[qemu.git] / hw / mcf_fec.c

/*
 * ColdFire Fast Ethernet Controller emulation.
 *
 * Copyright (c) 2007 CodeSourcery.
 *
 * This code is licenced under the GPL
 */
#include "hw.h"
#include "net.h"
#include "mcf.h"
/* For crc32 */
#include <zlib.h>

//#define DEBUG_FEC 1

#ifdef DEBUG_FEC
#define DPRINTF(fmt, ...) \
do { printf("mcf_fec: " fmt , ## __VA_ARGS__); } while (0)
#else
#define DPRINTF(fmt, ...) do {} while(0)
#endif

#define FEC_MAX_FRAME_SIZE 2032

typedef struct {
    qemu_irq *irq;
    int mmio_index;
    NICState *nic;
    NICConf conf;
    uint32_t irq_state;
    uint32_t eir;
    uint32_t eimr;
    int rx_enabled;
    uint32_t rx_descriptor;
    uint32_t tx_descriptor;
    uint32_t ecr;
    uint32_t mmfr;
    uint32_t mscr;
    uint32_t rcr;
    uint32_t tcr;
    uint32_t tfwr;
    uint32_t rfsr;
    uint32_t erdsr;
    uint32_t etdsr;
    uint32_t emrbr;
} mcf_fec_state;

#define FEC_INT_HB   0x80000000
#define FEC_INT_BABR 0x40000000
#define FEC_INT_BABT 0x20000000
#define FEC_INT_GRA  0x10000000
#define FEC_INT_TXF  0x08000000
#define FEC_INT_TXB  0x04000000
#define FEC_INT_RXF  0x02000000
#define FEC_INT_RXB  0x01000000
#define FEC_INT_MII  0x00800000
#define FEC_INT_EB   0x00400000
#define FEC_INT_LC   0x00200000
#define FEC_INT_RL   0x00100000
#define FEC_INT_UN   0x00080000

#define FEC_EN      2
#define FEC_RESET   1

/* Map interrupt flags onto IRQ lines.  */
#define FEC_NUM_IRQ 13
static const uint32_t mcf_fec_irq_map[FEC_NUM_IRQ] = {
    FEC_INT_TXF,
    FEC_INT_TXB,
    FEC_INT_UN,
    FEC_INT_RL,
    FEC_INT_RXF,
    FEC_INT_RXB,
    FEC_INT_MII,
    FEC_INT_LC,
    FEC_INT_HB,
    FEC_INT_GRA,
    FEC_INT_EB,
    FEC_INT_BABT,
    FEC_INT_BABR
};

/* Buffer Descriptor.  */
typedef struct {
    uint16_t flags;
    uint16_t length;
    uint32_t data;
} mcf_fec_bd;

#define FEC_BD_R    0x8000
#define FEC_BD_E    0x8000
#define FEC_BD_O1   0x4000
#define FEC_BD_W    0x2000
#define FEC_BD_O2   0x1000
#define FEC_BD_L    0x0800
#define FEC_BD_TC   0x0400
#define FEC_BD_ABC  0x0200
#define FEC_BD_M    0x0100
#define FEC_BD_BC   0x0080
#define FEC_BD_MC   0x0040
#define FEC_BD_LG   0x0020
#define FEC_BD_NO   0x0010
#define FEC_BD_CR   0x0004
#define FEC_BD_OV   0x0002
#define FEC_BD_TR   0x0001

static void mcf_fec_read_bd(mcf_fec_bd *bd, uint32_t addr)
{
    cpu_physical_memory_read(addr, (uint8_t *)bd, sizeof(*bd));
    be16_to_cpus(&bd->flags);
    be16_to_cpus(&bd->length);
    be32_to_cpus(&bd->data);
}

static void mcf_fec_write_bd(mcf_fec_bd *bd, uint32_t addr)
{
    mcf_fec_bd tmp;
    tmp.flags = cpu_to_be16(bd->flags);
    tmp.length = cpu_to_be16(bd->length);
    tmp.data = cpu_to_be32(bd->data);
    cpu_physical_memory_write(addr, (uint8_t *)&tmp, sizeof(tmp));
}

static void mcf_fec_update(mcf_fec_state *s)
{
    uint32_t active;
    uint32_t changed;
    uint32_t mask;
    int i;

    active = s->eir & s->eimr;
    changed = active ^s->irq_state;
    for (i = 0; i < FEC_NUM_IRQ; i++) {
        mask = mcf_fec_irq_map[i];
        if (changed & mask) {
            DPRINTF("IRQ %d = %d\n", i, (active & mask) != 0);
            qemu_set_irq(s->irq[i], (active & mask) != 0);
        }
    }
    s->irq_state = active;
}

static void mcf_fec_do_tx(mcf_fec_state *s)
{
    uint32_t addr;
    mcf_fec_bd bd;
    int frame_size;
    int len;
    uint8_t frame[FEC_MAX_FRAME_SIZE];
    uint8_t *ptr;

