zpu: renamed the directory for the usrp2 fw to zpu to reflect the cpu type

7 files changed, 1604 insertions, 0 deletions

diff --git a/firmware/zpu/usrp2/CMakeLists.txt b/firmware/zpu/usrp2/CMakeLists.txt
new file mode 100644
index 000000000..8ed31b8d4
--- /dev/null
+++ b/firmware/zpu/usrp2/CMakeLists.txt
@@ -0,0 +1,36 @@
+#
+# Copyright 2010 Ettus Research LLC
+#
+# This program is free software: you can redistribute it and/or modify
+# it under the terms of the GNU General Public License as published by
+# the Free Software Foundation, either version 3 of the License, or
+# (at your option) any later version.
+#
+# This program is distributed in the hope that it will be useful,
+# but WITHOUT ANY WARRANTY; without even the implied warranty of
+# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+# GNU General Public License for more details.
+#
+# You should have received a copy of the GNU General Public License
+# along with this program.  If not, see <http://www.gnu.org/licenses/>.
+#
+
+########################################################################
+INCLUDE(${CMAKE_SOURCE_DIR}/lib/CMakeLists.txt)
+INCLUDE_DIRECTORIES(${CMAKE_CURRENT_SOURCE_DIR})
+
+ADD_LIBRARY(libusrp2fw STATIC
+    ${COMMON_SRCS}
+    sd.c
+    ethernet.c
+    udp_fw_update.c
+)
+
+########################################################################
+ADD_EXECUTABLE(usrp2_txrx_uhd.elf ${CMAKE_SOURCE_DIR}/apps/txrx_uhd.c)
+TARGET_LINK_LIBRARIES(usrp2_txrx_uhd.elf libusrp2fw)
+GEN_OUTPUTS(usrp2_txrx_uhd.elf)
+
+ADD_EXECUTABLE(usrp2_blinkenlights.elf ${CMAKE_SOURCE_DIR}/apps/blinkenlights.c)
+TARGET_LINK_LIBRARIES(usrp2_blinkenlights.elf libusrp2fw)
+GEN_OUTPUTS(usrp2_blinkenlights.elf)
diff --git a/firmware/zpu/usrp2/eth_phy.h b/firmware/zpu/usrp2/eth_phy.h
new file mode 100644
index 000000000..6c16f97b7
--- /dev/null
+++ b/firmware/zpu/usrp2/eth_phy.h
@@ -0,0 +1,219 @@
+/* -*- c -*- */
+/*
+ * Copyright 2007 Free Software Foundation, Inc.
+ * Copyright(c) 1999 - 2005 Intel Corporation. All rights reserved.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+/* Much of this was extracted from the Linux e1000_hw.h file */
+
+#ifndef INCLUDED_ETH_PHY_H
+#define INCLUDED_ETH_PHY_H
+
+/* PHY 1000 MII Register/Bit Definitions */
+/* PHY Registers defined by IEEE */
+
+#define PHY_CTRL         0x00 /* Control Register */
+#define PHY_STATUS       0x01 /* Status Regiser */
+#define PHY_ID1          0x02 /* Phy Id Reg (word 1) */
+#define PHY_ID2          0x03 /* Phy Id Reg (word 2) */
+#define PHY_AUTONEG_ADV  0x04 /* Autoneg Advertisement */
+#define PHY_LP_ABILITY   0x05 /* Link Partner Ability (Base Page) */
+#define PHY_AUTONEG_EXP  0x06 /* Autoneg Expansion Reg */
+#define PHY_NEXT_PAGE_TX 0x07 /* Next Page TX */
+#define PHY_LP_NEXT_PAGE 0x08 /* Link Partner Next Page */
+#define PHY_1000T_CTRL   0x09 /* 1000Base-T Control Reg */
+#define PHY_1000T_STATUS 0x0A /* 1000Base-T Status Reg */
+#define PHY_EXT_STATUS   0x0F /* Extended Status Reg */
+
+/* PHY 1000 MII Register additions in DP83856 */
+/* The part implements 0x00 thru 0x1f; we use these. */
+
+#define	PHY_LINK_AN	 0x11 /* Link and Auto Negotiation Status Reg */
+#define PHY_INT_STATUS	 0x14 /* Interupt Status Reg (RO) */
+#define PHY_INT_MASK	 0x15 /* Interrupt Mask Reg  (RW) */
+#define PHY_INT_CLEAR    0x17 /* Interrupt Clear Reg (RW) */
+
+
+/* Bit definitions for some of the registers above */
+
+/* PHY Control Register (PHY_CTRL) */
+#define MII_CR_SPEED_SELECT_MSB 0x0040  /* bits 6,13: 10=1000, 01=100, 00=10 */
+#define MII_CR_COLL_TEST_ENABLE 0x0080  /* Collision test enable */
+#define MII_CR_FULL_DUPLEX      0x0100  /* FDX =1, half duplex =0 */
+#define MII_CR_RESTART_AUTO_NEG 0x0200  /* Restart auto negotiation */
+#define MII_CR_ISOLATE          0x0400  /* Isolate PHY from MII */
+#define MII_CR_POWER_DOWN       0x0800  /* Power down */
+#define MII_CR_AUTO_NEG_EN      0x1000  /* Auto Neg Enable */
+#define MII_CR_SPEED_SELECT_LSB 0x2000  /* bits 6,13: 10=1000, 01=100, 00=10 */
+#define MII_CR_LOOPBACK         0x4000  /* 0 = normal, 1 = loopback */
+#define MII_CR_RESET            0x8000  /* 0 = normal, 1 = PHY reset */
+
+/* PHY Status Register (PHY_STATUS) */
+#define MII_SR_EXTENDED_CAPS     0x0001 /* Extended register capabilities */
+#define MII_SR_JABBER_DETECT     0x0002 /* Jabber Detected */
+#define MII_SR_LINK_STATUS       0x0004 /* Link Status 1 = link */
+#define MII_SR_AUTONEG_CAPS      0x0008 /* Auto Neg Capable */
+#define MII_SR_REMOTE_FAULT      0x0010 /* Remote Fault Detect */
+#define MII_SR_AUTONEG_COMPLETE  0x0020 /* Auto Neg Complete */
+#define MII_SR_PREAMBLE_SUPPRESS 0x0040 /* Preamble may be suppressed */
+#define MII_SR_EXTENDED_STATUS   0x0100 /* Ext. status info in Reg 0x0F */
+#define MII_SR_100T2_HD_CAPS     0x0200 /* 100T2 Half Duplex Capable */
+#define MII_SR_100T2_FD_CAPS     0x0400 /* 100T2 Full Duplex Capable */
+#define MII_SR_10T_HD_CAPS       0x0800 /* 10T   Half Duplex Capable */
+#define MII_SR_10T_FD_CAPS       0x1000 /* 10T   Full Duplex Capable */
+#define MII_SR_100X_HD_CAPS      0x2000 /* 100X  Half Duplex Capable */
+#define MII_SR_100X_FD_CAPS      0x4000 /* 100X  Full Duplex Capable */
+#define MII_SR_100T4_CAPS        0x8000 /* 100T4 Capable */
+
+/* Autoneg Advertisement Register (PHY_AUTONEG_ADV) */
+#define NWAY_AR_SELECTOR_FIELD 0x0001   /* indicates IEEE 802.3 CSMA/CD */
+#define NWAY_AR_10T_HD_CAPS    0x0020   /* 10T   Half Duplex Capable */
+#define NWAY_AR_10T_FD_CAPS    0x0040   /* 10T   Full Duplex Capable */
+#define NWAY_AR_100TX_HD_CAPS  0x0080   /* 100TX Half Duplex Capable */
+#define NWAY_AR_100TX_FD_CAPS  0x0100   /* 100TX Full Duplex Capable */
+#define NWAY_AR_100T4_CAPS     0x0200   /* 100T4 Capable */
+#define NWAY_AR_PAUSE          0x0400   /* Pause operation desired */
+#define NWAY_AR_ASM_DIR        0x0800   /* Asymmetric Pause Direction bit */
+#define NWAY_AR_REMOTE_FAULT   0x2000   /* Remote Fault detected */
+#define NWAY_AR_NEXT_PAGE      0x8000   /* Next Page ability supported */
+
+/* Link Partner Ability Register (Base Page) (PHY_LP_ABILITY) */
+#define NWAY_LPAR_SELECTOR_FIELD 0x0000 /* LP protocol selector field */
+#define NWAY_LPAR_10T_HD_CAPS    0x0020 /* LP is 10T   Half Duplex Capable */
+#define NWAY_LPAR_10T_FD_CAPS    0x0040 /* LP is 10T   Full Duplex Capable */
+#define NWAY_LPAR_100TX_HD_CAPS  0x0080 /* LP is 100TX Half Duplex Capable */
