2 * ColdFire Fast Ethernet Controller emulation.
4 * Copyright (c) 2007 CodeSourcery.
6 * This code is licensed under the GPL
10 #include "hw/m68k/mcf.h"
11 #include "hw/net/mii.h"
14 #include "exec/address-spaces.h"
19 #define DPRINTF(fmt, ...) \
20 do { printf("mcf_fec: " fmt , ## __VA_ARGS__); } while (0)
22 #define DPRINTF(fmt, ...) do {} while(0)
25 #define FEC_MAX_FRAME_SIZE 2032
37 uint32_t rx_descriptor
;
38 uint32_t tx_descriptor
;
51 #define FEC_INT_HB 0x80000000
52 #define FEC_INT_BABR 0x40000000
53 #define FEC_INT_BABT 0x20000000
54 #define FEC_INT_GRA 0x10000000
55 #define FEC_INT_TXF 0x08000000
56 #define FEC_INT_TXB 0x04000000
57 #define FEC_INT_RXF 0x02000000
58 #define FEC_INT_RXB 0x01000000
59 #define FEC_INT_MII 0x00800000
60 #define FEC_INT_EB 0x00400000
61 #define FEC_INT_LC 0x00200000
62 #define FEC_INT_RL 0x00100000
63 #define FEC_INT_UN 0x00080000
68 /* Map interrupt flags onto IRQ lines. */
69 #define FEC_NUM_IRQ 13
70 static const uint32_t mcf_fec_irq_map
[FEC_NUM_IRQ
] = {
86 /* Buffer Descriptor. */
93 #define FEC_BD_R 0x8000
94 #define FEC_BD_E 0x8000
95 #define FEC_BD_O1 0x4000
96 #define FEC_BD_W 0x2000
97 #define FEC_BD_O2 0x1000
98 #define FEC_BD_L 0x0800
99 #define FEC_BD_TC 0x0400
100 #define FEC_BD_ABC 0x0200
101 #define FEC_BD_M 0x0100
102 #define FEC_BD_BC 0x0080
103 #define FEC_BD_MC 0x0040
104 #define FEC_BD_LG 0x0020
105 #define FEC_BD_NO 0x0010
106 #define FEC_BD_CR 0x0004
107 #define FEC_BD_OV 0x0002
108 #define FEC_BD_TR 0x0001
110 static void mcf_fec_read_bd(mcf_fec_bd
*bd
, uint32_t addr
)
112 cpu_physical_memory_read(addr
, bd
, sizeof(*bd
));
113 be16_to_cpus(&bd
->flags
);
114 be16_to_cpus(&bd
->length
);
115 be32_to_cpus(&bd
->data
);
118 static void mcf_fec_write_bd(mcf_fec_bd
*bd
, uint32_t addr
)
121 tmp
.flags
= cpu_to_be16(bd
->flags
);
122 tmp
.length
= cpu_to_be16(bd
->length
);
123 tmp
.data
= cpu_to_be32(bd
->data
);
124 cpu_physical_memory_write(addr
, &tmp
, sizeof(tmp
));
127 static void mcf_fec_update(mcf_fec_state
*s
)
134 active
= s
->eir
& s
->eimr
;
135 changed
= active
^s
->irq_state
;
136 for (i
= 0; i
< FEC_NUM_IRQ
; i
++) {
137 mask
= mcf_fec_irq_map
[i
];
138 if (changed
& mask
) {
139 DPRINTF("IRQ %d = %d\n", i
, (active
& mask
) != 0);
140 qemu_set_irq(s
->irq
[i
], (active
& mask
) != 0);
143 s
->irq_state
= active
;
146 static void mcf_fec_do_tx(mcf_fec_state
*s
)
152 uint8_t frame
[FEC_MAX_FRAME_SIZE
];
158 addr
= s
->tx_descriptor
;
160 mcf_fec_read_bd(&bd
, addr
);
161 DPRINTF("tx_bd %x flags %04x len %d data %08x\n",
162 addr
, bd
.flags
, bd
.length
, bd
.data
);
163 if ((bd
.flags
& FEC_BD_R
) == 0) {
164 /* Run out of descriptors to transmit. */
168 if (frame_size
+ len
> FEC_MAX_FRAME_SIZE
) {
169 len
= FEC_MAX_FRAME_SIZE
- frame_size
;
170 s
->eir
|= FEC_INT_BABT
;
172 cpu_physical_memory_read(bd
.data
, ptr
, len
);
175 if (bd
.flags
& FEC_BD_L
) {
176 /* Last buffer in frame. */
177 DPRINTF("Sending packet\n");
178 qemu_send_packet(qemu_get_queue(s
->nic
), frame
, len
);
181 s
->eir
|= FEC_INT_TXF
;
183 s
->eir
|= FEC_INT_TXB
;
184 bd
.flags
&= ~FEC_BD_R
;
185 /* Write back the modified descriptor. */
186 mcf_fec_write_bd(&bd
, addr
);
187 /* Advance to the next descriptor. */