    DPRINTF("do_tx\n");
    ptr = frame;
    frame_size = 0;
    addr = s->tx_descriptor;
    while (1) {
        mcf_fec_read_bd(&bd, addr);
        DPRINTF("tx_bd %x flags %04x len %d data %08x\n",
                addr, bd.flags, bd.length, bd.data);
        if ((bd.flags & FEC_BD_R) == 0) {
            /* Run out of descriptors to transmit.  */
            break;
        }
        len = bd.length;
        if (frame_size + len > FEC_MAX_FRAME_SIZE) {
            len = FEC_MAX_FRAME_SIZE - frame_size;
            s->eir |= FEC_INT_BABT;
        }
        cpu_physical_memory_read(bd.data, ptr, len);
        ptr += len;
        frame_size += len;
        if (bd.flags & FEC_BD_L) {
            /* Last buffer in frame.  */
            DPRINTF("Sending packet\n");
            qemu_send_packet(&s->nic->nc, frame, len);
            ptr = frame;
            frame_size = 0;
            s->eir |= FEC_INT_TXF;
        }
        s->eir |= FEC_INT_TXB;
        bd.flags &= ~FEC_BD_R;
        /* Write back the modified descriptor.  */
        mcf_fec_write_bd(&bd, addr);
        /* Advance to the next descriptor.  */
        if ((bd.flags & FEC_BD_W) != 0) {
            addr = s->etdsr;
        } else {
            addr += 8;
        }
    }
    s->tx_descriptor = addr;
}

static void mcf_fec_enable_rx(mcf_fec_state *s)
{
    mcf_fec_bd bd;

    mcf_fec_read_bd(&bd, s->rx_descriptor);
    s->rx_enabled = ((bd.flags & FEC_BD_E) != 0);
    if (!s->rx_enabled)
        DPRINTF("RX buffer full\n");
}

static void mcf_fec_reset(mcf_fec_state *s)
{
    s->eir = 0;
    s->eimr = 0;
    s->rx_enabled = 0;
    s->ecr = 0;
    s->mscr = 0;
    s->rcr = 0x05ee0001;
    s->tcr = 0;
    s->tfwr = 0;
    s->rfsr = 0x500;
}

static uint32_t mcf_fec_read(void *opaque, target_phys_addr_t addr)
{
    mcf_fec_state *s = (mcf_fec_state *)opaque;
    switch (addr & 0x3ff) {
    case 0x004: return s->eir;
    case 0x008: return s->eimr;
    case 0x010: return s->rx_enabled ? (1 << 24) : 0; /* RDAR */
    case 0x014: return 0; /* TDAR */
    case 0x024: return s->ecr;
    case 0x040: return s->mmfr;
    case 0x044: return s->mscr;
    case 0x064: return 0; /* MIBC */
    case 0x084: return s->rcr;
    case 0x0c4: return s->tcr;
    case 0x0e4: /* PALR */
        return (s->conf.macaddr.a[0] << 24) | (s->conf.macaddr.a[1] << 16)
              | (s->conf.macaddr.a[2] << 8) | s->conf.macaddr.a[3];
        break;
    case 0x0e8: /* PAUR */
        return (s->conf.macaddr.a[4] << 24) | (s->conf.macaddr.a[5] << 16) | 0x8808;
    case 0x0ec: return 0x10000; /* OPD */
    case 0x118: return 0;
    case 0x11c: return 0;
    case 0x120: return 0;
    case 0x124: return 0;
    case 0x144: return s->tfwr;
    case 0x14c: return 0x600;
    case 0x150: return s->rfsr;
    case 0x180: return s->erdsr;
    case 0x184: return s->etdsr;
    case 0x188: return s->emrbr;
    default:
        hw_error("mcf_fec_read: Bad address 0x%x\n", (int)addr);
        return 0;
    }
}

