hw/dp8393x.c

   1 /*
   2  * QEMU NS SONIC DP8393x netcard
   3  *
   4  * Copyright (c) 2008-2009 Herve Poussineau
   5  *
   6  * This program is free software; you can redistribute it and/or
   7  * modify it under the terms of the GNU General Public License as
   8  * published by the Free Software Foundation; either version 2 of
   9  * the License, or (at your option) any later version.
  10  *
  11  * This program is distributed in the hope that it will be useful,
  12  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  13  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  14  * GNU General Public License for more details.
  15  *
  16  * You should have received a copy of the GNU General Public License along
  17  * with this program; if not, see <http://www.gnu.org/licenses/>.
  18  */
  19
  20 #include "hw/hw.h"
  21 #include "qemu/timer.h"
  22 #include "net/net.h"
  23 #include "hw/mips.h"
  24
  25 //#define DEBUG_SONIC
  26
  27 /* Calculate CRCs properly on Rx packets */
  28 #define SONIC_CALCULATE_RXCRC
  29
  30 #if defined(SONIC_CALCULATE_RXCRC)
  31 /* For crc32 */
  32 #include <zlib.h>
  33 #endif
  34
  35 #ifdef DEBUG_SONIC
  36 #define DPRINTF(fmt, ...) \
  37 do { printf("sonic: " fmt , ##  __VA_ARGS__); } while (0)
  38 static const char* reg_names[] = {
  39     "CR", "DCR", "RCR", "TCR", "IMR", "ISR", "UTDA", "CTDA",
  40     "TPS", "TFC", "TSA0", "TSA1", "TFS", "URDA", "CRDA", "CRBA0",
  41     "CRBA1", "RBWC0", "RBWC1", "EOBC", "URRA", "RSA", "REA", "RRP",
  42     "RWP", "TRBA0", "TRBA1", "0x1b", "0x1c", "0x1d", "0x1e", "LLFA",
  43     "TTDA", "CEP", "CAP2", "CAP1", "CAP0", "CE", "CDP", "CDC",
  44     "SR", "WT0", "WT1", "RSC", "CRCT", "FAET", "MPT", "MDT",
  45     "0x30", "0x31", "0x32", "0x33", "0x34", "0x35", "0x36", "0x37",
  46     "0x38", "0x39", "0x3a", "0x3b", "0x3c", "0x3d", "0x3e", "DCR2" };
  47 #else
  48 #define DPRINTF(fmt, ...) do {} while (0)
  49 #endif
  50
  51 #define SONIC_ERROR(fmt, ...) \
  52 do { printf("sonic ERROR: %s: " fmt, __func__ , ## __VA_ARGS__); } while (0)
  53
  54 #define SONIC_CR     0x00
  55 #define SONIC_DCR    0x01
  56 #define SONIC_RCR    0x02
  57 #define SONIC_TCR    0x03
  58 #define SONIC_IMR    0x04
  59 #define SONIC_ISR    0x05
  60 #define SONIC_UTDA   0x06
  61 #define SONIC_CTDA   0x07
  62 #define SONIC_TPS    0x08
  63 #define SONIC_TFC    0x09
  64 #define SONIC_TSA0   0x0a
  65 #define SONIC_TSA1   0x0b
  66 #define SONIC_TFS    0x0c
  67 #define SONIC_URDA   0x0d
  68 #define SONIC_CRDA   0x0e
  69 #define SONIC_CRBA0  0x0f
  70 #define SONIC_CRBA1  0x10
  71 #define SONIC_RBWC0  0x11
  72 #define SONIC_RBWC1  0x12
  73 #define SONIC_EOBC   0x13
  74 #define SONIC_URRA   0x14
  75 #define SONIC_RSA    0x15
  76 #define SONIC_REA    0x16
  77 #define SONIC_RRP    0x17
  78 #define SONIC_RWP    0x18
  79 #define SONIC_TRBA0  0x19
  80 #define SONIC_TRBA1  0x1a
  81 #define SONIC_LLFA   0x1f
  82 #define SONIC_TTDA   0x20
  83 #define SONIC_CEP    0x21
  84 #define SONIC_CAP2   0x22
  85 #define SONIC_CAP1   0x23
  86 #define SONIC_CAP0   0x24
  87 #define SONIC_CE     0x25
  88 #define SONIC_CDP    0x26
  89 #define SONIC_CDC    0x27
  90 #define SONIC_SR     0x28
  91 #define SONIC_WT0    0x29
  92 #define SONIC_WT1    0x2a
  93 #define SONIC_RSC    0x2b
  94 #define SONIC_CRCT   0x2c
  95 #define SONIC_FAET   0x2d
  96 #define SONIC_MPT    0x2e
  97 #define SONIC_MDT    0x2f
  98 #define SONIC_DCR2   0x3f
  99
 100 #define SONIC_CR_HTX     0x0001
 101 #define SONIC_CR_TXP     0x0002
 102 #define SONIC_CR_RXDIS   0x0004
 103 #define SONIC_CR_RXEN    0x0008
 104 #define SONIC_CR_STP     0x0010
 105 #define SONIC_CR_ST      0x0020
 106 #define SONIC_CR_RST     0x0080
 107 #define SONIC_CR_RRRA    0x0100
 108 #define SONIC_CR_LCAM    0x0200
 109 #define SONIC_CR_MASK    0x03bf
 110
 111 #define SONIC_DCR_DW     0x0020
 112 #define SONIC_DCR_LBR    0x2000
