in this register are changed.
+ *
+ *	 Similar rules apply to the Hash Filter Enable bit when
+ *	 programming the hash table registers, and the Address Filter
+ *	 Enable bit when programming the address filter registers.
+ */
+#define MAC_RXCFG_ENAB	0x00000001	/* RX MAC Enable		*/
+#define MAC_RXCFG_SPAD	0x00000002	/* Strip Pad			*/
+#define MAC_RXCFG_SFCS	0x00000004	/* Strip FCS			*/
+#define MAC_RXCFG_PROM	0x00000008	/* Promiscuous Mode		*/
+#define MAC_RXCFG_PGRP	0x00000010	/* Promiscuous Group		*/
+#define MAC_RXCFG_HFE	0x00000020	/* Hash Filter Enable		*/
+#define MAC_RXCFG_AFE	0x00000040	/* Address Filter Enable	*/
+#define MAC_RXCFG_DDE	0x00000080	/* Disable Discard on Error	*/
+#define MAC_RXCFG_RCE	0x00000100	/* RX Carrier Extension		*/
+
+/* MAC Control Config Register. */
+#define MAC_MCCFG_SPE	0x00000001	/* Send Pause Enable		*/
+#define MAC_MCCFG_RPE	0x00000002	/* Receive Pause Enable		*/
+#define MAC_MCCFG_PMC	0x00000004	/* Pass MAC Control		*/
+
+/* XIF Configuration Register.
+ *
+ * NOTE: When leaving or entering loopback mode, a global hardware
+ *       init of GEM should be performed.
+ */
+#define MAC_XIFCFG_OE	0x00000001	/* MII TX Output Driver Enable	*/
+#define MAC_XIFCFG_LBCK	0x00000002	/* Loopback TX to RX		*/
+#define MAC_XIFCFG_DISE	0x00000004	/* Disable RX path during TX	*/
+#define MAC_XIFCFG_GMII	0x00000008	/* Use GMII clocks + datapath	*/
+#define MAC_XIFCFG_MBOE	0x00000010	/* Controls MII_BUF_EN pin	*/
+#define MAC_XIFCFG_LLED	0x00000020	/* Force LINKLED# active (low)	*/
+#define MAC_XIFCFG_FLED	0x00000040	/* Force FDPLXLED# active (low)	*/
+
+/* InterPacketGap0 Register.  This 8-bit value is used as an extension
+ * to the InterPacketGap1 Register.  Specifically it contributes to the
+ * timing of the RX-to-TX IPG.  This value is ignored and presumed to
+ * be zero for TX-to-TX IPG calculations and/or when the Enable IPG0 bit
+ * is cleared in the TX MAC Configuration Register.
+ *
+ * This value in this register in terms of media byte time.
+ *
+ * Recommended value: 0x00
+ */
+
+/* InterPacketGap1 Register.  This 8-bit value defines the first 2/3
+ * portion of the Inter Packet Gap.
+ *
+ * This value in this register in terms of media byte time.
+ *
+ * Recommended value: 0x08
+ */
+
+/* InterPacketGap2 Register.  This 8-bit value defines the second 1/3
+ * portion of the Inter Packet Gap.
+ *
+ * This value in this register in terms of media byte time.
+ *
+ * Recommended value: 0x04
+ */
+
+/* Slot Time Register.  This 10-bit value specifies the slot time
+ * parameter in units of media byte time.  It determines the physical
+ * span of the network.
+ *
+ * Recommended value: 0x40
+ */
+
+/* Minimum Frame Size Register.  This 10-bit register specifies the
+ * smallest sized frame the TXMAC will send onto the medium, and the
+ * RXMAC will receive from the medium.
+ *
+ * Recommended value: 0x40
+ */
+
+/* Maximum Frame and Burst Size Register.
+ *
+ * This register specifies two things.  First it specifies the maximum
+ * sized frame the TXMAC will send and the RXMAC will recognize as
+ * valid.  Second, it specifies the maximum run length of a burst of
+ * packets sent in half-duplex gigabit modes.