static void mcf_fec_write(void *opaque, target_phys_addr_t addr, uint32_t value)
{
    mcf_fec_state *s = (mcf_fec_state *)opaque;
    switch (addr & 0x3ff) {
    case 0x004:
        s->eir &= ~value;
        break;
    case 0x008:
        s->eimr = value;
        break;
    case 0x010: /* RDAR */
        if ((s->ecr & FEC_EN) && !s->rx_enabled) {
            DPRINTF("RX enable\n");
            mcf_fec_enable_rx(s);
        }
        break;
    case 0x014: /* TDAR */
        if (s->ecr & FEC_EN) {
            mcf_fec_do_tx(s);
        }
        break;
    case 0x024:
        s->ecr = value;
        if (value & FEC_RESET) {
            DPRINTF("Reset\n");
            mcf_fec_reset(s);
        }
        if ((s->ecr & FEC_EN) == 0) {
            s->rx_enabled = 0;
        }
        break;
    case 0x040:
        /* TODO: Implement MII.  */
        s->mmfr = value;
        break;
    case 0x044:
        s->mscr = value & 0xfe;
        break;
    case 0x064:
        /* TODO: Implement MIB.  */
        break;
    case 0x084:
        s->rcr = value & 0x07ff003f;
        /* TODO: Implement LOOP mode.  */
        break;
    case 0x0c4: /* TCR */
        /* We transmit immediately, so raise GRA immediately.  */
        s->tcr = value;
        if (value & 1)
            s->eir |= FEC_INT_GRA;
        break;
    case 0x0e4: /* PALR */
        s->conf.macaddr.a[0] = value >> 24;
        s->conf.macaddr.a[1] = value >> 16;
        s->conf.macaddr.a[2] = value >> 8;
        s->conf.macaddr.a[3] = value;
        break;
    case 0x0e8: /* PAUR */
        s->conf.macaddr.a[4] = value >> 24;
        s->conf.macaddr.a[5] = value >> 16;
        break;
    case 0x0ec:
        /* OPD */
        break;
    case 0x118:
    case 0x11c:
    case 0x120:
    case 0x124:
        /* TODO: implement MAC hash filtering.  */
        break;
    case 0x144:
        s->tfwr = value & 3;
        break;
    case 0x14c:
        /* FRBR writes ignored.  */
        break;
    case 0x150:
        s->rfsr = (value & 0x3fc) | 0x400;
        break;
    case 0x180:
        s->erdsr = value & ~3;
        s->rx_descriptor = s->erdsr;
        break;
    case 0x184:
        s->etdsr = value & ~3;
        s->tx_descriptor = s->etdsr;
        break;
    case 0x188:
        s->emrbr = value & 0x7f0;
        break;
    default:
        hw_error("mcf_fec_write Bad address 0x%x\n", (int)addr);
    }
    mcf_fec_update(s);
}

static int mcf_fec_can_receive(VLANClientState *nc)
{
    mcf_fec_state *s = DO_UPCAST(NICState, nc, nc)->opaque;
    return s->rx_enabled;
}

static ssize_t mcf_fec_receive(VLANClientState *nc, const uint8_t *buf, size_t size)
{
    mcf_fec_state *s = DO_UPCAST(NICState, nc, nc)->opaque;
    mcf_fec_bd bd;
    uint32_t flags = 0;
    uint32_t addr;
    uint32_t crc;
    uint32_t buf_addr;
    uint8_t *crc_ptr;
    unsigned int buf_len;

    DPRINTF("do_rx len %d\n", size);
    if (!s->rx_enabled) {
        fprintf(stderr, "mcf_fec_receive: Unexpected packet\n");
    }
    /* 4 bytes for the CRC.  */
    size += 4;
    crc = cpu_to_be32(crc32(~0, buf, size));
    crc_ptr = (uint8_t *)&crc;
    /* Huge frames are truncted.  */
    if (size > FEC_MAX_FRAME_SIZE) {
        size = FEC_MAX_FRAME_SIZE;
        flags |= FEC_BD_TR | FEC_BD_LG;
    }
    /* Frames larger than the user limit just set error flags.  */
    if (size > (s->rcr >> 16)) {
        flags |= FEC_BD_LG;
    }
    addr = s->rx_descriptor;
    while (size > 0) {
        mcf_fec_read_bd(&bd, addr);
        if ((bd.flags & FEC_BD_E) == 0) {
            /* No descriptors available.  Bail out.  */
            /* FIXME: This is wrong.  We should probably either save the
               remainder for when more RX buffers are available, or
               flag an error.  */
            fprintf(stderr, "mcf_fec: Lost end of frame\n");
            break;
        }
        buf_len = (size <= s->emrbr) ? size: s->emrbr;
        bd.length = buf_len;
        size -= buf_len;
        DPRINTF("rx_bd %x length %d\n", addr, bd.length);
        /* The last 4 bytes are the CRC.  */
        if (size < 4)
            buf_len += size - 4;
        buf_addr = bd.data;
        cpu_physical_memory_write(buf_addr, buf, buf_len);
        buf += buf_len;
        if (size < 4) {
            cpu_physical_memory_write(buf_addr + buf_len, crc_ptr, 4 - size);
            crc_ptr += 4 - size;
        }
        bd.flags &= ~FEC_BD_E;
        if (size == 0) {
            /* Last buffer in frame.  */
            bd.flags |= flags | FEC_BD_L;
            DPRINTF("rx frame flags %04x\n", bd.flags);
            s->eir |= FEC_INT_RXF;
        } else {
            s->eir |= FEC_INT_RXB;
        }
        mcf_fec_write_bd(&bd, addr);
        /* Advance to the next descriptor.  */
        if ((bd.flags & FEC_BD_W) != 0) {
            addr = s->erdsr;
        } else {
            addr += 8;
        }
    }
    s->rx_descriptor = addr;
    mcf_fec_enable_rx(s);
    mcf_fec_update(s);
    return size;
}

