[qemu.git] / hw / smc91c111.c

/* 
 * SMSC 91C111 Ethernet interface emulation
 *
 * Copyright (c) 2005 CodeSourcery, LLC.
 * Written by Paul Brook
 *
 * This code is licenced under the GPL
 */

#include "vl.h"
/* For crc32 */
#include <zlib.h>

/* Number of 2k memory pages available.  */
#define NUM_PACKETS 4

typedef struct {
    uint32_t base;
    VLANClientState *vc;
    uint16_t tcr;
    uint16_t rcr;
    uint16_t cr;
    uint16_t ctr;
    uint16_t gpr;
    uint16_t ptr;
    uint16_t ercv;
    void *pic;
    int irq;
    int bank;
    int packet_num;
    int tx_alloc;
    /* Bitmask of allocated packets.  */
    int allocated;
    int tx_fifo_len;
    int tx_fifo[NUM_PACKETS];
    int rx_fifo_len;
    int rx_fifo[NUM_PACKETS];
    int tx_fifo_done_len;
    int tx_fifo_done[NUM_PACKETS];
    /* Packet buffer memory.  */
    uint8_t data[NUM_PACKETS][2048];
    uint8_t int_level;
    uint8_t int_mask;
    uint8_t macaddr[6];
} smc91c111_state;

#define RCR_SOFT_RST  0x8000
#define RCR_STRIP_CRC 0x0200
#define RCR_RXEN      0x0100

#define TCR_EPH_LOOP  0x2000
#define TCR_NOCRC     0x0100
#define TCR_PAD_EN    0x0080
#define TCR_FORCOL    0x0004
#define TCR_LOOP      0x0002
#define TCR_TXEN      0x0001

#define INT_MD        0x80
#define INT_ERCV      0x40
#define INT_EPH       0x20
#define INT_RX_OVRN   0x10
#define INT_ALLOC     0x08
#define INT_TX_EMPTY  0x04
#define INT_TX        0x02
#define INT_RCV       0x01

#define CTR_AUTO_RELEASE  0x0800
#define CTR_RELOAD        0x0002
#define CTR_STORE         0x0001

#define RS_ALGNERR      0x8000
#define RS_BRODCAST     0x4000
#define RS_BADCRC       0x2000
#define RS_ODDFRAME     0x1000
#define RS_TOOLONG      0x0800
#define RS_TOOSHORT     0x0400
#define RS_MULTICAST    0x0001

/* Update interrupt status.  */
static void smc91c111_update(smc91c111_state *s)
{
    int level;

    if (s->tx_fifo_len == 0)
        s->int_level |= INT_TX_EMPTY;
    if (s->tx_fifo_done_len != 0)
        s->int_level |= INT_TX;
    level = (s->int_level & s->int_mask) != 0;
    pic_set_irq_new(s->pic, s->irq, level);
}

/* Try to allocate a packet.  Returns 0x80 on failure.  */
static int smc91c111_allocate_packet(smc91c111_state *s)
{
    int i;
    if (s->allocated == (1 << NUM_PACKETS) - 1) {
        return 0x80;
    }

    for (i = 0; i < NUM_PACKETS; i++) {
        if ((s->allocated & (1 << i)) == 0)
            break;
    }
    s->allocated |= 1 << i;
    return i;
}


/* Process a pending TX allocate.  */
static void smc91c111_tx_alloc(smc91c111_state *s)
{
    s->tx_alloc = smc91c111_allocate_packet(s);
    if (s->tx_alloc == 0x80)
        return;
    s->int_level |= INT_ALLOC;
    smc91c111_update(s);
}

/* Remove and item from the RX FIFO.  */
static void smc91c111_pop_rx_fifo(smc91c111_state *s)
{
    int i;

    s->rx_fifo_len--;
    if (s->rx_fifo_len) {
        for (i = 0; i < s->rx_fifo_len; i++)
            s->rx_fifo[i] = s->rx_fifo[i + 1];
        s->int_level |= INT_RCV;
    } else {
        s->int_level &= ~INT_RCV;
    }
    smc91c111_update(s);
}

/* Remove an item from the TX completion FIFO.  */
static void smc91c111_pop_tx_fifo_done(smc91c111_state *s)
{
    int i;

    if (s->tx_fifo_done_len == 0)
        return;
    s->tx_fifo_done_len--;
    for (i = 0; i < s->tx_fifo_done_len; i++)
        s->tx_fifo_done[i] = s->tx_fifo_done[i + 1];
}

/* Release the memory allocated to a packet.  */
static void smc91c111_release_packet(smc91c111_state *s, int packet)
{
    s->allocated &= ~(1 << packet);
    if (s->tx_alloc == 0x80)
        smc91c111_tx_alloc(s);
}

/* Flush the TX FIFO.  */
static void smc91c111_do_tx(smc91c111_state *s)
{
    int i;
    int len;
    int control;
    int add_crc;
    uint32_t crc;
    int packetnum;
    uint8_t *p;

    if ((s->tcr & TCR_TXEN) == 0)
        return;
    if (s->tx_fifo_len == 0)
        return;
    for (i = 0; i < s->tx_fifo_len; i++) {
        packetnum = s->tx_fifo[i];
        p = &s->data[packetnum][0];
        /* Set status word.  */
        *(p++) = 0x01;
        *(p++) = 0x40;
        len = *(p++);
        len |= ((int)*(p++)) << 8;
        len -= 6;
        control = p[len + 1];
        if (control & 0x20)
            len++;
        /* ??? This overwrites the data following the buffer.
           Don't know what real hardware does.  */
        if (len < 64 && (s->tcr & TCR_PAD_EN)) {
            memset(p + len, 0, 64 - len);
            len = 64;
        }
#if 0
        /* The card is supposed to append the CRC to the frame.  However
           none of the other network traffic has the CRC appended.
           Suspect this is low level ethernet detail we don't need to worry
           about.  */
        add_crc = (control & 0x10) || (s->tcr & TCR_NOCRC) == 0;
        if (add_crc) {
            crc = crc32(~0, p, len);
            memcpy(p + len, &crc, 4);
            len += 4;
        }
#else
        add_crc = 0;
#endif
        if (s->ctr & CTR_AUTO_RELEASE)
            /* Race?  */
            smc91c111_release_packet(s, packetnum);
        else if (s->tx_fifo_done_len < NUM_PACKETS)
            s->tx_fifo_done[s->tx_fifo_done_len++] = packetnum;
        qemu_send_packet(s->vc, p, len);
    }
    s->tx_fifo_len = 0;
    smc91c111_update(s);
}

