hw/net/can/can_sja1000.c

   1 /*
   2  * CAN device - SJA1000 chip emulation for QEMU
   3  *
   4  * Copyright (c) 2013-2014 Jin Yang
   5  * Copyright (c) 2014-2018 Pavel Pisa
   6  *
   7  * Initial development supported by Google GSoC 2013 from RTEMS project slot
   8  *
   9  * Permission is hereby granted, free of charge, to any person obtaining a copy
  10  * of this software and associated documentation files (the "Software"), to deal
  11  * in the Software without restriction, including without limitation the rights
  12  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
  13  * copies of the Software, and to permit persons to whom the Software is
  14  * furnished to do so, subject to the following conditions:
  15  *
  16  * The above copyright notice and this permission notice shall be included in
  17  * all copies or substantial portions of the Software.
  18  *
  19  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
  20  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
  21  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
  22  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
  23  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
  24  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
  25  * THE SOFTWARE.
  26  */
  27
  28 #include "qemu/osdep.h"
  29 #include "qemu/log.h"
  30 #include "chardev/char.h"
  31 #include "hw/hw.h"
  32 #include "hw/irq.h"
  33 #include "migration/vmstate.h"
  34 #include "net/can_emu.h"
  35
  36 #include "can_sja1000.h"
  37
  38 #ifndef DEBUG_FILTER
  39 #define DEBUG_FILTER 0
  40 #endif /*DEBUG_FILTER*/
  41
  42 #ifndef DEBUG_CAN
  43 #define DEBUG_CAN 0
  44 #endif /*DEBUG_CAN*/
  45
  46 #define DPRINTF(fmt, ...) \
  47     do { \
  48         if (DEBUG_CAN) { \
  49             qemu_log("[cansja]: " fmt , ## __VA_ARGS__); \
  50         } \
  51     } while (0)
  52
  53 static void can_sja_software_reset(CanSJA1000State *s)
  54 {
  55     s->mode        &= ~0x31;
  56     s->mode        |= 0x01;
  57     s->status_pel  &= ~0x37;
  58     s->status_pel  |= 0x34;
  59
  60     s->rxbuf_start = 0x00;
  61     s->rxmsg_cnt   = 0x00;
  62     s->rx_cnt      = 0x00;
  63 }
  64
  65 void can_sja_hardware_reset(CanSJA1000State *s)
  66 {
  67     /* Reset by hardware, p10 */
  68     s->mode        = 0x01;
  69     s->status_pel  = 0x3c;
  70     s->interrupt_pel = 0x00;
  71     s->clock       = 0x00;
  72     s->rxbuf_start = 0x00;
  73     s->rxmsg_cnt   = 0x00;
  74     s->rx_cnt      = 0x00;
  75
  76     s->control     = 0x01;
  77     s->status_bas  = 0x0c;
  78     s->interrupt_bas = 0x00;
  79
  80     qemu_irq_lower(s->irq);
  81 }
  82
  83 static
  84 void can_sja_single_filter(struct qemu_can_filter *filter,
  85             const uint8_t *acr,  const uint8_t *amr, int extended)
  86 {
  87     if (extended) {
  88         filter->can_id = (uint32_t)acr[0] << 21;
  89         filter->can_id |= (uint32_t)acr[1] << 13;
  90         filter->can_id |= (uint32_t)acr[2] << 5;
  91         filter->can_id |= (uint32_t)acr[3] >> 3;
  92         if (acr[3] & 4) {
  93             filter->can_id |= QEMU_CAN_RTR_FLAG;
  94         }
  95
  96         filter->can_mask = (uint32_t)amr[0] << 21;
  97         filter->can_mask |= (uint32_t)amr[1] << 13;
  98         filter->can_mask |= (uint32_t)amr[2] << 5;
  99         filter->can_mask |= (uint32_t)amr[3] >> 3;
 100         filter->can_mask = ~filter->can_mask & QEMU_CAN_EFF_MASK;
 101         if (!(amr[3] & 4)) {
 102             filter->can_mask |= QEMU_CAN_RTR_FLAG;
 103         }
 104     } else {
 105         filter->can_id = (uint32_t)acr[0] << 3;
 106         filter->can_id |= (uint32_t)acr[1] >> 5;
 107         if (acr[1] & 0x10) {
 108             filter->can_id |= QEMU_CAN_RTR_FLAG;
 109         }
 110
 111         filter->can_mask = (uint32_t)amr[0] << 3;
 112         filter->can_mask |= (uint32_t)amr[1] << 5;
 113         filter->can_mask = ~filter->can_mask & QEMU_CAN_SFF_MASK;
 114         if (!(amr[1] & 0x10)) {
 115             filter->can_mask |= QEMU_CAN_RTR_FLAG;
 116         }
 117     }
 118 }
 119
 120 static
