[qemu.git] / hw / smc91c111.c

/*
 * SMSC 91C111 Ethernet interface emulation
 *
 * Copyright (c) 2005 CodeSourcery, LLC.
 * Written by Paul Brook
 *
 * This code is licenced under the GPL
 */

#include "sysbus.h"
#include "net.h"
#include "devices.h"
/* For crc32 */
#include <zlib.h>

/* Number of 2k memory pages available.  */
#define NUM_PACKETS 4

typedef struct {
    SysBusDevice busdev;
    VLANClientState *vc;
    uint16_t tcr;
    uint16_t rcr;
    uint16_t cr;
    uint16_t ctr;
    uint16_t gpr;
    uint16_t ptr;
    uint16_t ercv;
    qemu_irq irq;
    int bank;
    int packet_num;
    int tx_alloc;
    /* Bitmask of allocated packets.  */
    int allocated;
    int tx_fifo_len;
    int tx_fifo[NUM_PACKETS];
    int rx_fifo_len;
    int rx_fifo[NUM_PACKETS];
    int tx_fifo_done_len;
    int tx_fifo_done[NUM_PACKETS];
    /* Packet buffer memory.  */
    uint8_t data[NUM_PACKETS][2048];
    uint8_t int_level;
    uint8_t int_mask;
    uint8_t macaddr[6];
    int mmio_index;
} smc91c111_state;

#define RCR_SOFT_RST  0x8000
#define RCR_STRIP_CRC 0x0200
#define RCR_RXEN      0x0100

#define TCR_EPH_LOOP  0x2000
#define TCR_NOCRC     0x0100
#define TCR_PAD_EN    0x0080
#define TCR_FORCOL    0x0004
#define TCR_LOOP      0x0002
#define TCR_TXEN      0x0001

#define INT_MD        0x80
#define INT_ERCV      0x40
#define INT_EPH       0x20
#define INT_RX_OVRN   0x10
#define INT_ALLOC     0x08
#define INT_TX_EMPTY  0x04
#define INT_TX        0x02
#define INT_RCV       0x01

#define CTR_AUTO_RELEASE  0x0800
#define CTR_RELOAD        0x0002
#define CTR_STORE         0x0001

#define RS_ALGNERR      0x8000
#define RS_BRODCAST     0x4000
#define RS_BADCRC       0x2000
#define RS_ODDFRAME     0x1000
#define RS_TOOLONG      0x0800
#define RS_TOOSHORT     0x0400
#define RS_MULTICAST    0x0001

/* Update interrupt status.  */
static void smc91c111_update(smc91c111_state *s)
{
    int level;

    if (s->tx_fifo_len == 0)
        s->int_level |= INT_TX_EMPTY;
    if (s->tx_fifo_done_len != 0)
        s->int_level |= INT_TX;
    level = (s->int_level & s->int_mask) != 0;
    qemu_set_irq(s->irq, level);
}

/* Try to allocate a packet.  Returns 0x80 on failure.  */
static int smc91c111_allocate_packet(smc91c111_state *s)
{
    int i;
    if (s->allocated == (1 << NUM_PACKETS) - 1) {
        return 0x80;
    }

    for (i = 0; i < NUM_PACKETS; i++) {
        if ((s->allocated & (1 << i)) == 0)
            break;
    }
    s->allocated |= 1 << i;
    return i;
}


/* Process a pending TX allocate.  */
static void smc91c111_tx_alloc(smc91c111_state *s)
{
    s->tx_alloc = smc91c111_allocate_packet(s);
    if (s->tx_alloc == 0x80)
        return;
    s->int_level |= INT_ALLOC;
    smc91c111_update(s);
}

/* Remove and item from the RX FIFO.  */
static void smc91c111_pop_rx_fifo(smc91c111_state *s)
{
    int i;

    s->rx_fifo_len--;
    if (s->rx_fifo_len) {
        for (i = 0; i < s->rx_fifo_len; i++)
            s->rx_fifo[i] = s->rx_fifo[i + 1];
        s->int_level |= INT_RCV;
    } else {
        s->int_level &= ~INT_RCV;
    }
    smc91c111_update(s);
}

/* Remove an item from the TX completion FIFO.  */
static void smc91c111_pop_tx_fifo_done(smc91c111_state *s)
{
    int i;

    if (s->tx_fifo_done_len == 0)
        return;
    s->tx_fifo_done_len--;
    for (i = 0; i < s->tx_fifo_done_len; i++)
        s->tx_fifo_done[i] = s->tx_fifo_done[i + 1];
}

/* Release the memory allocated to a packet.  */
static void smc91c111_release_packet(smc91c111_state *s, int packet)
{
    s->allocated &= ~(1 << packet);
    if (s->tx_alloc == 0x80)
        smc91c111_tx_alloc(s);
}

/* Flush the TX FIFO.  */
static void smc91c111_do_tx(smc91c111_state *s)
{
    int i;
    int len;
    int control;
    int add_crc;
    int packetnum;
    uint8_t *p;

    if ((s->tcr & TCR_TXEN) == 0)
        return;
    if (s->tx_fifo_len == 0)
        return;
    for (i = 0; i < s->tx_fifo_len; i++) {
        packetnum = s->tx_fifo[i];
        p = &s->data[packetnum][0];
        /* Set status word.  */
        *(p++) = 0x01;
        *(p++) = 0x40;
        len = *(p++);
        len |= ((int)*(p++)) << 8;
        len -= 6;
        control = p[len + 1];
        if (control & 0x20)
            len++;
        /* ??? This overwrites the data following the buffer.
           Don't know what real hardware does.  */
        if (len < 64 && (s->tcr & TCR_PAD_EN)) {
            memset(p + len, 0, 64 - len);
            len = 64;
        }
#if 0
        /* The card is supposed to append the CRC to the frame.  However
           none of the other network traffic has the CRC appended.
           Suspect this is low level ethernet detail we don't need to worry
           about.  */
        add_crc = (control & 0x10) || (s->tcr & TCR_NOCRC) == 0;
        if (add_crc) {
            uint32_t crc;

            crc = crc32(~0, p, len);
            memcpy(p + len, &crc, 4);
            len += 4;
        }
#else
        add_crc = 0;
#endif
        if (s->ctr & CTR_AUTO_RELEASE)
            /* Race?  */
            smc91c111_release_packet(s, packetnum);
        else if (s->tx_fifo_done_len < NUM_PACKETS)
            s->tx_fifo_done[s->tx_fifo_done_len++] = packetnum;
        qemu_send_packet(s->vc, p, len);
    }
    s->tx_fifo_len = 0;
    smc91c111_update(s);
}

