1 /* 2 * QEMU NS SONIC DP8393x netcard 3 * 4 * Copyright (c) 2008-2009 Herve Poussineau 5 * 6 * This program is free software; you can redistribute it and/or 7 * modify it under the terms of the GNU General Public License as 8 * published by the Free Software Foundation; either version 2 of 9 * the License, or (at your option) any later version. 10 * 11 * This program is distributed in the hope that it will be useful, 12 * but WITHOUT ANY WARRANTY; without even the implied warranty of 13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the 14 * GNU General Public License for more details. 15 * 16 * You should have received a copy of the GNU General Public License along 17 * with this program; if not, see <http://www.gnu.org/licenses/>. 18 */ 19 20 #include "qemu/osdep.h" 21 #include "hw/irq.h" 22 #include "hw/sysbus.h" 23 #include "net/net.h" 24 #include "qapi/error.h" 25 #include "qemu/module.h" 26 #include "qemu/timer.h" 27 #include <zlib.h> 28 29 //#define DEBUG_SONIC 30 31 #define SONIC_PROM_SIZE 0x1000 32 33 #ifdef DEBUG_SONIC 34 #define DPRINTF(fmt, ...) \ 35 do { printf("sonic: " fmt , ## __VA_ARGS__); } while (0) 36 static const char* reg_names[] = { 37 "CR", "DCR", "RCR", "TCR", "IMR", "ISR", "UTDA", "CTDA", 38 "TPS", "TFC", "TSA0", "TSA1", "TFS", "URDA", "CRDA", "CRBA0", 39 "CRBA1", "RBWC0", "RBWC1", "EOBC", "URRA", "RSA", "REA", "RRP", 40 "RWP", "TRBA0", "TRBA1", "0x1b", "0x1c", "0x1d", "0x1e", "LLFA", 41 "TTDA", "CEP", "CAP2", "CAP1", "CAP0", "CE", "CDP", "CDC", 42 "SR", "WT0", "WT1", "RSC", "CRCT", "FAET", "MPT", "MDT", 43 "0x30", "0x31", "0x32", "0x33", "0x34", "0x35", "0x36", "0x37", 44 "0x38", "0x39", "0x3a", "0x3b", "0x3c", "0x3d", "0x3e", "DCR2" }; 45 #else 46 #define DPRINTF(fmt, ...) do {} while (0) 47 #endif 48 49 #define SONIC_ERROR(fmt, ...) \ 50 do { printf("sonic ERROR: %s: " fmt, __func__ , ## __VA_ARGS__); } while (0) 51 52 #define SONIC_CR 0x00 53 #define SONIC_DCR 0x01 54 #define SONIC_RCR 0x02 55 #define SONIC_TCR 0x03 56 #define SONIC_IMR 0x04 57 #define SONIC_ISR 0x05 58 #define SONIC_UTDA 0x06 59 #define SONIC_CTDA 0x07 60 #define SONIC_TPS 0x08 61 #define SONIC_TFC 0x09 62 #define SONIC_TSA0 0x0a 63 #define SONIC_TSA1 0x0b 64 #define SONIC_TFS 0x0c 65 #define SONIC_URDA 0x0d 66 #define SONIC_CRDA 0x0e 67 #define SONIC_CRBA0 0x0f 68 #define SONIC_CRBA1 0x10 69 #define SONIC_RBWC0 0x11 70 #define SONIC_RBWC1 0x12 71 #define SONIC_EOBC 0x13 72 #define SONIC_URRA 0x14 73 #define SONIC_RSA 0x15 74 #define SONIC_REA 0x16 75 #define SONIC_RRP 0x17 76 #define SONIC_RWP 0x18 77 #define SONIC_TRBA0 0x19 78 #define SONIC_TRBA1 0x1a 79 #define SONIC_LLFA 0x1f 80 #define SONIC_TTDA 0x20 81 #define SONIC_CEP 0x21 82 #define SONIC_CAP2 0x22 83 #define SONIC_CAP1 0x23 84 #define SONIC_CAP0 0x24 85 #define SONIC_CE 0x25 86 #define SONIC_CDP 0x26 87 #define SONIC_CDC 0x27 88 #define SONIC_SR 0x28 89 #define SONIC_WT0 0x29 90 #define SONIC_WT1 0x2a 91 #define SONIC_RSC 0x2b 92 #define SONIC_CRCT 0x2c 93 #define SONIC_FAET 0x2d 94 #define SONIC_MPT 0x2e 95 #define SONIC_MDT 0x2f 96 #define SONIC_DCR2 0x3f 97 98 #define SONIC_CR_HTX 0x0001 99 #define SONIC_CR_TXP 0x0002 100 #define SONIC_CR_RXDIS 0x0004 101 #define SONIC_CR_RXEN 0x0008 102 #define SONIC_CR_STP 0x0010 103 #define SONIC_CR_ST 0x0020 104 #define SONIC_CR_RST 0x0080 105 #define SONIC_CR_RRRA 0x0100 106 #define SONIC_CR_LCAM 0x0200 107 #define SONIC_CR_MASK 0x03bf 108 109 #define SONIC_DCR_DW 0x0020 110 #define SONIC_DCR_LBR 