 113 #define SONIC_DCR_EXBUS  0x8000
 114
 115 #define SONIC_RCR_PRX    0x0001
 116 #define SONIC_RCR_LBK    0x0002
 117 #define SONIC_RCR_FAER   0x0004
 118 #define SONIC_RCR_CRCR   0x0008
 119 #define SONIC_RCR_CRS    0x0020
 120 #define SONIC_RCR_LPKT   0x0040
 121 #define SONIC_RCR_BC     0x0080
 122 #define SONIC_RCR_MC     0x0100
 123 #define SONIC_RCR_LB0    0x0200
 124 #define SONIC_RCR_LB1    0x0400
 125 #define SONIC_RCR_AMC    0x0800
 126 #define SONIC_RCR_PRO    0x1000
 127 #define SONIC_RCR_BRD    0x2000
 128 #define SONIC_RCR_RNT    0x4000
 129
 130 #define SONIC_TCR_PTX    0x0001
 131 #define SONIC_TCR_BCM    0x0002
 132 #define SONIC_TCR_FU     0x0004
 133 #define SONIC_TCR_EXC    0x0040
 134 #define SONIC_TCR_CRSL   0x0080
 135 #define SONIC_TCR_NCRS   0x0100
 136 #define SONIC_TCR_EXD    0x0400
 137 #define SONIC_TCR_CRCI   0x2000
 138 #define SONIC_TCR_PINT   0x8000
 139
 140 #define SONIC_ISR_RBE    0x0020
 141 #define SONIC_ISR_RDE    0x0040
 142 #define SONIC_ISR_TC     0x0080
 143 #define SONIC_ISR_TXDN   0x0200
 144 #define SONIC_ISR_PKTRX  0x0400
 145 #define SONIC_ISR_PINT   0x0800
 146 #define SONIC_ISR_LCD    0x1000
 147
 148 typedef struct dp8393xState {
 149     /* Hardware */
 150     int it_shift;
 151     qemu_irq irq;
 152 #ifdef DEBUG_SONIC
 153     int irq_level;
 154 #endif
 155     QEMUTimer *watchdog;
 156     int64_t wt_last_update;
 157     NICConf conf;
 158     NICState *nic;
 159     MemoryRegion *address_space;
 160     MemoryRegion mmio;
 161
 162     /* Registers */
 163     uint8_t cam[16][6];
 164     uint16_t regs[0x40];
 165
 166     /* Temporaries */
 167     uint8_t tx_buffer[0x10000];
 168     int loopback_packet;
 169
 170     /* Memory access */
 171     void (*memory_rw)(void *opaque, hwaddr addr, uint8_t *buf, int len, int is_write);
 172     void* mem_opaque;
 173 } dp8393xState;
 174
 175 static void dp8393x_update_irq(dp8393xState *s)
 176 {
 177     int level = (s->regs[SONIC_IMR] & s->regs[SONIC_ISR]) ? 1 : 0;
 178
 179 #ifdef DEBUG_SONIC
 180     if (level != s->irq_level) {
 181         s->irq_level = level;
 182         if (level) {
 183             DPRINTF("raise irq, isr is 0x%04x\n", s->regs[SONIC_ISR]);
 184         } else {
 185             DPRINTF("lower irq\n");
 186         }
 187     }
 188 #endif
 189
 190     qemu_set_irq(s->irq, level);
 191 }
 192
 193 static void do_load_cam(dp8393xState *s)
 194 {
 195     uint16_t data[8];
 196     int width, size;
 197     uint16_t index = 0;
 198
 199     width = (s->regs[SONIC_DCR] & SONIC_DCR_DW) ? 2 : 1;
 200     size = sizeof(uint16_t) * 4 * width;
 201
 202     while (s->regs[SONIC_CDC] & 0x1f) {
 203         /* Fill current entry */
 204         s->memory_rw(s->mem_opaque,
 205             (s->regs[SONIC_URRA] << 16) | s->regs[SONIC_CDP],
 206             (uint8_t *)data, size, 0);
 207         s->cam[index][0] = data[1 * width] & 0xff;
 208         s->cam[index][1] = data[1 * width] >> 8;
 209         s->cam[index][2] = data[2 * width] & 0xff;
 210         s->cam[index][3] = data[2 * width] >> 8;
 211         s->cam[index][4] = data[3 * width] & 0xff;
 212         s->cam[index][5] = data[3 * width] >> 8;
 213         DPRINTF("load cam[%d] with %02x%02x%02x%02x%02x%02x\n", index,
 214             s->cam[index][0], s->cam[index][1], s->cam[index][2],
 215             s->cam[index][3], s->cam[index][4], s->cam[index][5]);
 216         /* Move to next entry */
 217         s->regs[SONIC_CDC]--;
 218         s->regs[SONIC_CDP] += size;
 219         index++;
 220     }
 221
 222     /* Read CAM enable */
 223     s->memory_rw(s->mem_opaque,
 224         (s->regs[SONIC_URRA] << 16) | s->regs[SONIC_CDP],
 225         (uint8_t *)data, size, 0);
 226     s->regs[SONIC_CE] = data[0 * width];
 227     DPRINTF("load cam done. cam enable mask 0x%04x\n", s->regs[SONIC_CE]);
 228
 229     /* Done */
 230     s->regs[SONIC_CR] &= ~SONIC_CR_LCAM;