/* Add a packet to the TX FIFO.  */
static void smc91c111_queue_tx(smc91c111_state *s, int packet)
{
    if (s->tx_fifo_len == NUM_PACKETS)
        return;
    s->tx_fifo[s->tx_fifo_len++] = packet;
    smc91c111_do_tx(s);
}

static void smc91c111_reset(smc91c111_state *s)
{
    s->bank = 0;
    s->tx_fifo_len = 0;
    s->tx_fifo_done_len = 0;
    s->rx_fifo_len = 0;
    s->allocated = 0;
    s->packet_num = 0;
    s->tx_alloc = 0;
    s->tcr = 0;
    s->rcr = 0;
    s->cr = 0xa0b1;
    s->ctr = 0x1210;
    s->ptr = 0;
    s->ercv = 0x1f;
    s->int_level = INT_TX_EMPTY;
    s->int_mask = 0;
    smc91c111_update(s);
}

#define SET_LOW(name, val) s->name = (s->name & 0xff00) | val
#define SET_HIGH(name, val) s->name = (s->name & 0xff) | (val << 8)

static void smc91c111_writeb(void *opaque, target_phys_addr_t offset,
                             uint32_t value)
{
    smc91c111_state *s = (smc91c111_state *)opaque;

    if (offset == 14) {
        s->bank = value;
        return;
    }
    if (offset == 15)
        return;
    switch (s->bank) {
    case 0:
        switch (offset) {
        case 0: /* TCR */
            SET_LOW(tcr, value);
            return;
        case 1:
            SET_HIGH(tcr, value);
            return;
        case 4: /* RCR */
            SET_LOW(rcr, value);
            return;
        case 5:
            SET_HIGH(rcr, value);
            if (s->rcr & RCR_SOFT_RST)
                smc91c111_reset(s);
            return;
        case 10: case 11: /* RPCR */
            /* Ignored */
            return;
        }
        break;

    case 1:
        switch (offset) {
        case 0: /* CONFIG */
            SET_LOW(cr, value);
            return;
        case 1:
            SET_HIGH(cr,value);
            return;
        case 2: case 3: /* BASE */
        case 4: case 5: case 6: case 7: case 8: case 9: /* IA */
            /* Not implemented.  */
            return;
        case 10: /* Genral Purpose */
            SET_LOW(gpr, value);
            return;
        case 11:
            SET_HIGH(gpr, value);
            return;
        case 12: /* Control */
            if (value & 1)
                fprintf(stderr, "smc91c111:EEPROM store not implemented\n");
            if (value & 2)
                fprintf(stderr, "smc91c111:EEPROM reload not implemented\n");
            value &= ~3;
            SET_LOW(ctr, value);
            return;
        case 13:
            SET_HIGH(ctr, value);
            return;
        }
        break;

    case 2:
        switch (offset) {
        case 0: /* MMU Command */
            switch (value >> 5) {
            case 0: /* no-op */
                break;
            case 1: /* Allocate for TX.  */
                s->tx_alloc = 0x80;
                s->int_level &= ~INT_ALLOC;
                smc91c111_update(s);
                smc91c111_tx_alloc(s);
                break;
            case 2: /* Reset MMU.  */
                s->allocated = 0;
                s->tx_fifo_len = 0;
                s->tx_fifo_done_len = 0;
                s->rx_fifo_len = 0;
                s->tx_alloc = 0;
                break;
            case 3: /* Remove from RX FIFO.  */
                smc91c111_pop_rx_fifo(s);
                break;
            case 4: /* Remove from RX FIFO and release.  */
                if (s->rx_fifo_len > 0) {
                    smc91c111_release_packet(s, s->rx_fifo[0]);
                }
                smc91c111_pop_rx_fifo(s);
                break;
            case 5: /* Release.  */
                smc91c111_release_packet(s, s->packet_num);
                break;
            case 6: /* Add to TX FIFO.  */
                smc91c111_queue_tx(s, s->packet_num);
                break;
            case 7: /* Reset TX FIFO.  */
                s->tx_fifo_len = 0;
                s->tx_fifo_done_len = 0;
                break;
            }
            return;
        case 1:
            /* Ignore.  */
            return;
        case 2: /* Packet Number Register */
            s->packet_num = value;
            return;
        case 3: case 4: case 5:
            /* Should be readonly, but linux writes to them anyway. Ignore.  */
            return;
        case 6: /* Pointer */
            SET_LOW(ptr, value);
            return;
        case 7:
            SET_HIGH(ptr, value);
            return;
        case 8: case 9: case 10: case 11: /* Data */
            {
                int p;
                int n;

                if (s->ptr & 0x8000)
                    n = s->rx_fifo[0];
                else
                    n = s->packet_num;
                p = s->ptr & 0x07ff;
                if (s->ptr & 0x4000) {
                    s->ptr = (s->ptr & 0xf800) | ((s->ptr + 1) & 0x7ff);
                } else {
                    p += (offset & 3);
                }
                s->data[n][p] = value;
            }
            return;
        case 12: /* Interrupt ACK.  */
            s->int_level &= ~(value & 0xd6);
            if (value & INT_TX)
                smc91c111_pop_tx_fifo_done(s);
            smc91c111_update(s);
            return;
        case 13: /* Interrupt mask.  */
            s->int_mask = value;
            smc91c111_update(s);
            return;
        }
        break;;

    case 3:
        switch (offset) {
        case 0: case 1: case 2: case 3: case 4: case 5: case 6: case 7:
            /* Multicast table.  */
            /* Not implemented.  */
            return;
        case 8: case 9: /* Management Interface.  */
            /* Not implemented.  */
            return;
        case 12: /* Early receive.  */
            s->ercv = value & 0x1f;
        case 13:
            /* Ignore.  */
            return;
        }
        break;
    }
    hw_error("smc91c111_write: Bad reg %d:%x\n", s->bank, (int)offset);
}

