hw/smc91c111.c

   1 /*
   2  * SMSC 91C111 Ethernet interface emulation
   3  *
   4  * Copyright (c) 2005 CodeSourcery, LLC.
   5  * Written by Paul Brook
   6  *
   7  * This code is licensed under the GPL
   8  */
   9
  10 #include "sysbus.h"
  11 #include "net.h"
  12 #include "devices.h"
  13 /* For crc32 */
  14 #include <zlib.h>
  15
  16 /* Number of 2k memory pages available.  */
  17 #define NUM_PACKETS 4
  18
  19 typedef struct {
  20     SysBusDevice busdev;
  21     NICState *nic;
  22     NICConf conf;
  23     uint16_t tcr;
  24     uint16_t rcr;
  25     uint16_t cr;
  26     uint16_t ctr;
  27     uint16_t gpr;
  28     uint16_t ptr;
  29     uint16_t ercv;
  30     qemu_irq irq;
  31     int bank;
  32     int packet_num;
  33     int tx_alloc;
  34     /* Bitmask of allocated packets.  */
  35     int allocated;
  36     int tx_fifo_len;
  37     int tx_fifo[NUM_PACKETS];
  38     int rx_fifo_len;
  39     int rx_fifo[NUM_PACKETS];
  40     int tx_fifo_done_len;
  41     int tx_fifo_done[NUM_PACKETS];
  42     /* Packet buffer memory.  */
  43     uint8_t data[NUM_PACKETS][2048];
  44     uint8_t int_level;
  45     uint8_t int_mask;
  46     MemoryRegion mmio;
  47 } smc91c111_state;
  48
  49 static const VMStateDescription vmstate_smc91c111 = {
  50     .name = "smc91c111",
  51     .version_id = 1,
  52     .minimum_version_id = 1,
  53     .fields      = (VMStateField []) {
  54         VMSTATE_UINT16(tcr, smc91c111_state),
  55         VMSTATE_UINT16(rcr, smc91c111_state),
  56         VMSTATE_UINT16(cr, smc91c111_state),
  57         VMSTATE_UINT16(ctr, smc91c111_state),
  58         VMSTATE_UINT16(gpr, smc91c111_state),
  59         VMSTATE_UINT16(ptr, smc91c111_state),
  60         VMSTATE_UINT16(ercv, smc91c111_state),
  61         VMSTATE_INT32(bank, smc91c111_state),
  62         VMSTATE_INT32(packet_num, smc91c111_state),
  63         VMSTATE_INT32(tx_alloc, smc91c111_state),
  64         VMSTATE_INT32(allocated, smc91c111_state),
  65         VMSTATE_INT32(tx_fifo_len, smc91c111_state),
  66         VMSTATE_INT32_ARRAY(tx_fifo, smc91c111_state, NUM_PACKETS),
  67         VMSTATE_INT32(rx_fifo_len, smc91c111_state),
  68         VMSTATE_INT32_ARRAY(rx_fifo, smc91c111_state, NUM_PACKETS),
  69         VMSTATE_INT32(tx_fifo_done_len, smc91c111_state),
  70         VMSTATE_INT32_ARRAY(tx_fifo_done, smc91c111_state, NUM_PACKETS),
  71         VMSTATE_BUFFER_UNSAFE(data, smc91c111_state, 0, NUM_PACKETS * 2048),
  72         VMSTATE_UINT8(int_level, smc91c111_state),
  73         VMSTATE_UINT8(int_mask, smc91c111_state),
  74         VMSTATE_END_OF_LIST()
  75     }
  76 };
  77
  78 #define RCR_SOFT_RST  0x8000
  79 #define RCR_STRIP_CRC 0x0200
  80 #define RCR_RXEN      0x0100
  81
  82 #define TCR_EPH_LOOP  0x2000
  83 #define TCR_NOCRC     0x0100
  84 #define TCR_PAD_EN    0x0080
  85 #define TCR_FORCOL    0x0004
  86 #define TCR_LOOP      0x0002
  87 #define TCR_TXEN      0x0001
  88
  89 #define INT_MD        0x80
  90 #define INT_ERCV      0x40
  91 #define INT_EPH       0x20
  92 #define INT_RX_OVRN   0x10
  93 #define INT_ALLOC     0x08
  94 #define INT_TX_EMPTY  0x04
  95 #define INT_TX        0x02
  96 #define INT_RCV       0x01
  97
  98 #define CTR_AUTO_RELEASE  0x0800
