2 * SMSC 91C111 Ethernet interface emulation
4 * Copyright (c) 2005 CodeSourcery, LLC.
5 * Written by Paul Brook
7 * This code is licensed under the GPL
10 #include "hw/sysbus.h"
12 #include "hw/devices.h"
16 /* Number of 2k memory pages available. */
20 # define logout(fmt, ...) \
21 fprintf(stderr, "SMC91C111\t%-24s %s:%u " fmt, __func__, __FILE__, __LINE__, ##__VA_ARGS__)
23 # define logout(fmt, ...) (void)0
41 /* PHY Register Addresses (LAN91C111 Internal PHY) */
43 /* PHY Configuration Register 1 */
44 #define PHY_CFG1_REG 0x10
45 #define PHY_CFG1_LNKDIS 0x8000 /* 1=Rx Link Detect Function disabled */
46 #define PHY_CFG1_XMTDIS 0x4000 /* 1=TP Transmitter Disabled */
47 #define PHY_CFG1_XMTPDN 0x2000 /* 1=TP Transmitter Powered Down */
48 #define PHY_CFG1_BYPSCR 0x0400 /* 1=Bypass scrambler/descrambler */
49 #define PHY_CFG1_UNSCDS 0x0200 /* 1=Unscramble Idle Reception Disable */
50 #define PHY_CFG1_EQLZR 0x0100 /* 1=Rx Equalizer Disabled */
51 #define PHY_CFG1_CABLE 0x0080 /* 1=STP(150ohm), 0=UTP(100ohm) */
52 #define PHY_CFG1_RLVL0 0x0040 /* 1=Rx Squelch level reduced by 4.5db */
53 #define PHY_CFG1_TLVL_SHIFT 2 /* Transmit Output Level Adjust */
54 #define PHY_CFG1_TLVL_MASK 0x003C
55 #define PHY_CFG1_TRF_MASK 0x0003 /* Transmitter Rise/Fall time */
57 /* PHY Configuration Register 2 */
58 #define PHY_CFG2_REG 0x11
59 #define PHY_CFG2_APOLDIS 0x0020 /* 1=Auto Polarity Correction disabled */
60 #define PHY_CFG2_JABDIS 0x0010 /* 1=Jabber disabled */
61 #define PHY_CFG2_MREG 0x0008 /* 1=Multiple register access (MII mgt) */
62 #define PHY_CFG2_INTMDIO 0x0004 /* 1=Interrupt signaled with MDIO pulseo */
64 /* PHY Status Output (and Interrupt status) Register */
65 #define PHY_INT_REG 0x12 /* Status Output (Interrupt Status) */
66 #define PHY_INT_INT 0x8000 /* 1=bits have changed since last read */
67 #define PHY_INT_LNKFAIL 0x4000 /* 1=Link Not detected */
68 #define PHY_INT_LOSSSYNC 0x2000 /* 1=Descrambler has lost sync */
69 #define PHY_INT_CWRD 0x1000 /* 1=Invalid 4B5B code detected on rx */
70 #define PHY_INT_SSD 0x0800 /* 1=No Start Of Stream detected on rx */
71 #define PHY_INT_ESD 0x0400 /* 1=No End Of Stream detected on rx */
72 #define PHY_INT_RPOL 0x0200 /* 1=Reverse Polarity detected */
73 #define PHY_INT_JAB 0x0100 /* 1=Jabber detected */
74 #define PHY_INT_SPDDET 0x0080 /* 1=100Base-TX mode, 0=10Base-T mode */
75 #define PHY_INT_DPLXDET 0x0040 /* 1=Device in Full Duplex */
77 /* PHY Interrupt/Status Mask Register */
78 #define PHY_MASK_REG 0x13 /* Interrupt Mask */
79 /* Uses the same bit definitions as PHY_INT_REG */
93 /* Declarations from include/linux/mii.h. */
95 /* Generic MII registers. */
97 #define MII_BMCR 0x00 /* Basic mode control register */ // rw
98 #define MII_BMSR 0x01 /* Basic mode status register */ // r
99 #define MII_PHYSID1 0x02 /* PHYS ID 1 */
100 #define MII_PHYSID2 0x03 /* PHYS ID 2 */
101 #define MII_ADVERTISE 0x04 /* Advertisement control reg */ // rw
102 #define MII_LPA 0x05 /* Link partner ability reg */
103 #define MII_EXPANSION 0x06 /* Expansion register */
104 #define MII_CTRL1000 0x09 /* 1000BASE-T control */
105 #define MII_STAT1000 0x0a /* 1000BASE-T status */
106 #define MII_ESTATUS 0x0f /* Extended Status */
107 #define MII_DCOUNTER 0x12 /* Disconnect counter */
108 #define MII_FCSCOUNTER 0x13 /* False carrier counter */
