[mirror_qemu.git] / hw / lance.c

/*
 * QEMU Lance emulation
 * 
 * Copyright (c) 2003-2005 Fabrice Bellard
 * 
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */
#include "vl.h"

/* debug LANCE card */
//#define DEBUG_LANCE

#ifdef DEBUG_LANCE
#define DPRINTF(fmt, args...) \
do { printf("LANCE: " fmt , ##args); } while (0)
#else
#define DPRINTF(fmt, args...)
#endif

#ifndef LANCE_LOG_TX_BUFFERS
#define LANCE_LOG_TX_BUFFERS 4
#define LANCE_LOG_RX_BUFFERS 4
#endif

#define LE_CSR0 0
#define LE_CSR1 1
#define LE_CSR2 2
#define LE_CSR3 3
#define LE_NREGS (LE_CSR3 + 1)
#define LE_MAXREG LE_CSR3

#define LE_RDP  0
#define LE_RAP  1

#define LE_MO_PROM      0x8000  /* Enable promiscuous mode */

#define	LE_C0_ERR	0x8000	/* Error: set if BAB, SQE, MISS or ME is set */
#define	LE_C0_BABL	0x4000	/* BAB:  Babble: tx timeout. */
#define	LE_C0_CERR	0x2000	/* SQE:  Signal quality error */
#define	LE_C0_MISS	0x1000	/* MISS: Missed a packet */
#define	LE_C0_MERR	0x0800	/* ME:   Memory error */
#define	LE_C0_RINT	0x0400	/* Received interrupt */
#define	LE_C0_TINT	0x0200	/* Transmitter Interrupt */
#define	LE_C0_IDON	0x0100	/* IFIN: Init finished. */
#define	LE_C0_INTR	0x0080	/* Interrupt or error */
#define	LE_C0_INEA	0x0040	/* Interrupt enable */
#define	LE_C0_RXON	0x0020	/* Receiver on */
#define	LE_C0_TXON	0x0010	/* Transmitter on */
#define	LE_C0_TDMD	0x0008	/* Transmitter demand */
#define	LE_C0_STOP	0x0004	/* Stop the card */
#define	LE_C0_STRT	0x0002	/* Start the card */
#define	LE_C0_INIT	0x0001	/* Init the card */

#define	LE_C3_BSWP	0x4     /* SWAP */
#define	LE_C3_ACON	0x2	/* ALE Control */
#define	LE_C3_BCON	0x1	/* Byte control */

/* Receive message descriptor 1 */
#define LE_R1_OWN       0x80    /* Who owns the entry */
#define LE_R1_ERR       0x40    /* Error: if FRA, OFL, CRC or BUF is set */
#define LE_R1_FRA       0x20    /* FRA: Frame error */
#define LE_R1_OFL       0x10    /* OFL: Frame overflow */
#define LE_R1_CRC       0x08    /* CRC error */
#define LE_R1_BUF       0x04    /* BUF: Buffer error */
#define LE_R1_SOP       0x02    /* Start of packet */
#define LE_R1_EOP       0x01    /* End of packet */
#define LE_R1_POK       0x03    /* Packet is complete: SOP + EOP */

#define LE_T1_OWN       0x80    /* Lance owns the packet */
#define LE_T1_ERR       0x40    /* Error summary */
#define LE_T1_EMORE     0x10    /* Error: more than one retry needed */
#define LE_T1_EONE      0x08    /* Error: one retry needed */
#define LE_T1_EDEF      0x04    /* Error: deferred */
#define LE_T1_SOP       0x02    /* Start of packet */
#define LE_T1_EOP       0x01    /* End of packet */
#define LE_T1_POK	0x03	/* Packet is complete: SOP + EOP */

#define LE_T3_BUF       0x8000  /* Buffer error */
#define LE_T3_UFL       0x4000  /* Error underflow */
#define LE_T3_LCOL      0x1000  /* Error late collision */
#define LE_T3_CLOS      0x0800  /* Error carrier loss */
#define LE_T3_RTY       0x0400  /* Error retry */
#define LE_T3_TDR       0x03ff  /* Time Domain Reflectometry counter */

#define TX_RING_SIZE			(1 << (LANCE_LOG_TX_BUFFERS))
#define TX_RING_MOD_MASK		(TX_RING_SIZE - 1)
#define TX_RING_LEN_BITS		((LANCE_LOG_TX_BUFFERS) << 29)

#define RX_RING_SIZE			(1 << (LANCE_LOG_RX_BUFFERS))
#define RX_RING_MOD_MASK		(RX_RING_SIZE - 1)
#define RX_RING_LEN_BITS		((LANCE_LOG_RX_BUFFERS) << 29)

#define PKT_BUF_SZ		1544
#define RX_BUFF_SIZE            PKT_BUF_SZ
#define TX_BUFF_SIZE            PKT_BUF_SZ

struct lance_rx_desc {
	unsigned short rmd0;        /* low address of packet */
	unsigned char  rmd1_bits;   /* descriptor bits */
	unsigned char  rmd1_hadr;   /* high address of packet */
	short    length;    	    /* This length is 2s complement (negative)!
				     * Buffer length
				     */
	unsigned short mblength;    /* This is the actual number of bytes received */
};

struct lance_tx_desc {
	unsigned short tmd0;        /* low address of packet */
	unsigned char  tmd1_bits;   /* descriptor bits */
	unsigned char  tmd1_hadr;   /* high address of packet */
	short length;          	    /* Length is 2s complement (negative)! */
	unsigned short misc;
};

