xref: /openbmc/qemu/hw/net/smc91c111.c (revision db1015e9)
1 /*
2  * SMSC 91C111 Ethernet interface emulation
3  *
4  * Copyright (c) 2005 CodeSourcery, LLC.
5  * Written by Paul Brook
6  *
7  * This code is licensed under the GPL
8  */
9 
10 #include "qemu/osdep.h"
11 #include "hw/sysbus.h"
12 #include "migration/vmstate.h"
13 #include "net/net.h"
14 #include "hw/irq.h"
15 #include "hw/net/smc91c111.h"
16 #include "hw/qdev-properties.h"
17 #include "qapi/error.h"
18 #include "qemu/log.h"
19 #include "qemu/module.h"
20 /* For crc32 */
21 #include <zlib.h>
22 #include "qom/object.h"
23 
24 /* Number of 2k memory pages available.  */
25 #define NUM_PACKETS 4
26 
27 #define TYPE_SMC91C111 "smc91c111"
28 typedef struct smc91c111_state smc91c111_state;
29 #define SMC91C111(obj) OBJECT_CHECK(smc91c111_state, (obj), TYPE_SMC91C111)
30 
31 struct smc91c111_state {
32     SysBusDevice parent_obj;
33 
34     NICState *nic;
35     NICConf conf;
36     uint16_t tcr;
37     uint16_t rcr;
38     uint16_t cr;
39     uint16_t ctr;
40     uint16_t gpr;
41     uint16_t ptr;
42     uint16_t ercv;
43     qemu_irq irq;
44     int bank;
45     int packet_num;
46     int tx_alloc;
47     /* Bitmask of allocated packets.  */
48     int allocated;
49     int tx_fifo_len;
50     int tx_fifo[NUM_PACKETS];
51     int rx_fifo_len;
52     int rx_fifo[NUM_PACKETS];
53     int tx_fifo_done_len;
54     int tx_fifo_done[NUM_PACKETS];
55     /* Packet buffer memory.  */
56     uint8_t data[NUM_PACKETS][2048];
57     uint8_t int_level;
58     uint8_t int_mask;
59     MemoryRegion mmio;
60 };
61 
62 static const VMStateDescription vmstate_smc91c111 = {
63     .name = "smc91c111",
64     .version_id = 1,
65     .minimum_version_id = 1,
66     .fields = (VMStateField[]) {
67         VMSTATE_UINT16(tcr, smc91c111_state),
68         VMSTATE_UINT16(rcr, smc91c111_state),
69         VMSTATE_UINT16(cr, smc91c111_state),
70         VMSTATE_UINT16(ctr, smc91c111_state),
71         VMSTATE_UINT16(gpr, smc91c111_state),
72         VMSTATE_UINT16(ptr, smc91c111_state),
73         VMSTATE_UINT16(ercv, smc91c111_state),
74         VMSTATE_INT32(bank, smc91c111_state),
75         VMSTATE_INT32(packet_num, smc91c111_state),
76         VMSTATE_INT32(tx_alloc, smc91c111_state),
77         VMSTATE_INT32(allocated, smc91c111_state),
78         VMSTATE_INT32(tx_fifo_len, smc91c111_state),
79         VMSTATE_INT32_ARRAY(tx_fifo, smc91c111_state, NUM_PACKETS),
80         VMSTATE_INT32(rx_fifo_len, smc91c111_state),
81         VMSTATE_INT32_ARRAY(rx_fifo, smc91c111_state, NUM_PACKETS),
82         VMSTATE_INT32(tx_fifo_done_len, smc91c111_state),
83         VMSTATE_INT32_ARRAY(tx_fifo_done, smc91c111_state, NUM_PACKETS),
84         VMSTATE_BUFFER_UNSAFE(data, smc91c111_state, 0, NUM_PACKETS * 2048),
85         VMSTATE_UINT8(int_level, smc91c111_state),
86         VMSTATE_UINT8(int_mask, smc91c111_state),
87         VMSTATE_END_OF_LIST()
88     }
89 };
90 
91 #define RCR_SOFT_RST  0x8000
92 #define RCR_STRIP_CRC 0x0200
93 #define RCR_RXEN      0x0100
94 
95 #define TCR_EPH_LOOP  0x2000
96 #define TCR_NOCRC     0x0100
97 #define TCR_PAD_EN    0x0080
98 #define TCR_FORCOL    0x0004
99 #define TCR_LOOP      0x0002
100 #define TCR_TXEN      0x0001
101 
102 #define INT_MD        0x80
103 #define INT_ERCV      0x40
104 #define INT_EPH       0x20
105 #define INT_RX_OVRN   0x10
106 #define INT_ALLOC     0x08
107 #define INT_TX_EMPTY  0x04
108 #define INT_TX        0x02
109 #define INT_RCV       0x01
110 
111 #define CTR_AUTO_RELEASE  0x0800
112 #define CTR_RELOAD        0x0002
113 #define CTR_STORE         0x0001
114 
115 #define RS_ALGNERR      0x8000
116 #define RS_BRODCAST     0x4000