109 #define MII_NWAYTEST 0x14 /* N-way auto-neg test reg */
110 #define MII_RERRCOUNTER 0x15 /* Receive error counter */
111 #define MII_SREVISION 0x16 /* Silicon revision */
112 #define MII_RESV1 0x17 /* Reserved... */
113 #define MII_LBRERROR 0x18 /* Lpback, rx, bypass error */
114 #define MII_PHYADDR 0x19 /* PHY address */
115 #define MII_RESV2 0x1a /* Reserved... */
116 #define MII_TPISTATUS 0x1b /* TPI status for 10mbps */
117 #define MII_NCONFIG 0x1c /* Network interface config */
119 /* Basic mode control register. */
120 #define BMCR_RESV 0x003f /* Unused... */
121 #define BMCR_SPEED1000 0x0040 /* MSB of Speed (1000) */
122 #define BMCR_CTST 0x0080 /* Collision test */
123 #define BMCR_FULLDPLX 0x0100 /* Full duplex */
124 #define BMCR_ANRESTART 0x0200 /* Auto negotiation restart */
125 #define BMCR_ISOLATE 0x0400 /* Disconnect PHY from MII */
126 #define BMCR_PDOWN 0x0800 /* Powerdown the */
127 #define BMCR_ANENABLE 0x1000 /* Enable auto negotiation */
128 #define BMCR_SPEED100 0x2000 /* Select 100Mbps */
129 #define BMCR_LOOPBACK 0x4000 /* TXD loopback bits */
130 #define BMCR_RESET 0x8000 /* Reset the PHY */
132 /* Basic mode status register. */
133 #define BMSR_ERCAP 0x0001 /* Ext-reg capability */
134 #define BMSR_JCD 0x0002 /* Jabber detected */
135 #define BMSR_LSTATUS 0x0004 /* Link status */
136 #define BMSR_ANEGCAPABLE 0x0008 /* Able to do auto-negotiation */
137 #define BMSR_RFAULT 0x0010 /* Remote fault detected */
138 #define BMSR_ANEGCOMPLETE 0x0020 /* Auto-negotiation complete */
139 #define BMSR_RESV 0x00c0 /* Unused... */
140 #define BMSR_ESTATEN 0x0100 /* Extended Status in R15 */
141 #define BMSR_100HALF2 0x0200 /* Can do 100BASE-T2 HDX */
142 #define BMSR_100FULL2 0x0400 /* Can do 100BASE-T2 FDX */
143 #define BMSR_10HALF 0x0800 /* Can do 10mbps, half-duplex */
144 #define BMSR_10FULL 0x1000 /* Can do 10mbps, full-duplex */
145 #define BMSR_100HALF 0x2000 /* Can do 100mbps, half-duplex */
146 #define BMSR_100FULL 0x4000 /* Can do 100mbps, full-duplex */
147 #define BMSR_100BASE4 0x8000 /* Can do 100mbps, 4k packets */
149 //~ #define PHY_STAT_CAP_SUPR 0x0040 /* 1=recv mgmt frames with not preamble */
151 /* Advertisement control register. */
152 #define ADVERTISE_SLCT 0x001f /* Selector bits */
153 #define ADVERTISE_CSMA 0x0001 /* Only selector supported */
154 #define ADVERTISE_10HALF 0x0020 /* Try for 10mbps half-duplex */
155 #define ADVERTISE_1000XFULL 0x0020 /* Try for 1000BASE-X full-duplex */
156 #define ADVERTISE_10FULL 0x0040 /* Try for 10mbps full-duplex */
157 #define ADVERTISE_1000XHALF 0x0040 /* Try for 1000BASE-X half-duplex */
158 #define ADVERTISE_100HALF 0x0080 /* Try for 100mbps half-duplex */
159 #define ADVERTISE_1000XPAUSE 0x0080 /* Try for 1000BASE-X pause */
160 #define ADVERTISE_100FULL 0x0100 /* Try for 100mbps full-duplex */
161 #define ADVERTISE_1000XPSE_ASYM 0x0100 /* Try for 1000BASE-X asym pause */
162 #define ADVERTISE_100BASE4 0x0200 /* Try for 100mbps 4k packets */
163 #define ADVERTISE_PAUSE_CAP 0x0400 /* Try for pause */
164 #define ADVERTISE_PAUSE_ASYM 0x0800 /* Try for asymetric pause */
165 #define ADVERTISE_RESV 0x1000 /* Unused... */
166 #define ADVERTISE_RFAULT 0x2000 /* Say we can detect faults */
167 #define ADVERTISE_LPACK 0x4000 /* Ack link partners response */
168 #define ADVERTISE_NPAGE 0x8000 /* Next page bit */
