2 * ColdFire Fast Ethernet Controller emulation.
4 * Copyright (c) 2007 CodeSourcery.
6 * This code is licensed under the GPL
10 #include "hw/m68k/mcf.h"
11 #include "hw/net/mii.h"
14 #include "exec/address-spaces.h"
19 #define DPRINTF(fmt, ...) \
20 do { printf("mcf_fec: " fmt , ## __VA_ARGS__); } while (0)
22 #define DPRINTF(fmt, ...) do {} while(0)
25 #define FEC_MAX_FRAME_SIZE 2032
37 uint32_t rx_descriptor
;
38 uint32_t tx_descriptor
;
51 #define FEC_INT_HB 0x80000000
52 #define FEC_INT_BABR 0x40000000
53 #define FEC_INT_BABT 0x20000000
54 #define FEC_INT_GRA 0x10000000
55 #define FEC_INT_TXF 0x08000000
56 #define FEC_INT_TXB 0x04000000
57 #define FEC_INT_RXF 0x02000000
58 #define FEC_INT_RXB 0x01000000
59 #define FEC_INT_MII 0x00800000
60 #define FEC_INT_EB 0x00400000
61 #define FEC_INT_LC 0x00200000
62 #define FEC_INT_RL 0x00100000
63 #define FEC_INT_UN 0x00080000
68 /* Map interrupt flags onto IRQ lines. */
69 #define FEC_NUM_IRQ 13
70 static const uint32_t mcf_fec_irq_map
[FEC_NUM_IRQ
] = {
86 /* Buffer Descriptor. */
93 #define FEC_BD_R 0x8000
94 #define FEC_BD_E 0x8000
95 #define FEC_BD_O1 0x4000
96 #define FEC_BD_W 0x2000
97 #define FEC_BD_O2 0x1000
98 #define FEC_BD_L 0x0800
99 #define FEC_BD_TC 0x0400
100 #define FEC_BD_ABC 0x0200
101 #define FEC_BD_M 0x0100
102 #define FEC_BD_BC 0x0080
103 #define FEC_BD_MC 0x0040
104 #define FEC_BD_LG 0x0020
105 #define FEC_BD_NO 0x0010
106 #define FEC_BD_CR 0x0004
107 #define FEC_BD_OV 0x0002
108 #define FEC_BD_TR 0x0001
110 static void mcf_fec_read_bd(mcf_fec_bd
*bd
, uint32_t addr
)
112 cpu_physical_memory_read(addr
, bd
, sizeof(*bd
));
113 be16_to_cpus(&bd
->flags
);
114 be16_to_cpus(&bd
->length
);
115 be32_to_cpus(&bd
->data
);
118 static void mcf_fec_write_bd(mcf_fec_bd
*bd
, uint32_t addr
)
121 tmp
.flags
= cpu_to_be16(bd
->flags
);
122 tmp
.length
= cpu_to_be16(bd
->length
);
123 tmp
.data
= cpu_to_be32(bd
->data
);
124 cpu_physical_memory_write(addr
, &tmp
, sizeof(tmp
));
127 static void mcf_fec_update(mcf_fec_state
*s
)
134 active
= s
->eir
& s
->eimr
;
135 changed
= active
^s
->irq_state
;
136 for (i
= 0; i
< FEC_NUM_IRQ
; i
++) {
137 mask
= mcf_fec_irq_map
[i
];
138 if (changed
& mask
) {
139 DPRINTF("IRQ %d = %d\n", i
, (active
& mask
) != 0);
140 qemu_set_irq(s
->irq
[i
], (active
& mask
) != 0);
143 s
->irq_state
= active
;
146 static void mcf_fec_do_tx(mcf_fec_state
*s
)
152 uint8_t frame
[FEC_MAX_FRAME_SIZE
];
158 addr
= s
->tx_descriptor
;
160 mcf_fec_read_bd(&bd
, addr
);
161 DPRINTF("tx_bd %x flags %04x len %d data %08x\n",
162 addr
, bd
.flags
, bd
.length
, bd
.data
);
163 if ((bd
.flags
& FEC_BD_R
) == 0) {
164 /* Run out of descriptors to transmit. */
168 if (frame_size
+ len
> FEC_MAX_FRAME_SIZE
) {
169 len
= FEC_MAX_FRAME_SIZE
- frame_size
;
170 s
->eir
|= FEC_INT_BABT
;
172 cpu_physical_memory_read(bd
.data
, ptr
, len
);
175 if (bd
.flags
& FEC_BD_L
) {
176 /* Last buffer in frame. */
177 DPRINTF("Sending packet\n");
178 qemu_send_packet(qemu_get_queue(s
->nic
), frame
, len
);
181 s
->eir
|= FEC_INT_TXF
;
183 s
->eir
|= FEC_INT_TXB
;
184 bd
.flags
&= ~FEC_BD_R
;
185 /* Write back the modified descriptor. */
