xref: /openbmc/qemu/hw/net/smc91c111.c (revision aead95c7fafdac3fe8380c1e9f1be38122eb1b7e)
1 /*
2  * SMSC 91C111 Ethernet interface emulation
3  *
4  * Copyright (c) 2005 CodeSourcery, LLC.
5  * Written by Paul Brook
6  *
7  * This code is licensed under the GPL
8  */
9 
10 #include "qemu/osdep.h"
11 #include "hw/sysbus.h"
12 #include "migration/vmstate.h"
13 #include "net/net.h"
14 #include "hw/irq.h"
15 #include "hw/net/smc91c111.h"
16 #include "hw/qdev-properties.h"
17 #include "qapi/error.h"
18 #include "qemu/log.h"
19 #include "qemu/module.h"
20 #include <zlib.h> /* for crc32 */
21 #include "qom/object.h"
22 
23 /* Number of 2k memory pages available.  */
24 #define NUM_PACKETS 4
25 
26 #define TYPE_SMC91C111 "smc91c111"
27 OBJECT_DECLARE_SIMPLE_TYPE(smc91c111_state, SMC91C111)
28 
29 struct smc91c111_state {
30     SysBusDevice parent_obj;
31 
32     NICState *nic;
33     NICConf conf;
34     uint16_t tcr;
35     uint16_t rcr;
36     uint16_t cr;
37     uint16_t ctr;
38     uint16_t gpr;
39     uint16_t ptr;
40     uint16_t ercv;
41     qemu_irq irq;
42     int bank;
43     int packet_num;
44     int tx_alloc;
45     /* Bitmask of allocated packets.  */
46     int allocated;
47     int tx_fifo_len;
48     int tx_fifo[NUM_PACKETS];
49     int rx_fifo_len;
50     int rx_fifo[NUM_PACKETS];
51     int tx_fifo_done_len;
52     int tx_fifo_done[NUM_PACKETS];
53     /* Packet buffer memory.  */
54     uint8_t data[NUM_PACKETS][2048];
55     uint8_t int_level;
56     uint8_t int_mask;
57     MemoryRegion mmio;
58 };
59 
60 static const VMStateDescription vmstate_smc91c111 = {
61     .name = "smc91c111",
62     .version_id = 1,
63     .minimum_version_id = 1,
64     .fields = (const VMStateField[]) {
65         VMSTATE_UINT16(tcr, smc91c111_state),
66         VMSTATE_UINT16(rcr, smc91c111_state),
67         VMSTATE_UINT16(cr, smc91c111_state),
68         VMSTATE_UINT16(ctr, smc91c111_state),
69         VMSTATE_UINT16(gpr, smc91c111_state),
70         VMSTATE_UINT16(ptr, smc91c111_state),
71         VMSTATE_UINT16(ercv, smc91c111_state),
72         VMSTATE_INT32(bank, smc91c111_state),
73         VMSTATE_INT32(packet_num, smc91c111_state),
74         VMSTATE_INT32(tx_alloc, smc91c111_state),
75         VMSTATE_INT32(allocated, smc91c111_state),
76         VMSTATE_INT32(tx_fifo_len, smc91c111_state),
77         VMSTATE_INT32_ARRAY(tx_fifo, smc91c111_state, NUM_PACKETS),
78         VMSTATE_INT32(rx_fifo_len, smc91c111_state),
79         VMSTATE_INT32_ARRAY(rx_fifo, smc91c111_state, NUM_PACKETS),
80         VMSTATE_INT32(tx_fifo_done_len, smc91c111_state),
81         VMSTATE_INT32_ARRAY(tx_fifo_done, smc91c111_state, NUM_PACKETS),
82         VMSTATE_BUFFER_UNSAFE(data, smc91c111_state, 0, NUM_PACKETS * 2048),
83         VMSTATE_UINT8(int_level, smc91c111_state),
84         VMSTATE_UINT8(int_mask, smc91c111_state),
85         VMSTATE_END_OF_LIST()
86     }
87 };
88 
89 #define RCR_SOFT_RST  0x8000
90 #define RCR_STRIP_CRC 0x0200
91 #define RCR_RXEN      0x0100
92 
93 #define TCR_EPH_LOOP  0x2000