117 #define RS_BADCRC       0x2000
118 #define RS_ODDFRAME     0x1000
119 #define RS_TOOLONG      0x0800
120 #define RS_TOOSHORT     0x0400
121 #define RS_MULTICAST    0x0001
122 
123 /* Update interrupt status.  */
124 static void smc91c111_update(smc91c111_state *s)
125 {
126     int level;
127 
128     if (s->tx_fifo_len == 0)
129         s->int_level |= INT_TX_EMPTY;
130     if (s->tx_fifo_done_len != 0)
131         s->int_level |= INT_TX;
132     level = (s->int_level & s->int_mask) != 0;
133     qemu_set_irq(s->irq, level);
134 }
135 
136 static bool smc91c111_can_receive(smc91c111_state *s)
137 {
138     if ((s->rcr & RCR_RXEN) == 0 || (s->rcr & RCR_SOFT_RST)) {
139         return true;
140     }
141     if (s->allocated == (1 << NUM_PACKETS) - 1 ||
142         s->rx_fifo_len == NUM_PACKETS) {
143         return false;
144     }
145     return true;
146 }
147 
148 static inline void smc91c111_flush_queued_packets(smc91c111_state *s)
149 {
150     if (smc91c111_can_receive(s)) {
151         qemu_flush_queued_packets(qemu_get_queue(s->nic));
152     }
153 }
154 
155 /* Try to allocate a packet.  Returns 0x80 on failure.  */
156 static int smc91c111_allocate_packet(smc91c111_state *s)
157 {
158     int i;
159     if (s->allocated == (1 << NUM_PACKETS) - 1) {
160         return 0x80;
161     }
162 
163     for (i = 0; i < NUM_PACKETS; i++) {
164         if ((s->allocated & (1 << i)) == 0)
165             break;
166     }
167     s->allocated |= 1 << i;
168     return i;
169 }
170 
171 
172 /* Process a pending TX allocate.  */
173 static void smc91c111_tx_alloc(smc91c111_state *s)
174 {
175     s->tx_alloc = smc91c111_allocate_packet(s);
176     if (s->tx_alloc == 0x80)
177         return;
178     s->int_level |= INT_ALLOC;
179     smc91c111_update(s);
180 }
181 
182 /* Remove and item from the RX FIFO.  */
183 static void smc91c111_pop_rx_fifo(smc91c111_state *s)
184 {
185     int i;
186 
187     s->rx_fifo_len--;
188     if (s->rx_fifo_len) {
189         for (i = 0; i < s->rx_fifo_len; i++)
190             s->rx_fifo[i] = s->rx_fifo[i + 1];
191         s->int_level |= INT_RCV;
192     } else {
193         s->int_level &= ~INT_RCV;
194     }
195     smc91c111_flush_queued_packets(s);
196     smc91c111_update(s);
197 }
198 
199 /* Remove an item from the TX completion FIFO.  */
200 static void smc91c111_pop_tx_fifo_done(smc91c111_state *s)
201 {
202     int i;
203 
204     if (s->tx_fifo_done_len == 0)
205         return;
206     s->tx_fifo_done_len--;
207     for (i = 0; i < s->tx_fifo_done_len; i++)
208         s->tx_fifo_done[i] = s->tx_fifo_done[i + 1];
209 }
210 
211 /* Release the memory allocated to a packet.  */
212 static void smc91c111_release_packet(smc91c111_state *s, int packet)
213 {
214     s->allocated &= ~(1 << packet);
215     if (s->tx_alloc == 0x80)
216         smc91c111_tx_alloc(s);
217     smc91c111_flush_queued_packets(s);
218 }
219 
220 /* Flush the TX FIFO.  */
221 static void smc91c111_do_tx(smc91c111_state *s)
222 {
223     int i;
224     int len;
225     int control;
226     int packetnum;
227     uint8_t *p;
228 
229     if ((s->tcr & TCR_TXEN) == 0)
230         return;
231     if (s->tx_fifo_len == 0)
232         return;
233     for (i = 0; i < s->tx_fifo_len; i++) {
234         packetnum = s->tx_fifo[i];
235         p = &s->data[packetnum][0];
236         /* Set status word.  */
237         *(p++) = 0x01;
238         *(p++) = 0x40;
239         len = *(p++);
240         len |= ((int)*(p++)) << 8;
241         len -= 6;
242         control = p[len + 1];
243         if (control & 0x20)
244             len++;
245         /* ??? This overwrites the data following the buffer.
