1 /* 2 * SMSC 91C111 Ethernet interface emulation 3 * 4 * Copyright (c) 2005 CodeSourcery, LLC. 5 * Written by Paul Brook 6 * 7 * This code is licensed under the GPL 8 */ 9 10 #include "qemu/osdep.h" 11 #include "hw/sysbus.h" 12 #include "migration/vmstate.h" 13 #include "net/net.h" 14 #include "hw/irq.h" 15 #include "hw/net/smc91c111.h" 16 #include "hw/qdev-properties.h" 17 #include "qapi/error.h" 18 #include "qemu/log.h" 19 #include "qemu/module.h" 20 #include <zlib.h> /* for crc32 */ 21 #include "qom/object.h" 22 23 /* Number of 2k memory pages available. */ 24 #define NUM_PACKETS 4 25 26 #define TYPE_SMC91C111 "smc91c111" 27 OBJECT_DECLARE_SIMPLE_TYPE(smc91c111_state, SMC91C111) 28 29 struct smc91c111_state { 30 SysBusDevice parent_obj; 31 32 NICState *nic; 33 NICConf conf; 34 uint16_t tcr; 35 uint16_t rcr; 36 uint16_t cr; 37 uint16_t ctr; 38 uint16_t gpr; 39 uint16_t ptr; 40 uint16_t ercv; 41 qemu_irq irq; 42 int bank; 43 int packet_num; 44 int tx_alloc; 45 /* Bitmask of allocated packets. */ 46 int allocated; 47 int tx_fifo_len; 48 int tx_fifo[NUM_PACKETS]; 49 int rx_fifo_len; 50 int rx_fifo[NUM_PACKETS]; 51 int tx_fifo_done_len; 52 int tx_fifo_done[NUM_PACKETS]; 53 /* Packet buffer memory. */ 54 uint8_t data[NUM_PACKETS][2048]; 55 uint8_t int_level; 56 uint8_t int_mask; 57 MemoryRegion mmio; 58 }; 59 60 static const VMStateDescription vmstate_smc91c111 = { 61 .name = "smc91c111", 62 .version_id = 1, 63 .minimum_version_id = 1, 64 .fields = (const VMStateField[]) { 65 VMSTATE_UINT16(tcr, smc91c111_state), 66 VMSTATE_UINT16(rcr, smc91c111_state), 67 VMSTATE_UINT16(cr, smc91c111_state), 68 VMSTATE_UINT16(ctr, smc91c111_state), 69 VMSTATE_UINT16(gpr, smc91c111_state), 70 VMSTATE_UINT16(ptr, smc91c111_state), 71 VMSTATE_UINT16(ercv, smc91c111_state), 72 VMSTATE_INT32(bank, smc91c111_state), 73 VMSTATE_INT32(packet_num, smc91c111_state), 74 VMSTATE_INT32(tx_alloc, smc91c111_state), 75 VMSTATE_INT32(allocated, smc91c111_state), 76 VMSTATE_INT32(tx_fifo_len, smc91c111_state), 77 VMSTATE_INT32_ARRAY(tx_fifo, smc91c111_state, NUM_PACKETS), 78 VMSTATE_INT32(rx_fifo_len, smc91c111_state), 79 VMSTATE_INT32_ARRAY(rx_fifo, smc91c111_state, NUM_PACKETS), 80 VMSTATE_INT32(tx_fifo_done_len, smc91c111_state), 81 VMSTATE_INT32_ARRAY(tx_fifo_done, smc91c111_state, NUM_PACKETS), 82 VMSTATE_BUFFER_UNSAFE(data, smc91c111_state, 0, NUM_PACKETS * 2048), 83 VMSTATE_UINT8(int_level, smc91c111_state), 84 VMSTATE_UINT8(int_mask, smc91c111_state), 85 VMSTATE_END_OF_LIST() 86 } 87 }; 88 89 #define RCR_SOFT_RST 0x8000 90 #define RCR_STRIP_CRC 0x0200 91 #define RCR_RXEN 0x0100 92 93 #define TCR_EPH_LOOP 0x2000 94 #define TCR_NOCRC 0x0100 95 #define TCR_PAD_EN 0x0080 96 #define TCR_FORCOL 0x0004 97 #define TCR_LOOP 0x0002 98 #define TCR_TXEN 0x0001 99 100 #define INT_MD 0x80 101 #define INT_ERCV 0x40 102 #define INT_EPH 0x20 103 #define INT_RX_OVRN 0x10 104 #define INT_ALLOC 0x08 105 #define INT_TX_EMPTY 0x04 106 #define INT_TX 0x02 107 #define INT_RCV 0x01 108 109 #define CTR_AUTO_RELEASE 0x0800 110 #define CTR_RELOAD 0x0002 111 #define CTR_STORE 0x0001 112 113 #define RS_ALGNERR 0x8000 114 #define RS_BRODCAST 0x4000 115 #define RS_BADCRC 0x2000 116 #define