| 1 | /* |
| 2 | * SMSC 91C111 Ethernet interface emulation |
| 3 | * |
| 4 | * Copyright (c) 2005 CodeSourcery, LLC. |
| 5 | * Written by Paul Brook |
| 6 | * |
| 7 | * This code is licensed under the GPL |
| 8 | */ |
| 9 | |
| 10 | #include "qemu/osdep.h" |
| 11 | #include "hw/core/sysbus.h" |
| 12 | #include "migration/vmstate.h" |
| 13 | #include "net/net.h" |
| 14 | #include "hw/core/irq.h" |
| 15 | #include "hw/net/smc91c111.h" |
| 16 | #include "hw/core/registerfields.h" |
| 17 | #include "hw/core/qdev-properties.h" |
| 18 | #include "qapi/error.h" |
| 19 | #include "qemu/log.h" |
| 20 | #include "qemu/module.h" |
| 21 | #include <zlib.h> /* for crc32 */ |
| 22 | #include "qom/object.h" |
| 23 | |
| 24 | /* Number of 2k memory pages available. */ |
| 25 | #define NUM_PACKETS 4 |
| 26 | /* |
| 27 | * Maximum size of a data frame, including the leading status word |
| 28 | * and byte count fields and the trailing CRC, last data byte |
| 29 | * and control byte (per figure 8-1 in the Microchip Technology |
| 30 | * LAN91C111 datasheet). |
| 31 | */ |
| 32 | #define MAX_PACKET_SIZE 2048 |
| 33 | /* |
| 34 | * Size of the non-data fields in a data frame: status word, |
| 35 | * byte count, control byte, and last data byte; this defines |
| 36 | * the smallest value the byte count in the frame can validly be. |
| 37 | */ |
| 38 | #define MIN_PACKET_SIZE 6 |
| 39 | |
| 40 | #define TYPE_SMC91C111 "smc91c111" |
| 41 | OBJECT_DECLARE_SIMPLE_TYPE(smc91c111_state, SMC91C111) |
| 42 | |
| 43 | struct smc91c111_state { |
| 44 | SysBusDevice parent_obj; |
| 45 | |
| 46 | NICState *nic; |
| 47 | NICConf conf; |
| 48 | uint16_t tcr; |
| 49 | uint16_t rcr; |
| 50 | uint16_t cr; |
| 51 | uint16_t ctr; |
| 52 | uint16_t gpr; |
| 53 | uint16_t ptr; |
| 54 | uint16_t ercv; |
| 55 | qemu_irq irq; |
| 56 | int bank; |
| 57 | int packet_num; |
| 58 | int tx_alloc; |
| 59 | /* Bitmask of allocated packets. */ |
| 60 | int allocated; |
| 61 | int tx_fifo_len; |
| 62 | int tx_fifo[NUM_PACKETS]; |
| 63 | int rx_fifo_len; |
| 64 | int rx_fifo[NUM_PACKETS]; |
| 65 | int tx_fifo_done_len; |
| 66 | int tx_fifo_done[NUM_PACKETS]; |
| 67 | /* Packet buffer memory. */ |
| 68 | uint8_t data[NUM_PACKETS][MAX_PACKET_SIZE]; |
| 69 | uint8_t int_level; |
| 70 | uint8_t int_mask; |
| 71 | MemoryRegion mmio; |
| 72 | }; |
| 73 | |
| 74 | static const VMStateDescription vmstate_smc91c111 = { |
| 75 | .name = "smc91c111", |
| 76 | .version_id = 1, |
| 77 | .minimum_version_id = 1, |
| 78 | .fields = (const VMStateField[]) { |
| 79 | VMSTATE_UINT16(tcr, smc91c111_state), |
| 80 | VMSTATE_UINT16(rcr, smc91c111_state), |
| 81 | VMSTATE_UINT16(cr, smc91c111_state), |
| 82 | VMSTATE_UINT16(ctr, smc91c111_state), |
| 83 | VMSTATE_UINT16(gpr, smc91c111_state), |
| 84 | VMSTATE_UINT16(ptr, smc91c111_state), |
| 85 | VMSTATE_UINT16(ercv, smc91c111_state), |
| 86 | VMSTATE_INT32(bank, smc91c111_state), |
| 87 | VMSTATE_INT32(packet_num, smc91c111_state), |
| 88 | VMSTATE_INT32(tx_alloc, smc91c111_state), |
| 89 | VMSTATE_INT32(allocated, smc91c111_state), |
| 90 | VMSTATE_INT32(tx_fifo_len, smc91c111_state), |
| 91 | VMSTATE_INT32_ARRAY(tx_fifo, smc91c111_state, NUM_PACKETS), |
| 92 | VMSTATE_INT32(rx_fifo_len, smc91c111_state), |
| 93 | VMSTATE_INT32_ARRAY(rx_fifo, smc91c111_state, NUM_PACKETS), |
| 94 | VMSTATE_INT32(tx_fifo_done_len, smc91c111_state), |
| 95 | VMSTATE_INT32_ARRAY(tx_fifo_done, smc91c111_state, NUM_PACKETS), |
| 96 | VMSTATE_BUFFER_UNSAFE(data, smc91c111_state, 0, |
| 97 | NUM_PACKETS * MAX_PACKET_SIZE), |
| 98 | VMSTATE_UINT8(int_level, smc91c111_state), |
| 99 | VMSTATE_UINT8(int_mask, smc91c111_state), |
| 100 | VMSTATE_END_OF_LIST() |
| 101 | } |
| 102 | }; |
| 103 | |
| 104 | #define RCR_SOFT_RST 0x8000 |
| 105 | #define RCR_STRIP_CRC 0x0200 |
| 106 | #define RCR_RXEN 0x0100 |
| 107 | |
| 108 | #define TCR_EPH_LOOP 0x2000 |
