hw/net/smc91c111.c

   1 /*
   2  * SMSC 91C111 Ethernet interface emulation
   3  *
   4  * Copyright (c) 2005 CodeSourcery, LLC.
   5  * Written by Paul Brook
   6  *
   7  * This code is licensed under the GPL
   8  */
   9
  10 #include "qemu/osdep.h"
  11 #include "hw/sysbus.h"
  12 #include "net/net.h"
  13 #include "hw/devices.h"
  14 #include "qemu/log.h"
  15 /* For crc32 */
  16 #include <zlib.h>
  17
  18 /* Number of 2k memory pages available.  */
  19 #define NUM_PACKETS 4
  20
  21 #define TYPE_SMC91C111 "smc91c111"
  22 #define SMC91C111(obj) OBJECT_CHECK(smc91c111_state, (obj), TYPE_SMC91C111)
  23
  24 typedef struct {
  25     SysBusDevice parent_obj;
  26
  27     NICState *nic;
  28     NICConf conf;
  29     uint16_t tcr;
  30     uint16_t rcr;
  31     uint16_t cr;
  32     uint16_t ctr;
  33     uint16_t gpr;
  34     uint16_t ptr;
  35     uint16_t ercv;
  36     qemu_irq irq;
  37     int bank;
  38     int packet_num;
  39     int tx_alloc;
  40     /* Bitmask of allocated packets.  */
  41     int allocated;
  42     int tx_fifo_len;
  43     int tx_fifo[NUM_PACKETS];
  44     int rx_fifo_len;
  45     int rx_fifo[NUM_PACKETS];
  46     int tx_fifo_done_len;
  47     int tx_fifo_done[NUM_PACKETS];
  48     /* Packet buffer memory.  */
  49     uint8_t data[NUM_PACKETS][2048];
  50     uint8_t int_level;
  51     uint8_t int_mask;
  52     MemoryRegion mmio;
  53 } smc91c111_state;
  54
  55 static const VMStateDescription vmstate_smc91c111 = {
  56     .name = "smc91c111",
  57     .version_id = 1,
  58     .minimum_version_id = 1,
  59     .fields = (VMStateField[]) {
  60         VMSTATE_UINT16(tcr, smc91c111_state),
  61         VMSTATE_UINT16(rcr, smc91c111_state),
  62         VMSTATE_UINT16(cr, smc91c111_state),
  63         VMSTATE_UINT16(ctr, smc91c111_state),
  64         VMSTATE_UINT16(gpr, smc91c111_state),
  65         VMSTATE_UINT16(ptr, smc91c111_state),
  66         VMSTATE_UINT16(ercv, smc91c111_state),
  67         VMSTATE_INT32(bank, smc91c111_state),
  68         VMSTATE_INT32(packet_num, smc91c111_state),
  69         VMSTATE_INT32(tx_alloc, smc91c111_state),
  70         VMSTATE_INT32(allocated, smc91c111_state),
  71         VMSTATE_INT32(tx_fifo_len, smc91c111_state),
  72         VMSTATE_INT32_ARRAY(tx_fifo, smc91c111_state, NUM_PACKETS),
  73         VMSTATE_INT32(rx_fifo_len, smc91c111_state),
  74         VMSTATE_INT32_ARRAY(rx_fifo, smc91c111_state, NUM_PACKETS),
  75         VMSTATE_INT32(tx_fifo_done_len, smc91c111_state),
  76         VMSTATE_INT32_ARRAY(tx_fifo_done, smc91c111_state, NUM_PACKETS),
  77         VMSTATE_BUFFER_UNSAFE(data, smc91c111_state, 0, NUM_PACKETS * 2048),
  78         VMSTATE_UINT8(int_level, smc91c111_state),
  79         VMSTATE_UINT8(int_mask, smc91c111_state),
  80         VMSTATE_END_OF_LIST()
  81     }
  82 };
  83
  84 #define RCR_SOFT_RST  0x8000
  85 #define RCR_STRIP_CRC 0x0200
  86 #define RCR_RXEN      0x0100
  87
  88 #define TCR_EPH_LOOP  0x2000
  89 #define TCR_NOCRC     0x0100
  90 #define TCR_PAD_EN    0x0080
  91 #define TCR_FORCOL    0x0004
  92 #define TCR_LOOP      0x0002
  93 #define TCR_TXEN      0x0001
  94
  95 #define INT_MD        0x80
  96 #define INT_ERCV      0x40
  97 #define INT_EPH       0x20
  98 #define INT_RX_OVRN   0x10
  99 #define INT_ALLOC     0x08
 100 #define INT_TX_EMPTY  0x04
 101 #define INT_TX        0x02
 102 #define INT_RCV       0x01
 103
 104 #define CTR_AUTO_RELEASE  0x0800
 105 #define CTR_RELOAD        0x0002
 106 #define CTR_STORE         0x0001
 107
 108 #define RS_ALGNERR      0x8000
 109 #define RS_BRODCAST     0x4000
 110 #define RS_BADCRC       0x2000
 111 #define RS_ODDFRAME     0x1000