static CPUReadMemoryFunc * const mcf_fec_readfn[] = {
   mcf_fec_read,
   mcf_fec_read,
   mcf_fec_read
};

static CPUWriteMemoryFunc * const mcf_fec_writefn[] = {
   mcf_fec_write,
   mcf_fec_write,
   mcf_fec_write
};

static void mcf_fec_cleanup(VLANClientState *nc)
{
    mcf_fec_state *s = DO_UPCAST(NICState, nc, nc)->opaque;

    cpu_unregister_io_memory(s->mmio_index);

    qemu_free(s);
}

static NetClientInfo net_mcf_fec_info = {
    .type = NET_CLIENT_TYPE_NIC,
    .size = sizeof(NICState),
    .can_receive = mcf_fec_can_receive,
    .receive = mcf_fec_receive,
    .cleanup = mcf_fec_cleanup,
};

void mcf_fec_init(NICInfo *nd, target_phys_addr_t base, qemu_irq *irq)
{
    mcf_fec_state *s;

    qemu_check_nic_model(nd, "mcf_fec");

    s = (mcf_fec_state *)qemu_mallocz(sizeof(mcf_fec_state));
    s->irq = irq;
    s->mmio_index = cpu_register_io_memory(mcf_fec_readfn,
                                           mcf_fec_writefn, s);
    cpu_register_physical_memory(base, 0x400, s->mmio_index);

    memcpy(s->conf.macaddr.a, nd->macaddr, sizeof(nd->macaddr));
    s->conf.vlan = nd->vlan;
    s->conf.peer = nd->netdev;

    s->nic = qemu_new_nic(&net_mcf_fec_info, &s->conf, nd->model, nd->name, s);