/* Add a packet to the TX FIFO.  */
static void smc91c111_queue_tx(smc91c111_state *s, int packet)
{
    if (s->tx_fifo_len == NUM_PACKETS)
        return;
    s->tx_fifo[s->tx_fifo_len++] = packet;
    smc91c111_do_tx(s);
}

static void smc91c111_reset(smc91c111_state *s)
{
    s->bank = 0;
    s->tx_fifo_len = 0;
    s->tx_fifo_done_len = 0;
    s->rx_fifo_len = 0;
    s->allocated = 0;
    s->packet_num = 0;
    s->tx_alloc = 0;
    s->tcr = 0;
    s->rcr = 0;
    s->cr = 0xa0b1;
    s->ctr = 0x1210;
    s->ptr = 0;
    s->ercv = 0x1f;
    s->int_level = INT_TX_EMPTY;
    s->int_mask = 0;
    smc91c111_update(s);
}

#define SET_LOW(name, val) s->name = (s->name & 0xff00) | val
#define SET_HIGH(name, val) s->name = (s->name & 0xff) | (val << 8)

static void smc91c111_writeb(void *opaque, target_phys_addr_t offset,
                             uint32_t value)
{
    smc91c111_state *s = (smc91c111_state *)opaque;

    offset -= s->base;
    if (offset == 14) {
        s->bank = value;
        return;
    }
    if (offset == 15)
        return;
    switch (s->bank) {
    case 0:
        switch (offset) {
        case 0: /* TCR */
            SET_LOW(tcr, value);
            return;
        case 1:
            SET_HIGH(tcr, value);
            return;
        case 4: /* RCR */
            SET_LOW(rcr, value);
            return;
        case 5:
            SET_HIGH(rcr, value);
            if (s->rcr & RCR_SOFT_RST)
                smc91c111_reset(s);
            return;
        case 10: case 11: /* RPCR */
            /* Ignored */
            return;
        }
        break;

    case 1:
        switch (offset) {
        case 0: /* CONFIG */
            SET_LOW(cr, value);
            return;
        case 1:
            SET_HIGH(cr,value);
            return;
        case 2: case 3: /* BASE */
        case 4: case 5: case 6: case 7: case 8: case 9: /* IA */
            /* Not implemented.  */
            return;
        case 10: /* Genral Purpose */
            SET_LOW(gpr, value);
            return;
        case 11:
            SET_HIGH(gpr, value);
            return;
        case 12: /* Control */
            if (value & 1)
                fprintf(stderr, "smc91c111:EEPROM store not implemented\n");
            if (value & 2)
                fprintf(stderr, "smc91c111:EEPROM reload not implemented\n");
            value &= ~3;
            SET_LOW(ctr, value);
            return;
        case 13:
            SET_HIGH(ctr, value);
            return;
        }
        break;

    case 2:
        switch (offset) {
        case 0: /* MMU Command */
            switch (value >> 5) {
            case 0: /* no-op */
                break;
            case 1: /* Allocate for TX.  */
                s->tx_alloc = 0x80;
                s->int_level &= ~INT_ALLOC;
                smc91c111_update(s);
                smc91c111_tx_alloc(s);
                break;
            case 2: /* Reset MMU.  */
                s->allocated = 0;
                s->tx_fifo_len = 0;
                s->tx_fifo_done_len = 0;
                s->rx_fifo_len = 0;
                s->tx_alloc = 0;
                break;
            case 3: /* Remove from RX FIFO.  */
                smc91c111_pop_rx_fifo(s);
                break;
            case 4: /* Remove from RX FIFO and release.  */
                if (s->rx_fifo_len > 0) {
                    smc91c111_release_packet(s, s->rx_fifo[0]);
                }
                smc91c111_pop_rx_fifo(s);
                break;
            case 5: /* Release.  */
                smc91c111_release_packet(s, s->packet_num);
                break;
            case 6: /* Add to TX FIFO.  */
                smc91c111_queue_tx(s, s->packet_num);
                break;
            case 7: /* Reset TX FIFO.  */
                s->tx_fifo_len = 0;
                s->tx_fifo_done_len = 0;
                break;
            }
            return;
        case 1:
            /* Ignore.  */
            return;
        case 2: /* Packet Number Register */
            s->packet_num = value;
            return;
        case 3: case 4: case 5:
            /* Should be readonly, but linux writes to them anyway. Ignore.  */
            return;
        case 6: /* Pointer */
            SET_LOW(ptr, value);
            return;
        case 7:
            SET_HIGH(ptr, value);
            return;
        case 8: case 9: case 10: case 11: /* Data */
            {
                int p;
                int n;

                if (s->ptr & 0x8000)
                    n = s->rx_fifo[0];
                else
                    n = s->packet_num;
                p = s->ptr & 0x07ff;
                if (s->ptr & 0x4000) {
                    s->ptr = (s->ptr & 0xf800) | ((s->ptr + 1) & 0x7ff);
                } else {
                    p += (offset & 3);
                }
                s->data[n][p] = value;
            }
            return;
        case 12: /* Interrupt ACK.  */
            s->int_level &= ~(value & 0xd6);
            if (value & INT_TX)
                smc91c111_pop_tx_fifo_done(s);
            smc91c111_update(s);
            return;
        case 13: /* Interrupt mask.  */
            s->int_mask = value;
            smc91c111_update(s);
            return;
        }
        break;;