 112 #define RS_TOOLONG      0x0800
 113 #define RS_TOOSHORT     0x0400
 114 #define RS_MULTICAST    0x0001
 115
 116 /* Update interrupt status.  */
 117 static void smc91c111_update(smc91c111_state *s)
 118 {
 119     int level;
 120
 121     if (s->tx_fifo_len == 0)
 122         s->int_level |= INT_TX_EMPTY;
 123     if (s->tx_fifo_done_len != 0)
 124         s->int_level |= INT_TX;
 125     level = (s->int_level & s->int_mask) != 0;
 126     qemu_set_irq(s->irq, level);
 127 }
 128
 129 static int smc91c111_can_receive(smc91c111_state *s)
 130 {
 131     if ((s->rcr & RCR_RXEN) == 0 || (s->rcr & RCR_SOFT_RST)) {
 132         return 1;
 133     }
 134     if (s->allocated == (1 << NUM_PACKETS) - 1 ||
 135         s->rx_fifo_len == NUM_PACKETS) {
 136         return 0;
 137     }
 138     return 1;
 139 }
 140
 141 static inline void smc91c111_flush_queued_packets(smc91c111_state *s)
 142 {
 143     if (smc91c111_can_receive(s)) {
 144         qemu_flush_queued_packets(qemu_get_queue(s->nic));
 145     }
 146 }
 147
 148 /* Try to allocate a packet.  Returns 0x80 on failure.  */
 149 static int smc91c111_allocate_packet(smc91c111_state *s)
 150 {
 151     int i;
 152     if (s->allocated == (1 << NUM_PACKETS) - 1) {
 153         return 0x80;
 154     }
 155
 156     for (i = 0; i < NUM_PACKETS; i++) {
 157         if ((s->allocated & (1 << i)) == 0)
 158             break;
 159     }
 160     s->allocated |= 1 << i;
 161     return i;
 162 }
 163
 164
 165 /* Process a pending TX allocate.  */
 166 static void smc91c111_tx_alloc(smc91c111_state *s)
 167 {
 168     s->tx_alloc = smc91c111_allocate_packet(s);
 169     if (s->tx_alloc == 0x80)
 170         return;
 171     s->int_level |= INT_ALLOC;
 172     smc91c111_update(s);
 173 }
 174
 175 /* Remove and item from the RX FIFO.  */
 176 static void smc91c111_pop_rx_fifo(smc91c111_state *s)
 177 {
 178     int i;
 179
 180     s->rx_fifo_len--;
 181     if (s->rx_fifo_len) {
 182         for (i = 0; i < s->rx_fifo_len; i++)
 183             s->rx_fifo[i] = s->rx_fifo[i + 1];
 184         s->int_level |= INT_RCV;
 185     } else {
 186         s->int_level &= ~INT_RCV;
 187     }
 188     smc91c111_flush_queued_packets(s);
 189     smc91c111_update(s);
 190 }
 191
 192 /* Remove an item from the TX completion FIFO.  */
 193 static void smc91c111_pop_tx_fifo_done(smc91c111_state *s)
 194 {
 195     int i;
 196
 197     if (s->tx_fifo_done_len == 0)
 198         return;
 199     s->tx_fifo_done_len--;
 200     for (i = 0; i < s->tx_fifo_done_len; i++)
 201         s->tx_fifo_done[i] = s->tx_fifo_done[i + 1];
 202 }
 203
 204 /* Release the memory allocated to a packet.  */
 205 static void smc91c111_release_packet(smc91c111_state *s, int packet)
 206 {
 207     s->allocated &= ~(1 << packet);
 208     if (s->tx_alloc == 0x80)
 209         smc91c111_tx_alloc(s);
 210     smc91c111_flush_queued_packets(s);
 211 }
 212
 213 /* Flush the TX FIFO.  */
 214 static void smc91c111_do_tx(smc91c111_state *s)
 215 {
 216     int i;
 217     int len;
 218     int control;
 219     int packetnum;
 220     uint8_t *p;
 221
 222     if ((s->tcr & TCR_TXEN) == 0)
 223         return;
 224     if (s->tx_fifo_len == 0)
 225         return;
 226     for (i = 0; i < s->tx_fifo_len; i++) {
 227         packetnum = s->tx_fifo[i];
 228         p = &s->data[packetnum][0];
 229         /* Set status word.  */
 230         *(p++) = 0x01;
 231         *(p++) = 0x40;
 232         len = *(p++);
 233         len |= ((int)*(p++)) << 8;
 234         len -= 6;
 235         control = p[len + 1];
 236         if (control & 0x20)
 237             len++;
 238         /* ??? This overwrites the data following the buffer.