+ *
+ * Recommended value: 0x200005ee
+ */
+#define MAC_MAXFSZ_MFS	0x00007fff	/* Max Frame Size		*/
+#define MAC_MAXFSZ_MBS	0x7fff0000	/* Max Burst Size		*/
+
+/* PA Size Register.  This 10-bit register specifies the number of preamble
+ * bytes which will be transmitted at the beginning of each frame.  A
+ * value of two or greater should be programmed here.
+ *
+ * Recommended value: 0x07
+ */
+
+/* Jam Size Register.  This 4-bit register specifies the duration of
+ * the jam in units of media byte time.
+ *
+ * Recommended value: 0x04
+ */
+
+/* Attempts Limit Register.  This 8-bit register specifies the number
+ * of attempts that the TXMAC will make to transmit a frame, before it
+ * resets its Attempts Counter.  After reaching the Attempts Limit the
+ * TXMAC may or may not drop the frame, as determined by the NGU
+ * (Never Give Up) and NGUL (Never Give Up Limit) bits in the TXMAC
+ * Configuration Register.
+ *
+ * Recommended value: 0x10
+ */
+
+/* MAX Control Type Register.  This 16-bit register specifies the
+ * "type" field of a MAC Control frame.  The TXMAC uses this field to
+ * encapsulate the MAC Control frame for transmission, and the RXMAC
+ * uses it for decoding valid MAC Control frames received from the
+ * network.
+ *
+ * Recommended value: 0x8808
+ */
+
+/* MAC Address Registers.  Each of these registers specify the
+ * ethernet MAC of the interface, 16-bits at a time.  Register
+ * 0 specifies bits [47:32], register 1 bits [31:16], and register
+ * 2 bits [15:0].
+ *
+ * Registers 3 through and including 5 specify an alternate
+ * MAC address for the interface.
+ *
+ * Registers 6 through and including 8 specify the MAC Control
+ * Address, which must be the reserved multicast address for MAC
+ * Control frames.
+ *
+ * Example: To program primary station address a:b:c:d:e:f into
+ *	    the chip.
+ *		MAC_Address_2 = (a << 8) | b
+ *		MAC_Address_1 = (c << 8) | d
+ *		MAC_Address_0 = (e << 8) | f
+ */
+
+/* Address Filter Registers.  Registers 0 through 2 specify bit
+ * fields [47:32] through [15:0], respectively, of the address
+ * filter.  The Address Filter 2&1 Mask Register denotes the 8-bit
+ * nibble mask for Address Filter Registers 2 and 1.  The Address
+ * Filter 0 Mask Register denotes the 16-bit mask for the Address
+ * Filter Register 0.
+ */
+
+/* Hash Table Registers.  Registers 0 through 15 specify bit fields
+ * [255:240] through [15:0], respectively, of the hash table.
+ */
+
+/* Statistics Registers.  All of these registers are 16-bits and
+ * track occurrences of a specific event.  GEM can be configured
+ * to interrupt the host cpu when any of these counters overflow.
+ * They should all be explicitly initialized to zero when the interface
+ * is brought up.
+ */
+
+/* Random Number Seed Register.  This 10-bit value is used as the
+ * RNG seed inside GEM for the CSMA/CD backoff algorithm.  It is
+ * recommended to program this register to the 10 LSB of the
+ * interfaces MAC address.
+ */
+
+/* Pause Timer, read-only.  This 16-bit timer is used to time the pause
+ * interval as indicated by a received pause flow control frame.
+ * A non-zero value in this timer indicates that the MAC is currently in
+ * the paused state.
+ */
+
+/* MIF Registers */
+#define MIF_BBCLK	0x6200UL	/* MIF Bit-Bang Clock		*/
+#define MIF_BBDATA	0x6204UL	/* MIF Bit-Band Data		*/
+#define MIF_BBOENAB	0x6208UL	/* MIF Bit-Bang Output Enable	*/
+#define MIF_FRAME	0x620CUL	/* MIF Frame/Output Register	*/
+#define MIF_CFG		0x6210UL	/* MIF Configuration Register	*/
+#define MIF_MASK	0x6214UL	/* MIF Mask Register		*/
+#define MIF_STATUS	0x6218UL	/* MIF Status Register		*/
+#define MIF_SMACHINE	0x621CUL	/* MIF State Machine Register	*/
+
+/* MIF Bit-Bang Clock.  This 1-bit register is used to generate the
+ * MDC clock waveform on the MII Management Interface when the MIF is
+ * programmed in the "Bit-Bang" mode.  Writing a '1' after a '0' into
+ * this register will create a rising edge on the MDC, while writing
+ * a '0' after a '1' will create a falling edge.  For every bit that
+ * is transferred on the management interface, both edges have to be
+ * generated.