    case 3:
        switch (offset) {
        case 0: case 1: case 2: case 3: case 4: case 5: case 6: case 7:
            /* Multicast table.  */
            /* Not implemented.  */
            return;
        case 8: case 9: /* Management Interface.  */
            /* Not implemented.  */
            return;
        case 12: /* Early receive.  */
            s->ercv = value & 0x1f;
        case 13:
            /* Ignore.  */
            return;
        }
        break;
    }
    cpu_abort (cpu_single_env, "smc91c111_write: Bad reg %d:%x\n",
               s->bank, offset);
}

static uint32_t smc91c111_readb(void *opaque, target_phys_addr_t offset)
{
    smc91c111_state *s = (smc91c111_state *)opaque;

    offset -= s->base;
    if (offset == 14) {
        return s->bank;
    }
    if (offset == 15)
        return 0x33;
    switch (s->bank) {
    case 0:
        switch (offset) {
        case 0: /* TCR */
            return s->tcr & 0xff;
        case 1:
            return s->tcr >> 8;
        case 2: /* EPH Status */
            return 0;
        case 3:
            return 0x40;
        case 4: /* RCR */
            return s->rcr & 0xff;
        case 5:
            return s->rcr >> 8;
        case 6: /* Counter */
        case 7:
            /* Not implemented.  */
            return 0;
        case 8: /* Free memory available.  */
            {
                int i;
                int n;
                n = 0;
                for (i = 0; i < NUM_PACKETS; i++) {
                    if (s->allocated & (1 << i))
                        n++;
                }
                return n;
            }
        case 9: /* Memory size.  */
            return NUM_PACKETS;
        case 10: case 11: /* RPCR */
            /* Not implemented.  */
            return 0;
        }
        break;

    case 1:
        switch (offset) {
        case 0: /* CONFIG */
            return s->cr & 0xff;
        case 1:
            return s->cr >> 8;
        case 2: case 3: /* BASE */
            /* Not implemented.  */
            return 0;
        case 4: case 5: case 6: case 7: case 8: case 9: /* IA */
            return s->macaddr[offset - 4];
        case 10: /* General Purpose */
            return s->gpr & 0xff;
        case 11:
            return s->gpr >> 8;
        case 12: /* Control */
            return s->ctr & 0xff;
        case 13:
            return s->ctr >> 8;
        }
        break;

    case 2:
        switch (offset) {
        case 0: case 1: /* MMUCR Busy bit.  */
            return 0;
        case 2: /* Packet Number.  */
            return s->packet_num;
        case 3: /* Allocation Result.  */
            return s->tx_alloc;
        case 4: /* TX FIFO */
            if (s->tx_fifo_done_len == 0)
                return 0x80;
            else
                return s->tx_fifo_done[0];
        case 5: /* RX FIFO */
            if (s->rx_fifo_len == 0)
                return 0x80;
            else
                return s->rx_fifo[0];
        case 6: /* Pointer */
            return s->ptr & 0xff;
        case 7:
            return (s->ptr >> 8) & 0xf7;
        case 8: case 9: case 10: case 11: /* Data */
            {
                int p;
                int n;

                if (s->ptr & 0x8000)
                    n = s->rx_fifo[0];
                else
                    n = s->packet_num;
                p = s->ptr & 0x07ff;
                if (s->ptr & 0x4000) {
                    s->ptr = (s->ptr & 0xf800) | ((s->ptr + 1) & 0x07ff);
                } else {
                    p += (offset & 3);
                }
                return s->data[n][p];
            }
        case 12: /* Interrupt status.  */
            return s->int_level;
        case 13: /* Interrupt mask.  */
            return s->int_mask;
        }
        break;

    case 3:
        switch (offset) {
        case 0: case 1: case 2: case 3: case 4: case 5: case 6: case 7:
            /* Multicast table.  */
            /* Not implemented.  */
            return 0;
        case 8: /* Management Interface.  */
            /* Not implemented.  */
            return 0x30;
        case 9:
            return 0x33;
        case 10: /* Revision.  */
            return 0x91;
        case 11:
            return 0x33;
        case 12:
            return s->ercv;
        case 13:
            return 0;
        }
        break;
    }
    cpu_abort (cpu_single_env, "smc91c111_read: Bad reg %d:%x\n",
               s->bank, offset);
    return 0;
}

static void smc91c111_writew(void *opaque, target_phys_addr_t offset,
                             uint32_t value)
{
    smc91c111_writeb(opaque, offset, value & 0xff);
    smc91c111_writeb(opaque, offset + 1, value >> 8);
}

static void smc91c111_writel(void *opaque, target_phys_addr_t offset,
                             uint32_t value)
{
    smc91c111_state *s = (smc91c111_state *)opaque;
    /* 32-bit writes to offset 0xc only actually write to the bank select
       register (offset 0xe)  */
    if (offset != s->base + 0xc)
        smc91c111_writew(opaque, offset, value & 0xffff);
    smc91c111_writew(opaque, offset + 2, value >> 16);
}

static uint32_t smc91c111_readw(void *opaque, target_phys_addr_t offset)
{
    uint32_t val;
    val = smc91c111_readb(opaque, offset);
    val |= smc91c111_readb(opaque, offset + 1) << 8;
    return val;
}

static uint32_t smc91c111_readl(void *opaque, target_phys_addr_t offset)
{
    uint32_t val;
    val = smc91c111_readw(opaque, offset);
    val |= smc91c111_readw(opaque, offset + 2) << 16;
    return val;
}

static int smc91c111_can_receive(void *opaque)
{
    smc91c111_state *s = (smc91c111_state *)opaque;