 231     s->regs[SONIC_ISR] |= SONIC_ISR_LCD;
 232     dp8393x_update_irq(s);
 233 }
 234
 235 static void do_read_rra(dp8393xState *s)
 236 {
 237     uint16_t data[8];
 238     int width, size;
 239
 240     /* Read memory */
 241     width = (s->regs[SONIC_DCR] & SONIC_DCR_DW) ? 2 : 1;
 242     size = sizeof(uint16_t) * 4 * width;
 243     s->memory_rw(s->mem_opaque,
 244         (s->regs[SONIC_URRA] << 16) | s->regs[SONIC_RRP],
 245         (uint8_t *)data, size, 0);
 246
 247     /* Update SONIC registers */
 248     s->regs[SONIC_CRBA0] = data[0 * width];
 249     s->regs[SONIC_CRBA1] = data[1 * width];
 250     s->regs[SONIC_RBWC0] = data[2 * width];
 251     s->regs[SONIC_RBWC1] = data[3 * width];
 252     DPRINTF("CRBA0/1: 0x%04x/0x%04x, RBWC0/1: 0x%04x/0x%04x\n",
 253         s->regs[SONIC_CRBA0], s->regs[SONIC_CRBA1],
 254         s->regs[SONIC_RBWC0], s->regs[SONIC_RBWC1]);
 255
 256     /* Go to next entry */
 257     s->regs[SONIC_RRP] += size;
 258
 259     /* Handle wrap */
 260     if (s->regs[SONIC_RRP] == s->regs[SONIC_REA]) {
 261         s->regs[SONIC_RRP] = s->regs[SONIC_RSA];
 262     }
 263
 264     /* Check resource exhaustion */
 265     if (s->regs[SONIC_RRP] == s->regs[SONIC_RWP])
 266     {
 267         s->regs[SONIC_ISR] |= SONIC_ISR_RBE;
 268         dp8393x_update_irq(s);
 269     }
 270
 271     /* Done */
 272     s->regs[SONIC_CR] &= ~SONIC_CR_RRRA;
 273 }
 274
 275 static void do_software_reset(dp8393xState *s)
 276 {
 277     qemu_del_timer(s->watchdog);
 278
 279     s->regs[SONIC_CR] &= ~(SONIC_CR_LCAM | SONIC_CR_RRRA | SONIC_CR_TXP | SONIC_CR_HTX);
 280     s->regs[SONIC_CR] |= SONIC_CR_RST | SONIC_CR_RXDIS;
 281 }
 282
 283 static void set_next_tick(dp8393xState *s)
 284 {
 285     uint32_t ticks;
 286     int64_t delay;
 287
 288     if (s->regs[SONIC_CR] & SONIC_CR_STP) {
 289         qemu_del_timer(s->watchdog);
 290         return;
 291     }
 292
 293     ticks = s->regs[SONIC_WT1] << 16 | s->regs[SONIC_WT0];
 294     s->wt_last_update = qemu_get_clock_ns(vm_clock);
 295     delay = get_ticks_per_sec() * ticks / 5000000;
 296     qemu_mod_timer(s->watchdog, s->wt_last_update + delay);
 297 }
 298
 299 static void update_wt_regs(dp8393xState *s)
 300 {
 301     int64_t elapsed;
 302     uint32_t val;
 303
 304     if (s->regs[SONIC_CR] & SONIC_CR_STP) {
 305         qemu_del_timer(s->watchdog);
 306         return;
 307     }
 308
 309     elapsed = s->wt_last_update - qemu_get_clock_ns(vm_clock);
 310     val = s->regs[SONIC_WT1] << 16 | s->regs[SONIC_WT0];
 311     val -= elapsed / 5000000;
 312     s->regs[SONIC_WT1] = (val >> 16) & 0xffff;
 313     s->regs[SONIC_WT0] = (val >> 0)  & 0xffff;
 314     set_next_tick(s);
 315
 316 }
 317
 318 static void do_start_timer(dp8393xState *s)
 319 {
 320     s->regs[SONIC_CR] &= ~SONIC_CR_STP;
 321     set_next_tick(s);
 322 }
 323
 324 static void do_stop_timer(dp8393xState *s)
 325 {
 326     s->regs[SONIC_CR] &= ~SONIC_CR_ST;
 327     update_wt_regs(s);
 328 }
 329
 330 static void do_receiver_enable(dp8393xState *s)
 331 {
 332     s->regs[SONIC_CR] &= ~SONIC_CR_RXDIS;
 333 }
 334
 335 static void do_receiver_disable(dp8393xState *s)
 336 {
 337     s->regs[SONIC_CR] &= ~SONIC_CR_RXEN;
 338 }
 339
 340 static void do_transmit_packets(dp8393xState *s)
 341 {
 342     NetClientState *nc = qemu_get_queue(s->nic);
 343     uint16_t data[12];
 344     int width, size;
 345     int tx_len, len;
 346     uint16_t i;
 347
 348     width = (s->regs[SONIC_DCR] & SONIC_DCR_DW) ? 2 : 1;
 349
 350     while (1) {
 351         /* Read memory */
 352         DPRINTF("Transmit packet at %08x\n",
 353                 (s->regs[SONIC_UTDA] << 16) | s->regs[SONIC_CTDA]);
 354         size = sizeof(uint16_t) * 6 * width;
 355         s->regs[SONIC_TTDA] = s->regs[SONIC_CTDA];
 356         s->memory_rw(s->mem_opaque,
 357             ((s->regs[SONIC_UTDA] << 16) | s->regs[SONIC_TTDA]) + sizeof(uint16_t) * width,