170 #define ADVERTISE_FULL (ADVERTISE_100FULL | ADVERTISE_10FULL | \
172 #define ADVERTISE_ALL (ADVERTISE_10HALF | ADVERTISE_10FULL | \
173 ADVERTISE_100HALF | ADVERTISE_100FULL)
175 /* Link partner ability register. */
176 #define LPA_SLCT 0x001f /* Same as advertise selector */
177 #define LPA_10HALF 0x0020 /* Can do 10mbps half-duplex */
178 #define LPA_1000XFULL 0x0020 /* Can do 1000BASE-X full-duplex */
179 #define LPA_10FULL 0x0040 /* Can do 10mbps full-duplex */
180 #define LPA_1000XHALF 0x0040 /* Can do 1000BASE-X half-duplex */
181 #define LPA_100HALF 0x0080 /* Can do 100mbps half-duplex */
182 #define LPA_1000XPAUSE 0x0080 /* Can do 1000BASE-X pause */
183 #define LPA_100FULL 0x0100 /* Can do 100mbps full-duplex */
184 #define LPA_1000XPAUSE_ASYM 0x0100 /* Can do 1000BASE-X pause asym*/
185 #define LPA_100BASE4 0x0200 /* Can do 100mbps 4k packets */
186 #define LPA_PAUSE_CAP 0x0400 /* Can pause */
187 #define LPA_PAUSE_ASYM 0x0800 /* Can pause asymetrically */
188 #define LPA_RESV 0x1000 /* Unused... */
189 #define LPA_RFAULT 0x2000 /* Link partner faulted */
190 #define LPA_LPACK 0x4000 /* Link partner acked us */
191 #define LPA_NPAGE 0x8000 /* Next page bit */
193 #define LPA_DUPLEX (LPA_10FULL | LPA_100FULL)
194 #define LPA_100 (LPA_100FULL | LPA_100HALF | LPA_100BASE4)
196 /* End of declarations from include/linux/mii.h. */
198 /* SMC 91C111 specific MII register. */
200 /* 0x06 ... 0x0f are reserved. */
201 #define MII_CONFIGURATION1 0x10 /* Configuration 1 */
202 #define MII_CONFIGURATION2 0x11 /* Configuration 2 */
203 #define MII_STATUSOUTPUT 0x12 /* Status Output */
204 //~ PHY_FCSCR = 0x13, /* Mask */
205 /* 0x14 is reserved. */
206 /* 0x15 ... 0x1f are unused. */
209 /* Default values for MII management registers (see IEEE 802.3-2008 22.2.4). */
211 static const uint16_t mii_regs_default
[] = {
212 [MII_BMCR
] = BMCR_ANENABLE
| BMCR_SPEED100
,
213 [MII_BMSR
] = BMSR_100FULL
| BMSR_100HALF
| BMSR_10FULL
| BMSR_10HALF
|
214 BMSR_ANEGCAPABLE
| BMSR_LSTATUS
| BMSR_ERCAP
,
215 [MII_ADVERTISE
] = ADVERTISE_PAUSE_CAP
| ADVERTISE_ALL
| ADVERTISE_CSMA
,
218 #define TYPE_SMC91C111 "smc91c111"
219 #define SMC91C111(obj) OBJECT_CHECK(smc91c111_state, (obj), TYPE_SMC91C111)
222 SysBusDevice parent_obj
;
237 /* Bitmask of allocated packets. */
240 int tx_fifo
[NUM_PACKETS
];
242 int rx_fifo
[NUM_PACKETS
];
243 int tx_fifo_done_len
;
244 int tx_fifo_done
[NUM_PACKETS
];
245 /* Packet buffer memory. */
246 uint8_t data
[NUM_PACKETS
][2048];
252 static const VMStateDescription vmstate_smc91c111
= {
255 .minimum_version_id
= 1,
256 .fields
= (VMStateField
[]) {
257 VMSTATE_UINT16(tcr
, smc91c111_state
),
258 VMSTATE_UINT16(rcr
, smc91c111_state
),
259 VMSTATE_UINT16(cr
, smc91c111_state
),
260 VMSTATE_UINT16(ctr
, smc91c111_state
),
261 VMSTATE_UINT16(gpr
, smc91c111_state
),
262 VMSTATE_UINT16(ptr
, smc91c111_state
),
263 VMSTATE_UINT16(ercv
, smc91c111_state
),
264 VMSTATE_INT32(bank
, smc91c111_state
),
265 VMSTATE_INT32(packet_num
, smc91c111_state
),
266 VMSTATE_INT32(tx_alloc
, smc91c111_state
),
267 VMSTATE_INT32(allocated
, smc91c111_state
),
268 VMSTATE_INT32(tx_fifo_len
, smc91c111_state
),
269 VMSTATE_INT32_ARRAY(tx_fifo
, smc91c111_state
, NUM_PACKETS
),
270 VMSTATE_INT32(rx_fifo_len
, smc91c111_state
),
271 VMSTATE_INT32_ARRAY(rx_fifo
, smc91c111_state