RS_ODDFRAME 0x1000 117 #define RS_TOOLONG 0x0800 118 #define RS_TOOSHORT 0x0400 119 #define RS_MULTICAST 0x0001 120 121 static inline bool packetnum_valid(int packet_num) 122 { 123 return packet_num >= 0 && packet_num < NUM_PACKETS; 124 } 125 126 /* Update interrupt status. */ 127 static void smc91c111_update(smc91c111_state *s) 128 { 129 int level; 130 131 if (s->tx_fifo_len == 0) 132 s->int_level |= INT_TX_EMPTY; 133 if (s->tx_fifo_done_len != 0) 134 s->int_level |= INT_TX; 135 level = (s->int_level & s->int_mask) != 0; 136 qemu_set_irq(s->irq, level); 137 } 138 139 static bool smc91c111_can_receive(smc91c111_state *s) 140 { 141 if ((s->rcr & RCR_RXEN) == 0 || (s->rcr & RCR_SOFT_RST)) { 142 return true; 143 } 144 if (s->allocated == (1 << NUM_PACKETS) - 1 || 145 s->rx_fifo_len == NUM_PACKETS) { 146 return false; 147 } 148 return true; 149 } 150 151 static inline void smc91c111_flush_queued_packets(smc91c111_state *s) 152 { 153 if (smc91c111_can_receive(s)) { 154 qemu_flush_queued_packets(qemu_get_queue(s->nic)); 155 } 156 } 157 158 /* Try to allocate a packet. Returns 0x80 on failure. */ 159 static int smc91c111_allocate_packet(smc91c111_state *s) 160 { 161 int i; 162 if (s->allocated == (1 << NUM_PACKETS) - 1) { 163 return 0x80; 164 } 165 166 for (i = 0; i < NUM_PACKETS; i++) { 167 if ((s->allocated & (1 << i)) == 0) 168 break; 169 } 170 s->allocated |= 1 << i; 171 return i; 172 } 173 174 175 /* Process a pending TX allocate. */ 176 static void smc91c111_tx_alloc(smc91c111_state *s) 177 { 178 s->tx_alloc = smc91c111_allocate_packet(s); 179 if (s->tx_alloc == 0x80) 180 return; 181 s->int_level |= INT_ALLOC; 182 smc91c111_update(s); 183 } 184 185 /* Remove and item from the RX FIFO. */ 186 static void smc91c111_pop_rx_fifo(smc91c111_state *s) 187 { 188 int i; 189 190 if (s->rx_fifo_len == 0) { 191 /* 192 * The datasheet doesn't document what the behaviour is if the 193 * guest tries to pop an empty RX FIFO, and there's no obvious 194 * error status register to report it. Just ignore the attempt. 195 */ 196 return; 197 } 198 199 s->rx_fifo_len--; 200 if (s->rx_fifo_len) { 201 for (i = 0; i < s->rx_fifo_len; i++) 202 s->rx_fifo[i] = s->rx_fifo[i + 1]; 203 s->int_level |= INT_RCV; 204 } else { 205 s->int_level &= ~INT_RCV; 206 } 207 smc91c111_flush_queued_packets(s); 208 smc91c111_update(s); 209 } 210 211 /* Remove an item from the TX completion FIFO. */ 212 static void smc91c111_pop_tx_fifo_done(smc91c111_state *s) 213 { 214 int i; 215 216 if (s->tx_fifo_done_len == 0) 217 return; 218 s->tx_fifo_done_len--; 219 for (i = 0; i < s->tx_fifo_done_len; i++) 220 s->tx_fifo_done[i] = s->tx_fifo_done[i + 1]; 221 } 222 223 /* Release the memory allocated to a packet. */ 224 static void smc91c111_release_packet(smc91c111_state *s, int packet) 225 { 226 if (!packetnum_valid(packet)) { 227 /* 228 * Data sheet doesn't document behaviour in this guest error 229 * case, and there is no error status register to report it. 230 * Log and ignore the attempt. 