2 * SMSC 91C111 Ethernet interface emulation
4 * Copyright (c) 2005 CodeSourcery, LLC.
5 * Written by Paul Brook
7 * This code is licenced under the GPL
14 /* Number of 2k memory pages available. */
32 /* Bitmask of allocated packets. */
35 int tx_fifo
[NUM_PACKETS
];
37 int rx_fifo
[NUM_PACKETS
];
39 int tx_fifo_done
[NUM_PACKETS
];
40 /* Packet buffer memory. */
41 uint8_t data
[NUM_PACKETS
][2048];
47 #define RCR_SOFT_RST 0x8000
48 #define RCR_STRIP_CRC 0x0200
49 #define RCR_RXEN 0x0100
51 #define TCR_EPH_LOOP 0x2000
52 #define TCR_NOCRC 0x0100
53 #define TCR_PAD_EN 0x0080
54 #define TCR_FORCOL 0x0004
55 #define TCR_LOOP 0x0002
56 #define TCR_TXEN 0x0001
61 #define INT_RX_OVRN 0x10
62 #define INT_ALLOC 0x08
63 #define INT_TX_EMPTY 0x04
67 #define CTR_AUTO_RELEASE 0x0800
68 #define CTR_RELOAD 0x0002
69 #define CTR_STORE 0x0001
71 #define RS_ALGNERR 0x8000
72 #define RS_BRODCAST 0x4000
73 #define RS_BADCRC 0x2000
74 #define RS_ODDFRAME 0x1000
75 #define RS_TOOLONG 0x0800
76 #define RS_TOOSHORT 0x0400
77 #define RS_MULTICAST 0x0001
79 /* Update interrupt status. */
80 static void smc91c111_update(smc91c111_state
*s
)
84 if (s
->tx_fifo_len
== 0)
85 s
->int_level
|= INT_TX_EMPTY
;
86 if (s
->tx_fifo_done_len
!= 0)
87 s
->int_level
|= INT_TX
;
88 level
= (s
->int_level
& s
->int_mask
) != 0;
89 pic_set_irq_new(s
->pic
, s
->irq
, level
);
92 /* Try to allocate a packet. Returns 0x80 on failure. */
93 static int smc91c111_allocate_packet(smc91c111_state
*s
)
96 if (s
->allocated
== (1 << NUM_PACKETS
) - 1) {
100 for (i
= 0; i
< NUM_PACKETS
; i
++) {
101 if ((s
->allocated
& (1 << i
)) == 0)
104 s
->allocated
|= 1 << i
;
109 /* Process a pending TX allocate. */
110 static void smc91c111_tx_alloc(smc91c111_state
*s
)
112 s
->tx_alloc
= smc91c111_allocate_packet(s
);
113 if (s
->tx_alloc
== 0x80)
115 s
->int_level
|= INT_ALLOC
;
119 /* Remove and item from the RX FIFO. */
120 static void smc91c111_pop_rx_fifo(smc91c111_state
*s
)
125 if (s
->rx_fifo_len
) {
126 for (i
= 0; i
< s
->rx_fifo_len
; i
++)
127 s
->rx_fifo
[i
] = s
->rx_fifo
[i
+ 1];
128 s
->int_level
|= INT_RCV
;
130 s
->int_level
&= ~INT_RCV
;
135 /* Remove an item from the TX completion FIFO. */
136 static void smc91c111_pop_tx_fifo_done(smc91c111_state
*s
)
140 if (s
->tx_fifo_done_len
== 0)
142 s
->tx_fifo_done_len
--;
143 for (i
= 0; i
< s
->tx_fifo_done_len
; i
++)
144 s
->tx_fifo_done
[i
] = s
->tx_fifo_done
[i
+ 1];
147 /* Release the memory allocated to a packet. */
148 static void smc91c111_release_packet(smc91c111_state
*s
, int packet
)
150 s
->allocated
&= ~(1 << packet
);
151 if (s
->tx_alloc
== 0x80)
152 smc91c111_tx_alloc(s
);
155 /* Flush the TX FIFO. */
156 static void smc91c111_do_tx(smc91c111_state
*s
)
165 if ((s
->tcr
& TCR_TXEN
) == 0)
167 if (s
->tx_fifo_len
== 0)
169 for (i
= 0; i
< s
->tx_fifo_len
; i
++) {
170 packetnum
= s
->tx_fifo
[i
];
171 p
= &s
->data
[packetnum
][0];
172 /* Set status word. */
176 len
|= ((int)*(p
++)) << 8;
178 control
= p
[len
+ 1];
181 /* ??? This overwrites the data following the buffer.