 121 void can_sja_dual_filter(struct qemu_can_filter *filter,
 122             const uint8_t *acr,  const uint8_t *amr, int extended)
 123 {
 124     if (extended) {
 125         filter->can_id = (uint32_t)acr[0] << 21;
 126         filter->can_id |= (uint32_t)acr[1] << 13;
 127
 128         filter->can_mask = (uint32_t)amr[0] << 21;
 129         filter->can_mask |= (uint32_t)amr[1] << 13;
 130         filter->can_mask = ~filter->can_mask & QEMU_CAN_EFF_MASK & ~0x1fff;
 131     } else {
 132         filter->can_id = (uint32_t)acr[0] << 3;
 133         filter->can_id |= (uint32_t)acr[1] >> 5;
 134         if (acr[1] & 0x10) {
 135             filter->can_id |= QEMU_CAN_RTR_FLAG;
 136         }
 137
 138         filter->can_mask = (uint32_t)amr[0] << 3;
 139         filter->can_mask |= (uint32_t)amr[1] >> 5;
 140         filter->can_mask = ~filter->can_mask & QEMU_CAN_SFF_MASK;
 141         if (!(amr[1] & 0x10)) {
 142             filter->can_mask |= QEMU_CAN_RTR_FLAG;
 143         }
 144     }
 145 }
 146
 147 /* Details in DS-p22, what we need to do here is to test the data. */
 148 static
 149 int can_sja_accept_filter(CanSJA1000State *s,
 150                                  const qemu_can_frame *frame)
 151 {
 152
 153     struct qemu_can_filter filter;
 154
 155     if (s->clock & 0x80) { /* PeliCAN Mode */
 156         if (s->mode & (1 << 3)) { /* Single mode. */
 157             if (frame->can_id & QEMU_CAN_EFF_FLAG) { /* EFF */
 158                 can_sja_single_filter(&filter,
 159                     s->code_mask + 0, s->code_mask + 4, 1);
 160
 161                 if (!can_bus_filter_match(&filter, frame->can_id)) {
 162                     return 0;
 163                 }
 164             } else { /* SFF */
 165                 can_sja_single_filter(&filter,
 166                     s->code_mask + 0, s->code_mask + 4, 0);
 167
 168                 if (!can_bus_filter_match(&filter, frame->can_id)) {
 169                     return 0;
 170                 }
 171
 172                 if (frame->can_id & QEMU_CAN_RTR_FLAG) { /* RTR */
 173                     return 1;
 174                 }
 175
 176                 if (frame->can_dlc == 0) {
 177                     return 1;
 178                 }
 179
 180                 if ((frame->data[0] & ~(s->code_mask[6])) !=
 181                    (s->code_mask[2] & ~(s->code_mask[6]))) {
 182                     return 0;
 183                 }
 184
 185                 if (frame->can_dlc < 2) {
 186                     return 1;
 187                 }
 188
 189                 if ((frame->data[1] & ~(s->code_mask[7])) ==
 190                     (s->code_mask[3] & ~(s->code_mask[7]))) {
 191                     return 1;
 192                 }
 193
 194                 return 0;
 195             }
 196         } else { /* Dual mode */
 197             if (frame->can_id & QEMU_CAN_EFF_FLAG) { /* EFF */
 198                 can_sja_dual_filter(&filter,
 199                     s->code_mask + 0, s->code_mask + 4, 1);
 200
 201                 if (can_bus_filter_match(&filter, frame->can_id)) {
 202                     return 1;
 203                 }
 204
 205                 can_sja_dual_filter(&filter,
 206                     s->code_mask + 2, s->code_mask + 6, 1);
 207
 208                 if (can_bus_filter_match(&filter, frame->can_id)) {
 209                     return 1;
 210                 }
 211
 212                 return 0;
 213             } else {
 214                 can_sja_dual_filter(&filter,
 215                     s->code_mask + 0, s->code_mask + 4, 0);
 216
 217                 if (can_bus_filter_match(&filter, frame->can_id)) {
 218                     uint8_t expect;
 219                     uint8_t mask;
 220                     expect = s->code_mask[1] << 4;
 221                     expect |= s->code_mask[3] & 0x0f;
 222
 223                     mask = s->code_mask[5] << 4;
 224                     mask |= s->code_mask[7] & 0x0f;
 225                         mask = ~mask & 0xff;
 226
 227                     if ((frame->data[0] & mask) ==
 228                         (expect & mask)) {
 229                         return 1;