    qemu_format_nic_info_str(&s->nic->nc, s->conf.macaddr.a);
}
Commit	Line	Data
5fafdf24	1	/*
7e049b8a PB	2	* ColdFire Fast Ethernet Controller emulation.
	3	*
	4	* Copyright (c) 2007 CodeSourcery.
	5	*
	6	* This code is licenced under the GPL
	7	*/
87ecb68b PB	8	#include "hw.h"
	9	#include "net.h"
	10	#include "mcf.h"
7e049b8a PB	11	/* For crc32 */
	12	#include <zlib.h>
	13
	14	//#define DEBUG_FEC 1
	15
	16	#ifdef DEBUG_FEC
001faf32 BS	17	#define DPRINTF(fmt, ...) \
001faf32 BS	18	do { printf("mcf_fec: " fmt , ## __VA_ARGS__); } while (0)
7e049b8a	19	#else
001faf32	20	#define DPRINTF(fmt, ...) do {} while(0)
7e049b8a PB	21	#endif
	22
	23	#define FEC_MAX_FRAME_SIZE 2032
	24
	25	typedef struct {
	26	qemu_irq *irq;
b946a153	27	int mmio_index;
1cc49d95 MM	28	NICState *nic;
1cc49d95 MM	29	NICConf conf;
7e049b8a PB	30	uint32_t irq_state;
	31	uint32_t eir;
	32	uint32_t eimr;
	33	int rx_enabled;
	34	uint32_t rx_descriptor;
	35	uint32_t tx_descriptor;
	36	uint32_t ecr;
	37	uint32_t mmfr;
	38	uint32_t mscr;
	39	uint32_t rcr;
	40	uint32_t tcr;
	41	uint32_t tfwr;
	42	uint32_t rfsr;
	43	uint32_t erdsr;
	44	uint32_t etdsr;
	45	uint32_t emrbr;
7e049b8a PB	46	} mcf_fec_state;
	47
	48	#define FEC_INT_HB 0x80000000
	49	#define FEC_INT_BABR 0x40000000
	50	#define FEC_INT_BABT 0x20000000
	51	#define FEC_INT_GRA 0x10000000
	52	#define FEC_INT_TXF 0x08000000
	53	#define FEC_INT_TXB 0x04000000
	54	#define FEC_INT_RXF 0x02000000
	55	#define FEC_INT_RXB 0x01000000
	56	#define FEC_INT_MII 0x00800000
	57	#define FEC_INT_EB 0x00400000
	58	#define FEC_INT_LC 0x00200000
	59	#define FEC_INT_RL 0x00100000
	60	#define FEC_INT_UN 0x00080000
	61
	62	#define FEC_EN 2
	63	#define FEC_RESET 1
	64
	65	/* Map interrupt flags onto IRQ lines. */
	66	#define FEC_NUM_IRQ 13
	67	static const uint32_t mcf_fec_irq_map[FEC_NUM_IRQ] = {
	68	FEC_INT_TXF,
	69	FEC_INT_TXB,
	70	FEC_INT_UN,
	71	FEC_INT_RL,
	72	FEC_INT_RXF,
	73	FEC_INT_RXB,
	74	FEC_INT_MII,
	75	FEC_INT_LC,
	76	FEC_INT_HB,
	77	FEC_INT_GRA,
	78	FEC_INT_EB,
	79	FEC_INT_BABT,
	80	FEC_INT_BABR
	81	};
	82
	83	/* Buffer Descriptor. */
	84	typedef struct {
	85	uint16_t flags;
	86	uint16_t length;
	87	uint32_t data;
	88	} mcf_fec_bd;
	89
	90	#define FEC_BD_R 0x8000
	91	#define FEC_BD_E 0x8000
	92	#define FEC_BD_O1 0x4000
	93	#define FEC_BD_W 0x2000
	94	#define FEC_BD_O2 0x1000
	95	#define FEC_BD_L 0x0800
	96	#define FEC_BD_TC 0x0400
	97	#define FEC_BD_ABC 0x0200
	98	#define FEC_BD_M 0x0100
	99	#define FEC_BD_BC 0x0080
	100	#define FEC_BD_MC 0x0040
	101	#define FEC_BD_LG 0x0020
	102	#define FEC_BD_NO 0x0010
	103	#define FEC_BD_CR 0x0004
	104	#define FEC_BD_OV 0x0002
	105	#define FEC_BD_TR 0x0001
	106
	107	static void mcf_fec_read_bd(mcf_fec_bd *bd, uint32_t addr)
	108	{
	109	cpu_physical_memory_read(addr, (uint8_t )bd, sizeof(bd));
110	be16_to_cpus(&bd->flags);
111	be16_to_cpus(&bd->length);
112	be32_to_cpus(&bd->data);
113	}
114
115	static void mcf_fec_write_bd(mcf_fec_bd *bd, uint32_t addr)
116	{
117	mcf_fec_bd tmp;
118	tmp.flags = cpu_to_be16(bd->flags);
119	tmp.length = cpu_to_be16(bd->length);
120	tmp.data = cpu_to_be32(bd->data);
121	cpu_physical_memory_write(addr, (uint8_t *)&tmp, sizeof(tmp));
122	}
123
124	static void mcf_fec_update(mcf_fec_state *s)
125	{
126	uint32_t active;
127	uint32_t changed;
128	uint32_t mask;
129	int i;
130
131	active = s->eir & s->eimr;