static uint32_t smc91c111_readb(void *opaque, target_phys_addr_t offset)
{
    smc91c111_state *s = (smc91c111_state *)opaque;

    if (offset == 14) {
        return s->bank;
    }
    if (offset == 15)
        return 0x33;
    switch (s->bank) {
    case 0:
        switch (offset) {
        case 0: /* TCR */
            return s->tcr & 0xff;
        case 1:
            return s->tcr >> 8;
        case 2: /* EPH Status */
            return 0;
        case 3:
            return 0x40;
        case 4: /* RCR */
            return s->rcr & 0xff;
        case 5:
            return s->rcr >> 8;
        case 6: /* Counter */
        case 7:
            /* Not implemented.  */
            return 0;
        case 8: /* Memory size.  */
            return NUM_PACKETS;
        case 9: /* Free memory available.  */
            {
                int i;
                int n;
                n = 0;
                for (i = 0; i < NUM_PACKETS; i++) {
                    if (s->allocated & (1 << i))
                        n++;
                }
                return n;
            }
        case 10: case 11: /* RPCR */
            /* Not implemented.  */
            return 0;
        }
        break;

    case 1:
        switch (offset) {
        case 0: /* CONFIG */
            return s->cr & 0xff;
        case 1:
            return s->cr >> 8;
        case 2: case 3: /* BASE */
            /* Not implemented.  */
            return 0;
        case 4: case 5: case 6: case 7: case 8: case 9: /* IA */
            return s->macaddr[offset - 4];
        case 10: /* General Purpose */
            return s->gpr & 0xff;
        case 11:
            return s->gpr >> 8;
        case 12: /* Control */
            return s->ctr & 0xff;
        case 13:
            return s->ctr >> 8;
        }
        break;

    case 2:
        switch (offset) {
        case 0: case 1: /* MMUCR Busy bit.  */
            return 0;
        case 2: /* Packet Number.  */
            return s->packet_num;
        case 3: /* Allocation Result.  */
            return s->tx_alloc;
        case 4: /* TX FIFO */
            if (s->tx_fifo_done_len == 0)
                return 0x80;
            else
                return s->tx_fifo_done[0];
        case 5: /* RX FIFO */
            if (s->rx_fifo_len == 0)
                return 0x80;
            else
                return s->rx_fifo[0];
        case 6: /* Pointer */
            return s->ptr & 0xff;
        case 7:
            return (s->ptr >> 8) & 0xf7;
        case 8: case 9: case 10: case 11: /* Data */
            {
                int p;
                int n;

                if (s->ptr & 0x8000)
                    n = s->rx_fifo[0];
                else
                    n = s->packet_num;
                p = s->ptr & 0x07ff;
                if (s->ptr & 0x4000) {
                    s->ptr = (s->ptr & 0xf800) | ((s->ptr + 1) & 0x07ff);
                } else {
                    p += (offset & 3);
                }
                return s->data[n][p];
            }
        case 12: /* Interrupt status.  */
            return s->int_level;
        case 13: /* Interrupt mask.  */
            return s->int_mask;
        }
        break;

    case 3:
        switch (offset) {
        case 0: case 1: case 2: case 3: case 4: case 5: case 6: case 7:
            /* Multicast table.  */
            /* Not implemented.  */
            return 0;
        case 8: /* Management Interface.  */
            /* Not implemented.  */
            return 0x30;
        case 9:
            return 0x33;
        case 10: /* Revision.  */
            return 0x91;
        case 11:
            return 0x33;
        case 12:
            return s->ercv;
        case 13:
            return 0;
        }
        break;
    }
    hw_error("smc91c111_read: Bad reg %d:%x\n", s->bank, (int)offset);
    return 0;
}

static void smc91c111_writew(void *opaque, target_phys_addr_t offset,
                             uint32_t value)
{
    smc91c111_writeb(opaque, offset, value & 0xff);
    smc91c111_writeb(opaque, offset + 1, value >> 8);
}

static void smc91c111_writel(void *opaque, target_phys_addr_t offset,
                             uint32_t value)
{
    /* 32-bit writes to offset 0xc only actually write to the bank select
       register (offset 0xe)  */
    if (offset != 0xc)
        smc91c111_writew(opaque, offset, value & 0xffff);
    smc91c111_writew(opaque, offset + 2, value >> 16);
}

static uint32_t smc91c111_readw(void *opaque, target_phys_addr_t offset)
{
    uint32_t val;
    val = smc91c111_readb(opaque, offset);
    val |= smc91c111_readb(opaque, offset + 1) << 8;
    return val;
}

static uint32_t smc91c111_readl(void *opaque, target_phys_addr_t offset)
{
    uint32_t val;
    val = smc91c111_readw(opaque, offset);
    val |= smc91c111_readw(opaque, offset + 2) << 16;
    return val;
}

static int smc91c111_can_receive(VLANClientState *vc)
{
    smc91c111_state *s = vc->opaque;

    if ((s->rcr & RCR_RXEN) == 0 || (s->rcr & RCR_SOFT_RST))
        return 1;
    if (s->allocated == (1 << NUM_PACKETS) - 1)
        return 0;
    return 1;
}

static ssize_t smc91c111_receive(VLANClientState *vc, const uint8_t *buf, size_t size)
{
    smc91c111_state *s = vc->opaque;
    int status;
    int packetsize;
    uint32_t crc;
    int packetnum;
    uint8_t *p;

    if ((s->rcr & RCR_RXEN) == 0 || (s->rcr & RCR_SOFT_RST))
        return -1;
    /* Short packets are padded with zeros.  Receiving a packet
       < 64 bytes long is considered an error condition.  */
    if (size < 64)
        packetsize = 64;
    else
        packetsize = (size & ~1);
    packetsize += 6;
    crc = (s->rcr & RCR_STRIP_CRC) == 0;
    if (crc)
        packetsize += 4;
    /* TODO: Flag overrun and receive errors.  */
    if (packetsize > 2048)
        return -1;
    packetnum = smc91c111_allocate_packet(s);
    if (packetnum == 0x80)
        return -1;
    s->rx_fifo[s->rx_fifo_len++] = packetnum;

