2 * QEMU NE2000 emulation
4 * Copyright (c) 2003-2004 Fabrice Bellard
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
25 #include "qemu/osdep.h"
27 #include "qemu/module.h"
28 #include "exec/memory.h"
30 #include "migration/vmstate.h"
34 /* debug NE2000 card */
35 //#define DEBUG_NE2000
37 #define MAX_ETH_FRAME_SIZE 1514
39 #define E8390_CMD 0x00 /* The command register (for all pages) */
40 /* Page 0 register offsets. */
41 #define EN0_CLDALO 0x01 /* Low byte of current local dma addr RD */
42 #define EN0_STARTPG 0x01 /* Starting page of ring bfr WR */
43 #define EN0_CLDAHI 0x02 /* High byte of current local dma addr RD */
44 #define EN0_STOPPG 0x02 /* Ending page +1 of ring bfr WR */
45 #define EN0_BOUNDARY 0x03 /* Boundary page of ring bfr RD WR */
46 #define EN0_TSR 0x04 /* Transmit status reg RD */
47 #define EN0_TPSR 0x04 /* Transmit starting page WR */
48 #define EN0_NCR 0x05 /* Number of collision reg RD */
49 #define EN0_TCNTLO 0x05 /* Low byte of tx byte count WR */
50 #define EN0_FIFO 0x06 /* FIFO RD */
51 #define EN0_TCNTHI 0x06 /* High byte of tx byte count WR */
52 #define EN0_ISR 0x07 /* Interrupt status reg RD WR */
53 #define EN0_CRDALO 0x08 /* low byte of current remote dma address RD */
54 #define EN0_RSARLO 0x08 /* Remote start address reg 0 */
55 #define EN0_CRDAHI 0x09 /* high byte, current remote dma address RD */
56 #define EN0_RSARHI 0x09 /* Remote start address reg 1 */
57 #define EN0_RCNTLO 0x0a /* Remote byte count reg WR */
58 #define EN0_RTL8029ID0 0x0a /* Realtek ID byte #1 RD */
59 #define EN0_RCNTHI 0x0b /* Remote byte count reg WR */
60 #define EN0_RTL8029ID1 0x0b /* Realtek ID byte #2 RD */
61 #define EN0_RSR 0x0c /* rx status reg RD */
62 #define EN0_RXCR 0x0c /* RX configuration reg WR */
63 #define EN0_TXCR 0x0d /* TX configuration reg WR */
64 #define EN0_COUNTER0 0x0d /* Rcv alignment error counter RD */
65 #define EN0_DCFG 0x0e /* Data configuration reg WR */
66 #define EN0_COUNTER1 0x0e /* Rcv CRC error counter RD */
67 #define EN0_IMR 0x0f /* Interrupt mask reg WR */
68 #define EN0_COUNTER2 0x0f /* Rcv missed frame error counter RD */
71 #define EN1_CURPAG 0x17
74 #define EN2_STARTPG 0x21 /* Starting page of ring bfr RD */
75 #define EN2_STOPPG 0x22 /* Ending page +1 of ring bfr RD */
77 #define EN3_CONFIG0 0x33
78 #define EN3_CONFIG1 0x34
79 #define EN3_CONFIG2 0x35
80 #define EN3_CONFIG3 0x36
82 /* Register accessed at EN_CMD, the 8390 base addr. */
83 #define E8390_STOP 0x01 /* Stop and reset the chip */
84 #define E8390_START 0x02 /* Start the chip, clear reset */
85 #define E8390_TRANS 0x04 /* Transmit a frame */
86 #define E8390_RREAD 0x08 /* Remote read */
87 #define E8390_RWRITE 0x10 /* Remote write */
88 #define E8390_NODMA 0x20 /* Remote DMA */
89 #define E8390_PAGE0 0x00 /* Select page chip registers */
90 #define E8390_PAGE1 0x40 /* using the two high-order bits */
91 #define E8390_PAGE2 0x80 /* Page 3 is invalid. */