94 #define TCR_NOCRC     0x0100
95 #define TCR_PAD_EN    0x0080
96 #define TCR_FORCOL    0x0004
97 #define TCR_LOOP      0x0002
98 #define TCR_TXEN      0x0001
99 
100 #define INT_MD        0x80
101 #define INT_ERCV      0x40
102 #define INT_EPH       0x20
103 #define INT_RX_OVRN   0x10
104 #define INT_ALLOC     0x08
105 #define INT_TX_EMPTY  0x04
106 #define INT_TX        0x02
107 #define INT_RCV       0x01
108 
109 #define CTR_AUTO_RELEASE  0x0800
110 #define CTR_RELOAD        0x0002
111 #define CTR_STORE         0x0001
112 
113 #define RS_ALGNERR      0x8000
114 #define RS_BRODCAST     0x4000
115 #define RS_BADCRC       0x2000
116 #define RS_ODDFRAME     0x1000
117 #define RS_TOOLONG      0x0800
118 #define RS_TOOSHORT     0x0400
119 #define RS_MULTICAST    0x0001
120 
121 /* Update interrupt status.  */
smc91c111_update(smc91c111_state * s)122 static void smc91c111_update(smc91c111_state *s)
123 {
124     int level;
125 
126     if (s->tx_fifo_len == 0)
127         s->int_level |= INT_TX_EMPTY;
128     if (s->tx_fifo_done_len != 0)
129         s->int_level |= INT_TX;
130     level = (s->int_level & s->int_mask) != 0;
131     qemu_set_irq(s->irq, level);
132 }
133 
smc91c111_can_receive(smc91c111_state * s)134 static bool smc91c111_can_receive(smc91c111_state *s)
135 {
136     if ((s->rcr & RCR_RXEN) == 0 || (s->rcr & RCR_SOFT_RST)) {
137         return true;
138     }
139     if (s->allocated == (1 << NUM_PACKETS) - 1 ||
140         s->rx_fifo_len == NUM_PACKETS) {
141         return false;
142     }
143     return true;
144 }
145 
smc91c111_flush_queued_packets(smc91c111_state * s)146 static inline void smc91c111_flush_queued_packets(smc91c111_state *s)
147 {
148     if (smc91c111_can_receive(s)) {
149         qemu_flush_queued_packets(qemu_get_queue(s->nic));
150     }
151 }
152 
153 /* Try to allocate a packet.  Returns 0x80 on failure.  */
smc91c111_allocate_packet(smc91c111_state * s)154 static int smc91c111_allocate_packet(smc91c111_state *s)
155 {
156     int i;
157     if (s->allocated == (1 << NUM_PACKETS) - 1) {
158         return 0x80;
159     }
160 
161     for (i = 0; i < NUM_PACKETS; i++) {
162         if ((s->allocated & (1 << i)) == 0)
163             break;
164     }
165     s->allocated |= 1 << i;
166     return i;
167 }
168 
169 
170 /* Process a pending TX allocate.  */
smc91c111_tx_alloc(smc91c111_state * s)171 static void smc91c111_tx_alloc(smc91c111_state *s)
172 {
173     s->tx_alloc = smc91c111_allocate_packet(s);
174     if (s->tx_alloc == 0x80)
175         return;
176     s->int_level |= INT_ALLOC;
177     smc91c111_update(s);
178 }
179 
180 /* Remove and item from the RX FIFO.  */
smc91c111_pop_rx_fifo(smc91c111_state * s)181 static void smc91c111_pop_rx_fifo(smc91c111_state *s)
182 {
183     int i;
184 
185     if (s->rx_fifo_len == 0) {
186         /*
187          * The datasheet doesn't document what the behaviour is if the
188          * guest tries to pop an empty RX FIFO, and there's no obvious
189          * error status register to report it. Just ignore the attempt.