| 109 | #define TCR_NOCRC 0x0100 |
| 110 | #define TCR_PAD_EN 0x0080 |
| 111 | #define TCR_FORCOL 0x0004 |
| 112 | #define TCR_LOOP 0x0002 |
| 113 | #define TCR_TXEN 0x0001 |
| 114 | |
| 115 | #define INT_MD 0x80 |
| 116 | #define INT_ERCV 0x40 |
| 117 | #define INT_EPH 0x20 |
| 118 | #define INT_RX_OVRN 0x10 |
| 119 | #define INT_ALLOC 0x08 |
| 120 | #define INT_TX_EMPTY 0x04 |
| 121 | #define INT_TX 0x02 |
| 122 | #define INT_RCV 0x01 |
| 123 | |
| 124 | #define CTR_AUTO_RELEASE 0x0800 |
| 125 | #define CTR_RELOAD 0x0002 |
| 126 | #define CTR_STORE 0x0001 |
| 127 | |
| 128 | #define RS_ALGNERR 0x8000 |
| 129 | #define RS_BRODCAST 0x4000 |
| 130 | #define RS_BADCRC 0x2000 |
| 131 | #define RS_ODDFRAME 0x1000 |
| 132 | #define RS_TOOLONG 0x0800 |
| 133 | #define RS_TOOSHORT 0x0400 |
| 134 | #define RS_MULTICAST 0x0001 |
| 135 | |
| 136 | FIELD(PTR, PTR, 0, 11) |
| 137 | FIELD(PTR, NOT_EMPTY, 11, 1) |
| 138 | FIELD(PTR, RESERVED, 12, 1) |
| 139 | FIELD(PTR, READ, 13, 1) |
| 140 | FIELD(PTR, AUTOINCR, 14, 1) |
| 141 | FIELD(PTR, RCV, 15, 1) |
| 142 | |
| 143 | static inline bool packetnum_valid(int packet_num) |
| 144 | { |
| 145 | return packet_num >= 0 && packet_num < NUM_PACKETS; |
| 146 | } |
| 147 | |
| 148 | /* Update interrupt status. */ |
| 149 | static void smc91c111_update(smc91c111_state *s) |
| 150 | { |
| 151 | int level; |
| 152 | |
| 153 | if (s->tx_fifo_len == 0) |
| 154 | s->int_level |= INT_TX_EMPTY; |
| 155 | if (s->tx_fifo_done_len != 0) |
| 156 | s->int_level |= INT_TX; |
| 157 | level = (s->int_level & s->int_mask) != 0; |
| 158 | qemu_set_irq(s->irq, level); |
| 159 | } |
| 160 | |
| 161 | static bool smc91c111_can_receive(smc91c111_state *s) |
| 162 | { |
| 163 | if ((s->rcr & RCR_RXEN) == 0 || (s->rcr & RCR_SOFT_RST)) { |
| 164 | return true; |
| 165 | } |
| 166 | if (s->allocated == (1 << NUM_PACKETS) - 1 || |
| 167 | s->rx_fifo_len == NUM_PACKETS) { |
| 168 | return false; |
| 169 | } |
| 170 | return true; |
| 171 | } |
| 172 | |
| 173 | static inline void smc91c111_flush_queued_packets(smc91c111_state *s) |
| 174 | { |
| 175 | if (smc91c111_can_receive(s)) { |
| 176 | qemu_flush_queued_packets(qemu_get_queue(s->nic)); |
| 177 | } |
| 178 | } |
| 179 | |
| 180 | /* Try to allocate a packet. Returns 0x80 on failure. */ |
| 181 | static int smc91c111_allocate_packet(smc91c111_state *s) |
| 182 | { |
| 183 | int i; |
| 184 | if (s->allocated == (1 << NUM_PACKETS) - 1) { |
| 185 | return 0x80; |
| 186 | } |
| 187 | |
| 188 | for (i = 0; i < NUM_PACKETS; i++) { |
| 189 | if ((s->allocated & (1 << i)) == 0) |
| 190 | break; |
| 191 | } |
| 192 | s->allocated |= 1 << i; |
| 193 | return i; |
| 194 | } |
| 195 | |
| 196 | |
| 197 | /* Process a pending TX allocate. */ |
| 198 | static void smc91c111_tx_alloc(smc91c111_state *s) |
| 199 | { |
| 200 | s->tx_alloc = smc91c111_allocate_packet(s); |
| 201 | if (s->tx_alloc == 0x80) |
| 202 | return; |
| 203 | s->int_level |= INT_ALLOC; |
| 204 | smc91c111_update(s); |
| 205 | } |
| 206 | |
| 207 | /* Remove and item from the RX FIFO. */ |
| 208 | static void smc91c111_pop_rx_fifo(smc91c111_state *s) |
| 209 | { |
| 210 | int i; |
| 211 | |
| 212 | if (s->rx_fifo_len == 0) { |
| 213 | /* |
| 214 | * The datasheet doesn't document what the behaviour is if the |
| 215 | * guest tries to pop an empty RX FIFO, and there's no obvious |
| 216 | * error status register to report it. Just ignore the attempt. |
| 217 | */ |
| 218 | return; |
| 219 | } |
| 220 | |
| 221 | s->rx_fifo_len--; |
| 222 | if (s->rx_fifo_len) { |
| 223 | for (i = 0; i < s->rx_fifo_len; i++) |
| 224 | s->rx_fifo[i] = s->rx_fifo[i + 1]; |
| 225 | s->int_level |= INT_RCV; |
| 226 | } else { |
| 227 | s->int_level &= ~INT_RCV; |
| 228 | } |
| 229 | smc91c111_flush_queued_packets(s); |
| 230 | smc91c111_update(s); |
| 231 | } |
| 232 | |
| 233 | /* Remove an item from the TX completion FIFO. */ |