 230                     }
 231                 }
 232
 233                 can_sja_dual_filter(&filter,
 234                     s->code_mask + 2, s->code_mask + 6, 0);
 235
 236                 if (can_bus_filter_match(&filter, frame->can_id)) {
 237                     return 1;
 238                 }
 239
 240                 return 0;
 241             }
 242         }
 243     }
 244
 245     return 1;
 246 }
 247
 248 static void can_display_msg(const char *prefix, const qemu_can_frame *msg)
 249 {
 250     int i;
 251
 252     qemu_log_lock();
 253     qemu_log("%s%03X [%01d] %s %s",
 254              prefix,
 255              msg->can_id & QEMU_CAN_EFF_MASK,
 256              msg->can_dlc,
 257              msg->can_id & QEMU_CAN_EFF_FLAG ? "EFF" : "SFF",
 258              msg->can_id & QEMU_CAN_RTR_FLAG ? "RTR" : "DAT");
 259
 260     for (i = 0; i < msg->can_dlc; i++) {
 261         qemu_log(" %02X", msg->data[i]);
 262     }
 263     qemu_log("\n");
 264     qemu_log_flush();
 265     qemu_log_unlock();
 266 }
 267
 268 static void buff2frame_pel(const uint8_t *buff, qemu_can_frame *frame)
 269 {
 270     uint8_t i;
 271
 272     frame->can_id = 0;
 273     if (buff[0] & 0x40) { /* RTR */
 274         frame->can_id = QEMU_CAN_RTR_FLAG;
 275     }
 276     frame->can_dlc = buff[0] & 0x0f;
 277
 278     if (buff[0] & 0x80) { /* Extended */
 279         frame->can_id |= QEMU_CAN_EFF_FLAG;
 280         frame->can_id |= buff[1] << 21; /* ID.28~ID.21 */
 281         frame->can_id |= buff[2] << 13; /* ID.20~ID.13 */
 282         frame->can_id |= buff[3] <<  5;
 283         frame->can_id |= buff[4] >>  3;
 284         for (i = 0; i < frame->can_dlc; i++) {
 285             frame->data[i] = buff[5 + i];
 286         }
 287         for (; i < 8; i++) {
 288             frame->data[i] = 0;
 289         }
 290     } else {
 291         frame->can_id |= buff[1] <<  3;
 292         frame->can_id |= buff[2] >>  5;
 293         for (i = 0; i < frame->can_dlc; i++) {
 294             frame->data[i] = buff[3 + i];
 295         }
 296         for (; i < 8; i++) {
 297             frame->data[i] = 0;
 298         }
 299     }
 300 }
 301
 302
 303 static void buff2frame_bas(const uint8_t *buff, qemu_can_frame *frame)
 304 {
 305     uint8_t i;
 306
 307     frame->can_id = ((buff[0] << 3) & (0xff << 3)) + ((buff[1] >> 5) & 0x07);
 308     if (buff[1] & 0x10) { /* RTR */
 309         frame->can_id = QEMU_CAN_RTR_FLAG;
 310     }
 311     frame->can_dlc = buff[1] & 0x0f;
 312
 313     for (i = 0; i < frame->can_dlc; i++) {
 314         frame->data[i] = buff[2 + i];
 315     }
 316     for (; i < 8; i++) {
 317         frame->data[i] = 0;
 318     }
 319 }
 320
 321
 322 static int frame2buff_pel(const qemu_can_frame *frame, uint8_t *buff)
 323 {
 324     int i;
 325
 326     if (frame->can_id & QEMU_CAN_ERR_FLAG) { /* error frame, NOT support now. */
 327         return -1;
 328     }
 329
 330     buff[0] = 0x0f & frame->can_dlc; /* DLC */
 331     if (frame->can_id & QEMU_CAN_RTR_FLAG) { /* RTR */
 332         buff[0] |= (1 << 6);
 333     }
 334     if (frame->can_id & QEMU_CAN_EFF_FLAG) { /* EFF */
 335         buff[0] |= (1 << 7);
 336         buff[1] = extract32(frame->can_id, 21, 8); /* ID.28~ID.21 */
 337         buff[2] = extract32(frame->can_id, 13, 8); /* ID.20~ID.13 */
 338         buff[3] = extract32(frame->can_id, 5, 8);  /* ID.12~ID.05 */
 339         buff[4] = extract32(frame->can_id, 0, 5) << 3; /* ID.04~ID.00,xxx */
 340         for (i = 0; i < frame->can_dlc; i++) {
 341             buff[5 + i] = frame->data[i];
 342         }
 343         return frame->can_dlc + 5;
 344     } else { /* SFF */
 345         buff[1] = extract32(frame->can_id, 3, 8); /* ID.10~ID.03 */
 346         buff[2] = extract32(frame->can_id, 0, 3) << 5; /* ID.02~ID.00,xxxxx */
 347         for (i = 0; i < frame->can_dlc; i++) {
 348             buff[3 + i] = frame->data[i];
 349         }
 350
 351         return frame->can_dlc + 3;
 352     }
 353
 354     return -1;
 355 }
 356
 357 static int frame2buff_bas(const qemu_can_frame *frame, uint8_t *buff)
 358 {
 359     int i;
 360