    if ((s->rcr & RCR_RXEN) == 0 || (s->rcr & RCR_SOFT_RST))
        return 1;
    if (s->allocated == (1 << NUM_PACKETS) - 1)
        return 0;
    return 1;
}

static void smc91c111_receive(void *opaque, const uint8_t *buf, int size)
{
    smc91c111_state *s = (smc91c111_state *)opaque;
    int status;
    int packetsize;
    uint32_t crc;
    int packetnum;
    uint8_t *p;

    if ((s->rcr & RCR_RXEN) == 0 || (s->rcr & RCR_SOFT_RST))
        return;
    /* Short packets are padded with zeros.  Recieveing a packet
       < 64 bytes long is considered an error condition.  */
    if (size < 64)
        packetsize = 64;
    else
        packetsize = (size & ~1);
    packetsize += 6;
    crc = (s->rcr & RCR_STRIP_CRC) == 0;
    if (crc)
        packetsize += 4;
    /* TODO: Flag overrun and receive errors.  */
    if (packetsize > 2048)
        return;
    packetnum = smc91c111_allocate_packet(s);
    if (packetnum == 0x80)
        return;
    s->rx_fifo[s->rx_fifo_len++] = packetnum;

    p = &s->data[packetnum][0];
    /* ??? Multicast packets?  */
    status = 0;
    if (size > 1518)
        status |= RS_TOOLONG;
    if (size & 1)
        status |= RS_ODDFRAME;
    *(p++) = status & 0xff;
    *(p++) = status >> 8;
    *(p++) = packetsize & 0xff;
    *(p++) = packetsize >> 8;
    memcpy(p, buf, size & ~1);
    p += (size & ~1);
    /* Pad short packets.  */
    if (size < 64) {
        int pad;
        
        if (size & 1)
            *(p++) = buf[size - 1];
        pad = 64 - size;
        memset(p, 0, pad);
        p += pad;
        size = 64;
    }
    /* It's not clear if the CRC should go before or after the last byte in
       odd sized packets.  Linux disables the CRC, so that's no help.
       The pictures in the documentation show the CRC aligned on a 16-bit
       boundary before the last odd byte, so that's what we do.  */
    if (crc) {
        crc = crc32(~0, buf, size);
        *(p++) = crc & 0xff; crc >>= 8;
        *(p++) = crc & 0xff; crc >>= 8;
        *(p++) = crc & 0xff; crc >>= 8;
        *(p++) = crc & 0xff; crc >>= 8;
    }
    if (size & 1) {
        *(p++) = buf[size - 1];
        *(p++) = 0x60;
    } else {
        *(p++) = 0;
        *(p++) = 0x40;
    }
    /* TODO: Raise early RX interrupt?  */
    s->int_level |= INT_RCV;
    smc91c111_update(s);
}

static CPUReadMemoryFunc *smc91c111_readfn[] = {
    smc91c111_readb,
    smc91c111_readw,
    smc91c111_readl
};

static CPUWriteMemoryFunc *smc91c111_writefn[] = {
    smc91c111_writeb,
    smc91c111_writew,
    smc91c111_writel
};

void smc91c111_init(NICInfo *nd, uint32_t base, void *pic, int irq)
{
    smc91c111_state *s;
    int iomemtype;

    s = (smc91c111_state *)qemu_mallocz(sizeof(smc91c111_state));
    iomemtype = cpu_register_io_memory(0, smc91c111_readfn,
                                       smc91c111_writefn, s);
    cpu_register_physical_memory(base, 16, iomemtype);
    s->base = base;
    s->pic = pic;
    s->irq = irq;
    memcpy(s->macaddr, nd->macaddr, 6);

    smc91c111_reset(s);