/* The LANCE initialization block, described in databook. */
/* On the Sparc, this block should be on a DMA region     */
struct lance_init_block {
	unsigned short mode;		/* Pre-set mode (reg. 15) */
	unsigned char phys_addr[6];     /* Physical ethernet address */
	unsigned filter[2];		/* Multicast filter. */

	/* Receive and transmit ring base, along with extra bits. */
	unsigned short rx_ptr;		/* receive descriptor addr */
	unsigned short rx_len;		/* receive len and high addr */
	unsigned short tx_ptr;		/* transmit descriptor addr */
	unsigned short tx_len;		/* transmit len and high addr */
    
	/* The Tx and Rx ring entries must aligned on 8-byte boundaries. */
	struct lance_rx_desc brx_ring[RX_RING_SIZE];
	struct lance_tx_desc btx_ring[TX_RING_SIZE];
    
	char   tx_buf [TX_RING_SIZE][TX_BUFF_SIZE];
	char   pad[2];			/* align rx_buf for copy_and_sum(). */
	char   rx_buf [RX_RING_SIZE][RX_BUFF_SIZE];
};

#define LEDMA_REGS 4
#define LEDMA_MAXADDR (LEDMA_REGS * 4 - 1)

typedef struct LANCEState {
    NetDriverState *nd;
    uint32_t leptr;
    uint16_t addr;
    uint16_t regs[LE_NREGS];
    uint8_t phys[6]; /* mac address */
    int irq;
    unsigned int rxptr, txptr;
    uint32_t ledmaregs[LEDMA_REGS];
} LANCEState;

static void lance_send(void *opaque);

static void lance_reset(void *opaque)
{
    LANCEState *s = opaque;
    memcpy(s->phys, s->nd->macaddr, 6);
    s->rxptr = 0;
    s->txptr = 0;
    memset(s->regs, 0, LE_NREGS * 2);
    s->regs[LE_CSR0] = LE_C0_STOP;
    memset(s->ledmaregs, 0, LEDMA_REGS * 4);
}

static uint32_t lance_mem_readw(void *opaque, target_phys_addr_t addr)
{
    LANCEState *s = opaque;
    uint32_t saddr;

    saddr = addr & LE_MAXREG;
    switch (saddr >> 1) {
    case LE_RDP:
	DPRINTF("read dreg[%d] = %4.4x\n", s->addr, s->regs[s->addr]);
	return s->regs[s->addr];
    case LE_RAP:
	DPRINTF("read areg = %4.4x\n", s->addr);
	return s->addr;
    default:
	DPRINTF("read unknown(%d)\n", saddr>>1);
	break;
    }
    return 0;
}

static void lance_mem_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
{
    LANCEState *s = opaque;
    uint32_t saddr;
    uint16_t reg;

    saddr = addr & LE_MAXREG;
    switch (saddr >> 1) {
    case LE_RDP:
	DPRINTF("write dreg[%d] = %4.4x\n", s->addr, val);
	switch(s->addr) {
	case LE_CSR0:
	    if (val & LE_C0_STOP) {
		s->regs[LE_CSR0] = LE_C0_STOP;
		break;
	    }

	    reg = s->regs[LE_CSR0];

	    // 1 = clear for some bits
	    reg &= ~(val & 0x7f00);

	    // generated bits
	    reg &= ~(LE_C0_ERR | LE_C0_INTR);
	    if (reg & 0x7100)
		reg |= LE_C0_ERR;
	    if (reg & 0x7f00)
		reg |= LE_C0_INTR;

	    // direct bit
	    reg &= ~LE_C0_INEA;
	    reg |= val & LE_C0_INEA;

	    // exclusive bits
	    if (val & LE_C0_INIT) {
		reg |= LE_C0_IDON | LE_C0_INIT;
		reg &= ~LE_C0_STOP;
	    }
	    else if (val & LE_C0_STRT) {
		reg |= LE_C0_STRT | LE_C0_RXON | LE_C0_TXON;
		reg &= ~LE_C0_STOP;
	    }

	    s->regs[LE_CSR0] = reg;
	    break;
	case LE_CSR1:
	    s->leptr = (s->leptr & 0xffff0000) | (val & 0xffff);
	    s->regs[s->addr] = val;
	    break;
	case LE_CSR2:
	    s->leptr = (s->leptr & 0xffff) | ((val & 0xffff) << 16);
	    s->regs[s->addr] = val;
	    break;
	case LE_CSR3:
	    s->regs[s->addr] = val;
	    break;
	}
	break;
    case LE_RAP:
	DPRINTF("write areg = %4.4x\n", val);
	if (val < LE_NREGS)
	    s->addr = val;
	break;
    default:
	DPRINTF("write unknown(%d) = %4.4x\n", saddr>>1, val);
	break;
    }
    lance_send(s);
}

static CPUReadMemoryFunc *lance_mem_read[3] = {
    lance_mem_readw,
    lance_mem_readw,
    lance_mem_readw,
};

static CPUWriteMemoryFunc *lance_mem_write[3] = {
    lance_mem_writew,
    lance_mem_writew,
    lance_mem_writew,
};


