1 /*
2 * SMSC 91C111 Ethernet interface emulation
3 *
4 * Copyright (c) 2005 CodeSourcery, LLC.
5 * Written by Paul Brook
6 *
7 * This code is licensed under the GPL
8 */
9
10 #include "qemu/osdep.h"
11 #include "hw/sysbus.h"
12 #include "migration/vmstate.h"
13 #include "net/net.h"
14 #include "hw/irq.h"
15 #include "hw/net/smc91c111.h"
16 #include "hw/qdev-properties.h"
17 #include "qapi/error.h"
18 #include "qemu/log.h"
19 #include "qemu/module.h"
20 #include <zlib.h> /* for crc32 */
21 #include "qom/object.h"
22
23 /* Number of 2k memory pages available. */
24 #define NUM_PACKETS 4
25
26 #define TYPE_SMC91C111 "smc91c111"
27 OBJECT_DECLARE_SIMPLE_TYPE(smc91c111_state, SMC91C111)
28
29 struct smc91c111_state {
30 SysBusDevice parent_obj;
31
32 NICState *nic;
33 NICConf conf;
34 uint16_t tcr;
35 uint16_t rcr;
36 uint16_t cr;
37 uint16_t ctr;
38 uint16_t gpr;
39 uint16_t ptr;
40 uint16_t ercv;
41 qemu_irq irq;
42 int bank;
43 int packet_num;
44 int tx_alloc;
45 /* Bitmask of allocated packets. */
46 int allocated;
47 int tx_fifo_len;
48 int tx_fifo[NUM_PACKETS];
49 int rx_fifo_len;
50 int rx_fifo[NUM_PACKETS];
51 int tx_fifo_done_len;
52 int tx_fifo_done[NUM_PACKETS];
53 /* Packet buffer memory. */
54 uint8_t data[NUM_PACKETS][2048];
55 uint8_t int_level;
56 uint8_t int_mask;
57 MemoryRegion mmio;
58 };
59
60 static const VMStateDescription vmstate_smc91c111 = {
61 .name = "smc91c111",
62 .version_id = 1,
63 .minimum_version_id = 1,
64 .fields = (const VMStateField[]) {
65 VMSTATE_UINT16(tcr, smc91c111_state),
66 VMSTATE_UINT16(rcr, smc91c111_state),
67 VMSTATE_UINT16(cr, smc91c111_state),
68 VMSTATE_UINT16(ctr, smc91c111_state),
69 VMSTATE_UINT16(gpr, smc91c111_state),
70 VMSTATE_UINT16(ptr, smc91c111_state),
71 VMSTATE_UINT16(ercv, smc91c111_state),
72 VMSTATE_INT32(bank, smc91c111_state),
73 VMSTATE_INT32(packet_num, smc91c111_state),
74 VMSTATE_INT32(tx_alloc, smc91c111_state),
75 VMSTATE_INT32(allocated, smc91c111_state),
76 VMSTATE_INT32(tx_fifo_len, smc91c111_state),
77 VMSTATE_INT32_ARRAY(tx_fifo, smc91c111_state, NUM_PACKETS),
78 VMSTATE_INT32(rx_fifo_len, smc91c111_state),
79 VMSTATE_INT32_ARRAY(rx_fifo, smc91c111_state, NUM_PACKETS),
80 VMSTATE_INT32(tx_fifo_done_len, smc91c111_state),
81 VMSTATE_INT32_ARRAY(tx_fifo_done, smc91c111_state, NUM_PACKETS),
82 VMSTATE_BUFFER_UNSAFE(data, smc91c111_state, 0, NUM_PACKETS * 2048),
83 VMSTATE_UINT8(int_level, smc91c111_state),
84 VMSTATE_UINT8(int_mask, smc91c111_state),
85 VMSTATE_END_OF_LIST()
86 }
87 };
88
89 #define RCR_SOFT_RST 0x8000
90 #define RCR_STRIP_CRC 0x0200
91 #define RCR_RXEN 0x0100
92
93 #define TCR_EPH_LOOP 0x2000
94 #define TCR_NOCRC 0x0100
95 #define TCR_PAD_EN 0x0080
