hw/eepro100.c

   1 /*
   2  * QEMU i8255x (PRO100) emulation
   3  *
   4  * Copyright (C) 2006-2010 Stefan Weil
   5  *
   6  * Portions of the code are copies from grub / etherboot eepro100.c
   7  * and linux e100.c.
   8  *
   9  * This program is free software: you can redistribute it and/or modify
  10  * it under the terms of the GNU General Public License as published by
  11  * the Free Software Foundation, either version 2 of the License, or
  12  * (at your option) version 3 or any later version.
  13  *
  14  * This program is distributed in the hope that it will be useful,
  15  * but WITHOUT ANY WARRANTY; without even the implied warranty of
  16  * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
  17  * GNU General Public License for more details.
  18  *
  19  * You should have received a copy of the GNU General Public License
  20  * along with this program.  If not, see <http://www.gnu.org/licenses/>.
  21  *
  22  * Tested features (i82559):
  23  *      PXE boot (i386) ok
  24  *      Linux networking (i386) ok
  25  *
  26  * Untested:
  27  *      non-i386 platforms
  28  *      Windows networking
  29  *
  30  * References:
  31  *
  32  * Intel 8255x 10/100 Mbps Ethernet Controller Family
  33  * Open Source Software Developer Manual
  34  *
  35  * TODO:
  36  *      * PHY emulation should be separated from nic emulation.
  37  *        Most nic emulations could share the same phy code.
  38  *      * i82550 is untested. It is programmed like the i82559.
  39  *      * i82562 is untested. It is programmed like the i82559.
  40  *      * Power management (i82558 and later) is not implemented.
  41  *      * Wake-on-LAN is not implemented.
  42  */
  43
  44 #include <stdbool.h>            /* bool */
  45 #include <stddef.h>             /* offsetof */
  46 #include "hw.h"
  47 #include "pci.h"
  48 #include "net.h"
  49 #include "eeprom93xx.h"
  50
  51 #define KiB 1024
  52
  53 /* Debug EEPRO100 card. */
  54 #if 0
  55 # define DEBUG_EEPRO100
  56 #endif
  57
  58 #ifdef DEBUG_EEPRO100
  59 #define logout(fmt, ...) fprintf(stderr, "EE100\t%-24s" fmt, __func__, ## __VA_ARGS__)
  60 #else
  61 #define logout(fmt, ...) ((void)0)
  62 #endif
  63
  64 /* Set flags to 0 to disable debug output. */
  65 #define INT     1       /* interrupt related actions */
  66 #define MDI     1       /* mdi related actions */
  67 #define OTHER   1
  68 #define RXTX    1
  69 #define EEPROM  1       /* eeprom related actions */
  70
  71 #define TRACE(flag, command) ((flag) ? (command) : (void)0)
  72
  73 #define missing(text) fprintf(stderr, "eepro100: feature is missing in this emulation: " text "\n")
  74
  75 #define MAX_ETH_FRAME_SIZE 1514
  76
  77 /* This driver supports several different devices which are declared here. */
  78 #define i82550          0x82550
  79 #define i82551          0x82551
  80 #define i82557A         0x82557a
  81 #define i82557B         0x82557b
  82 #define i82557C         0x82557c
  83 #define i82558A         0x82558a
  84 #define i82558B         0x82558b
  85 #define i82559A         0x82559a
  86 #define i82559B         0x82559b
  87 #define i82559C         0x82559c
  88 #define i82559ER        0x82559e
  89 #define i82562          0x82562
  90
  91 /* Use 64 word EEPROM. TODO: could be a runtime option. */
  92 #define EEPROM_SIZE     64
  93
  94 #define PCI_MEM_SIZE            (4 * KiB)
  95 #define PCI_IO_SIZE             64
  96 #define PCI_FLASH_SIZE          (128 * KiB)
  97
  98 #define BIT(n) (1 << (n))
  99 #define BITS(n, m) (((0xffffffffU << (31 - n)) >> (31 - n + m)) << m)
 100
 101 /* The SCB accepts the following controls for the Tx and Rx units: */
 102 #define  CU_NOP         0x0000  /* No operation. */
 103 #define  CU_START       0x0010  /* CU start. */
 104 #define  CU_RESUME      0x0020  /* CU resume. */
 105 #define  CU_STATSADDR   0x0040  /* Load dump counters address. */
 106 #define  CU_SHOWSTATS   0x0050  /* Dump statistical counters. */
 107 #define  CU_CMD_BASE    0x0060  /* Load CU base address. */
 108 #define  CU_DUMPSTATS   0x0070  /* Dump and reset statistical counters. */
 109 #define  CU_SRESUME     0x00a0  /* CU static resume. */
 110
 111 #define  RU_NOP         0x0000
 112 #define  RX_START       0x0001
 113 #define  RX_RESUME      0x0002
 114 #define  RU_ABORT       0x0004
 115 #define  RX_ADDR_LOAD   0x0006
 116 #define  RX_RESUMENR    0x0007
 117 #define INT_MASK        0x0100
 118 #define DRVR_INT        0x0200  /* Driver generated interrupt. */
 119
 120 /* Offsets to the various registers.
 121    All accesses need not be longword aligned. */
 122 enum speedo_offsets {
 123     SCBStatus = 0,              /* Status Word. */
 124     SCBAck = 1,
 125     SCBCmd = 2,                 /* Rx/Command Unit command and status. */
 126     SCBIntmask = 3,
 127     SCBPointer = 4,             /* General purpose pointer. */
 128     SCBPort = 8,                /* Misc. commands and operands.  */
 129     SCBflash = 12,              /* Flash memory control. */
 130     SCBeeprom = 14,             /* EEPROM control. */
 131     SCBCtrlMDI = 16,            /* MDI interface control. */
 132     SCBEarlyRx = 20,            /* Early receive byte count. */
 133     SCBFlow = 24,               /* Flow Control. */
 134     SCBpmdr = 27,               /* Power Management Driver. */
 135     SCBgctrl = 28,              /* General Control. */
 136     SCBgstat = 29,              /* General Status. */
 137 };
 138
 139 /* A speedo3 transmit buffer descriptor with two buffers... */
 140 typedef struct {
 141     uint16_t status;
 142     uint16_t command;
 143     uint32_t link;              /* void * */
 144     uint32_t tbd_array_addr;    /* transmit buffer descriptor array address. */
 145     uint16_t tcb_bytes;         /* transmit command block byte count (in lower 14 bits */
 146     uint8_t tx_threshold;       /* transmit threshold */
 147     uint8_t tbd_count;          /* TBD number */
 148 #if 0
 149     /* This constitutes two "TBD" entries: hdr and data */
 150     uint32_t tx_buf_addr0;  /* void *, header of frame to be transmitted.  */
 151     int32_t  tx_buf_size0;  /* Length of Tx hdr. */
 152     uint32_t tx_buf_addr1;  /* void *, data to be transmitted.  */
 153     int32_t  tx_buf_size1;  /* Length of Tx data. */
 154 #endif
 155 } eepro100_tx_t;
 156
 157 /* Receive frame descriptor. */
 158 typedef struct {
 159     int16_t status;
 160     uint16_t command;
 161     uint32_t link;              /* struct RxFD * */
 162     uint32_t rx_buf_addr;       /* void * */
 163     uint16_t count;
 164     uint16_t size;
 165     char packet[MAX_ETH_FRAME_SIZE + 4];
 166 } eepro100_rx_t;
 167
 168 typedef enum {
 169     COMMAND_EL = BIT(15),
 170     COMMAND_S = BIT(14),
 171     COMMAND_I = BIT(13),
 172     COMMAND_NC = BIT(4),
 173     COMMAND_SF = BIT(3),
 174     COMMAND_CMD = BITS(2, 0),
 175 } scb_command_bit;
 176
 177 typedef enum {
 178     STATUS_C = BIT(15),
 179     STATUS_OK = BIT(13),
 180 } scb_status_bit;
 181
 182 typedef struct {
 183     uint32_t tx_good_frames, tx_max_collisions, tx_late_collisions,
 184              tx_underruns, tx_lost_crs, tx_deferred, tx_single_collisions,
 185              tx_multiple_collisions, tx_total_collisions;
 186     uint32_t rx_good_frames, rx_crc_errors, rx_alignment_errors,
 187              rx_resource_errors, rx_overrun_errors, rx_cdt_errors,
 188              rx_short_frame_errors;
 189     uint32_t fc_xmt_pause, fc_rcv_pause, fc_rcv_unsupported;
 190     uint16_t xmt_tco_frames, rcv_tco_frames;
 191     /* TODO: i82559 has six reserved statistics but a total of 24 dwords. */
 192     uint32_t reserved[4];
 193 } eepro100_stats_t;
 194
 195 typedef enum {
 196     cu_idle = 0,
 197     cu_suspended = 1,
 198     cu_active = 2,
 199     cu_lpq_active = 2,
 200     cu_hqp_active = 3
 201 } cu_state_t;
 202
 203 typedef enum {
 204     ru_idle = 0,
 205     ru_suspended = 1,
 206     ru_no_resources = 2,
 207     ru_ready = 4
 208 } ru_state_t;
 209
 210 typedef struct {
 211     PCIDevice dev;
 212     uint8_t mult[8];            /* multicast mask array */
 213     int mmio_index;
 214     NICState *nic;
 215     NICConf conf;
 216     uint8_t scb_stat;           /* SCB stat/ack byte */
 217     uint8_t int_stat;           /* PCI interrupt status */
 218     /* region must not be saved by nic_save. */
 219     uint32_t region[3];         /* PCI region addresses */
 220     uint16_t mdimem[32];
 221     eeprom_t *eeprom;
 222     uint32_t device;            /* device variant */
 223     uint32_t pointer;
 224     /* (cu_base + cu_offset) address the next command block in the command block list. */
 225     uint32_t cu_base;           /* CU base address */
 226     uint32_t cu_offset;         /* CU address offset */
 227     /* (ru_base + ru_offset) address the RFD in the Receive Frame Area. */
 228     uint32_t ru_base;           /* RU base address */
 229     uint32_t ru_offset;         /* RU address offset */
 230     uint32_t statsaddr;         /* pointer to eepro100_stats_t */
 231
 232     /* Temporary status information (no need to save these values),
 233      * used while processing CU commands. */
 234     eepro100_tx_t tx;           /* transmit buffer descriptor */
 235     uint32_t cb_address;        /* = cu_base + cu_offset */
 236
 237     /* Statistical counters. Also used for wake-up packet (i82559). */
 238     eepro100_stats_t statistics;
 239
 240     /* Configuration bytes. */