182 Don't know what real hardware does. */
183 if (len
< 64 && (s
->tcr
& TCR_PAD_EN
)) {
184 memset(p
+ len
, 0, 64 - len
);
188 /* The card is supposed to append the CRC to the frame. However
189 none of the other network traffic has the CRC appended.
190 Suspect this is low level ethernet detail we don't need to worry
192 add_crc
= (control
& 0x10) || (s
->tcr
& TCR_NOCRC
) == 0;
196 crc
= crc32(~0, p
, len
);
197 memcpy(p
+ len
, &crc
, 4);
203 if (s
->ctr
& CTR_AUTO_RELEASE
)
205 smc91c111_release_packet(s
, packetnum
);
206 else if (s
->tx_fifo_done_len
< NUM_PACKETS
)
207 s
->tx_fifo_done
[s
->tx_fifo_done_len
++] = packetnum
;
208 qemu_send_packet(s
->vc
, p
, len
);
214 /* Add a packet to the TX FIFO. */
215 static void smc91c111_queue_tx(smc91c111_state
*s
, int packet
)
217 if (s
->tx_fifo_len
== NUM_PACKETS
)
219 s
->tx_fifo
[s
->tx_fifo_len
++] = packet
;
223 static void smc91c111_reset(smc91c111_state
*s
)
227 s
->tx_fifo_done_len
= 0;
238 s
->int_level
= INT_TX_EMPTY
;
243 #define SET_LOW(name, val) s->name = (s->name & 0xff00) | val
244 #define SET_HIGH(name, val) s->name = (s->name & 0xff) | (val << 8)
246 static void smc91c111_writeb(void *opaque
, target_phys_addr_t offset
,
249 smc91c111_state
*s
= (smc91c111_state
*)opaque
;
265 SET_HIGH(tcr
, value
);
271 SET_HIGH(rcr
, value
);
272 if (s
->rcr
& RCR_SOFT_RST
)
275 case 10: case 11: /* RPCR */
289 case 2: case 3: /* BASE */
290 case 4: case 5: case 6: case 7: case 8: case 9: /* IA */
291 /* Not implemented. */
293 case 10: /* Genral Purpose */
297 SET_HIGH(gpr
, value
);
299 case 12: /* Control */
301 fprintf(stderr
, "smc91c111:EEPROM store not implemented\n");
303 fprintf(stderr
, "smc91c111:EEPROM reload not implemented\n");
308 SET_HIGH(ctr
, value
);
315 case 0: /* MMU Command */
316 switch (value
>> 5) {
319 case 1: /* Allocate for TX. */
321 s
->int_level
&= ~INT_ALLOC
;
323 smc91c111_tx_alloc(s
);
325 case 2: /* Reset MMU. */
328 s
->tx_fifo_done_len
= 0;
332 case 3: /* Remove from RX FIFO. */
333 smc91c111_pop_rx_fifo(s
);
335 case 4: /* Remove from RX FIFO and release. */
336 if (s
->rx_fifo_len
> 0) {
337 smc91c111_release_packet(s
, s
->rx_fifo
[0]);
339 smc91c111_pop_rx_fifo(s
);
341 case 5: /* Release. */
342 smc91c111_release_packet(s
, s
->packet_num
);
344 case 6: /* Add to TX FIFO. */
345 smc91c111_queue_tx(s
, s
->packet_num
);
347 case 7: /* Reset TX FIFO. */
349 s
->tx_fifo_done_len
= 0;
356 case 2: /* Packet Number Register */
357 s
->packet_num
= value
;
359 case 3: case 4: case 5:
360 /* Should be readonly, but linux writes to them anyway. Ignore. */
362 case 6: /* Pointer */
366 SET_HIGH(ptr
, value
);
368 case 8: case 9: case 10: case 11: /* Data */
378 if (s
->ptr
& 0x4000) {