93 /* Bits in EN0_ISR - Interrupt status register */
94 #define ENISR_RX 0x01 /* Receiver, no error */
95 #define ENISR_TX 0x02 /* Transmitter, no error */
96 #define ENISR_RX_ERR 0x04 /* Receiver, with error */
97 #define ENISR_TX_ERR 0x08 /* Transmitter, with error */
98 #define ENISR_OVER 0x10 /* Receiver overwrote the ring */
99 #define ENISR_COUNTERS 0x20 /* Counters need emptying */
100 #define ENISR_RDC 0x40 /* remote dma complete */
101 #define ENISR_RESET 0x80 /* Reset completed */
102 #define ENISR_ALL 0x3f /* Interrupts we will enable */
104 /* Bits in received packet status byte and EN0_RSR*/
105 #define ENRSR_RXOK 0x01 /* Received a good packet */
106 #define ENRSR_CRC 0x02 /* CRC error */
107 #define ENRSR_FAE 0x04 /* frame alignment error */
108 #define ENRSR_FO 0x08 /* FIFO overrun */
109 #define ENRSR_MPA 0x10 /* missed pkt */
110 #define ENRSR_PHY 0x20 /* physical/multicast address */
111 #define ENRSR_DIS 0x40 /* receiver disable. set in monitor mode */
112 #define ENRSR_DEF 0x80 /* deferring */
114 /* Transmitted packet status, EN0_TSR. */
115 #define ENTSR_PTX 0x01 /* Packet transmitted without error */
116 #define ENTSR_ND 0x02 /* The transmit wasn't deferred. */
117 #define ENTSR_COL 0x04 /* The transmit collided at least once. */
118 #define ENTSR_ABT 0x08 /* The transmit collided 16 times, and was deferred. */
119 #define ENTSR_CRS 0x10 /* The carrier sense was lost. */
120 #define ENTSR_FU 0x20 /* A "FIFO underrun" occurred during transmit. */
121 #define ENTSR_CDH 0x40 /* The collision detect "heartbeat" signal was lost. */
122 #define ENTSR_OWC 0x80 /* There was an out-of-window collision. */
124 void ne2000_reset(NE2000State
*s
)
128 s
->isr
= ENISR_RESET
;
129 memcpy(s
->mem
, &s
->c
.macaddr
, 6);
133 /* duplicate prom data */
134 for(i
= 15;i
>= 0; i
--) {
135 s
->mem
[2 * i
] = s
->mem
[i
];
136 s
->mem
[2 * i
+ 1] = s
->mem
[i
];
140 static void ne2000_update_irq(NE2000State
*s
)
143 isr
= (s
->isr
& s
->imr
) & 0x7f;
144 #if defined(DEBUG_NE2000)
145 printf("NE2000: Set IRQ to %d (%02x %02x)\n",
146 isr
? 1 : 0, s
->isr
, s
->imr
);
148 qemu_set_irq(s
->irq
, (isr
!= 0));
151 static int ne2000_buffer_full(NE2000State
*s
)
153 int avail
, index
, boundary
;
155 if (s
->stop
<= s
->start
) {
159 index
= s
->curpag
<< 8;
160 boundary
= s
->boundary
<< 8;
161 if (index
< boundary
)
162 avail
= boundary
- index
;
164 avail
= (s
->stop
- s
->start
) - (index
- boundary
);
165 if (avail
< (MAX_ETH_FRAME_SIZE
+ 4))
170 ssize_t
ne2000_receive(NetClientState
*nc
, const uint8_t *buf
, size_t size_
)
172 NE2000State
*s
= qemu_get_nic_opaque(nc
);
175 unsigned int total_len
, next
, avail
, len
, index
, mcast_idx
;
176 static const uint8_t broadcast_macaddr
[6] =
177 { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
179 #if defined(DEBUG_NE2000)
180 printf("NE2000: received len=%zu\n", size
);
183 if (s
->cmd