0x2000 111 #define SONIC_DCR_EXBUS 0x8000 112 113 #define SONIC_RCR_PRX 0x0001 114 #define SONIC_RCR_LBK 0x0002 115 #define SONIC_RCR_FAER 0x0004 116 #define SONIC_RCR_CRCR 0x0008 117 #define SONIC_RCR_CRS 0x0020 118 #define SONIC_RCR_LPKT 0x0040 119 #define SONIC_RCR_BC 0x0080 120 #define SONIC_RCR_MC 0x0100 121 #define SONIC_RCR_LB0 0x0200 122 #define SONIC_RCR_LB1 0x0400 123 #define SONIC_RCR_AMC 0x0800 124 #define SONIC_RCR_PRO 0x1000 125 #define SONIC_RCR_BRD 0x2000 126 #define SONIC_RCR_RNT 0x4000 127 128 #define SONIC_TCR_PTX 0x0001 129 #define SONIC_TCR_BCM 0x0002 130 #define SONIC_TCR_FU 0x0004 131 #define SONIC_TCR_EXC 0x0040 132 #define SONIC_TCR_CRSL 0x0080 133 #define SONIC_TCR_NCRS 0x0100 134 #define SONIC_TCR_EXD 0x0400 135 #define SONIC_TCR_CRCI 0x2000 136 #define SONIC_TCR_PINT 0x8000 137 138 #define SONIC_ISR_RBE 0x0020 139 #define SONIC_ISR_RDE 0x0040 140 #define SONIC_ISR_TC 0x0080 141 #define SONIC_ISR_TXDN 0x0200 142 #define SONIC_ISR_PKTRX 0x0400 143 #define SONIC_ISR_PINT 0x0800 144 #define SONIC_ISR_LCD 0x1000 145 146 #define TYPE_DP8393X "dp8393x" 147 #define DP8393X(obj) OBJECT_CHECK(dp8393xState, (obj), TYPE_DP8393X) 148 149 typedef struct dp8393xState { 150 SysBusDevice parent_obj; 151 152 /* Hardware */ 153 uint8_t it_shift; 154 qemu_irq irq; 155 #ifdef DEBUG_SONIC 156 int irq_level; 157 #endif 158 QEMUTimer *watchdog; 159 int64_t wt_last_update; 160 NICConf conf; 161 NICState *nic; 162 MemoryRegion mmio; 163 MemoryRegion prom; 164 165 /* Registers */ 166 uint8_t cam[16][6]; 167 uint16_t regs[0x40]; 168 169 /* Temporaries */ 170 uint8_t tx_buffer[0x10000]; 171 int loopback_packet; 172 173 /* Memory access */ 174 void *dma_mr; 175 AddressSpace as; 176 } dp8393xState; 177 178 /* Accessor functions for values which are formed by 179 * concatenating two 16 bit device registers. By putting these 180 * in their own functions with a uint32_t return type we avoid the 181 * pitfall of implicit sign extension where ((x << 16) | y) is a 182 * signed 32 bit integer that might get sign-extended to a 64 bit integer. 183 */ 184 static uint32_t dp8393x_cdp(dp8393xState *s) 185 { 186 return (s->regs[SONIC_URRA] << 16) | s->regs[SONIC_CDP]; 187 } 188 189 static uint32_t dp8393x_crba(dp8393xState *s) 190 { 191 return (s->regs[SONIC_CRBA1] << 16) | s->regs[SONIC_CRBA0]; 192 } 193 194 static uint32_t dp8393x_crda(dp8393xState *s) 195 { 196 return (s->regs[SONIC_URDA] << 16) | s->regs[SONIC_CRDA]; 197 } 198 199 static uint32_t dp8393x_rbwc(dp8393xState *s) 200 { 201 return (s->regs[SONIC_RBWC1] << 16) | s->regs[SONIC_RBWC0]; 202 } 203 204 static uint32_t dp8393x_rrp(dp8393xState *s) 205 { 206 return (s->regs[SONIC_URRA] << 16) | s->regs[SONIC_RRP]; 207 } 208 209 static uint32_t dp8393x_tsa(dp8393xState *s) 210 { 211 return (s->regs[SONIC_TSA1] << 16) | s->regs[SONIC_TSA0]; 212 } 213 214 static uint32_t dp8393x_ttda(dp8393xState *s) 215 { 216 return (s->regs[SONIC_UTDA] << 16) | s->regs[SONIC_TTDA]; 217 } 218 219 static uint32_t dp8393x_wt(dp8393xState *s) 220 { 221 return s->regs[SONIC_WT1] << 16 | s->regs[SONIC_WT0]; 222 } 223 224 static void dp8393x_update_irq(dp8393xState *s) 225 { 226 int level = (s->regs[SONIC_IMR] & s->regs[SONIC_ISR]) ? 1 : 0; 227 228 #ifdef DEBUG_SONIC 229 if (level != s->irq_level) { 230 s->irq_level = level; 231 if (level) { 232 DPRINTF("raise irq, isr is 0x%04x\n", s->regs[SONIC_ISR]); 233 } else { 234 DPRINTF("lower irq\n"); 235 } 236 } 237 #endif 238 239 qemu_set_irq(s->irq, level); 240 } 241 242 static void dp8393x_do_load_cam(dp8393xState *s) 243 { 244 uint16_t data[8]; 245 int width, size; 246 uint16_t index = 0; 247 248 width = (s->regs[SONIC_DCR] & SONIC_DCR_DW) ? 