 361      /*
 362       * EFF, no support for BasicMode
 363       * No use for Error frames now,
 364       * they could be used in future to update SJA1000 error state
 365       */
 366     if ((frame->can_id & QEMU_CAN_EFF_FLAG) ||
 367        (frame->can_id & QEMU_CAN_ERR_FLAG)) {
 368         return -1;
 369     }
 370
 371     buff[0] = extract32(frame->can_id, 3, 8); /* ID.10~ID.03 */
 372     buff[1] = extract32(frame->can_id, 0, 3) << 5; /* ID.02~ID.00,xxxxx */
 373     if (frame->can_id & QEMU_CAN_RTR_FLAG) { /* RTR */
 374         buff[1] |= (1 << 4);
 375     }
 376     buff[1] |= frame->can_dlc & 0x0f;
 377     for (i = 0; i < frame->can_dlc; i++) {
 378         buff[2 + i] = frame->data[i];
 379     }
 380
 381     return frame->can_dlc + 2;
 382 }
 383
 384 static void can_sja_update_pel_irq(CanSJA1000State *s)
 385 {
 386     if (s->interrupt_en & s->interrupt_pel) {
 387         qemu_irq_raise(s->irq);
 388     } else {
 389         qemu_irq_lower(s->irq);
 390     }
 391 }
 392
 393 static void can_sja_update_bas_irq(CanSJA1000State *s)
 394 {
 395     if ((s->control >> 1) & s->interrupt_bas) {
 396         qemu_irq_raise(s->irq);
 397     } else {
 398         qemu_irq_lower(s->irq);
 399     }
 400 }
 401
 402 void can_sja_mem_write(CanSJA1000State *s, hwaddr addr, uint64_t val,
 403                        unsigned size)
 404 {
 405     qemu_can_frame   frame;
 406     uint32_t         tmp;
 407     uint8_t          tmp8, count;
 408
 409
 410     DPRINTF("write 0x%02llx addr 0x%02x\n",
 411             (unsigned long long)val, (unsigned int)addr);
 412
 413     if (addr > CAN_SJA_MEM_SIZE) {
 414         return ;
 415     }
 416
 417     if (s->clock & 0x80) { /* PeliCAN Mode */
 418         switch (addr) {
 419         case SJA_MOD: /* Mode register */
 420             s->mode = 0x1f & val;
 421             if ((s->mode & 0x01) && ((val & 0x01) == 0)) {
 422                 /* Go to operation mode from reset mode. */
 423                 if (s->mode & (1 << 3)) { /* Single mode. */
 424                     /* For EFF */
 425                     can_sja_single_filter(&s->filter[0],
 426                         s->code_mask + 0, s->code_mask + 4, 1);
 427
 428                     /* For SFF */
 429                     can_sja_single_filter(&s->filter[1],
 430                         s->code_mask + 0, s->code_mask + 4, 0);
 431
 432                     can_bus_client_set_filters(&s->bus_client, s->filter, 2);
 433                 } else { /* Dual mode */
 434                     /* For EFF */
 435                     can_sja_dual_filter(&s->filter[0],
 436                         s->code_mask + 0, s->code_mask + 4, 1);
 437
 438                     can_sja_dual_filter(&s->filter[1],
 439                         s->code_mask + 2, s->code_mask + 6, 1);
 440
 441                     /* For SFF */
 442                     can_sja_dual_filter(&s->filter[2],
 443                         s->code_mask + 0, s->code_mask + 4, 0);
 444
 445                     can_sja_dual_filter(&s->filter[3],
 446                         s->code_mask + 2, s->code_mask + 6, 0);
 447
 448                     can_bus_client_set_filters(&s->bus_client, s->filter, 4);
 449                 }
 450
 451                 s->rxmsg_cnt = 0;
 452                 s->rx_cnt = 0;
 453             }
 454             break;
 455
 456         case SJA_CMR: /* Command register. */
 457             if (0x01 & val) { /* Send transmission request. */
 458                 buff2frame_pel(s->tx_buff, &frame);
 459                 if (DEBUG_FILTER) {
 460                     can_display_msg("[cansja]: Tx request " , &frame);
 461                 }
 462
 463                 /*
 464                  * Clear transmission complete status,
 465                  * and Transmit Buffer Status.
 466                  * write to the backends.
 467                  */
 468                 s->status_pel &= ~(3 << 2);
 469
 470                 can_bus_client_send(&s->bus_client, &frame, 1);
 471
 472                 /*
 473                  * Set transmission complete status
 474                  * and Transmit Buffer Status.