+ */
+
+/* MIF Bit-Bang Data.  This 1-bit register is used to generate the
+ * outgoing data (MDO) on the MII Management Interface when the MIF
+ * is programmed in the "Bit-Bang" mode.  The daa will be steered to the
+ * appropriate MDIO based on the state of the PHY_Select bit in the MIF
+ * Configuration Register.
+ */
+
+/* MIF Big-Band Output Enable.  THis 1-bit register is used to enable
+ * ('1') or disable ('0') the I-directional driver on the MII when the
+ * MIF is programmed in the "Bit-Bang" mode.  The MDIO should be enabled
+ * when data bits are transferred from the MIF to the transceiver, and it
+ * should be disabled when the interface is idle or when data bits are
+ * transferred from the transceiver to the MIF (data portion of a read
+ * instruction).  Only one MDIO will be enabled at a given time, depending
+ * on the state of the PHY_Select bit in the MIF Configuration Register.
+ */
+
+/* MIF Configuration Register.  This 15-bit register controls the operation
+ * of the MIF.
+ */
+#define MIF_CFG_PSELECT	0x00000001	/* Xcvr slct: 0=mdio0 1=mdio1	*/
+#define MIF_CFG_POLL	0x00000002	/* Enable polling mechanism	*/
+#define MIF_CFG_BBMODE	0x00000004	/* 1=bit-bang 0=frame mode	*/
+#define MIF_CFG_PRADDR	0x000000f8	/* Xcvr poll register address	*/
+#define MIF_CFG_MDI0	0x00000100	/* MDIO_0 present or read-bit	*/
+#define MIF_CFG_MDI1	0x00000200	/* MDIO_1 present or read-bit	*/
+#define MIF_CFG_PPADDR	0x00007c00	/* Xcvr poll PHY address	*/
+
+/* MIF Frame/Output Register.  This 32-bit register allows the host to
+ * communicate with a transceiver in frame mode (as opposed to big-bang
+ * mode).  Writes by the host specify an instrution.  After being issued
+ * the host must poll this register for completion.  Also, after
+ * completion this register holds the data returned by the transceiver
+ * if applicable.
+ */
+#define MIF_FRAME_ST	0xc0000000	/* STart of frame		*/
+#define MIF_FRAME_OP	0x30000000	/* OPcode			*/
+#define MIF_FRAME_PHYAD	0x0f800000	/* PHY ADdress			*/
+#define MIF_FRAME_REGAD	0x007c0000	/* REGister ADdress		*/
+#define MIF_FRAME_TAMSB	0x00020000	/* Turn Around MSB		*/
+#define MIF_FRAME_TALSB	0x00010000	/* Turn Around LSB		*/
+#define MIF_FRAME_DATA	0x0000ffff	/* Instruction Payload		*/
+
+/* MIF Status Register.  This register reports status when the MIF is
+ * operating in the poll mode.  The poll status field is auto-clearing
+ * on read.
+ */
+#define MIF_STATUS_DATA	0xffff0000	/* Live image of XCVR reg	*/
+#define MIF_STATUS_STAT	0x0000ffff	/* Which bits have changed	*/
+
+/* MIF Mask Register.  This 16-bit register is used when in poll mode
+ * to say which bits of the polled register will cause an interrupt
+ * when changed.