2 : 1; 249 size = sizeof(uint16_t) * 4 * width; 250 251 while (s->regs[SONIC_CDC] & 0x1f) { 252 /* Fill current entry */ 253 address_space_rw(&s->as, dp8393x_cdp(s), 254 MEMTXATTRS_UNSPECIFIED, (uint8_t *)data, size, 0); 255 s->cam[index][0] = data[1 * width] & 0xff; 256 s->cam[index][1] = data[1 * width] >> 8; 257 s->cam[index][2] = data[2 * width] & 0xff; 258 s->cam[index][3] = data[2 * width] >> 8; 259 s->cam[index][4] = data[3 * width] & 0xff; 260 s->cam[index][5] = data[3 * width] >> 8; 261 DPRINTF("load cam[%d] with %02x%02x%02x%02x%02x%02x\n", index, 262 s->cam[index][0], s->cam[index][1], s->cam[index][2], 263 s->cam[index][3], s->cam[index][4], s->cam[index][5]); 264 /* Move to next entry */ 265 s->regs[SONIC_CDC]--; 266 s->regs[SONIC_CDP] += size; 267 index++; 268 } 269 270 /* Read CAM enable */ 271 address_space_rw(&s->as, dp8393x_cdp(s), 272 MEMTXATTRS_UNSPECIFIED, (uint8_t *)data, size, 0); 273 s->regs[SONIC_CE] = data[0 * width]; 274 DPRINTF("load cam done. cam enable mask 0x%04x\n", s->regs[SONIC_CE]); 275 276 /* Done */ 277 s->regs[SONIC_CR] &= ~SONIC_CR_LCAM; 278 s->regs[SONIC_ISR] |= SONIC_ISR_LCD; 279 dp8393x_update_irq(s); 280 } 281 282 static void dp8393x_do_read_rra(dp8393xState *s) 283 { 284 uint16_t data[8]; 285 int width, size; 286 287 /* Read memory */ 288 width = (s->regs[SONIC_DCR] & SONIC_DCR_DW) ? 2 : 1; 289 size = sizeof(uint16_t) * 4 * width; 290 address_space_rw(&s->as, dp8393x_rrp(s), 291 MEMTXATTRS_UNSPECIFIED, (uint8_t *)data, size, 0); 292 293 /* Update SONIC registers */ 294 s->regs[SONIC_CRBA0] = data[0 * width]; 295 s->regs[SONIC_CRBA1] = data[1 * width]; 296 s->regs[SONIC_RBWC0] = data[2 * width]; 297 s->regs[SONIC_RBWC1] = data[3 * width]; 298 DPRINTF("CRBA0/1: 0x%04x/0x%04x, RBWC0/1: 0x%04x/0x%04x\n", 299 s->regs[SONIC_CRBA0], s->regs[SONIC_CRBA1], 300 s->regs[SONIC_RBWC0], s->regs[SONIC_RBWC1]); 301 302 /* Go to next entry */ 303 s->regs[SONIC_RRP] += size; 304 305 /* Handle wrap */ 306 if (s->regs[SONIC_RRP] == s->regs[SONIC_REA]) { 307 s->regs[SONIC_RRP] = s->regs[SONIC_RSA]; 308 } 309 310 /* Check resource exhaustion */ 311 if (s->regs[SONIC_RRP] == s->regs[SONIC_RWP]) 312 { 313 s->regs[SONIC_ISR] |= SONIC_ISR_RBE; 314 dp8393x_update_irq(s); 315 } 316 317 /* Done */ 318 s->regs[SONIC_CR] &= ~SONIC_CR_RRRA; 319 } 320 321 static void dp8393x_do_software_reset(dp8393xState *s) 322 { 323 timer_del(s->watchdog); 324 325 s->regs[SONIC_CR] &= ~(SONIC_CR_LCAM | SONIC_CR_RRRA | SONIC_CR_TXP | SONIC_CR_HTX); 326 s->regs[SONIC_CR] |= SONIC_CR_RST | SONIC_CR_RXDIS; 327 } 328 329 static void dp8393x_set_next_tick(dp8393xState *s) 330 { 331 uint32_t ticks; 332 int64_t delay; 333 334 if (s->regs[SONIC_CR] & SONIC_CR_STP) { 335 timer_del(s->watchdog); 336 return; 337 } 338 339 ticks = dp8393x_wt(s); 340 s->wt_last_update = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL); 341 delay = NANOSECONDS_PER_SECOND * ticks / 5000000; 342 timer_mod(s->watchdog, s->wt_last_update + delay); 343 } 344 345 static void dp8393x_update_wt_regs(dp8393xState *s) 346 { 347 int64_t elapsed; 348 uint32_t val; 349 350 if (s->regs[SONIC_CR] & SONIC_CR_STP) { 351 timer_del(s->watchdog); 352 return; 353 } 354 355 elapsed = s->wt_last_update - qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL); 356 val = dp8393x_wt(s); 357 val -= elapsed / 5000000; 358 s->regs[SONIC_WT1] = (val >> 16) & 0xffff; 359 s->regs[SONIC_WT0] = (val >> 0) & 0xffff; 360 dp8393x_set_next_tick(s); 361 362 } 363 364 static void dp8393x_do_start_timer(dp8393xState *s) 365 { 366 s->regs[SONIC_CR] &= ~SONIC_CR_STP; 367 dp8393x_set_next_tick(s); 368 } 369 370 static void dp8393x_do_stop_timer(dp8393xState *s) 371 { 372 s->regs[SONIC_CR] &= ~SONIC_CR_ST; 373 dp8393x_update_wt_regs(s); 374 } 375 376 static int dp8393x_can_receive(NetClientState *nc); 377 378 static void dp8393x_do_receiver_enable(dp8393xState *s) 379 { 380 s->regs[SONIC_CR] &= ~SONIC_CR_RXDIS; 381 if (dp8393x_can_receive(s->nic->ncs)) { 382 qemu_flush_queued_packets(qemu_get_queue(s->nic)); 383 } 384 } 385 386 static void dp8393x_do_receiver_disable(dp8393xState *s) 387 { 388 s->regs[SONIC_CR] &= ~SONIC_CR_RXEN; 389 } 390 391 static void dp8393x_do_transmit_packets(dp8393xState *s) 392 { 393 NetClientState *nc = qemu_get_queue(s->nic); 394 uint16_t data[12]; 395 int width, size; 396 int tx_len, len; 397 uint16_t i; 398 399 width = (s->regs[SONIC_DCR] & SONIC_DCR_DW) ? 2 : 1; 400 401 while (1) { 402 /* Read memory */ 403 size = sizeof(uint16_t) * 6 * width; 404 s->regs[SONIC_TTDA] = s->regs[SONIC_CTDA]; 405 DPRINTF("Transmit packet at %08x\n", dp8393x_ttda(s)); 406 address_space_rw(&s->as, 407 dp8393x_ttda(s) + sizeof(uint16_t) * width, 408 MEMTXATTRS_UNSPECIFIED, (uint8_t *)data, size, 0); 409 tx_len = 0; 410 411 /* Update registers */ 412 s->regs[SONIC_TCR] = data[0 * width] & 0xf000; 413 s->regs[SONIC_TPS] = data[1 * width]; 414 s->regs[SONIC_TFC] = data[2 * width]; 415 s->regs[SONIC_TSA0] = data[3 * width]; 416 s->regs[SONIC_TSA1] = data[4 * width]; 417 s->regs[SONIC_TFS] = data[5 * width]; 418 419 /* Handle programmable interrupt */ 420 if (s->regs[SONIC_TCR] & SONIC_TCR_PINT) { 421 s->regs[SONIC_ISR] |= SONIC_ISR_PINT; 422 } else { 423 s->regs[SONIC_ISR] &= ~SONIC_ISR_PINT; 424 } 425 426 for (i = 0; i < s->regs[SONIC_TFC]; ) { 427 /* Append fragment */ 428 len = s->regs[SONIC_TFS]; 429 if (tx_len + len > sizeof(s->tx_buffer)) { 430 len = sizeof(s->tx_buffer) - tx_len; 431 } 432 address_space_rw(&s->as, dp8393x_tsa(s), 433 MEMTXATTRS_UNSPECIFIED, &s->tx_buffer[tx_len], len, 0); 434 tx_len += len; 435 436 i++; 437 if (i != s->regs[SONIC_TFC]) { 438 /* Read next fragment details */ 439 size = sizeof(uint16_t) * 3 * width; 440 address_space_rw(&s->as, 441 dp8393x_ttda(s) + sizeof(uint16_t) * (4 + 3 * i) * width, 442 MEMTXATTRS_UNSPECIFIED, (uint8_t *)data, size, 0); 443 s->regs[SONIC_TSA0] = data[0 * width]; 444 s->regs[SONIC_TSA1] = data[1 * width]; 445 s->regs[SONIC_TFS] = data[2 * width]; 446 } 447 } 448 449 /* Handle Ethernet checksum */ 450 if (!(s->regs[SONIC_TCR] & SONIC_TCR_CRCI)) { 451 /* Don't append FCS there, to look like slirp packets 452 * which don't have one */ 453 } else { 454 /* Remove existing FCS */ 455 tx_len -= 4; 456 } 457 458 if (s->regs[SONIC_RCR] & (SONIC_RCR_LB1 | SONIC_RCR_LB0)) { 459 /* Loopback */ 460 s->regs[SONIC_TCR] |= SONIC_TCR_CRSL; 461 if (nc->info->can_receive(nc)) { 462 s->loopback_packet = 1; 463 nc->info->receive(nc, s->tx_buffer, tx_len); 464 } 465 } else { 466 /* Transmit packet */ 467 qemu_send_packet(nc, s->tx_buffer, tx_len); 468 } 469 s->regs[SONIC_TCR] |= SONIC_TCR_PTX; 470 471 /* Write status */ 472 data[0 * width] = s->regs[SONIC_TCR] & 0x0fff; /* status */ 473 size = sizeof(uint16_t) * width; 474 address_space_rw(&s->as, 475 dp8393x_ttda(s), 476 MEMTXATTRS_UNSPECIFIED, (uint8_t *)data, size, 1); 477 478 if (!