| 234 | static void smc91c111_pop_tx_fifo_done(smc91c111_state *s) |
| 235 | { |
| 236 | int i; |
| 237 | |
| 238 | if (s->tx_fifo_done_len == 0) |
| 239 | return; |
| 240 | s->tx_fifo_done_len--; |
| 241 | for (i = 0; i < s->tx_fifo_done_len; i++) |
| 242 | s->tx_fifo_done[i] = s->tx_fifo_done[i + 1]; |
| 243 | } |
| 244 | |
| 245 | /* Release the memory allocated to a packet. */ |
| 246 | static void smc91c111_release_packet(smc91c111_state *s, int packet) |
| 247 | { |
| 248 | if (!packetnum_valid(packet)) { |
| 249 | /* |
| 250 | * Data sheet doesn't document behaviour in this guest error |
| 251 | * case, and there is no error status register to report it. |
| 252 | * Log and ignore the attempt. |
| 253 | */ |
| 254 | qemu_log_mask(LOG_GUEST_ERROR, |
| 255 | "smc91c111: attempt to release invalid packet %d\n", |
| 256 | packet); |
| 257 | return; |
| 258 | } |
| 259 | s->allocated &= ~(1 << packet); |
| 260 | if (s->tx_alloc == 0x80) |
| 261 | smc91c111_tx_alloc(s); |
| 262 | smc91c111_flush_queued_packets(s); |
| 263 | } |
| 264 | |
| 265 | static void smc91c111_complete_tx_packet(smc91c111_state *s, int packetnum) |
| 266 | { |
| 267 | if (s->ctr & CTR_AUTO_RELEASE) { |
| 268 | /* Race? */ |
| 269 | smc91c111_release_packet(s, packetnum); |
| 270 | } else if (s->tx_fifo_done_len < NUM_PACKETS) { |
| 271 | s->tx_fifo_done[s->tx_fifo_done_len++] = packetnum; |
| 272 | } |
| 273 | } |
| 274 | |
| 275 | /* Flush the TX FIFO. */ |
| 276 | static void smc91c111_do_tx(smc91c111_state *s) |
| 277 | { |
| 278 | int i; |
| 279 | int len; |
| 280 | int control; |
| 281 | int packetnum; |
| 282 | uint8_t *p; |
| 283 | |
| 284 | if ((s->tcr & TCR_TXEN) == 0) |
| 285 | return; |
| 286 | if (s->tx_fifo_len == 0) |
| 287 | return; |
| 288 | for (i = 0; i < s->tx_fifo_len; i++) { |
| 289 | packetnum = s->tx_fifo[i]; |
| 290 | /* queue_tx checked the packet number was valid */ |
| 291 | assert(packetnum_valid(packetnum)); |
| 292 | p = &s->data[packetnum][0]; |
| 293 | /* Set status word. */ |
| 294 | *(p++) = 0x01; |
| 295 | *(p++) = 0x40; |
| 296 | len = *(p++); |
| 297 | len |= ((int)*(p++)) << 8; |
| 298 | if (len < MIN_PACKET_SIZE || len > MAX_PACKET_SIZE) { |
| 299 | /* |
| 300 | * Datasheet doesn't say what to do here, and there is no |
| 301 | * relevant tx error condition listed. Log, and drop the packet. |
| 302 | */ |
| 303 | qemu_log_mask(LOG_GUEST_ERROR, |
| 304 | "smc91c111: tx packet with bad length %d, dropping\n", |
| 305 | len); |
| 306 | smc91c111_complete_tx_packet(s, packetnum); |
| 307 | continue; |
| 308 | } |
| 309 | /* |
| 310 | * Convert from size of the data frame to number of bytes of |
| 311 | * actual packet data. Whether the "last data byte" field is |
| 312 | * included in the packet depends on the ODD bit in the control |
| 313 | * byte at the end of the frame. |
| 314 | */ |
| 315 | len -= MIN_PACKET_SIZE; |
| 316 | control = p[len + 1]; |
| 317 | if (control & 0x20) |
| 318 | len++; |
| 319 | /* ??? This overwrites the data following the buffer. |
| 320 | Don't know what real hardware does. */ |
| 321 | if (len < 64 && (s->tcr & TCR_PAD_EN)) { |
| 322 | memset(p + len, 0, 64 - len); |
| 323 | len = 64; |
| 324 | } |
| 325 | #if 0 |
| 326 | { |
| 327 | int add_crc; |
| 328 | |
| 329 | /* The card is supposed to append the CRC to the frame. |
| 330 | However none of the other network traffic has the CRC |
| 331 | appended. Suspect this is low level ethernet detail we |
| 332 | don't need to worry about. */ |
| 333 | add_crc = (control & 0x10) || (s->tcr & TCR_NOCRC) == 0; |
| 334 | if (add_crc) { |
| 335 | uint32_t crc; |
| 336 | |
| 337 | crc = crc32(~0, p, len); |
| 338 | memcpy(p + len, &crc, 4); |
| 339 | len += 4; |
| 340 | } |
| 341 | } |
| 342 | #endif |
| 343 | smc91c111_complete_tx_packet(s, packetnum); |
| 344 | qemu_send_packet(qemu_get_queue(s->nic), p, len); |