231 */ 232 qemu_log_mask(LOG_GUEST_ERROR, 233 "smc91c111: attempt to release invalid packet %d\n", 234 packet); 235 return; 236 } 237 s->allocated &= ~(1 << packet); 238 if (s->tx_alloc == 0x80) 239 smc91c111_tx_alloc(s); 240 smc91c111_flush_queued_packets(s); 241 } 242 243 /* Flush the TX FIFO. */ 244 static void smc91c111_do_tx(smc91c111_state *s) 245 { 246 int i; 247 int len; 248 int control; 249 int packetnum; 250 uint8_t *p; 251 252 if ((s->tcr & TCR_TXEN) == 0) 253 return; 254 if (s->tx_fifo_len == 0) 255 return; 256 for (i = 0; i < s->tx_fifo_len; i++) { 257 packetnum = s->tx_fifo[i]; 258 /* queue_tx checked the packet number was valid */ 259 assert(packetnum_valid(packetnum)); 260 p = &s->data[packetnum][0]; 261 /* Set status word. */ 262 *(p++) = 0x01; 263 *(p++) = 0x40; 264 len = *(p++); 265 len |= ((int)*(p++)) << 8; 266 len -= 6; 267 control = p[len + 1]; 268 if (control & 0x20) 269 len++; 270 /* ??? This overwrites the data following the buffer. 271 Don't know what real hardware does. */ 272 if (len < 64 && (s->tcr & TCR_PAD_EN)) { 273 memset(p + len, 0, 64 - len); 274 len = 64; 275 } 276 #if 0 277 { 278 int add_crc; 279 280 /* The card is supposed to append the CRC to the frame. 281 However none of the other network traffic has the CRC 282 appended. Suspect this is low level ethernet detail we 283 don't need to worry about. */ 284 add_crc = (control & 0x10) || (s->tcr & TCR_NOCRC) == 0; 285 if (add_crc) { 286 uint32_t crc; 287 288 crc = crc32(~0, p, len); 289 memcpy(p + len, &crc, 4); 290 len += 4; 291 } 292 } 293 #endif 294 if (s->ctr & CTR_AUTO_RELEASE) 295 /* Race? */ 296 smc91c111_release_packet(s, packetnum); 297 else if (s->tx_fifo_done_len < NUM_PACKETS) 298 s->tx_fifo_done[s->tx_fifo_done_len++] = packetnum; 299 qemu_send_packet(qemu_get_queue(s->nic), p, len); 300 } 301 s->tx_fifo_len = 0; 302 smc91c111_update(s); 303 } 304 305 /* Add a packet to the TX FIFO. */ 306 static void smc91c111_queue_tx(smc91c111_state *s, int packet) 307 { 308 if (!packetnum_valid(packet)) { 309 /* 310 * Datasheet doesn't document behaviour in this error case, and 311 * there's no error status register we could report it in. 312 * Log and ignore. 313 */ 314 qemu_log_mask(LOG_GUEST_ERROR, 315 "smc91c111: attempt to queue invalid packet %d\n", 316 packet); 317 return; 318 } 319 if (s->tx_fifo_len == NUM_PACKETS) 320 return; 321 s->tx_fifo[s->tx_fifo_len++] = packet; 322 smc91c111_do_tx(s); 323 } 324 325 static void smc91c111_reset(DeviceState *dev) 326 { 327 smc91c111_state *s = SMC91C111(dev); 328 329 s->bank = 0; 330 s->tx_fifo_len = 0; 331 s->tx_fifo_done_len = 0; 332 s->rx_fifo_len = 0; 333 s->allocated = 0; 334 s->packet_num = 0; 335 s->tx_alloc = 0; 336 s->tcr = 0; 337 s->rcr = 0; 338 s->cr = 0xa0b1; 339 s->ctr = 0x1210; 340 s->ptr = 0; 341 s->ercv = 0x1f; 342 s->int_level = INT_TX_EMPTY; 343 s->int_mask = 0; 344 smc91c111_update(s); 345 } 346 347 #define SET_LOW(name, val) s->name = (s->name & 0xff00) | val 348 #define SET_HIGH(name, val) s->name = (s->name & 0xff) | (val << 8) 349 350 static void smc91c111_writeb(void *opaque, hwaddr offset, 351 uint32_t value) 352 { 353 smc91c111_state *s = (smc91c111_state *)opaque; 354 355 offset = offset & 0xf; 356 if (offset == 14) { 357 s->bank = value; 358 return; 359 } 360 if (offset == 15) 361 return; 362 switch (s->bank) { 363 case 0: 364 switch (offset) { 365 case 