96 #define TCR_FORCOL 0x0004
97 #define TCR_LOOP 0x0002
98 #define TCR_TXEN 0x0001
99
100 #define INT_MD 0x80
101 #define INT_ERCV 0x40
102 #define INT_EPH 0x20
103 #define INT_RX_OVRN 0x10
104 #define INT_ALLOC 0x08
105 #define INT_TX_EMPTY 0x04
106 #define INT_TX 0x02
107 #define INT_RCV 0x01
108
109 #define CTR_AUTO_RELEASE 0x0800
110 #define CTR_RELOAD 0x0002
111 #define CTR_STORE 0x0001
112
113 #define RS_ALGNERR 0x8000
114 #define RS_BRODCAST 0x4000
115 #define RS_BADCRC 0x2000
116 #define RS_ODDFRAME 0x1000
117 #define RS_TOOLONG 0x0800
118 #define RS_TOOSHORT 0x0400
119 #define RS_MULTICAST 0x0001
120
121 /* Update interrupt status. */
smc91c111_update(smc91c111_state * s)122 static void smc91c111_update(smc91c111_state *s)
123 {
124 int level;
125
126 if (s->tx_fifo_len == 0)
127 s->int_level |= INT_TX_EMPTY;
128 if (s->tx_fifo_done_len != 0)
129 s->int_level |= INT_TX;
130 level = (s->int_level & s->int_mask) != 0;
131 qemu_set_irq(s->irq, level);
132 }
133
smc91c111_can_receive(smc91c111_state * s)134 static bool smc91c111_can_receive(smc91c111_state *s)
135 {
136 if ((s->rcr & RCR_RXEN) == 0 || (s->rcr & RCR_SOFT_RST)) {
137 return true;
138 }
139 if (s->allocated == (1 << NUM_PACKETS) - 1 ||
140 s->rx_fifo_len == NUM_PACKETS) {
141 return false;
142 }
143 return true;
144 }
145
smc91c111_flush_queued_packets(smc91c111_state * s)146 static inline void smc91c111_flush_queued_packets(smc91c111_state *s)
147 {
148 if (smc91c111_can_receive(s)) {
149 qemu_flush_queued_packets(qemu_get_queue(s->nic));
150 }
151 }
152
153 /* Try to allocate a packet. Returns 0x80 on failure. */
smc91c111_allocate_packet(smc91c111_state * s)154 static int smc91c111_allocate_packet(smc91c111_state *s)
155 {
156 int i;
157 if (s->allocated == (1 << NUM_PACKETS) - 1) {
158 return 0x80;
159 }
160
161 for (i = 0; i < NUM_PACKETS; i++) {
162 if ((s->allocated & (1 << i)) == 0)
163 break;
164 }
165 s->allocated |= 1 << i;
166 return i;
167 }
168
169
170 /* Process a pending TX allocate. */
smc91c111_tx_alloc(smc91c111_state * s)171 static void smc91c111_tx_alloc(smc91c111_state *s)
172 {
173 s->tx_alloc = smc91c111_allocate_packet(s);
174 if (s->tx_alloc == 0x80)
175 return;
176 s->int_level |= INT_ALLOC;
177 smc91c111_update(s);
178 }
179
180 /* Remove and item from the RX FIFO. */
smc91c111_pop_rx_fifo(smc91c111_state * s)181 static void smc91c111_pop_rx_fifo(smc91c111_state *s)
182 {
183 int i;
184
185 if (s->rx_fifo_len == 0) {
186 /*
187 * The datasheet doesn't document what the behaviour is if the
188 * guest tries to pop an empty RX FIFO, and there's no obvious
189 * error status register to report it. Just ignore the attempt.