190          */
191         return;
192     }
193 
194     s->rx_fifo_len--;
195     if (s->rx_fifo_len) {
196         for (i = 0; i < s->rx_fifo_len; i++)
197             s->rx_fifo[i] = s->rx_fifo[i + 1];
198         s->int_level |= INT_RCV;
199     } else {
200         s->int_level &= ~INT_RCV;
201     }
202     smc91c111_flush_queued_packets(s);
203     smc91c111_update(s);
204 }
205 
206 /* Remove an item from the TX completion FIFO.  */
smc91c111_pop_tx_fifo_done(smc91c111_state * s)207 static void smc91c111_pop_tx_fifo_done(smc91c111_state *s)
208 {
209     int i;
210 
211     if (s->tx_fifo_done_len == 0)
212         return;
213     s->tx_fifo_done_len--;
214     for (i = 0; i < s->tx_fifo_done_len; i++)
215         s->tx_fifo_done[i] = s->tx_fifo_done[i + 1];
216 }
217 
218 /* Release the memory allocated to a packet.  */
smc91c111_release_packet(smc91c111_state * s,int packet)219 static void smc91c111_release_packet(smc91c111_state *s, int packet)
220 {
221     s->allocated &= ~(1 << packet);
222     if (s->tx_alloc == 0x80)
223         smc91c111_tx_alloc(s);
224     smc91c111_flush_queued_packets(s);
225 }
226 
227 /* Flush the TX FIFO.  */
smc91c111_do_tx(smc91c111_state * s)228 static void smc91c111_do_tx(smc91c111_state *s)
229 {
230     int i;
231     int len;
232     int control;
233     int packetnum;
234     uint8_t *p;
235 
236     if ((s->tcr & TCR_TXEN) == 0)
237         return;
238     if (s->tx_fifo_len == 0)
239         return;
240     for (i = 0; i < s->tx_fifo_len; i++) {
241         packetnum = s->tx_fifo[i];
242         p = &s->data[packetnum][0];
243         /* Set status word.  */
244         *(p++) = 0x01;
245         *(p++) = 0x40;
246         len = *(p++);
247         len |= ((int)*(p++)) << 8;
248         len -= 6;
249         control = p[len + 1];
250         if (control & 0x20)
251             len++;
252         /* ??? This overwrites the data following the buffer.
253            Don't know what real hardware does.  */
254         if (len < 64 && (s->tcr & TCR_PAD_EN)) {
255             memset(p + len, 0, 64 - len);
256             len = 64;
257         }
258 #if 0
259         {
260             int add_crc;
261 
262             /* The card is supposed to append the CRC to the frame.
263                However none of the other network traffic has the CRC
264                appended.  Suspect this is low level ethernet detail we
265                don't need to worry about.  */
266             add_crc = (control & 0x10) || (s->tcr & TCR_NOCRC) == 0;
267             if (add_crc) {
268                 uint32_t crc;
269 
270                 crc = crc32(~0, p, len);
271                 memcpy(p + len, &crc, 4);
272                 len += 4;
273             }
274         }
275 #endif
276         if (s->ctr & CTR_AUTO_RELEASE)
277             /* Race?  */
278             smc91c111_release_packet(s, packetnum);
279         else if (s->tx_fifo_done_len < NUM_PACKETS)
280             s->tx_fifo_done[s->tx_fifo_done_len++] = packetnum;
281         qemu_send_packet(qemu_get_queue(s->nic), p, len);
282     }
283     s->tx_fifo_len = 0;
284     smc91c111_update(s);
285 }
286 
287 /* Add a packet to the TX FIFO.  */
smc91c111_queue_tx(smc91c111_state * s,int packet)288 static void smc91c111_queue_tx(smc91c111_state *s, int packet)
289 {
290     if (s->tx_fifo_len == NUM_PACKETS)
291         return;
292     s->tx_fifo[s->tx_fifo_len++] = packet;
293     smc91c111_do_tx(s);
294 }
295 
smc91c111_reset(DeviceState * dev)296 static void smc91c111_reset(DeviceState *dev)
297 {
298     smc91c111_state *s = SMC91C111(dev);
299 
300     s->bank = 0;
301     s->tx_fifo_len = 0;
302     s->tx_fifo_done_len = 0;
303     s->rx_fifo_len = 0;
304     s->allocated = 0;
305     s->packet_num = 0;
306     s->tx_alloc = 0;
307     s->tcr = 0;
308     s->rcr = 0;
309     s->cr = 0xa0b1;
310     s->ctr = 0x1210;
311     s->ptr = 0;
312     s->ercv = 0x1f;
313     s->int_level = INT_TX_EMPTY;
314     s->int_mask = 0;
315     smc91c111_update(s);
316 }
317 
318 #define SET_LOW(name, val) s->name = (s->name & 0xff00) | val
319 #define SET_HIGH(name, val) s->name = (s->name & 0xff) | (val << 8)
320 
smc91c111_writeb(void * opaque,hwaddr offset,uint32_t value)321 static void smc91c111_writeb(void *opaque, hwaddr offset,
322                              uint32_t value)
323 {
324     smc91c111_state *s = (smc91c111_state *)opaque;
325 
326     offset = offset & 0xf;
327     if (offset == 14) {
328         s->bank = value;
329         return;
330     }