    s->vc = qemu_new_vlan_client(nd->vlan, smc91c111_receive,
                                 smc91c111_can_receive, s);
    /* ??? Save/restore.  */
}
Commit	Line	Data
80337b66 FB	1	/*
	2	* SMSC 91C111 Ethernet interface emulation
	3	*
	4	* Copyright (c) 2005 CodeSourcery, LLC.
	5	* Written by Paul Brook
	6	*
	7	* This code is licenced under the GPL
	8	*/
	9
	10	#include "vl.h"
	11	/* For crc32 */
	12	#include <zlib.h>
	13
	14	/* Number of 2k memory pages available. */
	15	#define NUM_PACKETS 4
	16
	17	typedef struct {
	18	uint32_t base;
	19	VLANClientState *vc;
	20	uint16_t tcr;
	21	uint16_t rcr;
	22	uint16_t cr;
	23	uint16_t ctr;
	24	uint16_t gpr;
	25	uint16_t ptr;
	26	uint16_t ercv;
	27	void *pic;
	28	int irq;
	29	int bank;
	30	int packet_num;
	31	int tx_alloc;
	32	/* Bitmask of allocated packets. */
	33	int allocated;
	34	int tx_fifo_len;
	35	int tx_fifo[NUM_PACKETS];
	36	int rx_fifo_len;
	37	int rx_fifo[NUM_PACKETS];
5198cfd9 FB	38	int tx_fifo_done_len;
5198cfd9 FB	39	int tx_fifo_done[NUM_PACKETS];
80337b66	40	/* Packet buffer memory. */
5198cfd9	41	uint8_t data[NUM_PACKETS][2048];
80337b66 FB	42	uint8_t int_level;
	43	uint8_t int_mask;
	44	uint8_t macaddr[6];
	45	} smc91c111_state;
	46
	47	#define RCR_SOFT_RST 0x8000
	48	#define RCR_STRIP_CRC 0x0200
	49	#define RCR_RXEN 0x0100
	50
	51	#define TCR_EPH_LOOP 0x2000
	52	#define TCR_NOCRC 0x0100
	53	#define TCR_PAD_EN 0x0080
	54	#define TCR_FORCOL 0x0004
	55	#define TCR_LOOP 0x0002
	56	#define TCR_TXEN 0x0001
	57
	58	#define INT_MD 0x80
	59	#define INT_ERCV 0x40
	60	#define INT_EPH 0x20
	61	#define INT_RX_OVRN 0x10
	62	#define INT_ALLOC 0x08
	63	#define INT_TX_EMPTY 0x04
	64	#define INT_TX 0x02
	65	#define INT_RCV 0x01
	66
	67	#define CTR_AUTO_RELEASE 0x0800
	68	#define CTR_RELOAD 0x0002
	69	#define CTR_STORE 0x0001
	70
	71	#define RS_ALGNERR 0x8000
	72	#define RS_BRODCAST 0x4000
	73	#define RS_BADCRC 0x2000
	74	#define RS_ODDFRAME 0x1000
	75	#define RS_TOOLONG 0x0800
	76	#define RS_TOOSHORT 0x0400
	77	#define RS_MULTICAST 0x0001
	78
	79	/* Update interrupt status. */
	80	static void smc91c111_update(smc91c111_state *s)
	81	{
	82	int level;
	83
	84	if (s->tx_fifo_len == 0)
	85	s->int_level \|= INT_TX_EMPTY;
5198cfd9 FB	86	if (s->tx_fifo_done_len != 0)
5198cfd9 FB	87	s->int_level \|= INT_TX;
80337b66 FB	88	level = (s->int_level & s->int_mask) != 0;
	89	pic_set_irq_new(s->pic, s->irq, level);
	90	}
	91
	92	/* Try to allocate a packet. Returns 0x80 on failure. */
	93	static int smc91c111_allocate_packet(smc91c111_state *s)
	94	{
	95	int i;
	96	if (s->allocated == (1 << NUM_PACKETS) - 1) {
	97	return 0x80;
	98	}
	99
	100	for (i = 0; i < NUM_PACKETS; i++) {
	101	if ((s->allocated & (1 << i)) == 0)
	102	break;
	103	}
	104	s->allocated \|= 1 << i;
	105	return i;
	106	}
	107
	108
	109	/* Process a pending TX allocate. */
	110	static void smc91c111_tx_alloc(smc91c111_state *s)
	111	{
	112	s->tx_alloc = smc91c111_allocate_packet(s);
	113	if (s->tx_alloc == 0x80)
	114	return;
	115	s->int_level \|= INT_ALLOC;
	116	smc91c111_update(s);
	117	}
	118
	119	/* Remove and item from the RX FIFO. */
	120	static void smc91c111_pop_rx_fifo(smc91c111_state *s)
	121	{
	122	int i;
	123
	124	s->rx_fifo_len--;
	125	if (s->rx_fifo_len) {
	126	for (i = 0; i < s->rx_fifo_len; i++)
	127	s->rx_fifo[i] = s->rx_fifo[i + 1];
	128	s->int_level \|= INT_RCV;
	129	} else {
	130	s->int_level &= ~INT_RCV;
	131	}
	132	smc91c111_update(s);
	133	}
	134
5198cfd9 FB	135	/* Remove an item from the TX completion FIFO. */
	136	static void smc91c111_pop_tx_fifo_done(smc91c111_state *s)
	137	{
	138	int i;
	139
	140	if (s->tx_fifo_done_len == 0)
	141	return;
	142	s->tx_fifo_done_len--;
	143	for (i = 0; i < s->tx_fifo_done_len; i++)
	144	s->tx_fifo_done[i] = s->tx_fifo_done[i + 1];
	145	}
	146
80337b66 FB	147	/* Release the memory allocated to a packet. */
	148	static void smc91c111_release_packet(smc91c111_state *s, int packet)
	149	{
	150	s->allocated &= ~(1 << packet);
	151	if (s->tx_alloc == 0x80)
	152	smc91c111_tx_alloc(s);
	153	}
	154
	155	/* Flush the TX FIFO. */
	156	static void smc91c111_do_tx(smc91c111_state *s)
	157	{
	158	int i;
	159	int len;
	160	int control;
	161	int add_crc;
	162	uint32_t crc;
	163	int packetnum;
	164	uint8_t *p;
	165
	166	if ((s->tcr & TCR_TXEN) == 0)
	167	return;
	168	if (s->tx_fifo_len == 0)
	169	return;
	170	for (i = 0; i < s->tx_fifo_len; i++) {
	171	packetnum = s->tx_fifo[i];
	172	p = &s->data[packetnum][0];
	173	/* Set status word. */
	174	*(p++) = 0x01;
	175	*(p++) = 0x40;
	176	len = *(p++);
	177	len \|= ((int)*(p++)) << 8;