+#define NWAY_LPAR_100TX_FD_CAPS  0x0100 /* LP is 100TX Full Duplex Capable */
+#define NWAY_LPAR_100T4_CAPS     0x0200 /* LP is 100T4 Capable */
+#define NWAY_LPAR_PAUSE          0x0400 /* LP Pause operation desired */
+#define NWAY_LPAR_ASM_DIR        0x0800 /* LP Asymmetric Pause Direction bit */
+#define NWAY_LPAR_REMOTE_FAULT   0x2000 /* LP has detected Remote Fault */
+#define NWAY_LPAR_ACKNOWLEDGE    0x4000 /* LP has rx'd link code word */
+#define NWAY_LPAR_NEXT_PAGE      0x8000 /* Next Page ability supported */
+
+/* Autoneg Expansion Register (PHY_AUTONEG_EXP) */
+#define NWAY_ER_LP_NWAY_CAPS      0x0001 /* LP has Auto Neg Capability */
+#define NWAY_ER_PAGE_RXD          0x0002 /* LP is 10T   Half Duplex Capable */
+#define NWAY_ER_NEXT_PAGE_CAPS    0x0004 /* LP is 10T   Full Duplex Capable */
+#define NWAY_ER_LP_NEXT_PAGE_CAPS 0x0008 /* LP is 100TX Half Duplex Capable */
+#define NWAY_ER_PAR_DETECT_FAULT  0x0010 /* LP is 100TX Full Duplex Capable */
+
+/* Next Page TX Register (PHY_NEXT_PAGE_TX) */
+#define NPTX_MSG_CODE_FIELD 0x0001 /* NP msg code or unformatted data */
+#define NPTX_TOGGLE         0x0800 /* Toggles between exchanges
+                                    * of different NP
+                                    */
+#define NPTX_ACKNOWLDGE2    0x1000 /* 1 = will comply with msg
+                                    * 0 = cannot comply with msg
+                                    */
+#define NPTX_MSG_PAGE       0x2000 /* formatted(1)/unformatted(0) pg */
+#define NPTX_NEXT_PAGE      0x8000 /* 1 = addition NP will follow
+                                    * 0 = sending last NP
+                                    */
+
+/* Link Partner Next Page Register (PHY_LP_NEXT_PAGE) */
+#define LP_RNPR_MSG_CODE_FIELD 0x0001 /* NP msg code or unformatted data */
+#define LP_RNPR_TOGGLE         0x0800 /* Toggles between exchanges
+                                       * of different NP
+                                       */
+#define LP_RNPR_ACKNOWLDGE2    0x1000 /* 1 = will comply with msg
+                                       * 0 = cannot comply with msg
+                                       */
+#define LP_RNPR_MSG_PAGE       0x2000  /* formatted(1)/unformatted(0) pg */
+#define LP_RNPR_ACKNOWLDGE     0x4000  /* 1 = ACK / 0 = NO ACK */
+#define LP_RNPR_NEXT_PAGE      0x8000  /* 1 = addition NP will follow
+                                        * 0 = sending last NP
+                                        */
+
+/* 1000BASE-T Control Register (PHY_1000T_CTRL) */
+#define CR_1000T_ASYM_PAUSE      0x0080 /* Advertise asymmetric pause bit */
+#define CR_1000T_HD_CAPS         0x0100 /* Advertise 1000T HD capability */
+#define CR_1000T_FD_CAPS         0x0200 /* Advertise 1000T FD capability  */
+#define CR_1000T_REPEATER_DTE    0x0400 /* 1=Repeater/switch device port */
+                                        /* 0=DTE device */
+#define CR_1000T_MS_VALUE        0x0800 /* 1=Configure PHY as Master */
+                                        /* 0=Configure PHY as Slave */
+#define CR_1000T_MS_ENABLE       0x1000 /* 1=Master/Slave manual config value */
+                                        /* 0=Automatic Master/Slave config */
+#define CR_1000T_TEST_MODE_NORMAL 0x0000 /* Normal Operation */
+#define CR_1000T_TEST_MODE_1     0x2000 /* Transmit Waveform test */
+#define CR_1000T_TEST_MODE_2     0x4000 /* Master Transmit Jitter test */
+#define CR_1000T_TEST_MODE_3     0x6000 /* Slave Transmit Jitter test */
+#define CR_1000T_TEST_MODE_4     0x8000 /* Transmitter Distortion test */
+
+/* 1000BASE-T Status Register (PHY_1000T_STATUS) */
+#define SR_1000T_IDLE_ERROR_CNT   0x00FF /* Num idle errors since last read */
+#define SR_1000T_ASYM_PAUSE_DIR   0x0100 /* LP asymmetric pause direction bit */
+#define SR_1000T_LP_HD_CAPS       0x0400 /* LP is 1000T HD capable */
+#define SR_1000T_LP_FD_CAPS       0x0800 /* LP is 1000T FD capable */
+#define SR_1000T_REMOTE_RX_STATUS 0x1000 /* Remote receiver OK */
+#define SR_1000T_LOCAL_RX_STATUS  0x2000 /* Local receiver OK */
+#define SR_1000T_MS_CONFIG_RES    0x4000 /* 1=Local TX is Master, 0=Slave */
+#define SR_1000T_MS_CONFIG_FAULT  0x8000 /* Master/Slave config fault */
+#define SR_1000T_REMOTE_RX_STATUS_SHIFT          12
+#define SR_1000T_LOCAL_RX_STATUS_SHIFT           13
+#define SR_1000T_PHY_EXCESSIVE_IDLE_ERR_COUNT    5
+#define FFE_IDLE_ERR_COUNT_TIMEOUT_20            20
+#define FFE_IDLE_ERR_COUNT_TIMEOUT_100           100
+
+/* Extended Status Register (PHY_EXT_STATUS) */
+#define IEEE_ESR_1000T_HD_CAPS 0x1000 /* 1000T HD capable */
+#define IEEE_ESR_1000T_FD_CAPS 0x2000 /* 1000T FD capable */
+#define IEEE_ESR_1000X_HD_CAPS 0x4000 /* 1000X HD capable */
+#define IEEE_ESR_1000X_FD_CAPS 0x8000 /* 1000X FD capable */
+
+#define PHY_TX_POLARITY_MASK   0x0100 /* register 10h bit 8 (polarity bit) */
+#define PHY_TX_NORMAL_POLARITY 0      /* register 10h bit 8 (normal polarity) */
+
+#define AUTO_POLARITY_DISABLE  0x0010 /* register 11h bit 4 */
+                                      /* (0=enable, 1=disable) */
+
+/* Link and Auto Negotiation Status Reg (PHY_LINK_AN) [READ-ONLY] */
+#define	LANSR_MASTER           0x0001 /* 1=PHY is currently in master mode */
+#define	LANSR_FULL_DUPLEX      0x0002 /* 1=PHY is currently full duplex */
+#define LANSR_LINK_GOOD        0x0004 /* 1=a good link is established */
+#define LANSR_SPEED_MASK       0x0018
+#define	  LANSR_SPEED_10       0x0000 /*   10Mb/s */
+#define	  LANSR_SPEED_100      0x0008 /*  100Mb/s */
+#define	  LANSR_SPEED_1000     0x0010 /* 1000Mb/s */
+#define	  LANSR_SPEED_RSRVD    0x0018 /* reserved */
+#define LANSR_NON_COMP_MODE    0x0020 /* 1=detects only in non-compliant mode */
+#define	LANSR_DEEP_LOOPBACK    0x0040 /* 1=the PHY operates in deep loopback mode */
+#define	LANSR_SHALLOW_LOOPBACK 0x0080 /* 1=the PHY operates in shallow loopback mode */
+#define LANSR_RSRVD_8	       0x0100 /* reserved */
+#define LANSR_FIFO_ERR	       0x0200 /* 1=FIFO error occurred */
+#define	LANSR_MDIX_XOVER       0x0400 /* 1=PHY's MDI is in cross-over mode */
+#define	LANSR_RSRVD_11	       0x0800 /* resevered */
+#define	LANSR_TP_POLARITY_REV  0xf000 /* Twisted pair polarity status A:D([15:12]) 1=reversed */
+
+/* Interrupt status, mask and clear regs (PHY_INT_{STATUS,MASK,CLEAR}) */
+#define	PHY_INT_RSRVD_0	       0x0001 /* reserved */