& E8390_STOP
|| ne2000_buffer_full(s
))
186 /* XXX: check this */
187 if (s
->rxcr
& 0x10) {
188 /* promiscuous: receive all */
190 if (!memcmp(buf
, broadcast_macaddr
, 6)) {
191 /* broadcast address */
192 if (!(s
->rxcr
& 0x04))
194 } else if (buf
[0] & 0x01) {
196 if (!(s
->rxcr
& 0x08))
198 mcast_idx
= net_crc32(buf
, ETH_ALEN
) >> 26;
199 if (!(s
->mult
[mcast_idx
>> 3] & (1 << (mcast_idx
& 7))))
201 } else if (s
->mem
[0] == buf
[0] &&
202 s
->mem
[2] == buf
[1] &&
203 s
->mem
[4] == buf
[2] &&
204 s
->mem
[6] == buf
[3] &&
205 s
->mem
[8] == buf
[4] &&
206 s
->mem
[10] == buf
[5]) {
213 index
= s
->curpag
<< 8;
214 if (index
>= NE2000_PMEM_END
) {
217 /* 4 bytes for header */
218 total_len
= size
+ 4;
219 /* address for next packet (4 bytes for CRC) */
220 next
= index
+ ((total_len
+ 4 + 255) & ~0xff);
222 next
-= (s
->stop
- s
->start
);
223 /* prepare packet header */
225 s
->rsr
= ENRSR_RXOK
; /* receive status */
226 /* XXX: check this */
232 p
[3] = total_len
>> 8;
235 /* write packet data */
237 if (index
<= s
->stop
)
238 avail
= s
->stop
- index
;
244 memcpy(s
->mem
+ index
, buf
, len
);
247 if (index
== s
->stop
)
251 s
->curpag
= next
>> 8;
253 /* now we can signal we have received something */
255 ne2000_update_irq(s
);
260 static void ne2000_ioport_write(void *opaque
, uint32_t addr
, uint32_t val
)
262 NE2000State
*s
= opaque
;
263 int offset
, page
, index
;
266 trace_ne2000_ioport_write(addr
, val
);
267 if (addr
== E8390_CMD
) {
268 /* control register */
270 if (!(val
& E8390_STOP
)) { /* START bit makes no sense on RTL8029... */
271 s
->isr
&= ~ENISR_RESET
;
272 /* test specific case: zero length transfer */
273 if ((val
& (E8390_RREAD
| E8390_RWRITE
)) &&
276 ne2000_update_irq(s
);
278 if (val
& E8390_TRANS
) {
279 index
= (s
->tpsr
<< 8);
280 /* XXX: next 2 lines are a hack to make netware 3.11 work */
281 if (index
>= NE2000_PMEM_END
)
282 index
-= NE2000_PMEM_SIZE
;
283 /* fail safe: check range on the transmitted length */
284 if (index
+ s
->tcnt
<= NE2000_PMEM_END
) {
285 qemu_send_packet(qemu_get_queue(s
->nic
), s
->mem
+ index
,
288 /* signal end of transfer */
291 s
->cmd
&= ~E8390_TRANS
;
292 ne2000_update_irq(s
);
297 offset
= addr
| (page
<< 4);
300 if (val
<< 8 <= NE2000_PMEM_END
) {
305 if (val
<< 8 <= NE2000_PMEM_END
) {
310 if (val
<< 8 < NE2000_PMEM_END
) {
316 ne2000_update_irq(s
);
322 s
->tcnt
= (s
->tcnt
& 0xff00) | val
;
325 s
->tcnt
= (s
->tcnt
& 0x00ff) | (val
<< 8);
328 s
->rsar
= (s
->rsar
& 0xff00) | val
;
331 s
->rsar
= (s
->rsar
& 0x00ff) | (val
<< 8);
334 s
->rcnt
= (s
->rcnt
& 0xff00) | val
;
337 s
->rcnt
= (s
->rcnt
& 0x00ff) | (val
<< 8);
346 s
->isr
&= ~(val
& 0x7f);
347 ne2000_update_irq(s
);
349 case EN1_PHYS
... EN1_PHYS
+ 5:
350 s
->phys
[offset
- EN1_PHYS
] = val
;
353 if (val
<< 8 < NE2000_PMEM_END
) {
357 case EN1_MULT
... EN1_MULT
+ 7:
358 s
->mult
[offset
- EN1_MULT
] = val
;