246            Don't know what real hardware does.  */
247         if (len < 64 && (s->tcr & TCR_PAD_EN)) {
248             memset(p + len, 0, 64 - len);
249             len = 64;
250         }
251 #if 0
252         {
253             int add_crc;
254 
255             /* The card is supposed to append the CRC to the frame.
256                However none of the other network traffic has the CRC
257                appended.  Suspect this is low level ethernet detail we
258                don't need to worry about.  */
259             add_crc = (control & 0x10) || (s->tcr & TCR_NOCRC) == 0;
260             if (add_crc) {
261                 uint32_t crc;
262 
263                 crc = crc32(~0, p, len);
264                 memcpy(p + len, &crc, 4);
265                 len += 4;
266             }
267         }
268 #endif
269         if (s->ctr & CTR_AUTO_RELEASE)
270             /* Race?  */
271             smc91c111_release_packet(s, packetnum);
272         else if (s->tx_fifo_done_len < NUM_PACKETS)
273             s->tx_fifo_done[s->tx_fifo_done_len++] = packetnum;
274         qemu_send_packet(qemu_get_queue(s->nic), p, len);
275     }
276     s->tx_fifo_len = 0;
277     smc91c111_update(s);
278 }
279 
280 /* Add a packet to the TX FIFO.  */
281 static void smc91c111_queue_tx(smc91c111_state *s, int packet)
282 {
283     if (s->tx_fifo_len == NUM_PACKETS)
284         return;
285     s->tx_fifo[s->tx_fifo_len++] = packet;
286     smc91c111_do_tx(s);
287 }
288 
289 static void smc91c111_reset(DeviceState *dev)
290 {
291     smc91c111_state *s = SMC91C111(dev);
292 
293     s->bank = 0;
294     s->tx_fifo_len = 0;
295     s->tx_fifo_done_len = 0;
296     s->rx_fifo_len = 0;
297     s->allocated = 0;
298     s->packet_num = 0;
299     s->tx_alloc = 0;
300     s->tcr = 0;
301     s->rcr = 0;
302     s->cr = 0xa0b1;
303     s->ctr = 0x1210;
304     s->ptr = 0;
305     s->ercv = 0x1f;
306     s->int_level = INT_TX_EMPTY;
307     s->int_mask = 0;
308     smc91c111_update(s);
309 }
310 
311 #define SET_LOW(name, val) s->name = (s->name & 0xff00) | val
312 #define SET_HIGH(name, val) s->name = (s->name & 0xff) | (val << 8)
313 
314 static void smc91c111_writeb(void *opaque, hwaddr offset,
315                              uint32_t value)
316 {
317     smc91c111_state *s = (smc91c111_state *)opaque;
318 
319     offset = offset & 0xf;
320     if (offset == 14) {
321         s->bank = value;
322         return;
323     }
324     if (offset == 15)
325         return;
326     switch (s->bank) {
327     case 0:
328         switch (offset) {
329         case 0: /* TCR */
330             SET_LOW(tcr, value);
331             return;
332         case 1:
333             SET_HIGH(tcr, value);
334             return;
335         case 4: /* RCR */
336             SET_LOW(rcr, value);
337             return;
338         case 5:
339             SET_HIGH(rcr, value);
340             if (s->rcr & RCR_SOFT_RST) {
341                 smc91c111_reset(DEVICE(s));
342             }
343             smc91c111_flush_queued_packets(s);
344             return;
345         case 10: case 11: /* RPCR */
346             /* Ignored */
347             return;
348         case 12: case 13: /* Reserved */
349             return;
350         }
351         break;
352 
353     case 1:
354         switch (offset) {
355         case 0: /* CONFIG */
356             SET_LOW(cr, value);
357             return;
358         case 1:
359             SET_HIGH(cr,value);
360             return;
361         case 2: case 3: /* BASE */
362         case 4: case 5: case 6: case 7: case 8: case 9: /* IA */
363             /* Not implemented.  */
364             return;
365         case 10: /* Genral Purpose */
366             SET_LOW(gpr, value);
367             return;
368         case 11:
369             SET_HIGH(gpr, value);
370             return;
371         case 12: /* Control */
372             if (value & 1) {
373                 qemu_log_mask(LOG_UNIMP,
