2 * SMSC 91C111 Ethernet interface emulation
4 * Copyright (c) 2005 CodeSourcery, LLC.
5 * Written by Paul Brook
7 * This code is licenced under the GPL
16 /* Number of 2k memory pages available. */
32 /* Bitmask of allocated packets. */
35 int tx_fifo
[NUM_PACKETS
];
37 int rx_fifo
[NUM_PACKETS
];
39 int tx_fifo_done
[NUM_PACKETS
];
40 /* Packet buffer memory. */
41 uint8_t data
[NUM_PACKETS
][2048];
48 #define RCR_SOFT_RST 0x8000
49 #define RCR_STRIP_CRC 0x0200
50 #define RCR_RXEN 0x0100
52 #define TCR_EPH_LOOP 0x2000
53 #define TCR_NOCRC 0x0100
54 #define TCR_PAD_EN 0x0080
55 #define TCR_FORCOL 0x0004
56 #define TCR_LOOP 0x0002
57 #define TCR_TXEN 0x0001
62 #define INT_RX_OVRN 0x10
63 #define INT_ALLOC 0x08
64 #define INT_TX_EMPTY 0x04
68 #define CTR_AUTO_RELEASE 0x0800
69 #define CTR_RELOAD 0x0002
70 #define CTR_STORE 0x0001
72 #define RS_ALGNERR 0x8000
73 #define RS_BRODCAST 0x4000
74 #define RS_BADCRC 0x2000
75 #define RS_ODDFRAME 0x1000
76 #define RS_TOOLONG 0x0800
77 #define RS_TOOSHORT 0x0400
78 #define RS_MULTICAST 0x0001
80 /* Update interrupt status. */
81 static void smc91c111_update(smc91c111_state
*s
)
85 if (s
->tx_fifo_len
== 0)
86 s
->int_level
|= INT_TX_EMPTY
;
87 if (s
->tx_fifo_done_len
!= 0)
88 s
->int_level
|= INT_TX
;
89 level
= (s
->int_level
& s
->int_mask
) != 0;
90 qemu_set_irq(s
->irq
, level
);
93 /* Try to allocate a packet. Returns 0x80 on failure. */
94 static int smc91c111_allocate_packet(smc91c111_state
*s
)
97 if (s
->allocated
== (1 << NUM_PACKETS
) - 1) {
101 for (i
= 0; i
< NUM_PACKETS
; i
++) {
102 if ((s
->allocated
& (1 << i
)) == 0)
105 s
->allocated
|= 1 << i
;
110 /* Process a pending TX allocate. */
111 static void smc91c111_tx_alloc(smc91c111_state
*s
)
113 s
->tx_alloc
= smc91c111_allocate_packet(s
);
114 if (s
->tx_alloc
== 0x80)
116 s
->int_level
|= INT_ALLOC
;
120 /* Remove and item from the RX FIFO. */
121 static void smc91c111_pop_rx_fifo(smc91c111_state
*s
)
126 if (s
->rx_fifo_len
) {
127 for (i
= 0; i
< s
->rx_fifo_len
; i
++)
128 s
->rx_fifo
[i
] = s
->rx_fifo
[i
+ 1];
129 s
->int_level
|= INT_RCV
;
131 s
->int_level
&= ~INT_RCV
;
136 /* Remove an item from the TX completion FIFO. */
137 static void smc91c111_pop_tx_fifo_done(smc91c111_state
*s
)
141 if (s
->tx_fifo_done_len
== 0)
143 s
->tx_fifo_done_len
--;
144 for (i
= 0; i
< s
->tx_fifo_done_len
; i
++)
145 s
->tx_fifo_done
[i
] = s
->tx_fifo_done
[i
+ 1];
148 /* Release the memory allocated to a packet. */
149 static void smc91c111_release_packet(smc91c111_state
*s
, int packet
)
151 s
->allocated
&= ~(1 << packet
);
152 if (s
->tx_alloc
== 0x80)
153 smc91c111_tx_alloc(s
);
156 /* Flush the TX FIFO. */
157 static void smc91c111_do_tx(smc91c111_state
*s
)
166 if ((s
->tcr
& TCR_TXEN
) == 0)
168 if (s
->tx_fifo_len
== 0)
170 for (i
= 0; i
< s
->tx_fifo_len
; i
++) {
171 packetnum
= s
->tx_fifo
[i
];
172 p
= &s
->data
[packetnum
][0];
173 /* Set status word. */
177 len
|= ((int)*(p
++)) << 8;
179 control
= p
[len
+ 1];
182 /* ??? This overwrites the data following the buffer.