132	changed = active ^s->irq_state;
133	for (i = 0; i < FEC_NUM_IRQ; i++) {
134	mask = mcf_fec_irq_map[i];
135	if (changed & mask) {
136	DPRINTF("IRQ %d = %d\n", i, (active & mask) != 0);
137	qemu_set_irq(s->irq[i], (active & mask) != 0);
138	}
139	}
140	s->irq_state = active;
141	}
142
143	static void mcf_fec_do_tx(mcf_fec_state *s)
144	{
145	uint32_t addr;
146	mcf_fec_bd bd;
147	int frame_size;
148	int len;
149	uint8_t frame[FEC_MAX_FRAME_SIZE];
150	uint8_t *ptr;
151
152	DPRINTF("do_tx\n");
153	ptr = frame;
154	frame_size = 0;
155	addr = s->tx_descriptor;
156	while (1) {
157	mcf_fec_read_bd(&bd, addr);
158	DPRINTF("tx_bd %x flags %04x len %d data %08x\n",
159	addr, bd.flags, bd.length, bd.data);
160	if ((bd.flags & FEC_BD_R) == 0) {
161	/* Run out of descriptors to transmit. */
162	break;
163	}
164	len = bd.length;
165	if (frame_size + len > FEC_MAX_FRAME_SIZE) {
166	len = FEC_MAX_FRAME_SIZE - frame_size;
167	s->eir \|= FEC_INT_BABT;
168	}
169	cpu_physical_memory_read(bd.data, ptr, len);
170	ptr += len;
171	frame_size += len;
172	if (bd.flags & FEC_BD_L) {
173	/* Last buffer in frame. */
174	DPRINTF("Sending packet\n");
1cc49d95	175	qemu_send_packet(&s->nic->nc, frame, len);
7e049b8a PB	176	ptr = frame;
	177	frame_size = 0;
	178	s->eir \|= FEC_INT_TXF;
	179	}
	180	s->eir \|= FEC_INT_TXB;
	181	bd.flags &= ~FEC_BD_R;
	182	/* Write back the modified descriptor. */
	183	mcf_fec_write_bd(&bd, addr);
	184	/* Advance to the next descriptor. */
	185	if ((bd.flags & FEC_BD_W) != 0) {
	186	addr = s->etdsr;
	187	} else {
	188	addr += 8;
	189	}
	190	}
	191	s->tx_descriptor = addr;
	192	}
	193
4fdcd8d4	194	static void mcf_fec_enable_rx(mcf_fec_state *s)
7e049b8a PB	195	{
	196	mcf_fec_bd bd;
	197
	198	mcf_fec_read_bd(&bd, s->rx_descriptor);
	199	s->rx_enabled = ((bd.flags & FEC_BD_E) != 0);
	200	if (!s->rx_enabled)
	201	DPRINTF("RX buffer full\n");
	202	}
	203
	204	static void mcf_fec_reset(mcf_fec_state *s)
	205	{
	206	s->eir = 0;
	207	s->eimr = 0;
	208	s->rx_enabled = 0;
	209	s->ecr = 0;
	210	s->mscr = 0;
	211	s->rcr = 0x05ee0001;
	212	s->tcr = 0;
	213	s->tfwr = 0;
	214	s->rfsr = 0x500;
	215	}
	216
c227f099	217	static uint32_t mcf_fec_read(void *opaque, target_phys_addr_t addr)
7e049b8a PB	218	{
	219	mcf_fec_state s = (mcf_fec_state )opaque;
	220	switch (addr & 0x3ff) {
	221	case 0x004: return s->eir;
	222	case 0x008: return s->eimr;
	223	case 0x010: return s->rx_enabled ? (1 << 24) : 0; /* RDAR */
	224	case 0x014: return 0; /* TDAR */
	225	case 0x024: return s->ecr;
	226	case 0x040: return s->mmfr;
	227	case 0x044: return s->mscr;
	228	case 0x064: return 0; /* MIBC */
	229	case 0x084: return s->rcr;
	230	case 0x0c4: return s->tcr;
	231	case 0x0e4: /* PALR */
1cc49d95 MM	232	return (s->conf.macaddr.a[0] << 24) \| (s->conf.macaddr.a[1] << 16)
1cc49d95 MM	233	\| (s->conf.macaddr.a[2] << 8) \| s->conf.macaddr.a[3];
7e049b8a PB	234	break;
7e049b8a PB	235	case 0x0e8: /* PAUR */
1cc49d95	236	return (s->conf.macaddr.a[4] << 24) \| (s->conf.macaddr.a[5] << 16) \| 0x8808;
7e049b8a PB	237	case 0x0ec: return 0x10000; /* OPD */
	238	case 0x118: return 0;
	239	case 0x11c: return 0;
	240	case 0x120: return 0;
	241	case 0x124: return 0;
	242	case 0x144: return s->tfwr;
	243	case 0x14c: return 0x600;
	244	case 0x150: return s->rfsr;
	245	case 0x180: return s->erdsr;