    p = &s->data[packetnum][0];
    /* ??? Multicast packets?  */
    status = 0;
    if (size > 1518)
        status |= RS_TOOLONG;
    if (size & 1)
        status |= RS_ODDFRAME;
    *(p++) = status & 0xff;
    *(p++) = status >> 8;
    *(p++) = packetsize & 0xff;
    *(p++) = packetsize >> 8;
    memcpy(p, buf, size & ~1);
    p += (size & ~1);
    /* Pad short packets.  */
    if (size < 64) {
        int pad;

        if (size & 1)
            *(p++) = buf[size - 1];
        pad = 64 - size;
        memset(p, 0, pad);
        p += pad;
        size = 64;
    }
    /* It's not clear if the CRC should go before or after the last byte in
       odd sized packets.  Linux disables the CRC, so that's no help.
       The pictures in the documentation show the CRC aligned on a 16-bit
       boundary before the last odd byte, so that's what we do.  */
    if (crc) {
        crc = crc32(~0, buf, size);
        *(p++) = crc & 0xff; crc >>= 8;
        *(p++) = crc & 0xff; crc >>= 8;
        *(p++) = crc & 0xff; crc >>= 8;
        *(p++) = crc & 0xff; crc >>= 8;
    }
    if (size & 1) {
        *(p++) = buf[size - 1];
        *(p++) = 0x60;
    } else {
        *(p++) = 0;
        *(p++) = 0x40;
    }
    /* TODO: Raise early RX interrupt?  */
    s->int_level |= INT_RCV;
    smc91c111_update(s);

    return size;
}

static CPUReadMemoryFunc * const smc91c111_readfn[] = {
    smc91c111_readb,
    smc91c111_readw,
    smc91c111_readl
};

static CPUWriteMemoryFunc * const smc91c111_writefn[] = {
    smc91c111_writeb,
    smc91c111_writew,
    smc91c111_writel
};

static void smc91c111_cleanup(VLANClientState *vc)
{
    smc91c111_state *s = vc->opaque;

    cpu_unregister_io_memory(s->mmio_index);
    qemu_free(s);
}

static int smc91c111_init1(SysBusDevice *dev)
{
    smc91c111_state *s = FROM_SYSBUS(smc91c111_state, dev);

    s->mmio_index = cpu_register_io_memory(smc91c111_readfn,
                                           smc91c111_writefn, s);
    sysbus_init_mmio(dev, 16, s->mmio_index);
    sysbus_init_irq(dev, &s->irq);
    qdev_get_macaddr(&dev->qdev, s->macaddr);

    smc91c111_reset(s);

    s->vc = qdev_get_vlan_client(&dev->qdev,
                                 smc91c111_can_receive, smc91c111_receive, NULL,
                                 smc91c111_cleanup, s);
    qemu_format_nic_info_str(s->vc, s->macaddr);
    /* ??? Save/restore.  */
    return 0;
}

static void smc91c111_register_devices(void)
{
    sysbus_register_dev("smc91c111", sizeof(smc91c111_state), smc91c111_init1);
}

/* Legacy helper function.  Should go away when machine config files are
   implemented.  */
void smc91c111_init(NICInfo *nd, uint32_t base, qemu_irq irq)
{
    DeviceState *dev;
    SysBusDevice *s;

    qemu_check_nic_model(nd, "smc91c111");
    dev = qdev_create(NULL, "smc91c111");
    dev->nd = nd;
    qdev_init(dev);
    s = sysbus_from_qdev(dev);
    sysbus_mmio_map(s, 0, base);
    sysbus_connect_irq(s, 0, irq);
}