190 */
191 return;
192 }
193
194 s->rx_fifo_len--;
195 if (s->rx_fifo_len) {
196 for (i = 0; i < s->rx_fifo_len; i++)
197 s->rx_fifo[i] = s->rx_fifo[i + 1];
198 s->int_level |= INT_RCV;
199 } else {
200 s->int_level &= ~INT_RCV;
201 }
202 smc91c111_flush_queued_packets(s);
203 smc91c111_update(s);
204 }
205
206 /* Remove an item from the TX completion FIFO. */
smc91c111_pop_tx_fifo_done(smc91c111_state * s)207 static void smc91c111_pop_tx_fifo_done(smc91c111_state *s)
208 {
209 int i;
210
211 if (s->tx_fifo_done_len == 0)
212 return;
213 s->tx_fifo_done_len--;
214 for (i = 0; i < s->tx_fifo_done_len; i++)
215 s->tx_fifo_done[i] = s->tx_fifo_done[i + 1];
216 }
217
218 /* Release the memory allocated to a packet. */
smc91c111_release_packet(smc91c111_state * s,int packet)219 static void smc91c111_release_packet(smc91c111_state *s, int packet)
220 {
221 s->allocated &= ~(1 << packet);
222 if (s->tx_alloc == 0x80)
223 smc91c111_tx_alloc(s);
224 smc91c111_flush_queued_packets(s);
225 }
226
227 /* Flush the TX FIFO. */
smc91c111_do_tx(smc91c111_state * s)228 static void smc91c111_do_tx(smc91c111_state *s)
229 {
230 int i;
231 int len;
232 int control;
233 int packetnum;
234 uint8_t *p;
235
236 if ((s->tcr & TCR_TXEN) == 0)
237 return;
238 if (s->tx_fifo_len == 0)
239 return;
240 for (i = 0; i < s->tx_fifo_len; i++) {
241 packetnum = s->tx_fifo[i];
242 p = &s->data[packetnum][0];
243 /* Set status word. */
244 *(p++) = 0x01;
245 *(p++) = 0x40;
246 len = *(p++);
247 len |= ((int)*(p++)) << 8;
248 len -= 6;
249 control = p[len + 1];
250 if (control & 0x20)
251 len++;
252 /* ??? This overwrites the data following the buffer.
253 Don't know what real hardware does. */
254 if (len < 64 && (s->tcr & TCR_PAD_EN)) {
255 memset(p + len, 0, 64 - len);
256 len = 64;
257 }
258 #if 0
259 {
260 int add_crc;
261
262 /* The card is supposed to append the CRC to the frame.
263 However none of the other network traffic has the CRC
264 appended. Suspect this is low level ethernet detail we
265 don't need to worry about. */
266 add_crc = (control & 0x10) || (s->tcr & TCR_NOCRC) == 0;
267 if (add_crc) {
268 uint32_t crc;
269
270 crc = crc32(~0, p, len);
271 memcpy(p + len, &crc, 4);
272 len += 4;
273 }
274 }
275 #endif
276 if (s->ctr & CTR_AUTO_RELEASE)
277 /* Race? */
278 smc91c111_release_packet(s, packetnum);
279 else if (s->tx_fifo_done_len < NUM_PACKETS)
280 s->tx_fifo_done[s->tx_fifo_done_len++] = packetnum;
281 qemu_send_packet(qemu_get_queue(s->nic), p, len);
282 }
283 s->tx_fifo_len = 0;
284 smc91c111_update(s);
285 }
286
287 /* Add a packet to the TX FIFO. */
smc91c111_queue_tx(smc91c111_state * s,int packet)288 static void smc91c111_queue_tx(smc91c111_state *s, int packet)
289 {
290 if (s->tx_fifo_len == NUM_PACKETS)
291 return;
292 s->tx_fifo[s->tx_fifo_len++] = packet;
293 smc91c111_do_tx(s);
294 }
295
smc91c111_reset(DeviceState * dev)296 static void smc91c111_reset(DeviceState *dev)
297 {
298 smc91c111_state *s = SMC91C111(dev);
299
300 s->bank = 0;
301 s->tx_fifo_len = 0;
302 s->tx_fifo_done_len = 0;
303 s->rx_fifo_len = 0;
304 s->allocated = 0;
305 s->packet_num = 0;
306 s->tx_alloc = 0;
307 s->tcr = 0;
308 s->rcr = 0;
309 s->cr = 0xa0b1;
310 s->ctr = 0x1210;
311 s->ptr = 0;
312 s->ercv = 0x1f;
313 s->int_level = INT_TX_EMPTY;
314 s->int_mask = 0;
315 smc91c111_update(s);
316 }
317