+#define	PHY_INT_RSRVD_1	       0x0002 /* reserved */
+#define	PHY_INT_RSRVD_2	       0x0004 /* reserved */
+#define	PHY_INT_REM_FLT_CNG    0x0008 /* Remote Fault Changed */
+#define	PHY_INT_AN_CMPL	       0x0010 /* Auto-negotiation completion */
+#define	PHY_INT_NXT_PG_RCVD    0x0020 /* Next Page Received */
+#define PHY_INT_JABBER_CNG     0x0040 /* Jabber Changed */
+#define PHY_INT_NO_LINK	       0x0080 /* No link after auto-negotiation */
+#define PHY_INT_NO_HCD	       0x0100 /* AN couldn't determine highest common denominator */
+#define PHY_INT_MAS_SLA_ERR    0x0200 /* Master / Slave Error: couldn't resolve */
+#define PHY_INT_PRL_DET_FLT    0x0400 /* Parallel detection fault */
+#define PHY_INT_POL_CNG	       0x0800 /* Polarity of any channel changed */
+#define	PHY_INT_MDIX_CNG       0x1000 /* MDIX changed.  A pair swap occurred. */
+#define PHY_INT_DPLX_CNG       0x2000 /* Duplex changed */
+#define PHY_INT_LNK_CNG	       0x4000 /* Link changed (asserted when a link is established or broken) */
+#define PHY_INT_SPD_CNG	       0x8000 /* Speed changed */
+
+#endif /* INCLUDED_ETH_PHY_H */
diff --git a/firmware/zpu/usrp2/ethernet.c b/firmware/zpu/usrp2/ethernet.c
new file mode 100644
index 000000000..5d4654bda
--- /dev/null
+++ b/firmware/zpu/usrp2/ethernet.c
@@ -0,0 +1,290 @@
+/*
+ * Copyright 2007 Free Software Foundation, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "ethernet.h"
+#include "eth_phy.h"
+#include "eth_mac.h"
+#include "eth_mac_regs.h"
+#include "pic.h"
+#include "hal_io.h"
+#include "nonstdio.h"
+
+#define VERBOSE 1
+
+static ethernet_t ed_state;
+static ethernet_link_changed_callback_t ed_callback = 0;
+
+void 
+ethernet_register_link_changed_callback(ethernet_link_changed_callback_t new_callback)
+{
+  ed_callback = new_callback;
+}
+
+
+static void
+ed_set_mac_speed(int speed)
+{
+  printf("Speed set to %d\n",speed);
+  /*
+  switch(speed){
+  case 10:
+    eth_mac->speed = 1;
+    break;
+  case 100:
+    eth_mac->speed = 2;
+    break;
+  case 1000:
+    eth_mac->speed = 4;
+    break;
+  default:
+    break;
+  }
+  */
+}
+
+static void
+ed_link_up(int speed)
+{
+  // putstr("ed_link_up: "); puthex16_nl(speed);
+
+  ed_set_mac_speed(speed);
+
+  if (ed_callback)		// fire link changed callback
+    (*ed_callback)(speed);
+}
+
+static void
+ed_link_down(void)
+{
+  // putstr("ed_link_down\n");
+
+  if (ed_callback)		// fire link changed callback
+    (*ed_callback)(0);
+}
+
+
+static void
+ed_link_speed_change(int speed)
+{
+  ed_link_down();
+  ed_link_up(speed);
+}
+
+static void
+print_flow_control(int flow_control)
+{
+  static const char *flow_control_msg[4] = {
+    "NONE", "WE_TX", "WE_RX", "SYMMETRIC"
+  };
+  putstr("ethernet flow control: ");
+  puts(flow_control_msg[flow_control & 0x3]);
+}
+
+static void
+check_flow_control_resolution(void)
+{
+  static const unsigned char table[16] = {
+    // index = {local_asm, local_pause, partner_asm, partner_pause}
+    FC_NONE,  FC_NONE,  FC_NONE,  FC_NONE,
+    FC_NONE,  FC_SYMM,  FC_NONE,  FC_SYMM,
+    FC_NONE,  FC_NONE,  FC_NONE,  FC_WE_TX,
+    FC_NONE,  FC_SYMM,  FC_WE_RX, FC_SYMM
+  };
+
+  int us = eth_mac_miim_read(PHY_AUTONEG_ADV);
+  int lp = eth_mac_miim_read(PHY_LP_ABILITY);
+  int index = (((us >> 10) & 0x3) << 2) | ((lp >> 10) & 0x3);
+  ed_state.flow_control = table[index];
+
+  if (1)
+    print_flow_control(ed_state.flow_control);
+}
+
+/*
+ * Read the PHY state register to determine link state and speed
+ */
+static void
+ed_check_phy_state(void)
+{
+  int lansr = eth_mac_miim_read(PHY_LINK_AN);
+  eth_link_state_t new_state = LS_UNKNOWN;
+  int new_speed = S_UNKNOWN;
+
+  if (VERBOSE){
+    putstr("LANSR: ");
+    puthex16_nl(lansr);
+  }
+
+  if (lansr & LANSR_LINK_GOOD){		// link's up
+    if (VERBOSE)
+      puts("  LINK_GOOD");
+
+    new_state = LS_UP;
+    switch (lansr & LANSR_SPEED_MASK){
+    case LANSR_SPEED_10:
+      new_speed = 10;
+      break;
+      
+    case LANSR_SPEED_100:
+      new_speed = 100;
+      break;
+      
+    case LANSR_SPEED_1000:
+      new_speed = 1000;
+      break;
+
+    default:
+      new_speed = S_UNKNOWN;
+      break;
+    }
+
+    check_flow_control_resolution();
+  }
+  else {				// link's down
+    if (VERBOSE)
+      puts("  NOT LINK_GOOD");
+    
+    new_state = LS_DOWN;
+    new_speed = S_UNKNOWN;
+  }
+
+  if (new_state != ed_state.link_state){
+    ed_state.link_state = new_state;		// remember new state
+    if (new_state == LS_UP)
+      ed_link_up(new_speed);
+    else if (new_state == LS_DOWN)
+      ed_link_down();
+  }
+  else if (new_state == LS_UP && new_speed != ed_state.link_speed){
+    ed_state.link_speed = new_speed;		// remember new speed
+    ed_link_speed_change(new_speed);
+  }
+}
+
+/*
+ * This is fired when the ethernet PHY state changes
+ */
+static void
+eth_phy_irq_handler(unsigned irq)
+{
+  ed_check_phy_state();
+  eth_mac_miim_write(PHY_INT_CLEAR, ~0);	// clear all ints
+}
+
+void
+ethernet_init(void)
+{
+  eth_mac_init(ethernet_mac_addr());
+
+  ed_state.link_state = LS_UNKNOWN;
+  ed_state.link_speed = S_UNKNOWN;
+
+  // initialize MAC registers
+  //  eth_mac->tx_hwmark = 0x1e;
+  //eth_mac->tx_lwmark = 0x19;
+
+  //eth_mac->crc_chk_en = 1;
+  //eth_mac->rx_max_length = 2048;
+
+  // configure PAUSE frame stuff
+  //eth_mac->tx_pause_en = 1;		// pay attn to pause frames sent to us
+
+  //eth_mac->pause_quanta_set = 38;	// a bit more than 1 max frame 16kb/512 + fudge
+  //eth_mac->pause_frame_send_en = 1;	// enable sending pause frames
+
+
+  // setup PHY to interrupt on changes
+
+  unsigned mask =
+    (PHY_INT_AN_CMPL		// auto-neg completed
+     | PHY_INT_NO_LINK		// no link after auto-neg
+     | PHY_INT_NO_HCD		// no highest common denominator
+     | PHY_INT_MAS_SLA_ERR	// couldn't resolve master/slave 
+     | PHY_INT_PRL_DET_FLT	// parallel detection fault
+     | PHY_INT_LNK_CNG		// link established or broken
+     | PHY_INT_SPD_CNG		// speed changed
+     );
+
+  eth_mac_miim_write(PHY_INT_CLEAR, ~0);	// clear all pending interrupts
+  eth_mac_miim_write(PHY_INT_MASK, mask);	// enable the ones we want
+
+  pic_register_handler(IRQ_PHY, eth_phy_irq_handler);
+
+  // Advertise our flow control configuation.
+  //
+  // We and the link partner each specify two bits in the base page
+  // related to autoconfiguration: NWAY_AR_PAUSE and NWAY_AR_ASM_DIR.