 358             (uint8_t *)data, size, 0);
 359         tx_len = 0;
 360
 361         /* Update registers */
 362         s->regs[SONIC_TCR] = data[0 * width] & 0xf000;
 363         s->regs[SONIC_TPS] = data[1 * width];
 364         s->regs[SONIC_TFC] = data[2 * width];
 365         s->regs[SONIC_TSA0] = data[3 * width];
 366         s->regs[SONIC_TSA1] = data[4 * width];
 367         s->regs[SONIC_TFS] = data[5 * width];
 368
 369         /* Handle programmable interrupt */
 370         if (s->regs[SONIC_TCR] & SONIC_TCR_PINT) {
 371             s->regs[SONIC_ISR] |= SONIC_ISR_PINT;
 372         } else {
 373             s->regs[SONIC_ISR] &= ~SONIC_ISR_PINT;
 374         }
 375
 376         for (i = 0; i < s->regs[SONIC_TFC]; ) {
 377             /* Append fragment */
 378             len = s->regs[SONIC_TFS];
 379             if (tx_len + len > sizeof(s->tx_buffer)) {
 380                 len = sizeof(s->tx_buffer) - tx_len;
 381             }
 382             s->memory_rw(s->mem_opaque,
 383                 (s->regs[SONIC_TSA1] << 16) | s->regs[SONIC_TSA0],
 384                 &s->tx_buffer[tx_len], len, 0);
 385             tx_len += len;
 386
 387             i++;
 388             if (i != s->regs[SONIC_TFC]) {
 389                 /* Read next fragment details */
 390                 size = sizeof(uint16_t) * 3 * width;
 391                 s->memory_rw(s->mem_opaque,
 392                     ((s->regs[SONIC_UTDA] << 16) | s->regs[SONIC_TTDA]) + sizeof(uint16_t) * (4 + 3 * i) * width,
 393                     (uint8_t *)data, size, 0);
 394                 s->regs[SONIC_TSA0] = data[0 * width];
 395                 s->regs[SONIC_TSA1] = data[1 * width];
 396                 s->regs[SONIC_TFS] = data[2 * width];
 397             }
 398         }
 399
 400         /* Handle Ethernet checksum */
 401         if (!(s->regs[SONIC_TCR] & SONIC_TCR_CRCI)) {
 402             /* Don't append FCS there, to look like slirp packets
 403              * which don't have one */
 404         } else {
 405             /* Remove existing FCS */
 406             tx_len -= 4;
 407         }
 408
 409         if (s->regs[SONIC_RCR] & (SONIC_RCR_LB1 | SONIC_RCR_LB0)) {
 410             /* Loopback */
 411             s->regs[SONIC_TCR] |= SONIC_TCR_CRSL;
 412             if (nc->info->can_receive(nc)) {
 413                 s->loopback_packet = 1;
 414                 nc->info->receive(nc, s->tx_buffer, tx_len);
 415             }
 416         } else {
 417             /* Transmit packet */
 418             qemu_send_packet(nc, s->tx_buffer, tx_len);
 419         }
 420         s->regs[SONIC_TCR] |= SONIC_TCR_PTX;
 421
 422         /* Write status */
 423         data[0 * width] = s->regs[SONIC_TCR] & 0x0fff; /* status */
 424         size = sizeof(uint16_t) * width;
 425         s->memory_rw(s->mem_opaque,
 426             (s->regs[SONIC_UTDA] << 16) | s->regs[SONIC_TTDA],
 427             (uint8_t *)data, size, 1);
 428
 429         if (!(s->regs[SONIC_CR] & SONIC_CR_HTX)) {
 430             /* Read footer of packet */
 431             size = sizeof(uint16_t) * width;
 432             s->memory_rw(s->mem_opaque,
 433                 ((s->regs[SONIC_UTDA] << 16) | s->regs[SONIC_TTDA]) + sizeof(uint16_t) * (4 + 3 * s->regs[SONIC_TFC]) * width,
 434                 (uint8_t *)data, size, 0);
 435             s->regs[SONIC_CTDA] = data[0 * width] & ~0x1;
 436             if (data[0 * width] & 0x1) {
 437                 /* EOL detected */
 438                 break;
 439             }
 440         }
 441     }
 442
 443     /* Done */
 444     s->regs[SONIC_CR] &= ~SONIC_CR_TXP;
 445     s->regs[SONIC_ISR] |= SONIC_ISR_TXDN;
 446     dp8393x_update_irq(s);
 447 }
 448
 449 static void do_halt_transmission(dp8393xState *s)
 450 {
 451     /* Nothing to do */
 452 }
 453
 454 static void do_command(dp8393xState *s, uint16_t command)
 455 {