318 #define SET_LOW(name, val) s->name = (s->name & 0xff00) | val
319 #define SET_HIGH(name, val) s->name = (s->name & 0xff) | (val << 8)
320
smc91c111_writeb(void * opaque,hwaddr offset,uint32_t value)321 static void smc91c111_writeb(void *opaque, hwaddr offset,
322 uint32_t value)
323 {
324 smc91c111_state *s = (smc91c111_state *)opaque;
325
326 offset = offset & 0xf;
327 if (offset == 14) {
328 s->bank = value;
329 return;
330 }
331 if (offset == 15)
332 return;
333 switch (s->bank) {
334 case 0:
335 switch (offset) {
336 case 0: /* TCR */
337 SET_LOW(tcr, value);
338 return;
339 case 1:
340 SET_HIGH(tcr, value);
341 return;
342 case 4: /* RCR */
343 SET_LOW(rcr, value);
344 return;
345 case 5:
346 SET_HIGH(rcr, value);
347 if (s->rcr & RCR_SOFT_RST) {
348 smc91c111_reset(DEVICE(s));
349 }
350 smc91c111_flush_queued_packets(s);
351 return;
352 case 10: case 11: /* RPCR */
353 /* Ignored */
354 return;
355 case 12: case 13: /* Reserved */
356 return;
357 }
358 break;
359
360 case 1:
361 switch (offset) {
362 case 0: /* CONFIG */
363 SET_LOW(cr, value);
364 return;
365 case 1:
366 SET_HIGH(cr,value);
367 return;
368 case 2: case 3: /* BASE */
369 case 4: case 5: case 6: case 7: case 8: case 9: /* IA */
370 /* Not implemented. */
371 return;
372 case 10: /* General Purpose */
373 SET_LOW(gpr, value);
374 return;
375 case 11:
376 SET_HIGH(gpr, value);
377 return;
378 case 12: /* Control */
379 if (value & 1) {
380 qemu_log_mask(LOG_UNIMP,
381 "smc91c111: EEPROM store not implemented\n");
382 }
383 if (value & 2) {
384 qemu_log_mask(LOG_UNIMP,
385 "smc91c111: EEPROM reload not implemented\n");
386 }
387 value &= ~3;
388 SET_LOW(ctr, value);
389 return;
390 case 13:
391 SET_HIGH(ctr, value);
392 return;
393 }
394 break;
395
396 case 2:
397 switch (offset) {
398 case 0: /* MMU Command */
399 switch (value >> 5) {
400 case 0: /* no-op */
401 break;
402 case 1: /* Allocate for TX. */
403 s->tx_alloc = 0x80;
404 s->int_level &= ~INT_ALLOC;
405 smc91c111_update(s);
406 smc91c111_tx_alloc(s);
407 break;
408 case 2: /* Reset MMU. */
409 s->allocated = 0;
410 s->tx_fifo_len = 0;
411 s->tx_fifo_done_len = 0;
412 s->rx_fifo_len = 0;
413 s->tx_alloc = 0;
414 break;
415 case 3: /* Remove from RX FIFO. */
416 smc91c111_pop_rx_fifo(s);
417 break;
418 case 4: /* Remove from RX FIFO and release. */
419 if (s->rx_fifo_len > 0) {
420 smc91c111_release_packet(s, s->rx_fifo[0]);
421 }
422 smc91c111_pop_rx_fifo(s);
423 break;
424 case 5: /* Release. */
425 smc91c111_release_packet(s, s->packet_num);
426 break;
427 case 6: /* Add to TX FIFO. */
428 smc91c111_queue_tx(s, s->packet_num);
429 break;
430 case 7: /* Reset TX FIFO. */
431 s->tx_fifo_len = 0;
432 s->tx_fifo_done_len = 0;
433 break;
434 }
435 return;
436 case 1:
437 /* Ignore. */
438 return;
439 case 2: /* Packet Number Register */
440 s->packet_num = value;
441 return;
442 case 3: case 4: case 5:
443 /* Should be readonly, but linux writes to them anyway. Ignore. */
444 return;
445 case 6: /* Pointer */
446 SET_LOW(ptr, value);
447 return;
448 case 7:
449 SET_HIGH(ptr, value);
450 return;
451 case 8: case 9: case 10: case 11: /* Data */
452 {
453 int p;
454 int n;
455
456 if (s->ptr & 0x8000)
457 n = s->rx_fifo[0];
458 else
459 n = s->packet_num;
460 p = s->ptr & 0x07ff;
461 if (s->ptr & 0x4000) {
462 s->ptr = (s->ptr & 0xf800) | ((s->ptr + 1) & 0x7ff);
463 } else {