| 345 | } |
| 346 | s->tx_fifo_len = 0; |
| 347 | smc91c111_update(s); |
| 348 | } |
| 349 | |
| 350 | /* Add a packet to the TX FIFO. */ |
| 351 | static void smc91c111_queue_tx(smc91c111_state *s, int packet) |
| 352 | { |
| 353 | if (!packetnum_valid(packet)) { |
| 354 | /* |
| 355 | * Datasheet doesn't document behaviour in this error case, and |
| 356 | * there's no error status register we could report it in. |
| 357 | * Log and ignore. |
| 358 | */ |
| 359 | qemu_log_mask(LOG_GUEST_ERROR, |
| 360 | "smc91c111: attempt to queue invalid packet %d\n", |
| 361 | packet); |
| 362 | return; |
| 363 | } |
| 364 | if (s->tx_fifo_len == NUM_PACKETS) |
| 365 | return; |
| 366 | s->tx_fifo[s->tx_fifo_len++] = packet; |
| 367 | smc91c111_do_tx(s); |
| 368 | } |
| 369 | |
| 370 | static void smc91c111_reset(DeviceState *dev) |
| 371 | { |
| 372 | smc91c111_state *s = SMC91C111(dev); |
| 373 | |
| 374 | s->bank = 0; |
| 375 | s->tx_fifo_len = 0; |
| 376 | s->tx_fifo_done_len = 0; |
| 377 | s->rx_fifo_len = 0; |
| 378 | s->allocated = 0; |
| 379 | s->packet_num = 0; |
| 380 | s->tx_alloc = 0; |
| 381 | s->tcr = 0; |
| 382 | s->rcr = 0; |
| 383 | s->cr = 0xa0b1; |
| 384 | s->ctr = 0x1210; |
| 385 | s->ptr = 0; |
| 386 | s->ercv = 0x1f; |
| 387 | s->int_level = INT_TX_EMPTY; |
| 388 | s->int_mask = 0; |
| 389 | smc91c111_update(s); |
| 390 | } |
| 391 | |
| 392 | #define SET_LOW(name, val) s->name = (s->name & 0xff00) | val |
| 393 | #define SET_HIGH(name, val) s->name = (s->name & 0xff) | (val << 8) |
| 394 | |
| 395 | /* |
| 396 | * The pointer register's pointer is an 11 bit value (so it exactly |
| 397 | * indexes a 2048-byte data frame). Add the specified offset to it, |
| 398 | * wrapping around at the 2048 byte mark, and return the resulting |
| 399 | * wrapped value. There are flag bits in the top part of the register, |
| 400 | * but we can ignore them here as the mask will mask them out. |
| 401 | */ |
| 402 | static int ptr_reg_add(smc91c111_state *s, int offset) |
| 403 | { |
| 404 | return (s->ptr + offset) & R_PTR_PTR_MASK; |
| 405 | } |
| 406 | |
| 407 | /* |
| 408 | * For an access to the Data Register at @offset, return the |
| 409 | * required offset into the packet's data frame. This will |
| 410 | * perform the pointer register autoincrement if required, and |
| 411 | * guarantees to return an in-bounds offset. |
| 412 | */ |
| 413 | static int data_reg_ptr(smc91c111_state *s, int offset) |
| 414 | { |
| 415 | int p; |
| 416 | |
| 417 | if (s->ptr & R_PTR_AUTOINCR_MASK) { |
| 418 | /* |
| 419 | * Autoincrement: use the current pointer value, and |
| 420 | * increment the pointer register's pointer field. |
| 421 | */ |
| 422 | p = FIELD_EX32(s->ptr, PTR, PTR); |
| 423 | s->ptr = FIELD_DP32(s->ptr, PTR, PTR, ptr_reg_add(s, 1)); |
| 424 | } else { |
| 425 | /* |
| 426 | * No autoincrement: register offset determines which |
| 427 | * byte we're addressing. Setting the pointer to the top |
| 428 | * of the data buffer and then using the pointer wrapping |
| 429 | * to read the bottom byte of the buffer is not something |
| 430 | * sensible guest software will do, but the datasheet |
| 431 | * doesn't say what the behaviour is, so we don't forbid it. |
| 432 | */ |
| 433 | p = ptr_reg_add(s, offset & 3); |
| 434 | } |
| 435 | return p; |
| 436 | } |
| 437 | |
| 438 | static void smc91c111_writeb(void *opaque, hwaddr offset, |
| 439 | uint32_t value) |
| 440 | { |
| 441 | smc91c111_state *s = (smc91c111_state *)opaque; |
| 442 | |
| 443 | offset = offset & 0xf; |
| 444 | if (offset == 14) { |
| 445 | s->bank = value; |
| 446 | return; |
| 447 | } |
| 448 | if (offset == 15) |
| 449 | return; |
| 450 | switch (s->bank) { |
| 451 | case 0: |
| 452 | switch (offset) { |
| 453 | case 0: /* TCR */ |
| 454 | SET_LOW(tcr, value); |
| 455 | return; |
| 456 | case 1: |
| 457 | SET_HIGH(tcr, value); |