 456     if ((s->regs[SONIC_CR] & SONIC_CR_RST) && !(command & SONIC_CR_RST)) {
 457         s->regs[SONIC_CR] &= ~SONIC_CR_RST;
 458         return;
 459     }
 460
 461     s->regs[SONIC_CR] |= (command & SONIC_CR_MASK);
 462
 463     if (command & SONIC_CR_HTX)
 464         do_halt_transmission(s);
 465     if (command & SONIC_CR_TXP)
 466         do_transmit_packets(s);
 467     if (command & SONIC_CR_RXDIS)
 468         do_receiver_disable(s);
 469     if (command & SONIC_CR_RXEN)
 470         do_receiver_enable(s);
 471     if (command & SONIC_CR_STP)
 472         do_stop_timer(s);
 473     if (command & SONIC_CR_ST)
 474         do_start_timer(s);
 475     if (command & SONIC_CR_RST)
 476         do_software_reset(s);
 477     if (command & SONIC_CR_RRRA)
 478         do_read_rra(s);
 479     if (command & SONIC_CR_LCAM)
 480         do_load_cam(s);
 481 }
 482
 483 static uint16_t read_register(dp8393xState *s, int reg)
 484 {
 485     uint16_t val = 0;
 486
 487     switch (reg) {
 488         /* Update data before reading it */
 489         case SONIC_WT0:
 490         case SONIC_WT1:
 491             update_wt_regs(s);
 492             val = s->regs[reg];
 493             break;
 494         /* Accept read to some registers only when in reset mode */
 495         case SONIC_CAP2:
 496         case SONIC_CAP1:
 497         case SONIC_CAP0:
 498             if (s->regs[SONIC_CR] & SONIC_CR_RST) {
 499                 val = s->cam[s->regs[SONIC_CEP] & 0xf][2* (SONIC_CAP0 - reg) + 1] << 8;
 500                 val |= s->cam[s->regs[SONIC_CEP] & 0xf][2* (SONIC_CAP0 - reg)];
 501             }
 502             break;
 503         /* All other registers have no special contrainst */
 504         default:
 505             val = s->regs[reg];
 506     }
 507
 508     DPRINTF("read 0x%04x from reg %s\n", val, reg_names[reg]);
 509
 510     return val;
 511 }
 512
 513 static void write_register(dp8393xState *s, int reg, uint16_t val)
 514 {
 515     DPRINTF("write 0x%04x to reg %s\n", val, reg_names[reg]);
 516
 517     switch (reg) {
 518         /* Command register */
 519         case SONIC_CR:
 520             do_command(s, val);
 521             break;
 522         /* Prevent write to read-only registers */
 523         case SONIC_CAP2:
 524         case SONIC_CAP1:
 525         case SONIC_CAP0:
 526         case SONIC_SR:
 527         case SONIC_MDT:
 528             DPRINTF("writing to reg %d invalid\n", reg);
 529             break;
 530         /* Accept write to some registers only when in reset mode */
 531         case SONIC_DCR:
 532             if (s->regs[SONIC_CR] & SONIC_CR_RST) {
 533                 s->regs[reg] = val & 0xbfff;
 534             } else {
 535                 DPRINTF("writing to DCR invalid\n");
 536             }
 537             break;
 538         case SONIC_DCR2:
 539             if (s->regs[SONIC_CR] & SONIC_CR_RST) {
 540                 s->regs[reg] = val & 0xf017;
 541             } else {
 542                 DPRINTF("writing to DCR2 invalid\n");
 543             }
 544             break;
 545         /* 12 lower bytes are Read Only */
 546         case SONIC_TCR:
 547             s->regs[reg] = val & 0xf000;
 548             break;
 549         /* 9 lower bytes are Read Only */
 550         case SONIC_RCR:
 551             s->regs[reg] = val & 0xffe0;
 552             break;
 553         /* Ignore most significant bit */
 554         case SONIC_IMR:
 555             s->regs[reg] = val & 0x7fff;
 556             dp8393x_update_irq(s);
 557             break;
 558         /* Clear bits by writing 1 to them */
 559         case SONIC_ISR:
 560             val &= s->regs[reg];
 561             s->regs[reg] &= ~val;
 562             if (val & SONIC_ISR_RBE) {
 563                 do_read_rra(s);
 564             }
 565             dp8393x_update_irq(s);
 566             break;
 567         /* Ignore least significant bit */