331     if (offset == 15)
332         return;
333     switch (s->bank) {
334     case 0:
335         switch (offset) {
336         case 0: /* TCR */
337             SET_LOW(tcr, value);
338             return;
339         case 1:
340             SET_HIGH(tcr, value);
341             return;
342         case 4: /* RCR */
343             SET_LOW(rcr, value);
344             return;
345         case 5:
346             SET_HIGH(rcr, value);
347             if (s->rcr & RCR_SOFT_RST) {
348                 smc91c111_reset(DEVICE(s));
349             }
350             smc91c111_flush_queued_packets(s);
351             return;
352         case 10: case 11: /* RPCR */
353             /* Ignored */
354             return;
355         case 12: case 13: /* Reserved */
356             return;
357         }
358         break;
359 
360     case 1:
361         switch (offset) {
362         case 0: /* CONFIG */
363             SET_LOW(cr, value);
364             return;
365         case 1:
366             SET_HIGH(cr,value);
367             return;
368         case 2: case 3: /* BASE */
369         case 4: case 5: case 6: case 7: case 8: case 9: /* IA */
370             /* Not implemented.  */
371             return;
372         case 10: /* General Purpose */
373             SET_LOW(gpr, value);
374             return;
375         case 11:
376             SET_HIGH(gpr, value);
377             return;
378         case 12: /* Control */
379             if (value & 1) {
380                 qemu_log_mask(LOG_UNIMP,
381                               "smc91c111: EEPROM store not implemented\n");
382             }
383             if (value & 2) {
384                 qemu_log_mask(LOG_UNIMP,
385                               "smc91c111: EEPROM reload not implemented\n");
386             }
387             value &= ~3;
388             SET_LOW(ctr, value);
389             return;
390         case 13:
391             SET_HIGH(ctr, value);
392             return;
393         }
394         break;
395 
396     case 2:
397         switch (offset) {
398         case 0: /* MMU Command */
399             switch (value >> 5) {
400             case 0: /* no-op */
401                 break;
402             case 1: /* Allocate for TX.  */
403                 s->tx_alloc = 0x80;
404                 s->int_level &= ~INT_ALLOC;
405                 smc91c111_update(s);
406                 smc91c111_tx_alloc(s);
407                 break;
408             case 2: /* Reset MMU.  */
409                 s->allocated = 0;
410                 s->tx_fifo_len = 0;
411                 s->tx_fifo_done_len = 0;
412                 s->rx_fifo_len = 0;
413                 s->tx_alloc = 0;
414                 break;
415             case 3: /* Remove from RX FIFO.  */
416                 smc91c111_pop_rx_fifo(s);
417                 break;
418             case 4: /* Remove from RX FIFO and release.  */
419                 if (s->rx_fifo_len > 0) {
420                     smc91c111_release_packet(s, s->rx_fifo[0]);
421                 }
422                 smc91c111_pop_rx_fifo(s);
423                 break;
424             case 5: /* Release.  */
425                 smc91c111_release_packet(s, s->packet_num);
426                 break;
427             case 6: /* Add to TX FIFO.  */
428                 smc91c111_queue_tx(s, s->packet_num);
429                 break;
430             case 7: /* Reset TX FIFO.  */
431                 s->tx_fifo_len = 0;
432                 s->tx_fifo_done_len = 0;
433                 break;
434             }
435             return;
436         case 1:
437             /* Ignore.  */
438             return;
439         case 2: /* Packet Number Register */
440             s->packet_num = value;
441             return;
442         case 3: case 4: case 5:
443             /* Should be readonly, but linux writes to them anyway. Ignore.  */
444             return;
445         case 6: /* Pointer */
446             SET_LOW(ptr, value);
447             return;
448         case 7:
449             SET_HIGH(ptr, value);
450             return;
451         case 8: case 9: case 10: case 11: /* Data */
452             {
453                 int p;
454                 int n;
455 
456                 if (s->ptr & 0x8000)
457                     n = s->rx_fifo[0];
458                 else
459                     n = s->packet_num;
460                 p = s->ptr & 0x07ff;
461                 if (s->ptr & 0x4000) {
462                     s->ptr = (s->ptr & 0xf800) | ((s->ptr + 1) & 0x7ff);
463                 } else {