device_init(smc91c111_register_devices)
Commit	Line	Data
5fafdf24	1	/*
80337b66 FB	2	* SMSC 91C111 Ethernet interface emulation
	3	*
	4	* Copyright (c) 2005 CodeSourcery, LLC.
	5	* Written by Paul Brook
	6	*
	7	* This code is licenced under the GPL
	8	*/
	9
418dcf5b	10	#include "sysbus.h"
87ecb68b PB	11	#include "net.h"
87ecb68b PB	12	#include "devices.h"
80337b66 FB	13	/* For crc32 */
	14	#include <zlib.h>
	15
	16	/* Number of 2k memory pages available. */
	17	#define NUM_PACKETS 4
	18
	19	typedef struct {
418dcf5b	20	SysBusDevice busdev;
80337b66 FB	21	VLANClientState *vc;
	22	uint16_t tcr;
	23	uint16_t rcr;
	24	uint16_t cr;
	25	uint16_t ctr;
	26	uint16_t gpr;
	27	uint16_t ptr;
	28	uint16_t ercv;
d537cf6c	29	qemu_irq irq;
80337b66 FB	30	int bank;
	31	int packet_num;
	32	int tx_alloc;
	33	/* Bitmask of allocated packets. */
	34	int allocated;
	35	int tx_fifo_len;
	36	int tx_fifo[NUM_PACKETS];
	37	int rx_fifo_len;
	38	int rx_fifo[NUM_PACKETS];
5198cfd9 FB	39	int tx_fifo_done_len;
5198cfd9 FB	40	int tx_fifo_done[NUM_PACKETS];
80337b66	41	/* Packet buffer memory. */
5198cfd9	42	uint8_t data[NUM_PACKETS][2048];
80337b66 FB	43	uint8_t int_level;
	44	uint8_t int_mask;
	45	uint8_t macaddr[6];
b946a153	46	int mmio_index;
80337b66 FB	47	} smc91c111_state;
	48
	49	#define RCR_SOFT_RST 0x8000
	50	#define RCR_STRIP_CRC 0x0200
	51	#define RCR_RXEN 0x0100
	52
	53	#define TCR_EPH_LOOP 0x2000
	54	#define TCR_NOCRC 0x0100
	55	#define TCR_PAD_EN 0x0080
	56	#define TCR_FORCOL 0x0004
	57	#define TCR_LOOP 0x0002
	58	#define TCR_TXEN 0x0001
	59
	60	#define INT_MD 0x80
	61	#define INT_ERCV 0x40
	62	#define INT_EPH 0x20
	63	#define INT_RX_OVRN 0x10
	64	#define INT_ALLOC 0x08
	65	#define INT_TX_EMPTY 0x04
	66	#define INT_TX 0x02
	67	#define INT_RCV 0x01
	68
	69	#define CTR_AUTO_RELEASE 0x0800
	70	#define CTR_RELOAD 0x0002
	71	#define CTR_STORE 0x0001
	72
	73	#define RS_ALGNERR 0x8000
	74	#define RS_BRODCAST 0x4000
	75	#define RS_BADCRC 0x2000
	76	#define RS_ODDFRAME 0x1000
	77	#define RS_TOOLONG 0x0800
	78	#define RS_TOOSHORT 0x0400
	79	#define RS_MULTICAST 0x0001
	80
	81	/* Update interrupt status. */
	82	static void smc91c111_update(smc91c111_state *s)
	83	{
	84	int level;
	85
	86	if (s->tx_fifo_len == 0)
	87	s->int_level \|= INT_TX_EMPTY;
5198cfd9 FB	88	if (s->tx_fifo_done_len != 0)
5198cfd9 FB	89	s->int_level \|= INT_TX;
80337b66	90	level = (s->int_level & s->int_mask) != 0;
d537cf6c	91	qemu_set_irq(s->irq, level);
80337b66 FB	92	}
	93
	94	/* Try to allocate a packet. Returns 0x80 on failure. */
	95	static int smc91c111_allocate_packet(smc91c111_state *s)
	96	{
	97	int i;
	98	if (s->allocated == (1 << NUM_PACKETS) - 1) {
	99	return 0x80;
	100	}
	101
	102	for (i = 0; i < NUM_PACKETS; i++) {
	103	if ((s->allocated & (1 << i)) == 0)
	104	break;
	105	}
	106	s->allocated \|= 1 << i;
	107	return i;
	108	}
	109
	110
	111	/* Process a pending TX allocate. */
	112	static void smc91c111_tx_alloc(smc91c111_state *s)
	113	{
	114	s->tx_alloc = smc91c111_allocate_packet(s);
	115	if (s->tx_alloc == 0x80)
	116	return;
	117	s->int_level \|= INT_ALLOC;
	118	smc91c111_update(s);
	119	}
	120
	121	/* Remove and item from the RX FIFO. */
	122	static void smc91c111_pop_rx_fifo(smc91c111_state *s)
	123	{
	124	int i;
	125
	126	s->rx_fifo_len--;
	127	if (s->rx_fifo_len) {
	128	for (i = 0; i < s->rx_fifo_len; i++)
	129	s->rx_fifo[i] = s->rx_fifo[i + 1];
	130	s->int_level \|= INT_RCV;
	131	} else {
	132	s->int_level &= ~INT_RCV;
	133	}
	134	smc91c111_update(s);
	135	}
	136
5198cfd9 FB	137	/* Remove an item from the TX completion FIFO. */
	138	static void smc91c111_pop_tx_fifo_done(smc91c111_state *s)
	139	{
	140	int i;
	141
	142	if (s->tx_fifo_done_len == 0)
	143	return;
	144	s->tx_fifo_done_len--;
	145	for (i = 0; i < s->tx_fifo_done_len; i++)
	146	s->tx_fifo_done[i] = s->tx_fifo_done[i + 1];
	147	}
	148
80337b66 FB	149	/* Release the memory allocated to a packet. */
	150	static void smc91c111_release_packet(smc91c111_state *s, int packet)
	151	{
	152	s->allocated &= ~(1 << packet);
	153	if (s->tx_alloc == 0x80)
	154	smc91c111_tx_alloc(s);
	155	}
	156
	157	/* Flush the TX FIFO. */
	158	static void smc91c111_do_tx(smc91c111_state *s)
	159	{
	160	int i;
	161	int len;
	162	int control;
	163	int add_crc;
80337b66 FB	164	int packetnum;
	165	uint8_t *p;
	166
	167	if ((s->tcr & TCR_TXEN) == 0)
	168	return;
	169	if (s->tx_fifo_len == 0)
	170	return;
	171	for (i = 0; i < s->tx_fifo_len; i++) {
	172	packetnum = s->tx_fifo[i];
	173	p = &s->data[packetnum][0];
	174	/* Set status word. */
	175	*(p++) = 0x01;
	176	*(p++) = 0x40;
	177	len = *(p++);
	178	len \|= ((int)*(p++)) << 8;
	179	len -= 6;
	180	control = p[len + 1];
	181	if (control & 0x20)
	182	len++;
	183	/* ??? This overwrites the data following the buffer.
	184	Don't know what real hardware does. */
	185	if (len < 64 && (s->tcr & TCR_PAD_EN)) {
	186	memset(p + len, 0, 64 - len);
	187	len = 64;
	188	}
	189	#if 0