 475                  */
 476                 s->status_pel |= (3 << 2);
 477
 478                 /* Clear transmit status. */
 479                 s->status_pel &= ~(1 << 5);
 480                 s->interrupt_pel |= 0x02;
 481                 can_sja_update_pel_irq(s);
 482             }
 483             if (0x04 & val) { /* Release Receive Buffer */
 484                 if (s->rxmsg_cnt <= 0) {
 485                     break;
 486                 }
 487
 488                 tmp8 = s->rx_buff[s->rxbuf_start]; count = 0;
 489                 if (tmp8 & (1 << 7)) { /* EFF */
 490                     count += 2;
 491                 }
 492                 count += 3;
 493                 if (!(tmp8 & (1 << 6))) { /* DATA */
 494                     count += (tmp8 & 0x0f);
 495                 }
 496
 497                 if (DEBUG_FILTER) {
 498                     qemu_log("[cansja]: message released from "
 499                              "Rx FIFO cnt=%d, count=%d\n", s->rx_cnt, count);
 500                 }
 501
 502                 s->rxbuf_start += count;
 503                 s->rxbuf_start %= SJA_RCV_BUF_LEN;
 504
 505                 s->rx_cnt -= count;
 506                 s->rxmsg_cnt--;
 507                 if (s->rxmsg_cnt == 0) {
 508                     s->status_pel &= ~(1 << 0);
 509                     s->interrupt_pel &= ~(1 << 0);
 510                     can_sja_update_pel_irq(s);
 511                 }
 512             }
 513             if (0x08 & val) { /* Clear data overrun */
 514                 s->status_pel &= ~(1 << 1);
 515                 s->interrupt_pel &= ~(1 << 3);
 516                 can_sja_update_pel_irq(s);
 517             }
 518             break;
 519         case SJA_SR: /* Status register */
 520         case SJA_IR: /* Interrupt register */
 521             break; /* Do nothing */
 522         case SJA_IER: /* Interrupt enable register */
 523             s->interrupt_en = val;
 524             break;
 525         case 16: /* RX frame information addr16-28. */
 526             s->status_pel |= (1 << 5); /* Set transmit status. */
 527         case 17 ... 28:
 528             if (s->mode & 0x01) { /* Reset mode */
 529                 if (addr < 24) {
 530                     s->code_mask[addr - 16] = val;
 531                 }
 532             } else { /* Operation mode */
 533                 s->tx_buff[addr - 16] = val; /* Store to TX buffer directly. */
 534             }
 535             break;
 536         case SJA_CDR:
 537             s->clock = val;
 538             break;
 539         }
 540     } else { /* Basic Mode */
 541         switch (addr) {
 542         case SJA_BCAN_CTR: /* Control register, addr 0 */
 543             if ((s->control & 0x01) && ((val & 0x01) == 0)) {
 544                 /* Go to operation mode from reset mode. */
 545                 s->filter[0].can_id = (s->code << 3) & (0xff << 3);
 546                 tmp = (~(s->mask << 3)) & (0xff << 3);
 547                 tmp |= QEMU_CAN_EFF_FLAG; /* Only Basic CAN Frame. */
 548                 s->filter[0].can_mask = tmp;
 549                 can_bus_client_set_filters(&s->bus_client, s->filter, 1);
 550
 551                 s->rxmsg_cnt = 0;
 552                 s->rx_cnt = 0;
 553             } else if (!(s->control & 0x01) && !(val & 0x01)) {
 554                 can_sja_software_reset(s);
 555             }
 556
 557             s->control = 0x1f & val;
 558             break;
 559         case SJA_BCAN_CMR: /* Command register, addr 1 */
 560             if (0x01 & val) { /* Send transmission request. */
 561                 buff2frame_bas(s->tx_buff, &frame);
 562                 if (DEBUG_FILTER) {
 563                     can_display_msg("[cansja]: Tx request " , &frame);
 564                 }
 565
 566                 /*
 567                  * Clear transmission complete status,
 568                  * and Transmit Buffer Status.
 569                  */
 570                 s->status_bas &= ~(3 << 2);
 571
 572                 /* write to the backends. */
 573                 can_bus_client_send(&s->bus_client, &frame, 1);
 574
 575                 /*
 576                  * Set transmission complete status,
 577                  * and Transmit Buffer Status.