464                     p += (offset & 3);
465                 }
466                 s->data[n][p] = value;
467             }
468             return;
469         case 12: /* Interrupt ACK.  */
470             s->int_level &= ~(value & 0xd6);
471             if (value & INT_TX)
472                 smc91c111_pop_tx_fifo_done(s);
473             smc91c111_update(s);
474             return;
475         case 13: /* Interrupt mask.  */
476             s->int_mask = value;
477             smc91c111_update(s);
478             return;
479         }
480         break;
481 
482     case 3:
483         switch (offset) {
484         case 0: case 1: case 2: case 3: case 4: case 5: case 6: case 7:
485             /* Multicast table.  */
486             /* Not implemented.  */
487             return;
488         case 8: case 9: /* Management Interface.  */
489             /* Not implemented.  */
490             return;
491         case 12: /* Early receive.  */
492             s->ercv = value & 0x1f;
493             return;
494         case 13:
495             /* Ignore.  */
496             return;
497         }
498         break;
499     }
500     qemu_log_mask(LOG_GUEST_ERROR, "smc91c111_write(bank:%d) Illegal register"
501                                    " 0x%" HWADDR_PRIx " = 0x%x\n",
502                   s->bank, offset, value);
503 }
504 
smc91c111_readb(void * opaque,hwaddr offset)505 static uint32_t smc91c111_readb(void *opaque, hwaddr offset)
506 {
507     smc91c111_state *s = (smc91c111_state *)opaque;
508 
509     offset = offset & 0xf;
510     if (offset == 14) {
511         return s->bank;
512     }
513     if (offset == 15)
514         return 0x33;
515     switch (s->bank) {
516     case 0:
517         switch (offset) {
518         case 0: /* TCR */
519             return s->tcr & 0xff;
520         case 1:
521             return s->tcr >> 8;
522         case 2: /* EPH Status */
523             return 0;
524         case 3:
525             return 0x40;
526         case 4: /* RCR */
527             return s->rcr & 0xff;
528         case 5:
529             return s->rcr >> 8;
530         case 6: /* Counter */
531         case 7:
532             /* Not implemented.  */
533             return 0;
534         case 8: /* Memory size.  */
535             return NUM_PACKETS;
536         case 9: /* Free memory available.  */
537             {
538                 int i;
539                 int n;
540                 n = 0;
541                 for (i = 0; i < NUM_PACKETS; i++) {
542                     if (s->allocated & (1 << i))
543                         n++;
544                 }
545                 return n;
546             }
547         case 10: case 11: /* RPCR */
548             /* Not implemented.  */
549             return 0;
550         case 12: case 13: /* Reserved */
551             return 0;
552         }
553         break;
554 
555     case 1:
556         switch (offset) {
557         case 0: /* CONFIG */
558             return s->cr & 0xff;
559         case 1:
560             return s->cr >> 8;
561         case 2: case 3: /* BASE */
562             /* Not implemented.  */
563             return 0;
564         case 4: case 5: case 6: case 7: case 8: case 9: /* IA */
565             return s->conf.macaddr.a[offset - 4];
566         case 10: /* General Purpose */
567             return s->gpr & 0xff;
568         case 11:
569             return s->gpr >> 8;
570         case 12: /* Control */
571             return s->ctr & 0xff;
572         case 13:
573             return s->ctr >> 8;
574         }
575         break;
576 
577     case 2:
578         switch (offset) {
579         case 0: case 1: /* MMUCR Busy bit.  */
580             return 0;
581         case 2: /* Packet Number.  */
582             return s->packet_num;
583         case 3: /* Allocation Result.  */
584             return s->tx_alloc;
585         case 4: /* TX FIFO */
586             if (s->tx_fifo_done_len == 0)
587                 return 0x80;
588             else
589                 return s->tx_fifo_done[0];
590         case 5: /* RX FIFO */
591             if (s->rx_fifo_len == 0)
592                 return 0x80;
593             else
594                 return s->rx_fifo[0];
595         case 6: /* Pointer */
596             return s->ptr & 0xff;
597         case 7:
598             return (s->ptr >> 8) & 0xf7;
599         case 8: case 9: case 10: case 11: /* Data */
600             {
601                 int p;
602                 int n;
603 
604                 if (s->ptr & 0x8000)