	178	len -= 6;
	179	control = p[len + 1];
	180	if (control & 0x20)
	181	len++;
	182	/* ??? This overwrites the data following the buffer.
	183	Don't know what real hardware does. */
	184	if (len < 64 && (s->tcr & TCR_PAD_EN)) {
	185	memset(p + len, 0, 64 - len);
	186	len = 64;
	187	}
	188	#if 0
	189	/* The card is supposed to append the CRC to the frame. However
	190	none of the other network traffic has the CRC appended.
	191	Suspect this is low level ethernet detail we don't need to worry
	192	about. */
	193	add_crc = (control & 0x10) \|\| (s->tcr & TCR_NOCRC) == 0;
	194	if (add_crc) {
	195	crc = crc32(~0, p, len);
	196	memcpy(p + len, &crc, 4);
	197	len += 4;
	198	}
	199	#else
	200	add_crc = 0;
	201	#endif
	202	if (s->ctr & CTR_AUTO_RELEASE)
5198cfd9	203	/* Race? */
80337b66	204	smc91c111_release_packet(s, packetnum);
5198cfd9 FB	205	else if (s->tx_fifo_done_len < NUM_PACKETS)
5198cfd9 FB	206	s->tx_fifo_done[s->tx_fifo_done_len++] = packetnum;
80337b66 FB	207	qemu_send_packet(s->vc, p, len);
	208	}
	209	s->tx_fifo_len = 0;
80337b66 FB	210	smc91c111_update(s);
	211	}
	212
	213	/* Add a packet to the TX FIFO. */
	214	static void smc91c111_queue_tx(smc91c111_state *s, int packet)
	215	{
	216	if (s->tx_fifo_len == NUM_PACKETS)
	217	return;
	218	s->tx_fifo[s->tx_fifo_len++] = packet;
	219	smc91c111_do_tx(s);
	220	}
	221
	222	static void smc91c111_reset(smc91c111_state *s)
	223	{
	224	s->bank = 0;
	225	s->tx_fifo_len = 0;
5198cfd9	226	s->tx_fifo_done_len = 0;
80337b66 FB	227	s->rx_fifo_len = 0;
	228	s->allocated = 0;
	229	s->packet_num = 0;
	230	s->tx_alloc = 0;
	231	s->tcr = 0;
	232	s->rcr = 0;
	233	s->cr = 0xa0b1;
	234	s->ctr = 0x1210;
	235	s->ptr = 0;
	236	s->ercv = 0x1f;
	237	s->int_level = INT_TX_EMPTY;
	238	s->int_mask = 0;
	239	smc91c111_update(s);
	240	}
	241
	242	#define SET_LOW(name, val) s->name = (s->name & 0xff00) \| val
	243	#define SET_HIGH(name, val) s->name = (s->name & 0xff) \| (val << 8)
	244
	245	static void smc91c111_writeb(void *opaque, target_phys_addr_t offset,
	246	uint32_t value)
	247	{
	248	smc91c111_state s = (smc91c111_state )opaque;
	249
	250	offset -= s->base;
	251	if (offset == 14) {
	252	s->bank = value;
	253	return;
	254	}
	255	if (offset == 15)
	256	return;
	257	switch (s->bank) {
	258	case 0:
	259	switch (offset) {
	260	case 0: /* TCR */
	261	SET_LOW(tcr, value);
	262	return;
	263	case 1:
	264	SET_HIGH(tcr, value);
	265	return;
	266	case 4: /* RCR */
	267	SET_LOW(rcr, value);
	268	return;
	269	case 5:
	270	SET_HIGH(rcr, value);
	271	if (s->rcr & RCR_SOFT_RST)
	272	smc91c111_reset(s);
	273	return;
	274	case 10: case 11: /* RPCR */
	275	/* Ignored */
	276	return;
	277	}
	278	break;
	279
	280	case 1:
	281	switch (offset) {
	282	case 0: /* CONFIG */
	283	SET_LOW(cr, value);
	284	return;
	285	case 1:
	286	SET_HIGH(cr,value);
	287	return;
	288	case 2: case 3: /* BASE */
	289	case 4: case 5: case 6: case 7: case 8: case 9: /* IA */
	290	/* Not implemented. */
291	return;
292	case 10: /* Genral Purpose */
293	SET_LOW(gpr, value);
294	return;
295	case 11:
296	SET_HIGH(gpr, value);
297	return;
298	case 12: /* Control */
299	if (value & 1)
300	fprintf(stderr, "smc91c111:EEPROM store not implemented\n");
301	if (value & 2)
302	fprintf(stderr, "smc91c111:EEPROM reload not implemented\n");
303	value &= ~3;
304	SET_LOW(ctr, value);
305	return;
306	case 13:
307	SET_HIGH(ctr, value);
308	return;
309	}
310	break;
311
312	case 2:
313	switch (offset) {
314	case 0: /* MMU Command */
315	switch (value >> 5) {
316	case 0: /* no-op */
317	break;
318	case 1: /* Allocate for TX. */
319	s->tx_alloc = 0x80;
320	s->int_level &= ~INT_ALLOC;
321	smc91c111_update(s);
322	smc91c111_tx_alloc(s);
323	break;
324	case 2: /* Reset MMU. */
325	s->allocated = 0;
326	s->tx_fifo_len = 0;
5198cfd9	327	s->tx_fifo_done_len = 0;
80337b66 FB	328	s->rx_fifo_len = 0;
	329	s->tx_alloc = 0;
	330	break;
	331	case 3: /* Remove from RX FIFO. */
	332	smc91c111_pop_rx_fifo(s);
	333	break;
	334	case 4: /* Remove from RX FIFO and release. */
	335	if (s->rx_fifo_len > 0) {
	336	smc91c111_release_packet(s, s->rx_fifo[0]);
	337	}
	338	smc91c111_pop_rx_fifo(s);
	339	break;
	340	case 5: /* Release. */
	341	smc91c111_release_packet(s, s->packet_num);
	342	break;
	343	case 6: /* Add to TX FIFO. */
	344	smc91c111_queue_tx(s, s->packet_num);
	345	break;
	346	case 7: /* Reset TX FIFO. */
	347	s->tx_fifo_len = 0;
5198cfd9	348	s->tx_fifo_done_len = 0;
80337b66 FB	349	break;
	350	}
	351	return;
	352	case 1:
	353	/* Ignore. */
	354	return;
	355	case 2: /* Packet Number Register */