	190	/* The card is supposed to append the CRC to the frame. However
	191	none of the other network traffic has the CRC appended.
	192	Suspect this is low level ethernet detail we don't need to worry
	193	about. */
	194	add_crc = (control & 0x10) \|\| (s->tcr & TCR_NOCRC) == 0;
	195	if (add_crc) {
416b5d36 TS	196	uint32_t crc;
416b5d36 TS	197
80337b66 FB	198	crc = crc32(~0, p, len);
	199	memcpy(p + len, &crc, 4);
	200	len += 4;
	201	}
	202	#else
	203	add_crc = 0;
	204	#endif
	205	if (s->ctr & CTR_AUTO_RELEASE)
5198cfd9	206	/* Race? */
80337b66	207	smc91c111_release_packet(s, packetnum);
5198cfd9 FB	208	else if (s->tx_fifo_done_len < NUM_PACKETS)
5198cfd9 FB	209	s->tx_fifo_done[s->tx_fifo_done_len++] = packetnum;
80337b66 FB	210	qemu_send_packet(s->vc, p, len);
	211	}
	212	s->tx_fifo_len = 0;
80337b66 FB	213	smc91c111_update(s);
	214	}
	215
	216	/* Add a packet to the TX FIFO. */
	217	static void smc91c111_queue_tx(smc91c111_state *s, int packet)
	218	{
	219	if (s->tx_fifo_len == NUM_PACKETS)
	220	return;
	221	s->tx_fifo[s->tx_fifo_len++] = packet;
	222	smc91c111_do_tx(s);
	223	}
	224
	225	static void smc91c111_reset(smc91c111_state *s)
	226	{
	227	s->bank = 0;
	228	s->tx_fifo_len = 0;
5198cfd9	229	s->tx_fifo_done_len = 0;
80337b66 FB	230	s->rx_fifo_len = 0;
	231	s->allocated = 0;
	232	s->packet_num = 0;
	233	s->tx_alloc = 0;
	234	s->tcr = 0;
	235	s->rcr = 0;
	236	s->cr = 0xa0b1;
	237	s->ctr = 0x1210;
	238	s->ptr = 0;
	239	s->ercv = 0x1f;
	240	s->int_level = INT_TX_EMPTY;
	241	s->int_mask = 0;
	242	smc91c111_update(s);
	243	}
	244
	245	#define SET_LOW(name, val) s->name = (s->name & 0xff00) \| val
	246	#define SET_HIGH(name, val) s->name = (s->name & 0xff) \| (val << 8)
	247
	248	static void smc91c111_writeb(void *opaque, target_phys_addr_t offset,
	249	uint32_t value)
	250	{
	251	smc91c111_state s = (smc91c111_state )opaque;
	252
80337b66 FB	253	if (offset == 14) {
	254	s->bank = value;
	255	return;
	256	}
	257	if (offset == 15)
	258	return;
	259	switch (s->bank) {
	260	case 0:
	261	switch (offset) {
	262	case 0: /* TCR */
	263	SET_LOW(tcr, value);
	264	return;
	265	case 1:
	266	SET_HIGH(tcr, value);
	267	return;
	268	case 4: /* RCR */
	269	SET_LOW(rcr, value);
	270	return;
	271	case 5:
	272	SET_HIGH(rcr, value);
	273	if (s->rcr & RCR_SOFT_RST)
	274	smc91c111_reset(s);
	275	return;
	276	case 10: case 11: /* RPCR */
	277	/* Ignored */
	278	return;
	279	}
	280	break;
	281
	282	case 1:
	283	switch (offset) {
	284	case 0: /* CONFIG */
	285	SET_LOW(cr, value);
	286	return;
	287	case 1:
	288	SET_HIGH(cr,value);
	289	return;
	290	case 2: case 3: /* BASE */
	291	case 4: case 5: case 6: case 7: case 8: case 9: /* IA */
	292	/* Not implemented. */
	293	return;
	294	case 10: /* Genral Purpose */
	295	SET_LOW(gpr, value);
	296	return;
	297	case 11:
	298	SET_HIGH(gpr, value);
	299	return;
	300	case 12: /* Control */
	301	if (value & 1)
	302	fprintf(stderr, "smc91c111:EEPROM store not implemented\n");
	303	if (value & 2)
	304	fprintf(stderr, "smc91c111:EEPROM reload not implemented\n");
	305	value &= ~3;
	306	SET_LOW(ctr, value);
	307	return;
	308	case 13:
	309	SET_HIGH(ctr, value);
	310	return;
	311	}
	312	break;
	313
	314	case 2:
	315	switch (offset) {
	316	case 0: /* MMU Command */
317	switch (value >> 5) {
318	case 0: /* no-op */
319	break;
320	case 1: /* Allocate for TX. */
321	s->tx_alloc = 0x80;
322	s->int_level &= ~INT_ALLOC;
323	smc91c111_update(s);
324	smc91c111_tx_alloc(s);
325	break;
326	case 2: /* Reset MMU. */
327	s->allocated = 0;
328	s->tx_fifo_len = 0;
5198cfd9	329	s->tx_fifo_done_len = 0;
80337b66 FB	330	s->rx_fifo_len = 0;
	331	s->tx_alloc = 0;
	332	break;
	333	case 3: /* Remove from RX FIFO. */
	334	smc91c111_pop_rx_fifo(s);
	335	break;
	336	case 4: /* Remove from RX FIFO and release. */
	337	if (s->rx_fifo_len > 0) {
	338	smc91c111_release_packet(s, s->rx_fifo[0]);
	339	}
	340	smc91c111_pop_rx_fifo(s);
	341	break;
	342	case 5: /* Release. */
	343	smc91c111_release_packet(s, s->packet_num);
	344	break;
	345	case 6: /* Add to TX FIFO. */
	346	smc91c111_queue_tx(s, s->packet_num);
	347	break;
	348	case 7: /* Reset TX FIFO. */
	349	s->tx_fifo_len = 0;
5198cfd9	350	s->tx_fifo_done_len = 0;
80337b66 FB	351	break;
	352	}
	353	return;
	354	case 1:
	355	/* Ignore. */
	356	return;
	357	case 2: /* Packet Number Register */
	358	s->packet_num = value;
	359	return;
	360	case 3: case 4: case 5:
	361	/* Should be readonly, but linux writes to them anyway. Ignore. */
	362	return;
	363	case 6: /* Pointer */
	364	SET_LOW(ptr, value);
	365	return;
	366	case 7:
	367	SET_HIGH(ptr, value);
	368	return;
	369	case 8: case 9: case 10: case 11: /* Data */
	370	{
	371	int p;
	372	int n;
	373
	374	if (s->ptr & 0x8000)
	375	n = s->rx_fifo[0];
	376	else
	377	n = s->packet_num;
	378	p = s->ptr & 0x07ff;
	379	if (s->ptr & 0x4000) {
	380	s->ptr = (s->ptr & 0xf800) \| ((s->ptr + 1) & 0x7ff);
	381	} else {
	382	p += (offset & 3);
	383	}