+  // The bits say what a device is "willing" to do, not what may actually
+  // happen as a result of the negotiation.  There are 4 cases:
+  //
+  // PAUSE  ASM_DIR
+  //
+  //  0        0        I have no flow control capability.
+  //
+  //  1        0        I both assert and respond to flow control.
+  //
+  //  0        1        I assert flow control, but cannot respond.  That is,
+  //                    I want to be able to send PAUSE frames, but will ignore any
+  //		 	you send to me.  (This is our configuration.)
+  //
+  //  1        1        I can both assert and respond to flow control AND I am willing
+  //                    to operate symmetrically OR asymmetrically in EITHER direction.
+  //                    (We hope the link partner advertises this, otherwise we don't
+  //			get what we want.)
+
+  int t = eth_mac_miim_read(PHY_AUTONEG_ADV);
+  t &= ~(NWAY_AR_PAUSE | NWAY_AR_ASM_DIR);
+  t |= NWAY_AR_ASM_DIR;
+
+  // Say we can't to 10BASE-T or 100BASE-TX, half or full duplex
+  t &= ~(NWAY_AR_10T_HD_CAPS | NWAY_AR_10T_FD_CAPS | NWAY_AR_100TX_HD_CAPS | NWAY_AR_100TX_FD_CAPS);
+
+  eth_mac_miim_write(PHY_AUTONEG_ADV, t);
+  int r = eth_mac_miim_read(PHY_AUTONEG_ADV);  		// DEBUG, read back
+  if (t != r){
+    printf("PHY_AUTONEG_ADV: wrote 0x%x, got 0x%x\n", t, r);
+  }
+
+  // Restart autonegotation.  
+  // We want to ensure that we're advertising our PAUSE capabilities.
+  t = eth_mac_miim_read(PHY_CTRL);
+  eth_mac_miim_write(PHY_CTRL, t | MII_CR_RESTART_AUTO_NEG);
+}
+
+int
+ethernet_check_errors(void)
+{
+  // these registers are reset when read
+  
+  int	r = 0;
+  /*
+  if (eth_mac_read_rmon(0x05) != 0)
+    r |= RME_RX_CRC;
+  if (eth_mac_read_rmon(0x06) != 0)
+    r |= RME_RX_FIFO_FULL;
+  if (eth_mac_read_rmon(0x07) != 0)
+    r |= RME_RX_2SHORT_2LONG;
+  
+  if (eth_mac_read_rmon(0x25) != 0)
+    r |= RME_TX_JAM_DROP;
+  if (eth_mac_read_rmon(0x26) != 0)
+    r |= RME_TX_FIFO_UNDER;
+  if (eth_mac_read_rmon(0x27) != 0)
+    r |= RME_TX_FIFO_OVER;
+  */
+  return r;
+}
diff --git a/firmware/zpu/usrp2/memory_map.h b/firmware/zpu/usrp2/memory_map.h
new file mode 100644
index 000000000..a2de29cdb
--- /dev/null
+++ b/firmware/zpu/usrp2/memory_map.h
@@ -0,0 +1,706 @@
+/* -*- c -*- */
+/*
+ * Copyright 2007,2008,2009 Free Software Foundation, Inc.
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+/* Overall Memory Map
+ *   0000-7FFF  32K   RAM space (16K on 1500, 24K on 2000, 32K on DSP)
+ *   8000-BFFF  16K   Buffer Pool
+ *   C000-FFFF  16K   Peripherals
+ */
+
+
+#ifndef INCLUDED_MEMORY_MAP_H
+#define INCLUDED_MEMORY_MAP_H
+
+#include <stdint.h>
+
+
+#define MASTER_CLK_RATE        100000000		// 100 MHz
+
+
+////////////////////////////////////////////////////////////////
+//
+//         Memory map for embedded wishbone bus
+//
+////////////////////////////////////////////////////////////////
+
+
+////////////////////////////////////////////////////////////////
+// Main RAM, Slave 0
+
+#define RAM_BASE 0x0000
+
+////////////////////////////////////////////////////////////////
+// Buffer Pool RAM, Slave 1
+//
+// The buffers themselves are located in Slave 1, Buffer Pool RAM.
+// The status registers are in Slave 5, Buffer Pool Status.
+// The control register is in Slave 7, Settings Bus.
+
+#define BUFFER_POOL_RAM_BASE 0x8000
+
+#define BP_NLINES	   0x0200	// number of 32-bit lines in a buffer
+
+#define buffer_pool_ram \
+  ((uint32_t *) BUFFER_POOL_RAM_BASE)
+
+#define buffer_ram(n) (&buffer_pool_ram[(n) * BP_NLINES])
+
+
+/////////////////////////////////////////////////////
+// SPI Core, Slave 2.  See core docs for more info
+#define SPI_BASE 0xC000   // Base address (16-bit)
+
+typedef struct {
+  volatile uint32_t	txrx0;
+  volatile uint32_t	txrx1;
+  volatile uint32_t	txrx2;
+  volatile uint32_t	txrx3;
+  volatile uint32_t	ctrl;
+  volatile uint32_t	div;
+  volatile uint32_t	ss;
+} spi_regs_t;
+
+#define spi_regs ((spi_regs_t *) SPI_BASE)
+
+
+// Masks for controlling different peripherals
+#define SPI_SS_AD9510    1
+#define SPI_SS_AD9777    2
+#define SPI_SS_RX_DAC    4
+#define SPI_SS_RX_ADC    8
+#define SPI_SS_RX_DB    16
+#define SPI_SS_TX_DAC   32
+#define SPI_SS_TX_ADC   64
+#define SPI_SS_TX_DB   128
+#define SPI_SS_ADS64P44 256
+
+// Masks for different parts of CTRL reg
+#define SPI_CTRL_ASS      (1<<13)
+#define SPI_CTRL_IE       (1<<12)
+#define SPI_CTRL_LSB      (1<<11)
+#define SPI_CTRL_TXNEG    (1<<10)
+#define SPI_CTRL_RXNEG    (1<< 9)
+#define SPI_CTRL_GO_BSY   (1<< 8)
+#define SPI_CTRL_CHAR_LEN_MASK 0x7F
+
+////////////////////////////////////////////////
+// I2C, Slave 3
+// See Wishbone I2C-Master Core Specification.
+
+#define I2C_BASE 0xC400
+
+typedef struct {
+  volatile uint32_t  prescaler_lo;	// r/w
+  volatile uint32_t  prescaler_hi;	// r/w
+  volatile uint32_t  ctrl;		// r/w
+  volatile uint32_t  data;		// wr = transmit reg; rd = receive reg
+  volatile uint32_t  cmd_status;	// wr = command reg;  rd = status reg
+} i2c_regs_t;
+
+#define i2c_regs ((i2c_regs_t *) I2C_BASE)
+
+#define	I2C_CTRL_EN	(1 << 7)	// core enable
+#define	I2C_CTRL_IE	(1 << 6)	// interrupt enable
+
+//
+// STA, STO, RD, WR, and IACK bits are cleared automatically
+//
+#define	I2C_CMD_START	(1 << 7)	// generate (repeated) start condition
+#define I2C_CMD_STOP	(1 << 6)	// generate stop condition
+#define	I2C_CMD_RD	(1 << 5)	// read from slave
+#define I2C_CMD_WR	(1 << 4)	// write to slave
+#define	I2C_CMD_NACK	(1 << 3)	// when a rcvr, send ACK (ACK=0) or NACK (ACK=1)
+#define I2C_CMD_RSVD_2	(1 << 2)	// reserved
+#define	I2C_CMD_RSVD_1	(1 << 1)	// reserved
+#define I2C_CMD_IACK	(1 << 0)	// set to clear pending interrupt
+
+#define I2C_ST_RXACK	(1 << 7)	// Received acknowledgement from slave (1 = NAK, 0 = ACK)
+#define	I2C_ST_BUSY	(1 << 6)	// 1 after START signal detected; 0 after STOP signal detected
+#define	I2C_ST_AL	(1 << 5)	// Arbitration lost.  1 when core lost arbitration
+#define	I2C_ST_RSVD_4	(1 << 4)	// reserved
+#define	I2C_ST_RSVD_3	(1 << 3)	// reserved
+#define	I2C_ST_RSVD_2	(1 << 2)	// reserved
+#define I2C_ST_TIP	(1 << 1)	// Transfer-in-progress
+#define	I2C_ST_IP	(1 << 0)	// Interrupt pending
+
+
+////////////////////////////////////////////////
+// GPIO, Slave 4
+//
+// These go to the daughterboard i/o pins
+
+#define GPIO_BASE 0xC800
+
+typedef struct {
+  volatile uint32_t	io;	  // tx data in high 16, rx in low 16
+  volatile uint32_t     ddr;      // 32 bits, 1 means output. tx in high 16, rx in low 16
+  volatile uint32_t	tx_sel;   // 16 2-bit fields select which source goes to TX DB
+  volatile uint32_t	rx_sel;   // 16 2-bit fields select which source goes to RX DB
+} gpio_regs_t;
+
+// each 2-bit sel field is layed out this way
+#define GPIO_SEL_SW	   0 // if pin is an output, set by software in the io reg
+#define	GPIO_SEL_ATR	   1 // if pin is an output, set by ATR logic
+#define	GPIO_SEL_DEBUG_0   2 // if pin is an output, debug lines from FPGA fabric
+#define	GPIO_SEL_DEBUG_1   3 // if pin is an output, debug lines from FPGA fabric
+
+#define gpio_base ((gpio_regs_t *) GPIO_BASE)
+
+///////////////////////////////////////////////////
+// Buffer Pool Status, Slave 5
+//
+// The buffers themselves are located in Slave 1, Buffer Pool RAM.