 568         case SONIC_RSA:
 569         case SONIC_REA:
 570         case SONIC_RRP:
 571         case SONIC_RWP:
 572             s->regs[reg] = val & 0xfffe;
 573             break;
 574         /* Invert written value for some registers */
 575         case SONIC_CRCT:
 576         case SONIC_FAET:
 577         case SONIC_MPT:
 578             s->regs[reg] = val ^ 0xffff;
 579             break;
 580         /* All other registers have no special contrainst */
 581         default:
 582             s->regs[reg] = val;
 583     }
 584
 585     if (reg == SONIC_WT0 || reg == SONIC_WT1) {
 586         set_next_tick(s);
 587     }
 588 }
 589
 590 static void dp8393x_watchdog(void *opaque)
 591 {
 592     dp8393xState *s = opaque;
 593
 594     if (s->regs[SONIC_CR] & SONIC_CR_STP) {
 595         return;
 596     }
 597
 598     s->regs[SONIC_WT1] = 0xffff;
 599     s->regs[SONIC_WT0] = 0xffff;
 600     set_next_tick(s);
 601
 602     /* Signal underflow */
 603     s->regs[SONIC_ISR] |= SONIC_ISR_TC;
 604     dp8393x_update_irq(s);
 605 }
 606
 607 static uint32_t dp8393x_readw(void *opaque, hwaddr addr)
 608 {
 609     dp8393xState *s = opaque;
 610     int reg;
 611
 612     if ((addr & ((1 << s->it_shift) - 1)) != 0) {
 613         return 0;
 614     }
 615
 616     reg = addr >> s->it_shift;
 617     return read_register(s, reg);
 618 }
 619
 620 static uint32_t dp8393x_readb(void *opaque, hwaddr addr)
 621 {
 622     uint16_t v = dp8393x_readw(opaque, addr & ~0x1);
 623     return (v >> (8 * (addr & 0x1))) & 0xff;
 624 }
 625
 626 static uint32_t dp8393x_readl(void *opaque, hwaddr addr)
 627 {
 628     uint32_t v;
 629     v = dp8393x_readw(opaque, addr);
 630     v |= dp8393x_readw(opaque, addr + 2) << 16;
 631     return v;
 632 }
 633
 634 static void dp8393x_writew(void *opaque, hwaddr addr, uint32_t val)
 635 {
 636     dp8393xState *s = opaque;
 637     int reg;
 638
 639     if ((addr & ((1 << s->it_shift) - 1)) != 0) {
 640         return;
 641     }
 642
 643     reg = addr >> s->it_shift;
 644
 645     write_register(s, reg, (uint16_t)val);
 646 }
 647
 648 static void dp8393x_writeb(void *opaque, hwaddr addr, uint32_t val)
 649 {
 650     uint16_t old_val = dp8393x_readw(opaque, addr & ~0x1);
 651
 652     switch (addr & 3) {
 653     case 0:
 654         val = val | (old_val & 0xff00);
 655         break;
 656     case 1:
 657         val = (val << 8) | (old_val & 0x00ff);
 658         break;
 659     }
 660     dp8393x_writew(opaque, addr & ~0x1, val);
 661 }
 662
 663 static void dp8393x_writel(void *opaque, hwaddr addr, uint32_t val)
 664 {
 665     dp8393x_writew(opaque, addr, val & 0xffff);
 666     dp8393x_writew(opaque, addr + 2, (val >> 16) & 0xffff);
 667 }
 668
 669 static const MemoryRegionOps dp8393x_ops = {
 670     .old_mmio = {
 671         .read = { dp8393x_readb, dp8393x_readw, dp8393x_readl, },
 672         .write = { dp8393x_writeb, dp8393x_writew, dp8393x_writel, },
 673     },
 674     .endianness = DEVICE_NATIVE_ENDIAN,
 675 };
 676
 677 static int nic_can_receive(NetClientState *nc)
 678 {
 679     dp8393xState *s = qemu_get_nic_opaque(nc);
 680
 681     if (!(s->regs[SONIC_CR] & SONIC_CR_RXEN))
 682         return 0;
 683     if (s->regs[SONIC_ISR] & SONIC_ISR_RBE)
 684         return 0;
 685     return 1;
 686 }
 687
 688 static int receive_filter(dp8393xState *s, const uint8_t * buf, int size)
 689 {
 690     static const uint8_t bcast[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
 691     int i;
 692
 693     /* Check for runt packet (remember that checksum is not there) */
 694     if (size < 64 - 4) {
 695         return (s->regs[SONIC_RCR] & SONIC_RCR_RNT) ? 0 : -1;
 696     }
 697
 698     /* Check promiscuous mode */
 699     if ((s->regs[SONIC_RCR] & SONIC_RCR_PRO) && (buf[0] & 1) == 0) {
 700         return 0;
 701     }
 702
 703     /* Check multicast packets */