 578                  */
 579                 s->status_bas |= (3 << 2);
 580
 581                 /* Clear transmit status. */
 582                 s->status_bas &= ~(1 << 5);
 583                 s->interrupt_bas |= 0x02;
 584                 can_sja_update_bas_irq(s);
 585             }
 586             if (0x04 & val) { /* Release Receive Buffer */
 587                 if (s->rxmsg_cnt <= 0) {
 588                     break;
 589                 }
 590
 591                 tmp8 = s->rx_buff[(s->rxbuf_start + 1) % SJA_RCV_BUF_LEN];
 592                 count = 2 + (tmp8 & 0x0f);
 593
 594                 if (DEBUG_FILTER) {
 595                     qemu_log("[cansja]: message released from "
 596                              "Rx FIFO cnt=%d, count=%d\n", s->rx_cnt, count);
 597                 }
 598
 599                 s->rxbuf_start += count;
 600                 s->rxbuf_start %= SJA_RCV_BUF_LEN;
 601                 s->rx_cnt -= count;
 602                 s->rxmsg_cnt--;
 603
 604                 if (s->rxmsg_cnt == 0) {
 605                     s->status_bas &= ~(1 << 0);
 606                     s->interrupt_bas &= ~(1 << 0);
 607                     can_sja_update_bas_irq(s);
 608                 }
 609             }
 610             if (0x08 & val) { /* Clear data overrun */
 611                 s->status_bas &= ~(1 << 1);
 612                 s->interrupt_bas &= ~(1 << 3);
 613                 can_sja_update_bas_irq(s);
 614             }
 615             break;
 616         case 4:
 617             s->code = val;
 618             break;
 619         case 5:
 620             s->mask = val;
 621             break;
 622         case 10:
 623             s->status_bas |= (1 << 5); /* Set transmit status. */
 624         case 11 ... 19:
 625             if ((s->control & 0x01) == 0) { /* Operation mode */
 626                 s->tx_buff[addr - 10] = val; /* Store to TX buffer directly. */
 627             }
 628             break;
 629         case SJA_CDR:
 630             s->clock = val;
 631             break;
 632         }
 633     }
 634 }
 635
 636 uint64_t can_sja_mem_read(CanSJA1000State *s, hwaddr addr, unsigned size)
 637 {
 638     uint64_t temp = 0;
 639
 640     DPRINTF("read addr 0x%02x ...\n", (unsigned int)addr);
 641
 642     if (addr > CAN_SJA_MEM_SIZE) {
 643         return 0;
 644     }
 645
 646     if (s->clock & 0x80) { /* PeliCAN Mode */
 647         switch (addr) {
 648         case SJA_MOD: /* Mode register, addr 0 */
 649             temp = s->mode;
 650             break;
 651         case SJA_CMR: /* Command register, addr 1 */
 652             temp = 0x00; /* Command register, cannot be read. */
 653             break;
 654         case SJA_SR: /* Status register, addr 2 */
 655             temp = s->status_pel;
 656             break;
 657         case SJA_IR: /* Interrupt register, addr 3 */
 658             temp = s->interrupt_pel;
 659             s->interrupt_pel = 0;
 660             if (s->rxmsg_cnt) {
 661                 s->interrupt_pel |= (1 << 0); /* Receive interrupt. */
 662             }
 663             can_sja_update_pel_irq(s);
 664             break;
 665         case SJA_IER: /* Interrupt enable register, addr 4 */
 666             temp = s->interrupt_en;
 667             break;
 668         case 5: /* Reserved */
 669         case 6: /* Bus timing 0, hardware related, not support now. */
 670         case 7: /* Bus timing 1, hardware related, not support now. */
 671         case 8: /*
 672                  * Output control register, hardware related,
 673                  * not supported for now.
 674                  */
 675         case 9: /* Test. */
 676         case 10 ... 15: /* Reserved */
 677             temp = 0x00;
 678             break;
 679
 680         case 16 ... 28:
 681             if (s->mode & 0x01) { /* Reset mode */
 682                 if (addr < 24) {
 683                     temp = s->code_mask[addr - 16];
 684                 } else {
 685                     temp = 0x00;
 686                 }
 687             } else { /* Operation mode */
 688                 temp = s->rx_buff[(s->rxbuf_start + addr - 16) %
 689                        SJA_RCV_BUF_LEN];
 690             }
 691             break;
 692         case SJA_CDR:
 693             temp = s->clock;
 694             break;
 695         default:
 696             temp = 0xff;
 697         }
 698     } else { /* Basic Mode */
 699         switch (addr) {
 700         case SJA_BCAN_CTR: /* Control register, addr 0 */
 701             temp = s->control;
 702             break;
 703         case SJA_BCAN_SR: /* Status register, addr 2 */
 704             temp = s->status_bas;
 705             break;
 706         case SJA_BCAN_IR: /* Interrupt register, addr 3 */
 707             temp = s->interrupt_bas;
 708             s->interrupt_bas = 0;
 709             if (s->rxmsg_cnt) {
 710                 s->interrupt_bas |= (1 << 0); /* Receive interrupt. */
 711             }
 712             can_sja_update_bas_irq(s);
 713             break;
 714         case 4:
 715             temp = s->code;
 716             break;
 717         case 5:
 718             temp = s->mask;
 719             break;
 720         case 20 ... 29:
 721             temp = s->rx_buff[(s->rxbuf_start + addr - 20) % SJA_RCV_BUF_LEN];
 722             break;
 723         case 31:
 724             temp = s->clock;
 725             break;
 726         default:
 727             temp = 0xff;
 728             break;
 729         }
 730     }
 731     DPRINTF("read addr 0x%02x, %d bytes, content 0x%02lx\n",
 732             (int)addr, size, (long unsigned int)temp);
 733
 734     return temp;
 735 }
 736
 737 int can_sja_can_receive(CanBusClientState *client)
 738 {
 739     CanSJA1000State *s = container_of(client, CanSJA1000State, bus_client);
 740
 741     if (s->clock & 0x80) { /* PeliCAN Mode */
 742         if (s->mode & 0x01) { /* reset mode. */
 743             return 0;
 744         }
 745     } else { /* BasicCAN mode */
 746         if (s->control & 0x01) {
 747             return 0;
 748         }
 749     }
 750
 751     return 1; /* always return 1, when operation mode */
 752 }
 753
 754 ssize_t can_sja_receive(CanBusClientState *client, const qemu_can_frame *frames,
 755                         size_t frames_cnt)
 756 {
 757     CanSJA1000State *s = container_of(client, CanSJA1000State, bus_client);
 758     static uint8_t rcv[SJA_MSG_MAX_LEN];
 759     int i;
 760     int ret = -1;
 761     const qemu_can_frame *frame = frames;
 762
 763     if (frames_cnt <= 0) {
 764         return 0;
 765     }
 766     if (DEBUG_FILTER) {
 767         can_display_msg("[cansja]: receive ", frame);
 768     }
 769
 770     if (s->clock & 0x80) { /* PeliCAN Mode */
 771
 772         /* the CAN controller is receiving a message */
 773         s->status_pel |= (1 << 4);
 774
 775         if (can_sja_accept_filter(s, frame) == 0) {
 776             s->status_pel &= ~(1 << 4);
 777             if (DEBUG_FILTER) {
 778                 qemu_log("[cansja]: filter rejects message\n");
 779             }
 780             return ret;
 781         }
 782
 783         ret = frame2buff_pel(frame, rcv);
 784         if (ret < 0) {
 785             s->status_pel &= ~(1 << 4);
 786             if (DEBUG_FILTER) {
 787                 qemu_log("[cansja]: message store failed\n");
 788             }
 789             return ret; /* maybe not support now. */
 790         }
 791
 792         if (s->rx_cnt + ret > SJA_RCV_BUF_LEN) { /* Data overrun. */
 793             s->status_pel |= (1 << 1); /* Overrun status */
 794             s->interrupt_pel |= (1 << 3);
 795             s->status_pel &= ~(1 << 4);
 796             if (DEBUG_FILTER) {
 797                 qemu_log("[cansja]: receive FIFO overrun\n");
 798             }
 799             can_sja_update_pel_irq(s);
 800             return ret;
 801         }
 802         s->rx_cnt += ret;
 803         s->rxmsg_cnt++;
 804         if (DEBUG_FILTER) {
 805             qemu_log("[cansja]: message stored in receive FIFO\n");
 806         }
 807
 808         for (i = 0; i < ret; i++) {
 809             s->rx_buff[(s->rx_ptr++) % SJA_RCV_BUF_LEN] = rcv[i];
 810         }
 811         s->rx_ptr %= SJA_RCV_BUF_LEN; /* update the pointer. */
 812
 813         s->status_pel |= 0x01; /* Set the Receive Buffer Status. DS-p23 */
 814         s->interrupt_pel |= 0x01;
 815         s->status_pel &= ~(1 << 4);
 816         s->status_pel |= (1 << 0);
 817         can_sja_update_pel_irq(s);
 818     } else { /* BasicCAN mode */
 819
 820         /* the CAN controller is receiving a message */
 821         s->status_bas |= (1 << 4);
 822