  99 #define CTR_RELOAD        0x0002
 100 #define CTR_STORE         0x0001
 101
 102 #define RS_ALGNERR      0x8000
 103 #define RS_BRODCAST     0x4000
 104 #define RS_BADCRC       0x2000
 105 #define RS_ODDFRAME     0x1000
 106 #define RS_TOOLONG      0x0800
 107 #define RS_TOOSHORT     0x0400
 108 #define RS_MULTICAST    0x0001
 109
 110 /* Update interrupt status.  */
 111 static void smc91c111_update(smc91c111_state *s)
 112 {
 113     int level;
 114
 115     if (s->tx_fifo_len == 0)
 116         s->int_level |= INT_TX_EMPTY;
 117     if (s->tx_fifo_done_len != 0)
 118         s->int_level |= INT_TX;
 119     level = (s->int_level & s->int_mask) != 0;
 120     qemu_set_irq(s->irq, level);
 121 }
 122
 123 /* Try to allocate a packet.  Returns 0x80 on failure.  */
 124 static int smc91c111_allocate_packet(smc91c111_state *s)
 125 {
 126     int i;
 127     if (s->allocated == (1 << NUM_PACKETS) - 1) {
 128         return 0x80;
 129     }
 130
 131     for (i = 0; i < NUM_PACKETS; i++) {
 132         if ((s->allocated & (1 << i)) == 0)
 133             break;
 134     }
 135     s->allocated |= 1 << i;
 136     return i;
 137 }
 138
 139
 140 /* Process a pending TX allocate.  */
 141 static void smc91c111_tx_alloc(smc91c111_state *s)
 142 {
 143     s->tx_alloc = smc91c111_allocate_packet(s);
 144     if (s->tx_alloc == 0x80)
 145         return;
 146     s->int_level |= INT_ALLOC;
 147     smc91c111_update(s);
 148 }
 149
 150 /* Remove and item from the RX FIFO.  */
 151 static void smc91c111_pop_rx_fifo(smc91c111_state *s)
 152 {
 153     int i;
 154
 155     s->rx_fifo_len--;
 156     if (s->rx_fifo_len) {
 157         for (i = 0; i < s->rx_fifo_len; i++)
 158             s->rx_fifo[i] = s->rx_fifo[i + 1];
 159         s->int_level |= INT_RCV;
 160     } else {
 161         s->int_level &= ~INT_RCV;
 162     }
 163     smc91c111_update(s);
 164 }
 165
 166 /* Remove an item from the TX completion FIFO.  */
 167 static void smc91c111_pop_tx_fifo_done(smc91c111_state *s)
 168 {
 169     int i;
 170
 171     if (s->tx_fifo_done_len == 0)
 172         return;
 173     s->tx_fifo_done_len--;
 174     for (i = 0; i < s->tx_fifo_done_len; i++)
 175         s->tx_fifo_done[i] = s->tx_fifo_done[i + 1];
 176 }
 177
 178 /* Release the memory allocated to a packet.  */
 179 static void smc91c111_release_packet(smc91c111_state *s, int packet)
 180 {
 181     s->allocated &= ~(1 << packet);
 182     if (s->tx_alloc == 0x80)
 183         smc91c111_tx_alloc(s);
 184 }
 185
 186 /* Flush the TX FIFO.  */
 187 static void smc91c111_do_tx(smc91c111_state *s)
 188 {
 189     int i;
 190     int len;
 191     int control;
 192     int packetnum;
 193     uint8_t *p;
 194
 195     if ((s->tcr & TCR_TXEN) == 0)
 196         return;
 197     if (s->tx_fifo_len == 0)
 198         return;
 199     for (i = 0; i < s->tx_fifo_len; i++) {
 200         packetnum = s->tx_fifo[i];
 201         p = &s->data[packetnum][0];
 202         /* Set status word.  */
 203         *(p++) = 0x01;
 204         *(p++) = 0x40;
 205         len = *(p++);
 206         len |= ((int)*(p++)) << 8;
 207         len -= 6;
 208         control = p[len + 1];
 209         if (control & 0x20)
 210             len++;
 211         /* ??? This overwrites the data following the buffer.