/* return the max buffer size if the LANCE can receive more data */
static int lance_can_receive(void *opaque)
{
    LANCEState *s = opaque;
    uint32_t dmaptr = s->leptr + s->ledmaregs[3];
    struct lance_init_block *ib;
    int i;
    uint8_t temp8;

    if ((s->regs[LE_CSR0] & LE_C0_STOP) == LE_C0_STOP)
	return 0;

    ib = (void *) iommu_translate(dmaptr);

    for (i = 0; i < RX_RING_SIZE; i++) {
	cpu_physical_memory_read((uint32_t)&ib->brx_ring[i].rmd1_bits, (void *) &temp8, 1);
	if (temp8 == (LE_R1_OWN)) {
	    DPRINTF("can receive %d\n", RX_BUFF_SIZE);
	    return RX_BUFF_SIZE;
	}
    }
    DPRINTF("cannot receive\n");
    return 0;
}

#define MIN_BUF_SIZE 60

static void lance_receive(void *opaque, const uint8_t *buf, int size)
{
    LANCEState *s = opaque;
    uint32_t dmaptr = s->leptr + s->ledmaregs[3];
    struct lance_init_block *ib;
    unsigned int i, old_rxptr;
    uint16_t temp16;
    uint8_t temp8;

    DPRINTF("receive size %d\n", size);
    if ((s->regs[LE_CSR0] & LE_C0_STOP) == LE_C0_STOP)
	return;

    ib = (void *) iommu_translate(dmaptr);

    old_rxptr = s->rxptr;
    for (i = s->rxptr; i != ((old_rxptr - 1) & RX_RING_MOD_MASK); i = (i + 1) & RX_RING_MOD_MASK) {
	cpu_physical_memory_read((uint32_t)&ib->brx_ring[i].rmd1_bits, (void *) &temp8, 1);
	if (temp8 == (LE_R1_OWN)) {
	    s->rxptr = (s->rxptr + 1) & RX_RING_MOD_MASK;
	    temp16 = size + 4;
	    bswap16s(&temp16);
	    cpu_physical_memory_write((uint32_t)&ib->brx_ring[i].mblength, (void *) &temp16, 2);
	    cpu_physical_memory_write((uint32_t)&ib->rx_buf[i], buf, size);
	    temp8 = LE_R1_POK;
	    cpu_physical_memory_write((uint32_t)&ib->brx_ring[i].rmd1_bits, (void *) &temp8, 1);
	    s->regs[LE_CSR0] |= LE_C0_RINT | LE_C0_INTR;
	    if (s->regs[LE_CSR0] & LE_C0_INEA)
		pic_set_irq(s->irq, 1);
	    DPRINTF("got packet, len %d\n", size);
	    return;
	}
    }
}

static void lance_send(void *opaque)
{
    LANCEState *s = opaque;
    uint32_t dmaptr = s->leptr + s->ledmaregs[3];
    struct lance_init_block *ib;
    unsigned int i, old_txptr;
    uint16_t temp16;
    uint8_t temp8;
    char pkt_buf[PKT_BUF_SZ];

    DPRINTF("sending packet? (csr0 %4.4x)\n", s->regs[LE_CSR0]);
    if ((s->regs[LE_CSR0] & LE_C0_STOP) == LE_C0_STOP)
	return;

    ib = (void *) iommu_translate(dmaptr);

    DPRINTF("sending packet? (dmaptr %8.8x) (ib %p) (btx_ring %p)\n", dmaptr, ib, &ib->btx_ring);
    old_txptr = s->txptr;
    for (i = s->txptr; i != ((old_txptr - 1) & TX_RING_MOD_MASK); i = (i + 1) & TX_RING_MOD_MASK) {
	cpu_physical_memory_read((uint32_t)&ib->btx_ring[i].tmd1_bits, (void *) &temp8, 1);
	if (temp8 == (LE_T1_POK|LE_T1_OWN)) {
	    cpu_physical_memory_read((uint32_t)&ib->btx_ring[i].length, (void *) &temp16, 2);
	    bswap16s(&temp16);
	    temp16 = (~temp16) + 1;
	    cpu_physical_memory_read((uint32_t)&ib->tx_buf[i], pkt_buf, temp16);
	    DPRINTF("sending packet, len %d\n", temp16);
	    qemu_send_packet(s->nd, pkt_buf, temp16);
	    temp8 = LE_T1_POK;
	    cpu_physical_memory_write((uint32_t)&ib->btx_ring[i].tmd1_bits, (void *) &temp8, 1);
	    s->txptr = (s->txptr + 1) & TX_RING_MOD_MASK;
	    s->regs[LE_CSR0] |= LE_C0_TINT | LE_C0_INTR;
	}
    }
    if ((s->regs[LE_CSR0] & LE_C0_INTR) && (s->regs[LE_CSR0] & LE_C0_INEA))
	pic_set_irq(s->irq, 1);
}

static uint32_t ledma_mem_readl(void *opaque, target_phys_addr_t addr)
{
    LANCEState *s = opaque;
    uint32_t saddr;

    saddr = (addr & LEDMA_MAXADDR) >> 2;
    return s->ledmaregs[saddr];
}

static void ledma_mem_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
{
    LANCEState *s = opaque;
    uint32_t saddr;