(s->regs[SONIC_CR] & SONIC_CR_HTX)) { 479 /* Read footer of packet */ 480 size = sizeof(uint16_t) * width; 481 address_space_rw(&s->as, 482 dp8393x_ttda(s) + 483 sizeof(uint16_t) * 484 (4 + 3 * s->regs[SONIC_TFC]) * width, 485 MEMTXATTRS_UNSPECIFIED, (uint8_t *)data, size, 0); 486 s->regs[SONIC_CTDA] = data[0 * width] & ~0x1; 487 if (data[0 * width] & 0x1) { 488 /* EOL detected */ 489 break; 490 } 491 } 492 } 493 494 /* Done */ 495 s->regs[SONIC_CR] &= ~SONIC_CR_TXP; 496 s->regs[SONIC_ISR] |= SONIC_ISR_TXDN; 497 dp8393x_update_irq(s); 498 } 499 500 static void dp8393x_do_halt_transmission(dp8393xState *s) 501 { 502 /* Nothing to do */ 503 } 504 505 static void dp8393x_do_command(dp8393xState *s, uint16_t command) 506 { 507 if ((s->regs[SONIC_CR] & SONIC_CR_RST) && !(command & SONIC_CR_RST)) { 508 s->regs[SONIC_CR] &= ~SONIC_CR_RST; 509 return; 510 } 511 512 s->regs[SONIC_CR] |= (command & SONIC_CR_MASK); 513 514 if (command & SONIC_CR_HTX) 515 dp8393x_do_halt_transmission(s); 516 if (command & SONIC_CR_TXP) 517 dp8393x_do_transmit_packets(s); 518 if (command & SONIC_CR_RXDIS) 519 dp8393x_do_receiver_disable(s); 520 if (command & SONIC_CR_RXEN) 521 dp8393x_do_receiver_enable(s); 522 if (command & SONIC_CR_STP) 523 dp8393x_do_stop_timer(s); 524 if (command & SONIC_CR_ST) 525 dp8393x_do_start_timer(s); 526 if (command & SONIC_CR_RST) 527 dp8393x_do_software_reset(s); 528 if (command & SONIC_CR_RRRA) 529 dp8393x_do_read_rra(s); 530 if (command & SONIC_CR_LCAM) 531 dp8393x_do_load_cam(s); 532 } 533 534 static uint64_t dp8393x_read(void *opaque, hwaddr addr, unsigned int size) 535 { 536 dp8393xState *s = opaque; 537 int reg = addr >> s->it_shift; 538 uint16_t val = 0; 539 540 switch (reg) { 541 /* Update data before reading it */ 542 case SONIC_WT0: 543 case SONIC_WT1: 544 dp8393x_update_wt_regs(s); 545 val = s->regs[reg]; 546 break; 547 /* Accept read to some registers only when in reset mode */ 548 case SONIC_CAP2: 549 case SONIC_CAP1: 550 case SONIC_CAP0: 551 if (s->regs[SONIC_CR] & SONIC_CR_RST) { 552 val = s->cam[s->regs[SONIC_CEP] & 0xf][2* (SONIC_CAP0 - reg) + 1] << 8; 553 val |= s->cam[s->regs[SONIC_CEP] & 0xf][2* (SONIC_CAP0 - reg)]; 554 } 555 break; 556 /* All other registers have no special contrainst */ 557 default: 558 val = s->regs[reg]; 559 } 560 561 DPRINTF("read 0x%04x from reg %s\n", val, reg_names[reg]); 562 563 return val; 564 } 565 566 static void dp8393x_write(void *opaque, hwaddr addr, uint64_t data, 567 unsigned int size) 568 { 569 dp8393xState *s = opaque; 570 int reg = addr >> s->it_shift; 571 572 DPRINTF("write 0x%04x to reg %s\n", (uint16_t)data, reg_names[reg]); 573 574 switch (reg) { 575 /* Command register */ 576 case SONIC_CR: 577 dp8393x_do_command(s, data); 578 break; 579 /* Prevent write to read-only registers */ 580 case SONIC_CAP2: 581 case SONIC_CAP1: 582 case SONIC_CAP0: 583 case SONIC_SR: 584 case SONIC_MDT: 585 DPRINTF("writing to reg %d invalid\n", reg); 586 break; 587 /* Accept write to some registers only when in reset mode */ 588 case SONIC_DCR: 589 if (s->regs[SONIC_CR] & SONIC_CR_RST) { 590 s->regs[reg] = data & 0xbfff; 591 } else { 592 DPRINTF("writing to DCR invalid\n"); 593 } 594 break; 595 case SONIC_DCR2: 596 if (s->regs[SONIC_CR] & SONIC_CR_RST) { 597 s->regs[reg] = data & 0xf017; 598 } else { 599 DPRINTF("writing