0: /* TCR */ 366 SET_LOW(tcr, value); 367 return; 368 case 1: 369 SET_HIGH(tcr, value); 370 return; 371 case 4: /* RCR */ 372 SET_LOW(rcr, value); 373 return; 374 case 5: 375 SET_HIGH(rcr, value); 376 if (s->rcr & RCR_SOFT_RST) { 377 smc91c111_reset(DEVICE(s)); 378 } 379 smc91c111_flush_queued_packets(s); 380 return; 381 case 10: case 11: /* RPCR */ 382 /* Ignored */ 383 return; 384 case 12: case 13: /* Reserved */ 385 return; 386 } 387 break; 388 389 case 1: 390 switch (offset) { 391 case 0: /* CONFIG */ 392 SET_LOW(cr, value); 393 return; 394 case 1: 395 SET_HIGH(cr,value); 396 return; 397 case 2: case 3: /* BASE */ 398 case 4: case 5: case 6: case 7: case 8: case 9: /* IA */ 399 /* Not implemented. */ 400 return; 401 case 10: /* General Purpose */ 402 SET_LOW(gpr, value); 403 return; 404 case 11: 405 SET_HIGH(gpr, value); 406 return; 407 case 12: /* Control */ 408 if (value & 1) { 409 qemu_log_mask(LOG_UNIMP, 410 "smc91c111: EEPROM store not implemented\n"); 411 } 412 if (value & 2) { 413 qemu_log_mask(LOG_UNIMP, 414 "smc91c111: EEPROM reload not implemented\n"); 415 } 416 value &= ~3; 417 SET_LOW(ctr, value); 418 return; 419 case 13: 420 SET_HIGH(ctr, value); 421 return; 422 } 423 break; 424 425 case 2: 426 switch (offset) { 427 case 0: /* MMU Command */ 428 switch (value >> 5) { 429 case 0: /* no-op */ 430 break; 431 case 1: /* Allocate for TX. */ 432 s->tx_alloc = 0x80; 433 s->int_level &= ~INT_ALLOC; 434 smc91c111_update(s); 435 smc91c111_tx_alloc(s); 436 break; 437 case 2: /* Reset MMU. */ 438 s->allocated = 0; 439 s->tx_fifo_len = 0; 440 s->tx_fifo_done_len = 0; 441 s->rx_fifo_len = 0; 442 s->tx_alloc = 0; 443 break; 444 case 3: /* Remove from RX FIFO. */ 445 smc91c111_pop_rx_fifo(s); 446 break; 447 case 4: /* Remove from RX FIFO and release. */ 448 if (s->rx_fifo_len > 0) { 449 smc91c111_release_packet(s, s->rx_fifo[0]); 450 } 451 smc91c111_pop_rx_fifo(s); 452 break; 453 case 5: /* Release. */ 454 smc91c111_release_packet(s, s->packet_num); 455 break; 456 case 6: /* Add to TX FIFO. */ 457 smc91c111_queue_tx(s, s->packet_num); 458 break; 459 case 7: /* Reset TX FIFO. */ 460 s->tx_fifo_len = 0; 461 s->tx_fifo_done_len = 0; 462 break; 463 } 464 return; 465 case 1: 466 /* Ignore. */ 467 return; 468 case 2: /* Packet Number Register */ 469 s->packet_num = value; 470 return; 471 case 3: case 4: case 5: 472 /* Should be readonly, but linux writes to them anyway. Ignore. */ 473 return; 474 case 6: /* Pointer */ 475 SET_LOW(ptr, value); 476 return; 477 case 7: 478 SET_HIGH(ptr, value); 479 return; 480 case 8: case 9: case 10: case 11: /* Data */ 481 { 482 int p; 483 int n; 484 485 if (s->ptr & 0x8000) 486 n = s->rx_fifo[0]; 487 else 488 n = s->packet_num; 489 if (!packetnum_valid(n)) { 490 /* Datasheet doesn't document what to do here */ 491 qemu_log_mask(LOG_GUEST_ERROR, 492 "smc91c111: attempt to write data to invalid packet %d\n", 493 n); 494 return; 495 } 496 p = s->ptr & 0x07ff; 497 if (s->ptr & 0x4000) { 498 s->ptr = (s->ptr & 0xf800) | ((s->ptr + 1) & 0x7ff); 499 } else { 500 p += (offset & 3); 501 } 502 s->data[n][p] = value; 503 } 504 return; 505 case 12: /* Interrupt ACK. */ 506 s->int_level &= ~(value & 0xd6); 507 