 241     uint8_t configuration[22];
 242
 243     /* Data in mem is always in the byte order of the controller (le). */
 244     uint8_t mem[PCI_MEM_SIZE];
 245     /* vmstate for each particular nic */
 246     VMStateDescription *vmstate;
 247
 248     /* Quasi static device properties (no need to save them). */
 249     uint16_t stats_size;
 250     bool has_extended_tcb_support;
 251 } EEPRO100State;
 252
 253 /* Word indices in EEPROM. */
 254 typedef enum {
 255     EEPROM_CNFG_MDIX  = 0x03,
 256     EEPROM_ID         = 0x05,
 257     EEPROM_PHY_ID     = 0x06,
 258     EEPROM_VENDOR_ID  = 0x0c,
 259     EEPROM_CONFIG_ASF = 0x0d,
 260     EEPROM_DEVICE_ID  = 0x23,
 261     EEPROM_SMBUS_ADDR = 0x90,
 262 } EEPROMOffset;
 263
 264 /* Bit values for EEPROM ID word. */
 265 typedef enum {
 266     EEPROM_ID_MDM = BIT(0),     /* Modem */
 267     EEPROM_ID_STB = BIT(1),     /* Standby Enable */
 268     EEPROM_ID_WMR = BIT(2),     /* ??? */
 269     EEPROM_ID_WOL = BIT(5),     /* Wake on LAN */
 270     EEPROM_ID_DPD = BIT(6),     /* Deep Power Down */
 271     EEPROM_ID_ALT = BIT(7),     /* */
 272     /* BITS(10, 8) device revision */
 273     EEPROM_ID_BD = BIT(11),     /* boot disable */
 274     EEPROM_ID_ID = BIT(13),     /* id bit */
 275     /* BITS(15, 14) signature */
 276     EEPROM_ID_VALID = BIT(14),  /* signature for valid eeprom */
 277 } eeprom_id_bit;
 278
 279 /* Default values for MDI (PHY) registers */
 280 static const uint16_t eepro100_mdi_default[] = {
 281     /* MDI Registers 0 - 6, 7 */
 282     0x3000, 0x780d, 0x02a8, 0x0154, 0x05e1, 0x0000, 0x0000, 0x0000,
 283     /* MDI Registers 8 - 15 */
 284     0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
 285     /* MDI Registers 16 - 31 */
 286     0x0003, 0x0000, 0x0001, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
 287     0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
 288 };
 289
 290 /* Readonly mask for MDI (PHY) registers */
 291 static const uint16_t eepro100_mdi_mask[] = {
 292     0x0000, 0xffff, 0xffff, 0xffff, 0xc01f, 0xffff, 0xffff, 0x0000,
 293     0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
 294     0x0fff, 0x0000, 0xffff, 0xffff, 0xffff, 0xffff, 0xffff, 0xffff,
 295     0xffff, 0xffff, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000,
 296 };
 297
 298 /* XXX: optimize */
 299 static void stl_le_phys(target_phys_addr_t addr, uint32_t val)
 300 {
 301     val = cpu_to_le32(val);
 302     cpu_physical_memory_write(addr, (const uint8_t *)&val, sizeof(val));
 303 }
 304
 305 #define POLYNOMIAL 0x04c11db6
 306
 307 /* From FreeBSD */
 308 /* XXX: optimize */
 309 static unsigned compute_mcast_idx(const uint8_t * ep)
 310 {
 311     uint32_t crc;
 312     int carry, i, j;
 313     uint8_t b;
 314
 315     crc = 0xffffffff;
 316     for (i = 0; i < 6; i++) {
 317         b = *ep++;
 318         for (j = 0; j < 8; j++) {
 319             carry = ((crc & 0x80000000L) ? 1 : 0) ^ (b & 0x01);
 320             crc <<= 1;
 321             b >>= 1;
 322             if (carry) {
 323                 crc = ((crc ^ POLYNOMIAL) | carry);
 324             }
 325         }
 326     }
 327     return (crc & BITS(7, 2)) >> 2;
 328 }
 329
 330 #if defined(DEBUG_EEPRO100)
 331 static const char *nic_dump(const uint8_t * buf, unsigned size)
 332 {
 333     static char dump[3 * 16 + 1];
 334     char *p = &dump[0];
 335     if (size > 16) {
 336         size = 16;
 337     }
 338     while (size-- > 0) {
 339         p += sprintf(p, " %02x", *buf++);
 340     }
 341     return dump;
 342 }
 343 #endif                          /* DEBUG_EEPRO100 */
 344
 345 enum scb_stat_ack {
 346     stat_ack_not_ours = 0x00,
 347     stat_ack_sw_gen = 0x04,
 348     stat_ack_rnr = 0x10,
 349     stat_ack_cu_idle = 0x20,
 350     stat_ack_frame_rx = 0x40,
 351     stat_ack_cu_cmd_done = 0x80,
 352     stat_ack_not_present = 0xFF,
 353     stat_ack_rx = (stat_ack_sw_gen | stat_ack_rnr | stat_ack_frame_rx),
 354     stat_ack_tx = (stat_ack_cu_idle | stat_ack_cu_cmd_done),
 355 };
 356
 357 static void disable_interrupt(EEPRO100State * s)
 358 {
 359     if (s->int_stat) {
 360         TRACE(INT, logout("interrupt disabled\n"));
 361         qemu_irq_lower(s->dev.irq[0]);
 362         s->int_stat = 0;
 363     }
 364 }
 365
 366 static void enable_interrupt(EEPRO100State * s)
 367 {
 368     if (!s->int_stat) {
 369         TRACE(INT, logout("interrupt enabled\n"));
 370         qemu_irq_raise(s->dev.irq[0]);
 371         s->int_stat = 1;
 372     }
 373 }
 374
 375 static void eepro100_acknowledge(EEPRO100State * s)
 376 {
 377     s->scb_stat &= ~s->mem[SCBAck];
 378     s->mem[SCBAck] = s->scb_stat;
 379     if (s->scb_stat == 0) {
 380         disable_interrupt(s);
 381     }
 382 }
 383
 384 static void eepro100_interrupt(EEPRO100State * s, uint8_t status)
 385 {
 386     uint8_t mask = ~s->mem[SCBIntmask];
 387     s->mem[SCBAck] |= status;
 388     status = s->scb_stat = s->mem[SCBAck];
 389     status &= (mask | 0x0f);
 390 #if 0
 391     status &= (~s->mem[SCBIntmask] | 0x0xf);
 392 #endif
 393     if (status && (mask & 0x01)) {
 394         /* SCB mask and SCB Bit M do not disable interrupt. */
 395         enable_interrupt(s);
 396     } else if (s->int_stat) {
 397         disable_interrupt(s);
 398     }
 399 }
 400
 401 static void eepro100_cx_interrupt(EEPRO100State * s)
 402 {
 403     /* CU completed action command. */
 404     /* Transmit not ok (82557 only, not in emulation). */
 405     eepro100_interrupt(s, 0x80);
 406 }
 407
 408 static void eepro100_cna_interrupt(EEPRO100State * s)
 409 {
 410     /* CU left the active state. */
 411     eepro100_interrupt(s, 0x20);
 412 }
 413
 414 static void eepro100_fr_interrupt(EEPRO100State * s)
 415 {
 416     /* RU received a complete frame. */
 417     eepro100_interrupt(s, 0x40);
 418 }
 419
 420 static void eepro100_rnr_interrupt(EEPRO100State * s)
 421 {
 422     /* RU is not ready. */
 423     eepro100_interrupt(s, 0x10);
 424 }
 425
 426 static void eepro100_mdi_interrupt(EEPRO100State * s)
 427 {
 428     /* MDI completed read or write cycle. */
 429     eepro100_interrupt(s, 0x08);
 430 }
 431
 432 static void eepro100_swi_interrupt(EEPRO100State * s)
 433 {
 434     /* Software has requested an interrupt. */
 435     eepro100_interrupt(s, 0x04);
 436 }
 437
 438 #if 0
 439 static void eepro100_fcp_interrupt(EEPRO100State * s)
 440 {
 441     /* Flow control pause interrupt (82558 and later). */
 442     eepro100_interrupt(s, 0x01);
 443 }
 444 #endif
 445
 446 static void pci_reset(EEPRO100State * s)
 447 {
 448     uint32_t device = s->device;
 449     uint8_t *pci_conf = s->dev.config;
 450     bool power_management = 1;
 451
 452     TRACE(OTHER, logout("%p\n", s));
 453
 454     /* PCI Vendor ID */
 455     pci_config_set_vendor_id(pci_conf, PCI_VENDOR_ID_INTEL);
 456     /* PCI Device ID depends on device and is set below. */
 457     /* PCI Status */
 458     pci_set_word(pci_conf + PCI_STATUS, PCI_STATUS_DEVSEL_MEDIUM | PCI_STATUS_FAST_BACK);
 459     /* PCI Revision ID */
 460     pci_set_byte(pci_conf + PCI_REVISION_ID, 0x08);
 461     pci_config_set_class(pci_conf, PCI_CLASS_NETWORK_ETHERNET);
 462     /* PCI Latency Timer */
 463     pci_set_byte(pci_conf + PCI_LATENCY_TIMER, 0x20);   /* latency timer = 32 clocks */
 464     /* Capability Pointer */
 465     /* TODO: revisions with power_management 1 use this but
 466      * do not set new capability list bit in status register. */
 467     pci_set_byte(pci_conf + PCI_CAPABILITY_LIST, 0xdc);
 468     /* Minimum Grant */
 469     pci_set_byte(pci_conf + PCI_MIN_GNT, 0x08);
 470     /* Maximum Latency */
 471     pci_set_byte(pci_conf + PCI_MAX_LAT, 0x18);
 472
 473     switch (device) {
 474     case i82550:
 475         /* TODO: check device id. */
 476         pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_INTEL_82551IT);
 477         /* Revision ID: 0x0c, 0x0d, 0x0e. */
 478         pci_set_byte(pci_conf + PCI_REVISION_ID, 0x0e);
 479         /* TODO: check size of statistical counters. */
 480         s->stats_size = 80;
 481         /* TODO: check extended tcb support. */
 482         s->has_extended_tcb_support = 1;
 483         break;
 484     case i82551:
 485         pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_INTEL_82551IT);
 486         /* Revision ID: 0x0f, 0x10. */
 487         pci_set_byte(pci_conf + PCI_REVISION_ID, 0x0f);
 488         /* TODO: check size of statistical counters. */
 489         s->stats_size = 80;
 490         s->has_extended_tcb_support = 1;
 491         break;
 492     case i82557A:
 493         pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_INTEL_82557);
 494         pci_set_byte(pci_conf + PCI_REVISION_ID, 0x01);
 495         pci_set_byte(pci_conf + PCI_CAPABILITY_LIST, 0x00);
 496         power_management = 0;
 497         break;
 498     case i82557B:
 499         pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_INTEL_82557);
 500         pci_set_byte(pci_conf + PCI_REVISION_ID, 0x02);
 501         pci_set_byte(pci_conf + PCI_CAPABILITY_LIST, 0x00);
 502         power_management = 0;
 503         break;
 504     case i82557C:
 505         pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_INTEL_82557);
 506         pci_set_byte(pci_conf + PCI_REVISION_ID, 0x03);
 507         pci_set_byte(pci_conf + PCI_CAPABILITY_LIST, 0x00);
 508         power_management = 0;
 509         break;
 510     case i82558A:
 511         pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_INTEL_82557);