    saddr = (addr & LEDMA_MAXADDR) >> 2;
    s->ledmaregs[saddr] = val;
}

static CPUReadMemoryFunc *ledma_mem_read[3] = {
    ledma_mem_readl,
    ledma_mem_readl,
    ledma_mem_readl,
};

static CPUWriteMemoryFunc *ledma_mem_write[3] = {
    ledma_mem_writel,
    ledma_mem_writel,
    ledma_mem_writel,
};

static void lance_save(QEMUFile *f, void *opaque)
{
    LANCEState *s = opaque;
    int i;
    
    qemu_put_be32s(f, &s->leptr);
    qemu_put_be16s(f, &s->addr);
    for (i = 0; i < LE_NREGS; i ++)
	qemu_put_be16s(f, &s->regs[i]);
    qemu_put_buffer(f, s->phys, 6);
    qemu_put_be32s(f, &s->irq);
    for (i = 0; i < LEDMA_REGS; i ++)
	qemu_put_be32s(f, &s->ledmaregs[i]);
}

static int lance_load(QEMUFile *f, void *opaque, int version_id)
{
    LANCEState *s = opaque;
    int i;
    
    if (version_id != 1)
        return -EINVAL;

    qemu_get_be32s(f, &s->leptr);
    qemu_get_be16s(f, &s->addr);
    for (i = 0; i < LE_NREGS; i ++)
	qemu_get_be16s(f, &s->regs[i]);
    qemu_get_buffer(f, s->phys, 6);
    qemu_get_be32s(f, &s->irq);
    for (i = 0; i < LEDMA_REGS; i ++)
	qemu_get_be32s(f, &s->ledmaregs[i]);
    return 0;
}

void lance_init(NetDriverState *nd, int irq, uint32_t leaddr, uint32_t ledaddr)
{
    LANCEState *s;
    int lance_io_memory, ledma_io_memory;

    s = qemu_mallocz(sizeof(LANCEState));
    if (!s)
        return;

    s->nd = nd;
    s->irq = irq;

    lance_io_memory = cpu_register_io_memory(0, lance_mem_read, lance_mem_write, s);
    cpu_register_physical_memory(leaddr, 4, lance_io_memory);

    ledma_io_memory = cpu_register_io_memory(0, ledma_mem_read, ledma_mem_write, s);
    cpu_register_physical_memory(ledaddr, 16, ledma_io_memory);