188 if ((bd
.flags
& FEC_BD_W
) != 0) {
194 s
->tx_descriptor
= addr
;
197 static void mcf_fec_enable_rx(mcf_fec_state
*s
)
199 NetClientState
*nc
= qemu_get_queue(s
->nic
);
202 mcf_fec_read_bd(&bd
, s
->rx_descriptor
);
203 s
->rx_enabled
= ((bd
.flags
& FEC_BD_E
) != 0);
205 qemu_flush_queued_packets(nc
);
209 static void mcf_fec_reset(mcf_fec_state
*s
)
222 #define MMFR_WRITE_OP (1 << 28)
223 #define MMFR_READ_OP (2 << 28)
224 #define MMFR_PHYADDR(v) (((v) >> 23) & 0x1f)
225 #define MMFR_REGNUM(v) (((v) >> 18) & 0x1f)
227 static uint64_t mcf_fec_read_mdio(mcf_fec_state
*s
)
231 if (s
->mmfr
& MMFR_WRITE_OP
)
233 if (MMFR_PHYADDR(s
->mmfr
) != 1)
234 return s
->mmfr
|= 0xffff;
236 switch (MMFR_REGNUM(s
->mmfr
)) {
238 v
= MII_BMCR_SPEED
| MII_BMCR_AUTOEN
| MII_BMCR_FD
;
241 v
= MII_BMSR_100TX_FD
| MII_BMSR_100TX_HD
| MII_BMSR_10T_FD
|
242 MII_BMSR_10T_HD
| MII_BMSR_MFPS
| MII_BMSR_AN_COMP
|
243 MII_BMSR_AUTONEG
| MII_BMSR_LINK_ST
;
252 v
= MII_ANAR_TXFD
| MII_ANAR_TX
| MII_ANAR_10FD
|
253 MII_ANAR_10
| MII_ANAR_CSMACD
;
256 v
= MII_ANLPAR_ACK
| MII_ANLPAR_TXFD
| MII_ANLPAR_TX
|
257 MII_ANLPAR_10FD
| MII_ANLPAR_10
| MII_ANLPAR_CSMACD
;
263 s
->mmfr
= (s
->mmfr
& ~0xffff) | v
;
267 static uint64_t mcf_fec_read(void *opaque
, hwaddr addr
,
270 mcf_fec_state
*s
= (mcf_fec_state
*)opaque
;
271 switch (addr
& 0x3ff) {
272 case 0x004: return s
->eir
;
273 case 0x008: return s
->eimr
;
274 case 0x010: return s
->rx_enabled
? (1 << 24) : 0; /* RDAR */
275 case 0x014: return 0; /* TDAR */
276 case 0x024: return s
->ecr
;
277 case 0x040: return mcf_fec_read_mdio(s
);
278 case 0x044: return s
->mscr
;
279 case 0x064: return 0; /* MIBC */
280 case 0x084: return s
->rcr
;
281 case 0x0c4: return s
->tcr
;
282 case 0x0e4: /* PALR */
283 return (s
->conf
.macaddr
.a
[0] << 24) | (s
->conf
.macaddr
.a
[1] << 16)
284 | (s
->conf
.macaddr
.a
[2] << 8) | s
->conf
.macaddr
.a
[3];
286 case 0x0e8: /* PAUR */
287 return (s
->conf
.macaddr
.a
[4] << 24) | (s
->conf
.macaddr
.a
[5] << 16) | 0x8808;
288 case 0x0ec: return 0x10000; /* OPD */
289 case 0x118: return 0;
290 case 0x11c: return 0;
291 case 0x120: return 0;
292 case 0x124: return 0;
293 case 0x144: return s
->tfwr
;
294 case 0x14c: return 0x600;
295 case 0x150: return s
->rfsr
;
296 case 0x180: return s
->erdsr
;
297 case 0x184: return s
->etdsr
;
298 case 0x188: return s
->emrbr
;
300 hw_error("mcf_fec_read: Bad address 0x%x\n", (int)addr
);
305 static void mcf_fec_write(void *opaque
, hwaddr addr
,
306 uint64_t value
, unsigned size
)
308 mcf_fec_state
*s
= (mcf_fec_state
*)opaque
;
309 switch (addr
& 0x3ff) {
316 case 0x010: /* RDAR */
317 if ((s
->ecr
& FEC_EN
) && !s
->rx_enabled
) {
318 DPRINTF("RX enable\n");
319 mcf_fec_enable_rx(s
);
322 case 0x014: /* TDAR */
323 if (s
->ecr
& FEC_EN
) {
329 if (value
& FEC_RESET
) {
333 if ((s
->ecr
& FEC_EN
) == 0) {
339 s
->eir
|= FEC_INT_MII
;
342 s
->mscr
= value
& 0xfe;
345 /* TODO: Implement MIB. */
348 s
->rcr
= value
& 0x07ff003f;
349 /* TODO: Implement LOOP mode. */
351 case 0x0c4: /* TCR */
352 /* We transmit immediately, so raise GRA immediately. */
355 s
->eir
|= FEC_INT_GRA
;
357 case 0x0e4: /* PALR */
358 s
->conf
.macaddr
.a
[0] = value
>> 24;
359 s
->conf
.macaddr
.a