379 s
->ptr
= (s
->ptr
& 0xf800) | ((s
->ptr
+ 1) & 0x7ff);
383 s
->data
[n
][p
] = value
;
386 case 12: /* Interrupt ACK. */
387 s
->int_level
&= ~(value
& 0xd6);
389 smc91c111_pop_tx_fifo_done(s
);
392 case 13: /* Interrupt mask. */
401 case 0: case 1: case 2: case 3: case 4: case 5: case 6: case 7:
402 /* Multicast table. */
403 /* Not implemented. */
405 case 8: case 9: /* Management Interface. */
406 /* Not implemented. */
408 case 12: /* Early receive. */
409 s
->ercv
= value
& 0x1f;
416 cpu_abort (cpu_single_env
, "smc91c111_write: Bad reg %d:%x\n",
420 static uint32_t smc91c111_readb(void *opaque
, target_phys_addr_t offset
)
422 smc91c111_state
*s
= (smc91c111_state
*)opaque
;
434 return s
->tcr
& 0xff;
437 case 2: /* EPH Status */
442 return s
->rcr
& 0xff;
445 case 6: /* Counter */
447 /* Not implemented. */
449 case 8: /* Free memory available. */
454 for (i
= 0; i
< NUM_PACKETS
; i
++) {
455 if (s
->allocated
& (1 << i
))
460 case 9: /* Memory size. */
462 case 10: case 11: /* RPCR */
463 /* Not implemented. */
474 case 2: case 3: /* BASE */
475 /* Not implemented. */
477 case 4: case 5: case 6: case 7: case 8: case 9: /* IA */
478 return s
->macaddr
[offset
- 4];
479 case 10: /* General Purpose */
480 return s
->gpr
& 0xff;
483 case 12: /* Control */
484 return s
->ctr
& 0xff;
492 case 0: case 1: /* MMUCR Busy bit. */
494 case 2: /* Packet Number. */
495 return s
->packet_num
;
496 case 3: /* Allocation Result. */
498 case 4: /* TX FIFO */
499 if (s
->tx_fifo_done_len
== 0)
502 return s
->tx_fifo_done
[0];
503 case 5: /* RX FIFO */
504 if (s
->rx_fifo_len
== 0)
507 return s
->rx_fifo
[0];
508 case 6: /* Pointer */
509 return s
->ptr
& 0xff;
511 return (s
->ptr
>> 8) & 0xf7;
512 case 8: case 9: case 10: case 11: /* Data */
522 if (s
->ptr
& 0x4000) {
523 s
->ptr
= (s
->ptr
& 0xf800) | ((s
->ptr
+ 1) & 0x07ff);
527 return s
->data
[n
][p
];
529 case 12: /* Interrupt status. */
531 case 13: /* Interrupt mask. */
538 case 0: case 1: case 2: case 3: case 4: case 5: case 6: case 7:
539 /* Multicast table. */
540 /* Not implemented. */
542 case 8: /* Management Interface. */
543 /* Not implemented. */
547 case 10: /* Revision. */
558 cpu_abort (cpu_single_env
, "smc91c111_read: Bad reg %d:%x\n",
563 static void smc91c111_writew(void *opaque
, target_phys_addr_t offset
,
566 smc91c111_writeb(opaque
, offset
, value
& 0xff);
567 smc91c111_writeb(opaque
, offset
+ 1, value
>> 8);
570 static void smc91c111_writel(void *opaque
, target_phys_addr_t offset
,
573 smc91c111_state
*s
= (smc91c111_state
*)opaque
;
574 /* 32-bit writes to offset 0xc only actually write to the bank select
575 register (offset 0xe) */
576 if (offset
!= s
->base
+ 0xc)
577 smc91c111_writew(opaque