 512         pci_set_word(pci_conf + PCI_STATUS, PCI_STATUS_DEVSEL_MEDIUM |
 513                                   PCI_STATUS_FAST_BACK | PCI_STATUS_CAP_LIST);
 514         pci_set_byte(pci_conf + PCI_REVISION_ID, 0x04);
 515         s->stats_size = 76;
 516         s->has_extended_tcb_support = 1;
 517         break;
 518     case i82558B:
 519         pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_INTEL_82557);
 520         pci_set_word(pci_conf + PCI_STATUS, PCI_STATUS_DEVSEL_MEDIUM |
 521                                   PCI_STATUS_FAST_BACK | PCI_STATUS_CAP_LIST);
 522         pci_set_byte(pci_conf + PCI_REVISION_ID, 0x05);
 523         s->stats_size = 76;
 524         s->has_extended_tcb_support = 1;
 525         break;
 526     case i82559A:
 527         pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_INTEL_82557);
 528         pci_set_word(pci_conf + PCI_STATUS, PCI_STATUS_DEVSEL_MEDIUM |
 529                                   PCI_STATUS_FAST_BACK | PCI_STATUS_CAP_LIST);
 530         pci_set_byte(pci_conf + PCI_REVISION_ID, 0x06);
 531         s->stats_size = 80;
 532         s->has_extended_tcb_support = 1;
 533         break;
 534     case i82559B:
 535         pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_INTEL_82557);
 536         pci_set_word(pci_conf + PCI_STATUS, PCI_STATUS_DEVSEL_MEDIUM |
 537                                   PCI_STATUS_FAST_BACK | PCI_STATUS_CAP_LIST);
 538         pci_set_byte(pci_conf + PCI_REVISION_ID, 0x07);
 539         s->stats_size = 80;
 540         s->has_extended_tcb_support = 1;
 541         break;
 542     case i82559C:
 543         pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_INTEL_82557);
 544         pci_set_word(pci_conf + PCI_STATUS, PCI_STATUS_DEVSEL_MEDIUM |
 545                                   PCI_STATUS_FAST_BACK | PCI_STATUS_CAP_LIST);
 546         pci_set_byte(pci_conf + PCI_REVISION_ID, 0x08);
 547         /* TODO: Windows wants revision id 0x0c. */
 548         pci_set_byte(pci_conf + PCI_REVISION_ID, 0x0c);
 549 #if EEPROM_SIZE > 0
 550         pci_set_word(pci_conf + PCI_SUBSYSTEM_VENDOR_ID, 0x8086);
 551         pci_set_word(pci_conf + PCI_SUBSYSTEM_ID, 0x0040);
 552 #endif
 553         s->stats_size = 80;
 554         s->has_extended_tcb_support = 1;
 555         break;
 556     case i82559ER:
 557         pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_INTEL_82551IT);
 558         pci_set_word(pci_conf + PCI_STATUS, PCI_STATUS_DEVSEL_MEDIUM |
 559                                   PCI_STATUS_FAST_BACK | PCI_STATUS_CAP_LIST);
 560         pci_set_byte(pci_conf + PCI_REVISION_ID, 0x09);
 561         s->stats_size = 80;
 562         s->has_extended_tcb_support = 1;
 563         break;
 564     case i82562:
 565         /* TODO: check device id. */
 566         pci_config_set_device_id(pci_conf, PCI_DEVICE_ID_INTEL_82551IT);
 567         /* TODO: wrong revision id. */
 568         pci_set_byte(pci_conf + PCI_REVISION_ID, 0x0e);
 569         s->stats_size = 80;
 570         s->has_extended_tcb_support = 1;
 571         break;
 572     default:
 573         logout("Device %X is undefined!\n", device);
 574     }
 575
 576     s->configuration[6] |= BIT(5);
 577
 578     if (s->stats_size == 80) {
 579         /* TODO: check TCO Statistical Counters bit. Documentation not clear. */
 580         if (s->configuration[6] & BIT(2)) {
 581             /* TCO statistical counters. */
 582             assert(s->configuration[6] & BIT(5));
 583         } else {
 584             if (s->configuration[6] & BIT(5)) {
 585                 /* No extended statistical counters, i82557 compatible. */
 586                 s->stats_size = 64;
 587             } else {
 588                 /* i82558 compatible. */
 589                 s->stats_size = 76;
 590             }
 591         }
 592     } else {
 593         if (s->configuration[6] & BIT(5)) {
 594             /* No extended statistical counters. */
 595             s->stats_size = 64;
 596         }
 597     }
 598     assert(s->stats_size > 0 && s->stats_size <= sizeof(s->statistics));
 599
 600     if (power_management) {
 601         /* Power Management Capabilities */
 602         pci_set_byte(pci_conf + 0xdc, 0x01);
 603         /* Next Item Pointer */
 604         /* Capability ID */
 605         pci_set_word(pci_conf + 0xde, 0x7e21);
 606         /* TODO: Power Management Control / Status. */
 607         /* TODO: Ethernet Power Consumption Registers (i82559 and later). */
 608     }
 609
 610 #if EEPROM_SIZE > 0
 611     if (device == i82557C || device == i82558B || device == i82559C) {
 612         /*
 613         TODO: get vendor id from EEPROM for i82557C or later.
 614         TODO: get device id from EEPROM for i82557C or later.
 615         TODO: status bit 4 can be disabled by EEPROM for i82558, i82559.
 616         TODO: header type is determined by EEPROM for i82559.
 617         TODO: get subsystem id from EEPROM for i82557C or later.
 618         TODO: get subsystem vendor id from EEPROM for i82557C or later.
 619         TODO: exp. rom baddr depends on a bit in EEPROM for i82558 or later.
 620         TODO: capability pointer depends on EEPROM for i82558.
 621         */
 622         logout("Get device id and revision from EEPROM!!!\n");
 623     }
 624 #endif /* EEPROM_SIZE > 0 */
 625 }
 626
 627 static void nic_selective_reset(EEPRO100State * s)
 628 {
 629     size_t i;
 630     uint16_t *eeprom_contents = eeprom93xx_data(s->eeprom);
 631 #if 0
 632     eeprom93xx_reset(s->eeprom);
 633 #endif
 634     memcpy(eeprom_contents, s->conf.macaddr.a, 6);
 635     eeprom_contents[EEPROM_ID] = EEPROM_ID_VALID;
 636     if (s->device == i82557B || s->device == i82557C)
 637         eeprom_contents[5] = 0x0100;
 638     eeprom_contents[EEPROM_PHY_ID] = 1;
 639     uint16_t sum = 0;
 640     for (i = 0; i < EEPROM_SIZE - 1; i++) {
 641         sum += eeprom_contents[i];
 642     }
 643     eeprom_contents[EEPROM_SIZE - 1] = 0xbaba - sum;
 644     TRACE(EEPROM, logout("checksum=0x%04x\n", eeprom_contents[EEPROM_SIZE - 1]));
 645
 646     memset(s->mem, 0, sizeof(s->mem));
 647     uint32_t val = BIT(21);
 648     memcpy(&s->mem[SCBCtrlMDI], &val, sizeof(val));
 649
 650     assert(sizeof(s->mdimem) == sizeof(eepro100_mdi_default));
 651     memcpy(&s->mdimem[0], &eepro100_mdi_default[0], sizeof(s->mdimem));
 652 }
 653
 654 static void nic_reset(void *opaque)
 655 {
 656     EEPRO100State *s = opaque;
 657     TRACE(OTHER, logout("%p\n", s));
 658     /* TODO: Clearing of multicast table for selective reset, too? */
 659     memset(&s->mult[0], 0, sizeof(s->mult));
 660     nic_selective_reset(s);
 661 }
 662
 663 #if defined(DEBUG_EEPRO100)
 664 static const char * const e100_reg[PCI_IO_SIZE / 4] = {
 665     "Command/Status",
 666     "General Pointer",
 667     "Port",
 668     "EEPROM/Flash Control",
 669     "MDI Control",
 670     "Receive DMA Byte Count",
 671     "Flow Control",
 672     "General Status/Control"
 673 };
 674
 675 static char *regname(uint32_t addr)
 676 {
 677     static char buf[32];
 678     if (addr < PCI_IO_SIZE) {
 679         const char *r = e100_reg[addr / 4];
 680         if (r != 0) {
 681             snprintf(buf, sizeof(buf), "%s+%u", r, addr % 4);
 682         } else {
 683             snprintf(buf, sizeof(buf), "0x%02x", addr);
 684         }
 685     } else {
 686         snprintf(buf, sizeof(buf), "??? 0x%08x", addr);
 687     }
 688     return buf;
 689 }
 690 #endif                          /* DEBUG_EEPRO100 */
 691
 692 /*****************************************************************************
 693  *
 694  * Command emulation.
 695  *
 696  ****************************************************************************/
 697
 698 #if 0
 699 static uint16_t eepro100_read_command(EEPRO100State * s)
 700 {
 701     uint16_t val = 0xffff;
 702     TRACE(OTHER, logout("val=0x%04x\n", val));
 703     return val;
 704 }
 705 #endif
 706
 707 /* Commands that can be put in a command list entry. */
 708 enum commands {
 709     CmdNOp = 0,
 710     CmdIASetup = 1,
 711     CmdConfigure = 2,
 712     CmdMulticastList = 3,
 713     CmdTx = 4,
 714     CmdTDR = 5,                 /* load microcode */
 715     CmdDump = 6,
 716     CmdDiagnose = 7,
 717
 718     /* And some extra flags: */
 719     CmdSuspend = 0x4000,        /* Suspend after completion. */
 720     CmdIntr = 0x2000,           /* Interrupt after completion. */
 721     CmdTxFlex = 0x0008,         /* Use "Flexible mode" for CmdTx command. */
 722 };
 723
 724 static cu_state_t get_cu_state(EEPRO100State * s)
 725 {
 726     return ((s->mem[SCBStatus] & BITS(7, 6)) >> 6);
 727 }
 728
 729 static void set_cu_state(EEPRO100State * s, cu_state_t state)
 730 {
 731     s->mem[SCBStatus] = (s->mem[SCBStatus] & ~BITS(7, 6)) + (state << 6);
 732 }
 733
 734 static ru_state_t get_ru_state(EEPRO100State * s)
 735 {
 736     return ((s->mem[SCBStatus] & BITS(5, 2)) >> 2);
 737 }
 738
 739 static void set_ru_state(EEPRO100State * s, ru_state_t state)
 740 {
 741     s->mem[SCBStatus] = (s->mem[SCBStatus] & ~BITS(5, 2)) + (state << 2);
 742 }
 743
 744 static void dump_statistics(EEPRO100State * s)
 745 {
 746     /* Dump statistical data. Most data is never changed by the emulation
 747      * and always 0, so we first just copy the whole block and then those
 748      * values which really matter.
 749      * Number of data should check configuration!!!