	356	s->packet_num = value;
	357	return;
	358	case 3: case 4: case 5:
	359	/* Should be readonly, but linux writes to them anyway. Ignore. */
	360	return;
	361	case 6: /* Pointer */
	362	SET_LOW(ptr, value);
	363	return;
	364	case 7:
	365	SET_HIGH(ptr, value);
	366	return;
	367	case 8: case 9: case 10: case 11: /* Data */
	368	{
	369	int p;
	370	int n;
	371
	372	if (s->ptr & 0x8000)
	373	n = s->rx_fifo[0];
	374	else
	375	n = s->packet_num;
	376	p = s->ptr & 0x07ff;
	377	if (s->ptr & 0x4000) {
	378	s->ptr = (s->ptr & 0xf800) \| ((s->ptr + 1) & 0x7ff);
	379	} else {
	380	p += (offset & 3);
	381	}
	382	s->data[n][p] = value;
	383	}
	384	return;
	385	case 12: /* Interrupt ACK. */
	386	s->int_level &= ~(value & 0xd6);
5198cfd9 FB	387	if (value & INT_TX)
5198cfd9 FB	388	smc91c111_pop_tx_fifo_done(s);
80337b66 FB	389	smc91c111_update(s);
	390	return;
	391	case 13: /* Interrupt mask. */
	392	s->int_mask = value;
	393	smc91c111_update(s);
	394	return;
	395	}
	396	break;;
	397
	398	case 3:
	399	switch (offset) {
	400	case 0: case 1: case 2: case 3: case 4: case 5: case 6: case 7:
	401	/* Multicast table. */
	402	/* Not implemented. */
	403	return;
	404	case 8: case 9: /* Management Interface. */
	405	/* Not implemented. */
	406	return;
	407	case 12: /* Early receive. */
	408	s->ercv = value & 0x1f;
	409	case 13:
	410	/* Ignore. */
	411	return;
	412	}
	413	break;
	414	}
	415	cpu_abort (cpu_single_env, "smc91c111_write: Bad reg %d:%x\n",
	416	s->bank, offset);
	417	}
	418
	419	static uint32_t smc91c111_readb(void *opaque, target_phys_addr_t offset)
	420	{
	421	smc91c111_state s = (smc91c111_state )opaque;
	422
	423	offset -= s->base;
	424	if (offset == 14) {
	425	return s->bank;
	426	}
	427	if (offset == 15)
	428	return 0x33;
	429	switch (s->bank) {
	430	case 0:
	431	switch (offset) {
	432	case 0: /* TCR */
	433	return s->tcr & 0xff;
	434	case 1:
	435	return s->tcr >> 8;
	436	case 2: /* EPH Status */
	437	return 0;
	438	case 3:
	439	return 0x40;
	440	case 4: /* RCR */
	441	return s->rcr & 0xff;
	442	case 5:
	443	return s->rcr >> 8;
	444	case 6: /* Counter */
	445	case 7:
	446	/* Not implemented. */
	447	return 0;
	448	case 8: /* Free memory available. */
	449	{
	450	int i;
	451	int n;
	452	n = 0;
453	for (i = 0; i < NUM_PACKETS; i++) {
454	if (s->allocated & (1 << i))
455	n++;
456	}
457	return n;
458	}
459	case 9: /* Memory size. */
460	return NUM_PACKETS;
461	case 10: case 11: /* RPCR */
462	/* Not implemented. */
463	return 0;
464	}
465	break;
466
467	case 1:
468	switch (offset) {
469	case 0: /* CONFIG */
470	return s->cr & 0xff;
471	case 1:
472	return s->cr >> 8;
473	case 2: case 3: /* BASE */
474	/* Not implemented. */
475	return 0;
476	case 4: case 5: case 6: case 7: case 8: case 9: /* IA */
477	return s->macaddr[offset - 4];
478	case 10: /* General Purpose */
479	return s->gpr & 0xff;
480	case 11:
481	return s->gpr >> 8;
482	case 12: /* Control */
483	return s->ctr & 0xff;
484	case 13:
485	return s->ctr >> 8;
486	}
487	break;
488
489	case 2:
490	switch (offset) {
491	case 0: case 1: /* MMUCR Busy bit. */
492	return 0;
493	case 2: /* Packet Number. */
494	return s->packet_num;
495	case 3: /* Allocation Result. */
496	return s->tx_alloc;
497	case 4: /* TX FIFO */
5198cfd9	498	if (s->tx_fifo_done_len == 0)
80337b66 FB	499	return 0x80;
80337b66 FB	500	else
5198cfd9	501	return s->tx_fifo_done[0];
80337b66 FB	502	case 5: /* RX FIFO */
	503	if (s->rx_fifo_len == 0)
	504	return 0x80;
	505	else
	506	return s->rx_fifo[0];
	507	case 6: /* Pointer */
	508	return s->ptr & 0xff;
	509	case 7:
	510	return (s->ptr >> 8) & 0xf7;
	511	case 8: case 9: case 10: case 11: /* Data */
	512	{
	513	int p;
	514	int n;
	515
	516	if (s->ptr & 0x8000)
	517	n = s->rx_fifo[0];
	518	else
	519	n = s->packet_num;
	520	p = s->ptr & 0x07ff;
	521	if (s->ptr & 0x4000) {
	522	s->ptr = (s->ptr & 0xf800) \| ((s->ptr + 1) & 0x07ff);
	523	} else {
	524	p += (offset & 3);
	525	}
	526	return s->data[n][p];
	527	}
	528	case 12: /* Interrupt status. */
	529	return s->int_level;
	530	case 13: /* Interrupt mask. */
	531	return s->int_mask;
	532	}
	533	break;
	534
	535	case 3:
	536	switch (offset) {
	537	case 0: case 1: case 2: case 3: case 4: case 5: case 6: case 7:
	538	/* Multicast table. */
	539	/* Not implemented. */
	540	return 0;
	541	case 8: /* Management Interface. */
	542	/* Not implemented. */
	543	return 0x30;
	544	case 9:
	545	return 0x33;
	546	case 10: /* Revision. */
	547	return 0x91;
	548	case 11:
	549	return 0x33;
	550	case 12:
	551	return s->ercv;
	552	case 13:
	553	return 0;