374                               "smc91c111: EEPROM store not implemented\n");
375             }
376             if (value & 2) {
377                 qemu_log_mask(LOG_UNIMP,
378                               "smc91c111: EEPROM reload not implemented\n");
379             }
380             value &= ~3;
381             SET_LOW(ctr, value);
382             return;
383         case 13:
384             SET_HIGH(ctr, value);
385             return;
386         }
387         break;
388 
389     case 2:
390         switch (offset) {
391         case 0: /* MMU Command */
392             switch (value >> 5) {
393             case 0: /* no-op */
394                 break;
395             case 1: /* Allocate for TX.  */
396                 s->tx_alloc = 0x80;
397                 s->int_level &= ~INT_ALLOC;
398                 smc91c111_update(s);
399                 smc91c111_tx_alloc(s);
400                 break;
401             case 2: /* Reset MMU.  */
402                 s->allocated = 0;
403                 s->tx_fifo_len = 0;
404                 s->tx_fifo_done_len = 0;
405                 s->rx_fifo_len = 0;
406                 s->tx_alloc = 0;
407                 break;
408             case 3: /* Remove from RX FIFO.  */
409                 smc91c111_pop_rx_fifo(s);
410                 break;
411             case 4: /* Remove from RX FIFO and release.  */
412                 if (s->rx_fifo_len > 0) {
413                     smc91c111_release_packet(s, s->rx_fifo[0]);
414                 }
415                 smc91c111_pop_rx_fifo(s);
416                 break;
417             case 5: /* Release.  */
418                 smc91c111_release_packet(s, s->packet_num);
419                 break;
420             case 6: /* Add to TX FIFO.  */
421                 smc91c111_queue_tx(s, s->packet_num);
422                 break;
423             case 7: /* Reset TX FIFO.  */
424                 s->tx_fifo_len = 0;
425                 s->tx_fifo_done_len = 0;
426                 break;
427             }
428             return;
429         case 1:
430             /* Ignore.  */
431             return;
432         case 2: /* Packet Number Register */
433             s->packet_num = value;
434             return;
435         case 3: case 4: case 5:
436             /* Should be readonly, but linux writes to them anyway. Ignore.  */
437             return;
438         case 6: /* Pointer */
439             SET_LOW(ptr, value);
440             return;
441         case 7:
442             SET_HIGH(ptr, value);
443             return;
444         case 8: case 9: case 10: case 11: /* Data */
445             {
446                 int p;
447                 int n;
448 
449                 if (s->ptr & 0x8000)
450                     n = s->rx_fifo[0];
451                 else
452                     n = s->packet_num;
453                 p = s->ptr & 0x07ff;
454                 if (s->ptr & 0x4000) {
455                     s->ptr = (s->ptr & 0xf800) | ((s->ptr + 1) & 0x7ff);
456                 } else {
457                     p += (offset & 3);
458                 }
459                 s->data[n][p] = value;
460             }
461             return;
462         case 12: /* Interrupt ACK.  */
463             s->int_level &= ~(value & 0xd6);
464             if (value & INT_TX)
465                 smc91c111_pop_tx_fifo_done(s);
466             smc91c111_update(s);
467             return;
468         case 13: /* Interrupt mask.  */
469             s->int_mask = value;
470             smc91c111_update(s);
471             return;
472         }
473         break;
474 
475     case 3:
476         switch (offset) {
477         case 0: case 1: case 2: case 3: case 4: case 5: case 6: case 7:
478             /* Multicast table.  */
479             /* Not implemented.  */
480             return;
481         case 8: case 9: /* Management Interface.  */
482             /* Not implemented.  */