, offset
, value
& 0xffff);
578 smc91c111_writew(opaque
, offset
+ 2, value
>> 16);
581 static uint32_t smc91c111_readw(void *opaque
, target_phys_addr_t offset
)
584 val
= smc91c111_readb(opaque
, offset
);
585 val
|= smc91c111_readb(opaque
, offset
+ 1) << 8;
589 static uint32_t smc91c111_readl(void *opaque
, target_phys_addr_t offset
)
592 val
= smc91c111_readw(opaque
, offset
);
593 val
|= smc91c111_readw(opaque
, offset
+ 2) << 16;
597 static int smc91c111_can_receive(void *opaque
)
599 smc91c111_state
*s
= (smc91c111_state
*)opaque
;
601 if ((s
->rcr
& RCR_RXEN
) == 0 || (s
->rcr
& RCR_SOFT_RST
))
603 if (s
->allocated
== (1 << NUM_PACKETS
) - 1)
608 static void smc91c111_receive(void *opaque
, const uint8_t *buf
, int size
)
610 smc91c111_state
*s
= (smc91c111_state
*)opaque
;
617 if ((s
->rcr
& RCR_RXEN
) == 0 || (s
->rcr
& RCR_SOFT_RST
))
619 /* Short packets are padded with zeros. Receiving a packet
620 < 64 bytes long is considered an error condition. */
624 packetsize
= (size
& ~1);
626 crc
= (s
->rcr
& RCR_STRIP_CRC
) == 0;
629 /* TODO: Flag overrun and receive errors. */
630 if (packetsize
> 2048)
632 packetnum
= smc91c111_allocate_packet(s
);
633 if (packetnum
== 0x80)
635 s
->rx_fifo
[s
->rx_fifo_len
++] = packetnum
;
637 p
= &s
->data
[packetnum
][0];
638 /* ??? Multicast packets? */
641 status
|= RS_TOOLONG
;
643 status
|= RS_ODDFRAME
;
644 *(p
++) = status
& 0xff;
645 *(p
++) = status
>> 8;
646 *(p
++) = packetsize
& 0xff;
647 *(p
++) = packetsize
>> 8;
648 memcpy(p
, buf
, size
& ~1);
650 /* Pad short packets. */
655 *(p
++) = buf
[size
- 1];
661 /* It's not clear if the CRC should go before or after the last byte in
662 odd sized packets. Linux disables the CRC, so that's no help.
663 The pictures in the documentation show the CRC aligned on a 16-bit
664 boundary before the last odd byte, so that's what we do. */
666 crc
= crc32(~0, buf
, size
);
667 *(p
++) = crc
& 0xff; crc
>>= 8;
668 *(p
++) = crc
& 0xff; crc
>>= 8;
669 *(p
++) = crc
& 0xff; crc
>>= 8;
670 *(p
++) = crc
& 0xff; crc
>>= 8;
673 *(p
++) = buf
[size
- 1];
679 /* TODO: Raise early RX interrupt? */
680 s
->int_level
|= INT_RCV
;
684 static CPUReadMemoryFunc
*smc91c111_readfn
[] = {
690 static CPUWriteMemoryFunc
*smc91c111_writefn
[] = {
696 void smc91c111_init(NICInfo
*nd
, uint32_t base
, void *pic
, int irq
)
701 s
= (smc91c111_state
*)qemu_mallocz(sizeof(smc91c111_state
));
702 iomemtype
= cpu_register_io_memory(0, smc91c111_readfn
,
703 smc91c111_writefn
, s
);
704 cpu_register_physical_memory(base
, 16, iomemtype
);
708 memcpy(s
->macaddr
, nd
->macaddr
, 6);
712 s
->vc
= qemu_new_vlan_client(nd
->vlan
, smc91c111_receive
,
713 smc91c111_can_receive
, s
);
714 /* ??? Save/restore. */