 239            Don't know what real hardware does.  */
 240         if (len < 64 && (s->tcr & TCR_PAD_EN)) {
 241             memset(p + len, 0, 64 - len);
 242             len = 64;
 243         }
 244 #if 0
 245         {
 246             int add_crc;
 247
 248             /* The card is supposed to append the CRC to the frame.
 249                However none of the other network traffic has the CRC
 250                appended.  Suspect this is low level ethernet detail we
 251                don't need to worry about.  */
 252             add_crc = (control & 0x10) || (s->tcr & TCR_NOCRC) == 0;
 253             if (add_crc) {
 254                 uint32_t crc;
 255
 256                 crc = crc32(~0, p, len);
 257                 memcpy(p + len, &crc, 4);
 258                 len += 4;
 259             }
 260         }
 261 #endif
 262         if (s->ctr & CTR_AUTO_RELEASE)
 263             /* Race?  */
 264             smc91c111_release_packet(s, packetnum);
 265         else if (s->tx_fifo_done_len < NUM_PACKETS)
 266             s->tx_fifo_done[s->tx_fifo_done_len++] = packetnum;
 267         qemu_send_packet(qemu_get_queue(s->nic), p, len);
 268     }
 269     s->tx_fifo_len = 0;
 270     smc91c111_update(s);
 271 }
 272
 273 /* Add a packet to the TX FIFO.  */
 274 static void smc91c111_queue_tx(smc91c111_state *s, int packet)
 275 {
 276     if (s->tx_fifo_len == NUM_PACKETS)
 277         return;
 278     s->tx_fifo[s->tx_fifo_len++] = packet;
 279     smc91c111_do_tx(s);
 280 }
 281
 282 static void smc91c111_reset(DeviceState *dev)
 283 {
 284     smc91c111_state *s = SMC91C111(dev);
 285
 286     s->bank = 0;
 287     s->tx_fifo_len = 0;
 288     s->tx_fifo_done_len = 0;
 289     s->rx_fifo_len = 0;
 290     s->allocated = 0;
 291     s->packet_num = 0;
 292     s->tx_alloc = 0;
 293     s->tcr = 0;
 294     s->rcr = 0;
 295     s->cr = 0xa0b1;
 296     s->ctr = 0x1210;
 297     s->ptr = 0;
 298     s->ercv = 0x1f;
 299     s->int_level = INT_TX_EMPTY;
 300     s->int_mask = 0;
 301     smc91c111_update(s);
 302 }
 303
 304 #define SET_LOW(name, val) s->name = (s->name & 0xff00) | val
 305 #define SET_HIGH(name, val) s->name = (s->name & 0xff) | (val << 8)
 306
 307 static void smc91c111_writeb(void *opaque, hwaddr offset,
 308                              uint32_t value)
 309 {
 310     smc91c111_state *s = (smc91c111_state *)opaque;
 311
 312     offset = offset & 0xf;
 313     if (offset == 14) {
 314         s->bank = value;
 315         return;
 316     }
 317     if (offset == 15)
 318         return;
 319     switch (s->bank) {
 320     case 0:
 321         switch (offset) {
 322         case 0: /* TCR */
 323             SET_LOW(tcr, value);
 324             return;
 325         case 1:
 326             SET_HIGH(tcr, value);
 327             return;
 328         case 4: /* RCR */
 329             SET_LOW(rcr, value);
 330             return;
 331         case 5:
 332             SET_HIGH(rcr, value);
 333             if (s->rcr & RCR_SOFT_RST) {
 334                 smc91c111_reset(DEVICE(s));
 335             }
 336             smc91c111_flush_queued_packets(s);
 337             return;
 338         case 10: case 11: /* RPCR */
 339             /* Ignored */
 340             return;
 341         case 12: case 13: /* Reserved */
 342             return;
 343         }
 344         break;
 345
 346     case 1:
 347         switch (offset) {
 348         case 0: /* CONFIG */
 349             SET_LOW(cr, value);
 350             return;
 351         case 1:
 352             SET_HIGH(cr,value);
 353             return;
 354         case 2: case 3: /* BASE */
 355         case 4: case 5: case 6: case 7: case 8: case 9: /* IA */
 356             /* Not implemented.  */
 357             return;
 358         case 10: /* Genral Purpose */
 359             SET_LOW(gpr, value);
 360             return;
 361         case 11:
 362             SET_HIGH(gpr, value);
 363             return;
 364         case 12: /* Control */
 365             if (value & 1)