 212            Don't know what real hardware does.  */
 213         if (len < 64 && (s->tcr & TCR_PAD_EN)) {
 214             memset(p + len, 0, 64 - len);
 215             len = 64;
 216         }
 217 #if 0
 218         {
 219             int add_crc;
 220
 221             /* The card is supposed to append the CRC to the frame.
 222                However none of the other network traffic has the CRC
 223                appended.  Suspect this is low level ethernet detail we
 224                don't need to worry about.  */
 225             add_crc = (control & 0x10) || (s->tcr & TCR_NOCRC) == 0;
 226             if (add_crc) {
 227                 uint32_t crc;
 228
 229                 crc = crc32(~0, p, len);
 230                 memcpy(p + len, &crc, 4);
 231                 len += 4;
 232             }
 233         }
 234 #endif
 235         if (s->ctr & CTR_AUTO_RELEASE)
 236             /* Race?  */
 237             smc91c111_release_packet(s, packetnum);
 238         else if (s->tx_fifo_done_len < NUM_PACKETS)
 239             s->tx_fifo_done[s->tx_fifo_done_len++] = packetnum;
 240         qemu_send_packet(&s->nic->nc, p, len);
 241     }
 242     s->tx_fifo_len = 0;
 243     smc91c111_update(s);
 244 }
 245
 246 /* Add a packet to the TX FIFO.  */
 247 static void smc91c111_queue_tx(smc91c111_state *s, int packet)
 248 {
 249     if (s->tx_fifo_len == NUM_PACKETS)
 250         return;
 251     s->tx_fifo[s->tx_fifo_len++] = packet;
 252     smc91c111_do_tx(s);
 253 }
 254
 255 static void smc91c111_reset(DeviceState *dev)
 256 {
 257     smc91c111_state *s = FROM_SYSBUS(smc91c111_state, sysbus_from_qdev(dev));
 258     s->bank = 0;
 259     s->tx_fifo_len = 0;
 260     s->tx_fifo_done_len = 0;
 261     s->rx_fifo_len = 0;
 262     s->allocated = 0;
 263     s->packet_num = 0;
 264     s->tx_alloc = 0;
 265     s->tcr = 0;
 266     s->rcr = 0;
 267     s->cr = 0xa0b1;
 268     s->ctr = 0x1210;
 269     s->ptr = 0;
 270     s->ercv = 0x1f;
 271     s->int_level = INT_TX_EMPTY;
 272     s->int_mask = 0;
 273     smc91c111_update(s);
 274 }
 275
 276 #define SET_LOW(name, val) s->name = (s->name & 0xff00) | val
 277 #define SET_HIGH(name, val) s->name = (s->name & 0xff) | (val << 8)
 278
 279 static void smc91c111_writeb(void *opaque, target_phys_addr_t offset,
 280                              uint32_t value)
 281 {
 282     smc91c111_state *s = (smc91c111_state *)opaque;
 283
 284     offset = offset & 0xf;
 285     if (offset == 14) {
 286         s->bank = value;
 287         return;
 288     }
 289     if (offset == 15)
 290         return;
 291     switch (s->bank) {
 292     case 0:
 293         switch (offset) {
 294         case 0: /* TCR */
 295             SET_LOW(tcr, value);
 296             return;
 297         case 1:
 298             SET_HIGH(tcr, value);
 299             return;
 300         case 4: /* RCR */
 301             SET_LOW(rcr, value);
 302             return;
 303         case 5:
 304             SET_HIGH(rcr, value);
 305             if (s->rcr & RCR_SOFT_RST)
 306                 smc91c111_reset(&s->busdev.qdev);
 307             return;
 308         case 10: case 11: /* RPCR */
 309             /* Ignored */
 310             return;
 311         case 12: case 13: /* Reserved */
 312             return;
 313         }
 314         break;
 315
 316     case 1:
 317         switch (offset) {
 318         case 0: /* CONFIG */
 319             SET_LOW(cr, value);
 320             return;
 321         case 1:
 322             SET_HIGH(cr,value);
 323             return;
 324         case 2: case 3: /* BASE */
 325         case 4: case 5: case 6: case 7: case 8: case 9: /* IA */
 326             /* Not implemented.  */
 327             return;
 328         case 10: /* Genral Purpose */
 329             SET_LOW(gpr, value);
 330             return;
 331         case 11:
 332             SET_HIGH(gpr, value);
 333             return;
 334         case 12: /* Control */
 335             if (value & 1)
 336                 fprintf(stderr, "smc91c111:EEPROM store not implemented\n");