 704     if ((s->regs[SONIC_RCR] & SONIC_RCR_AMC) && (buf[0] & 1) == 1) {
 705         return SONIC_RCR_MC;
 706     }
 707
 708     /* Check broadcast */
 709     if ((s->regs[SONIC_RCR] & SONIC_RCR_BRD) && !memcmp(buf, bcast, sizeof(bcast))) {
 710         return SONIC_RCR_BC;
 711     }
 712
 713     /* Check CAM */
 714     for (i = 0; i < 16; i++) {
 715         if (s->regs[SONIC_CE] & (1 << i)) {
 716              /* Entry enabled */
 717              if (!memcmp(buf, s->cam[i], sizeof(s->cam[i]))) {
 718                  return 0;
 719              }
 720         }
 721     }
 722
 723     return -1;
 724 }
 725
 726 static ssize_t nic_receive(NetClientState *nc, const uint8_t * buf, size_t size)
 727 {
 728     dp8393xState *s = qemu_get_nic_opaque(nc);
 729     uint16_t data[10];
 730     int packet_type;
 731     uint32_t available, address;
 732     int width, rx_len = size;
 733     uint32_t checksum;
 734
 735     width = (s->regs[SONIC_DCR] & SONIC_DCR_DW) ? 2 : 1;
 736
 737     s->regs[SONIC_RCR] &= ~(SONIC_RCR_PRX | SONIC_RCR_LBK | SONIC_RCR_FAER |
 738         SONIC_RCR_CRCR | SONIC_RCR_LPKT | SONIC_RCR_BC | SONIC_RCR_MC);
 739
 740     packet_type = receive_filter(s, buf, size);
 741     if (packet_type < 0) {
 742         DPRINTF("packet not for netcard\n");
 743         return -1;
 744     }
 745
 746     /* XXX: Check byte ordering */
 747
 748     /* Check for EOL */
 749     if (s->regs[SONIC_LLFA] & 0x1) {
 750         /* Are we still in resource exhaustion? */
 751         size = sizeof(uint16_t) * 1 * width;
 752         address = ((s->regs[SONIC_URDA] << 16) | s->regs[SONIC_CRDA]) + sizeof(uint16_t) * 5 * width;
 753         s->memory_rw(s->mem_opaque, address, (uint8_t*)data, size, 0);
 754         if (data[0 * width] & 0x1) {
 755             /* Still EOL ; stop reception */
 756             return -1;
 757         } else {
 758             s->regs[SONIC_CRDA] = s->regs[SONIC_LLFA];
 759         }
 760     }
 761
 762     /* Save current position */
 763     s->regs[SONIC_TRBA1] = s->regs[SONIC_CRBA1];
 764     s->regs[SONIC_TRBA0] = s->regs[SONIC_CRBA0];
 765
 766     /* Calculate the ethernet checksum */
 767 #ifdef SONIC_CALCULATE_RXCRC
 768     checksum = cpu_to_le32(crc32(0, buf, rx_len));
 769 #else
 770     checksum = 0;
 771 #endif
 772
 773     /* Put packet into RBA */
 774     DPRINTF("Receive packet at %08x\n", (s->regs[SONIC_CRBA1] << 16) | s->regs[SONIC_CRBA0]);
 775     address = (s->regs[SONIC_CRBA1] << 16) | s->regs[SONIC_CRBA0];
 776     s->memory_rw(s->mem_opaque, address, (uint8_t*)buf, rx_len, 1);
 777     address += rx_len;
 778     s->memory_rw(s->mem_opaque, address, (uint8_t*)&checksum, 4, 1);
 779     rx_len += 4;
 780     s->regs[SONIC_CRBA1] = address >> 16;
 781     s->regs[SONIC_CRBA0] = address & 0xffff;
 782     available = (s->regs[SONIC_RBWC1] << 16) | s->regs[SONIC_RBWC0];
 783     available -= rx_len / 2;
 784     s->regs[SONIC_RBWC1] = available >> 16;
 785     s->regs[SONIC_RBWC0] = available & 0xffff;
 786
 787     /* Update status */
 788     if (((s->regs[SONIC_RBWC1] << 16) | s->regs[SONIC_RBWC0]) < s->regs[SONIC_EOBC]) {
 789         s->regs[SONIC_RCR] |= SONIC_RCR_LPKT;
 790     }
 791     s->regs[SONIC_RCR] |= packet_type;
 792     s->regs[SONIC_RCR] |= SONIC_RCR_PRX;
 793     if (s->loopback_packet) {
 794         s->regs[SONIC_RCR] |= SONIC_RCR_LBK;
 795         s->loopback_packet = 0;
 796     }
 797
 798     /* Write status to memory */
 799     DPRINTF("Write status at %08x\n", (s->regs[SONIC_URDA] << 16) | s->regs[SONIC_CRDA]);
 800     data[0 * width] = s->regs[SONIC_RCR]; /* status */
 801     data[1 * width] = rx_len; /* byte count */
 802     data[2 * width] = s->regs[SONIC_TRBA0]; /* pkt_ptr0 */
 803     data[3 * width] = s->regs[SONIC_TRBA1]; /* pkt_ptr1 */
 804     data[4 * width] = s->regs[SONIC_RSC]; /* seq_no */
 805     size = sizeof(uint16_t) * 5 * width;