+ */
+
+/* PCS/Serialink Registers */
+#define PCS_MIICTRL	0x9000UL	/* PCS MII Control Register	*/
+#define PCS_MIISTAT	0x9004UL	/* PCS MII Status Register	*/
+#define PCS_MIIADV	0x9008UL	/* PCS MII Advertisement Reg	*/
+#define PCS_MIILP	0x900CUL	/* PCS MII Link Partner Ability	*/
+#define PCS_CFG		0x9010UL	/* PCS Configuration Register	*/
+#define PCS_SMACHINE	0x9014UL	/* PCS State Machine Register	*/
+#define PCS_ISTAT	0x9018UL	/* PCS Interrupt Status Reg	*/
+#define PCS_DMODE	0x9050UL	/* Datapath Mode Register	*/
+#define PCS_SCTRL	0x9054UL	/* Serialink Control Register	*/
+#define PCS_SOS		0x9058UL	/* Shared Output Select Reg	*/
+#define PCS_SSTATE	0x905CUL	/* Serialink State Register	*/
+
+/* PCD MII Control Register. */
+#define PCS_MIICTRL_SPD	0x00000040	/* Read as one, writes ignored	*/
+#define PCS_MIICTRL_CT	0x00000080	/* Force COL signal active	*/
+#define PCS_MIICTRL_DM	0x00000100	/* Duplex mode, forced low	*/
+#define PCS_MIICTRL_RAN	0x00000200	/* Restart auto-neg, self clear	*/
+#define PCS_MIICTRL_ISO	0x00000400	/* Read as zero, writes ignored	*/
+#define PCS_MIICTRL_PD	0x00000800	/* Read as zero, writes ignored	*/
+#define PCS_MIICTRL_ANE	0x00001000	/* Auto-neg enable		*/
+#define PCS_MIICTRL_SS	0x00002000	/* Read as zero, writes ignored	*/
+#define PCS_MIICTRL_WB	0x00004000	/* Wrapback, loopback at 10-bit
+					 * input side of Serialink
+					 */
+#define PCS_MIICTRL_RST	0x00008000	/* Resets PCS, self clearing	*/
+
+/* PCS MII Status Register. */
+#define PCS_MIISTAT_EC	0x00000001	/* Ext Capability: Read as zero	*/
+#define PCS_MIISTAT_JD	0x00000002	/* Jabber Detect: Read as zero	*/
+#define PCS_MIISTAT_LS	0x00000004	/* Link Status: 1=up 0=down	*/
+#define PCS_MIISTAT_ANA	0x00000008	/* Auto-neg Ability, always 1	*/
+#define PCS_MIISTAT_RF	0x00000010	/* Remote Fault			*/
+#define PCS_MIISTAT_ANC	0x00000020	/* Auto-neg complete		*/
+#define PCS_MIISTAT_ES	0x00000100	/* Extended Status, always 1	*/
+
+/* PCS MII Advertisement Register. */
+#define PCS_MIIADV_FD	0x00000020	/* Advertise Full Duplex	*/
+#define PCS_MIIADV_HD	0x00000040	/* Advertise Half Duplex	*/
+#define PCS_MIIADV_SP	0x00000080	/* Advertise Symmetric Pause	*/
+#define PCS_MIIADV_AP	0x00000100	/* Advertise Asymmetric Pause	*/
+#define PCS_MIIADV_RF	0x00003000	/* Remote Fault			*/
+#define PCS_MIIADV_ACK	0x00004000	/* Read-only			*/
+#define PCS_MIIADV_NP	0x00008000	/* Next-page, forced low	*/
+
+/* PCS MII Link Partner Ability Register.   This register is equivalent
+ * to the Link Partnet Ability Register of the standard MII register set.
+ * It's layout corresponds to the PCS MII Advertisement Register.
+ */
+
+/* PCS Configuration Register. */
+#define PCS_CFG_ENABLE	0x00000001	/* Must be zero while changing
+					 * PCS MII advertisement reg.
+					 */
+#define PCS_CFG_SDO	0x00000002	/* Signal detect override	*/
+#define PCS_CFG_SDL	0x00000004	/* Signal detect active low	*/
+#define PCS_CFG_JS	0x00000018	/* Jitter-study:
+					 * 0 = normal operation
+					 * 1 = high-frequency test pattern
+					 * 2 = low-frequency test pattern
+					 * 3 = reserved
+					 */
+#define PCS_CFG_TO	0x00000020	/* 10ms auto-neg timer override	*/
+
+/* PCS Interrupt Status Register.  This register is self-clearing
+ * when read.