	384	s->data[n][p] = value;
	385	}
	386	return;
	387	case 12: /* Interrupt ACK. */
	388	s->int_level &= ~(value & 0xd6);
5198cfd9 FB	389	if (value & INT_TX)
5198cfd9 FB	390	smc91c111_pop_tx_fifo_done(s);
80337b66 FB	391	smc91c111_update(s);
	392	return;
	393	case 13: /* Interrupt mask. */
	394	s->int_mask = value;
	395	smc91c111_update(s);
	396	return;
	397	}
	398	break;;
	399
	400	case 3:
	401	switch (offset) {
	402	case 0: case 1: case 2: case 3: case 4: case 5: case 6: case 7:
	403	/* Multicast table. */
	404	/* Not implemented. */
	405	return;
	406	case 8: case 9: /* Management Interface. */
	407	/* Not implemented. */
	408	return;
	409	case 12: /* Early receive. */
	410	s->ercv = value & 0x1f;
	411	case 13:
	412	/* Ignore. */
	413	return;
	414	}
	415	break;
	416	}
2ac71179	417	hw_error("smc91c111_write: Bad reg %d:%x\n", s->bank, (int)offset);
80337b66 FB	418	}
	419
	420	static uint32_t smc91c111_readb(void *opaque, target_phys_addr_t offset)
	421	{
	422	smc91c111_state s = (smc91c111_state )opaque;
	423
80337b66 FB	424	if (offset == 14) {
	425	return s->bank;
	426	}
	427	if (offset == 15)
	428	return 0x33;
	429	switch (s->bank) {
	430	case 0:
	431	switch (offset) {
	432	case 0: /* TCR */
	433	return s->tcr & 0xff;
	434	case 1:
	435	return s->tcr >> 8;
	436	case 2: /* EPH Status */
	437	return 0;
	438	case 3:
	439	return 0x40;
	440	case 4: /* RCR */
	441	return s->rcr & 0xff;
	442	case 5:
	443	return s->rcr >> 8;
	444	case 6: /* Counter */
	445	case 7:
	446	/* Not implemented. */
	447	return 0;
687fa640 TS	448	case 8: /* Memory size. */
	449	return NUM_PACKETS;
	450	case 9: /* Free memory available. */
80337b66 FB	451	{
	452	int i;
	453	int n;
	454	n = 0;
	455	for (i = 0; i < NUM_PACKETS; i++) {
	456	if (s->allocated & (1 << i))
	457	n++;
	458	}
	459	return n;
	460	}
80337b66 FB	461	case 10: case 11: /* RPCR */
	462	/* Not implemented. */
	463	return 0;
	464	}
	465	break;
	466
	467	case 1:
	468	switch (offset) {
	469	case 0: /* CONFIG */
	470	return s->cr & 0xff;
	471	case 1:
	472	return s->cr >> 8;
	473	case 2: case 3: /* BASE */
	474	/* Not implemented. */
	475	return 0;
	476	case 4: case 5: case 6: case 7: case 8: case 9: /* IA */
	477	return s->macaddr[offset - 4];
	478	case 10: /* General Purpose */
	479	return s->gpr & 0xff;
	480	case 11:
	481	return s->gpr >> 8;
	482	case 12: /* Control */
	483	return s->ctr & 0xff;
	484	case 13:
	485	return s->ctr >> 8;
	486	}
	487	break;
	488
	489	case 2:
	490	switch (offset) {
	491	case 0: case 1: /* MMUCR Busy bit. */
	492	return 0;
	493	case 2: /* Packet Number. */
	494	return s->packet_num;
	495	case 3: /* Allocation Result. */
	496	return s->tx_alloc;
	497	case 4: /* TX FIFO */
5198cfd9	498	if (s->tx_fifo_done_len == 0)
80337b66 FB	499	return 0x80;
80337b66 FB	500	else
5198cfd9	501	return s->tx_fifo_done[0];
80337b66 FB	502	case 5: /* RX FIFO */
	503	if (s->rx_fifo_len == 0)
	504	return 0x80;
	505	else
	506	return s->rx_fifo[0];
	507	case 6: /* Pointer */
	508	return s->ptr & 0xff;
	509	case 7:
	510	return (s->ptr >> 8) & 0xf7;
	511	case 8: case 9: case 10: case 11: /* Data */
	512	{
	513	int p;
	514	int n;
	515
	516	if (s->ptr & 0x8000)
	517	n = s->rx_fifo[0];
	518	else
	519	n = s->packet_num;
	520	p = s->ptr & 0x07ff;
	521	if (s->ptr & 0x4000) {
	522	s->ptr = (s->ptr & 0xf800) \| ((s->ptr + 1) & 0x07ff);
	523	} else {
	524	p += (offset & 3);
	525	}
	526	return s->data[n][p];
	527	}
	528	case 12: /* Interrupt status. */
	529	return s->int_level;
	530	case 13: /* Interrupt mask. */
	531	return s->int_mask;
	532	}
	533	break;
	534
	535	case 3:
	536	switch (offset) {
	537	case 0: case 1: case 2: case 3: case 4: case 5: case 6: case 7:
	538	/* Multicast table. */
	539	/* Not implemented. */
	540	return 0;
	541	case 8: /* Management Interface. */
	542	/* Not implemented. */
	543	return 0x30;
	544	case 9:
	545	return 0x33;
	546	case 10: /* Revision. */
	547	return 0x91;
	548	case 11:
	549	return 0x33;
	550	case 12:
	551	return s->ercv;
	552	case 13:
	553	return 0;
	554	}
	555	break;
	556	}
2ac71179	557	hw_error("smc91c111_read: Bad reg %d:%x\n", s->bank, (int)offset);
80337b66 FB	558	return 0;
	559	}
	560
	561	static void smc91c111_writew(void *opaque, target_phys_addr_t offset,
	562	uint32_t value)
	563	{
	564	smc91c111_writeb(opaque, offset, value & 0xff);
	565	smc91c111_writeb(opaque, offset + 1, value >> 8);
	566	}
	567
	568	static void smc91c111_writel(void *opaque, target_phys_addr_t offset,
	569	uint32_t value)
	570	{
80337b66 FB	571	/* 32-bit writes to offset 0xc only actually write to the bank select
80337b66 FB	572	register (offset 0xe) */
8da3ff18	573	if (offset != 0xc)
80337b66 FB	574	smc91c111_writew(opaque, offset, value & 0xffff);
	575	smc91c111_writew(opaque, offset + 2, value >> 16);
	576	}
	577
	578	static uint32_t smc91c111_readw(void *opaque, target_phys_addr_t offset)
	579	{
	580	uint32_t val;
	581	val = smc91c111_readb(opaque, offset);