[1] = value
>> 16;
360 s
->conf
.macaddr
.a
[2] = value
>> 8;
361 s
->conf
.macaddr
.a
[3] = value
;
363 case 0x0e8: /* PAUR */
364 s
->conf
.macaddr
.a
[4] = value
>> 24;
365 s
->conf
.macaddr
.a
[5] = value
>> 16;
374 /* TODO: implement MAC hash filtering. */
380 /* FRBR writes ignored. */
383 s
->rfsr
= (value
& 0x3fc) | 0x400;
386 s
->erdsr
= value
& ~3;
387 s
->rx_descriptor
= s
->erdsr
;
390 s
->etdsr
= value
& ~3;
391 s
->tx_descriptor
= s
->etdsr
;
394 s
->emrbr
= value
& 0x7f0;
397 hw_error("mcf_fec_write Bad address 0x%x\n", (int)addr
);
402 static int mcf_fec_have_receive_space(mcf_fec_state
*s
, size_t want
)
407 /* Walk descriptor list to determine if we have enough buffer */
408 addr
= s
->rx_descriptor
;
410 mcf_fec_read_bd(&bd
, addr
);
411 if ((bd
.flags
& FEC_BD_E
) == 0) {
414 if (want
< s
->emrbr
) {
418 /* Advance to the next descriptor. */
419 if ((bd
.flags
& FEC_BD_W
) != 0) {
428 static ssize_t
mcf_fec_receive(NetClientState
*nc
, const uint8_t *buf
, size_t size
)
430 mcf_fec_state
*s
= qemu_get_nic_opaque(nc
);
437 unsigned int buf_len
;
440 DPRINTF("do_rx len %d\n", size
);
441 if (!s
->rx_enabled
) {
444 /* 4 bytes for the CRC. */
446 crc
= cpu_to_be32(crc32(~0, buf
, size
));
447 crc_ptr
= (uint8_t *)&crc
;
448 /* Huge frames are truncted. */
449 if (size
> FEC_MAX_FRAME_SIZE
) {
450 size
= FEC_MAX_FRAME_SIZE
;
451 flags
|= FEC_BD_TR
| FEC_BD_LG
;
453 /* Frames larger than the user limit just set error flags. */
454 if (size
> (s
->rcr
>> 16)) {
457 /* Check if we have enough space in current descriptors */
458 if (!mcf_fec_have_receive_space(s
, size
)) {
461 addr
= s
->rx_descriptor
;
464 mcf_fec_read_bd(&bd
, addr
);
465 buf_len
= (size
<= s
->emrbr
) ? size
: s
->emrbr
;
468 DPRINTF("rx_bd %x length %d\n", addr
, bd
.length
);
469 /* The last 4 bytes are the CRC. */
473 cpu_physical_memory_write(buf_addr
, buf
, buf_len
);
476 cpu_physical_memory_write(buf_addr
+ buf_len
, crc_ptr
, 4 - size
);
479 bd
.flags
&= ~FEC_BD_E
;
481 /* Last buffer in frame. */
482 bd
.flags
|= flags
| FEC_BD_L
;
483 DPRINTF("rx frame flags %04x\n", bd
.flags
);
484 s
->eir
|= FEC_INT_RXF
;
486 s
->eir
|= FEC_INT_RXB
;
488 mcf_fec_write_bd(&bd
, addr
);
489 /* Advance to the next descriptor. */
490 if ((bd
.flags
& FEC_BD_W
) != 0) {
496 s
->rx_descriptor
= addr
;
497 mcf_fec_enable_rx(s
);
502 static const MemoryRegionOps mcf_fec_ops
= {
503 .read
= mcf_fec_read
,
504 .write
= mcf_fec_write
,
505 .endianness
= DEVICE_NATIVE_ENDIAN
,
508 static NetClientInfo net_mcf_fec_info
= {
509 .type
= NET_CLIENT_OPTIONS_KIND_NIC
,
510 .size
= sizeof(NICState
),
511 .receive
= mcf_fec_receive
,
514 void mcf_fec_init(MemoryRegion
*sysmem
, NICInfo
*nd
,
515 hwaddr base
, qemu_irq
*irq
)
519 qemu_check_nic_model(nd
, "mcf_fec");
521 s
= (mcf_fec_state
*)g_malloc0(sizeof(mcf_fec_state
));
525 memory_region_init_io(&s
->iomem
, NULL
, &mcf_fec_ops
, s
, "fec", 0x400);
526 memory_region_add_subregion(sysmem
, base
, &s
->iomem
);
528 s
->conf
.macaddr
= nd
->macaddr
;
529 s
->conf
.peers
.ncs
[0] = nd
->netdev
;
531 s
->nic
= qemu_new_nic(&net_mcf_fec_info
, &s
->conf
, nd
->model
, nd
->name
, s
);
533 qemu_format_nic_info_str(qemu_get_queue(s
->nic
), s
->conf
.macaddr
.a
);