 337             if (value & 2)
 338                 fprintf(stderr, "smc91c111:EEPROM reload not implemented\n");
 339             value &= ~3;
 340             SET_LOW(ctr, value);
 341             return;
 342         case 13:
 343             SET_HIGH(ctr, value);
 344             return;
 345         }
 346         break;
 347
 348     case 2:
 349         switch (offset) {
 350         case 0: /* MMU Command */
 351             switch (value >> 5) {
 352             case 0: /* no-op */
 353                 break;
 354             case 1: /* Allocate for TX.  */
 355                 s->tx_alloc = 0x80;
 356                 s->int_level &= ~INT_ALLOC;
 357                 smc91c111_update(s);
 358                 smc91c111_tx_alloc(s);
 359                 break;
 360             case 2: /* Reset MMU.  */
 361                 s->allocated = 0;
 362                 s->tx_fifo_len = 0;
 363                 s->tx_fifo_done_len = 0;
 364                 s->rx_fifo_len = 0;
 365                 s->tx_alloc = 0;
 366                 break;
 367             case 3: /* Remove from RX FIFO.  */
 368                 smc91c111_pop_rx_fifo(s);
 369                 break;
 370             case 4: /* Remove from RX FIFO and release.  */
 371                 if (s->rx_fifo_len > 0) {
 372                     smc91c111_release_packet(s, s->rx_fifo[0]);
 373                 }
 374                 smc91c111_pop_rx_fifo(s);
 375                 break;
 376             case 5: /* Release.  */
 377                 smc91c111_release_packet(s, s->packet_num);
 378                 break;
 379             case 6: /* Add to TX FIFO.  */
 380                 smc91c111_queue_tx(s, s->packet_num);
 381                 break;
 382             case 7: /* Reset TX FIFO.  */
 383                 s->tx_fifo_len = 0;
 384                 s->tx_fifo_done_len = 0;
 385                 break;
 386             }
 387             return;
 388         case 1:
 389             /* Ignore.  */
 390             return;
 391         case 2: /* Packet Number Register */
 392             s->packet_num = value;
 393             return;
 394         case 3: case 4: case 5:
 395             /* Should be readonly, but linux writes to them anyway. Ignore.  */
 396             return;
 397         case 6: /* Pointer */
 398             SET_LOW(ptr, value);
 399             return;
 400         case 7:
 401             SET_HIGH(ptr, value);
 402             return;
 403         case 8: case 9: case 10: case 11: /* Data */
 404             {
 405                 int p;
 406                 int n;
 407
 408                 if (s->ptr & 0x8000)
 409                     n = s->rx_fifo[0];
 410                 else
 411                     n = s->packet_num;
 412                 p = s->ptr & 0x07ff;
 413                 if (s->ptr & 0x4000) {
 414                     s->ptr = (s->ptr & 0xf800) | ((s->ptr + 1) & 0x7ff);
 415                 } else {
 416                     p += (offset & 3);
 417                 }
 418                 s->data[n][p] = value;
 419             }
 420             return;
 421         case 12: /* Interrupt ACK.  */
 422             s->int_level &= ~(value & 0xd6);
 423             if (value & INT_TX)
 424                 smc91c111_pop_tx_fifo_done(s);
 425             smc91c111_update(s);
 426             return;
 427         case 13: /* Interrupt mask.  */
 428             s->int_mask = value;
 429             smc91c111_update(s);
 430             return;
 431         }
 432         break;
 433
 434     case 3:
 435         switch (offset) {
 436         case 0: case 1: case 2: case 3: case 4: case 5: case 6: case 7:
 437             /* Multicast table.  */
 438             /* Not implemented.  */
 439             return;
 440         case 8: case 9: /* Management Interface.  */
 441             /* Not implemented.  */
 442             return;
 443         case 12: /* Early receive.  */
 444             s->ercv = value & 0x1f;
 445         case 13:
 446             /* Ignore.  */
 447             return;
 448         }