183 Don't know what real hardware does. */
184 if (len
< 64 && (s
->tcr
& TCR_PAD_EN
)) {
185 memset(p
+ len
, 0, 64 - len
);
189 /* The card is supposed to append the CRC to the frame. However
190 none of the other network traffic has the CRC appended.
191 Suspect this is low level ethernet detail we don't need to worry
193 add_crc
= (control
& 0x10) || (s
->tcr
& TCR_NOCRC
) == 0;
197 crc
= crc32(~0, p
, len
);
198 memcpy(p
+ len
, &crc
, 4);
204 if (s
->ctr
& CTR_AUTO_RELEASE
)
206 smc91c111_release_packet(s
, packetnum
);
207 else if (s
->tx_fifo_done_len
< NUM_PACKETS
)
208 s
->tx_fifo_done
[s
->tx_fifo_done_len
++] = packetnum
;
209 qemu_send_packet(s
->vc
, p
, len
);
215 /* Add a packet to the TX FIFO. */
216 static void smc91c111_queue_tx(smc91c111_state
*s
, int packet
)
218 if (s
->tx_fifo_len
== NUM_PACKETS
)
220 s
->tx_fifo
[s
->tx_fifo_len
++] = packet
;
224 static void smc91c111_reset(smc91c111_state
*s
)
228 s
->tx_fifo_done_len
= 0;
239 s
->int_level
= INT_TX_EMPTY
;
244 #define SET_LOW(name, val) s->name = (s->name & 0xff00) | val
245 #define SET_HIGH(name, val) s->name = (s->name & 0xff) | (val << 8)
247 static void smc91c111_writeb(void *opaque
, target_phys_addr_t offset
,
250 smc91c111_state
*s
= (smc91c111_state
*)opaque
;
265 SET_HIGH(tcr
, value
);
271 SET_HIGH(rcr
, value
);
272 if (s
->rcr
& RCR_SOFT_RST
)
275 case 10: case 11: /* RPCR */
289 case 2: case 3: /* BASE */
290 case 4: case 5: case 6: case 7: case 8: case 9: /* IA */
291 /* Not implemented. */
293 case 10: /* Genral Purpose */
297 SET_HIGH(gpr
, value
);
299 case 12: /* Control */
301 fprintf(stderr
, "smc91c111:EEPROM store not implemented\n");
303 fprintf(stderr
, "smc91c111:EEPROM reload not implemented\n");
308 SET_HIGH(ctr
, value
);
315 case 0: /* MMU Command */
316 switch (value
>> 5) {
319 case 1: /* Allocate for TX. */
321 s
->int_level
&= ~INT_ALLOC
;
323 smc91c111_tx_alloc(s
);
325 case 2: /* Reset MMU. */
328 s
->tx_fifo_done_len
= 0;
332 case 3: /* Remove from RX FIFO. */
333 smc91c111_pop_rx_fifo(s
);
335 case 4: /* Remove from RX FIFO and release. */
336 if (s
->rx_fifo_len
> 0) {
337 smc91c111_release_packet(s
, s
->rx_fifo
[0]);
339 smc91c111_pop_rx_fifo(s
);
341 case 5: /* Release. */
342 smc91c111_release_packet(s
, s
->packet_num
);
344 case 6: /* Add to TX FIFO. */
345 smc91c111_queue_tx(s
, s
->packet_num
);
347 case 7: /* Reset TX FIFO. */
349 s
->tx_fifo_done_len
= 0;
356 case 2: /* Packet Number Register */
357 s
->packet_num
= value
;
359 case 3: case 4: case 5:
360 /* Should be readonly, but linux writes to them anyway. Ignore. */
362 case 6: /* Pointer */
366 SET_HIGH(ptr
, value
);
368 case 8: case 9: case 10: case 11: /* Data */
378 if (s
->ptr
& 0x4000) {
379 s
->ptr
= (s
->ptr
& 0xf800) | ((s
->ptr
+ 1) & 0x7ff);
383 s
->data