 750      */
 751     cpu_physical_memory_write(s->statsaddr,
 752                               (uint8_t *) & s->statistics, s->stats_size);
 753     stl_le_phys(s->statsaddr + 0, s->statistics.tx_good_frames);
 754     stl_le_phys(s->statsaddr + 36, s->statistics.rx_good_frames);
 755     stl_le_phys(s->statsaddr + 48, s->statistics.rx_resource_errors);
 756     stl_le_phys(s->statsaddr + 60, s->statistics.rx_short_frame_errors);
 757 #if 0
 758     stw_le_phys(s->statsaddr + 76, s->statistics.xmt_tco_frames);
 759     stw_le_phys(s->statsaddr + 78, s->statistics.rcv_tco_frames);
 760     missing("CU dump statistical counters");
 761 #endif
 762 }
 763
 764 static void read_cb(EEPRO100State *s)
 765 {
 766     cpu_physical_memory_read(s->cb_address, (uint8_t *) &s->tx, sizeof(s->tx));
 767     s->tx.status = le16_to_cpu(s->tx.status);
 768     s->tx.command = le16_to_cpu(s->tx.command);
 769     s->tx.link = le32_to_cpu(s->tx.link);
 770     s->tx.tbd_array_addr = le32_to_cpu(s->tx.tbd_array_addr);
 771     s->tx.tcb_bytes = le16_to_cpu(s->tx.tcb_bytes);
 772 }
 773
 774 static void tx_command(EEPRO100State *s)
 775 {
 776     uint32_t tbd_array = le32_to_cpu(s->tx.tbd_array_addr);
 777     uint16_t tcb_bytes = (le16_to_cpu(s->tx.tcb_bytes) & 0x3fff);
 778     /* Sends larger than MAX_ETH_FRAME_SIZE are allowed, up to 2600 bytes. */
 779     uint8_t buf[2600];
 780     uint16_t size = 0;
 781     uint32_t tbd_address = s->cb_address + 0x10;
 782     TRACE(RXTX, logout
 783         ("transmit, TBD array address 0x%08x, TCB byte count 0x%04x, TBD count %u\n",
 784          tbd_array, tcb_bytes, s->tx.tbd_count));
 785
 786     if (tcb_bytes > 2600) {
 787         logout("TCB byte count too large, using 2600\n");
 788         tcb_bytes = 2600;
 789     }
 790     if (!((tcb_bytes > 0) || (tbd_array != 0xffffffff))) {
 791         logout
 792             ("illegal values of TBD array address and TCB byte count!\n");
 793     }
 794     assert(tcb_bytes <= sizeof(buf));
 795     while (size < tcb_bytes) {
 796         uint32_t tx_buffer_address = ldl_phys(tbd_address);
 797         uint16_t tx_buffer_size = lduw_phys(tbd_address + 4);
 798 #if 0
 799         uint16_t tx_buffer_el = lduw_phys(tbd_address + 6);
 800 #endif
 801         tbd_address += 8;
 802         TRACE(RXTX, logout
 803             ("TBD (simplified mode): buffer address 0x%08x, size 0x%04x\n",
 804              tx_buffer_address, tx_buffer_size));
 805         tx_buffer_size = MIN(tx_buffer_size, sizeof(buf) - size);
 806         cpu_physical_memory_read(tx_buffer_address, &buf[size],
 807                                  tx_buffer_size);
 808         size += tx_buffer_size;
 809     }
 810     if (tbd_array == 0xffffffff) {
 811         /* Simplified mode. Was already handled by code above. */
 812     } else {
 813         /* Flexible mode. */
 814         uint8_t tbd_count = 0;
 815         if (s->has_extended_tcb_support && !(s->configuration[6] & BIT(4))) {
 816             /* Extended Flexible TCB. */
 817             for (; tbd_count < 2; tbd_count++) {
 818                 uint32_t tx_buffer_address = ldl_phys(tbd_address);
 819                 uint16_t tx_buffer_size = lduw_phys(tbd_address + 4);
 820                 uint16_t tx_buffer_el = lduw_phys(tbd_address + 6);
 821                 tbd_address += 8;
 822                 TRACE(RXTX, logout
 823                     ("TBD (extended flexible mode): buffer address 0x%08x, size 0x%04x\n",
 824                      tx_buffer_address, tx_buffer_size));
 825                 tx_buffer_size = MIN(tx_buffer_size, sizeof(buf) - size);
 826                 cpu_physical_memory_read(tx_buffer_address, &buf[size],
 827                                          tx_buffer_size);
 828                 size += tx_buffer_size;
 829                 if (tx_buffer_el & 1) {
 830                     break;
 831                 }
 832             }
 833         }
 834         tbd_address = tbd_array;
 835         for (; tbd_count < s->tx.tbd_count; tbd_count++) {
 836             uint32_t tx_buffer_address = ldl_phys(tbd_address);
 837             uint16_t tx_buffer_size = lduw_phys(tbd_address + 4);
 838             uint16_t tx_buffer_el = lduw_phys(tbd_address + 6);
 839             tbd_address += 8;
 840             TRACE(RXTX, logout
 841                 ("TBD (flexible mode): buffer address 0x%08x, size 0x%04x\n",
 842                  tx_buffer_address, tx_buffer_size));
 843             tx_buffer_size = MIN(tx_buffer_size, sizeof(buf) - size);
 844             cpu_physical_memory_read(tx_buffer_address, &buf[size],
 845                                      tx_buffer_size);
 846             size += tx_buffer_size;
 847             if (tx_buffer_el & 1) {
 848                 break;
 849             }
 850         }
 851     }
 852     TRACE(RXTX, logout("%p sending frame, len=%d,%s\n", s, size, nic_dump(buf, size)));
 853     qemu_send_packet(&s->nic->nc, buf, size);
 854     s->statistics.tx_good_frames++;
 855     /* Transmit with bad status would raise an CX/TNO interrupt.
 856      * (82557 only). Emulation never has bad status. */
 857 #if 0
 858     eepro100_cx_interrupt(s);
 859 #endif
 860 }
 861
 862 static void set_multicast_list(EEPRO100State *s)
 863 {
 864     uint16_t multicast_count = s->tx.tbd_array_addr & BITS(13, 0);
 865     uint16_t i;
 866     memset(&s->mult[0], 0, sizeof(s->mult));
 867     TRACE(OTHER, logout("multicast list, multicast count = %u\n", multicast_count));
 868     for (i = 0; i < multicast_count; i += 6) {
 869         uint8_t multicast_addr[6];
 870         cpu_physical_memory_read(s->cb_address + 10 + i, multicast_addr, 6);
 871         TRACE(OTHER, logout("multicast entry %s\n", nic_dump(multicast_addr, 6)));
 872         unsigned mcast_idx = compute_mcast_idx(multicast_addr);
 873         assert(mcast_idx < 64);
 874         s->mult[mcast_idx >> 3] |= (1 << (mcast_idx & 7));
 875     }
 876 }
 877
 878 static void action_command(EEPRO100State *s)
 879 {
 880     for (;;) {
 881         bool bit_el;
 882         bool bit_s;
 883         bool bit_i;
 884         bool bit_nc;
 885         bool success = true;
 886         s->cb_address = s->cu_base + s->cu_offset;
 887         read_cb(s);
 888         bit_el = ((s->tx.command & COMMAND_EL) != 0);
 889         bit_s = ((s->tx.command & COMMAND_S) != 0);
 890         bit_i = ((s->tx.command & COMMAND_I) != 0);
 891         bit_nc = ((s->tx.command & COMMAND_NC) != 0);
 892 #if 0
 893         bool bit_sf = ((s->tx.command & COMMAND_SF) != 0);
 894 #endif
 895         s->cu_offset = s->tx.link;
 896         TRACE(OTHER,
 897               logout("val=(cu start), status=0x%04x, command=0x%04x, link=0x%08x\n",
 898                      s->tx.status, s->tx.command, s->tx.link));
 899         switch (s->tx.command & COMMAND_CMD) {
 900         case CmdNOp:
 901             /* Do nothing. */
 902             break;
 903         case CmdIASetup:
 904             cpu_physical_memory_read(s->cb_address + 8, &s->conf.macaddr.a[0], 6);
 905             TRACE(OTHER, logout("macaddr: %s\n", nic_dump(&s->conf.macaddr.a[0], 6)));
 906             break;
 907         case CmdConfigure:
 908             cpu_physical_memory_read(s->cb_address + 8, &s->configuration[0],
 909                                      sizeof(s->configuration));
 910             TRACE(OTHER, logout("configuration: %s\n", nic_dump(&s->configuration[0], 16)));
 911             break;
 912         case CmdMulticastList:
 913             set_multicast_list(s);
 914             break;
 915         case CmdTx:
 916             if (bit_nc) {
 917                 missing("CmdTx: NC = 0");
 918                 success = false;
 919                 break;
 920             }
 921             tx_command(s);
 922             break;
 923         case CmdTDR:
 924             TRACE(OTHER, logout("load microcode\n"));
 925             /* Starting with offset 8, the command contains
 926              * 64 dwords microcode which we just ignore here. */
 927             break;
 928         case CmdDiagnose:
 929             TRACE(OTHER, logout("diagnose\n"));
 930             /* Make sure error flag is not set. */
 931             s->tx.status = 0;
 932             break;
 933         default:
 934             missing("undefined command");
 935             success = false;
 936             break;
 937         }
 938         /* Write new status. */
 939         stw_phys(s->cb_address, s->tx.status | STATUS_C | (success ? STATUS_OK : 0));
 940         if (bit_i) {
 941             /* CU completed action. */
 942             eepro100_cx_interrupt(s);
 943         }
 944         if (bit_el) {
 945             /* CU becomes idle. Terminate command loop. */
 946             set_cu_state(s, cu_idle);
 947             eepro100_cna_interrupt(s);
 948             break;
 949         } else if (bit_s) {
 950             /* CU becomes suspended. Terminate command loop. */
 951             set_cu_state(s, cu_suspended);
 952             eepro100_cna_interrupt(s);
 953             break;
 954         } else {
 955             /* More entries in list. */
 956             TRACE(OTHER, logout("CU list with at least one more entry\n"));
 957         }
 958     }
 959     TRACE(OTHER, logout("CU list empty\n"));
 960     /* List is empty. Now CU is idle or suspended. */
 961 }
 962
 963 static void eepro100_cu_command(EEPRO100State * s, uint8_t val)
 964 {
 965     cu_state_t cu_state;
 966     switch (val) {
 967     case CU_NOP:
 968         /* No operation. */
 969         break;
 970     case CU_START:
 971         cu_state = get_cu_state(s);
 972         if (cu_state != cu_idle && cu_state != cu_suspended) {
 973             /* Intel documentation says that CU must be idle or suspended
 974              * for the CU start command. */
 975             logout("unexpected CU state is %u\n", cu_state);
 976         }
 977         set_cu_state(s, cu_active);
 978         s->cu_offset = s->pointer;
 979         action_command(s);
 980         break;
 981     case CU_RESUME:
 982         if (get_cu_state(s) != cu_suspended) {
 983             logout("bad CU resume from CU state %u\n", get_cu_state(s));
 984             /* Workaround for bad Linux eepro100 driver which resumes
 985              * from idle state. */
 986 #if 0
 987             missing("cu resume");
 988 #endif
 989             set_cu_state(s, cu_suspended);
 990         }
 991         if (get_cu_state(s) == cu_suspended) {
 992             TRACE(OTHER, logout("CU resuming\n"));
 993             set_cu_state(s, cu_active);
 994             action_command(s);
 995         }
 996         break;
 997     case CU_STATSADDR:
 998         /* Load dump counters address. */
 999         s->statsaddr = s->pointer;
1000         TRACE(OTHER, logout("val=0x%02x (status address)\n", val));
1001         break;
1002     case CU_SHOWSTATS:
1003         /* Dump statistical counters. */
1004         TRACE(OTHER, logout("val=0x%02x (dump stats)\n", val));
1005         dump_statistics(s);
1006         stl_le_phys(s->statsaddr + s->stats_size, 0xa005);
1007         break;
1008     case CU_CMD_BASE:
1009         /* Load CU base. */
1010         TRACE(OTHER, logout("val=0x%02x (CU base address)\n", val));
1011         s->cu_base = s->pointer;
1012         break;
1013     case CU_DUMPSTATS:
1014         /* Dump and reset statistical counters. */
1015         TRACE(OTHER, logout("val=0x%02x (dump stats and reset)\n", val));
1016         dump_statistics(s);
1017         stl_le_phys(s->statsaddr + s->stats_size, 0xa007);
1018         memset(&s->statistics, 0, sizeof(s->statistics));
1019         break;
1020     case CU_SRESUME:
1021         /* CU static resume. */
1022         missing("CU static resume");
1023         break;
1024     default:
1025         missing("Undefined CU command");
1026     }
1027 }
1028
1029 static void eepro100_ru_command(EEPRO100State * s, uint8_t val)
1030 {
1031     switch (val) {
1032     case RU_NOP:
1033         /* No operation. */
1034         break;
1035     case RX_START:
1036         /* RU start. */
1037         if (get_ru_state(s) != ru_idle) {
1038             logout("RU state is %u, should be %u\n", get_ru_state(s), ru_idle);
1039 #if 0
1040             assert(!"wrong RU state");
1041 #endif
1042         }
1043         set_ru_state(s, ru_ready);
1044         s->ru_offset = s->pointer;
1045         TRACE(OTHER, logout("val=0x%02x (rx start)\n", val));
1046         break;
1047     case RX_RESUME:
1048         /* Restart RU. */
1049         if (get_ru_state(s) != ru_suspended) {
1050             logout("RU state is %u, should be %u\n", get_ru_state(s),
1051                    ru_suspended);
1052 #if 0
1053             assert(!"wrong RU state");
1054 #endif
1055         }
1056         set_ru_state(s, ru_ready);
1057         break;
1058     case RU_ABORT:
1059         /* RU abort. */
1060         if (get_ru_state(s) == ru_ready) {
1061             eepro100_rnr_interrupt(s);
1062         }
1063         set_ru_state(s, ru_idle);
1064         break;
1065     case RX_ADDR_LOAD:
1066         /* Load RU base. */
1067         TRACE(OTHER, logout("val=0x%02x (RU base address)\n", val));
1068         s->ru_base = s->pointer;
1069         break;
1070     default:
1071         logout("val=0x%02x (undefined RU command)\n", val);
1072         missing("Undefined SU command");
1073     }
1074 }
1075
1076 static void eepro100_write_command(EEPRO100State * s, uint8_t val)
1077 {
1078     eepro100_ru_command(s, val & 0x0f);
1079     eepro100_cu_command(s, val & 0xf0);
1080     if ((val) == 0) {
1081         TRACE(OTHER, logout("val=0x%02x\n", val));
1082     }
1083     /* Clear command byte after command was accepted. */
1084     s->mem[SCBCmd] = 0;
1085 }
1086
1087 /*****************************************************************************
1088  *
1089  * EEPROM emulation.