464 p += (offset & 3);
465 }
466 s->data[n][p] = value;
467 }
468 return;
469 case 12: /* Interrupt ACK. */
470 s->int_level &= ~(value & 0xd6);
471 if (value & INT_TX)
472 smc91c111_pop_tx_fifo_done(s);
473 smc91c111_update(s);
474 return;
475 case 13: /* Interrupt mask. */
476 s->int_mask = value;
477 smc91c111_update(s);
478 return;
479 }
480 break;
481
482 case 3:
483 switch (offset) {
484 case 0: case 1: case 2: case 3: case 4: case 5: case 6: case 7:
485 /* Multicast table. */
486 /* Not implemented. */
487 return;
488 case 8: case 9: /* Management Interface. */
489 /* Not implemented. */
490 return;
491 case 12: /* Early receive. */
492 s->ercv = value & 0x1f;
493 return;
494 case 13:
495 /* Ignore. */
496 return;
497 }
498 break;
499 }
500 qemu_log_mask(LOG_GUEST_ERROR, "smc91c111_write(bank:%d) Illegal register"
501 " 0x%" HWADDR_PRIx " = 0x%x\n",
502 s->bank, offset, value);
503 }
504
smc91c111_readb(void * opaque,hwaddr offset)505 static uint32_t smc91c111_readb(void *opaque, hwaddr offset)
506 {
507 smc91c111_state *s = (smc91c111_state *)opaque;
508
509 offset = offset & 0xf;
510 if (offset == 14) {
511 return s->bank;
512 }
513 if (offset == 15)
514 return 0x33;
515 switch (s->bank) {
516 case 0:
517 switch (offset) {
518 case 0: /* TCR */
519 return s->tcr & 0xff;
520 case 1:
521 return s->tcr >> 8;
522 case 2: /* EPH Status */
523 return 0;
524 case 3:
525 return 0x40;
526 case 4: /* RCR */
527 return s->rcr & 0xff;
528 case 5:
529 return s->rcr >> 8;
530 case 6: /* Counter */
531 case 7:
532 /* Not implemented. */
533 return 0;
534 case 8: /* Memory size. */
535 return NUM_PACKETS;
536 case 9: /* Free memory available. */
537 {
538 int i;
539 int n;
540 n = 0;
541 for (i = 0; i < NUM_PACKETS; i++) {
542 if (s->allocated & (1 << i))
543 n++;
544 }
545 return n;
546 }
547 case 10: case 11: /* RPCR */
548 /* Not implemented. */
549 return 0;
550 case 12: case 13: /* Reserved */
551 return 0;
552 }
553 break;
554
555 case 1:
556 switch (offset) {
557 case 0: /* CONFIG */
558 return s->cr & 0xff;
559 case 1:
560 return s->cr >> 8;
561 case 2: case 3: /* BASE */
562 /* Not implemented. */
563 return 0;
564 case 4: case 5: case 6: case 7: case 8: case 9: /* IA */
565 return s->conf.macaddr.a[offset - 4];
566 case 10: /* General Purpose */
567 return s->gpr & 0xff;
568 case 11:
569 return s->gpr >> 8;
570 case 12: /* Control */
571 return s->ctr & 0xff;
572 case 13:
573 return s->ctr >> 8;
574 }
575 break;
576
577 case 2:
578 switch (offset) {
579 case 0: case 1: /* MMUCR Busy bit. */
580 return 0;
581 case 2: /* Packet Number. */
582 return s->packet_num;
583 case 3: /* Allocation Result. */
584 return s->tx_alloc;
585 case 4: /* TX FIFO */
586 if (s->tx_fifo_done_len == 0)
587 return 0x80;
588 else
589 return s->tx_fifo_done[0];
590 case 5: /* RX FIFO */
591 if (s->rx_fifo_len == 0)
592 return 0x80;
593 else
594 return s->rx_fifo[0];
595 case 6: /* Pointer */
596 return s->ptr & 0xff;
597 case 7:
598 return (s->ptr >> 8) & 0xf7;
599 case 8: case 9: case 10: case 11: /* Data */
600 {
601 int p;
602 int n;
603
604 if (s->ptr & 0x8000)
605 n = s->rx_fifo[0];
606 else
607 n = s->packet_num;
608 p = s->ptr & 0x07ff;
609 if (s->ptr & 0x4000) {
610 s->ptr = (s->ptr & 0xf800) | ((s->ptr + 1) & 0x07ff);
611 } else {
612 p += (offset & 3);
613 }
614 return s->data[n][p];
615 }