364 static uint32_t ne2000_ioport_read(void *opaque
, uint32_t addr
)
366 NE2000State
*s
= opaque
;
367 int offset
, page
, ret
;
370 if (addr
== E8390_CMD
) {
374 offset
= addr
| (page
<< 4);
386 ret
= s
->rsar
& 0x00ff;
391 case EN1_PHYS
... EN1_PHYS
+ 5:
392 ret
= s
->phys
[offset
- EN1_PHYS
];
397 case EN1_MULT
... EN1_MULT
+ 7:
398 ret
= s
->mult
[offset
- EN1_MULT
];
416 ret
= 0; /* 10baseT media */
419 ret
= 0x40; /* 10baseT active */
422 ret
= 0x40; /* Full duplex */
429 trace_ne2000_ioport_read(addr
, ret
);
433 static inline void ne2000_mem_writeb(NE2000State
*s
, uint32_t addr
,
437 (addr
>= NE2000_PMEM_START
&& addr
< NE2000_MEM_SIZE
)) {
442 static inline void ne2000_mem_writew(NE2000State
*s
, uint32_t addr
,
445 addr
&= ~1; /* XXX: check exact behaviour if not even */
447 (addr
>= NE2000_PMEM_START
&& addr
< NE2000_MEM_SIZE
)) {
448 *(uint16_t *)(s
->mem
+ addr
) = cpu_to_le16(val
);
452 static inline void ne2000_mem_writel(NE2000State
*s
, uint32_t addr
,
455 addr
&= ~1; /* XXX: check exact behaviour if not even */
457 || (addr
>= NE2000_PMEM_START
458 && addr
+ sizeof(uint32_t) <= NE2000_MEM_SIZE
)) {
459 stl_le_p(s
->mem
+ addr
, val
);
463 static inline uint32_t ne2000_mem_readb(NE2000State
*s
, uint32_t addr
)
466 (addr
>= NE2000_PMEM_START
&& addr
< NE2000_MEM_SIZE
)) {
473 static inline uint32_t ne2000_mem_readw(NE2000State
*s
, uint32_t addr
)
475 addr
&= ~1; /* XXX: check exact behaviour if not even */
477 (addr
>= NE2000_PMEM_START
&& addr
< NE2000_MEM_SIZE
)) {
478 return le16_to_cpu(*(uint16_t *)(s
->mem
+ addr
));
484 static inline uint32_t ne2000_mem_readl(NE2000State
*s
, uint32_t addr
)
486 addr
&= ~1; /* XXX: check exact behaviour if not even */
488 || (addr
>= NE2000_PMEM_START
489 && addr
+ sizeof(uint32_t) <= NE2000_MEM_SIZE
)) {
490 return ldl_le_p(s
->mem
+ addr
);
496 static inline void ne2000_dma_update(NE2000State
*s
, int len
)
500 /* XXX: check what to do if rsar > stop */
501 if (s
->rsar
== s
->stop
)
504 if (s
->rcnt
<= len
) {
506 /* signal end of transfer */
508 ne2000_update_irq(s
);
514 static void ne2000_asic_ioport_write(void *opaque
, uint32_t addr
, uint32_t val
)
516 NE2000State
*s
= opaque
;
519 printf("NE2000: asic write val=0x%04x\n", val
);
523 if (s
->dcfg
& 0x01) {
525 ne2000_mem_writew(s
, s
->rsar
, val
);
526 ne2000_dma_update(s
, 2);
529 ne2000_mem_writeb(s
, s
->rsar
, val
);
530 ne2000_dma_update(s
, 1);
534 static uint32_t ne2000_asic_ioport_read(void *opaque
, uint32_t addr
)
536 NE2000State
*s
= opaque
;
539 if (s
->dcfg
& 0x01) {
541 ret
= ne2000_mem_readw(s
, s
->rsar
);
542 ne2000_dma_update(s
, 2);
545 ret
= ne2000_mem_readb(s
, s
->rsar
);
546 ne2000_dma_update(s
, 1);
549 printf("NE2000: asic read val=0x%04x\n", ret
);
554 static void ne2000_asic_ioport_writel(void *opaque
, uint32_t addr
, uint32_t val
)
556 NE2000State
*s
= opaque
;
559 printf("NE2000: asic writel val=0x%04x\n", val
);