1090  *
1091  ****************************************************************************/
1092
1093 #define EEPROM_CS       0x02
1094 #define EEPROM_SK       0x01
1095 #define EEPROM_DI       0x04
1096 #define EEPROM_DO       0x08
1097
1098 static uint16_t eepro100_read_eeprom(EEPRO100State * s)
1099 {
1100     uint16_t val;
1101     memcpy(&val, &s->mem[SCBeeprom], sizeof(val));
1102     if (eeprom93xx_read(s->eeprom)) {
1103         val |= EEPROM_DO;
1104     } else {
1105         val &= ~EEPROM_DO;
1106     }
1107     TRACE(EEPROM, logout("val=0x%04x\n", val));
1108     return val;
1109 }
1110
1111 static void eepro100_write_eeprom(eeprom_t * eeprom, uint8_t val)
1112 {
1113     TRACE(EEPROM, logout("val=0x%02x\n", val));
1114
1115     /* mask unwriteable bits */
1116 #if 0
1117     val = SET_MASKED(val, 0x31, eeprom->value);
1118 #endif
1119
1120     int eecs = ((val & EEPROM_CS) != 0);
1121     int eesk = ((val & EEPROM_SK) != 0);
1122     int eedi = ((val & EEPROM_DI) != 0);
1123     eeprom93xx_write(eeprom, eecs, eesk, eedi);
1124 }
1125
1126 static void eepro100_write_pointer(EEPRO100State * s, uint32_t val)
1127 {
1128     s->pointer = le32_to_cpu(val);
1129     TRACE(OTHER, logout("val=0x%08x\n", val));
1130 }
1131
1132 /*****************************************************************************
1133  *
1134  * MDI emulation.
1135  *
1136  ****************************************************************************/
1137
1138 #if defined(DEBUG_EEPRO100)
1139 static const char * const mdi_op_name[] = {
1140     "opcode 0",
1141     "write",
1142     "read",
1143     "opcode 3"
1144 };
1145
1146 static const char * const mdi_reg_name[] = {
1147     "Control",
1148     "Status",
1149     "PHY Identification (Word 1)",
1150     "PHY Identification (Word 2)",
1151     "Auto-Negotiation Advertisement",
1152     "Auto-Negotiation Link Partner Ability",
1153     "Auto-Negotiation Expansion"
1154 };
1155
1156 static const char *reg2name(uint8_t reg)
1157 {
1158     static char buffer[10];
1159     const char *p = buffer;
1160     if (reg < ARRAY_SIZE(mdi_reg_name)) {
1161         p = mdi_reg_name[reg];
1162     } else {
1163         snprintf(buffer, sizeof(buffer), "reg=0x%02x", reg);
1164     }
1165     return p;
1166 }
1167 #endif                          /* DEBUG_EEPRO100 */
1168
1169 static uint32_t eepro100_read_mdi(EEPRO100State * s)
1170 {
1171     uint32_t val;
1172     memcpy(&val, &s->mem[0x10], sizeof(val));
1173
1174 #ifdef DEBUG_EEPRO100
1175     uint8_t raiseint = (val & BIT(29)) >> 29;
1176     uint8_t opcode = (val & BITS(27, 26)) >> 26;
1177     uint8_t phy = (val & BITS(25, 21)) >> 21;
1178     uint8_t reg = (val & BITS(20, 16)) >> 16;
1179     uint16_t data = (val & BITS(15, 0));
1180 #endif
1181     /* Emulation takes no time to finish MDI transaction. */
1182     val |= BIT(28);
1183     TRACE(MDI, logout("val=0x%08x (int=%u, %s, phy=%u, %s, data=0x%04x\n",
1184                       val, raiseint, mdi_op_name[opcode], phy,
1185                       reg2name(reg), data));
1186     return val;
1187 }
1188
1189 static void eepro100_write_mdi(EEPRO100State * s, uint32_t val)
1190 {
1191     uint8_t raiseint = (val & BIT(29)) >> 29;
1192     uint8_t opcode = (val & BITS(27, 26)) >> 26;
1193     uint8_t phy = (val & BITS(25, 21)) >> 21;
1194     uint8_t reg = (val & BITS(20, 16)) >> 16;
1195     uint16_t data = (val & BITS(15, 0));
1196     TRACE(MDI, logout("val=0x%08x (int=%u, %s, phy=%u, %s, data=0x%04x\n",
1197           val, raiseint, mdi_op_name[opcode], phy, reg2name(reg), data));
1198     if (phy != 1) {
1199         /* Unsupported PHY address. */
1200 #if 0
1201         logout("phy must be 1 but is %u\n", phy);
1202 #endif
1203         data = 0;
1204     } else if (opcode != 1 && opcode != 2) {
1205         /* Unsupported opcode. */
1206         logout("opcode must be 1 or 2 but is %u\n", opcode);
1207         data = 0;
1208     } else if (reg > 6) {
1209         /* Unsupported register. */
1210         logout("register must be 0...6 but is %u\n", reg);
1211         data = 0;
1212     } else {
1213         TRACE(MDI, logout("val=0x%08x (int=%u, %s, phy=%u, %s, data=0x%04x\n",
1214                           val, raiseint, mdi_op_name[opcode], phy,
1215                           reg2name(reg), data));
1216         if (opcode == 1) {
1217             /* MDI write */
1218             switch (reg) {
1219             case 0:            /* Control Register */
1220                 if (data & 0x8000) {
1221                     /* Reset status and control registers to default. */
1222                     s->mdimem[0] = eepro100_mdi_default[0];
1223                     s->mdimem[1] = eepro100_mdi_default[1];
1224                     data = s->mdimem[reg];
1225                 } else {
1226                     /* Restart Auto Configuration = Normal Operation */
1227                     data &= ~0x0200;
1228                 }
1229                 break;
1230             case 1:            /* Status Register */
1231                 missing("not writable");
1232                 data = s->mdimem[reg];
1233                 break;
1234             case 2:            /* PHY Identification Register (Word 1) */
1235             case 3:            /* PHY Identification Register (Word 2) */
1236                 missing("not implemented");
1237                 break;
1238             case 4:            /* Auto-Negotiation Advertisement Register */
1239             case 5:            /* Auto-Negotiation Link Partner Ability Register */
1240                 break;
1241             case 6:            /* Auto-Negotiation Expansion Register */
1242             default:
1243                 missing("not implemented");
1244             }
1245             s->mdimem[reg] = data;
1246         } else if (opcode == 2) {
1247             /* MDI read */
1248             switch (reg) {
1249             case 0:            /* Control Register */
1250                 if (data & 0x8000) {
1251                     /* Reset status and control registers to default. */
1252                     s->mdimem[0] = eepro100_mdi_default[0];
1253                     s->mdimem[1] = eepro100_mdi_default[1];
1254                 }
1255                 break;
1256             case 1:            /* Status Register */
1257                 s->mdimem[reg] |= 0x0020;
1258                 break;
1259             case 2:            /* PHY Identification Register (Word 1) */
1260             case 3:            /* PHY Identification Register (Word 2) */
1261             case 4:            /* Auto-Negotiation Advertisement Register */
1262                 break;
1263             case 5:            /* Auto-Negotiation Link Partner Ability Register */
1264                 s->mdimem[reg] = 0x41fe;
1265                 break;
1266             case 6:            /* Auto-Negotiation Expansion Register */
1267                 s->mdimem[reg] = 0x0001;
1268                 break;
1269             }
1270             data = s->mdimem[reg];
1271         }
1272         /* Emulation takes no time to finish MDI transaction.
1273          * Set MDI bit in SCB status register. */
1274         s->mem[SCBAck] |= 0x08;
1275         val |= BIT(28);
1276         if (raiseint) {
1277             eepro100_mdi_interrupt(s);
1278         }
1279     }
1280     val = (val & 0xffff0000) + data;
1281     memcpy(&s->mem[0x10], &val, sizeof(val));
1282 }
1283
1284 /*****************************************************************************
1285  *
1286  * Port emulation.
1287  *
1288  ****************************************************************************/
1289
1290 #define PORT_SOFTWARE_RESET     0
1291 #define PORT_SELFTEST           1
1292 #define PORT_SELECTIVE_RESET    2
1293 #define PORT_DUMP               3
1294 #define PORT_SELECTION_MASK     3
1295
1296 typedef struct {
1297     uint32_t st_sign;           /* Self Test Signature */
1298     uint32_t st_result;         /* Self Test Results */
1299 } eepro100_selftest_t;
1300
1301 static uint32_t eepro100_read_port(EEPRO100State * s)
1302 {
1303     return 0;
1304 }
1305
1306 static void eepro100_write_port(EEPRO100State * s, uint32_t val)
1307 {
1308     val = le32_to_cpu(val);
1309     uint32_t address = (val & ~PORT_SELECTION_MASK);
1310     uint8_t selection = (val & PORT_SELECTION_MASK);
1311     switch (selection) {
1312     case PORT_SOFTWARE_RESET:
1313         nic_reset(s);
1314         break;
1315     case PORT_SELFTEST:
1316         TRACE(OTHER, logout("selftest address=0x%08x\n", address));
1317         eepro100_selftest_t data;
1318         cpu_physical_memory_read(address, (uint8_t *) & data, sizeof(data));
1319         data.st_sign = 0xffffffff;
1320         data.st_result = 0;
1321         cpu_physical_memory_write(address, (uint8_t *) & data, sizeof(data));
1322         break;
1323     case PORT_SELECTIVE_RESET:
1324         TRACE(OTHER, logout("selective reset, selftest address=0x%08x\n", address));
1325         nic_selective_reset(s);
1326         break;
1327     default:
1328         logout("val=0x%08x\n", val);
1329         missing("unknown port selection");
1330     }
1331 }
1332
1333 /*****************************************************************************
1334  *
1335  * General hardware emulation.