605                     n = s->rx_fifo[0];
606                 else
607                     n = s->packet_num;
608                 p = s->ptr & 0x07ff;
609                 if (s->ptr & 0x4000) {
610                     s->ptr = (s->ptr & 0xf800) | ((s->ptr + 1) & 0x07ff);
611                 } else {
612                     p += (offset & 3);
613                 }
614                 return s->data[n][p];
615             }
616         case 12: /* Interrupt status.  */
617             return s->int_level;
618         case 13: /* Interrupt mask.  */
619             return s->int_mask;
620         }
621         break;
622 
623     case 3:
624         switch (offset) {
625         case 0: case 1: case 2: case 3: case 4: case 5: case 6: case 7:
626             /* Multicast table.  */
627             /* Not implemented.  */
628             return 0;
629         case 8: /* Management Interface.  */
630             /* Not implemented.  */
631             return 0x30;
632         case 9:
633             return 0x33;
634         case 10: /* Revision.  */
635             return 0x91;
636         case 11:
637             return 0x33;
638         case 12:
639             return s->ercv;
640         case 13:
641             return 0;
642         }
643         break;
644     }
645     qemu_log_mask(LOG_GUEST_ERROR, "smc91c111_read(bank:%d) Illegal register"
646                                    " 0x%" HWADDR_PRIx "\n",
647                   s->bank, offset);
648     return 0;
649 }
650 
smc91c111_readfn(void * opaque,hwaddr addr,unsigned size)651 static uint64_t smc91c111_readfn(void *opaque, hwaddr addr, unsigned size)
652 {
653     int i;
654     uint32_t val = 0;
655 
656     for (i = 0; i < size; i++) {
657         val |= smc91c111_readb(opaque, addr + i) << (i * 8);
658     }
659     return val;
660 }
661 
smc91c111_writefn(void * opaque,hwaddr addr,uint64_t value,unsigned size)662 static void smc91c111_writefn(void *opaque, hwaddr addr,
663                                uint64_t value, unsigned size)
664 {
665     int i = 0;
666 
667     /* 32-bit writes to offset 0xc only actually write to the bank select
668      * register (offset 0xe), so skip the first two bytes we would write.
669      */
670     if (addr == 0xc && size == 4) {
671         i += 2;
672     }
673 
674     for (; i < size; i++) {
675         smc91c111_writeb(opaque, addr + i,
676                          extract32(value, i * 8, 8));
677     }
678 }
679 
smc91c111_can_receive_nc(NetClientState * nc)680 static bool smc91c111_can_receive_nc(NetClientState *nc)
681 {
682     smc91c111_state *s = qemu_get_nic_opaque(nc);
683 
684     return smc91c111_can_receive(s);
685 }
686 
smc91c111_receive(NetClientState * nc,const uint8_t * buf,size_t size)687 static ssize_t smc91c111_receive(NetClientState *nc, const uint8_t *buf, size_t size)
688 {
689     smc91c111_state *s = qemu_get_nic_opaque(nc);
690     int status;
691     int packetsize;
692     uint32_t crc;
693     int packetnum;
694     uint8_t *p;
695 
696     if ((s->rcr & RCR_RXEN) == 0 || (s->rcr & RCR_SOFT_RST))
697         return -1;
698     /* Short packets are padded with zeros.  Receiving a packet
699        < 64 bytes long is considered an error condition.  */
700     if (size < 64)
701         packetsize = 64;
702     else
703         packetsize = (size & ~1);
704     packetsize += 6;
705     crc = (s->rcr & RCR_STRIP_CRC) == 0;
706     if (crc)
707         packetsize += 4;
708     /* TODO: Flag overrun and receive errors.  */
709     if (packetsize > 2048)
710         return -1;
711     packetnum = smc91c111_allocate_packet(s);
712     if (packetnum == 0x80)
713         return -1;
714     s->rx_fifo[s->rx_fifo_len++] = packetnum;
715 
716     p = &s->data[packetnum][0];
717     /* ??? Multicast packets?  */
718     status = 0;
719     if (size > 1518)
720         status |= RS_TOOLONG;
721     if (size & 1)
722         status |= RS_ODDFRAME;
723     *(p++) = status & 0xff;
724     *(p++) = status >> 8;
725     *(p++) = packetsize & 0xff;
726     *(p++) = packetsize >> 8;
727     memcpy(p, buf, size & ~1);
728     p += (size & ~1);
729     /* Pad short packets.  */
730     if (size < 64) {
731         int pad;
732 
733         if (size & 1)
734             *(p++) = buf[size - 1];
735         pad = 64 - size;
736         memset(p, 0, pad);
737         p += pad;
738         size = 64;
739     }
740     /* It's not clear if the CRC should go before or after the last byte in
741        odd sized packets.  Linux disables the CRC, so that's no help.