 449         break;
 450     }
 451     hw_error("smc91c111_write: Bad reg %d:%x\n", s->bank, (int)offset);
 452 }
 453
 454 static uint32_t smc91c111_readb(void *opaque, target_phys_addr_t offset)
 455 {
 456     smc91c111_state *s = (smc91c111_state *)opaque;
 457
 458     offset = offset & 0xf;
 459     if (offset == 14) {
 460         return s->bank;
 461     }
 462     if (offset == 15)
 463         return 0x33;
 464     switch (s->bank) {
 465     case 0:
 466         switch (offset) {
 467         case 0: /* TCR */
 468             return s->tcr & 0xff;
 469         case 1:
 470             return s->tcr >> 8;
 471         case 2: /* EPH Status */
 472             return 0;
 473         case 3:
 474             return 0x40;
 475         case 4: /* RCR */
 476             return s->rcr & 0xff;
 477         case 5:
 478             return s->rcr >> 8;
 479         case 6: /* Counter */
 480         case 7:
 481             /* Not implemented.  */
 482             return 0;
 483         case 8: /* Memory size.  */
 484             return NUM_PACKETS;
 485         case 9: /* Free memory available.  */
 486             {
 487                 int i;
 488                 int n;
 489                 n = 0;
 490                 for (i = 0; i < NUM_PACKETS; i++) {
 491                     if (s->allocated & (1 << i))
 492                         n++;
 493                 }
 494                 return n;
 495             }
 496         case 10: case 11: /* RPCR */
 497             /* Not implemented.  */
 498             return 0;
 499         case 12: case 13: /* Reserved */
 500             return 0;
 501         }
 502         break;
 503
 504     case 1:
 505         switch (offset) {
 506         case 0: /* CONFIG */
 507             return s->cr & 0xff;
 508         case 1:
 509             return s->cr >> 8;
 510         case 2: case 3: /* BASE */
 511             /* Not implemented.  */
 512             return 0;
 513         case 4: case 5: case 6: case 7: case 8: case 9: /* IA */
 514             return s->conf.macaddr.a[offset - 4];
 515         case 10: /* General Purpose */
 516             return s->gpr & 0xff;
 517         case 11:
 518             return s->gpr >> 8;
 519         case 12: /* Control */
 520             return s->ctr & 0xff;
 521         case 13:
 522             return s->ctr >> 8;
 523         }
 524         break;
 525
 526     case 2:
 527         switch (offset) {
 528         case 0: case 1: /* MMUCR Busy bit.  */
 529             return 0;
 530         case 2: /* Packet Number.  */
 531             return s->packet_num;
 532         case 3: /* Allocation Result.  */
 533             return s->tx_alloc;
 534         case 4: /* TX FIFO */
 535             if (s->tx_fifo_done_len == 0)
 536                 return 0x80;
 537             else
 538                 return s->tx_fifo_done[0];
 539         case 5: /* RX FIFO */
 540             if (s->rx_fifo_len == 0)
 541                 return 0x80;
 542             else
 543                 return s->rx_fifo[0];
 544         case 6: /* Pointer */
 545             return s->ptr & 0xff;
 546         case 7:
 547             return (s->ptr >> 8) & 0xf7;
 548         case 8: case 9: case 10: case 11: /* Data */
 549             {
 550                 int p;
 551                 int n;
 552
 553                 if (s->ptr & 0x8000)
 554                     n = s->rx_fifo[0];
 555                 else
 556                     n = s->packet_num;
 557                 p = s->ptr & 0x07ff;
 558                 if (s->ptr & 0x4000) {
 559                     s->ptr = (s->ptr & 0xf800) | ((s->ptr + 1) & 0x07ff);
 560                 } else {
 561                     p += (offset & 3);
 562                 }
 563                 return s->data[n][p];
 564             }
 565         case 12: /* Interrupt status.  */
 566             return s->int_level;
 567         case 13: /* Interrupt mask.  */
 568             return s->int_mask;
 569         }
 570         break;
 571
 572     case 3:
 573         switch (offset) {