1336  *
1337  ****************************************************************************/
1338
1339 static uint8_t eepro100_read1(EEPRO100State * s, uint32_t addr)
1340 {
1341     uint8_t val;
1342     if (addr <= sizeof(s->mem) - sizeof(val)) {
1343         memcpy(&val, &s->mem[addr], sizeof(val));
1344     }
1345
1346     switch (addr) {
1347     case SCBStatus:
1348     case SCBAck:
1349         TRACE(OTHER, logout("addr=%s val=0x%02x\n", regname(addr), val));
1350         break;
1351     case SCBCmd:
1352         TRACE(OTHER, logout("addr=%s val=0x%02x\n", regname(addr), val));
1353 #if 0
1354         val = eepro100_read_command(s);
1355 #endif
1356         break;
1357     case SCBIntmask:
1358         TRACE(OTHER, logout("addr=%s val=0x%02x\n", regname(addr), val));
1359         break;
1360     case SCBPort + 3:
1361         TRACE(OTHER, logout("addr=%s val=0x%02x\n", regname(addr), val));
1362         break;
1363     case SCBeeprom:
1364         val = eepro100_read_eeprom(s);
1365         break;
1366     case SCBpmdr:       /* Power Management Driver Register */
1367         val = 0;
1368         TRACE(OTHER, logout("addr=%s val=0x%02x\n", regname(addr), val));
1369         break;
1370     case SCBgstat:      /* General Status Register */
1371         /* 100 Mbps full duplex, valid link */
1372         val = 0x07;
1373         TRACE(OTHER, logout("addr=General Status val=%02x\n", val));
1374         break;
1375     default:
1376         logout("addr=%s val=0x%02x\n", regname(addr), val);
1377         missing("unknown byte read");
1378     }
1379     return val;
1380 }
1381
1382 static uint16_t eepro100_read2(EEPRO100State * s, uint32_t addr)
1383 {
1384     uint16_t val;
1385     if (addr <= sizeof(s->mem) - sizeof(val)) {
1386         memcpy(&val, &s->mem[addr], sizeof(val));
1387     }
1388
1389     switch (addr) {
1390     case SCBStatus:
1391     case SCBCmd:
1392         TRACE(OTHER, logout("addr=%s val=0x%04x\n", regname(addr), val));
1393         break;
1394     case SCBeeprom:
1395         val = eepro100_read_eeprom(s);
1396         TRACE(OTHER, logout("addr=%s val=0x%04x\n", regname(addr), val));
1397         break;
1398     default:
1399         logout("addr=%s val=0x%04x\n", regname(addr), val);
1400         missing("unknown word read");
1401     }
1402     return val;
1403 }
1404
1405 static uint32_t eepro100_read4(EEPRO100State * s, uint32_t addr)
1406 {
1407     uint32_t val;
1408     if (addr <= sizeof(s->mem) - sizeof(val)) {
1409         memcpy(&val, &s->mem[addr], sizeof(val));
1410     }
1411
1412     switch (addr) {
1413     case SCBStatus:
1414         TRACE(OTHER, logout("addr=%s val=0x%08x\n", regname(addr), val));
1415         break;
1416     case SCBPointer:
1417 #if 0
1418         val = eepro100_read_pointer(s);
1419 #endif
1420         TRACE(OTHER, logout("addr=%s val=0x%08x\n", regname(addr), val));
1421         break;
1422     case SCBPort:
1423         val = eepro100_read_port(s);
1424         TRACE(OTHER, logout("addr=%s val=0x%08x\n", regname(addr), val));
1425         break;
1426     case SCBCtrlMDI:
1427         val = eepro100_read_mdi(s);
1428         break;
1429     default:
1430         logout("addr=%s val=0x%08x\n", regname(addr), val);
1431         missing("unknown longword read");
1432     }
1433     return val;
1434 }
1435
1436 static void eepro100_write1(EEPRO100State * s, uint32_t addr, uint8_t val)
1437 {
1438     /* SCBStatus is readonly. */
1439     if (addr > SCBStatus && addr <= sizeof(s->mem) - sizeof(val)) {
1440         memcpy(&s->mem[addr], &val, sizeof(val));
1441     }
1442
1443     TRACE(OTHER, logout("addr=%s val=0x%02x\n", regname(addr), val));
1444
1445     switch (addr) {
1446     case SCBStatus:
1447         break;
1448     case SCBAck:
1449         eepro100_acknowledge(s);
1450         break;
1451     case SCBCmd:
1452         eepro100_write_command(s, val);
1453         break;
1454     case SCBIntmask:
1455         if (val & BIT(1)) {
1456             eepro100_swi_interrupt(s);
1457         }
1458         eepro100_interrupt(s, 0);
1459         break;
1460     case SCBPort + 3:
1461     case SCBFlow:       /* does not exist on 82557 */
1462     case SCBFlow + 1:
1463     case SCBFlow + 2:
1464     case SCBpmdr:       /* does not exist on 82557 */
1465         TRACE(OTHER, logout("addr=%s val=0x%02x\n", regname(addr), val));
1466         break;
1467     case SCBeeprom:
1468         eepro100_write_eeprom(s->eeprom, val);
1469         break;
1470     default:
1471         logout("addr=%s val=0x%02x\n", regname(addr), val);
1472         missing("unknown byte write");
1473     }
1474 }
1475
1476 static void eepro100_write2(EEPRO100State * s, uint32_t addr, uint16_t val)
1477 {
1478     /* SCBStatus is readonly. */
1479     if (addr > SCBStatus && addr <= sizeof(s->mem) - sizeof(val)) {
1480         memcpy(&s->mem[addr], &val, sizeof(val));
1481     }
1482
1483     TRACE(OTHER, logout("addr=%s val=0x%04x\n", regname(addr), val));
1484
1485     switch (addr) {
1486     case SCBStatus:
1487         s->mem[SCBAck] = (val >> 8);
1488         eepro100_acknowledge(s);
1489         break;
1490     case SCBCmd:
1491         eepro100_write_command(s, val);
1492         eepro100_write1(s, SCBIntmask, val >> 8);
1493         break;
1494     case SCBeeprom:
1495         eepro100_write_eeprom(s->eeprom, val);
1496         break;
1497     default:
1498         logout("addr=%s val=0x%04x\n", regname(addr), val);
1499         missing("unknown word write");
1500     }
1501 }
1502
1503 static void eepro100_write4(EEPRO100State * s, uint32_t addr, uint32_t val)
1504 {
1505     if (addr <= sizeof(s->mem) - sizeof(val)) {
1506         memcpy(&s->mem[addr], &val, sizeof(val));
1507     }
1508
1509     switch (addr) {
1510     case SCBPointer:
1511         eepro100_write_pointer(s, val);
1512         break;
1513     case SCBPort:
1514         TRACE(OTHER, logout("addr=%s val=0x%08x\n", regname(addr), val));
1515         eepro100_write_port(s, val);
1516         break;
1517     case SCBCtrlMDI:
1518         eepro100_write_mdi(s, val);
1519         break;
1520     default:
1521         logout("addr=%s val=0x%08x\n", regname(addr), val);
1522         missing("unknown longword write");
1523     }
1524 }
1525
1526 /*****************************************************************************
1527  *
1528  * Port mapped I/O.
1529  *
1530  ****************************************************************************/
1531
1532 static uint32_t ioport_read1(void *opaque, uint32_t addr)
1533 {
1534     EEPRO100State *s = opaque;
1535 #if 0
1536     logout("addr=%s\n", regname(addr));
1537 #endif
1538     return eepro100_read1(s, addr - s->region[1]);
1539 }
1540
1541 static uint32_t ioport_read2(void *opaque, uint32_t addr)
1542 {
1543     EEPRO100State *s = opaque;
1544     return eepro100_read2(s, addr - s->region[1]);
1545 }
1546
1547 static uint32_t ioport_read4(void *opaque, uint32_t addr)
1548 {
1549     EEPRO100State *s = opaque;
1550     return eepro100_read4(s, addr - s->region[1]);
1551 }
1552
1553 static void ioport_write1(void *opaque, uint32_t addr, uint32_t val)
1554 {
1555     EEPRO100State *s = opaque;
1556 #if 0
1557     logout("addr=%s val=0x%02x\n", regname(addr), val);
1558 #endif
1559     eepro100_write1(s, addr - s->region[1], val);
1560 }
1561
1562 static void ioport_write2(void *opaque, uint32_t addr, uint32_t val)
1563 {
1564     EEPRO100State *s = opaque;
1565     eepro100_write2(s, addr - s->region[1], val);
1566 }
1567
1568 static void ioport_write4(void *opaque, uint32_t addr, uint32_t val)
1569 {
1570     EEPRO100State *s = opaque;
1571     eepro100_write4(s, addr - s->region[1], val);
1572 }
1573
1574 /***********************************************************/
1575 /* PCI EEPRO100 definitions */
1576
1577 static void pci_map(PCIDevice * pci_dev, int region_num,
1578                     pcibus_t addr, pcibus_t size, int type)
1579 {
1580     EEPRO100State *s = DO_UPCAST(EEPRO100State, dev, pci_dev);
1581
1582     TRACE(OTHER, logout("region %d, addr=0x%08"FMT_PCIBUS", "
1583           "size=0x%08"FMT_PCIBUS", type=%d\n",
1584           region_num, addr, size, type));
1585
1586     assert(region_num == 1);
1587     register_ioport_write(addr, size, 1, ioport_write1, s);
1588     register_ioport_read(addr, size, 1, ioport_read1, s);
1589     register_ioport_write(addr, size, 2, ioport_write2, s);
1590     register_ioport_read(addr, size, 2, ioport_read2, s);
1591     register_ioport_write(addr, size, 4, ioport_write4, s);
1592     register_ioport_read(addr, size, 4, ioport_read4, s);
1593
1594     s->region[region_num] = addr;
1595 }
1596
1597 /*****************************************************************************
1598  *
1599  * Memory mapped I/O.
1600  *
1601  ****************************************************************************/
1602
1603 static void pci_mmio_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
1604 {
1605     EEPRO100State *s = opaque;
1606 #if 0
1607     logout("addr=%s val=0x%02x\n", regname(addr), val);
1608 #endif
1609     eepro100_write1(s, addr, val);
1610 }
1611
1612 static void pci_mmio_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
1613 {
1614     EEPRO100State *s = opaque;
1615 #if 0
1616     logout("addr=%s val=0x%02x\n", regname(addr), val);
1617 #endif
1618     eepro100_write2(s, addr, val);
1619 }
1620
1621 static void pci_mmio_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
1622 {
1623     EEPRO100State *s = opaque;
1624 #if 0
1625     logout("addr=%s val=0x%02x\n", regname(addr), val);
1626 #endif
1627     eepro100_write4(s, addr, val);
1628 }
1629
1630 static uint32_t pci_mmio_readb(void *opaque, target_phys_addr_t addr)
1631 {
1632     EEPRO100State *s = opaque;
1633 #if 0
1634     logout("addr=%s\n", regname(addr));
1635 #endif
1636     return eepro100_read1(s, addr);
1637 }
1638
1639 static uint32_t pci_mmio_readw(void *opaque, target_phys_addr_t addr)
1640 {
1641     EEPRO100State *s = opaque;
1642 #if 0
1643     logout("addr=%s\n", regname(addr));
1644 #endif
1645     return eepro100_read2(s, addr);
1646 }
1647
1648 static uint32_t pci_mmio_readl(void *opaque, target_phys_addr_t addr)
1649 {
1650     EEPRO100State *s = opaque;
1651 #if 0
1652     logout("addr=%s\n", regname(addr));
1653 #endif
1654     return eepro100_read4(s, addr);
1655 }
1656
1657 static CPUWriteMemoryFunc * const pci_mmio_write[] = {
1658     pci_mmio_writeb,
1659     pci_mmio_writew,
1660     pci_mmio_writel
1661 };
1662
1663 static CPUReadMemoryFunc * const pci_mmio_read[] = {
1664     pci_mmio_readb,
1665     pci_mmio_readw,
1666     pci_mmio_readl
1667 };
1668
1669 static void pci_mmio_map(PCIDevice * pci_dev, int region_num,
1670                          pcibus_t addr, pcibus_t size, int type)
1671 {
1672     EEPRO100State *s = DO_UPCAST(EEPRO100State, dev, pci_dev);
1673
1674     TRACE(OTHER, logout("region %d, addr=0x%08"FMT_PCIBUS", "
1675           "size=0x%08"FMT_PCIBUS", type=%d\n",
1676           region_num, addr, size, type));
1677
1678     if (region_num == 0) {
1679         /* Map control / status registers. */
1680         cpu_register_physical_memory(addr, size, s->mmio_index);
1681         s->region[region_num] = addr;
1682     }
1683 }
1684
1685 static int nic_can_receive(VLANClientState *nc)
1686 {
1687     EEPRO100State *s = DO_UPCAST(NICState, nc, nc)->opaque;
1688     TRACE(RXTX, logout("%p\n", s));
1689     return get_ru_state(s) == ru_ready;
1690 #if 0
1691     return !eepro100_buffer_full(s);
1692 #endif
1693 }
1694
1695 static ssize_t nic_receive(VLANClientState *nc, const uint8_t * buf, size_t size)
1696 {
1697     /* TODO:
1698      * - Magic packets should set bit 30 in power management driver register.