+// The status registers are in Slave 5, Buffer Pool Status.
+// The control register is in Slave 7, Settings Bus.
+
+#define BUFFER_POOL_STATUS_BASE 0xCC00
+
+typedef struct {
+  volatile uint32_t _padding[8];
+  volatile uint32_t status;
+  volatile uint32_t hw_config;	         // see below
+  volatile uint32_t dummy[3];
+  volatile uint32_t irqs;
+  volatile uint32_t pri_enc_bp_status;
+  volatile uint32_t cycle_count;
+} buffer_pool_status_t;
+
+#define buffer_pool_status ((buffer_pool_status_t *) BUFFER_POOL_STATUS_BASE)
+
+// The hw_config register
+
+#define	HWC_SIMULATION		0x80000000
+#define	HWC_WB_CLK_DIV_MASK	0x0000000f
+
+/*!
+ * \brief return non-zero if we're running under the simulator
+ */
+inline static int
+hwconfig_simulation_p(void)
+{
+  return buffer_pool_status->hw_config & HWC_SIMULATION;
+}
+
+/*!
+ * \brief Return Wishbone Clock divisor.
+ * The processor runs at the Wishbone Clock rate which is MASTER_CLK_RATE / divisor.
+ */
+inline static int
+hwconfig_wishbone_divisor(void)
+{
+  return buffer_pool_status->hw_config & HWC_WB_CLK_DIV_MASK;
+}
+
+///////////////////////////////////////////////////
+// Ethernet Core, Slave 6
+
+#define ETH_BASE 0xD000
+
+#include "eth_mac_regs.h"
+
+#define eth_mac ((eth_mac_regs_t *) ETH_BASE)
+
+////////////////////////////////////////////////////
+// Settings Bus, Slave #7, Not Byte Addressable!
+//
+// Output-only from processor point-of-view.
+// 1KB of address space (== 256 32-bit write-only regs)
+
+
+#define MISC_OUTPUT_BASE        0xD400
+#define	TX_PROTOCOL_ENGINE_BASE 0xD480
+#define	RX_PROTOCOL_ENGINE_BASE 0xD4C0
+#define BUFFER_POOL_CTRL_BASE   0xD500
+#define LAST_SETTING_REG        0xD7FC	// last valid setting register
+
+#define SR_MISC 0
+#define SR_TX_PROT_ENG 32
+#define SR_RX_PROT_ENG 48
+#define SR_BUFFER_POOL_CTRL 64
+#define SR_UDP_SM 96
+#define SR_TX_DSP 208
+#define SR_TX_CTRL 224
+#define SR_RX_DSP 160
+#define SR_RX_CTRL 176
+#define SR_TIME64 192
+#define SR_SIMTIMER 198
+#define SR_LAST 255
+
+#define	_SR_ADDR(sr)	(MISC_OUTPUT_BASE + (sr) * sizeof(uint32_t))
+
+// --- buffer pool control regs ---
+
+typedef struct {
+  volatile uint32_t misc_ctrl;
+  volatile uint32_t ip_addr;
+  volatile uint32_t ctrl_ports; //ctrl (low 16) other (high 16)
+  volatile uint32_t data_ports; //dsp0 (low 16) dsp1 (high 16)
+  volatile uint32_t cpu_out_ctrl;
+  volatile uint32_t cpu_inp_ctrl;
+} buffer_pool_ctrl_t;
+
+#define buffer_pool_ctrl ((buffer_pool_ctrl_t *) BUFFER_POOL_CTRL_BASE)
+
+// --- misc outputs ---
+
+typedef struct {
+  volatile uint32_t	clk_ctrl;
+  volatile uint32_t	serdes_ctrl;
+  volatile uint32_t	adc_ctrl;
+  volatile uint32_t	leds;
+  volatile uint32_t	phy_ctrl;	// LSB is reset line to eth phy
+  volatile uint32_t	debug_mux_ctrl;
+  volatile uint32_t     ram_page;       // FIXME should go somewhere else...
+  volatile uint32_t     flush_icache;   // Flush the icache
+  volatile uint32_t     led_src;        // HW or SW control for LEDs
+} output_regs_t;
+
+#define CLK_RESET  (1<<4)
+#define CLK_ENABLE (1<<3) | (1<<2)
+#define CLK_SEL    (1<<1) | (1<<0)
+
+#define SERDES_ENABLE 8
+#define SERDES_PRBSEN 4
+#define SERDES_LOOPEN 2
+#define SERDES_RXEN   1
+
+#define	ADC_CTRL_ON	0x0F
+#define	ADC_CTRL_OFF	0x00
+
+// crazy order that matches the labels on the case
+
+#define	LED_A		(1 << 4)
+#define	LED_B		(1 << 1)
+#define	LED_C		(1 << 3)
+#define	LED_D		(1 << 0)
+#define	LED_E		(1 << 2)
+//      LED_F		// controlled by CPLD
+#define	LED_RJ45	(1 << 5)
+
+#define output_regs ((output_regs_t *) MISC_OUTPUT_BASE)
+
+// --- udp tx regs ---
+
+typedef struct {
+  // Bits 19:16 are control info; bits 15:0 are data (see below)
+  // First two words are unused.
+  volatile uint32_t _nope[2];
+  //--- ethernet header - 14 bytes---
+  volatile struct{
+    uint32_t mac_dst_0_1; //word 2
+    uint32_t mac_dst_2_3;
+    uint32_t mac_dst_4_5;
+    uint32_t mac_src_0_1;
+    uint32_t mac_src_2_3;
+    uint32_t mac_src_4_5;
+    uint32_t ether_type; //word 8
+  } eth_hdr;
+  //--- ip header - 20 bytes ---
+  volatile struct{
+    uint32_t ver_ihl_tos; //word 9
+    uint32_t total_length;
+    uint32_t identification;
+    uint32_t flags_frag_off;
+    uint32_t ttl_proto;
+    uint32_t checksum;
+    uint32_t src_addr_high;
+    uint32_t src_addr_low;
+    uint32_t dst_addr_high;
+    uint32_t dst_addr_low; //word 18
+  } ip_hdr;
+  //--- udp header - 8 bytes ---
+  volatile struct{
+    uint32_t src_port; //word 19
+    uint32_t dst_port;
+    uint32_t length;
+    uint32_t checksum; //word 22
+  } udp_hdr;
+  volatile uint32_t _pad[1];
+  volatile uint32_t dsp0_port;
+  volatile uint32_t err0_port;
+  volatile uint32_t dsp1_port;
+  volatile uint32_t err1_port;
+} sr_udp_sm_t;
+
+// control bits (all expect UDP_SM_LAST_WORD are mutually exclusive)
+
+// Insert a UDP source port from the table
+#define UDP_SM_INS_UDP_SRC_PORT     (1 << 21)
+
+// Insert a UDP dest port from the table
+#define UDP_SM_INS_UDP_DST_PORT     (1 << 20)
+
+// This is the last word of the header
+#define	UDP_SM_LAST_WORD		(1 << 19)
+
+// Insert IP header checksum here.  Data is the xor of 16'hFFFF and
+// the values written into regs 9-13 and 15-18.