, NUM_PACKETS
),
272 VMSTATE_INT32(tx_fifo_done_len
, smc91c111_state
),
273 VMSTATE_INT32_ARRAY(tx_fifo_done
, smc91c111_state
, NUM_PACKETS
),
274 VMSTATE_BUFFER_UNSAFE(data
, smc91c111_state
, 0, NUM_PACKETS
* 2048),
275 VMSTATE_UINT8(int_level
, smc91c111_state
),
276 VMSTATE_UINT8(int_mask
, smc91c111_state
),
277 VMSTATE_END_OF_LIST()
281 #define RCR_SOFT_RST 0x8000
282 #define RCR_STRIP_CRC 0x0200
283 #define RCR_RXEN 0x0100
285 #define TCR_EPH_LOOP 0x2000
286 #define TCR_NOCRC 0x0100
287 #define TCR_PAD_EN 0x0080
288 #define TCR_FORCOL 0x0004
289 #define TCR_LOOP 0x0002
290 #define TCR_TXEN 0x0001
293 #define INT_ERCV 0x40
295 #define INT_RX_OVRN 0x10
296 #define INT_ALLOC 0x08
297 #define INT_TX_EMPTY 0x04
301 #define CTR_AUTO_RELEASE 0x0800
302 #define CTR_RELOAD 0x0002
303 #define CTR_STORE 0x0001
305 #define RS_ALGNERR 0x8000
306 #define RS_BRODCAST 0x4000
307 #define RS_BADCRC 0x2000
308 #define RS_ODDFRAME 0x1000
309 #define RS_TOOLONG 0x0800
310 #define RS_TOOSHORT 0x0400
311 #define RS_MULTICAST 0x0001
313 static void mii_write(MII
*mii
, uint32_t value
)
316 A timing diagram for a Ml serial port frame is shown in Figure 7.1. The Ml serial port is idle when at
317 least 32 continuous 1's are detected on MDIO and remains idle as long as continuous 1's are detected.
318 During idle, MDIO is in the high impedance state. When the Ml serial port is in the idle state, a 01
319 pattern on the MDIO initiates a serial shift cycle. Data on MDIO is then shifted in on the next 14 rising
320 edges of MDC (MDIO is high impedance). If the register access mode is not enabled, on the next 16
321 rising edges of MDC, data is either shifted in or out on MDIO, depending on whether a write or read
322 cycle was selected with the bits READ and WRITE. After the 32 MDC cycles have been completed,
323 one complete register has been read/written, the serial shift process is halted, data is latched into the
324 device, and MDIO goes into high impedance state. Another serial shift cycle cannot be initiated until
325 the idle condition (at least 32 continuous 1's) is detected.
327 bool clock
= !mii
->mclk
&& (value
& 4);
329 assert((value
& 0xfffffff0) == 0x30);
333 mii
->mdi
= value
& MII_MDI
;
334 mii
->mdoe
= value
& MII_MDOE
;
335 mii
->mdo
= value
& MII_MDO
;
336 mii
->data
= (mii
->data
<< 1) + (value
& 1);
337 logout("%u%u%u%u %08x\n",
338 mii
->mdoe
? 1 : 0, mii
->mclk
? 1 : 0,
339 mii
->mdi
? 1 : 0, mii
->mdo
? 1 : 0,
341 switch (mii
->status
) {
343 if (mii
->data
== 0xffffffff) {
344 logout("mii is idle\n");
346 mii
->status
= MII_IDLE
;
350 if (mii
->data
== 0xfffffffd) {
351 logout("mii got start bit pattern 01\n");
352 mii
->status
= MII_GOT_START
;
356 if ((mii
->data
& 0xffffc000) == 0xffff4000) {
357 unsigned op
= (mii
->data
>> 12) & 0x3;
358 unsigned phy
= (mii
->data
>> 7) & 0x1f;
359 unsigned reg
= (mii
->data
>> 2) & 0x1f;
360 logout("mii got 14 bits (op=%u, phy=%u, reg=%u, ta=%u)\n",
361 op
, phy
, reg
, mii
->data
& 0x3);
364 logout("Wrong phy %u, wait for idle\n", phy
);
365 mii
->status
= MII_WAITING
;
366 } else if (reg
>= ARRAY_SIZE(mii
->regs
)) {
367 logout("Wrong reg %u, wait for idle\n", reg
);
368 mii
->status
= MII_WAITING
;
369 } else if (op
== 1) {
370 mii
->status
= MII_WRITE
;
371 } else if (op
== 2) {
372 mii
->data
= mii
->regs
[reg
];
374 mii