if (value & INT_TX) 508 smc91c111_pop_tx_fifo_done(s); 509 smc91c111_update(s); 510 return; 511 case 13: /* Interrupt mask. */ 512 s->int_mask = value; 513 smc91c111_update(s); 514 return; 515 } 516 break; 517 518 case 3: 519 switch (offset) { 520 case 0: case 1: case 2: case 3: case 4: case 5: case 6: case 7: 521 /* Multicast table. */ 522 /* Not implemented. */ 523 return; 524 case 8: case 9: /* Management Interface. */ 525 /* Not implemented. */ 526 return; 527 case 12: /* Early receive. */ 528 s->ercv = value & 0x1f; 529 return; 530 case 13: 531 /* Ignore. */ 532 return; 533 } 534 break; 535 } 536 qemu_log_mask(LOG_GUEST_ERROR, "smc91c111_write(bank:%d) Illegal register" 537 " 0x%" HWADDR_PRIx " = 0x%x\n", 538 s->bank, offset, value); 539 } 540 541 static uint32_t smc91c111_readb(void *opaque, hwaddr offset) 542 { 543 smc91c111_state *s = (smc91c111_state *)opaque; 544 545 offset = offset & 0xf; 546 if (offset == 14) { 547 return s->bank; 548 } 549 if (offset == 15) 550 return 0x33; 551 switch (s->bank) { 552 case 0: 553 switch (offset) { 554 case 0: /* TCR */ 555 return s->tcr & 0xff; 556 case 1: 557 return s->tcr >> 8; 558 case 2: /* EPH Status */ 559 return 0; 560 case 3: 561 return 0x40; 562 case 4: /* RCR */ 563 return s->rcr & 0xff; 564 case 5: 565 return s->rcr >> 8; 566 case 6: /* Counter */ 567 case 7: 568 /* Not implemented. */ 569 return 0; 570 case 8: /* Memory size. */ 571 return NUM_PACKETS; 572 case 9: /* Free memory available. */ 573 { 574 int i; 575 int n; 576 n = 0; 577 for (i = 0; i < NUM_PACKETS; i++) { 578 if (s->allocated & (1 << i)) 579 n++; 580 } 581 return n; 582 } 583 case 10: case 11: /* RPCR */ 584 /* Not implemented. */ 585 return 0; 586 case 12: case 13: /* Reserved */ 587 return 0; 588 } 589 break; 590 591 case 1: 592 switch (offset) { 593 case 0: /* CONFIG */ 594 return s->cr & 0xff; 595 case 1: 596 return s->cr >> 8; 597 case 2: case 3: /* BASE */ 598 /* Not implemented. */ 599 return 0; 600 case 4: case 5: case 6: case 7: case 8: case 9: /* IA */ 601 return s->conf.macaddr.a[offset - 4]; 602 case 10: /* General Purpose */ 603 return s->gpr & 0xff; 604 case 11: 605 return s->gpr >> 8; 606 case 12: /* Control */ 607 return s->ctr & 0xff; 608 case 13: 609 return s->ctr >> 8; 610 } 611 break; 612 613 case 2: 614 switch (offset) { 615 case 0: case 1: /* MMUCR Busy bit. */ 616 return 0; 617 case 2: /* Packet Number. */ 618 return s->packet_num; 619 case 3: /* Allocation Result. */ 620 return s->tx_alloc; 621 case 4: /* TX FIFO */ 622 if (s->tx_fifo_done_len == 0) 623 return 0x80; 624 else 625 return s->tx_fifo_done[0]; 626 case 5: /* RX FIFO */ 627 if (s->rx_fifo_len == 0) 628 return 0x80; 629 else 630 return s->rx_fifo[0]; 631 case 6: /* Pointer */ 632 return s->ptr & 0xff; 633 case 7: 634 return (s->ptr >> 8) & 0xf7; 635 case 8: case 9: case 10: case 11: /* Data */ 636 { 637 int p; 638 int n; 639 640 if (s->ptr & 0x8000) 641 n = s->rx_fifo[0]; 642 else 643 n = s->packet_num; 644 if (!packetnum_valid(n)) { 645 /* Datasheet doesn't document what to do here */ 646 qemu_log_mask(LOG_GUEST_ERROR, 647 "smc91c111: attempt to read data from invalid packet %d\n", 648 n); 649 return 0; 650 } 651 p = s->ptr & 0x07ff; 652 if (s->ptr & 0x4000) { 653 s->ptr = (s->ptr & 0xf800) | ((s->ptr + 1) & 0x07ff); 654 } else { 655 p += (offset & 3); 656 } 657 return s->data[n][p]; 658 } 659 case 12: /* Interrupt status. */ 660 return s->int_level; 661 case 13: /* Interrupt mask. */ 662 return s->int_mask; 663 } 664 break; 665 666 case 3: 667 switch (offset) { 668 case 0: case 1: case 2: case 3: case 4: case 5: case 6: case 7: 669 /* Multicast table. */ 670 /* Not implemented. */ 671 return 0; 672 case 8: /* Management Interface. */ 673 /* Not implemented. */ 674 return 0x30; 675 case 9: 676 return 0x33; 677 case 10: /* Revision. */ 678 return 0x91; 679 case 11: 680 return 0x33; 681 case 12: 682 return s->ercv; 683 case 13: 684 return 0; 685 } 686 break; 687 } 688 qemu_log_mask(LOG_GUEST_ERROR, "smc91c111_read(bank:%d) Illegal register" 689 " 0x%" HWADDR_PRIx "\n", 690 s->bank, offset); 691 return 0; 692 } 693 694 static uint64_t smc91c111_readfn(void *opaque, hwaddr addr, unsigned size) 695 { 696 int i; 697 uint32_t val = 0; 698 699 for (i = 0; i < size; i++) { 700 val |= smc91c111_readb(opaque, addr + i) << (i * 8); 701 } 702 return val; 703 } 704 705 static void smc91c111_writefn(void *opaque, hwaddr addr, 706 uint64_t value, unsigned size) 707 { 708 int i = 0; 709 710 /* 32-bit writes to offset 0xc only actually write to the bank select 711 * register (offset 0xe), so skip the first two bytes we would write. 712 */ 713 if (addr == 0xc && size == 4) { 714 i += 2; 715 } 716 717 for (; i < size; i++) { 718 smc91c111_writeb(opaque, addr + i, 719 extract32(value, i * 8, 8)); 720 } 721 } 722 723 static bool smc91c111_can_receive_nc(NetClientState *nc) 724 { 725 smc91c111_state *s = qemu_get_nic_opaque(nc); 726 727 return smc91c111_can_receive(s); 728 } 729 730 static ssize_t smc91c111_receive(NetClientState *nc, const uint8_t *buf, size_t size) 731 { 732 smc91c111_state *s = qemu_get_nic_opaque(nc); 733 int status; 734 int packetsize; 735 uint32_t crc; 736 int packetnum; 737 uint8_t *p; 738 739 if ((s->rcr & RCR_RXEN) == 0 || (s->rcr & RCR_SOFT_RST)) 740 return -1; 741 /* Short packets are padded with zeros. Receiving a packet 742 < 64 bytes long is considered an error condition. */ 743 if (size < 64) 744 packetsize = 64; 745 else 746 packetsize = (size & ~1); 747 packetsize += 6; 748 crc = (s->rcr & RCR_STRIP_CRC) == 0; 749 if (crc) 750 packetsize += 4; 751 /* TODO: Flag overrun and receive errors. */ 752 if (packetsize > 2048) 753 return -1; 754 packetnum = smc91c111_allocate_packet(s); 755 if (packetnum == 0x80) 756 return -1; 757 s->rx_fifo[s->rx_fifo_len++] = packetnum; 758 759 /* allocate_packet() will not hand us back an invalid packet number */ 760 assert(packetnum_valid(packetnum)); 761 p = &s->data[packetnum][0]; 762 /* ??? Multicast packets? */ 763 status = 0; 764 if (size > 1518) 765 status |= RS_TOOLONG; 766 if (size & 1) 767 status |= RS_ODDFRAME; 768 *(p++) = status & 0xff; 769 *(p++) = status >> 8; 770 *(p++) = packetsize & 0xff; 771 *(p++) = packetsize >> 8; 772 memcpy(p, buf, size & ~1); 773 p += (size & ~1); 774 /* Pad short packets. */ 775 if (size < 64) { 776 int pad; 777 778 if (size & 1) 779 *(p++) = buf[size - 1]; 780 pad = 