	582	val \|= smc91c111_readb(opaque, offset + 1) << 8;
	583	return val;
	584	}
	585
	586	static uint32_t smc91c111_readl(void *opaque, target_phys_addr_t offset)
	587	{
	588	uint32_t val;
	589	val = smc91c111_readw(opaque, offset);
	590	val \|= smc91c111_readw(opaque, offset + 2) << 16;
	591	return val;
	592	}
	593
e3f5ec2b	594	static int smc91c111_can_receive(VLANClientState *vc)
d861b05e	595	{
e3f5ec2b	596	smc91c111_state *s = vc->opaque;
d861b05e PB	597
	598	if ((s->rcr & RCR_RXEN) == 0 \|\| (s->rcr & RCR_SOFT_RST))
	599	return 1;
	600	if (s->allocated == (1 << NUM_PACKETS) - 1)
	601	return 0;
	602	return 1;
	603	}
	604
4f1c942b	605	static ssize_t smc91c111_receive(VLANClientState vc, const uint8_t buf, size_t size)
80337b66	606	{
e3f5ec2b	607	smc91c111_state *s = vc->opaque;
80337b66 FB	608	int status;
	609	int packetsize;
	610	uint32_t crc;
	611	int packetnum;
	612	uint8_t *p;
	613
	614	if ((s->rcr & RCR_RXEN) == 0 \|\| (s->rcr & RCR_SOFT_RST))
4f1c942b	615	return -1;
9f083493	616	/* Short packets are padded with zeros. Receiving a packet
80337b66 FB	617	< 64 bytes long is considered an error condition. */
	618	if (size < 64)
	619	packetsize = 64;
	620	else
	621	packetsize = (size & ~1);
	622	packetsize += 6;
	623	crc = (s->rcr & RCR_STRIP_CRC) == 0;
	624	if (crc)
	625	packetsize += 4;
	626	/* TODO: Flag overrun and receive errors. */
	627	if (packetsize > 2048)
4f1c942b	628	return -1;
80337b66 FB	629	packetnum = smc91c111_allocate_packet(s);
80337b66 FB	630	if (packetnum == 0x80)
4f1c942b	631	return -1;
80337b66 FB	632	s->rx_fifo[s->rx_fifo_len++] = packetnum;
	633
	634	p = &s->data[packetnum][0];
	635	/* ??? Multicast packets? */
	636	status = 0;
	637	if (size > 1518)
	638	status \|= RS_TOOLONG;
	639	if (size & 1)
	640	status \|= RS_ODDFRAME;
	641	*(p++) = status & 0xff;
	642	*(p++) = status >> 8;
	643	*(p++) = packetsize & 0xff;
	644	*(p++) = packetsize >> 8;
	645	memcpy(p, buf, size & ~1);
	646	p += (size & ~1);
	647	/* Pad short packets. */
	648	if (size < 64) {
	649	int pad;
3b46e624	650
80337b66 FB	651	if (size & 1)
	652	*(p++) = buf[size - 1];
	653	pad = 64 - size;
	654	memset(p, 0, pad);
	655	p += pad;
	656	size = 64;
	657	}
	658	/* It's not clear if the CRC should go before or after the last byte in
	659	odd sized packets. Linux disables the CRC, so that's no help.
	660	The pictures in the documentation show the CRC aligned on a 16-bit
	661	boundary before the last odd byte, so that's what we do. */
	662	if (crc) {
	663	crc = crc32(~0, buf, size);
	664	*(p++) = crc & 0xff; crc >>= 8;
	665	*(p++) = crc & 0xff; crc >>= 8;
	666	*(p++) = crc & 0xff; crc >>= 8;
	667	*(p++) = crc & 0xff; crc >>= 8;
	668	}
	669	if (size & 1) {
	670	*(p++) = buf[size - 1];
	671	*(p++) = 0x60;
	672	} else {
	673	*(p++) = 0;
	674	*(p++) = 0x40;
	675	}
	676	/* TODO: Raise early RX interrupt? */
	677	s->int_level \|= INT_RCV;
	678	smc91c111_update(s);
4f1c942b MM	679
4f1c942b MM	680	return size;
80337b66 FB	681	}
80337b66 FB	682
d60efc6b	683	static CPUReadMemoryFunc * const smc91c111_readfn[] = {
80337b66 FB	684	smc91c111_readb,
	685	smc91c111_readw,
	686	smc91c111_readl
	687	};
	688
d60efc6b	689	static CPUWriteMemoryFunc * const smc91c111_writefn[] = {
80337b66 FB	690	smc91c111_writeb,
	691	smc91c111_writew,
	692	smc91c111_writel
	693	};
	694
b946a153 AL	695	static void smc91c111_cleanup(VLANClientState *vc)
	696	{
	697	smc91c111_state *s = vc->opaque;
	698
	699	cpu_unregister_io_memory(s->mmio_index);
	700	qemu_free(s);
	701	}
	702
81a322d4	703	static int smc91c111_init1(SysBusDevice *dev)
80337b66	704	{
418dcf5b	705	smc91c111_state *s = FROM_SYSBUS(smc91c111_state, dev);
0ae18cee	706
1eed09cb	707	s->mmio_index = cpu_register_io_memory(smc91c111_readfn,
b946a153	708	smc91c111_writefn, s);
418dcf5b PB	709	sysbus_init_mmio(dev, 16, s->mmio_index);
	710	sysbus_init_irq(dev, &s->irq);
	711	qdev_get_macaddr(&dev->qdev, s->macaddr);
80337b66 FB	712
	713	smc91c111_reset(s);
	714
418dcf5b	715	s->vc = qdev_get_vlan_client(&dev->qdev,
463af534	716	smc91c111_can_receive, smc91c111_receive, NULL,
b946a153	717	smc91c111_cleanup, s);
96d5e201	718	qemu_format_nic_info_str(s->vc, s->macaddr);
80337b66	719	/* ??? Save/restore. */
81a322d4	720	return 0;
80337b66	721	}
418dcf5b PB	722
	723	static void smc91c111_register_devices(void)
	724	{
	725	sysbus_register_dev("smc91c111", sizeof(smc91c111_state), smc91c111_init1);
	726	}
	727
	728	/* Legacy helper function. Should go away when machine config files are
	729	implemented. */
	730	void smc91c111_init(NICInfo *nd, uint32_t base, qemu_irq irq)
	731	{
	732	DeviceState *dev;
	733	SysBusDevice *s;
	734
	735	qemu_check_nic_model(nd, "smc91c111");
	736	dev = qdev_create(NULL, "smc91c111");
ee6847d1	737	dev->nd = nd;
418dcf5b PB	738	qdev_init(dev);
	739	s = sysbus_from_qdev(dev);
	740	sysbus_mmio_map(s, 0, base);
	741	sysbus_connect_irq(s, 0, irq);
	742	}
	743
	744	device_init(smc91c111_register_devices)