->status
= MII_READ
;
376 logout("Illegal MII operation %u, wait for idle\n", op
);
377 mii
->status
= MII_WAITING
;
382 if ((mii
->data
& 0xc0000000) == 0x40000000) {
383 uint16_t data
= mii
->data
& 0xffff;
384 logout("mii wrote 16 bits (data=0x%04x=%u)\n", data
, data
);
385 mii
->regs
[mii
->reg
] = data
;
386 mii
->status
= MII_WAITING
;
390 if ((mii
->data
& 0x0000ffff) == 0x0000ffff) {
391 logout("mii read 16 bits\n");
393 mii
->status
= MII_WAITING
;
396 mii
->mdi
= (mii
->data
& 0x00010000) ? MII_MDI
: 0;
401 mii
->mclk
= value
& MII_MCLK
;
402 //~ assert(mii->mdoe);
405 static void mii_reset(MII
*mii
)
407 memcpy(mii
->regs
, mii_regs_default
, sizeof(mii
->regs
));
410 /* Update interrupt status. */
411 static void smc91c111_update(smc91c111_state
*s
)
415 if (s
->tx_fifo_len
== 0)
416 s
->int_level
|= INT_TX_EMPTY
;
417 if (s
->tx_fifo_done_len
!= 0)
418 s
->int_level
|= INT_TX
;
419 level
= (s
->int_level
& s
->int_mask
) != 0;
420 qemu_set_irq(s
->irq
, level
);
423 static int smc91c111_can_receive(smc91c111_state
*s
)
425 if ((s
->rcr
& RCR_RXEN
) == 0 || (s
->rcr
& RCR_SOFT_RST
)) {
428 if (s
->allocated
== (1 << NUM_PACKETS
) - 1 ||
429 s
->rx_fifo_len
== NUM_PACKETS
) {
435 static inline void smc91c111_flush_queued_packets(smc91c111_state
*s
)
437 if (smc91c111_can_receive(s
)) {
438 qemu_flush_queued_packets(qemu_get_queue(s
->nic
));
442 /* Try to allocate a packet. Returns 0x80 on failure. */
443 static int smc91c111_allocate_packet(smc91c111_state
*s
)
446 if (s
->allocated
== (1 << NUM_PACKETS
) - 1) {
450 for (i
= 0; i
< NUM_PACKETS
; i
++) {
451 if ((s
->allocated
& (1 << i
)) == 0)
454 s
->allocated
|= 1 << i
;
459 /* Process a pending TX allocate. */
460 static void smc91c111_tx_alloc(smc91c111_state
*s
)
462 s
->tx_alloc
= smc91c111_allocate_packet(s
);
463 if (s
->tx_alloc
== 0x80)
465 s
->int_level
|= INT_ALLOC
;
469 /* Remove and item from the RX FIFO. */
470 static void smc91c111_pop_rx_fifo(smc91c111_state
*s
)
475 if (s
->rx_fifo_len
) {
476 for (i
= 0; i
< s
->rx_fifo_len
; i
++)
477 s
->rx_fifo
[i
] = s
->rx_fifo
[i
+ 1];
478 s
->int_level
|= INT_RCV
;
480 s
->int_level
&= ~INT_RCV
;
482 smc91c111_flush_queued_packets(s
);
486 /* Remove an item from the TX completion FIFO. */
487 static void smc91c111_pop_tx_fifo_done(smc91c111_state
*s
)
491 if (s
->tx_fifo_done_len
== 0)
493 s
->tx_fifo_done_len
--;
494 for (i
= 0; i
< s
->tx_fifo_done_len
; i
++)
495 s
->tx_fifo_done
[i
] = s
->tx_fifo_done
[i
+ 1];
498 /* Release the memory allocated to a packet. */
499 static void smc91c111_release_packet(smc91c111_state
*s
, int packet
)
501 s
->allocated
&= ~(1 << packet
);
502 if (s
->tx_alloc
== 0x80)
503 smc91c111_tx_alloc(s
);
504 smc91c111_flush_queued_packets(s
);
507 /* Flush the TX FIFO. */
508 static void smc91c111_do_tx(smc91c111_state
*s
)
516 if ((s
->tcr
& TCR_TXEN
) == 0)
518 if (s
->tx_fifo_len
== 0)
520 for (i
= 0; i
< s
->tx_fifo_len
; i
++) {
521 packetnum
= s
->tx_fifo
[i
];
522 p
= &s
->data
[packetnum
][0];
523 /* Set status word. */
527 len
|= ((int)*(p
++)) << 8;
529 control
= p
[len
+ 1];
532 /* ??? This overwrites the data following the buffer.
533 Don't know what real hardware does. */
534 if (len
< 64 && (s
->tcr
& TCR_PAD_EN
)) {
535 memset(p
+ len
, 0, 64 - len
);
542 /* The card is supposed to append the CRC to the frame.