| 458 | return; |
| 459 | case 4: /* RCR */ |
| 460 | SET_LOW(rcr, value); |
| 461 | return; |
| 462 | case 5: |
| 463 | SET_HIGH(rcr, value); |
| 464 | if (s->rcr & RCR_SOFT_RST) { |
| 465 | smc91c111_reset(DEVICE(s)); |
| 466 | } |
| 467 | smc91c111_flush_queued_packets(s); |
| 468 | return; |
| 469 | case 10: case 11: /* RPCR */ |
| 470 | /* Ignored */ |
| 471 | return; |
| 472 | case 12: case 13: /* Reserved */ |
| 473 | return; |
| 474 | } |
| 475 | break; |
| 476 | |
| 477 | case 1: |
| 478 | switch (offset) { |
| 479 | case 0: /* CONFIG */ |
| 480 | SET_LOW(cr, value); |
| 481 | return; |
| 482 | case 1: |
| 483 | SET_HIGH(cr,value); |
| 484 | return; |
| 485 | case 2: case 3: /* BASE */ |
| 486 | case 4: case 5: case 6: case 7: case 8: case 9: /* IA */ |
| 487 | /* Not implemented. */ |
| 488 | return; |
| 489 | case 10: /* General Purpose */ |
| 490 | SET_LOW(gpr, value); |
| 491 | return; |
| 492 | case 11: |
| 493 | SET_HIGH(gpr, value); |
| 494 | return; |
| 495 | case 12: /* Control */ |
| 496 | if (value & 1) { |
| 497 | qemu_log_mask(LOG_UNIMP, |
| 498 | "smc91c111: EEPROM store not implemented\n"); |
| 499 | } |
| 500 | if (value & 2) { |
| 501 | qemu_log_mask(LOG_UNIMP, |
| 502 | "smc91c111: EEPROM reload not implemented\n"); |
| 503 | } |
| 504 | value &= ~3; |
| 505 | SET_LOW(ctr, value); |
| 506 | return; |
| 507 | case 13: |
| 508 | SET_HIGH(ctr, value); |
| 509 | return; |
| 510 | } |
| 511 | break; |
| 512 | |
| 513 | case 2: |
| 514 | switch (offset) { |
| 515 | case 0: /* MMU Command */ |
| 516 | switch (value >> 5) { |
| 517 | case 0: /* no-op */ |
| 518 | break; |
| 519 | case 1: /* Allocate for TX. */ |
| 520 | s->tx_alloc = 0x80; |
| 521 | s->int_level &= ~INT_ALLOC; |
| 522 | smc91c111_update(s); |
| 523 | smc91c111_tx_alloc(s); |
| 524 | break; |
| 525 | case 2: /* Reset MMU. */ |
| 526 | s->allocated = 0; |
| 527 | s->tx_fifo_len = 0; |
| 528 | s->tx_fifo_done_len = 0; |
| 529 | s->rx_fifo_len = 0; |
| 530 | s->tx_alloc = 0; |
| 531 | break; |
| 532 | case 3: /* Remove from RX FIFO. */ |
| 533 | smc91c111_pop_rx_fifo(s); |
| 534 | break; |
| 535 | case 4: /* Remove from RX FIFO and release. */ |
| 536 | if (s->rx_fifo_len > 0) { |
| 537 | smc91c111_release_packet(s, s->rx_fifo[0]); |
| 538 | } |
| 539 | smc91c111_pop_rx_fifo(s); |
| 540 | break; |
| 541 | case 5: /* Release. */ |
| 542 | smc91c111_release_packet(s, s->packet_num); |
| 543 | break; |
| 544 | case 6: /* Add to TX FIFO. */ |
| 545 | smc91c111_queue_tx(s, s->packet_num); |
| 546 | break; |
| 547 | case 7: /* Reset TX FIFO. */ |
| 548 | s->tx_fifo_len = 0; |
| 549 | s->tx_fifo_done_len = 0; |
| 550 | break; |
| 551 | } |
| 552 | return; |
| 553 | case 1: |
| 554 | /* Ignore. */ |
| 555 | return; |
| 556 | case 2: /* Packet Number Register */ |
| 557 | s->packet_num = value; |
| 558 | return; |
| 559 | case 3: case 4: case 5: |
| 560 | /* Should be readonly, but linux writes to them anyway. Ignore. */ |
| 561 | return; |
| 562 | case 6: /* Pointer */ |
| 563 | SET_LOW(ptr, value); |
| 564 | return; |
| 565 | case 7: |
| 566 | SET_HIGH(ptr, value); |
| 567 | return; |
| 568 | case 8: case 9: case 10: case 11: /* Data */ |
| 569 | { |
| 570 | int p; |
| 571 | int n; |
| 572 | |
| 573 | if (s->ptr & 0x8000) |
| 574 | n = s->rx_fifo[0]; |
| 575 | else |
| 576 | n = s->packet_num; |
| 577 | if (!packetnum_valid(n)) { |
| 578 | /* Datasheet doesn't document what to do here */ |
| 579 | qemu_log_mask(LOG_GUEST_ERROR, |
| 580 | "smc91c111: attempt to write data to invalid packet %d\n", |
| 581 | n); |
| 582 | return; |
| 583 | } |
| 584 | p = data_reg_ptr(s, offset); |
| 585 | s->data[n][p] = value; |
| 586 | } |
| 587 | return; |
| 588 | case 12: /* Interrupt ACK. */ |
| 589 | s->int_level &= ~(value & 0xd6); |
| 590 | if (value & INT_TX) |
| 591 | smc91c111_pop_tx_fifo_done(s); |
| 592 | smc91c111_update(s); |