	554	}
	555	break;
	556	}
	557	cpu_abort (cpu_single_env, "smc91c111_read: Bad reg %d:%x\n",
	558	s->bank, offset);
	559	return 0;
	560	}
	561
	562	static void smc91c111_writew(void *opaque, target_phys_addr_t offset,
	563	uint32_t value)
	564	{
	565	smc91c111_writeb(opaque, offset, value & 0xff);
566	smc91c111_writeb(opaque, offset + 1, value >> 8);
567	}
568
569	static void smc91c111_writel(void *opaque, target_phys_addr_t offset,
570	uint32_t value)
571	{
572	smc91c111_state s = (smc91c111_state )opaque;
573	/* 32-bit writes to offset 0xc only actually write to the bank select
574	register (offset 0xe) */
575	if (offset != s->base + 0xc)
576	smc91c111_writew(opaque, offset, value & 0xffff);
577	smc91c111_writew(opaque, offset + 2, value >> 16);
578	}
579
580	static uint32_t smc91c111_readw(void *opaque, target_phys_addr_t offset)
581	{
582	uint32_t val;
583	val = smc91c111_readb(opaque, offset);
584	val \|= smc91c111_readb(opaque, offset + 1) << 8;
585	return val;
586	}
587
588	static uint32_t smc91c111_readl(void *opaque, target_phys_addr_t offset)
589	{
590	uint32_t val;
591	val = smc91c111_readw(opaque, offset);
592	val \|= smc91c111_readw(opaque, offset + 2) << 16;
593	return val;
594	}
595
d861b05e PB	596	static int smc91c111_can_receive(void *opaque)
	597	{
	598	smc91c111_state s = (smc91c111_state )opaque;
	599
	600	if ((s->rcr & RCR_RXEN) == 0 \|\| (s->rcr & RCR_SOFT_RST))
	601	return 1;
	602	if (s->allocated == (1 << NUM_PACKETS) - 1)
	603	return 0;
	604	return 1;
	605	}
	606
80337b66 FB	607	static void smc91c111_receive(void opaque, const uint8_t buf, int size)
	608	{
	609	smc91c111_state s = (smc91c111_state )opaque;
	610	int status;
	611	int packetsize;
	612	uint32_t crc;
	613	int packetnum;
	614	uint8_t *p;
	615
	616	if ((s->rcr & RCR_RXEN) == 0 \|\| (s->rcr & RCR_SOFT_RST))
	617	return;
	618	/* Short packets are padded with zeros. Recieveing a packet
	619	< 64 bytes long is considered an error condition. */
	620	if (size < 64)
	621	packetsize = 64;
	622	else
	623	packetsize = (size & ~1);
	624	packetsize += 6;
	625	crc = (s->rcr & RCR_STRIP_CRC) == 0;
	626	if (crc)
	627	packetsize += 4;
	628	/* TODO: Flag overrun and receive errors. */
	629	if (packetsize > 2048)
	630	return;
	631	packetnum = smc91c111_allocate_packet(s);
	632	if (packetnum == 0x80)
	633	return;
	634	s->rx_fifo[s->rx_fifo_len++] = packetnum;
	635
	636	p = &s->data[packetnum][0];
	637	/* ??? Multicast packets? */
	638	status = 0;
	639	if (size > 1518)
	640	status \|= RS_TOOLONG;
	641	if (size & 1)
	642	status \|= RS_ODDFRAME;
	643	*(p++) = status & 0xff;
	644	*(p++) = status >> 8;
	645	*(p++) = packetsize & 0xff;
	646	*(p++) = packetsize >> 8;
	647	memcpy(p, buf, size & ~1);
	648	p += (size & ~1);
	649	/* Pad short packets. */
	650	if (size < 64) {
	651	int pad;
	652
	653	if (size & 1)
	654	*(p++) = buf[size - 1];
	655	pad = 64 - size;
	656	memset(p, 0, pad);
	657	p += pad;
	658	size = 64;
	659	}
	660	/* It's not clear if the CRC should go before or after the last byte in
	661	odd sized packets. Linux disables the CRC, so that's no help.
	662	The pictures in the documentation show the CRC aligned on a 16-bit
	663	boundary before the last odd byte, so that's what we do. */
	664	if (crc) {
	665	crc = crc32(~0, buf, size);
	666	*(p++) = crc & 0xff; crc >>= 8;
	667	*(p++) = crc & 0xff; crc >>= 8;
	668	*(p++) = crc & 0xff; crc >>= 8;
	669	*(p++) = crc & 0xff; crc >>= 8;
	670	}
671	if (size & 1) {
672	*(p++) = buf[size - 1];
673	*(p++) = 0x60;
674	} else {
675	*(p++) = 0;
676	*(p++) = 0x40;
677	}
678	/* TODO: Raise early RX interrupt? */
679	s->int_level \|= INT_RCV;
680	smc91c111_update(s);
681	}
682
683	static CPUReadMemoryFunc *smc91c111_readfn[] = {
684	smc91c111_readb,
685	smc91c111_readw,
686	smc91c111_readl
687	};
688
689	static CPUWriteMemoryFunc *smc91c111_writefn[] = {
690	smc91c111_writeb,
691	smc91c111_writew,
692	smc91c111_writel
693	};
694
695	void smc91c111_init(NICInfo nd, uint32_t base, void pic, int irq)
696	{
697	smc91c111_state *s;
698	int iomemtype;
699
700	s = (smc91c111_state *)qemu_mallocz(sizeof(smc91c111_state));
701	iomemtype = cpu_register_io_memory(0, smc91c111_readfn,
702	smc91c111_writefn, s);
703	cpu_register_physical_memory(base, 16, iomemtype);
704	s->base = base;
705	s->pic = pic;
706	s->irq = irq;
707	memcpy(s->macaddr, nd->macaddr, 6);
708
709	smc91c111_reset(s);
710
d861b05e PB	711	s->vc = qemu_new_vlan_client(nd->vlan, smc91c111_receive,
d861b05e PB	712	smc91c111_can_receive, s);
80337b66 FB	713	/* ??? Save/restore. */
80337b66 FB	714	}