543 However none of the other network traffic has the CRC
544 appended. Suspect this is low level ethernet detail we
545 don't need to worry about. */
546 add_crc
= (control
& 0x10) || (s
->tcr
& TCR_NOCRC
) == 0;
550 crc
= crc32(~0, p
, len
);
551 memcpy(p
+ len
, &crc
, 4);
556 if (s
->ctr
& CTR_AUTO_RELEASE
)
558 smc91c111_release_packet(s
, packetnum
);
559 else if (s
->tx_fifo_done_len
< NUM_PACKETS
)
560 s
->tx_fifo_done
[s
->tx_fifo_done_len
++] = packetnum
;
561 qemu_send_packet(qemu_get_queue(s
->nic
), p
, len
);
567 /* Add a packet to the TX FIFO. */
568 static void smc91c111_queue_tx(smc91c111_state
*s
, int packet
)
570 if (s
->tx_fifo_len
== NUM_PACKETS
)
572 s
->tx_fifo
[s
->tx_fifo_len
++] = packet
;
576 static void smc91c111_reset(DeviceState
*dev
)
578 smc91c111_state
*s
= SMC91C111(dev
);
582 s
->tx_fifo_done_len
= 0;
593 s
->int_level
= INT_TX_EMPTY
;
599 #define SET_LOW(name, val) s->name = (s->name & 0xff00) | val
600 #define SET_HIGH(name, val) s->name = (s->name & 0xff) | (val << 8)
602 static void smc91c111_writeb(void *opaque
, hwaddr offset
,
605 smc91c111_state
*s
= (smc91c111_state
*)opaque
;
607 offset
= offset
& 0xf;
621 SET_HIGH(tcr
, value
);
627 SET_HIGH(rcr
, value
);
628 if (s
->rcr
& RCR_SOFT_RST
) {
629 smc91c111_reset(DEVICE(s
));
631 smc91c111_flush_queued_packets(s
);
633 case 10: case 11: /* RPCR */
636 case 12: case 13: /* Reserved */
639 logout(TARGET_FMT_plx
"= %02" PRIx32
"\n", offset
, value
);
651 case 2: case 3: /* BASE */
652 case 4: case 5: case 6: case 7: case 8: case 9: /* IA */
653 logout(TARGET_FMT_plx
"= %02" PRIx32
"\n", offset
, value
);
655 case 10: /* General Purpose */
659 SET_HIGH(gpr
, value
);
661 case 12: /* Control */
663 fprintf(stderr
, "smc91c111:EEPROM store not implemented\n");
665 fprintf(stderr
, "smc91c111:EEPROM reload not implemented\n");
670 SET_HIGH(ctr
, value
);
673 logout(TARGET_FMT_plx
"= %02" PRIx32
"\n", offset
, value
);
679 case 0: /* MMU Command */
680 switch (value
>> 5) {
683 case 1: /* Allocate for TX. */
685 s
->int_level
&= ~INT_ALLOC
;
687 smc91c111_tx_alloc(s
);
689 case 2: /* Reset MMU. */
692 s
->tx_fifo_done_len
= 0;
696 case 3: /* Remove from RX FIFO. */
697 smc91c111_pop_rx_fifo(s
);
699 case 4: /* Remove from RX FIFO and release. */
700 if (s
->rx_fifo_len
> 0) {
701 smc91c111_release_packet(s
, s
->rx_fifo
[0]);
703 smc91c111_pop_rx_fifo(s
);
705 case 5: /* Release. */
706 smc91c111_release_packet(s
, s
->packet_num
);
708 case 6: /* Add to TX FIFO. */
709 smc91c111_queue_tx(s
, s
->packet_num
);
711 case 7: /* Reset TX FIFO. */
713 s
->tx_fifo_done_len
= 0;
716 logout(TARGET_FMT_plx
"= %02" PRIx32
"\n", offset
, value
);
722 case 2: /* Packet Number Register */
723 s
->packet_num
= value
;
725 case 3: case 4: case 5:
726 /* Should be readonly, but linux writes to them anyway. Ignore. */
728 case 6: /* Pointer */
732 SET_HIGH(ptr
, value
);
734 case 8: case 9: case 10: case 11: /* Data */
744 if (s
->ptr
& 0x4000) {
745 s
->ptr
= (s
->ptr
& 0xf800) | ((s
->ptr
+ 1) & 0x7ff);
749 s
->data
[n
][p
] = value
;
752 case 12: /* Interrupt ACK. */
753 s
->int_level
&= ~(value
& 0xd6);
755 smc91c111_pop_tx_fifo_done(s
);
758 case 13: /* Interrupt mask. */
763 logout(TARGET_FMT_plx
"= %02" PRIx32
"\n", offset
, value
);
769 case 0: case 1: case 2: case 3: case 4: case 5: case 6: case 7:
770 /* Multicast table. */
771 logout(TARGET_FMT_plx
"= %02" PRIx32
"\n", offset
, value
);
773 case 8: /* Management Interface (low). */
774 mii_write(&s
->mii
, value
);
776 case 9: /* Management Interface (high). */
778 /* MSK_CRS100 not implemented. */
779 logout(TARGET_FMT_plx
"= %02" PRIx32
"\n", offset
, value
);
782 case 12: /* Early receive. */
783 s
->ercv
= value
& 0x1f;
787 logout(TARGET_FMT_plx
"= %02" PRIx32
"\n", offset
, value
);
790 logout(TARGET_FMT_plx
"= %02" PRIx32
"\n", offset
, value
);
794 logout(TARGET_FMT_plx
"= %02" PRIx32
"\n", offset
, value
);
796 hw_error("smc91c111_write: Bad reg %d:%x\n", s
->bank
, (int)offset
);
799 static uint32_t smc91c111_readb(void *opaque
, hwaddr offset
)
801 smc91c111_state