564 ne2000_mem_writel(s
, s
->rsar
, val
);
565 ne2000_dma_update(s
, 4);
568 static uint32_t ne2000_asic_ioport_readl(void *opaque
, uint32_t addr
)
570 NE2000State
*s
= opaque
;
574 ret
= ne2000_mem_readl(s
, s
->rsar
);
575 ne2000_dma_update(s
, 4);
577 printf("NE2000: asic readl val=0x%04x\n", ret
);
582 static void ne2000_reset_ioport_write(void *opaque
, uint32_t addr
, uint32_t val
)
584 /* nothing to do (end of reset pulse) */
587 static uint32_t ne2000_reset_ioport_read(void *opaque
, uint32_t addr
)
589 NE2000State
*s
= opaque
;
594 static int ne2000_post_load(void* opaque
, int version_id
)
596 NE2000State
* s
= opaque
;
598 if (version_id
< 2) {
604 const VMStateDescription vmstate_ne2000
= {
607 .minimum_version_id
= 0,
608 .post_load
= ne2000_post_load
,
609 .fields
= (const VMStateField
[]) {
610 VMSTATE_UINT8_V(rxcr
, NE2000State
, 2),
611 VMSTATE_UINT8(cmd
, NE2000State
),
612 VMSTATE_UINT32(start
, NE2000State
),
613 VMSTATE_UINT32(stop
, NE2000State
),
614 VMSTATE_UINT8(boundary
, NE2000State
),
615 VMSTATE_UINT8(tsr
, NE2000State
),
616 VMSTATE_UINT8(tpsr
, NE2000State
),
617 VMSTATE_UINT16(tcnt
, NE2000State
),
618 VMSTATE_UINT16(rcnt
, NE2000State
),
619 VMSTATE_UINT32(rsar
, NE2000State
),
620 VMSTATE_UINT8(rsr
, NE2000State
),
621 VMSTATE_UINT8(isr
, NE2000State
),
622 VMSTATE_UINT8(dcfg
, NE2000State
),
623 VMSTATE_UINT8(imr
, NE2000State
),
624 VMSTATE_BUFFER(phys
, NE2000State
),
625 VMSTATE_UINT8(curpag
, NE2000State
),
626 VMSTATE_BUFFER(mult
, NE2000State
),
627 VMSTATE_UNUSED(4), /* was irq */
628 VMSTATE_BUFFER(mem
, NE2000State
),
629 VMSTATE_END_OF_LIST()
633 static uint64_t ne2000_read(void *opaque
, hwaddr addr
,
636 NE2000State
*s
= opaque
;
639 if (addr
< 0x10 && size
== 1) {
640 val
= ne2000_ioport_read(s
, addr
);
641 } else if (addr
== 0x10) {
643 val
= ne2000_asic_ioport_read(s
, addr
);
645 val
= ne2000_asic_ioport_readl(s
, addr
);
647 } else if (addr
== 0x1f && size
== 1) {
648 val
= ne2000_reset_ioport_read(s
, addr
);
650 val
= ((uint64_t)1 << (size
* 8)) - 1;
652 trace_ne2000_read(addr
, val
);
657 static void ne2000_write(void *opaque
, hwaddr addr
,
658 uint64_t data
, unsigned size
)
660 NE2000State
*s
= opaque
;
662 trace_ne2000_write(addr
, data
);
663 if (addr
< 0x10 && size
== 1) {
664 ne2000_ioport_write(s
, addr
, data
);
665 } else if (addr
== 0x10) {
667 ne2000_asic_ioport_write(s
, addr
, data
);
669 ne2000_asic_ioport_writel(s
, addr
, data
);
671 } else if (addr
== 0x1f && size
== 1) {
672 ne2000_reset_ioport_write(s
, addr
, data
);
676 static const MemoryRegionOps ne2000_ops
= {
678 .write
= ne2000_write
,
679 .endianness
= DEVICE_LITTLE_ENDIAN
,
682 /***********************************************************/
683 /* PCI NE2000 definitions */
685 void ne2000_setup_io(NE2000State
*s
, DeviceState
*dev
, unsigned size
)
687 memory_region_init_io(&s
->io
, OBJECT(dev
), &ne2000_ops
, s
, "ne2000", size
);