+#define	UDP_SM_INS_IP_HDR_CHKSUM	(1 << 18)
+
+// Insert IP Length here (data ignored)
+#define	UDP_SM_INS_IP_LEN		(1 << 17)
+
+// Insert UDP Length here (data ignore)
+#define	UDP_SM_INS_UDP_LEN		(1 << 16)
+
+#define sr_udp_sm ((sr_udp_sm_t *) _SR_ADDR(SR_UDP_SM))
+
+// --- dsp tx regs ---
+
+#define MIN_CIC_INTERP	1
+#define	MAX_CIC_INTERP  128
+
+typedef struct {
+  volatile uint32_t     num_chan;
+  volatile uint32_t     clear_state;	// clears out state machine, fifos,
+  volatile uint32_t     report_sid;
+  volatile uint32_t     policy;
+  volatile uint32_t     cyc_per_up;
+  volatile uint32_t     packets_per_up;
+} sr_tx_ctrl_t;
+
+#define sr_tx_ctrl ((sr_tx_ctrl_t *) _SR_ADDR(SR_TX_CTRL))
+
+typedef struct {
+  volatile int32_t	freq;
+  volatile uint32_t	scale_iq;	// {scale_i,scale_q}
+  volatile uint32_t     interp_rate;
+  volatile uint32_t     _padding0;      // padding for the tx_mux
+                                        //   NOT freq, scale, interp
+  /*!
+   * \brief output mux configuration.
+   *
+   * <pre>
+   *     3                   2                   1                       
+   *   1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0
+   *  +-------------------------------+-------+-------+-------+-------+
+   *  |                                               | DAC1  |  DAC0 |
+   *  +-------------------------------+-------+-------+-------+-------+
+   * 
+   *  There are N DUCs (1 now) with complex inputs and outputs.
+   *  There are two DACs.
+   * 
+   *  Each 4-bit DACx field specifies the source for the DAC
+   *  Each subfield is coded like this: 
+   * 
+   *     3 2 1 0
+   *    +-------+
+   *    |   N   |
+   *    +-------+
+   * 
+   *  N specifies which DUC output is connected to this DAC.
+   * 
+   *   N   which interp output
+   *  ---  -------------------
+   *   0   DUC 0 I
+   *   1   DUC 0 Q
+   *   2   DUC 1 I
+   *   3   DUC 1 Q
+   *   F   All Zeros
+   *   
+   * The default value is 0x10
+   * </pre>
+   */
+  volatile uint32_t	tx_mux;
+
+} dsp_tx_regs_t;
+  
+#define dsp_tx_regs ((dsp_tx_regs_t *) _SR_ADDR(SR_TX_DSP))
+
+// --- VITA RX CTRL regs ---
+typedef struct {
+  // The following 3 are logically a single command register.
+  // They are clocked into the underlying fifo when time_ticks is written.
+  volatile uint32_t	cmd;		// {now, chain, num_samples(30)
+  volatile uint32_t	time_secs;
+  volatile uint32_t	time_ticks;
+
+  volatile uint32_t	clear_overrun;	// write anything to clear overrun
+  volatile uint32_t	vrt_header;	// word 0 of packet.  FPGA fills in packet counter
+  volatile uint32_t	vrt_stream_id;	// word 1 of packet. 
+  volatile uint32_t	vrt_trailer;
+  volatile uint32_t	nsamples_per_pkt;
+  volatile uint32_t     nchannels;      // 1 in basic case, up to 4 for vector sources
+  volatile uint32_t     pad[7];         // Make each structure 16 elements long
+} sr_rx_ctrl_t;
+
+#define sr_rx_ctrl ((sr_rx_ctrl_t *) _SR_ADDR(SR_RX_CTRL))
+
+// --- dsp rx regs ---
+#define	MIN_CIC_DECIM	1
+#define	MAX_CIC_DECIM   128
+
+typedef struct {
+  volatile int32_t	freq;
+  volatile uint32_t	scale_iq;	// {scale_i,scale_q}
+  volatile uint32_t     decim_rate;
+  volatile uint32_t     dcoffset_i;     // Bit 31 high sets fixed offset mode, using lower 14 bits,
+                                        // otherwise it is automatic 
+  volatile uint32_t     dcoffset_q;     // Bit 31 high sets fixed offset mode, using lower 14 bits
+
+  /*!
+   * \brief input mux configuration.
+   *
+   * This determines which ADC (or constant zero) is connected to 
+   * each DDC input.  There are N DDCs (1 now).  Each has two inputs.
+   *
+   * <pre>
+   * Mux value:
+   *
+   *    3                   2                   1                       
+   *  1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0
+   * +-------+-------+-------+-------+-------+-------+-------+-------+
+   * |                                                       |Q0 |I0 |
+   * +-------+-------+-------+-------+-------+-------+-------+-------+
+   *
+   * Each 2-bit I field is either 00 (A/D A), 01 (A/D B) or 1X (const zero)
+   * Each 2-bit Q field is either 00 (A/D A), 01 (A/D B) or 1X (const zero)
+   *
+   * The default value is 0x4
+   * </pre>
+   */
+  volatile uint32_t     rx_mux;        // called adc_mux in dsp_core_rx.v
+
+  /*!
+   * \brief Streaming GPIO configuration
+   *
+   * This determines whether the LSBs of I and Q samples come from the DSP
+   * pipeline or from the io_rx GPIO pins.  To stream GPIO, one must first
+   * set the GPIO data direction register to have io_rx[15] and/or io_rx[14]
+   * configured as inputs.  The GPIO pins will be sampled at the time the
+   * remainder of the DSP sample is strobed into the RX sample FIFO.  There
+   * will be a decimation-dependent fixed time offset between the GPIO
+   * sample stream and the associated RF samples.
+   *
+   *    3                   2                   1                       
+   *  1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0
+   * +-------+-------+-------+-------+-------+-------+-------+-------+
+   * |                           MBZ                             |Q|I|
+   * +-------+-------+-------+-------+-------+-------+-------+-------+
+   *
+   * I         0=LSB comes from DSP pipeline (default)
+   *           1=LSB comes from io_rx[15]
+   * 
+   * Q         0=LSB comes from DSP pipeline (default)
+   *           1=LSB comes from io_rx[14]
+   */
+  volatile uint32_t gpio_stream_enable;
+
+} dsp_rx_regs_t;
+  
+#define dsp_rx_regs ((dsp_rx_regs_t *) _SR_ADDR(SR_RX_DSP))
+
+// ----------------------------------------------------------------
+// VITA49 64 bit time (write only)
+  /*!
+   * \brief Time 64 flags
+   *
+   * <pre>
+   *
+   *    3                   2                   1                       
+   *  1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0 9 8 7 6 5 4 3 2 1 0
+   * +-----------------------------------------------------------+-+-+
+   * |                                                           |S|P|
+   * +-----------------------------------------------------------+-+-+
+   *
+   * P - PPS edge selection (0=negedge, 1=posedge, default=0)
+   * S - Source (0=sma, 1=mimo, 0=default)
+   *
+   * </pre>
+   */
+typedef struct {
+  volatile uint32_t	secs;	// value to set absolute secs to on next PPS
+  volatile uint32_t	ticks;	// value to set absolute ticks to on next PPS
+  volatile uint32_t flags;  // flags - see chart above
+  volatile uint32_t imm;    // set immediate (0=latch on next pps, 1=latch immediate, default=0)
+} sr_time64_t;
+
+#define sr_time64 ((sr_time64_t *) _SR_ADDR(SR_TIME64))
+
+
+/* 
+ * --- ethernet tx protocol engine regs (write only) ---
+ *
+ * These registers control the transmit portion of the ethernet
+ * protocol engine (out of USRP2).  The protocol engine handles fifo
+ * status and sequence number insertion in outgoing packets, and
+ * automagically generates status packets when required to inform the
+ * host of changes in fifo availability.
+ *
+ * All outgoing packets have their fifo_status field set to the number
+ * of 32-bit lines of fifo available in the ethernet Rx fifo (see
+ * usrp2_eth_packet.h).  Seqno's are set if FIXME, else 0.
+ *
+ * FIXME clean this up once we know how it's supposed to behave.
+ */
+
+typedef struct {
+  volatile uint32_t  flags;	     // not yet fully defined (channel?)
+  volatile uint32_t  mac_dst0123;    // 4 bytes of destination mac addr
+  volatile uint32_t  mac_dst45src01; // 2 bytes of dest mac addr; 2 bytes of src mac addr
+  volatile uint32_t  mac_src2345;    // 4 bytes of destination mac addr
+  volatile uint32_t  seqno;	     // Write to init seqno.  It autoincs on match
+} tx_proto_engine_regs_t;
+
+#define tx_proto_engine ((tx_proto_engine_regs_t *) TX_PROTOCOL_ENGINE_BASE)
+
+/*
+ * --- ethernet rx protocol engine regs (write only) ---
+ *
+ * These registers control the receive portion of the ethernet
+ * protocol engine (into USRP2).  The protocol engine offloads common
+ * packet inspection operations so that firmware has less to do on
+ * "fast path" packets.