*s
= (smc91c111_state
*)opaque
;
803 offset
= offset
& 0xf;
813 return s
->tcr
& 0xff;
816 case 2: /* EPH Status */
821 return s
->rcr
& 0xff;
824 case 6: /* Counter */
826 logout(TARGET_FMT_plx
"\n", offset
);
828 case 8: /* Memory size. */
830 case 9: /* Free memory available. */
835 for (i
= 0; i
< NUM_PACKETS
; i
++) {
836 if (s
->allocated
& (1 << i
))
841 case 10: case 11: /* RPCR */
842 logout(TARGET_FMT_plx
"\n", offset
);
844 case 12: case 13: /* Reserved */
847 logout(TARGET_FMT_plx
"\n", offset
);
857 case 2: case 3: /* BASE */
858 logout(TARGET_FMT_plx
"\n", offset
);
860 case 4: case 5: case 6: case 7: case 8: case 9: /* IA */
861 return s
->conf
.macaddr
.a
[offset
- 4];
862 case 10: /* General Purpose */
863 return s
->gpr
& 0xff;
866 case 12: /* Control */
867 return s
->ctr
& 0xff;
871 logout(TARGET_FMT_plx
"\n", offset
);
877 case 0: case 1: /* MMUCR Busy bit. */
879 case 2: /* Packet Number. */
880 return s
->packet_num
;
881 case 3: /* Allocation Result. */
883 case 4: /* TX FIFO */
884 if (s
->tx_fifo_done_len
== 0)
887 return s
->tx_fifo_done
[0];
888 case 5: /* RX FIFO */
889 if (s
->rx_fifo_len
== 0)
892 return s
->rx_fifo
[0];
893 case 6: /* Pointer */
894 return s
->ptr
& 0xff;
896 return (s
->ptr
>> 8) & 0xf7;
897 case 8: case 9: case 10: case 11: /* Data */
907 if (s
->ptr
& 0x4000) {
908 s
->ptr
= (s
->ptr
& 0xf800) | ((s
->ptr
+ 1) & 0x07ff);
912 return s
->data
[n
][p
];
914 case 12: /* Interrupt status. */
916 case 13: /* Interrupt mask. */
919 logout(TARGET_FMT_plx
"\n", offset
);
925 case 0: case 1: case 2: case 3: case 4: case 5: case 6: case 7:
926 /* Multicast table. */
927 logout(TARGET_FMT_plx
"\n", offset
);
929 case 8: /* Management Interface (low). */
930 logout(TARGET_FMT_plx
"\n", offset
);
931 return 0x30 + s
->mii
.mdi
;
932 case 9: /* Management Interface (high). */
934 case 10: /* Revision. */
943 logout(TARGET_FMT_plx
"\n", offset
);
947 logout(TARGET_FMT_plx
"\n", offset
);
949 hw_error("smc91c111_read: Bad reg %d:%x\n", s
->bank
, (int)offset
);
953 static void smc91c111_writew(void *opaque
, hwaddr offset
,
956 smc91c111_writeb(opaque
, offset
, value
& 0xff);
957 smc91c111_writeb(opaque
, offset
+ 1, value
>> 8);
960 static void smc91c111_writel(void *opaque
, hwaddr offset
,
963 /* 32-bit writes to offset 0xc only actually write to the bank select
964 register (offset 0xe) */
966 smc91c111_writew(opaque
, offset
, value
& 0xffff);
967 smc91c111_writew(opaque
, offset
+ 2, value
>> 16);
970 static uint32_t smc91c111_readw(void *opaque
, hwaddr offset
)
973 val
= smc91c111_readb(opaque
, offset
);
974 val
|= smc91c111_readb(opaque
, offset
+ 1) << 8;
978 static uint32_t smc91c111_readl(void *opaque
, hwaddr offset
)
981 val
= smc91c111_readw(opaque
, offset
);
982 val
|= smc91c111_readw(opaque
, offset
+ 2) << 16;
986 static int smc91c111_can_receive_nc(NetClientState
*nc
)
988 smc91c111_state
*s
= qemu_get_nic_opaque(nc
);
990 return smc91c111_can_receive(s
);
993 static ssize_t
smc91c111_receive(NetClientState
*nc
, const uint8_t *buf
, size_t size
)
995 smc91c111_state
*s
= qemu_get_nic_opaque(nc
);
1002 if ((s
->rcr
& RCR_RXEN
) == 0 || (s
->rcr
& RCR_SOFT_RST
))
1004 /* Short packets are padded with zeros. Receiving a packet
1005 < 64 bytes long is considered an error condition. */
1009 packetsize
= (size
& ~1);
1011 crc
= (s
->rcr
& RCR_STRIP_CRC
) == 0;
1014 /* TODO: Flag overrun and receive errors. */
1015 if (packetsize
> 2048)
1017 packetnum
= smc91c111_allocate_packet(s
);
1018 if (packetnum
== 0x80)
1020 s
->rx_fifo
[s
->rx_fifo_len
++] = packetnum
;
1022 p
= &s
->data
[packetnum
][0];
1023 /* ??? Multicast packets? */
1026 status
|= RS_TOOLONG
;
1028 status
|= RS_ODDFRAME
;
1029 *(p
++) = status
& 0xff;
1030 *(p
++) = status
>> 8;
1031 *(p
++) = packetsize
& 0xff;
1032 *(p
++) = packetsize
>> 8;
1033 memcpy(p
, buf
, size
& ~1);
1035 /* Pad short packets. */
1040 *(p
++) = buf
[size
- 1];
1046 /* It's not clear if the CRC should go before or after the last byte in
1047 odd sized packets. Linux disables the CRC, so that's no help.