64 - size; 781 memset(p, 0, pad); 782 p += pad; 783 size = 64; 784 } 785 /* It's not clear if the CRC should go before or after the last byte in 786 odd sized packets. Linux disables the CRC, so that's no help. 787 The pictures in the documentation show the CRC aligned on a 16-bit 788 boundary before the last odd byte, so that's what we do. */ 789 if (crc) { 790 crc = crc32(~0, buf, size); 791 *(p++) = crc & 0xff; crc >>= 8; 792 *(p++) = crc & 0xff; crc >>= 8; 793 *(p++) = crc & 0xff; crc >>= 8; 794 *(p++) = crc & 0xff; 795 } 796 if (size & 1) { 797 *(p++) = buf[size - 1]; 798 *p = 0x60; 799 } else { 800 *(p++) = 0; 801 *p = 0x40; 802 } 803 /* TODO: Raise early RX interrupt? */ 804 s->int_level |= INT_RCV; 805 smc91c111_update(s); 806 807 return size; 808 } 809 810 static const MemoryRegionOps smc91c111_mem_ops = { 811 /* The special case for 32 bit writes to 0xc means we can't just 812 * set .impl.min/max_access_size to 1, unfortunately 813 */ 814 .read = smc91c111_readfn, 815 .write = smc91c111_writefn, 816 .valid.min_access_size = 1, 817 .valid.max_access_size = 4, 818 .endianness = DEVICE_NATIVE_ENDIAN, 819 }; 820 821 static NetClientInfo net_smc91c111_info = { 822 .type = NET_CLIENT_DRIVER_NIC, 823 .size = sizeof(NICState), 824 .can_receive = smc91c111_can_receive_nc, 825 .receive = smc91c111_receive, 826 }; 827 828 static void smc91c111_realize(DeviceState *dev, Error **errp) 829 { 830 SysBusDevice *sbd = SYS_BUS_DEVICE(dev); 831 smc91c111_state *s = SMC91C111(dev); 832 833 memory_region_init_io(&s->mmio, OBJECT(s), &smc91c111_mem_ops, s, 834 "smc91c111-mmio", 16); 835 sysbus_init_mmio(sbd, &s->mmio); 836 sysbus_init_irq(sbd, &s->irq); 837 qemu_macaddr_default_if_unset(&s->conf.macaddr); 838 s->nic = qemu_new_nic(&net_smc91c111_info, &s->conf, 839 object_get_typename(OBJECT(dev)), dev->id, 840 &dev->mem_reentrancy_guard, s); 841 qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a); 842 /* ??? Save/restore. */ 843 } 844 845 static const Property smc91c111_properties[] = { 846 DEFINE_NIC_PROPERTIES(smc91c111_state, conf), 847 }; 848 849 static void smc91c111_class_init(ObjectClass *klass, void *data) 850 { 851 DeviceClass *dc = DEVICE_CLASS(klass); 852 853 dc->realize = smc91c111_realize; 854 device_class_set_legacy_reset(dc, smc91c111_reset); 855 dc->vmsd = &vmstate_smc91c111; 856 device_class_set_props(dc, smc91c111_properties); 857 } 858 859 static const TypeInfo smc91c111_info = { 860 .name = TYPE_SMC91C111, 861 .parent = TYPE_SYS_BUS_DEVICE, 862 .instance_size = sizeof(smc91c111_state), 863 .class_init = smc91c111_class_init, 864 }; 865 866 static void smc91c111_register_types(void) 867 { 868 type_register_static(&smc91c111_info); 869 } 870 871 /* Legacy helper function. Should go away when machine config files are 872 implemented. */ 873 void smc91c111_init(uint32_t base, qemu_irq irq) 874 { 875 DeviceState *dev; 876 SysBusDevice *s; 877 878 dev = qdev_new(TYPE_SMC91C111); 879 qemu_configure_nic_device(dev, true, NULL); 880 s = SYS_BUS_DEVICE(dev); 881 sysbus_realize_and_unref(s, &error_fatal); 882 sysbus_mmio_map(s, 0, base); 883 sysbus_connect_irq(s, 0, irq); 884 } 885 886 type_init(smc91c111_register_types) 887