 574         case 0: case 1: case 2: case 3: case 4: case 5: case 6: case 7:
 575             /* Multicast table.  */
 576             /* Not implemented.  */
 577             return 0;
 578         case 8: /* Management Interface.  */
 579             /* Not implemented.  */
 580             return 0x30;
 581         case 9:
 582             return 0x33;
 583         case 10: /* Revision.  */
 584             return 0x91;
 585         case 11:
 586             return 0x33;
 587         case 12:
 588             return s->ercv;
 589         case 13:
 590             return 0;
 591         }
 592         break;
 593     }
 594     hw_error("smc91c111_read: Bad reg %d:%x\n", s->bank, (int)offset);
 595     return 0;
 596 }
 597
 598 static void smc91c111_writew(void *opaque, target_phys_addr_t offset,
 599                              uint32_t value)
 600 {
 601     smc91c111_writeb(opaque, offset, value & 0xff);
 602     smc91c111_writeb(opaque, offset + 1, value >> 8);
 603 }
 604
 605 static void smc91c111_writel(void *opaque, target_phys_addr_t offset,
 606                              uint32_t value)
 607 {
 608     /* 32-bit writes to offset 0xc only actually write to the bank select
 609        register (offset 0xe)  */
 610     if (offset != 0xc)
 611         smc91c111_writew(opaque, offset, value & 0xffff);
 612     smc91c111_writew(opaque, offset + 2, value >> 16);
 613 }
 614
 615 static uint32_t smc91c111_readw(void *opaque, target_phys_addr_t offset)
 616 {
 617     uint32_t val;
 618     val = smc91c111_readb(opaque, offset);
 619     val |= smc91c111_readb(opaque, offset + 1) << 8;
 620     return val;
 621 }
 622
 623 static uint32_t smc91c111_readl(void *opaque, target_phys_addr_t offset)
 624 {
 625     uint32_t val;
 626     val = smc91c111_readw(opaque, offset);
 627     val |= smc91c111_readw(opaque, offset + 2) << 16;
 628     return val;
 629 }
 630
 631 static int smc91c111_can_receive(VLANClientState *nc)
 632 {
 633     smc91c111_state *s = DO_UPCAST(NICState, nc, nc)->opaque;
 634
 635     if ((s->rcr & RCR_RXEN) == 0 || (s->rcr & RCR_SOFT_RST))
 636         return 1;
 637     if (s->allocated == (1 << NUM_PACKETS) - 1)
 638         return 0;
 639     return 1;
 640 }
 641
 642 static ssize_t smc91c111_receive(VLANClientState *nc, const uint8_t *buf, size_t size)
 643 {
 644     smc91c111_state *s = DO_UPCAST(NICState, nc, nc)->opaque;
 645     int status;
 646     int packetsize;
 647     uint32_t crc;
 648     int packetnum;
 649     uint8_t *p;
 650
 651     if ((s->rcr & RCR_RXEN) == 0 || (s->rcr & RCR_SOFT_RST))
 652         return -1;
 653     /* Short packets are padded with zeros.  Receiving a packet
 654        < 64 bytes long is considered an error condition.  */
 655     if (size < 64)
 656         packetsize = 64;
 657     else
 658         packetsize = (size & ~1);
 659     packetsize += 6;
 660     crc = (s->rcr & RCR_STRIP_CRC) == 0;
 661     if (crc)
 662         packetsize += 4;
 663     /* TODO: Flag overrun and receive errors.  */
 664     if (packetsize > 2048)
 665         return -1;
 666     packetnum = smc91c111_allocate_packet(s);
 667     if (packetnum == 0x80)
 668         return -1;
 669     s->rx_fifo[s->rx_fifo_len++] = packetnum;
 670
 671     p = &s->data[packetnum][0];
 672     /* ??? Multicast packets?  */
 673     status = 0;
 674     if (size > 1518)
 675         status |= RS_TOOLONG;
 676     if (size & 1)
 677         status |= RS_ODDFRAME;
 678     *(p++) = status & 0xff;
 679     *(p++) = status >> 8;
 680     *(p++) = packetsize & 0xff;
 681     *(p++) = packetsize >> 8;
 682     memcpy(p, buf, size & ~1);
 683     p += (size & ~1);
 684     /* Pad short packets.  */
 685     if (size < 64) {
 686         int pad;
 687
 688         if (size & 1)
 689             *(p++) = buf[size - 1];
 690         pad = 64 - size;
 691         memset(p, 0, pad);
 692         p += pad;
 693         size = 64;
 694     }
 695     /* It's not clear if the CRC should go before or after the last byte in
 696        odd sized packets.  Linux disables the CRC, so that's no help.