	246	case 0x184: return s->etdsr;
	247	case 0x188: return s->emrbr;
	248	default:
2ac71179	249	hw_error("mcf_fec_read: Bad address 0x%x\n", (int)addr);
7e049b8a PB	250	return 0;
	251	}
	252	}
	253
c227f099	254	static void mcf_fec_write(void *opaque, target_phys_addr_t addr, uint32_t value)
7e049b8a PB	255	{
	256	mcf_fec_state s = (mcf_fec_state )opaque;
	257	switch (addr & 0x3ff) {
	258	case 0x004:
	259	s->eir &= ~value;
	260	break;
	261	case 0x008:
	262	s->eimr = value;
	263	break;
	264	case 0x010: /* RDAR */
	265	if ((s->ecr & FEC_EN) && !s->rx_enabled) {
	266	DPRINTF("RX enable\n");
	267	mcf_fec_enable_rx(s);
	268	}
	269	break;
	270	case 0x014: /* TDAR */
	271	if (s->ecr & FEC_EN) {
	272	mcf_fec_do_tx(s);
	273	}
	274	break;
	275	case 0x024:
	276	s->ecr = value;
	277	if (value & FEC_RESET) {
	278	DPRINTF("Reset\n");
	279	mcf_fec_reset(s);
	280	}
	281	if ((s->ecr & FEC_EN) == 0) {
	282	s->rx_enabled = 0;
	283	}
	284	break;
	285	case 0x040:
	286	/* TODO: Implement MII. */
	287	s->mmfr = value;
	288	break;
	289	case 0x044:
	290	s->mscr = value & 0xfe;
	291	break;
	292	case 0x064:
	293	/* TODO: Implement MIB. */
	294	break;
	295	case 0x084:
	296	s->rcr = value & 0x07ff003f;
	297	/* TODO: Implement LOOP mode. */
	298	break;
	299	case 0x0c4: /* TCR */
	300	/* We transmit immediately, so raise GRA immediately. */
	301	s->tcr = value;
	302	if (value & 1)
	303	s->eir \|= FEC_INT_GRA;
	304	break;
	305	case 0x0e4: /* PALR */
1cc49d95 MM	306	s->conf.macaddr.a[0] = value >> 24;
	307	s->conf.macaddr.a[1] = value >> 16;
	308	s->conf.macaddr.a[2] = value >> 8;
	309	s->conf.macaddr.a[3] = value;
7e049b8a PB	310	break;
7e049b8a PB	311	case 0x0e8: /* PAUR */
1cc49d95 MM	312	s->conf.macaddr.a[4] = value >> 24;
1cc49d95 MM	313	s->conf.macaddr.a[5] = value >> 16;
7e049b8a PB	314	break;
	315	case 0x0ec:
	316	/* OPD */
	317	break;
	318	case 0x118:
	319	case 0x11c:
	320	case 0x120:
	321	case 0x124:
	322	/* TODO: implement MAC hash filtering. */
	323	break;
	324	case 0x144:
	325	s->tfwr = value & 3;
	326	break;
	327	case 0x14c:
	328	/* FRBR writes ignored. */
	329	break;
	330	case 0x150:
	331	s->rfsr = (value & 0x3fc) \| 0x400;
	332	break;
	333	case 0x180:
	334	s->erdsr = value & ~3;
	335	s->rx_descriptor = s->erdsr;
	336	break;
	337	case 0x184:
	338	s->etdsr = value & ~3;
	339	s->tx_descriptor = s->etdsr;
	340	break;
	341	case 0x188:
	342	s->emrbr = value & 0x7f0;
	343	break;
	344	default:
2ac71179	345	hw_error("mcf_fec_write Bad address 0x%x\n", (int)addr);
7e049b8a PB	346	}
	347	mcf_fec_update(s);
	348	}
	349
1cc49d95	350	static int mcf_fec_can_receive(VLANClientState *nc)
7e049b8a	351	{
1cc49d95	352	mcf_fec_state *s = DO_UPCAST(NICState, nc, nc)->opaque;
7e049b8a PB	353	return s->rx_enabled;
	354	}
	355
1cc49d95	356	static ssize_t mcf_fec_receive(VLANClientState nc, const uint8_t buf, size_t size)
7e049b8a	357	{
1cc49d95	358	mcf_fec_state *s = DO_UPCAST(NICState, nc, nc)->opaque;
7e049b8a PB	359	mcf_fec_bd bd;
	360	uint32_t flags = 0;
	361	uint32_t addr;
	362	uint32_t crc;
	363	uint32_t buf_addr;
	364	uint8_t *crc_ptr;
	365	unsigned int buf_len;
	366
	367	DPRINTF("do_rx len %d\n", size);
	368	if (!s->rx_enabled) {
	369	fprintf(stderr, "mcf_fec_receive: Unexpected packet\n");
	370	}
	371	/* 4 bytes for the CRC. */
	372	size += 4;
	373	crc = cpu_to_be32(crc32(~0, buf, size));
	374	crc_ptr = (uint8_t *)&crc;