1699      * - Interesting packets should set bit 29 in power management driver register.
1700      */
1701     EEPRO100State *s = DO_UPCAST(NICState, nc, nc)->opaque;
1702     uint16_t rfd_status = 0xa000;
1703     static const uint8_t broadcast_macaddr[6] =
1704         { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
1705
1706     /* TODO: check multiple IA bit. */
1707     if (s->configuration[20] & BIT(6)) {
1708         missing("Multiple IA bit");
1709         return -1;
1710     }
1711
1712     if (s->configuration[8] & 0x80) {
1713         /* CSMA is disabled. */
1714         logout("%p received while CSMA is disabled\n", s);
1715         return -1;
1716     } else if (size < 64 && (s->configuration[7] & BIT(0))) {
1717         /* Short frame and configuration byte 7/0 (discard short receive) set:
1718          * Short frame is discarded */
1719         logout("%p received short frame (%zu byte)\n", s, size);
1720         s->statistics.rx_short_frame_errors++;
1721 #if 0
1722         return -1;
1723 #endif
1724     } else if ((size > MAX_ETH_FRAME_SIZE + 4) && !(s->configuration[18] & BIT(3))) {
1725         /* Long frame and configuration byte 18/3 (long receive ok) not set:
1726          * Long frames are discarded. */
1727         logout("%p received long frame (%zu byte), ignored\n", s, size);
1728         return -1;
1729     } else if (memcmp(buf, s->conf.macaddr.a, 6) == 0) {       /* !!! */
1730         /* Frame matches individual address. */
1731         /* TODO: check configuration byte 15/4 (ignore U/L). */
1732         TRACE(RXTX, logout("%p received frame for me, len=%zu\n", s, size));
1733     } else if (memcmp(buf, broadcast_macaddr, 6) == 0) {
1734         /* Broadcast frame. */
1735         TRACE(RXTX, logout("%p received broadcast, len=%zu\n", s, size));
1736         rfd_status |= 0x0002;
1737     } else if (buf[0] & 0x01) {
1738         /* Multicast frame. */
1739         TRACE(RXTX, logout("%p received multicast, len=%zu,%s\n", s, size, nic_dump(buf, size)));
1740         if (s->configuration[21] & BIT(3)) {
1741           /* Multicast all bit is set, receive all multicast frames. */
1742         } else {
1743           unsigned mcast_idx = compute_mcast_idx(buf);
1744           assert(mcast_idx < 64);
1745           if (s->mult[mcast_idx >> 3] & (1 << (mcast_idx & 7))) {
1746             /* Multicast frame is allowed in hash table. */
1747           } else if (s->configuration[15] & BIT(0)) {
1748               /* Promiscuous: receive all. */
1749               rfd_status |= 0x0004;
1750           } else {
1751               TRACE(RXTX, logout("%p multicast ignored\n", s));
1752               return -1;
1753           }
1754         }
1755         /* TODO: Next not for promiscuous mode? */
1756         rfd_status |= 0x0002;
1757     } else if (s->configuration[15] & BIT(0)) {
1758         /* Promiscuous: receive all. */
1759         TRACE(RXTX, logout("%p received frame in promiscuous mode, len=%zu\n", s, size));
1760         rfd_status |= 0x0004;
1761     } else {
1762         TRACE(RXTX, logout("%p received frame, ignored, len=%zu,%s\n", s, size,
1763               nic_dump(buf, size)));
1764         return size;
1765     }
1766
1767     if (get_ru_state(s) != ru_ready) {
1768         /* No resources available. */
1769         logout("no resources, state=%u\n", get_ru_state(s));
1770         /* TODO: RNR interrupt only at first failed frame? */
1771         eepro100_rnr_interrupt(s);
1772         s->statistics.rx_resource_errors++;
1773 #if 0
1774         assert(!"no resources");
1775 #endif
1776         return -1;
1777     }
1778     /* !!! */
1779     eepro100_rx_t rx;
1780     cpu_physical_memory_read(s->ru_base + s->ru_offset, (uint8_t *) & rx,
1781                              offsetof(eepro100_rx_t, packet));
1782     uint16_t rfd_command = le16_to_cpu(rx.command);
1783     uint16_t rfd_size = le16_to_cpu(rx.size);
1784
1785     if (size > rfd_size) {
1786         logout("Receive buffer (%" PRId16 " bytes) too small for data "
1787             "(%zu bytes); data truncated\n", rfd_size, size);
1788         size = rfd_size;
1789     }
1790     if (size < 64) {
1791         rfd_status |= 0x0080;
1792     }
1793     TRACE(OTHER, logout("command 0x%04x, link 0x%08x, addr 0x%08x, size %u\n",
1794           rfd_command, rx.link, rx.rx_buf_addr, rfd_size));
1795     stw_phys(s->ru_base + s->ru_offset + offsetof(eepro100_rx_t, status),
1796              rfd_status);
1797     stw_phys(s->ru_base + s->ru_offset + offsetof(eepro100_rx_t, count), size);
1798     /* Early receive interrupt not supported. */
1799 #if 0
1800     eepro100_er_interrupt(s);
1801 #endif
1802     /* Receive CRC Transfer not supported. */
1803     if (s->configuration[18] & BIT(2)) {
1804         missing("Receive CRC Transfer");
1805         return -1;
1806     }
1807     /* TODO: check stripping enable bit. */
1808 #if 0
1809     assert(!(s->configuration[17] & BIT(0)));
1810 #endif
1811     cpu_physical_memory_write(s->ru_base + s->ru_offset +
1812                               offsetof(eepro100_rx_t, packet), buf, size);
1813     s->statistics.rx_good_frames++;
1814     eepro100_fr_interrupt(s);
1815     s->ru_offset = le32_to_cpu(rx.link);
1816     if (rfd_command & COMMAND_EL) {
1817         /* EL bit is set, so this was the last frame. */
1818         logout("receive: Running out of frames\n");
1819         set_ru_state(s, ru_suspended);
1820     }
1821     if (rfd_command & COMMAND_S) {
1822         /* S bit is set. */
1823         set_ru_state(s, ru_suspended);
1824     }
1825     return size;
1826 }
1827
1828 static const VMStateDescription vmstate_eepro100 = {
1829     .version_id = 3,
1830     .minimum_version_id = 2,
1831     .minimum_version_id_old = 2,
1832     .fields      = (VMStateField []) {
1833         VMSTATE_PCI_DEVICE(dev, EEPRO100State),
1834         VMSTATE_UNUSED(32),
1835         VMSTATE_BUFFER(mult, EEPRO100State),
1836         VMSTATE_BUFFER(mem, EEPRO100State),
1837         /* Save all members of struct between scb_stat and mem. */
1838         VMSTATE_UINT8(scb_stat, EEPRO100State),
1839         VMSTATE_UINT8(int_stat, EEPRO100State),
1840         VMSTATE_UNUSED(3*4),
1841         VMSTATE_MACADDR(conf.macaddr, EEPRO100State),
1842         VMSTATE_UNUSED(19*4),
1843         VMSTATE_UINT16_ARRAY(mdimem, EEPRO100State, 32),
1844         /* The eeprom should be saved and restored by its own routines. */
1845         VMSTATE_UINT32(device, EEPRO100State),
1846         /* TODO check device. */
1847         VMSTATE_UINT32(pointer, EEPRO100State),
1848         VMSTATE_UINT32(cu_base, EEPRO100State),
1849         VMSTATE_UINT32(cu_offset, EEPRO100State),
1850         VMSTATE_UINT32(ru_base, EEPRO100State),
1851         VMSTATE_UINT32(ru_offset, EEPRO100State),
1852         VMSTATE_UINT32(statsaddr, EEPRO100State),
1853         /* Save eepro100_stats_t statistics. */
1854         VMSTATE_UINT32(statistics.tx_good_frames, EEPRO100State),
1855         VMSTATE_UINT32(statistics.tx_max_collisions, EEPRO100State),
1856         VMSTATE_UINT32(statistics.tx_late_collisions, EEPRO100State),
1857         VMSTATE_UINT32(statistics.tx_underruns, EEPRO100State),
1858         VMSTATE_UINT32(statistics.tx_lost_crs, EEPRO100State),
1859         VMSTATE_UINT32(statistics.tx_deferred, EEPRO100State),
1860         VMSTATE_UINT32(statistics.tx_single_collisions, EEPRO100State),
1861         VMSTATE_UINT32(statistics.tx_multiple_collisions, EEPRO100State),
1862         VMSTATE_UINT32(statistics.tx_total_collisions, EEPRO100State),
1863         VMSTATE_UINT32(statistics.rx_good_frames, EEPRO100State),
1864         VMSTATE_UINT32(statistics.rx_crc_errors, EEPRO100State),
1865         VMSTATE_UINT32(statistics.rx_alignment_errors, EEPRO100State),
1866         VMSTATE_UINT32(statistics.rx_resource_errors, EEPRO100State),
1867         VMSTATE_UINT32(statistics.rx_overrun_errors, EEPRO100State),
1868         VMSTATE_UINT32(statistics.rx_cdt_errors, EEPRO100State),
1869         VMSTATE_UINT32(statistics.rx_short_frame_errors, EEPRO100State),
1870         VMSTATE_UINT32(statistics.fc_xmt_pause, EEPRO100State),
1871         VMSTATE_UINT32(statistics.fc_rcv_pause, EEPRO100State),
1872         VMSTATE_UINT32(statistics.fc_rcv_unsupported, EEPRO100State),
1873         VMSTATE_UINT16(statistics.xmt_tco_frames, EEPRO100State),
1874         VMSTATE_UINT16(statistics.rcv_tco_frames, EEPRO100State),
1875         /* Configuration bytes. */
1876         VMSTATE_BUFFER(configuration, EEPRO100State),
1877         VMSTATE_END_OF_LIST()
1878     }
1879 };
1880
1881 static void nic_cleanup(VLANClientState *nc)
1882 {
1883     EEPRO100State *s = DO_UPCAST(NICState, nc, nc)->opaque;
1884
1885     s->nic = NULL;
1886 }
1887
1888 static int pci_nic_uninit(PCIDevice *pci_dev)
1889 {
1890     EEPRO100State *s = DO_UPCAST(EEPRO100State, dev, pci_dev);
1891
1892     cpu_unregister_io_memory(s->mmio_index);
1893     vmstate_unregister(s->vmstate, s);
1894     eeprom93xx_free(s->eeprom);
1895     qemu_del_vlan_client(&s->nic->nc);
1896     return 0;
1897 }
1898
1899 static NetClientInfo net_eepro100_info = {