 697        The pictures in the documentation show the CRC aligned on a 16-bit
 698        boundary before the last odd byte, so that's what we do.  */
 699     if (crc) {
 700         crc = crc32(~0, buf, size);
 701         *(p++) = crc & 0xff; crc >>= 8;
 702         *(p++) = crc & 0xff; crc >>= 8;
 703         *(p++) = crc & 0xff; crc >>= 8;
 704         *(p++) = crc & 0xff;
 705     }
 706     if (size & 1) {
 707         *(p++) = buf[size - 1];
 708         *p = 0x60;
 709     } else {
 710         *(p++) = 0;
 711         *p = 0x40;
 712     }
 713     /* TODO: Raise early RX interrupt?  */
 714     s->int_level |= INT_RCV;
 715     smc91c111_update(s);
 716
 717     return size;
 718 }
 719
 720 static const MemoryRegionOps smc91c111_mem_ops = {
 721     /* The special case for 32 bit writes to 0xc means we can't just
 722      * set .impl.min/max_access_size to 1, unfortunately
 723      */
 724     .old_mmio = {
 725         .read = { smc91c111_readb, smc91c111_readw, smc91c111_readl, },
 726         .write = { smc91c111_writeb, smc91c111_writew, smc91c111_writel, },
 727     },
 728     .endianness = DEVICE_NATIVE_ENDIAN,
 729 };
 730
 731 static void smc91c111_cleanup(VLANClientState *nc)
 732 {
 733     smc91c111_state *s = DO_UPCAST(NICState, nc, nc)->opaque;
 734
 735     s->nic = NULL;
 736 }
 737
 738 static NetClientInfo net_smc91c111_info = {
 739     .type = NET_CLIENT_TYPE_NIC,
 740     .size = sizeof(NICState),
 741     .can_receive = smc91c111_can_receive,
 742     .receive = smc91c111_receive,
 743     .cleanup = smc91c111_cleanup,
 744 };
 745
 746 static int smc91c111_init1(SysBusDevice *dev)
 747 {
 748     smc91c111_state *s = FROM_SYSBUS(smc91c111_state, dev);
 749     memory_region_init_io(&s->mmio, &smc91c111_mem_ops, s,
 750                           "smc91c111-mmio", 16);
 751     sysbus_init_mmio(dev, &s->mmio);
 752     sysbus_init_irq(dev, &s->irq);
 753     qemu_macaddr_default_if_unset(&s->conf.macaddr);
 754     s->nic = qemu_new_nic(&net_smc91c111_info, &s->conf,
 755                           dev->qdev.info->name, dev->qdev.id, s);
 756     qemu_format_nic_info_str(&s->nic->nc, s->conf.macaddr.a);
 757     /* ??? Save/restore.  */
 758     return 0;
 759 }
 760
 761 static SysBusDeviceInfo smc91c111_info = {
 762     .init = smc91c111_init1,
 763     .qdev.name  = "smc91c111",
 764     .qdev.size  = sizeof(smc91c111_state),
 765     .qdev.vmsd = &vmstate_smc91c111,
 766     .qdev.reset = smc91c111_reset,
 767     .qdev.props = (Property[]) {
 768         DEFINE_NIC_PROPERTIES(smc91c111_state, conf),
 769         DEFINE_PROP_END_OF_LIST(),
 770     }
 771 };
 772
 773 static void smc91c111_register_devices(void)
 774 {
 775     sysbus_register_withprop(&smc91c111_info);
 776 }
 777
 778 /* Legacy helper function.  Should go away when machine config files are
 779    implemented.  */
 780 void smc91c111_init(NICInfo *nd, uint32_t base, qemu_irq irq)
 781 {
 782     DeviceState *dev;
 783     SysBusDevice *s;
 784
 785     qemu_check_nic_model(nd, "smc91c111");
 786     dev = qdev_create(NULL, "smc91c111");
 787     qdev_set_nic_properties(dev, nd);
 788     qdev_init_nofail(dev);
 789     s = sysbus_from_qdev(dev);
 790     sysbus_mmio_map(s, 0, base);
 791     sysbus_connect_irq(s, 0, irq);
 792 }
 793
 794 device_init(smc91c111_register_devices)