    lance_reset(s);
    qemu_add_read_packet(nd, lance_can_receive, lance_receive, s);
    register_savevm("lance", leaddr, 1, lance_save, lance_load, s);
    qemu_register_reset(lance_reset, s);
}
Commit	Line	Data
420557e8 FB	1	/*
	2	* QEMU Lance emulation
	3	*
66321a11	4	* Copyright (c) 2003-2005 Fabrice Bellard
420557e8 FB	5	*
	6	* Permission is hereby granted, free of charge, to any person obtaining a copy
	7	* of this software and associated documentation files (the "Software"), to deal
	8	* in the Software without restriction, including without limitation the rights
	9	* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
	10	* copies of the Software, and to permit persons to whom the Software is
	11	* furnished to do so, subject to the following conditions:
	12	*
	13	* The above copyright notice and this permission notice shall be included in
	14	* all copies or substantial portions of the Software.
	15	*
	16	* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
	17	* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
	18	* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
	19	* THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
	20	* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
	21	* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
	22	* THE SOFTWARE.
	23	*/
	24	#include "vl.h"
	25
	26	/* debug LANCE card */
8d5f07fa	27	//#define DEBUG_LANCE
420557e8	28
66321a11 FB	29	#ifdef DEBUG_LANCE
	30	#define DPRINTF(fmt, args...) \
	31	do { printf("LANCE: " fmt , ##args); } while (0)
	32	#else
	33	#define DPRINTF(fmt, args...)
	34	#endif
	35
420557e8 FB	36	#ifndef LANCE_LOG_TX_BUFFERS
	37	#define LANCE_LOG_TX_BUFFERS 4
	38	#define LANCE_LOG_RX_BUFFERS 4
	39	#endif
	40
420557e8 FB	41	#define LE_CSR0 0
	42	#define LE_CSR1 1
	43	#define LE_CSR2 2
	44	#define LE_CSR3 3
66321a11 FB	45	#define LE_NREGS (LE_CSR3 + 1)
66321a11 FB	46	#define LE_MAXREG LE_CSR3
420557e8 FB	47
	48	#define LE_RDP 0
	49	#define LE_RAP 1
	50
	51	#define LE_MO_PROM 0x8000 /* Enable promiscuous mode */
	52
	53	#define LE_C0_ERR 0x8000 /* Error: set if BAB, SQE, MISS or ME is set */
	54	#define LE_C0_BABL 0x4000 /* BAB: Babble: tx timeout. */
	55	#define LE_C0_CERR 0x2000 /* SQE: Signal quality error */
	56	#define LE_C0_MISS 0x1000 /* MISS: Missed a packet */
	57	#define LE_C0_MERR 0x0800 /* ME: Memory error */
	58	#define LE_C0_RINT 0x0400 /* Received interrupt */
	59	#define LE_C0_TINT 0x0200 /* Transmitter Interrupt */
	60	#define LE_C0_IDON 0x0100 /* IFIN: Init finished. */
	61	#define LE_C0_INTR 0x0080 /* Interrupt or error */
	62	#define LE_C0_INEA 0x0040 /* Interrupt enable */
	63	#define LE_C0_RXON 0x0020 /* Receiver on */
	64	#define LE_C0_TXON 0x0010 /* Transmitter on */
	65	#define LE_C0_TDMD 0x0008 /* Transmitter demand */
	66	#define LE_C0_STOP 0x0004 /* Stop the card */
	67	#define LE_C0_STRT 0x0002 /* Start the card */
	68	#define LE_C0_INIT 0x0001 /* Init the card */
	69
	70	#define LE_C3_BSWP 0x4 /* SWAP */
	71	#define LE_C3_ACON 0x2 /* ALE Control */
	72	#define LE_C3_BCON 0x1 /* Byte control */
	73
	74	/* Receive message descriptor 1 */
	75	#define LE_R1_OWN 0x80 /* Who owns the entry */
	76	#define LE_R1_ERR 0x40 /* Error: if FRA, OFL, CRC or BUF is set */
	77	#define LE_R1_FRA 0x20 /* FRA: Frame error */
	78	#define LE_R1_OFL 0x10 /* OFL: Frame overflow */
	79	#define LE_R1_CRC 0x08 /* CRC error */
	80	#define LE_R1_BUF 0x04 /* BUF: Buffer error */
	81	#define LE_R1_SOP 0x02 /* Start of packet */
	82	#define LE_R1_EOP 0x01 /* End of packet */
	83	#define LE_R1_POK 0x03 /* Packet is complete: SOP + EOP */
	84
	85	#define LE_T1_OWN 0x80 /* Lance owns the packet */
	86	#define LE_T1_ERR 0x40 /* Error summary */
	87	#define LE_T1_EMORE 0x10 /* Error: more than one retry needed */
	88	#define LE_T1_EONE 0x08 /* Error: one retry needed */
	89	#define LE_T1_EDEF 0x04 /* Error: deferred */
	90	#define LE_T1_SOP 0x02 /* Start of packet */
	91	#define LE_T1_EOP 0x01 /* End of packet */
	92	#define LE_T1_POK 0x03 /* Packet is complete: SOP + EOP */
	93
	94	#define LE_T3_BUF 0x8000 /* Buffer error */
	95	#define LE_T3_UFL 0x4000 /* Error underflow */
	96	#define LE_T3_LCOL 0x1000 /* Error late collision */