616 case 12: /* Interrupt status. */
617 return s->int_level;
618 case 13: /* Interrupt mask. */
619 return s->int_mask;
620 }
621 break;
622
623 case 3:
624 switch (offset) {
625 case 0: case 1: case 2: case 3: case 4: case 5: case 6: case 7:
626 /* Multicast table. */
627 /* Not implemented. */
628 return 0;
629 case 8: /* Management Interface. */
630 /* Not implemented. */
631 return 0x30;
632 case 9:
633 return 0x33;
634 case 10: /* Revision. */
635 return 0x91;
636 case 11:
637 return 0x33;
638 case 12:
639 return s->ercv;
640 case 13:
641 return 0;
642 }
643 break;
644 }
645 qemu_log_mask(LOG_GUEST_ERROR, "smc91c111_read(bank:%d) Illegal register"
646 " 0x%" HWADDR_PRIx "\n",
647 s->bank, offset);
648 return 0;
649 }
650
smc91c111_readfn(void * opaque,hwaddr addr,unsigned size)651 static uint64_t smc91c111_readfn(void *opaque, hwaddr addr, unsigned size)
652 {
653 int i;
654 uint32_t val = 0;
655
656 for (i = 0; i < size; i++) {
657 val |= smc91c111_readb(opaque, addr + i) << (i * 8);
658 }
659 return val;
660 }
661
smc91c111_writefn(void * opaque,hwaddr addr,uint64_t value,unsigned size)662 static void smc91c111_writefn(void *opaque, hwaddr addr,
663 uint64_t value, unsigned size)
664 {
665 int i = 0;
666
667 /* 32-bit writes to offset 0xc only actually write to the bank select
668 * register (offset 0xe), so skip the first two bytes we would write.
669 */
670 if (addr == 0xc && size == 4) {
671 i += 2;
672 }
673
674 for (; i < size; i++) {
675 smc91c111_writeb(opaque, addr + i,
676 extract32(value, i * 8, 8));
677 }
678 }
679
smc91c111_can_receive_nc(NetClientState * nc)680 static bool smc91c111_can_receive_nc(NetClientState *nc)
681 {
682 smc91c111_state *s = qemu_get_nic_opaque(nc);
683
684 return smc91c111_can_receive(s);
685 }
686
smc91c111_receive(NetClientState * nc,const uint8_t * buf,size_t size)687 static ssize_t smc91c111_receive(NetClientState *nc, const uint8_t *buf, size_t size)
688 {
689 smc91c111_state *s = qemu_get_nic_opaque(nc);
690 int status;
691 int packetsize;
692 uint32_t crc;
693 int packetnum;
694 uint8_t *p;
695
696 if ((s->rcr & RCR_RXEN) == 0 || (s->rcr & RCR_SOFT_RST))
697 return -1;
698 /* Short packets are padded with zeros. Receiving a packet
699 < 64 bytes long is considered an error condition. */
700 if (size < 64)
701 packetsize = 64;
702 else
703 packetsize = (size & ~1);
704 packetsize += 6;
705 crc = (s->rcr & RCR_STRIP_CRC) == 0;
706 if (crc)
707 packetsize += 4;
708 /* TODO: Flag overrun and receive errors. */
709 if (packetsize > 2048)
710 return -1;
711 packetnum = smc91c111_allocate_packet(s);
712 if (packetnum == 0x80)
713 return -1;
714 s->rx_fifo[s->rx_fifo_len++] = packetnum;
715
716 p = &s->data[packetnum][0];
717 /* ??? Multicast packets? */
718 status = 0;
719 if (size > 1518)
720 status |= RS_TOOLONG;
721 if (size & 1)
722 status |= RS_ODDFRAME;
723 *(p++) = status & 0xff;
724 *(p++) = status >> 8;
725 *(p++) = packetsize & 0xff;
726 *(p++) = packetsize >> 8;
727 memcpy(p, buf, size & ~1);
728 p += (size & ~1);
729 /* Pad short packets. */
730 if (size < 64) {
731 int pad;
732
733 if (size & 1)
734 *(p++) = buf[size - 1];
735 pad = 64 - size;
736 memset(p, 0, pad);
737 p += pad;
738 size = 64;
739 }
740 /* It's not clear if the CRC should go before or after the last byte in
741 odd sized packets. Linux disables the CRC, so that's no help.