[n
][p
] = value
;
386 case 12: /* Interrupt ACK. */
387 s
->int_level
&= ~(value
& 0xd6);
389 smc91c111_pop_tx_fifo_done(s
);
392 case 13: /* Interrupt mask. */
401 case 0: case 1: case 2: case 3: case 4: case 5: case 6: case 7:
402 /* Multicast table. */
403 /* Not implemented. */
405 case 8: case 9: /* Management Interface. */
406 /* Not implemented. */
408 case 12: /* Early receive. */
409 s
->ercv
= value
& 0x1f;
416 hw_error("smc91c111_write: Bad reg %d:%x\n", s
->bank
, (int)offset
);
419 static uint32_t smc91c111_readb(void *opaque
, target_phys_addr_t offset
)
421 smc91c111_state
*s
= (smc91c111_state
*)opaque
;
432 return s
->tcr
& 0xff;
435 case 2: /* EPH Status */
440 return s
->rcr
& 0xff;
443 case 6: /* Counter */
445 /* Not implemented. */
447 case 8: /* Memory size. */
449 case 9: /* Free memory available. */
454 for (i
= 0; i
< NUM_PACKETS
; i
++) {
455 if (s
->allocated
& (1 << i
))
460 case 10: case 11: /* RPCR */
461 /* Not implemented. */
472 case 2: case 3: /* BASE */
473 /* Not implemented. */
475 case 4: case 5: case 6: case 7: case 8: case 9: /* IA */
476 return s
->macaddr
[offset
- 4];
477 case 10: /* General Purpose */
478 return s
->gpr
& 0xff;
481 case 12: /* Control */
482 return s
->ctr
& 0xff;
490 case 0: case 1: /* MMUCR Busy bit. */
492 case 2: /* Packet Number. */
493 return s
->packet_num
;
494 case 3: /* Allocation Result. */
496 case 4: /* TX FIFO */
497 if (s
->tx_fifo_done_len
== 0)
500 return s
->tx_fifo_done
[0];
501 case 5: /* RX FIFO */
502 if (s
->rx_fifo_len
== 0)
505 return s
->rx_fifo
[0];
506 case 6: /* Pointer */
507 return s
->ptr
& 0xff;
509 return (s
->ptr
>> 8) & 0xf7;
510 case 8: case 9: case 10: case 11: /* Data */
520 if (s
->ptr
& 0x4000) {
521 s
->ptr
= (s
->ptr
& 0xf800) | ((s
->ptr
+ 1) & 0x07ff);
525 return s
->data
[n
][p
];
527 case 12: /* Interrupt status. */
529 case 13: /* Interrupt mask. */
536 case 0: case 1: case 2: case 3: case 4: case 5: case 6: case 7:
537 /* Multicast table. */
538 /* Not implemented. */
540 case 8: /* Management Interface. */
541 /* Not implemented. */
545 case 10: /* Revision. */
556 hw_error("smc91c111_read: Bad reg %d:%x\n", s
->bank
, (int)offset
);
560 static void smc91c111_writew(void *opaque
, target_phys_addr_t offset
,
563 smc91c111_writeb(opaque
, offset
, value
& 0xff);
564 smc91c111_writeb(opaque
, offset
+ 1, value
>> 8);
567 static void smc91c111_writel(void *opaque
, target_phys_addr_t offset
,
570 /* 32-bit writes to offset 0xc only actually write to the bank select
571 register (offset 0xe) */
573 smc91c111_writew(opaque
, offset
, value
& 0xffff);
574 smc91c111_writew(opaque
, offset
+ 2, value
>> 16);
577 static uint32_t smc91c111_readw(void *opaque
, target_phys_addr_t offset
)
580 val
= smc91c111_readb(opaque
, offset
);
581 val