| 593 | return; |
| 594 | case 13: /* Interrupt mask. */ |
| 595 | s->int_mask = value; |
| 596 | smc91c111_update(s); |
| 597 | return; |
| 598 | } |
| 599 | break; |
| 600 | |
| 601 | case 3: |
| 602 | switch (offset) { |
| 603 | case 0: case 1: case 2: case 3: case 4: case 5: case 6: case 7: |
| 604 | /* Multicast table. */ |
| 605 | /* Not implemented. */ |
| 606 | return; |
| 607 | case 8: case 9: /* Management Interface. */ |
| 608 | /* Not implemented. */ |
| 609 | return; |
| 610 | case 12: /* Early receive. */ |
| 611 | s->ercv = value & 0x1f; |
| 612 | return; |
| 613 | case 13: |
| 614 | /* Ignore. */ |
| 615 | return; |
| 616 | } |
| 617 | break; |
| 618 | } |
| 619 | qemu_log_mask(LOG_GUEST_ERROR, "smc91c111_write(bank:%d) Illegal register" |
| 620 | " 0x%" HWADDR_PRIx " = 0x%x\n", |
| 621 | s->bank, offset, value); |
| 622 | } |
| 623 | |
| 624 | static uint32_t smc91c111_readb(void *opaque, hwaddr offset) |
| 625 | { |
| 626 | smc91c111_state *s = (smc91c111_state *)opaque; |
| 627 | |
| 628 | offset = offset & 0xf; |
| 629 | if (offset == 14) { |
| 630 | return s->bank; |
| 631 | } |
| 632 | if (offset == 15) |
| 633 | return 0x33; |
| 634 | switch (s->bank) { |
| 635 | case 0: |
| 636 | switch (offset) { |
| 637 | case 0: /* TCR */ |
| 638 | return s->tcr & 0xff; |
| 639 | case 1: |
| 640 | return s->tcr >> 8; |
| 641 | case 2: /* EPH Status */ |
| 642 | return 0; |
| 643 | case 3: |
| 644 | return 0x40; |
| 645 | case 4: /* RCR */ |
| 646 | return s->rcr & 0xff; |
| 647 | case 5: |
| 648 | return s->rcr >> 8; |
| 649 | case 6: /* Counter */ |
| 650 | case 7: |
| 651 | /* Not implemented. */ |
| 652 | return 0; |
| 653 | case 8: /* Memory size. */ |
| 654 | return NUM_PACKETS; |
| 655 | case 9: /* Free memory available. */ |
| 656 | { |
| 657 | int i; |
| 658 | int n; |
| 659 | n = 0; |
| 660 | for (i = 0; i < NUM_PACKETS; i++) { |
| 661 | if (s->allocated & (1 << i)) |
| 662 | n++; |
| 663 | } |
| 664 | return n; |
| 665 | } |
| 666 | case 10: case 11: /* RPCR */ |
| 667 | /* Not implemented. */ |
| 668 | return 0; |
| 669 | case 12: case 13: /* Reserved */ |
| 670 | return 0; |
| 671 | } |
| 672 | break; |
| 673 | |
| 674 | case 1: |
| 675 | switch (offset) { |
| 676 | case 0: /* CONFIG */ |
| 677 | return s->cr & 0xff; |
| 678 | case 1: |
| 679 | return s->cr >> 8; |
| 680 | case 2: case 3: /* BASE */ |
| 681 | /* Not implemented. */ |
| 682 | return 0; |
| 683 | case 4: case 5: case 6: case 7: case 8: case 9: /* IA */ |
| 684 | return s->conf.macaddr.a[offset - 4]; |
| 685 | case 10: /* General Purpose */ |
| 686 | return s->gpr & 0xff; |
| 687 | case 11: |
| 688 | return s->gpr >> 8; |
| 689 | case 12: /* Control */ |
| 690 | return s->ctr & 0xff; |
| 691 | case 13: |
| 692 | return s->ctr >> 8; |
| 693 | } |
| 694 | break; |
| 695 | |
| 696 | case 2: |
| 697 | switch (offset) { |
| 698 | case 0: case 1: /* MMUCR Busy bit. */ |
| 699 | return 0; |
| 700 | case 2: /* Packet Number. */ |
| 701 | return s->packet_num; |
| 702 | case 3: /* Allocation Result. */ |
| 703 | return s->tx_alloc; |
| 704 | case 4: /* TX FIFO */ |
| 705 | if (s->tx_fifo_done_len == 0) |
| 706 | return 0x80; |
| 707 | else |
| 708 | return s->tx_fifo_done[0]; |
| 709 | case 5: /* RX FIFO */ |
| 710 | if (s->rx_fifo_len == 0) |
| 711 | return 0x80; |
| 712 | else |
| 713 | return s->rx_fifo[0]; |
| 714 | case 6: /* Pointer */ |
| 715 | return s->ptr & 0xff; |
| 716 | case 7: |
| 717 | return (s->ptr >> 8) & 0xf7; |
| 718 | case 8: case 9: case 10: case 11: /* Data */ |
| 719 | { |
| 720 | int p; |
| 721 | int n; |
| 722 | |
| 723 | if (s->ptr & 0x8000) |
| 724 | n = s->rx_fifo[0]; |
| 725 | else |
| 726 | n = s->packet_num; |
| 727 | if (!packetnum_valid(n)) { |
| 728 | /* Datasheet doesn't document what to do here */ |
| 729 | qemu_log_mask(LOG_GUEST_ERROR, |
| 730 | "smc91c111: attempt to read data from invalid packet %d\n", |