 823         ret = frame2buff_bas(frame, rcv);
 824         if (ret < 0) {
 825             s->status_bas &= ~(1 << 4);
 826             if (DEBUG_FILTER) {
 827                 qemu_log("[cansja]: message store failed\n");
 828             }
 829             return ret; /* maybe not support now. */
 830         }
 831
 832         if (s->rx_cnt + ret > SJA_RCV_BUF_LEN) { /* Data overrun. */
 833             s->status_bas |= (1 << 1); /* Overrun status */
 834             s->status_bas &= ~(1 << 4);
 835             s->interrupt_bas |= (1 << 3);
 836             can_sja_update_bas_irq(s);
 837             if (DEBUG_FILTER) {
 838                 qemu_log("[cansja]: receive FIFO overrun\n");
 839             }
 840             return ret;
 841         }
 842         s->rx_cnt += ret;
 843         s->rxmsg_cnt++;
 844
 845         if (DEBUG_FILTER) {
 846             qemu_log("[cansja]: message stored\n");
 847         }
 848
 849         for (i = 0; i < ret; i++) {
 850             s->rx_buff[(s->rx_ptr++) % SJA_RCV_BUF_LEN] = rcv[i];
 851         }
 852         s->rx_ptr %= SJA_RCV_BUF_LEN; /* update the pointer. */
 853
 854         s->status_bas |= 0x01; /* Set the Receive Buffer Status. DS-p15 */
 855         s->status_bas &= ~(1 << 4);
 856         s->interrupt_bas |= (1 << 0);
 857         can_sja_update_bas_irq(s);
 858     }
 859     return 1;
 860 }
 861
 862 static CanBusClientInfo can_sja_bus_client_info = {
 863     .can_receive = can_sja_can_receive,
 864     .receive = can_sja_receive,
 865 };
 866
 867
 868 int can_sja_connect_to_bus(CanSJA1000State *s, CanBusState *bus)
 869 {
 870     s->bus_client.info = &can_sja_bus_client_info;
 871
 872     if (!bus) {
 873         return -EINVAL;
 874     }
 875
 876     if (can_bus_insert_client(bus, &s->bus_client) < 0) {
 877         return -1;
 878     }
 879
 880     return 0;
 881 }
 882
 883 void can_sja_disconnect(CanSJA1000State *s)
 884 {
 885     can_bus_remove_client(&s->bus_client);
 886 }
 887
 888 int can_sja_init(CanSJA1000State *s, qemu_irq irq)
 889 {
 890     s->irq = irq;
 891
 892     qemu_irq_lower(s->irq);
 893
 894     can_sja_hardware_reset(s);
 895
 896     return 0;
 897 }
 898
 899 const VMStateDescription vmstate_qemu_can_filter = {
 900     .name = "qemu_can_filter",
 901     .version_id = 1,
 902     .minimum_version_id = 1,
 903     .minimum_version_id_old = 1,
 904     .fields = (VMStateField[]) {
 905         VMSTATE_UINT32(can_id, qemu_can_filter),
 906         VMSTATE_UINT32(can_mask, qemu_can_filter),
 907         VMSTATE_END_OF_LIST()
 908     }
 909 };
 910
 911 static int can_sja_post_load(void *opaque, int version_id)
 912 {
 913     CanSJA1000State *s = opaque;
 914     if (s->clock & 0x80) { /* PeliCAN Mode */
 915         can_sja_update_pel_irq(s);
 916     } else {
 917         can_sja_update_bas_irq(s);
 918     }
 919     return 0;
 920 }
 921
 922 /* VMState is needed for live migration of QEMU images */
 923 const VMStateDescription vmstate_can_sja = {
 924     .name = "can_sja",
 925     .version_id = 1,
 926     .minimum_version_id = 1,
 927     .minimum_version_id_old = 1,
 928     .post_load = can_sja_post_load,
 929     .fields = (VMStateField[]) {
 930         VMSTATE_UINT8(mode, CanSJA1000State),
 931
 932         VMSTATE_UINT8(status_pel, CanSJA1000State),
 933         VMSTATE_UINT8(interrupt_pel, CanSJA1000State),
 934         VMSTATE_UINT8(interrupt_en, CanSJA1000State),
 935         VMSTATE_UINT8(rxmsg_cnt, CanSJA1000State),
 936         VMSTATE_UINT8(rxbuf_start, CanSJA1000State),
 937         VMSTATE_UINT8(clock, CanSJA1000State),
 938
 939         VMSTATE_BUFFER(code_mask, CanSJA1000State),
 940         VMSTATE_BUFFER(tx_buff, CanSJA1000State),
 941
 942         VMSTATE_BUFFER(rx_buff, CanSJA1000State),
 943
 944         VMSTATE_UINT32(rx_ptr, CanSJA1000State),
 945         VMSTATE_UINT32(rx_cnt, CanSJA1000State),
 946
 947         VMSTATE_UINT8(control, CanSJA1000State),
 948
 949         VMSTATE_UINT8(status_bas, CanSJA1000State),
 950         VMSTATE_UINT8(interrupt_bas, CanSJA1000State),
 951         VMSTATE_UINT8(code, CanSJA1000State),
 952         VMSTATE_UINT8(mask, CanSJA1000State),
 953
 954         VMSTATE_STRUCT_ARRAY(filter, CanSJA1000State, 4, 0,
 955                              vmstate_qemu_can_filter, qemu_can_filter),
 956
 957
 958         VMSTATE_END_OF_LIST()
 959     }
 960 };