 366                 fprintf(stderr, "smc91c111:EEPROM store not implemented\n");
 367             if (value & 2)
 368                 fprintf(stderr, "smc91c111:EEPROM reload not implemented\n");
 369             value &= ~3;
 370             SET_LOW(ctr, value);
 371             return;
 372         case 13:
 373             SET_HIGH(ctr, value);
 374             return;
 375         }
 376         break;
 377
 378     case 2:
 379         switch (offset) {
 380         case 0: /* MMU Command */
 381             switch (value >> 5) {
 382             case 0: /* no-op */
 383                 break;
 384             case 1: /* Allocate for TX.  */
 385                 s->tx_alloc = 0x80;
 386                 s->int_level &= ~INT_ALLOC;
 387                 smc91c111_update(s);
 388                 smc91c111_tx_alloc(s);
 389                 break;
 390             case 2: /* Reset MMU.  */
 391                 s->allocated = 0;
 392                 s->tx_fifo_len = 0;
 393                 s->tx_fifo_done_len = 0;
 394                 s->rx_fifo_len = 0;
 395                 s->tx_alloc = 0;
 396                 break;
 397             case 3: /* Remove from RX FIFO.  */
 398                 smc91c111_pop_rx_fifo(s);
 399                 break;
 400             case 4: /* Remove from RX FIFO and release.  */
 401                 if (s->rx_fifo_len > 0) {
 402                     smc91c111_release_packet(s, s->rx_fifo[0]);
 403                 }
 404                 smc91c111_pop_rx_fifo(s);
 405                 break;
 406             case 5: /* Release.  */
 407                 smc91c111_release_packet(s, s->packet_num);
 408                 break;
 409             case 6: /* Add to TX FIFO.  */
 410                 smc91c111_queue_tx(s, s->packet_num);
 411                 break;
 412             case 7: /* Reset TX FIFO.  */
 413                 s->tx_fifo_len = 0;
 414                 s->tx_fifo_done_len = 0;
 415                 break;
 416             }
 417             return;
 418         case 1:
 419             /* Ignore.  */
 420             return;
 421         case 2: /* Packet Number Register */
 422             s->packet_num = value;
 423             return;
 424         case 3: case 4: case 5:
 425             /* Should be readonly, but linux writes to them anyway. Ignore.  */
 426             return;
 427         case 6: /* Pointer */
 428             SET_LOW(ptr, value);
 429             return;
 430         case 7:
 431             SET_HIGH(ptr, value);
 432             return;
 433         case 8: case 9: case 10: case 11: /* Data */
 434             {
 435                 int p;
 436                 int n;
 437
 438                 if (s->ptr & 0x8000)
 439                     n = s->rx_fifo[0];
 440                 else
 441                     n = s->packet_num;
 442                 p = s->ptr & 0x07ff;
 443                 if (s->ptr & 0x4000) {
 444                     s->ptr = (s->ptr & 0xf800) | ((s->ptr + 1) & 0x7ff);
 445                 } else {
 446                     p += (offset & 3);
 447                 }
 448                 s->data[n][p] = value;
 449             }
 450             return;
 451         case 12: /* Interrupt ACK.  */
 452             s->int_level &= ~(value & 0xd6);
 453             if (value & INT_TX)
 454                 smc91c111_pop_tx_fifo_done(s);
 455             smc91c111_update(s);
 456             return;
 457         case 13: /* Interrupt mask.  */
 458             s->int_mask = value;
 459             smc91c111_update(s);
 460             return;
 461         }
 462         break;
 463
 464     case 3:
 465         switch (offset) {
 466         case 0: case 1: case 2: case 3: case 4: case 5: case 6: case 7:
 467             /* Multicast table.  */
 468             /* Not implemented.  */
 469             return;
 470         case 8: case 9: /* Management Interface.  */
 471             /* Not implemented.  */
 472             return;
 473         case 12: /* Early receive.  */