+ *
+ * The registers define conditions which must be matched for a packet
+ * to be considered a "fast path" packet.  If a received packet
+ * matches the src and dst mac address, ethertype, flags field, and
+ * expected seqno number it is considered a "fast path" packet, and
+ * the expected seqno is updated.  If the packet fails to satisfy any
+ * of the above conditions it's a "slow path" packet, and the
+ * corresponding SLOWPATH flag will be set buffer_status register.
+ */
+
+typedef struct {
+  volatile uint32_t  flags;	     // not yet fully defined (channel?)
+  volatile uint32_t  mac_dst0123;    // 4 bytes of destination mac addr
+  volatile uint32_t  mac_dst45src01; // 2 bytes of dest mac addr; 2 bytes of src mac addr
+  volatile uint32_t  mac_src2345;    // 4 bytes of destination mac addr
+  volatile uint32_t  ethertype_pad;  // ethertype in high 16-bits
+} rx_proto_engine_regs_t;
+
+#define rx_proto_engine ((rx_proto_engine_regs_t *) RX_PROTOCOL_ENGINE_BASE)
+
+
+
+///////////////////////////////////////////////////
+// Simple Programmable Interrupt Controller, Slave 8
+
+#define PIC_BASE  0xD800
+
+// Interrupt request lines
+// Bit numbers (LSB == 0) that correpond to interrupts into PIC
+
+#define	IRQ_BUFFER	0	// buffer manager
+#define	IRQ_ONETIME	1
+#define	IRQ_SPI		2
+#define	IRQ_I2C		3
+#define	IRQ_PHY		4	// ethernet PHY
+#define	IRQ_UNDERRUN	5
+#define	IRQ_OVERRUN	6
+#define	IRQ_PPS		7	// pulse per second
+#define	IRQ_UART_RX	8
+#define	IRQ_UART_TX	9
+#define	IRQ_SERDES	10
+#define	IRQ_CLKSTATUS	11
+#define IRQ_PERIODIC    12
+
+#define IRQ_TO_MASK(x) (1 << (x))
+
+#define PIC_BUFFER_INT    IRQ_TO_MASK(IRQ_BUFFER)
+#define PIC_ONETIME_INT   IRQ_TO_MASK(IRQ_ONETIME)
+#define PIC_SPI_INT       IRQ_TO_MASK(IRQ_SPI)
+#define PIC_I2C_INT       IRQ_TO_MASK(IRQ_I2C)
+#define PIC_PHY_INT       IRQ_TO_MASK(IRQ_PHY)
+#define PIC_UNDERRUN_INT  IRQ_TO_MASK(IRQ_UNDERRUN)
+#define PIC_OVERRUN_INT   IRQ_TO_MASK(IRQ_OVERRUN)
+#define PIC_PPS_INT   	  IRQ_TO_MASK(IRQ_PPS)
+#define PIC_UART_RX_INT   IRQ_TO_MASK(IRQ_UART_RX)
+#define PIC_UART_TX_INT   IRQ_TO_MASK(IRQ_UART_TX)
+#define PIC_SERDES        IRQ_TO_MASK(IRQ_SERDES)
+#define PIC_CLKSTATUS     IRQ_TO_MASK(IRQ_CLKSTATUS)
+
+typedef struct {
+  volatile uint32_t edge_enable; // mask: 1 -> edge triggered, 0 -> level
+  volatile uint32_t polarity;	 // mask: 1 -> rising edge
+  volatile uint32_t mask;	 // mask: 1 -> disabled
+  volatile uint32_t pending;	 // mask: 1 -> pending; write 1's to clear pending ints
+} pic_regs_t;
+
+#define pic_regs ((pic_regs_t *) PIC_BASE)
+
+// ----------------------------------------------------------------
+// WB_CLK_RATE is the time base for this
+typedef struct {
+  volatile uint32_t	onetime;   // Number of wb clk cycles till the onetime interrupt
+  volatile uint32_t	periodic;  // Repeat rate of periodic interrupt
+} sr_simple_timer_t;
+
+#define sr_simple_timer ((sr_simple_timer_t *) _SR_ADDR(SR_SIMTIMER))
+
+///////////////////////////////////////////////////
+// UART, Slave 10
+
+#define UART_BASE  0xE000
+
+typedef struct {
+  //  All elements are 8 bits except for clkdiv (16), but we use uint32 to make 
+  //    the hardware for decoding easier
+  volatile uint32_t clkdiv;  // Set to 50e6 divided by baud rate (no x16 factor)
+  volatile uint32_t txlevel; // Number of spaces in the FIFO for writes
+  volatile uint32_t rxlevel; // Number of available elements in the FIFO for reads
+  volatile uint32_t txchar;  // Write characters to be sent here
+  volatile uint32_t rxchar;  // Read received characters here
+} uart_regs_t;
+
+#define uart_regs ((uart_regs_t *) UART_BASE)
+
+///////////////////////////////////////////////////
+// ATR Controller, Slave 11
+
+#define ATR_BASE  0xE400
+
+typedef struct {
+  volatile uint32_t	v[16];
+} atr_regs_t;
+
+#define	ATR_IDLE	0x0	// indicies into v
+#define ATR_TX		0x1
+#define	ATR_RX		0x2
+#define	ATR_FULL	0x3
+
+#define atr_regs ((atr_regs_t *) ATR_BASE)
+
+///////////////////////////////////////////////////
+// SD Card SPI interface, Slave 13
+//   All regs are 8 bits wide, but are accessed as if they are 32 bits
+
+#define SDSPI_BASE  0xEC00
+
+typedef struct {
+  volatile uint32_t status;  // Write a 1 or 0 for controlling CS
+  volatile uint32_t clkdiv;
+  volatile uint32_t send_dat;
+  volatile uint32_t receive_dat;
+} sdspi_regs_t;
+
+#define sdspi_regs ((sdspi_regs_t *) SDSPI_BASE)
+
+///////////////////////////////////////////////////
+// External RAM interface, Slave 14
+//   Pages are 1K.  Page is 10 bits, set by a control register
+//    output_regs->ram_page
+
+#define EXTRAM_BASE 0xF000
+#define extram ((volatile uint32_t *) EXTRAM_BASE)
+
+
+///////////////////////////////////////////////////
+
+#endif
+
diff --git a/firmware/zpu/usrp2/sd.c b/firmware/zpu/usrp2/sd.c
new file mode 100644
index 000000000..d000b28ae
--- /dev/null
+++ b/firmware/zpu/usrp2/sd.c
@@ -0,0 +1,197 @@
+/* -*- c -*- */
+/*
+ * Copyright 2008 Ettus Research LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#include "sd.h"
+#include "memory_map.h"
+#include "stdint.h"
+#include "stdio.h"
+
+static inline void
+sd_packarg(unsigned char *argument,unsigned int value)
+{
+  argument[3] = (unsigned char)(value >> 24);
+  argument[2] = (unsigned char)(value >> 16);
+  argument[1] = (unsigned char)(value >> 8);
+  argument[0] = (unsigned char)(value);
+}
+
+int
+sd_init(void)
+{
+  unsigned char response[5];
+  unsigned char argument[4];
+  int i,j;
+
+  for(i=0;i<4;i++)
+    argument[i] = 0;
+
+  // Set clock to less than 400 kHz to start out
+  sdspi_regs->clkdiv = 128;
+
+  // Delay at least 74 cycles
+  sd_assert_cs();
+  for(i = 0; i < 100; i++)
+    sd_send_byte(SD_IDLE);
+  sd_deassert_cs();
+  
+  // Initialization Sequence -- CMD0 CMD55 ACMD41 CMD58
+  // Put card in idle state
+  if(sd_send_command(SD_CMD0,SD_CMD0_R,response,argument)==0)
+    return 0;  // Something went wrong in command
+
+  j = 0;
+  do {
+    j++;
+    if(sd_send_command(SD_CMD55,SD_CMD55_R,response,argument)==1)
+      sd_send_command(SD_ACMD41,SD_ACMD41_R,response,argument);
+    else
+      j = SD_IDLE_WAIT_MAX;
+  }
+  while(((response[0] & SD_MSK_IDLE) == SD_MSK_IDLE) && (j < SD_IDLE_WAIT_MAX));
+