1048 The pictures in the documentation show the CRC aligned on a 16-bit
1049 boundary before the last odd byte, so that's what we do. */
1051 crc
= crc32(~0, buf
, size
);
1052 *(p
++) = crc
& 0xff; crc
>>= 8;
1053 *(p
++) = crc
& 0xff; crc
>>= 8;
1054 *(p
++) = crc
& 0xff; crc
>>= 8;
1055 *(p
++) = crc
& 0xff;
1058 *(p
++) = buf
[size
- 1];
1064 /* TODO: Raise early RX interrupt? */
1065 s
->int_level
|= INT_RCV
;
1066 smc91c111_update(s
);
1071 static const MemoryRegionOps smc91c111_mem_ops
= {
1072 /* The special case for 32 bit writes to 0xc means we can't just
1073 * set .impl.min/max_access_size to 1, unfortunately
1076 .read
= { smc91c111_readb
, smc91c111_readw
, smc91c111_readl
, },
1077 .write
= { smc91c111_writeb
, smc91c111_writew
, smc91c111_writel
, },
1079 .endianness
= DEVICE_NATIVE_ENDIAN
,
1082 static NetClientInfo net_smc91c111_info
= {
1083 .type
= NET_CLIENT_OPTIONS_KIND_NIC
,
1084 .size
= sizeof(NICState
),
1085 .can_receive
= smc91c111_can_receive_nc
,
1086 .receive
= smc91c111_receive
,
1089 static int smc91c111_init1(SysBusDevice
*sbd
)
1091 DeviceState
*dev
= DEVICE(sbd
);
1092 smc91c111_state
*s
= SMC91C111(dev
);
1094 memory_region_init_io(&s
->mmio
, OBJECT(s
), &smc91c111_mem_ops
, s
,
1095 "smc91c111-mmio", 16);
1096 sysbus_init_mmio(sbd
, &s
->mmio
);
1097 sysbus_init_irq(sbd
, &s
->irq
);
1098 qemu_macaddr_default_if_unset(&s
->conf
.macaddr
);
1099 s
->nic
= qemu_new_nic(&net_smc91c111_info
, &s
->conf
,
1100 object_get_typename(OBJECT(dev
)), dev
->id
, s
);
1101 qemu_format_nic_info_str(qemu_get_queue(s
->nic
), s
->conf
.macaddr
.a
);
1102 /* ??? Save/restore. */
1106 static Property smc91c111_properties
[] = {
1107 DEFINE_NIC_PROPERTIES(smc91c111_state
, conf
),
1108 DEFINE_PROP_END_OF_LIST(),
1111 static void smc91c111_class_init(ObjectClass
*klass
, void *data
)
1113 DeviceClass
*dc
= DEVICE_CLASS(klass
);
1114 SysBusDeviceClass
*k
= SYS_BUS_DEVICE_CLASS(klass
);
1116 k
->init
= smc91c111_init1
;
1117 dc
->reset
= smc91c111_reset
;
1118 dc
->vmsd
= &vmstate_smc91c111
;
1119 dc
->props
= smc91c111_properties
;
1122 static const TypeInfo smc91c111_info
= {
1123 .name
= TYPE_SMC91C111
,
1124 .parent
= TYPE_SYS_BUS_DEVICE
,
1125 .instance_size
= sizeof(smc91c111_state
),
1126 .class_init
= smc91c111_class_init
,
1129 static void smc91c111_register_types(void)
1131 type_register_static(&smc91c111_info
);
1134 /* Legacy helper function. Should go away when machine config files are
1136 void smc91c111_init(NICInfo
*nd
, uint32_t base
, qemu_irq irq
)
1141 qemu_check_nic_model(nd
, "smc91c111");
1142 dev
= qdev_create(NULL
, TYPE_SMC91C111
);
1143 qdev_set_nic_properties(dev
, nd
);
1144 qdev_init_nofail(dev
);
1145 s
= SYS_BUS_DEVICE(dev
);
1146 sysbus_mmio_map(s
, 0, base
);
1147 sysbus_connect_irq(s
, 0, irq
);
1150 type_init(smc91c111_register_types
)