to DCR2 invalid\n"); 600 } 601 break; 602 /* 12 lower bytes are Read Only */ 603 case SONIC_TCR: 604 s->regs[reg] = data & 0xf000; 605 break; 606 /* 9 lower bytes are Read Only */ 607 case SONIC_RCR: 608 s->regs[reg] = data & 0xffe0; 609 break; 610 /* Ignore most significant bit */ 611 case SONIC_IMR: 612 s->regs[reg] = data & 0x7fff; 613 dp8393x_update_irq(s); 614 break; 615 /* Clear bits by writing 1 to them */ 616 case SONIC_ISR: 617 data &= s->regs[reg]; 618 s->regs[reg] &= ~data; 619 if (data & SONIC_ISR_RBE) { 620 dp8393x_do_read_rra(s); 621 } 622 dp8393x_update_irq(s); 623 if (dp8393x_can_receive(s->nic->ncs)) { 624 qemu_flush_queued_packets(qemu_get_queue(s->nic)); 625 } 626 break; 627 /* Ignore least significant bit */ 628 case SONIC_RSA: 629 case SONIC_REA: 630 case SONIC_RRP: 631 case SONIC_RWP: 632 s->regs[reg] = data & 0xfffe; 633 break; 634 /* Invert written value for some registers */ 635 case SONIC_CRCT: 636 case SONIC_FAET: 637 case SONIC_MPT: 638 s->regs[reg] = data ^ 0xffff; 639 break; 640 /* All other registers have no special contrainst */ 641 default: 642 s->regs[reg] = data; 643 } 644 645 if (reg == SONIC_WT0 || reg == SONIC_WT1) { 646 dp8393x_set_next_tick(s); 647 } 648 } 649 650 static const MemoryRegionOps dp8393x_ops = { 651 .read = dp8393x_read, 652 .write = dp8393x_write, 653 .impl.min_access_size = 2, 654 .impl.max_access_size = 2, 655 .endianness = DEVICE_NATIVE_ENDIAN, 656 }; 657 658 static void dp8393x_watchdog(void *opaque) 659 { 660 dp8393xState *s = opaque; 661 662 if (s->regs[SONIC_CR] & SONIC_CR_STP) { 663 return; 664 } 665 666 s->regs[SONIC_WT1] = 0xffff; 667 s->regs[SONIC_WT0] = 0xffff; 668 dp8393x_set_next_tick(s); 669 670 /* Signal underflow */ 671 s->regs[SONIC_ISR] |= SONIC_ISR_TC; 672 dp8393x_update_irq(s); 673 } 674 675 static int dp8393x_can_receive(NetClientState *nc) 676 { 677 dp8393xState *s = qemu_get_nic_opaque(nc); 678 679 if (!(s->regs[SONIC_CR] & SONIC_CR_RXEN)) 680 return 0; 681 if (s->regs[SONIC_ISR] & SONIC_ISR_RBE) 682 return 0; 683 return 1; 684 } 685 686 static int dp8393x_receive_filter(dp8393xState *s, const uint8_t * buf, 687 int size) 688 { 689 static const uint8_t bcast[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff}; 690 int i; 691 692 /* Check promiscuous mode */ 693 if ((s->regs[SONIC_RCR] & SONIC_RCR_PRO) && (buf[0] & 1) == 0) { 694 return 0; 695 } 696 697 /* Check multicast packets */ 698 if ((s->regs[SONIC_RCR] & SONIC_RCR_AMC) && (buf[0] & 1) == 1) { 699 return SONIC_RCR_MC; 700 } 701 702 /* Check broadcast */ 703 if ((s->regs[SONIC_RCR] & SONIC_RCR_BRD) && !memcmp(buf, bcast, sizeof(bcast))) { 704 return SONIC_RCR_BC; 705 } 706 707 /* Check CAM */ 708 for (i = 0; i < 16; i++) { 709 if (s->regs[SONIC_CE] & (1 << i)) { 710 /* Entry enabled */ 711 if (!memcmp(buf, s->cam[i], sizeof(s->cam[i]))) { 712 return 0; 713 } 714 } 715 } 716 717 return -1; 718 } 719 720 static ssize_t dp8393x_receive(NetClientState *nc, const uint8_t * buf, 721 size_t size) 722 { 723 dp8393xState *s = qemu_get_nic_opaque(nc); 724 uint16_t data[10]; 725 int packet_type; 726 uint32_t available, address; 727 int width, rx_len = size; 728 uint32_t checksum; 729 730 width = (s->regs[SONIC_DCR] & SONIC_DCR_DW) ? 