483             return;
484         case 12: /* Early receive.  */
485             s->ercv = value & 0x1f;
486             return;
487         case 13:
488             /* Ignore.  */
489             return;
490         }
491         break;
492     }
493     qemu_log_mask(LOG_GUEST_ERROR, "smc91c111_write(bank:%d) Illegal register"
494                                    " 0x%" HWADDR_PRIx " = 0x%x\n",
495                   s->bank, offset, value);
496 }
497 
498 static uint32_t smc91c111_readb(void *opaque, hwaddr offset)
499 {
500     smc91c111_state *s = (smc91c111_state *)opaque;
501 
502     offset = offset & 0xf;
503     if (offset == 14) {
504         return s->bank;
505     }
506     if (offset == 15)
507         return 0x33;
508     switch (s->bank) {
509     case 0:
510         switch (offset) {
511         case 0: /* TCR */
512             return s->tcr & 0xff;
513         case 1:
514             return s->tcr >> 8;
515         case 2: /* EPH Status */
516             return 0;
517         case 3:
518             return 0x40;
519         case 4: /* RCR */
520             return s->rcr & 0xff;
521         case 5:
522             return s->rcr >> 8;
523         case 6: /* Counter */
524         case 7:
525             /* Not implemented.  */
526             return 0;
527         case 8: /* Memory size.  */
528             return NUM_PACKETS;
529         case 9: /* Free memory available.  */
530             {
531                 int i;
532                 int n;
533                 n = 0;
534                 for (i = 0; i < NUM_PACKETS; i++) {
535                     if (s->allocated & (1 << i))
536                         n++;
537                 }
538                 return n;
539             }
540         case 10: case 11: /* RPCR */
541             /* Not implemented.  */
542             return 0;
543         case 12: case 13: /* Reserved */
544             return 0;
545         }
546         break;
547 
548     case 1:
549         switch (offset) {
550         case 0: /* CONFIG */
551             return s->cr & 0xff;
552         case 1:
553             return s->cr >> 8;
554         case 2: case 3: /* BASE */
555             /* Not implemented.  */
556             return 0;
557         case 4: case 5: case 6: case 7: case 8: case 9: /* IA */
558             return s->conf.macaddr.a[offset - 4];
559         case 10: /* General Purpose */
560             return s->gpr & 0xff;
561         case 11:
562             return s->gpr >> 8;
563         case 12: /* Control */
564             return s->ctr & 0xff;
565         case 13:
566             return s->ctr >> 8;
567         }
568         break;
569 
570     case 2:
571         switch (offset) {
572         case 0: case 1: /* MMUCR Busy bit.  */
573             return 0;
574         case 2: /* Packet Number.  */
575             return s->packet_num;
576         case 3: /* Allocation Result.  */
577             return s->tx_alloc;
578         case 4: /* TX FIFO */
579             if (s->tx_fifo_done_len == 0)
580                 return 0x80;
581             else
582                 return s->tx_fifo_done[0];
583         case 5: /* RX FIFO */
584             if (s->rx_fifo_len == 0)
585                 return 0x80;
586             else
587                 return s->rx_fifo[0];
588         case 6: /* Pointer */
589             return s->ptr & 0xff;
590         case 7:
591             return (s->ptr >> 8) & 0xf7;
592         case 8: case 9: case 10: case 11: /* Data */
593             {
594                 int p;
595                 int n;
596 
597                 if (s->ptr & 0x8000)
598                     n = s->rx_fifo[0];
599                 else
600                     n = s->packet_num;
601                 p = s->ptr & 0x07ff;
602                 if (s->ptr & 0x4000) {
603                     s->ptr = (s->ptr & 0xf800) | ((s->ptr + 1) & 0x07ff);
604                 } else {
605                     p += (offset & 3);