 474             s->ercv = value & 0x1f;
 475             return;
 476         case 13:
 477             /* Ignore.  */
 478             return;
 479         }
 480         break;
 481     }
 482     qemu_log_mask(LOG_GUEST_ERROR, "smc91c111_write(bank:%d) Illegal register"
 483                                    " 0x%" HWADDR_PRIx " = 0x%x\n",
 484                   s->bank, offset, value);
 485 }
 486
 487 static uint32_t smc91c111_readb(void *opaque, hwaddr offset)
 488 {
 489     smc91c111_state *s = (smc91c111_state *)opaque;
 490
 491     offset = offset & 0xf;
 492     if (offset == 14) {
 493         return s->bank;
 494     }
 495     if (offset == 15)
 496         return 0x33;
 497     switch (s->bank) {
 498     case 0:
 499         switch (offset) {
 500         case 0: /* TCR */
 501             return s->tcr & 0xff;
 502         case 1:
 503             return s->tcr >> 8;
 504         case 2: /* EPH Status */
 505             return 0;
 506         case 3:
 507             return 0x40;
 508         case 4: /* RCR */
 509             return s->rcr & 0xff;
 510         case 5:
 511             return s->rcr >> 8;
 512         case 6: /* Counter */
 513         case 7:
 514             /* Not implemented.  */
 515             return 0;
 516         case 8: /* Memory size.  */
 517             return NUM_PACKETS;
 518         case 9: /* Free memory available.  */
 519             {
 520                 int i;
 521                 int n;
 522                 n = 0;
 523                 for (i = 0; i < NUM_PACKETS; i++) {
 524                     if (s->allocated & (1 << i))
 525                         n++;
 526                 }
 527                 return n;
 528             }
 529         case 10: case 11: /* RPCR */
 530             /* Not implemented.  */
 531             return 0;
 532         case 12: case 13: /* Reserved */
 533             return 0;
 534         }
 535         break;
 536
 537     case 1:
 538         switch (offset) {
 539         case 0: /* CONFIG */
 540             return s->cr & 0xff;
 541         case 1:
 542             return s->cr >> 8;
 543         case 2: case 3: /* BASE */
 544             /* Not implemented.  */
 545             return 0;
 546         case 4: case 5: case 6: case 7: case 8: case 9: /* IA */
 547             return s->conf.macaddr.a[offset - 4];
 548         case 10: /* General Purpose */
 549             return s->gpr & 0xff;
 550         case 11:
 551             return s->gpr >> 8;
 552         case 12: /* Control */
 553             return s->ctr & 0xff;
 554         case 13:
 555             return s->ctr >> 8;
 556         }
 557         break;
 558
 559     case 2:
 560         switch (offset) {
 561         case 0: case 1: /* MMUCR Busy bit.  */
 562             return 0;
 563         case 2: /* Packet Number.  */
 564             return s->packet_num;
 565         case 3: /* Allocation Result.  */
 566             return s->tx_alloc;
 567         case 4: /* TX FIFO */
 568             if (s->tx_fifo_done_len == 0)
 569                 return 0x80;
 570             else
 571                 return s->tx_fifo_done[0];
 572         case 5: /* RX FIFO */
 573             if (s->rx_fifo_len == 0)
 574                 return 0x80;
 575             else
 576                 return s->rx_fifo[0];
 577         case 6: /* Pointer */
 578             return s->ptr & 0xff;
 579         case 7:
 580             return (s->ptr >> 8) & 0xf7;
 581         case 8: case 9: case 10: case 11: /* Data */
 582             {
 583                 int p;
 584                 int n;
 585
 586                 if (s->ptr & 0x8000)
 587                     n = s->rx_fifo[0];
 588                 else
 589                     n = s->packet_num;
 590                 p = s->ptr & 0x07ff;
 591                 if (s->ptr & 0x4000) {
 592                     s->ptr = (s->ptr & 0xf800) | ((s->ptr + 1) & 0x07ff);
 593                 } else {
 594                     p += (offset & 3);
 595                 }