186 mcf_fec_write_bd(&bd
, addr
);
187 /* Advance to the next descriptor. */
188 if ((bd
.flags
& FEC_BD_W
) != 0) {
194 s
->tx_descriptor
= addr
;
197 static void mcf_fec_enable_rx(mcf_fec_state
*s
)
201 mcf_fec_read_bd(&bd
, s
->rx_descriptor
);
202 s
->rx_enabled
= ((bd
.flags
& FEC_BD_E
) != 0);
204 DPRINTF("RX buffer full\n");
207 static void mcf_fec_reset(mcf_fec_state
*s
)
220 #define MMFR_WRITE_OP (1 << 28)
221 #define MMFR_READ_OP (2 << 28)
222 #define MMFR_PHYADDR(v) (((v) >> 23) & 0x1f)
223 #define MMFR_REGNUM(v) (((v) >> 18) & 0x1f)
225 static uint64_t mcf_fec_read_mdio(mcf_fec_state
*s
)
229 if (s
->mmfr
& MMFR_WRITE_OP
)
231 if (MMFR_PHYADDR(s
->mmfr
) != 1)
232 return s
->mmfr
|= 0xffff;
234 switch (MMFR_REGNUM(s
->mmfr
)) {
236 v
= MII_BMCR_SPEED
| MII_BMCR_AUTOEN
| MII_BMCR_FD
;
239 v
= MII_BMSR_100TX_FD
| MII_BMSR_100TX_HD
| MII_BMSR_10T_FD
|
240 MII_BMSR_10T_HD
| MII_BMSR_MFPS
| MII_BMSR_AN_COMP
|
241 MII_BMSR_AUTONEG
| MII_BMSR_LINK_ST
;
250 v
= MII_ANAR_TXFD
| MII_ANAR_TX
| MII_ANAR_10FD
|
251 MII_ANAR_10
| MII_ANAR_CSMACD
;
254 v
= MII_ANLPAR_ACK
| MII_ANLPAR_TXFD
| MII_ANLPAR_TX
|
255 MII_ANLPAR_10FD
| MII_ANLPAR_10
| MII_ANLPAR_CSMACD
;
261 s
->mmfr
= (s
->mmfr
& ~0xffff) | v
;
265 static uint64_t mcf_fec_read(void *opaque
, hwaddr addr
,
268 mcf_fec_state
*s
= (mcf_fec_state
*)opaque
;
269 switch (addr
& 0x3ff) {
270 case 0x004: return s
->eir
;
271 case 0x008: return s
->eimr
;
272 case 0x010: return s
->rx_enabled
? (1 << 24) : 0; /* RDAR */
273 case 0x014: return 0; /* TDAR */
274 case 0x024: return s
->ecr
;
275 case 0x040: return mcf_fec_read_mdio(s
);
276 case 0x044: return s
->mscr
;
277 case 0x064: return 0; /* MIBC */
278 case 0x084: return s
->rcr
;
279 case 0x0c4: return s
->tcr
;
280 case 0x0e4: /* PALR */
281 return (s
->conf
.macaddr
.a
[0] << 24) | (s
->conf
.macaddr
.a
[1] << 16)
282 | (s
->conf
.macaddr
.a
[2] << 8) | s
->conf
.macaddr
.a
[3];
284 case 0x0e8: /* PAUR */
285 return (s
->conf
.macaddr
.a
[4] << 24) | (s
->conf
.macaddr
.a
[5] << 16) | 0x8808;
286 case 0x0ec: return 0x10000; /* OPD */
287 case 0x118: return 0;
288 case 0x11c: return 0;
289 case 0x120: return 0;
290 case 0x124: return 0;
291 case 0x144: return s
->tfwr
;
292 case 0x14c: return 0x600;
293 case 0x150: return s
->rfsr
;
294 case 0x180: return s
->erdsr
;
295 case 0x184: return s
->etdsr
;
296 case 0x188: return s
->emrbr
;
298 hw_error("mcf_fec_read: Bad address 0x%x\n", (int)addr
);
303 static void mcf_fec_write(void *opaque
, hwaddr addr
,
304 uint64_t value
, unsigned size
)
306 mcf_fec_state
*s
= (mcf_fec_state
*)opaque
;
307 switch (addr
& 0x3ff) {
314 case 0x010: /* RDAR */
315 if ((s
->ecr
& FEC_EN
) && !s
->rx_enabled
) {
316 DPRINTF("RX enable\n");
317 mcf_fec_enable_rx(s
);
320 case 0x014: /* TDAR */
321 if (s
->ecr
& FEC_EN
) {
327 if (value
& FEC_RESET
) {
331 if ((s
->ecr
& FEC_EN
) == 0) {
337 s
->eir
|= FEC_INT_MII
;
340 s
->mscr
= value
& 0xfe;
343 /* TODO: Implement MIB. */
346 s
->rcr
= value
& 0x07ff003f;
347 /* TODO: Implement LOOP mode. */
349 case 0x0c4: /* TCR */
350 /* We transmit immediately, so raise GRA immediately. */
353 s