+ */
+#define PCS_ISTAT_LSC	0x00000004	/* Link Status Change		*/
+
+/* Datapath Mode Register. */
+#define PCS_DMODE_SM	0x00000001	/* 1 = use internal Serialink	*/
+#define PCS_DMODE_ESM	0x00000002	/* External SERDES mode		*/
+#define PCS_DMODE_MGM	0x00000004	/* MII/GMII mode		*/
+#define PCS_DMODE_GMOE	0x00000008	/* GMII Output Enable		*/
+
+/* Serialink Control Register.
+ *
+ * NOTE: When in SERDES mode, the loopback bit has inverse logic.
+ */
+#define PCS_SCTRL_LOOP	0x00000001	/* Loopback enable		*/
+#define PCS_SCTRL_ESCD	0x00000002	/* Enable sync char detection	*/
+#define PCS_SCTRL_LOCK	0x00000004	/* Lock to reference clock	*/
+#define PCS_SCTRL_EMP	0x00000018	/* Output driver emphasis	*/
+#define PCS_SCTRL_STEST	0x000001c0	/* Self test patterns		*/
+#define PCS_SCTRL_PDWN	0x00000200	/* Software power-down		*/
+#define PCS_SCTRL_RXZ	0x00000c00	/* PLL input to Serialink	*/
+#define PCS_SCTRL_RXP	0x00003000	/* PLL input to Serialink	*/
+#define PCS_SCTRL_TXZ	0x0000c000	/* PLL input to Serialink	*/
+#define PCS_SCTRL_TXP	0x00030000	/* PLL input to Serialink	*/
+
+/* Shared Output Select Register.  For test and debug, allows multiplexing
+ * test outputs into the PROM address pins.  Set to zero for normal
+ * operation.
+ */
+#define PCS_SOS_PADDR	0x00000003	/* PROM Address			*/
+
+/* PROM Image Space */
+#define PROM_START	0x100000UL	/* Expansion ROM run time access*/
+#define PROM_SIZE	0x0fffffUL	/* Size of ROM			*/
+#define PROM_END	0x200000UL	/* End of ROM			*/
+
+/* MII definitions missing from mii.h */
+
+#define BMCR_SPD2	0x0040		/* Gigabit enable? (bcm5411)	*/
+#define LPA_PAUSE	0x0400
+
+/* More PHY registers (specific to Broadcom models) */
+
+/* MII BCM5201 MULTIPHY interrupt register */
+#define MII_BCM5201_INTERRUPT			0x1A
+#define MII_BCM5201_INTERRUPT_INTENABLE		0x4000
+
+#define MII_BCM5201_AUXMODE2			0x1B
+#define MII_BCM5201_AUXMODE2_LOWPOWER		0x0008
+
+#define MII_BCM5201_MULTIPHY                    0x1E
+
+/* MII BCM5201 MULTIPHY register bits */
+#define MII_BCM5201_MULTIPHY_SERIALMODE         0x0002
+#define MII_BCM5201_MULTIPHY_SUPERISOLATE       0x0008
+
+/* MII BCM5400 1000-BASET Control register */
+#define MII_BCM5400_GB_CONTROL			0x09
+#define MII_BCM5400_GB_CONTROL_FULLDUPLEXCAP	0x0200
+
+/* MII BCM5400 AUXCONTROL register */
+#define MII_BCM5400_AUXCONTROL                  0x18
+#define MII_BCM5400_AUXCONTROL_PWR10BASET       0x0004
+
+/* MII BCM5400 AUXSTATUS register */
+#define MII_BCM5400_AUXSTATUS                   0x19
+#define MII_BCM5400_AUXSTATUS_LINKMODE_MASK     0x0700
+#define MII_BCM5400_AUXSTATUS_LINKMODE_SHIFT    8
+
+/* When it can, GEM internally caches 4 aligned TX descriptors
+ * at a time, so that it can use full cacheline DMA reads.
+ *
+ * Note that unlike HME, there is no ownership bit in the descriptor
+ * control word.  The same functionality is obtained via the TX-Kick
+ * and TX-Complete registers.  As a result, GEM need not write back
+ * updated values to the TX descriptor ring, it only performs reads.
+ *
+ * Since TX descriptors are never modified by GEM, the driver can
+ * use the buffer DMA address as a place to keep track of allocated
+ * DMA mappings for a transmitted packet.