 806     s->memory_rw(s->mem_opaque, (s->regs[SONIC_URDA] << 16) | s->regs[SONIC_CRDA], (uint8_t *)data, size, 1);
 807
 808     /* Move to next descriptor */
 809     size = sizeof(uint16_t) * width;
 810     s->memory_rw(s->mem_opaque,
 811         ((s->regs[SONIC_URDA] << 16) | s->regs[SONIC_CRDA]) + sizeof(uint16_t) * 5 * width,
 812         (uint8_t *)data, size, 0);
 813     s->regs[SONIC_LLFA] = data[0 * width];
 814     if (s->regs[SONIC_LLFA] & 0x1) {
 815         /* EOL detected */
 816         s->regs[SONIC_ISR] |= SONIC_ISR_RDE;
 817     } else {
 818         data[0 * width] = 0; /* in_use */
 819         s->memory_rw(s->mem_opaque,
 820             ((s->regs[SONIC_URDA] << 16) | s->regs[SONIC_CRDA]) + sizeof(uint16_t) * 6 * width,
 821             (uint8_t *)data, size, 1);
 822         s->regs[SONIC_CRDA] = s->regs[SONIC_LLFA];
 823         s->regs[SONIC_ISR] |= SONIC_ISR_PKTRX;
 824         s->regs[SONIC_RSC] = (s->regs[SONIC_RSC] & 0xff00) | (((s->regs[SONIC_RSC] & 0x00ff) + 1) & 0x00ff);
 825
 826         if (s->regs[SONIC_RCR] & SONIC_RCR_LPKT) {
 827             /* Read next RRA */
 828             do_read_rra(s);
 829         }
 830     }
 831
 832     /* Done */
 833     dp8393x_update_irq(s);
 834
 835     return size;
 836 }
 837
 838 static void nic_reset(void *opaque)
 839 {
 840     dp8393xState *s = opaque;
 841     qemu_del_timer(s->watchdog);
 842
 843     s->regs[SONIC_CR] = SONIC_CR_RST | SONIC_CR_STP | SONIC_CR_RXDIS;
 844     s->regs[SONIC_DCR] &= ~(SONIC_DCR_EXBUS | SONIC_DCR_LBR);
 845     s->regs[SONIC_RCR] &= ~(SONIC_RCR_LB0 | SONIC_RCR_LB1 | SONIC_RCR_BRD | SONIC_RCR_RNT);
 846     s->regs[SONIC_TCR] |= SONIC_TCR_NCRS | SONIC_TCR_PTX;
 847     s->regs[SONIC_TCR] &= ~SONIC_TCR_BCM;
 848     s->regs[SONIC_IMR] = 0;
 849     s->regs[SONIC_ISR] = 0;
 850     s->regs[SONIC_DCR2] = 0;
 851     s->regs[SONIC_EOBC] = 0x02F8;
 852     s->regs[SONIC_RSC] = 0;
 853     s->regs[SONIC_CE] = 0;
 854     s->regs[SONIC_RSC] = 0;
 855
 856     /* Network cable is connected */
 857     s->regs[SONIC_RCR] |= SONIC_RCR_CRS;
 858
 859     dp8393x_update_irq(s);
 860 }
 861
 862 static void nic_cleanup(NetClientState *nc)
 863 {
 864     dp8393xState *s = qemu_get_nic_opaque(nc);
 865
 866     memory_region_del_subregion(s->address_space, &s->mmio);
 867     memory_region_destroy(&s->mmio);
 868
 869     qemu_del_timer(s->watchdog);
 870     qemu_free_timer(s->watchdog);
 871
 872     g_free(s);
 873 }
 874
 875 static NetClientInfo net_dp83932_info = {
 876     .type = NET_CLIENT_OPTIONS_KIND_NIC,
 877     .size = sizeof(NICState),
 878     .can_receive = nic_can_receive,
 879     .receive = nic_receive,
 880     .cleanup = nic_cleanup,
 881 };
 882
 883 void dp83932_init(NICInfo *nd, hwaddr base, int it_shift,
 884                   MemoryRegion *address_space,
 885                   qemu_irq irq, void* mem_opaque,
 886                   void (*memory_rw)(void *opaque, hwaddr addr, uint8_t *buf, int len, int is_write))
 887 {
 888     dp8393xState *s;
 889
 890     qemu_check_nic_model(nd, "dp83932");
 891
 892     s = g_malloc0(sizeof(dp8393xState));
 893
 894     s->address_space = address_space;
 895     s->mem_opaque = mem_opaque;
 896     s->memory_rw = memory_rw;
 897     s->it_shift = it_shift;
 898     s->irq = irq;
 899     s->watchdog = qemu_new_timer_ns(vm_clock, dp8393x_watchdog, s);
 900     s->regs[SONIC_SR] = 0x0004; /* only revision recognized by Linux */
 901
 902     s->conf.macaddr = nd->macaddr;
 903     s->conf.peers.ncs[0] = nd->netdev;
 904
 905     s->nic = qemu_new_nic(&net_dp83932_info, &s->conf, nd->model, nd->name, s);
 906
 907     qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
 908     qemu_register_reset(nic_reset, s);
 909     nic_reset(s);
 910
 911     memory_region_init_io(&s->mmio, &dp8393x_ops, s,
 912                           "dp8393x", 0x40 << it_shift);
 913     memory_region_add_subregion(address_space, base, &s->mmio);
 914 }