742        The pictures in the documentation show the CRC aligned on a 16-bit
743        boundary before the last odd byte, so that's what we do.  */
744     if (crc) {
745         crc = crc32(~0, buf, size);
746         *(p++) = crc & 0xff; crc >>= 8;
747         *(p++) = crc & 0xff; crc >>= 8;
748         *(p++) = crc & 0xff; crc >>= 8;
749         *(p++) = crc & 0xff;
750     }
751     if (size & 1) {
752         *(p++) = buf[size - 1];
753         *p = 0x60;
754     } else {
755         *(p++) = 0;
756         *p = 0x40;
757     }
758     /* TODO: Raise early RX interrupt?  */
759     s->int_level |= INT_RCV;
760     smc91c111_update(s);
761 
762     return size;
763 }
764 
765 static const MemoryRegionOps smc91c111_mem_ops = {
766     /* The special case for 32 bit writes to 0xc means we can't just
767      * set .impl.min/max_access_size to 1, unfortunately
768      */
769     .read = smc91c111_readfn,
770     .write = smc91c111_writefn,
771     .valid.min_access_size = 1,
772     .valid.max_access_size = 4,
773     .endianness = DEVICE_NATIVE_ENDIAN,
774 };
775 
776 static NetClientInfo net_smc91c111_info = {
777     .type = NET_CLIENT_DRIVER_NIC,
778     .size = sizeof(NICState),
779     .can_receive = smc91c111_can_receive_nc,
780     .receive = smc91c111_receive,
781 };
782 
smc91c111_realize(DeviceState * dev,Error ** errp)783 static void smc91c111_realize(DeviceState *dev, Error **errp)
784 {
785     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
786     smc91c111_state *s = SMC91C111(dev);
787 
788     memory_region_init_io(&s->mmio, OBJECT(s), &smc91c111_mem_ops, s,
789                           "smc91c111-mmio", 16);
790     sysbus_init_mmio(sbd, &s->mmio);
791     sysbus_init_irq(sbd, &s->irq);
792     qemu_macaddr_default_if_unset(&s->conf.macaddr);
793     s->nic = qemu_new_nic(&net_smc91c111_info, &s->conf,
794                           object_get_typename(OBJECT(dev)), dev->id,
795                           &dev->mem_reentrancy_guard, s);
796     qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
797     /* ??? Save/restore.  */
798 }
799 
800 static Property smc91c111_properties[] = {
801     DEFINE_NIC_PROPERTIES(smc91c111_state, conf),
802     DEFINE_PROP_END_OF_LIST(),
803 };
804 
smc91c111_class_init(ObjectClass * klass,void * data)805 static void smc91c111_class_init(ObjectClass *klass, void *data)
806 {
807     DeviceClass *dc = DEVICE_CLASS(klass);
808 
809     dc->realize = smc91c111_realize;
810     device_class_set_legacy_reset(dc, smc91c111_reset);
811     dc->vmsd = &vmstate_smc91c111;
812     device_class_set_props(dc, smc91c111_properties);
813 }
814 
815 static const TypeInfo smc91c111_info = {
816     .name          = TYPE_SMC91C111,
817     .parent        = TYPE_SYS_BUS_DEVICE,
818     .instance_size = sizeof(smc91c111_state),
819     .class_init    = smc91c111_class_init,
820 };
821 
smc91c111_register_types(void)822 static void smc91c111_register_types(void)
823 {
824     type_register_static(&smc91c111_info);
825 }
826 
827 /* Legacy helper function.  Should go away when machine config files are
828    implemented.  */
smc91c111_init(uint32_t base,qemu_irq irq)829 void smc91c111_init(uint32_t base, qemu_irq irq)
830 {
831     DeviceState *dev;
832     SysBusDevice *s;
833 
834     dev = qdev_new(TYPE_SMC91C111);
835     qemu_configure_nic_device(dev, true, NULL);
836     s = SYS_BUS_DEVICE(dev);
837     sysbus_realize_and_unref(s, &error_fatal);
838     sysbus_mmio_map(s, 0, base);
839     sysbus_connect_irq(s, 0, irq);
840 }
841 
842 type_init(smc91c111_register_types)
843