+  if(j>= SD_IDLE_WAIT_MAX)  // IDLE timeout exceeded, card asleep
+    return 0;
+  
+  // CMD58 reads the SD card capabilities
+  if(sd_send_command(SD_CMD58,SD_CMD58_R,response,argument)==0)
+    return 0;  // CMD58 FAIL
+
+  if((response[2] & SD_MSK_OCR_33) != SD_MSK_OCR_33)
+    return 0;  // Card doesn't do 3.3V
+
+  //printf("OCR = %x %x %x %x\n",response[0],response[1],response[2],response[3]);
+
+  // Set blocklen here
+  sd_packarg(argument,SD_BLOCKLEN);
+  if(sd_send_command(SD_CMD16,SD_CMD16_R,response,argument)==0)
+    return 0;    // Set Blocklen failed
+  
+  // Reset back to high speed
+  sdspi_regs->clkdiv = 4;
+  //puts("finished init\n");
+  return 1;
+}
+
+int sd_send_command(unsigned char cmd,unsigned char response_type,
+		    unsigned char *response,unsigned char *argument)
+{
+  int i;
+  char response_length;
+  unsigned char tmp;
+
+  sd_assert_cs();
+  sd_send_byte((cmd & 0x3F) | 0x40);
+  for(i=3;i>=0;i--)
+    sd_send_byte(argument[i]);
+  sd_send_byte(SD_CRC);   // Always the same
+
+  response_length = 0;
+  switch(response_type)
+    {
+    case SD_R1:
+    case SD_R1B:
+      response_length = 1;
+      break;
+    case SD_R2:
+      response_length = 2;
+      break;
+    case SD_R3:
+      response_length = 5;
+      break;
+    default:
+      break;
+    }
+
+  // Wait for a response, which will have a 0 start bit
+  i = 0;
+  do
+    {
+      tmp = sd_rcv_byte();
+      i++;
+    }
+  while(((tmp & 0x80) != 0) && i < SD_CMD_TIMEOUT);
+
+  if(i>= SD_CMD_TIMEOUT)
+    {
+      sd_deassert_cs();
+      //puts("cmd send timeout\n");
+      return 0;
+    }
+
+  for(i=response_length-1; i>=0; i--)
+    {
+      response[i] = tmp;
+      tmp = sd_rcv_byte();
+    }
+  i = 0;
+  if(response_type == SD_R1B)
+    {
+      do
+	{
+	  i++;
+	  tmp = sd_rcv_byte();
+	}
+      while(tmp != SD_IDLE);
+      sd_send_byte(SD_IDLE);
+    }
+  
+  //puts("send cmd success\n");
+  sd_deassert_cs();
+  return 1;
+}
+
+int
+sd_read_block (unsigned int blockaddr, unsigned char *buf)
+{
+  unsigned char response[5];
+  unsigned char argument[4];
+  unsigned int i = 0;
+  unsigned char tmp;
+
+  blockaddr <<= SD_BLOCKLEN_NBITS;
+  sd_packarg(argument,blockaddr);
+  if(sd_send_command(SD_CMD17,SD_CMD17_R,response,argument)==0)
+    return 0;    //Failed READ;
+  if(response[0] != 0)
+    return 0;    //Misaligned READ
+
+  sd_assert_cs();
+  i = 0;
+  do
+    {
+      tmp = sd_rcv_byte();
+      i++;
+    }
+  while((tmp == 0xFF) && (i < SD_RD_TIMEOUT));
+  if((i>= SD_RD_TIMEOUT) ||((tmp & SD_MSK_TOK_DATAERROR) == 0))
+    {
+      sd_send_byte(SD_IDLE);  // Send a dummy before quitting
+      return 0;   // Data ERROR
+    }
+  for(i=0;i<SD_BLOCKLEN;i++)
+    buf[i] = sd_rcv_byte();
+  return 1;
+
+}
+
+int
+sd_write_block(unsigned int blockaddr, const unsigned char *buf)
+{
+  // FIXME not implemented yet
+  return 0;
+}
diff --git a/firmware/zpu/usrp2/sd.h b/firmware/zpu/usrp2/sd.h
new file mode 100644
index 000000000..e2d0ae38e
--- /dev/null
+++ b/firmware/zpu/usrp2/sd.h
@@ -0,0 +1,122 @@
+/* -*- c -*- */
+/*
+ * Copyright 2008 Ettus Research LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+#ifndef INCLUDED_SD_H
+#define INCLUDED_SD_H
+
+#include "memory_map.h"
+
+#define SD_READY 1
+#define SD_IDLE_WAIT_MAX 100
+#define SD_CMD_TIMEOUT 100
+#define SD_RD_TIMEOUT 1000
+
+#define SD_CMD0 0
+#define SD_CMD1 1
+#define SD_CMD9 9
+#define SD_CMD10 10
+#define SD_CMD12 12
+#define SD_CMD13 13
+#define SD_CMD16 16
+#define SD_CMD17 17 
+#define SD_CMD18 18
+#define SD_CMD24 24
+#define SD_CMD25 25
+#define SD_CMD27 27
+#define SD_CMD28 28
+#define SD_CMD29 29
+#define SD_CMD30 30
+#define SD_CMD32 32
+#define SD_CMD33 33
+#define SD_CMD38 38
+#define SD_CMD55 55
+#define SD_CMD58 58
+#define SD_CMD59 59
+#define SD_ACMD41 41
+#define SD_IDLE 0xFF
+#define SD_CRC 0x95
+
+#define SD_R1 1
+#define SD_R1B 2
+#define SD_R2 3
+#define SD_R3 4
+
+#define SD_CMD0_R SD_R1
+#define SD_CMD16_R SD_R1
+#define SD_CMD17_R SD_R1
+#define SD_CMD55_R SD_R1
+#define SD_ACMD41_R SD_R1
+#define SD_CMD58_R SD_R3
+
+#define SD_BLOCKLEN 512
+#define SD_BLOCKLEN_NBITS 9
+
+#define SD_MSK_IDLE 0x01
+#define SD_MSK_OCR_33 0xC0
+#define SD_MSK_TOK_DATAERROR 0xE0
+
+
+int sd_init(void);
+
+static inline void
+sd_assert_cs(void)
+{
+  // Wait for idle before doing anything
+  while(sdspi_regs->status != SD_READY)
+    ;
+  sdspi_regs->status = 1;
+}
+
+static inline void
+sd_deassert_cs(void)
+{
+  // Wait for idle before doing anything
+  while(sdspi_regs->status != SD_READY)
+    ;
+  sdspi_regs->status = 0;
+}
+
+static inline char
+sd_rcv_byte(void)
+{
+  // Wait for idle before doing anything
+  while(sdspi_regs->status != SD_READY)
+    ;
+  sdspi_regs->send_dat = SD_IDLE;
+  while(sdspi_regs->status != SD_READY)
+    ;
+  return sdspi_regs-> receive_dat;
+}
+
+static inline void
+sd_send_byte(char dat)
+{
+  // Wait for idle before doing anything
+  while(sdspi_regs->status != SD_READY)
+    ;      // Wait for status = 1 (ready)
+  sdspi_regs->send_dat = dat;
+}
+
+
+int sd_send_command(unsigned char cmd,unsigned char response_type,
+		    unsigned char *response,unsigned char *argument);
+
+int sd_read_block (unsigned int blockaddr, unsigned char *buf);
+int sd_write_block(unsigned int blockaddr, const unsigned char *buf);
+
+#endif /* INCLUDED_SD_H */
diff --git a/firmware/zpu/usrp2/udp_fw_update.c b/firmware/zpu/usrp2/udp_fw_update.c
new file mode 100644
index 000000000..14eb0b1ee
--- /dev/null
+++ b/firmware/zpu/usrp2/udp_fw_update.c
@@ -0,0 +1,34 @@
+/* -*- c++ -*- */
+/*
+ * Copyright 2010 Ettus Research LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <http://www.gnu.org/licenses/>.
+ */
+
+//Routines to handle updating the SPI Flash firmware via UDP
+
+#include "net_common.h"
+#include "usrp2/fw_common.h"
+#include <nonstdio.h>
+#include "udp_fw_update.h"
+
+//Firmware update packet handler
+void handle_udp_fw_update_packet(struct socket_address src, struct socket_address dst,
+                                 unsigned char *payload, int payload_len) {
+
+  usrp2_fw_update_data_t update_data_out;
+  update_data_out.id = USRP2_FW_UPDATE_ID_WAT;
+
+  send_udp_pkt(USRP2_UDP_UPDATE_PORT, src, &update_data_out, sizeof(update_data_out));
+}