 596                 return s->data[n][p];
 597             }
 598         case 12: /* Interrupt status.  */
 599             return s->int_level;
 600         case 13: /* Interrupt mask.  */
 601             return s->int_mask;
 602         }
 603         break;
 604
 605     case 3:
 606         switch (offset) {
 607         case 0: case 1: case 2: case 3: case 4: case 5: case 6: case 7:
 608             /* Multicast table.  */
 609             /* Not implemented.  */
 610             return 0;
 611         case 8: /* Management Interface.  */
 612             /* Not implemented.  */
 613             return 0x30;
 614         case 9:
 615             return 0x33;
 616         case 10: /* Revision.  */
 617             return 0x91;
 618         case 11:
 619             return 0x33;
 620         case 12:
 621             return s->ercv;
 622         case 13:
 623             return 0;
 624         }
 625         break;
 626     }
 627     qemu_log_mask(LOG_GUEST_ERROR, "smc91c111_read(bank:%d) Illegal register"
 628                                    " 0x%" HWADDR_PRIx "\n",
 629                   s->bank, offset);
 630     return 0;
 631 }
 632
 633 static uint64_t smc91c111_readfn(void *opaque, hwaddr addr, unsigned size)
 634 {
 635     int i;
 636     uint32_t val = 0;
 637
 638     for (i = 0; i < size; i++) {
 639         val |= smc91c111_readb(opaque, addr + i) << (i * 8);
 640     }
 641     return val;
 642 }
 643
 644 static void smc91c111_writefn(void *opaque, hwaddr addr,
 645                                uint64_t value, unsigned size)
 646 {
 647     int i = 0;
 648
 649     /* 32-bit writes to offset 0xc only actually write to the bank select
 650      * register (offset 0xe), so skip the first two bytes we would write.
 651      */
 652     if (addr == 0xc && size == 4) {
 653         i += 2;
 654     }
 655
 656     for (; i < size; i++) {
 657         smc91c111_writeb(opaque, addr + i,
 658                          extract32(value, i * 8, 8));
 659     }
 660 }
 661
 662 static int smc91c111_can_receive_nc(NetClientState *nc)
 663 {
 664     smc91c111_state *s = qemu_get_nic_opaque(nc);
 665
 666     return smc91c111_can_receive(s);
 667 }
 668
 669 static ssize_t smc91c111_receive(NetClientState *nc, const uint8_t *buf, size_t size)
 670 {
 671     smc91c111_state *s = qemu_get_nic_opaque(nc);
 672     int status;
 673     int packetsize;
 674     uint32_t crc;
 675     int packetnum;
 676     uint8_t *p;
 677
 678     if ((s->rcr & RCR_RXEN) == 0 || (s->rcr & RCR_SOFT_RST))
 679         return -1;
 680     /* Short packets are padded with zeros.  Receiving a packet
 681        < 64 bytes long is considered an error condition.  */
 682     if (size < 64)
 683         packetsize = 64;
 684     else
 685         packetsize = (size & ~1);
 686     packetsize += 6;
 687     crc = (s->rcr & RCR_STRIP_CRC) == 0;
 688     if (crc)
 689         packetsize += 4;
 690     /* TODO: Flag overrun and receive errors.  */
 691     if (packetsize > 2048)
 692         return -1;
 693     packetnum = smc91c111_allocate_packet(s);
 694     if (packetnum == 0x80)
 695         return -1;
 696     s->rx_fifo[s->rx_fifo_len++] = packetnum;
 697
 698     p = &s->data[packetnum][0];
 699     /* ??? Multicast packets?  */
 700     status = 0;
 701     if (size > 1518)
 702         status |= RS_TOOLONG;
 703     if (size & 1)
 704         status |= RS_ODDFRAME;
 705     *(p++) = status & 0xff;
 706     *(p++) = status >> 8;
 707     *(p++) = packetsize & 0xff;
 708     *(p++) = packetsize >> 8;
 709     memcpy(p, buf, size & ~1);
 710     p += (size & ~1);
 711     /* Pad short packets.  */
 712     if (size < 64) {
 713         int pad;
 714
 715         if (size & 1)
 716             *(p++) = buf[size - 1];
 717         pad = 64 - size;
 718         memset(p, 0, pad);
 719         p += pad;
 720         size = 64;
 721     }
 722     /* It's not clear if the CRC should go before or after the last byte in
 723        odd sized packets.  Linux disables the CRC, so that's no help.