	97	#define LE_T3_CLOS 0x0800 /* Error carrier loss */
	98	#define LE_T3_RTY 0x0400 /* Error retry */
	99	#define LE_T3_TDR 0x03ff /* Time Domain Reflectometry counter */
	100
	101	#define TX_RING_SIZE (1 << (LANCE_LOG_TX_BUFFERS))
	102	#define TX_RING_MOD_MASK (TX_RING_SIZE - 1)
	103	#define TX_RING_LEN_BITS ((LANCE_LOG_TX_BUFFERS) << 29)
	104
	105	#define RX_RING_SIZE (1 << (LANCE_LOG_RX_BUFFERS))
	106	#define RX_RING_MOD_MASK (RX_RING_SIZE - 1)
	107	#define RX_RING_LEN_BITS ((LANCE_LOG_RX_BUFFERS) << 29)
	108
	109	#define PKT_BUF_SZ 1544
	110	#define RX_BUFF_SIZE PKT_BUF_SZ
111	#define TX_BUFF_SIZE PKT_BUF_SZ
112
113	struct lance_rx_desc {
114	unsigned short rmd0; /* low address of packet */
115	unsigned char rmd1_bits; /* descriptor bits */
116	unsigned char rmd1_hadr; /* high address of packet */
117	short length; /* This length is 2s complement (negative)!
118	* Buffer length
119	*/
120	unsigned short mblength; /* This is the actual number of bytes received */
121	};
122
123	struct lance_tx_desc {
124	unsigned short tmd0; /* low address of packet */
125	unsigned char tmd1_bits; /* descriptor bits */
126	unsigned char tmd1_hadr; /* high address of packet */
127	short length; /* Length is 2s complement (negative)! */
128	unsigned short misc;
129	};
130
131	/* The LANCE initialization block, described in databook. */
132	/* On the Sparc, this block should be on a DMA region */
133	struct lance_init_block {
134	unsigned short mode; /* Pre-set mode (reg. 15) */
135	unsigned char phys_addr[6]; /* Physical ethernet address */
136	unsigned filter[2]; /* Multicast filter. */
137
138	/* Receive and transmit ring base, along with extra bits. */
139	unsigned short rx_ptr; /* receive descriptor addr */
140	unsigned short rx_len; /* receive len and high addr */
141	unsigned short tx_ptr; /* transmit descriptor addr */
142	unsigned short tx_len; /* transmit len and high addr */
143
144	/* The Tx and Rx ring entries must aligned on 8-byte boundaries. */
145	struct lance_rx_desc brx_ring[RX_RING_SIZE];
146	struct lance_tx_desc btx_ring[TX_RING_SIZE];
147
148	char tx_buf [TX_RING_SIZE][TX_BUFF_SIZE];
149	char pad[2]; /* align rx_buf for copy_and_sum(). */
150	char rx_buf [RX_RING_SIZE][RX_BUFF_SIZE];
151	};
152
153	#define LEDMA_REGS 4
e80cfcfc	154	#define LEDMA_MAXADDR (LEDMA_REGS * 4 - 1)
420557e8	155
420557e8 FB	156	typedef struct LANCEState {
	157	NetDriverState *nd;
	158	uint32_t leptr;
	159	uint16_t addr;
66321a11	160	uint16_t regs[LE_NREGS];
420557e8 FB	161	uint8_t phys[6]; /* mac address */
420557e8 FB	162	int irq;
e80cfcfc FB	163	unsigned int rxptr, txptr;
e80cfcfc FB	164	uint32_t ledmaregs[LEDMA_REGS];
420557e8 FB	165	} LANCEState;
420557e8 FB	166
420557e8 FB	167	static void lance_send(void *opaque);
420557e8 FB	168
e80cfcfc	169	static void lance_reset(void *opaque)
420557e8	170	{
e80cfcfc	171	LANCEState *s = opaque;
420557e8	172	memcpy(s->phys, s->nd->macaddr, 6);
e80cfcfc FB	173	s->rxptr = 0;
e80cfcfc FB	174	s->txptr = 0;
66321a11	175	memset(s->regs, 0, LE_NREGS * 2);
420557e8	176	s->regs[LE_CSR0] = LE_C0_STOP;
e80cfcfc	177	memset(s->ledmaregs, 0, LEDMA_REGS * 4);
420557e8 FB	178	}
	179
	180	static uint32_t lance_mem_readw(void *opaque, target_phys_addr_t addr)
	181	{
	182	LANCEState *s = opaque;
	183	uint32_t saddr;
	184
e80cfcfc	185	saddr = addr & LE_MAXREG;
420557e8 FB	186	switch (saddr >> 1) {
420557e8 FB	187	case LE_RDP:
66321a11	188	DPRINTF("read dreg[%d] = %4.4x\n", s->addr, s->regs[s->addr]);
420557e8 FB	189	return s->regs[s->addr];
420557e8 FB	190	case LE_RAP:
66321a11	191	DPRINTF("read areg = %4.4x\n", s->addr);
420557e8 FB	192	return s->addr;
420557e8 FB	193	default:
66321a11	194	DPRINTF("read unknown(%d)\n", saddr>>1);
420557e8 FB	195	break;
	196	}
	197	return 0;
	198	}
	199
	200	static void lance_mem_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
	201	{
	202	LANCEState *s = opaque;
	203	uint32_t saddr;
8d5f07fa	204	uint16_t reg;
420557e8	205
e80cfcfc	206	saddr = addr & LE_MAXREG;
420557e8 FB	207	switch (saddr >> 1) {
420557e8 FB	208	case LE_RDP:
66321a11	209	DPRINTF("write dreg[%d] = %4.4x\n", s->addr, val);
420557e8 FB	210	switch(s->addr) {
	211	case LE_CSR0:
	212	if (val & LE_C0_STOP) {
	213	s->regs[LE_CSR0] = LE_C0_STOP;
	214	break;
	215	}
	216
	217	reg = s->regs[LE_CSR0];
	218
	219	// 1 = clear for some bits
	220	reg &= ~(val & 0x7f00);
	221
	222	// generated bits
	223	reg &= ~(LE_C0_ERR \| LE_C0_INTR);
	224	if (reg & 0x7100)
	225	reg \|= LE_C0_ERR;
	226	if (reg & 0x7f00)
	227	reg \|= LE_C0_INTR;
	228
	229	// direct bit
	230	reg &= ~LE_C0_INEA;
	231	reg \|= val & LE_C0_INEA;
	232
	233	// exclusive bits
	234	if (val & LE_C0_INIT) {
	235	reg \|= LE_C0_IDON \| LE_C0_INIT;
	236	reg &= ~LE_C0_STOP;
	237	}
	238	else if (val & LE_C0_STRT) {
	239	reg \|= LE_C0_STRT \| LE_C0_RXON \| LE_C0_TXON;
	240	reg &= ~LE_C0_STOP;
	241	}
	242
	243	s->regs[LE_CSR0] = reg;
420557e8 FB	244	break;
	245	case LE_CSR1:
	246	s->leptr = (s->leptr & 0xffff0000) \| (val & 0xffff);
	247	s->regs[s->addr] = val;
	248	break;
	249	case LE_CSR2:
	250	s->leptr = (s->leptr & 0xffff) \| ((val & 0xffff) << 16);
	251	s->regs[s->addr] = val;
	252	break;
	253	case LE_CSR3:
	254	s->regs[s->addr] = val;
	255	break;
	256	}
	257	break;
	258	case LE_RAP:
66321a11 FB	259	DPRINTF("write areg = %4.4x\n", val);
66321a11 FB	260	if (val < LE_NREGS)
420557e8 FB	261	s->addr = val;
	262	break;
	263	default:
66321a11	264	DPRINTF("write unknown(%d) = %4.4x\n", saddr>>1, val);
420557e8 FB	265	break;
	266	}
	267	lance_send(s);
	268	}
	269
	270	static CPUReadMemoryFunc *lance_mem_read[3] = {
	271	lance_mem_readw,
	272	lance_mem_readw,
	273	lance_mem_readw,
	274	};
	275
	276	static CPUWriteMemoryFunc *lance_mem_write[3] = {
	277	lance_mem_writew,
	278	lance_mem_writew,
	279	lance_mem_writew,
	280	};
	281
	282
	283	/* return the max buffer size if the LANCE can receive more data */
	284	static int lance_can_receive(void *opaque)
	285	{
	286	LANCEState *s = opaque;
e80cfcfc	287	uint32_t dmaptr = s->leptr + s->ledmaregs[3];
420557e8 FB	288	struct lance_init_block *ib;
420557e8 FB	289	int i;
66321a11	290	uint8_t temp8;
420557e8 FB	291
	292	if ((s->regs[LE_CSR0] & LE_C0_STOP) == LE_C0_STOP)
	293	return 0;
	294
	295	ib = (void *) iommu_translate(dmaptr);
	296
	297	for (i = 0; i < RX_RING_SIZE; i++) {
66321a11 FB	298	cpu_physical_memory_read((uint32_t)&ib->brx_ring[i].rmd1_bits, (void *) &temp8, 1);
	299	if (temp8 == (LE_R1_OWN)) {
	300	DPRINTF("can receive %d\n", RX_BUFF_SIZE);
420557e8 FB	301	return RX_BUFF_SIZE;
	302	}
	303	}
66321a11	304	DPRINTF("cannot receive\n");
420557e8 FB	305	return 0;
	306	}
	307
	308	#define MIN_BUF_SIZE 60
	309
	310	static void lance_receive(void opaque, const uint8_t buf, int size)
	311	{
	312	LANCEState *s = opaque;
e80cfcfc	313	uint32_t dmaptr = s->leptr + s->ledmaregs[3];
420557e8	314	struct lance_init_block *ib;
66321a11 FB	315	unsigned int i, old_rxptr;
	316	uint16_t temp16;
	317	uint8_t temp8;
420557e8	318
66321a11	319	DPRINTF("receive size %d\n", size);
420557e8 FB	320	if ((s->regs[LE_CSR0] & LE_C0_STOP) == LE_C0_STOP)
	321	return;
	322
	323	ib = (void *) iommu_translate(dmaptr);
	324
e80cfcfc FB	325	old_rxptr = s->rxptr;
e80cfcfc FB	326	for (i = s->rxptr; i != ((old_rxptr - 1) & RX_RING_MOD_MASK); i = (i + 1) & RX_RING_MOD_MASK) {
66321a11 FB	327	cpu_physical_memory_read((uint32_t)&ib->brx_ring[i].rmd1_bits, (void *) &temp8, 1);
66321a11 FB	328	if (temp8 == (LE_R1_OWN)) {
e80cfcfc	329	s->rxptr = (s->rxptr + 1) & RX_RING_MOD_MASK;
66321a11 FB	330	temp16 = size + 4;
	331	bswap16s(&temp16);
	332	cpu_physical_memory_write((uint32_t)&ib->brx_ring[i].mblength, (void *) &temp16, 2);
e80cfcfc	333	cpu_physical_memory_write((uint32_t)&ib->rx_buf[i], buf, size);
66321a11 FB	334	temp8 = LE_R1_POK;
66321a11 FB	335	cpu_physical_memory_write((uint32_t)&ib->brx_ring[i].rmd1_bits, (void *) &temp8, 1);
420557e8	336	s->regs[LE_CSR0] \|= LE_C0_RINT \| LE_C0_INTR;
66321a11	337	if (s->regs[LE_CSR0] & LE_C0_INEA)
420557e8	338	pic_set_irq(s->irq, 1);
66321a11	339	DPRINTF("got packet, len %d\n", size);
420557e8 FB	340	return;
	341	}
	342	}
	343	}
	344
	345	static void lance_send(void *opaque)
	346	{
	347	LANCEState *s = opaque;
e80cfcfc	348	uint32_t dmaptr = s->leptr + s->ledmaregs[3];
420557e8	349	struct lance_init_block *ib;
66321a11 FB	350	unsigned int i, old_txptr;
	351	uint16_t temp16;
	352	uint8_t temp8;