|= smc91c111_readb(opaque
, offset
+ 1) << 8;
585 static uint32_t smc91c111_readl(void *opaque
, target_phys_addr_t offset
)
588 val
= smc91c111_readw(opaque
, offset
);
589 val
|= smc91c111_readw(opaque
, offset
+ 2) << 16;
593 static int smc91c111_can_receive(void *opaque
)
595 smc91c111_state
*s
= (smc91c111_state
*)opaque
;
597 if ((s
->rcr
& RCR_RXEN
) == 0 || (s
->rcr
& RCR_SOFT_RST
))
599 if (s
->allocated
== (1 << NUM_PACKETS
) - 1)
604 static void smc91c111_receive(void *opaque
, const uint8_t *buf
, int size
)
606 smc91c111_state
*s
= (smc91c111_state
*)opaque
;
613 if ((s
->rcr
& RCR_RXEN
) == 0 || (s
->rcr
& RCR_SOFT_RST
))
615 /* Short packets are padded with zeros. Receiving a packet
616 < 64 bytes long is considered an error condition. */
620 packetsize
= (size
& ~1);
622 crc
= (s
->rcr
& RCR_STRIP_CRC
) == 0;
625 /* TODO: Flag overrun and receive errors. */
626 if (packetsize
> 2048)
628 packetnum
= smc91c111_allocate_packet(s
);
629 if (packetnum
== 0x80)
631 s
->rx_fifo
[s
->rx_fifo_len
++] = packetnum
;
633 p
= &s
->data
[packetnum
][0];
634 /* ??? Multicast packets? */
637 status
|= RS_TOOLONG
;
639 status
|= RS_ODDFRAME
;
640 *(p
++) = status
& 0xff;
641 *(p
++) = status
>> 8;
642 *(p
++) = packetsize
& 0xff;
643 *(p
++) = packetsize
>> 8;
644 memcpy(p
, buf
, size
& ~1);
646 /* Pad short packets. */
651 *(p
++) = buf
[size
- 1];
657 /* It's not clear if the CRC should go before or after the last byte in
658 odd sized packets. Linux disables the CRC, so that's no help.
659 The pictures in the documentation show the CRC aligned on a 16-bit
660 boundary before the last odd byte, so that's what we do. */
662 crc
= crc32(~0, buf
, size
);
663 *(p
++) = crc
& 0xff; crc
>>= 8;
664 *(p
++) = crc
& 0xff; crc
>>= 8;
665 *(p
++) = crc
& 0xff; crc
>>= 8;
666 *(p
++) = crc
& 0xff; crc
>>= 8;
669 *(p
++) = buf
[size
- 1];
675 /* TODO: Raise early RX interrupt? */
676 s
->int_level
|= INT_RCV
;
680 static CPUReadMemoryFunc
*smc91c111_readfn
[] = {
686 static CPUWriteMemoryFunc
*smc91c111_writefn
[] = {
692 static void smc91c111_cleanup(VLANClientState
*vc
)
694 smc91c111_state
*s
= vc
->opaque
;
696 cpu_unregister_io_memory(s
->mmio_index
);
700 void smc91c111_init(NICInfo
*nd
, uint32_t base
, qemu_irq irq
)
704 qemu_check_nic_model(nd
, "smc91c111");
706 s
= (smc91c111_state
*)qemu_mallocz(sizeof(smc91c111_state
));
707 s
->mmio_index
= cpu_register_io_memory(0, smc91c111_readfn
,
708 smc91c111_writefn
, s
);
709 cpu_register_physical_memory(base
, 16, s
->mmio_index
);
711 memcpy(s
->macaddr
, nd
->macaddr
, 6);
715 s
->vc
= qemu_new_vlan_client(nd
->vlan
, nd
->model
, nd
->name
,
716 smc91c111_receive
, smc91c111_can_receive
,
717 smc91c111_cleanup
, s
);
718 qemu_format_nic_info_str(s
->vc
, s
->macaddr
);
719 /* ??? Save/restore. */