 724        The pictures in the documentation show the CRC aligned on a 16-bit
 725        boundary before the last odd byte, so that's what we do.  */
 726     if (crc) {
 727         crc = crc32(~0, buf, size);
 728         *(p++) = crc & 0xff; crc >>= 8;
 729         *(p++) = crc & 0xff; crc >>= 8;
 730         *(p++) = crc & 0xff; crc >>= 8;
 731         *(p++) = crc & 0xff;
 732     }
 733     if (size & 1) {
 734         *(p++) = buf[size - 1];
 735         *p = 0x60;
 736     } else {
 737         *(p++) = 0;
 738         *p = 0x40;
 739     }
 740     /* TODO: Raise early RX interrupt?  */
 741     s->int_level |= INT_RCV;
 742     smc91c111_update(s);
 743
 744     return size;
 745 }
 746
 747 static const MemoryRegionOps smc91c111_mem_ops = {
 748     /* The special case for 32 bit writes to 0xc means we can't just
 749      * set .impl.min/max_access_size to 1, unfortunately
 750      */
 751     .read = smc91c111_readfn,
 752     .write = smc91c111_writefn,
 753     .valid.min_access_size = 1,
 754     .valid.max_access_size = 4,
 755     .endianness = DEVICE_NATIVE_ENDIAN,
 756 };
 757
 758 static NetClientInfo net_smc91c111_info = {
 759     .type = NET_CLIENT_DRIVER_NIC,
 760     .size = sizeof(NICState),
 761     .can_receive = smc91c111_can_receive_nc,
 762     .receive = smc91c111_receive,
 763 };
 764
 765 static int smc91c111_init1(SysBusDevice *sbd)
 766 {
 767     DeviceState *dev = DEVICE(sbd);
 768     smc91c111_state *s = SMC91C111(dev);
 769
 770     memory_region_init_io(&s->mmio, OBJECT(s), &smc91c111_mem_ops, s,
 771                           "smc91c111-mmio", 16);
 772     sysbus_init_mmio(sbd, &s->mmio);
 773     sysbus_init_irq(sbd, &s->irq);
 774     qemu_macaddr_default_if_unset(&s->conf.macaddr);
 775     s->nic = qemu_new_nic(&net_smc91c111_info, &s->conf,
 776                           object_get_typename(OBJECT(dev)), dev->id, s);
 777     qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
 778     /* ??? Save/restore.  */
 779     return 0;
 780 }
 781
 782 static Property smc91c111_properties[] = {
 783     DEFINE_NIC_PROPERTIES(smc91c111_state, conf),
 784     DEFINE_PROP_END_OF_LIST(),
 785 };
 786
 787 static void smc91c111_class_init(ObjectClass *klass, void *data)
 788 {
 789     DeviceClass *dc = DEVICE_CLASS(klass);
 790     SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
 791
 792     k->init = smc91c111_init1;
 793     dc->reset = smc91c111_reset;
 794     dc->vmsd = &vmstate_smc91c111;
 795     dc->props = smc91c111_properties;
 796 }
 797
 798 static const TypeInfo smc91c111_info = {
 799     .name          = TYPE_SMC91C111,
 800     .parent        = TYPE_SYS_BUS_DEVICE,
 801     .instance_size = sizeof(smc91c111_state),
 802     .class_init    = smc91c111_class_init,
 803 };
 804
 805 static void smc91c111_register_types(void)
 806 {
 807     type_register_static(&smc91c111_info);
 808 }
 809
 810 /* Legacy helper function.  Should go away when machine config files are
 811    implemented.  */
 812 void smc91c111_init(NICInfo *nd, uint32_t base, qemu_irq irq)
 813 {
 814     DeviceState *dev;
 815     SysBusDevice *s;
 816
 817     qemu_check_nic_model(nd, "smc91c111");
 818     dev = qdev_create(NULL, TYPE_SMC91C111);
 819     qdev_set_nic_properties(dev, nd);
 820     qdev_init_nofail(dev);
 821     s = SYS_BUS_DEVICE(dev);
 822     sysbus_mmio_map(s, 0, base);
 823     sysbus_connect_irq(s, 0, irq);
 824 }
 825
 826 type_init(smc91c111_register_types)