->eir
|= FEC_INT_GRA
;
355 case 0x0e4: /* PALR */
356 s
->conf
.macaddr
.a
[0] = value
>> 24;
357 s
->conf
.macaddr
.a
[1] = value
>> 16;
358 s
->conf
.macaddr
.a
[2] = value
>> 8;
359 s
->conf
.macaddr
.a
[3] = value
;
361 case 0x0e8: /* PAUR */
362 s
->conf
.macaddr
.a
[4] = value
>> 24;
363 s
->conf
.macaddr
.a
[5] = value
>> 16;
372 /* TODO: implement MAC hash filtering. */
378 /* FRBR writes ignored. */
381 s
->rfsr
= (value
& 0x3fc) | 0x400;
384 s
->erdsr
= value
& ~3;
385 s
->rx_descriptor
= s
->erdsr
;
388 s
->etdsr
= value
& ~3;
389 s
->tx_descriptor
= s
->etdsr
;
392 s
->emrbr
= value
& 0x7f0;
395 hw_error("mcf_fec_write Bad address 0x%x\n", (int)addr
);
400 static ssize_t
mcf_fec_receive(NetClientState
*nc
, const uint8_t *buf
, size_t size
)
402 mcf_fec_state
*s
= qemu_get_nic_opaque(nc
);
409 unsigned int buf_len
;
412 DPRINTF("do_rx len %d\n", size
);
413 if (!s
->rx_enabled
) {
416 /* 4 bytes for the CRC. */
418 crc
= cpu_to_be32(crc32(~0, buf
, size
));
419 crc_ptr
= (uint8_t *)&crc
;
420 /* Huge frames are truncted. */
421 if (size
> FEC_MAX_FRAME_SIZE
) {
422 size
= FEC_MAX_FRAME_SIZE
;
423 flags
|= FEC_BD_TR
| FEC_BD_LG
;
425 /* Frames larger than the user limit just set error flags. */
426 if (size
> (s
->rcr
>> 16)) {
429 addr
= s
->rx_descriptor
;
432 mcf_fec_read_bd(&bd
, addr
);
433 if ((bd
.flags
& FEC_BD_E
) == 0) {
434 /* No descriptors available. Bail out. */
435 /* FIXME: This is wrong. We should probably either save the
436 remainder for when more RX buffers are available, or
438 fprintf(stderr
, "mcf_fec: Lost end of frame\n");
441 buf_len
= (size
<= s
->emrbr
) ? size
: s
->emrbr
;
444 DPRINTF("rx_bd %x length %d\n", addr
, bd
.length
);
445 /* The last 4 bytes are the CRC. */
449 cpu_physical_memory_write(buf_addr
, buf
, buf_len
);
452 cpu_physical_memory_write(buf_addr
+ buf_len
, crc_ptr
, 4 - size
);
455 bd
.flags
&= ~FEC_BD_E
;
457 /* Last buffer in frame. */
458 bd
.flags
|= flags
| FEC_BD_L
;
459 DPRINTF("rx frame flags %04x\n", bd
.flags
);
460 s
->eir
|= FEC_INT_RXF
;
462 s
->eir
|= FEC_INT_RXB
;
464 mcf_fec_write_bd(&bd
, addr
);
465 /* Advance to the next descriptor. */
466 if ((bd
.flags
& FEC_BD_W
) != 0) {
472 s
->rx_descriptor
= addr
;
473 mcf_fec_enable_rx(s
);
478 static const MemoryRegionOps mcf_fec_ops
= {
479 .read
= mcf_fec_read
,
480 .write
= mcf_fec_write
,
481 .endianness
= DEVICE_NATIVE_ENDIAN
,
484 static NetClientInfo net_mcf_fec_info
= {
485 .type
= NET_CLIENT_OPTIONS_KIND_NIC
,
486 .size
= sizeof(NICState
),
487 .receive
= mcf_fec_receive
,
490 void mcf_fec_init(MemoryRegion
*sysmem
, NICInfo
*nd
,
491 hwaddr base
, qemu_irq
*irq
)
495 qemu_check_nic_model(nd
, "mcf_fec");
497 s
= (mcf_fec_state
*)g_malloc0(sizeof(mcf_fec_state
));
501 memory_region_init_io(&s
->iomem
, NULL
, &mcf_fec_ops
, s
, "fec", 0x400);
502 memory_region_add_subregion(sysmem
, base
, &s
->iomem
);
504 s
->conf
.macaddr
= nd
->macaddr
;
505 s
->conf
.peers
.ncs
[0] = nd
->netdev
;
507 s
->nic
= qemu_new_nic(&net_mcf_fec_info
, &s
->conf
, nd
->model
, nd
->name
, s
);
509 qemu_format_nic_info_str(qemu_get_queue(s
->nic
), s
->conf
.macaddr
.a
);