606                 }
607                 return s->data[n][p];
608             }
609         case 12: /* Interrupt status.  */
610             return s->int_level;
611         case 13: /* Interrupt mask.  */
612             return s->int_mask;
613         }
614         break;
615 
616     case 3:
617         switch (offset) {
618         case 0: case 1: case 2: case 3: case 4: case 5: case 6: case 7:
619             /* Multicast table.  */
620             /* Not implemented.  */
621             return 0;
622         case 8: /* Management Interface.  */
623             /* Not implemented.  */
624             return 0x30;
625         case 9:
626             return 0x33;
627         case 10: /* Revision.  */
628             return 0x91;
629         case 11:
630             return 0x33;
631         case 12:
632             return s->ercv;
633         case 13:
634             return 0;
635         }
636         break;
637     }
638     qemu_log_mask(LOG_GUEST_ERROR, "smc91c111_read(bank:%d) Illegal register"
639                                    " 0x%" HWADDR_PRIx "\n",
640                   s->bank, offset);
641     return 0;
642 }
643 
644 static uint64_t smc91c111_readfn(void *opaque, hwaddr addr, unsigned size)
645 {
646     int i;
647     uint32_t val = 0;
648 
649     for (i = 0; i < size; i++) {
650         val |= smc91c111_readb(opaque, addr + i) << (i * 8);
651     }
652     return val;
653 }
654 
655 static void smc91c111_writefn(void *opaque, hwaddr addr,
656                                uint64_t value, unsigned size)
657 {
658     int i = 0;
659 
660     /* 32-bit writes to offset 0xc only actually write to the bank select
661      * register (offset 0xe), so skip the first two bytes we would write.
662      */
663     if (addr == 0xc && size == 4) {
664         i += 2;
665     }
666 
667     for (; i < size; i++) {
668         smc91c111_writeb(opaque, addr + i,
669                          extract32(value, i * 8, 8));
670     }
671 }
672 
673 static bool smc91c111_can_receive_nc(NetClientState *nc)
674 {
675     smc91c111_state *s = qemu_get_nic_opaque(nc);
676 
677     return smc91c111_can_receive(s);
678 }
679 
680 static ssize_t smc91c111_receive(NetClientState *nc, const uint8_t *buf, size_t size)
681 {
682     smc91c111_state *s = qemu_get_nic_opaque(nc);
683     int status;
684     int packetsize;
685     uint32_t crc;
686     int packetnum;
687     uint8_t *p;
688 
689     if ((s->rcr & RCR_RXEN) == 0 || (s->rcr & RCR_SOFT_RST))
690         return -1;
691     /* Short packets are padded with zeros.  Receiving a packet
692        < 64 bytes long is considered an error condition.  */
693     if (size < 64)
694         packetsize = 64;
695     else
696         packetsize = (size & ~1);
697     packetsize += 6;
698     crc = (s->rcr & RCR_STRIP_CRC) == 0;
699     if (crc)
700         packetsize += 4;
701     /* TODO: Flag overrun and receive errors.  */
702     if (packetsize > 2048)
703         return -1;
704     packetnum = smc91c111_allocate_packet(s);
705     if (packetnum == 0x80)
706         return -1;
707     s->rx_fifo[s->rx_fifo_len++] = packetnum;
708 
709     p = &s->data[packetnum][0];
710     /* ??? Multicast packets?  */
711     status = 0;
712     if (size > 1518)
713         status |= RS_TOOLONG;
714     if (size & 1)
715         status |= RS_ODDFRAME;
716     *(p++) = status & 0xff;
717     *(p++) = status >> 8;
718     *(p++) = packetsize & 0xff;
719     *(p++) = packetsize >> 8;
720     memcpy(p, buf, size & ~1);
721     p += (size & ~1);
722     /* Pad short packets.  */
723     if (size < 64) {
724         int pad;
725 
726         if (size & 1)
727             *(p++) = buf[size - 1];
728         pad = 64 - size;
729         memset(p, 0, pad);
730         p += pad;
731         size = 64;
732     }
733     /* It's not clear if the CRC should go before or after the last byte in
734        odd sized packets.  Linux disables the CRC, so that's no help.