420557e8 FB	353	char pkt_buf[PKT_BUF_SZ];
420557e8 FB	354
66321a11	355	DPRINTF("sending packet? (csr0 %4.4x)\n", s->regs[LE_CSR0]);
420557e8 FB	356	if ((s->regs[LE_CSR0] & LE_C0_STOP) == LE_C0_STOP)
	357	return;
	358
	359	ib = (void *) iommu_translate(dmaptr);
	360
66321a11	361	DPRINTF("sending packet? (dmaptr %8.8x) (ib %p) (btx_ring %p)\n", dmaptr, ib, &ib->btx_ring);
e80cfcfc FB	362	old_txptr = s->txptr;
e80cfcfc FB	363	for (i = s->txptr; i != ((old_txptr - 1) & TX_RING_MOD_MASK); i = (i + 1) & TX_RING_MOD_MASK) {
66321a11 FB	364	cpu_physical_memory_read((uint32_t)&ib->btx_ring[i].tmd1_bits, (void *) &temp8, 1);
	365	if (temp8 == (LE_T1_POK\|LE_T1_OWN)) {
	366	cpu_physical_memory_read((uint32_t)&ib->btx_ring[i].length, (void *) &temp16, 2);
	367	bswap16s(&temp16);
	368	temp16 = (~temp16) + 1;
	369	cpu_physical_memory_read((uint32_t)&ib->tx_buf[i], pkt_buf, temp16);
	370	DPRINTF("sending packet, len %d\n", temp16);
	371	qemu_send_packet(s->nd, pkt_buf, temp16);
	372	temp8 = LE_T1_POK;
	373	cpu_physical_memory_write((uint32_t)&ib->btx_ring[i].tmd1_bits, (void *) &temp8, 1);
e80cfcfc	374	s->txptr = (s->txptr + 1) & TX_RING_MOD_MASK;
420557e8 FB	375	s->regs[LE_CSR0] \|= LE_C0_TINT \| LE_C0_INTR;
	376	}
	377	}
66321a11 FB	378	if ((s->regs[LE_CSR0] & LE_C0_INTR) && (s->regs[LE_CSR0] & LE_C0_INEA))
66321a11 FB	379	pic_set_irq(s->irq, 1);
420557e8 FB	380	}
420557e8 FB	381
420557e8 FB	382	static uint32_t ledma_mem_readl(void *opaque, target_phys_addr_t addr)
420557e8 FB	383	{
e80cfcfc	384	LANCEState *s = opaque;
420557e8 FB	385	uint32_t saddr;
420557e8 FB	386
e80cfcfc FB	387	saddr = (addr & LEDMA_MAXADDR) >> 2;
e80cfcfc FB	388	return s->ledmaregs[saddr];
420557e8 FB	389	}
	390
	391	static void ledma_mem_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
	392	{
e80cfcfc	393	LANCEState *s = opaque;
420557e8 FB	394	uint32_t saddr;
420557e8 FB	395
e80cfcfc FB	396	saddr = (addr & LEDMA_MAXADDR) >> 2;
e80cfcfc FB	397	s->ledmaregs[saddr] = val;
420557e8 FB	398	}
	399
	400	static CPUReadMemoryFunc *ledma_mem_read[3] = {
	401	ledma_mem_readl,
	402	ledma_mem_readl,
	403	ledma_mem_readl,
	404	};
	405
	406	static CPUWriteMemoryFunc *ledma_mem_write[3] = {
	407	ledma_mem_writel,
	408	ledma_mem_writel,
	409	ledma_mem_writel,
	410	};
	411
e80cfcfc FB	412	static void lance_save(QEMUFile f, void opaque)
	413	{
	414	LANCEState *s = opaque;
	415	int i;
	416
	417	qemu_put_be32s(f, &s->leptr);
	418	qemu_put_be16s(f, &s->addr);
66321a11	419	for (i = 0; i < LE_NREGS; i ++)
e80cfcfc FB	420	qemu_put_be16s(f, &s->regs[i]);
	421	qemu_put_buffer(f, s->phys, 6);
	422	qemu_put_be32s(f, &s->irq);
	423	for (i = 0; i < LEDMA_REGS; i ++)
	424	qemu_put_be32s(f, &s->ledmaregs[i]);
	425	}
	426
	427	static int lance_load(QEMUFile f, void opaque, int version_id)
	428	{
	429	LANCEState *s = opaque;
	430	int i;
	431
	432	if (version_id != 1)
	433	return -EINVAL;
	434
	435	qemu_get_be32s(f, &s->leptr);
	436	qemu_get_be16s(f, &s->addr);
66321a11	437	for (i = 0; i < LE_NREGS; i ++)
e80cfcfc FB	438	qemu_get_be16s(f, &s->regs[i]);
	439	qemu_get_buffer(f, s->phys, 6);
	440	qemu_get_be32s(f, &s->irq);
	441	for (i = 0; i < LEDMA_REGS; i ++)
	442	qemu_get_be32s(f, &s->ledmaregs[i]);
	443	return 0;
	444	}
	445
8d5f07fa	446	void lance_init(NetDriverState *nd, int irq, uint32_t leaddr, uint32_t ledaddr)
420557e8 FB	447	{
420557e8 FB	448	LANCEState *s;
8d5f07fa	449	int lance_io_memory, ledma_io_memory;
420557e8 FB	450
	451	s = qemu_mallocz(sizeof(LANCEState));
	452	if (!s)
	453	return;
	454
8d5f07fa FB	455	s->nd = nd;
	456	s->irq = irq;
	457
420557e8	458	lance_io_memory = cpu_register_io_memory(0, lance_mem_read, lance_mem_write, s);
66321a11	459	cpu_register_physical_memory(leaddr, 4, lance_io_memory);
8d5f07fa	460
e80cfcfc	461	ledma_io_memory = cpu_register_io_memory(0, ledma_mem_read, ledma_mem_write, s);
8d5f07fa	462	cpu_register_physical_memory(ledaddr, 16, ledma_io_memory);
420557e8 FB	463
	464	lance_reset(s);
	465	qemu_add_read_packet(nd, lance_can_receive, lance_receive, s);
e80cfcfc FB	466	register_savevm("lance", leaddr, 1, lance_save, lance_load, s);
e80cfcfc FB	467	qemu_register_reset(lance_reset, s);
420557e8 FB	468	}
420557e8 FB	469