	375	/* Huge frames are truncted. */
	376	if (size > FEC_MAX_FRAME_SIZE) {
	377	size = FEC_MAX_FRAME_SIZE;
	378	flags \|= FEC_BD_TR \| FEC_BD_LG;
	379	}
	380	/* Frames larger than the user limit just set error flags. */
	381	if (size > (s->rcr >> 16)) {
	382	flags \|= FEC_BD_LG;
	383	}
	384	addr = s->rx_descriptor;
	385	while (size > 0) {
	386	mcf_fec_read_bd(&bd, addr);
	387	if ((bd.flags & FEC_BD_E) == 0) {
	388	/* No descriptors available. Bail out. */
	389	/* FIXME: This is wrong. We should probably either save the
	390	remainder for when more RX buffers are available, or
	391	flag an error. */
	392	fprintf(stderr, "mcf_fec: Lost end of frame\n");
	393	break;
	394	}
	395	buf_len = (size <= s->emrbr) ? size: s->emrbr;
	396	bd.length = buf_len;
	397	size -= buf_len;
	398	DPRINTF("rx_bd %x length %d\n", addr, bd.length);
	399	/* The last 4 bytes are the CRC. */
	400	if (size < 4)
	401	buf_len += size - 4;
	402	buf_addr = bd.data;
	403	cpu_physical_memory_write(buf_addr, buf, buf_len);
	404	buf += buf_len;
	405	if (size < 4) {
	406	cpu_physical_memory_write(buf_addr + buf_len, crc_ptr, 4 - size);
	407	crc_ptr += 4 - size;
	408	}
	409	bd.flags &= ~FEC_BD_E;
	410	if (size == 0) {
	411	/* Last buffer in frame. */
	412	bd.flags \|= flags \| FEC_BD_L;
	413	DPRINTF("rx frame flags %04x\n", bd.flags);
	414	s->eir \|= FEC_INT_RXF;
	415	} else {
	416	s->eir \|= FEC_INT_RXB;
	417	}
	418	mcf_fec_write_bd(&bd, addr);
	419	/* Advance to the next descriptor. */
	420	if ((bd.flags & FEC_BD_W) != 0) {
	421	addr = s->erdsr;
	422	} else {
423	addr += 8;
424	}
425	}
426	s->rx_descriptor = addr;
427	mcf_fec_enable_rx(s);
428	mcf_fec_update(s);
4f1c942b	429	return size;
7e049b8a PB	430	}
7e049b8a PB	431
d60efc6b	432	static CPUReadMemoryFunc * const mcf_fec_readfn[] = {
7e049b8a PB	433	mcf_fec_read,
	434	mcf_fec_read,
	435	mcf_fec_read
	436	};
	437
d60efc6b	438	static CPUWriteMemoryFunc * const mcf_fec_writefn[] = {
7e049b8a PB	439	mcf_fec_write,
	440	mcf_fec_write,
	441	mcf_fec_write
	442	};
	443
1cc49d95	444	static void mcf_fec_cleanup(VLANClientState *nc)
b946a153	445	{
1cc49d95	446	mcf_fec_state *s = DO_UPCAST(NICState, nc, nc)->opaque;
b946a153 AL	447
	448	cpu_unregister_io_memory(s->mmio_index);
	449
	450	qemu_free(s);
	451	}
	452
1cc49d95 MM	453	static NetClientInfo net_mcf_fec_info = {
	454	.type = NET_CLIENT_TYPE_NIC,
	455	.size = sizeof(NICState),
	456	.can_receive = mcf_fec_can_receive,
	457	.receive = mcf_fec_receive,
	458	.cleanup = mcf_fec_cleanup,
	459	};
	460
c227f099	461	void mcf_fec_init(NICInfo nd, target_phys_addr_t base, qemu_irq irq)
7e049b8a PB	462	{
7e049b8a PB	463	mcf_fec_state *s;
7e049b8a	464
0ae18cee AL	465	qemu_check_nic_model(nd, "mcf_fec");
0ae18cee AL	466
7e049b8a PB	467	s = (mcf_fec_state *)qemu_mallocz(sizeof(mcf_fec_state));
7e049b8a PB	468	s->irq = irq;
1eed09cb	469	s->mmio_index = cpu_register_io_memory(mcf_fec_readfn,
b946a153 AL	470	mcf_fec_writefn, s);
b946a153 AL	471	cpu_register_physical_memory(base, 0x400, s->mmio_index);
7e049b8a	472
1cc49d95 MM	473	memcpy(s->conf.macaddr.a, nd->macaddr, sizeof(nd->macaddr));
	474	s->conf.vlan = nd->vlan;
	475	s->conf.peer = nd->netdev;
	476
	477	s->nic = qemu_new_nic(&net_mcf_fec_info, &s->conf, nd->model, nd->name, s);
	478
	479	qemu_format_nic_info_str(&s->nic->nc, s->conf.macaddr.a);
7e049b8a	480	}