| 731 | n); |
| 732 | return 0; |
| 733 | } |
| 734 | p = data_reg_ptr(s, offset); |
| 735 | return s->data[n][p]; |
| 736 | } |
| 737 | case 12: /* Interrupt status. */ |
| 738 | return s->int_level; |
| 739 | case 13: /* Interrupt mask. */ |
| 740 | return s->int_mask; |
| 741 | } |
| 742 | break; |
| 743 | |
| 744 | case 3: |
| 745 | switch (offset) { |
| 746 | case 0: case 1: case 2: case 3: case 4: case 5: case 6: case 7: |
| 747 | /* Multicast table. */ |
| 748 | /* Not implemented. */ |
| 749 | return 0; |
| 750 | case 8: /* Management Interface. */ |
| 751 | /* Not implemented. */ |
| 752 | return 0x30; |
| 753 | case 9: |
| 754 | return 0x33; |
| 755 | case 10: /* Revision. */ |
| 756 | return 0x91; |
| 757 | case 11: |
| 758 | return 0x33; |
| 759 | case 12: |
| 760 | return s->ercv; |
| 761 | case 13: |
| 762 | return 0; |
| 763 | } |
| 764 | break; |
| 765 | } |
| 766 | qemu_log_mask(LOG_GUEST_ERROR, "smc91c111_read(bank:%d) Illegal register" |
| 767 | " 0x%" HWADDR_PRIx "\n", |
| 768 | s->bank, offset); |
| 769 | return 0; |
| 770 | } |
| 771 | |
| 772 | static uint64_t smc91c111_readfn(void *opaque, hwaddr addr, unsigned size) |
| 773 | { |
| 774 | int i; |
| 775 | uint32_t val = 0; |
| 776 | |
| 777 | for (i = 0; i < size; i++) { |
| 778 | val |= smc91c111_readb(opaque, addr + i) << (i * 8); |
| 779 | } |
| 780 | return val; |
| 781 | } |
| 782 | |
| 783 | static void smc91c111_writefn(void *opaque, hwaddr addr, |
| 784 | uint64_t value, unsigned size) |
| 785 | { |
| 786 | int i = 0; |
| 787 | |
| 788 | /* 32-bit writes to offset 0xc only actually write to the bank select |
| 789 | * register (offset 0xe), so skip the first two bytes we would write. |
| 790 | */ |
| 791 | if (addr == 0xc && size == 4) { |
| 792 | i += 2; |
| 793 | } |
| 794 | |
| 795 | for (; i < size; i++) { |
| 796 | smc91c111_writeb(opaque, addr + i, |
| 797 | extract32(value, i * 8, 8)); |
| 798 | } |
| 799 | } |
| 800 | |
| 801 | static bool smc91c111_can_receive_nc(NetClientState *nc) |
| 802 | { |
| 803 | smc91c111_state *s = qemu_get_nic_opaque(nc); |
| 804 | |
| 805 | return smc91c111_can_receive(s); |
| 806 | } |
| 807 | |
| 808 | static ssize_t smc91c111_receive(NetClientState *nc, const uint8_t *buf, size_t size) |
| 809 | { |
| 810 | smc91c111_state *s = qemu_get_nic_opaque(nc); |
| 811 | int status; |
| 812 | int packetsize; |
| 813 | uint32_t crc; |
| 814 | int packetnum; |
| 815 | uint8_t *p; |
| 816 | |
| 817 | if ((s->rcr & RCR_RXEN) == 0 || (s->rcr & RCR_SOFT_RST)) |
| 818 | return -1; |
| 819 | /* Short packets are padded with zeros. Receiving a packet |
| 820 | < 64 bytes long is considered an error condition. */ |
| 821 | if (size < 64) |
| 822 | packetsize = 64; |
| 823 | else |
| 824 | packetsize = (size & ~1); |
| 825 | packetsize += 6; |
| 826 | crc = (s->rcr & RCR_STRIP_CRC) == 0; |
| 827 | if (crc) |
| 828 | packetsize += 4; |
| 829 | /* TODO: Flag overrun and receive errors. */ |
| 830 | if (packetsize > MAX_PACKET_SIZE) { |
| 831 | return -1; |
| 832 | } |
| 833 | packetnum = smc91c111_allocate_packet(s); |
| 834 | if (packetnum == 0x80) |
| 835 | return -1; |
| 836 | s->rx_fifo[s->rx_fifo_len++] = packetnum; |
| 837 | |
| 838 | /* allocate_packet() will not hand us back an invalid packet number */ |
| 839 | assert(packetnum_valid(packetnum)); |
| 840 | p = &s->data[packetnum][0]; |
| 841 | /* ??? Multicast packets? */ |
| 842 | status = 0; |
| 843 | if (size > 1518) |
| 844 | status |= RS_TOOLONG; |
| 845 | if (size & 1) |
| 846 | status |= RS_ODDFRAME; |
| 847 | *(p++) = status & 0xff; |
| 848 | *(p++) = status >> 8; |
| 849 | *(p++) = packetsize & 0xff; |
| 850 | *(p++) = packetsize >> 8; |
| 851 | memcpy(p, buf, size & ~1); |
| 852 | p += (size & ~1); |
| 853 | /* Pad short packets. */ |
| 854 | if (size < 64) { |
| 855 | int pad; |
| 856 | |
| 857 | if (size & 1) |