742 The pictures in the documentation show the CRC aligned on a 16-bit
743 boundary before the last odd byte, so that's what we do. */
744 if (crc) {
745 crc = crc32(~0, buf, size);
746 *(p++) = crc & 0xff; crc >>= 8;
747 *(p++) = crc & 0xff; crc >>= 8;
748 *(p++) = crc & 0xff; crc >>= 8;
749 *(p++) = crc & 0xff;
750 }
751 if (size & 1) {
752 *(p++) = buf[size - 1];
753 *p = 0x60;
754 } else {
755 *(p++) = 0;
756 *p = 0x40;
757 }
758 /* TODO: Raise early RX interrupt? */
759 s->int_level |= INT_RCV;
760 smc91c111_update(s);
761
762 return size;
763 }
764
765 static const MemoryRegionOps smc91c111_mem_ops = {
766 /* The special case for 32 bit writes to 0xc means we can't just
767 * set .impl.min/max_access_size to 1, unfortunately
768 */
769 .read = smc91c111_readfn,
770 .write = smc91c111_writefn,
771 .valid.min_access_size = 1,
772 .valid.max_access_size = 4,
773 .endianness = DEVICE_NATIVE_ENDIAN,
774 };
775
776 static NetClientInfo net_smc91c111_info = {
777 .type = NET_CLIENT_DRIVER_NIC,
778 .size = sizeof(NICState),
779 .can_receive = smc91c111_can_receive_nc,
780 .receive = smc91c111_receive,
781 };
782
smc91c111_realize(DeviceState * dev,Error ** errp)783 static void smc91c111_realize(DeviceState *dev, Error **errp)
784 {
785 SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
786 smc91c111_state *s = SMC91C111(dev);
787
788 memory_region_init_io(&s->mmio, OBJECT(s), &smc91c111_mem_ops, s,
789 "smc91c111-mmio", 16);
790 sysbus_init_mmio(sbd, &s->mmio);
791 sysbus_init_irq(sbd, &s->irq);
792 qemu_macaddr_default_if_unset(&s->conf.macaddr);
793 s->nic = qemu_new_nic(&net_smc91c111_info, &s->conf,
794 object_get_typename(OBJECT(dev)), dev->id,
795 &dev->mem_reentrancy_guard, s);
796 qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
797 /* ??? Save/restore. */
798 }
799
800 static Property smc91c111_properties[] = {
801 DEFINE_NIC_PROPERTIES(smc91c111_state, conf),
802 DEFINE_PROP_END_OF_LIST(),
803 };
804
smc91c111_class_init(ObjectClass * klass,void * data)805 static void smc91c111_class_init(ObjectClass *klass, void *data)
806 {
807 DeviceClass *dc = DEVICE_CLASS(klass);
808
809 dc->realize = smc91c111_realize;
810 device_class_set_legacy_reset(dc, smc91c111_reset);
811 dc->vmsd = &vmstate_smc91c111;
812 device_class_set_props(dc, smc91c111_properties);
813 }
814
815 static const TypeInfo smc91c111_info = {
816 .name = TYPE_SMC91C111,
817 .parent = TYPE_SYS_BUS_DEVICE,
818 .instance_size = sizeof(smc91c111_state),
819 .class_init = smc91c111_class_init,
820 };
821
smc91c111_register_types(void)822 static void smc91c111_register_types(void)
823 {
824 type_register_static(&smc91c111_info);
825 }
826
827 /* Legacy helper function. Should go away when machine config files are
828 implemented. */
smc91c111_init(uint32_t base,qemu_irq irq)829 void smc91c111_init(uint32_t base, qemu_irq irq)
830 {
831 DeviceState *dev;
832 SysBusDevice *s;
833
834 dev = qdev_new(TYPE_SMC91C111);
835 qemu_configure_nic_device(dev, true, NULL);
836 s = SYS_BUS_DEVICE(dev);
837 sysbus_realize_and_unref(s, &error_fatal);
838 sysbus_mmio_map(s, 0, base);
839 sysbus_connect_irq(s, 0, irq);
840 }
841
842 type_init(smc91c111_register_types)
843