+ */
+struct gem_txd {
+        uint64_t	control_word;
+        uint64_t	buffer;
+};
+
+#define TXDCTRL_BUFSZ	0x0000000000007fffULL	/* Buffer Size		*/
+#define TXDCTRL_CSTART	0x00000000001f8000ULL	/* CSUM Start Offset	*/
+#define TXDCTRL_COFF	0x000000001fe00000ULL	/* CSUM Stuff Offset	*/
+#define TXDCTRL_CENAB	0x0000000020000000ULL	/* CSUM Enable		*/
+#define TXDCTRL_EOF	0x0000000040000000ULL	/* End of Frame		*/
+#define TXDCTRL_SOF	0x0000000080000000ULL	/* Start of Frame	*/
+#define TXDCTRL_INTME	0x0000000100000000ULL	/* "Interrupt Me"	*/
+#define TXDCTRL_NOCRC	0x0000000200000000ULL	/* No CRC Present	*/
+
+/* GEM requires that RX descriptors are provided four at a time,
+ * aligned.  Also, the RX ring may not wrap around.  This means that
+ * there will be at least 4 unused descriptor entries in the middle
+ * of the RX ring at all times.
+ *
+ * Similar to HME, GEM assumes that it can write garbage bytes before
+ * the beginning of the buffer and right after the end in order to DMA
+ * whole cachelines.
+ *
+ * Unlike for TX, GEM does update the status word in the RX descriptors
+ * when packets arrive.  Therefore an ownership bit does exist in the
+ * RX descriptors.  It is advisory, GEM clears it but does not check
+ * it in any way.  So when buffers are posted to the RX ring (via the
+ * RX Kick register) by the driver it must make sure the buffers are
+ * truly ready and that the ownership bits are set properly.
+ *
+ * Even though GEM modifies the RX descriptors, it guarantees that the
+ * buffer DMA address field will stay the same when it performs these
+ * updates.  Therefore it can be used to keep track of DMA mappings
+ * by the host driver just as in the TX descriptor case above.
+ */
+struct gem_rxd {
+        uint64_t	status_word;
+        uint64_t	buffer;
+};
+
+#define RXDCTRL_TCPCSUM	0x000000000000ffffULL	/* TCP Pseudo-CSUM	*/
+#define RXDCTRL_BUFSZ	0x000000007fff0000ULL	/* Buffer Size		*/
+#define RXDCTRL_OWN	0x0000000080000000ULL	/* GEM owns this entry	*/
+#define RXDCTRL_HASHVAL	0x0ffff00000000000ULL	/* Hash Value		*/
+#define RXDCTRL_HPASS	0x1000000000000000ULL	/* Passed Hash Filter	*/
+#define RXDCTRL_ALTMAC	0x2000000000000000ULL	/* Matched ALT MAC	*/
+#define RXDCTRL_BAD	0x4000000000000000ULL	/* Frame has bad CRC	*/
+
+
+#endif /* _SUNGEM_H */
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index 24fae16..c2a8c0b 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -1758,6 +1758,7 @@ static const char * const pci_nic_models[] = {
     "e1000",
     "pcnet",
     "virtio",
+    "sungem",
     NULL
 };
 
@@ -1770,6 +1771,7 @@ static const char * const pci_nic_names[] = {
     "e1000",
     "pcnet",
     "virtio-net-pci",
+    "sungem",
     NULL
 };
 
diff --git a/include/hw/pci/pci_ids.h b/include/hw/pci/pci_ids.h
index d77ca60..d38dc73 100644
--- a/include/hw/pci/pci_ids.h
+++ b/include/hw/pci/pci_ids.h
@@ -89,6 +89,7 @@
 #define PCI_VENDOR_ID_APPLE              0x106b
 #define PCI_DEVICE_ID_APPLE_UNI_N_AGP    0x0020
 #define PCI_DEVICE_ID_APPLE_U3_AGP       0x004b
+#define PCI_DEVICE_ID_APPLE_UNI_N_GMAC   0x0021
 
 #define PCI_VENDOR_ID_SUN                0x108e
 #define PCI_DEVICE_ID_SUN_EBUS           0x1000