1900     .type = NET_CLIENT_TYPE_NIC,
1901     .size = sizeof(NICState),
1902     .can_receive = nic_can_receive,
1903     .receive = nic_receive,
1904     .cleanup = nic_cleanup,
1905 };
1906
1907 static int nic_init(PCIDevice *pci_dev, uint32_t device)
1908 {
1909     EEPRO100State *s = DO_UPCAST(EEPRO100State, dev, pci_dev);
1910
1911     TRACE(OTHER, logout("\n"));
1912
1913     s->device = device;
1914
1915     pci_reset(s);
1916
1917     /* Add 64 * 2 EEPROM. i82557 and i82558 support a 64 word EEPROM,
1918      * i82559 and later support 64 or 256 word EEPROM. */
1919     s->eeprom = eeprom93xx_new(EEPROM_SIZE);
1920
1921     /* Handler for memory-mapped I/O */
1922     s->mmio_index =
1923         cpu_register_io_memory(pci_mmio_read, pci_mmio_write, s);
1924
1925     pci_register_bar(&s->dev, 0, PCI_MEM_SIZE,
1926                            PCI_BASE_ADDRESS_SPACE_MEMORY |
1927                            PCI_BASE_ADDRESS_MEM_PREFETCH, pci_mmio_map);
1928     pci_register_bar(&s->dev, 1, PCI_IO_SIZE, PCI_BASE_ADDRESS_SPACE_IO,
1929                            pci_map);
1930     pci_register_bar(&s->dev, 2, PCI_FLASH_SIZE, PCI_BASE_ADDRESS_SPACE_MEMORY,
1931                            pci_mmio_map);
1932
1933     qemu_macaddr_default_if_unset(&s->conf.macaddr);
1934     logout("macaddr: %s\n", nic_dump(&s->conf.macaddr.a[0], 6));
1935     assert(s->region[1] == 0);
1936
1937     nic_reset(s);
1938
1939     s->nic = qemu_new_nic(&net_eepro100_info, &s->conf,
1940                           pci_dev->qdev.info->name, pci_dev->qdev.id, s);
1941
1942     qemu_format_nic_info_str(&s->nic->nc, s->conf.macaddr.a);
1943     TRACE(OTHER, logout("%s\n", s->nic->nc.info_str));
1944
1945     qemu_register_reset(nic_reset, s);
1946
1947     s->vmstate = qemu_malloc(sizeof(vmstate_eepro100));
1948     memcpy(s->vmstate, &vmstate_eepro100, sizeof(vmstate_eepro100));
1949     s->vmstate->name = s->nic->nc.model;
1950     vmstate_register(-1, s->vmstate, s);
1951
1952     return 0;
1953 }
1954
1955 static int pci_i82550_init(PCIDevice *pci_dev)
1956 {
1957     return nic_init(pci_dev, i82550);
1958 }
1959
1960 static int pci_i82551_init(PCIDevice *pci_dev)
1961 {
1962     return nic_init(pci_dev, i82551);
1963 }
1964
1965 static int pci_i82557a_init(PCIDevice *pci_dev)
1966 {
1967     return nic_init(pci_dev, i82557A);
1968 }
1969
1970 static int pci_i82557b_init(PCIDevice *pci_dev)
1971 {
1972     return nic_init(pci_dev, i82557B);
1973 }
1974
1975 static int pci_i82557c_init(PCIDevice *pci_dev)
1976 {
1977     return nic_init(pci_dev, i82557C);
1978 }
1979
1980 static int pci_i82558a_init(PCIDevice *pci_dev)
1981 {
1982     return nic_init(pci_dev, i82558A);
1983 }
1984
1985 static int pci_i82558b_init(PCIDevice *pci_dev)
1986 {
1987     return nic_init(pci_dev, i82558B);
1988 }
1989
1990 static int pci_i82559a_init(PCIDevice *pci_dev)
1991 {
1992     return nic_init(pci_dev, i82559A);
1993 }
1994
1995 static int pci_i82559b_init(PCIDevice *pci_dev)
1996 {
1997     return nic_init(pci_dev, i82559B);
1998 }
1999
2000 static int pci_i82559c_init(PCIDevice *pci_dev)
2001 {
2002     return nic_init(pci_dev, i82559C);
2003 }
2004
2005 static int pci_i82559er_init(PCIDevice *pci_dev)
2006 {
2007     return nic_init(pci_dev, i82559ER);
2008 }
2009
2010 static int pci_i82562_init(PCIDevice *pci_dev)
2011 {
2012     return nic_init(pci_dev, i82562);
2013 }
2014
2015 static PCIDeviceInfo eepro100_info[] = {
2016     {
2017         .qdev.name = "i82550",
2018         .qdev.desc = "Intel i82550 Ethernet",
2019         .qdev.size = sizeof(EEPRO100State),
2020         .init      = pci_i82550_init,
2021         .exit      = pci_nic_uninit,
2022         .romfile   = "gpxe-eepro100-80861209.rom",
2023         .qdev.props = (Property[]) {
2024             DEFINE_NIC_PROPERTIES(EEPRO100State, conf),
2025             DEFINE_PROP_END_OF_LIST(),
2026         },
2027     },{
2028         .qdev.name = "i82551",
2029         .qdev.desc = "Intel i82551 Ethernet",
2030         .qdev.size = sizeof(EEPRO100State),
2031         .init      = pci_i82551_init,
2032         .exit      = pci_nic_uninit,
2033         .romfile   = "gpxe-eepro100-80861209.rom",
2034         .qdev.props = (Property[]) {
2035             DEFINE_NIC_PROPERTIES(EEPRO100State, conf),
2036             DEFINE_PROP_END_OF_LIST(),
2037         },
2038     },{
2039         .qdev.name = "i82557a",
2040         .qdev.desc = "Intel i82557A Ethernet",
2041         .qdev.size = sizeof(EEPRO100State),
2042         .init      = pci_i82557a_init,
2043         .exit      = pci_nic_uninit,
2044         .romfile   = "gpxe-eepro100-80861229.rom",
2045         .qdev.props = (Property[]) {
2046             DEFINE_NIC_PROPERTIES(EEPRO100State, conf),
2047             DEFINE_PROP_END_OF_LIST(),
2048         },
2049     },{
2050         .qdev.name = "i82557b",
2051         .qdev.desc = "Intel i82557B Ethernet",
2052         .qdev.size = sizeof(EEPRO100State),
2053         .init      = pci_i82557b_init,
2054         .exit      = pci_nic_uninit,
2055         .romfile   = "gpxe-eepro100-80861229.rom",
2056         .qdev.props = (Property[]) {
2057             DEFINE_NIC_PROPERTIES(EEPRO100State, conf),
2058             DEFINE_PROP_END_OF_LIST(),
2059         },
2060     },{
2061         .qdev.name = "i82557c",
2062         .qdev.desc = "Intel i82557C Ethernet",
2063         .qdev.size = sizeof(EEPRO100State),
2064         .init      = pci_i82557c_init,
2065         .exit      = pci_nic_uninit,
2066         .romfile   = "gpxe-eepro100-80861229.rom",
2067         .qdev.props = (Property[]) {
2068             DEFINE_NIC_PROPERTIES(EEPRO100State, conf),
2069             DEFINE_PROP_END_OF_LIST(),
2070         },
2071     },{
2072         .qdev.name = "i82558a",
2073         .qdev.desc = "Intel i82558A Ethernet",
2074         .qdev.size = sizeof(EEPRO100State),
2075         .init      = pci_i82558a_init,
2076         .exit      = pci_nic_uninit,
2077         .romfile   = "gpxe-eepro100-80861229.rom",
2078         .qdev.props = (Property[]) {
2079             DEFINE_NIC_PROPERTIES(EEPRO100State, conf),
2080             DEFINE_PROP_END_OF_LIST(),
2081         },
2082     },{
2083         .qdev.name = "i82558b",
2084         .qdev.desc = "Intel i82558B Ethernet",
2085         .qdev.size = sizeof(EEPRO100State),
2086         .init      = pci_i82558b_init,
2087         .exit      = pci_nic_uninit,
2088         .romfile   = "gpxe-eepro100-80861229.rom",
2089         .qdev.props = (Property[]) {
2090             DEFINE_NIC_PROPERTIES(EEPRO100State, conf),
2091             DEFINE_PROP_END_OF_LIST(),
2092         },
2093     },{
2094         .qdev.name = "i82559a",
2095         .qdev.desc = "Intel i82559A Ethernet",
2096         .qdev.size = sizeof(EEPRO100State),
2097         .init      = pci_i82559a_init,
2098         .exit      = pci_nic_uninit,
2099         .romfile   = "gpxe-eepro100-80861229.rom",
2100         .qdev.props = (Property[]) {
2101             DEFINE_NIC_PROPERTIES(EEPRO100State, conf),
2102             DEFINE_PROP_END_OF_LIST(),
2103         },
2104     },{
2105         .qdev.name = "i82559b",
2106         .qdev.desc = "Intel i82559B Ethernet",
2107         .qdev.size = sizeof(EEPRO100State),
2108         .init      = pci_i82559b_init,
2109         .exit      = pci_nic_uninit,
2110         .romfile   = "gpxe-eepro100-80861229.rom",
2111         .qdev.props = (Property[]) {
2112             DEFINE_NIC_PROPERTIES(EEPRO100State, conf),
2113             DEFINE_PROP_END_OF_LIST(),
2114         },
2115     },{
2116         .qdev.name = "i82559c",
2117         .qdev.desc = "Intel i82559C Ethernet",
2118         .qdev.size = sizeof(EEPRO100State),
2119         .init      = pci_i82559c_init,
2120         .exit      = pci_nic_uninit,
2121         .romfile   = "gpxe-eepro100-80861229.rom",
2122         .qdev.props = (Property[]) {
2123             DEFINE_NIC_PROPERTIES(EEPRO100State, conf),
2124             DEFINE_PROP_END_OF_LIST(),
2125         },
2126     },{
2127         .qdev.name = "i82559er",
2128         .qdev.desc = "Intel i82559ER Ethernet",
2129         .qdev.size = sizeof(EEPRO100State),
2130         .init      = pci_i82559er_init,
2131         .exit      = pci_nic_uninit,
2132         .romfile   = "gpxe-eepro100-80861209.rom",
2133         .qdev.props = (Property[]) {
2134             DEFINE_NIC_PROPERTIES(EEPRO100State, conf),
2135             DEFINE_PROP_END_OF_LIST(),
2136         },
2137     },{
2138         .qdev.name = "i82562",
2139         .qdev.desc = "Intel i82562 Ethernet",
2140         .qdev.size = sizeof(EEPRO100State),
2141         .init      = pci_i82562_init,
2142         .exit      = pci_nic_uninit,
2143         .romfile   = "gpxe-eepro100-80861209.rom",
2144         .qdev.props = (Property[]) {
2145             DEFINE_NIC_PROPERTIES(EEPRO100State, conf),
2146             DEFINE_PROP_END_OF_LIST(),
2147         },
2148     },{
2149         /* end of list */
2150     }
2151 };
2152
2153 static void eepro100_register_devices(void)
2154 {
2155     pci_qdev_register_many(eepro100_info);
2156 }
2157
2158 device_init(eepro100_register_devices)