735        The pictures in the documentation show the CRC aligned on a 16-bit
736        boundary before the last odd byte, so that's what we do.  */
737     if (crc) {
738         crc = crc32(~0, buf, size);
739         *(p++) = crc & 0xff; crc >>= 8;
740         *(p++) = crc & 0xff; crc >>= 8;
741         *(p++) = crc & 0xff; crc >>= 8;
742         *(p++) = crc & 0xff;
743     }
744     if (size & 1) {
745         *(p++) = buf[size - 1];
746         *p = 0x60;
747     } else {
748         *(p++) = 0;
749         *p = 0x40;
750     }
751     /* TODO: Raise early RX interrupt?  */
752     s->int_level |= INT_RCV;
753     smc91c111_update(s);
754 
755     return size;
756 }
757 
758 static const MemoryRegionOps smc91c111_mem_ops = {
759     /* The special case for 32 bit writes to 0xc means we can't just
760      * set .impl.min/max_access_size to 1, unfortunately
761      */
762     .read = smc91c111_readfn,
763     .write = smc91c111_writefn,
764     .valid.min_access_size = 1,
765     .valid.max_access_size = 4,
766     .endianness = DEVICE_NATIVE_ENDIAN,
767 };
768 
769 static NetClientInfo net_smc91c111_info = {
770     .type = NET_CLIENT_DRIVER_NIC,
771     .size = sizeof(NICState),
772     .can_receive = smc91c111_can_receive_nc,
773     .receive = smc91c111_receive,
774 };
775 
776 static void smc91c111_realize(DeviceState *dev, Error **errp)
777 {
778     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
779     smc91c111_state *s = SMC91C111(dev);
780 
781     memory_region_init_io(&s->mmio, OBJECT(s), &smc91c111_mem_ops, s,
782                           "smc91c111-mmio", 16);
783     sysbus_init_mmio(sbd, &s->mmio);
784     sysbus_init_irq(sbd, &s->irq);
785     qemu_macaddr_default_if_unset(&s->conf.macaddr);
786     s->nic = qemu_new_nic(&net_smc91c111_info, &s->conf,
787                           object_get_typename(OBJECT(dev)), dev->id, s);
788     qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
789     /* ??? Save/restore.  */
790 }
791 
792 static Property smc91c111_properties[] = {
793     DEFINE_NIC_PROPERTIES(smc91c111_state, conf),
794     DEFINE_PROP_END_OF_LIST(),
795 };
796 
797 static void smc91c111_class_init(ObjectClass *klass, void *data)
798 {
799     DeviceClass *dc = DEVICE_CLASS(klass);
800 
801     dc->realize = smc91c111_realize;
802     dc->reset = smc91c111_reset;
803     dc->vmsd = &vmstate_smc91c111;
804     device_class_set_props(dc, smc91c111_properties);
805 }
806 
807 static const TypeInfo smc91c111_info = {
808     .name          = TYPE_SMC91C111,
809     .parent        = TYPE_SYS_BUS_DEVICE,
810     .instance_size = sizeof(smc91c111_state),
811     .class_init    = smc91c111_class_init,
812 };
813 
814 static void smc91c111_register_types(void)
815 {
816     type_register_static(&smc91c111_info);
817 }
818 
819 /* Legacy helper function.  Should go away when machine config files are
820    implemented.  */
821 void smc91c111_init(NICInfo *nd, uint32_t base, qemu_irq irq)
822 {
823     DeviceState *dev;
824     SysBusDevice *s;
825 
826     qemu_check_nic_model(nd, "smc91c111");
827     dev = qdev_new(TYPE_SMC91C111);
828     qdev_set_nic_properties(dev, nd);
829     s = SYS_BUS_DEVICE(dev);
830     sysbus_realize_and_unref(s, &error_fatal);
831     sysbus_mmio_map(s, 0, base);
832     sysbus_connect_irq(s, 0, irq);
833 }
834 
835 type_init(smc91c111_register_types)
836