2 : 1; 731 732 s->regs[SONIC_RCR] &= ~(SONIC_RCR_PRX | SONIC_RCR_LBK | SONIC_RCR_FAER | 733 SONIC_RCR_CRCR | SONIC_RCR_LPKT | SONIC_RCR_BC | SONIC_RCR_MC); 734 735 packet_type = dp8393x_receive_filter(s, buf, size); 736 if (packet_type < 0) { 737 DPRINTF("packet not for netcard\n"); 738 return -1; 739 } 740 741 /* XXX: Check byte ordering */ 742 743 /* Check for EOL */ 744 if (s->regs[SONIC_LLFA] & 0x1) { 745 /* Are we still in resource exhaustion? */ 746 size = sizeof(uint16_t) * 1 * width; 747 address = dp8393x_crda(s) + sizeof(uint16_t) * 5 * width; 748 address_space_rw(&s->as, address, MEMTXATTRS_UNSPECIFIED, 749 (uint8_t *)data, size, 0); 750 if (data[0 * width] & 0x1) { 751 /* Still EOL ; stop reception */ 752 return -1; 753 } else { 754 s->regs[SONIC_CRDA] = s->regs[SONIC_LLFA]; 755 } 756 } 757 758 /* Save current position */ 759 s->regs[SONIC_TRBA1] = s->regs[SONIC_CRBA1]; 760 s->regs[SONIC_TRBA0] = s->regs[SONIC_CRBA0]; 761 762 /* Calculate the ethernet checksum */ 763 checksum = cpu_to_le32(crc32(0, buf, rx_len)); 764 765 /* Put packet into RBA */ 766 DPRINTF("Receive packet at %08x\n", dp8393x_crba(s)); 767 address = dp8393x_crba(s); 768 address_space_rw(&s->as, address, 769 MEMTXATTRS_UNSPECIFIED, (uint8_t *)buf, rx_len, 1); 770 address += rx_len; 771 address_space_rw(&s->as, address, 772 MEMTXATTRS_UNSPECIFIED, (uint8_t *)&checksum, 4, 1); 773 rx_len += 4; 774 s->regs[SONIC_CRBA1] = address >> 16; 775 s->regs[SONIC_CRBA0] = address & 0xffff; 776 available = dp8393x_rbwc(s); 777 available -= rx_len / 2; 778 s->regs[SONIC_RBWC1] = available >> 16; 779 s->regs[SONIC_RBWC0] = available & 0xffff; 780 781 /* Update status */ 782 if (dp8393x_rbwc(s) < s->regs[SONIC_EOBC]) { 783 s->regs[SONIC_RCR] |= SONIC_RCR_LPKT; 784 } 785 s->regs[SONIC_RCR] |= packet_type; 786 s->regs[SONIC_RCR] |= SONIC_RCR_PRX; 787 if (s->loopback_packet) { 788 s->regs[SONIC_RCR] |= SONIC_RCR_LBK; 789 s->loopback_packet = 0; 790 } 791 792 /* Write status to memory */ 793 DPRINTF("Write status at %08x\n", dp8393x_crda(s)); 794 data[0 * width] = s->regs[SONIC_RCR]; /* status */ 795 data[1 * width] = rx_len; /* byte count */ 796 data[2 * width] = s->regs[SONIC_TRBA0]; /* pkt_ptr0 */ 797 data[3 * width] = s->regs[SONIC_TRBA1]; /* pkt_ptr1 */ 798 data[4 * width] = s->regs[SONIC_RSC]; /* seq_no */ 799 size = sizeof(uint16_t) * 5 * width; 800 address_space_rw(&s->as, dp8393x_crda(s), 801 MEMTXATTRS_UNSPECIFIED, (uint8_t *)data, size, 1); 802 803 /* Move to next descriptor */ 804 size = sizeof(uint16_t) * width; 805 address_space_rw(&s->as, dp8393x_crda(s) + sizeof(uint16_t) * 5 * width, 806 MEMTXATTRS_UNSPECIFIED, (uint8_t *)data, size, 0); 807 s->regs[SONIC_LLFA] = data[0 * width]; 808 if (s->regs[SONIC_LLFA] & 0x1) { 809 /* EOL detected */ 810 s->regs[SONIC_ISR] |= SONIC_ISR_RDE; 811 } else { 812 data[0 * width] = 0; /* in_use */ 813 address_space_rw(&s->as, dp8393x_crda(s) + sizeof(uint16_t) * 6 * width, 814 MEMTXATTRS_UNSPECIFIED, (uint8_t *)data, sizeof(uint16_t), 1); 815 s->regs[SONIC_CRDA] = s->regs[SONIC_LLFA]; 816 s->regs[SONIC_ISR] |= SONIC_ISR_PKTRX; 817 s->regs[SONIC_RSC] = (s->regs[SONIC_RSC] & 0xff00) | (((s->regs[SONIC_RSC] & 0x00ff) + 1) & 0x00ff); 818 819 if (s->regs[SONIC_RCR] & SONIC_RCR_LPKT) { 820 /* Read next RRA */ 821 dp8393x_do_read_rra(s); 822 } 823 } 824 825 /* Done */ 826 dp8393x_update_irq(s); 827 828 return size; 829 } 830 831 static void dp8393x_reset(DeviceState *dev) 832 { 833 dp8393xState *s = DP8393X(dev); 834 timer_del(s->watchdog); 835 836 memset(s->regs, 0, sizeof(s->regs)); 837 s->regs[SONIC_CR] = SONIC_CR_RST | SONIC_CR_STP | SONIC_CR_RXDIS; 838 s->regs[SONIC_DCR] &= ~(SONIC_DCR_EXBUS | SONIC_DCR_LBR); 839 s->regs[SONIC_RCR] &= ~(SONIC_RCR_LB0 | SONIC_RCR_LB1 | SONIC_RCR_BRD | SONIC_RCR_RNT); 840 s->regs[SONIC_TCR] |= SONIC_TCR_NCRS | SONIC_TCR_PTX; 841 s->regs[SONIC_TCR] &= ~SONIC_TCR_BCM; 842 s->regs[SONIC_IMR] = 0; 843 s->regs[SONIC_ISR] = 0; 844 s->regs[SONIC_DCR2] = 0; 845 s->regs[SONIC_EOBC] = 0x02F8; 846 s->regs[SONIC_RSC] = 0; 847 s->regs[SONIC_CE] = 0; 848 s->regs[SONIC_RSC] = 0; 849 850 /* Network cable is connected */ 851 s->regs[SONIC_RCR] |= SONIC_RCR_CRS; 852 853 dp8393x_update_irq(s); 854 } 855 856 static NetClientInfo net_dp83932_info = { 857 .type = NET_CLIENT_DRIVER_NIC, 858 .size = sizeof(NICState), 859 .can_receive = dp8393x_can_receive, 860 .receive = dp8393x_receive, 861 }; 862 863 static void dp8393x_instance_init(Object *obj) 864 { 865 SysBusDevice *sbd = SYS_BUS_DEVICE(obj); 866 dp8393xState *s = DP8393X(obj); 867 868 sysbus_init_mmio(sbd, &s->mmio); 869 sysbus_init_mmio(sbd, &s->prom); 870 sysbus_init_irq(sbd, &s->irq); 871 } 872 873 static void dp8393x_realize(DeviceState *dev, Error **errp) 874 { 875 dp8393xState *s = DP8393X(dev); 876 int i, checksum; 877 uint8_t *prom; 878 Error *local_err = NULL; 879 880 address_space_init(&s->as, s->dma_mr, "dp8393x"); 881 memory_region_init_io(&s->mmio, OBJECT(dev), &dp8393x_ops, s, 882 "dp8393x-regs", 0x40 << s->it_shift); 883 884 s->nic = qemu_new_nic(&net_dp83932_info, &s->conf, 885 object_get_typename(OBJECT(dev)), dev->id, s); 886 qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a); 887 888 s->watchdog = timer_new_ns(QEMU_CLOCK_VIRTUAL, dp8393x_watchdog, s); 889 s->regs[SONIC_SR] = 0x0004; /* only revision recognized by Linux */ 890 891 memory_region_init_ram(&s->prom, OBJECT(dev), 892 "dp8393x-prom", SONIC_PROM_SIZE, &local_err); 893 if (local_err) { 894 error_propagate(errp, local_err); 895 return; 896 } 897 memory_region_set_readonly(&s->prom, true); 898 prom = memory_region_get_ram_ptr(&s->prom); 899 checksum = 0; 900 for (i = 0; i < 6; i++) { 901 prom[i] = s->conf.macaddr.a[i]; 902 checksum += prom[i]; 903 if (checksum > 0xff) { 904 checksum = (checksum + 1) & 0xff; 905 } 906 } 907 prom[7] = 0xff - checksum; 908 } 909 910 static const VMStateDescription vmstate_dp8393x = { 911 .name = "dp8393x", 912 .version_id = 0, 913 .minimum_version_id = 0, 914 .fields = (VMStateField []) { 915 VMSTATE_BUFFER_UNSAFE(cam, dp8393xState, 0, 16 * 6), 916 VMSTATE_UINT16_ARRAY(regs, dp8393xState, 0x40), 917 VMSTATE_END_OF_LIST() 918 } 919 }; 920 921 static Property dp8393x_properties[] = { 922 DEFINE_NIC_PROPERTIES(dp8393xState, conf), 923 DEFINE_PROP_PTR("dma_mr", dp8393xState, dma_mr), 924 DEFINE_PROP_UINT8("it_shift", dp8393xState, it_shift, 0), 925 DEFINE_PROP_END_OF_LIST(), 926 }; 927 928 static void dp8393x_class_init(ObjectClass *klass, void *data) 929 { 930 DeviceClass *dc = DEVICE_CLASS(klass); 931 932 set_bit(DEVICE_CATEGORY_NETWORK, dc->categories); 933 dc->realize = dp8393x_realize; 934 dc->reset = dp8393x_reset; 935 dc->vmsd = &vmstate_dp8393x; 936 dc->props = dp8393x_properties; 937 /* Reason: dma_mr property can't be set */ 938 dc->user_creatable = false; 939 } 940 941 static const TypeInfo dp8393x_info = { 942 .name = TYPE_DP8393X, 943 .parent = TYPE_SYS_BUS_DEVICE, 944 .instance_size = sizeof(dp8393xState), 945 .instance_init = dp8393x_instance_init, 946 .class_init = dp8393x_class_init, 947 }; 948 949 static void dp8393x_register_types(void) 950 { 951 type_register_static(&dp8393x_info); 952 } 953 954 type_init(dp8393x_register_types) 955