| 858 | *(p++) = buf[size - 1]; |
| 859 | pad = 64 - size; |
| 860 | memset(p, 0, pad); |
| 861 | p += pad; |
| 862 | size = 64; |
| 863 | } |
| 864 | /* It's not clear if the CRC should go before or after the last byte in |
| 865 | odd sized packets. Linux disables the CRC, so that's no help. |
| 866 | The pictures in the documentation show the CRC aligned on a 16-bit |
| 867 | boundary before the last odd byte, so that's what we do. */ |
| 868 | if (crc) { |
| 869 | crc = crc32(~0, buf, size); |
| 870 | *(p++) = crc & 0xff; crc >>= 8; |
| 871 | *(p++) = crc & 0xff; crc >>= 8; |
| 872 | *(p++) = crc & 0xff; crc >>= 8; |
| 873 | *(p++) = crc & 0xff; |
| 874 | } |
| 875 | if (size & 1) { |
| 876 | *(p++) = buf[size - 1]; |
| 877 | *p = 0x60; |
| 878 | } else { |
| 879 | *(p++) = 0; |
| 880 | *p = 0x40; |
| 881 | } |
| 882 | /* TODO: Raise early RX interrupt? */ |
| 883 | s->int_level |= INT_RCV; |
| 884 | smc91c111_update(s); |
| 885 | |
| 886 | return size; |
| 887 | } |
| 888 | |
| 889 | static const MemoryRegionOps smc91c111_mem_ops = { |
| 890 | /* The special case for 32 bit writes to 0xc means we can't just |
| 891 | * set .impl.min/max_access_size to 1, unfortunately |
| 892 | */ |
| 893 | .read = smc91c111_readfn, |
| 894 | .write = smc91c111_writefn, |
| 895 | .valid.min_access_size = 1, |
| 896 | .valid.max_access_size = 4, |
| 897 | .endianness = DEVICE_NATIVE_ENDIAN, |
| 898 | }; |
| 899 | |
| 900 | static NetClientInfo net_smc91c111_info = { |
| 901 | .type = NET_CLIENT_DRIVER_NIC, |
| 902 | .size = sizeof(NICState), |
| 903 | .can_receive = smc91c111_can_receive_nc, |
| 904 | .receive = smc91c111_receive, |
| 905 | }; |
| 906 | |
| 907 | static void smc91c111_realize(DeviceState *dev, Error **errp) |
| 908 | { |
| 909 | SysBusDevice *sbd = SYS_BUS_DEVICE(dev); |
| 910 | smc91c111_state *s = SMC91C111(dev); |
| 911 | |
| 912 | memory_region_init_io(&s->mmio, OBJECT(s), &smc91c111_mem_ops, s, |
| 913 | "smc91c111-mmio", 16); |
| 914 | sysbus_init_mmio(sbd, &s->mmio); |
| 915 | sysbus_init_irq(sbd, &s->irq); |
| 916 | qemu_macaddr_default_if_unset(&s->conf.macaddr); |
| 917 | s->nic = qemu_new_nic(&net_smc91c111_info, &s->conf, |
| 918 | object_get_typename(OBJECT(dev)), dev->id, |
| 919 | &dev->mem_reentrancy_guard, s); |
| 920 | qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a); |
| 921 | /* ??? Save/restore. */ |
| 922 | } |
| 923 | |
| 924 | static const Property smc91c111_properties[] = { |
| 925 | DEFINE_NIC_PROPERTIES(smc91c111_state, conf), |
| 926 | }; |
| 927 | |
| 928 | static void smc91c111_class_init(ObjectClass *klass, const void *data) |
| 929 | { |
| 930 | DeviceClass *dc = DEVICE_CLASS(klass); |
| 931 | |
| 932 | dc->realize = smc91c111_realize; |
| 933 | device_class_set_legacy_reset(dc, smc91c111_reset); |
| 934 | dc->vmsd = &vmstate_smc91c111; |
| 935 | device_class_set_props(dc, smc91c111_properties); |
| 936 | } |
| 937 | |
| 938 | static const TypeInfo smc91c111_info = { |
| 939 | .name = TYPE_SMC91C111, |
| 940 | .parent = TYPE_SYS_BUS_DEVICE, |
| 941 | .instance_size = sizeof(smc91c111_state), |
| 942 | .class_init = smc91c111_class_init, |
| 943 | }; |
| 944 | |
| 945 | static void smc91c111_register_types(void) |
| 946 | { |
| 947 | type_register_static(&smc91c111_info); |
| 948 | } |
| 949 | |
| 950 | /* Legacy helper function. Should go away when machine config files are |
| 951 | implemented. */ |
| 952 | void smc91c111_init(uint32_t base, qemu_irq irq) |
| 953 | { |
| 954 | DeviceState *dev; |
| 955 | SysBusDevice *s; |
| 956 | |
| 957 | dev = qdev_new(TYPE_SMC91C111); |
| 958 | qemu_configure_nic_device(dev, true, NULL); |
| 959 | s = SYS_BUS_DEVICE(dev); |
| 960 | sysbus_realize_and_unref(s, &error_fatal); |
| 961 | sysbus_mmio_map(s, 0, base); |
| 962 | sysbus_connect_irq(s, 0, irq); |
| 963 | } |
| 964 | |
| 965 | type_init(smc91c111_register_types) |