2 * QEMU NE2000 emulation
4 * Copyright (c) 2003-2004 Fabrice Bellard
6 * Permission is hereby granted, free of charge, to any person obtaining a copy
7 * of this software and associated documentation files (the "Software"), to deal
8 * in the Software without restriction, including without limitation the rights
9 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10 * copies of the Software, and to permit persons to whom the Software is
11 * furnished to do so, subject to the following conditions:
13 * The above copyright notice and this permission notice shall be included in
14 * all copies or substantial portions of the Software.
16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
25 #include "qemu/osdep.h"
27 #include "qemu/module.h"
28 #include "exec/memory.h"
30 #include "migration/vmstate.h"
32 #include "sysemu/sysemu.h"
35 /* debug NE2000 card */
36 //#define DEBUG_NE2000
38 #define MAX_ETH_FRAME_SIZE 1514
40 #define E8390_CMD 0x00 /* The command register (for all pages) */
41 /* Page 0 register offsets. */
42 #define EN0_CLDALO 0x01 /* Low byte of current local dma addr RD */
43 #define EN0_STARTPG 0x01 /* Starting page of ring bfr WR */
44 #define EN0_CLDAHI 0x02 /* High byte of current local dma addr RD */
45 #define EN0_STOPPG 0x02 /* Ending page +1 of ring bfr WR */
46 #define EN0_BOUNDARY 0x03 /* Boundary page of ring bfr RD WR */
47 #define EN0_TSR 0x04 /* Transmit status reg RD */
48 #define EN0_TPSR 0x04 /* Transmit starting page WR */
49 #define EN0_NCR 0x05 /* Number of collision reg RD */
50 #define EN0_TCNTLO 0x05 /* Low byte of tx byte count WR */
51 #define EN0_FIFO 0x06 /* FIFO RD */
52 #define EN0_TCNTHI 0x06 /* High byte of tx byte count WR */
53 #define EN0_ISR 0x07 /* Interrupt status reg RD WR */
54 #define EN0_CRDALO 0x08 /* low byte of current remote dma address RD */
55 #define EN0_RSARLO 0x08 /* Remote start address reg 0 */
56 #define EN0_CRDAHI 0x09 /* high byte, current remote dma address RD */
57 #define EN0_RSARHI 0x09 /* Remote start address reg 1 */
58 #define EN0_RCNTLO 0x0a /* Remote byte count reg WR */
59 #define EN0_RTL8029ID0 0x0a /* Realtek ID byte #1 RD */
60 #define EN0_RCNTHI 0x0b /* Remote byte count reg WR */
61 #define EN0_RTL8029ID1 0x0b /* Realtek ID byte #2 RD */
62 #define EN0_RSR 0x0c /* rx status reg RD */
63 #define EN0_RXCR 0x0c /* RX configuration reg WR */
64 #define EN0_TXCR 0x0d /* TX configuration reg WR */
65 #define EN0_COUNTER0 0x0d /* Rcv alignment error counter RD */
66 #define EN0_DCFG 0x0e /* Data configuration reg WR */
67 #define EN0_COUNTER1 0x0e /* Rcv CRC error counter RD */
68 #define EN0_IMR 0x0f /* Interrupt mask reg WR */
69 #define EN0_COUNTER2 0x0f /* Rcv missed frame error counter RD */
72 #define EN1_CURPAG 0x17
75 #define EN2_STARTPG 0x21 /* Starting page of ring bfr RD */
76 #define EN2_STOPPG 0x22 /* Ending page +1 of ring bfr RD */
78 #define EN3_CONFIG0 0x33
79 #define EN3_CONFIG1 0x34
80 #define EN3_CONFIG2 0x35
81 #define EN3_CONFIG3 0x36
83 /* Register accessed at EN_CMD, the 8390 base addr. */
84 #define E8390_STOP 0x01 /* Stop and reset the chip */
85 #define E8390_START 0x02 /* Start the chip, clear reset */
86 #define E8390_TRANS 0x04 /* Transmit a frame */
87 #define E8390_RREAD 0x08 /* Remote read */
88 #define E8390_RWRITE 0x10 /* Remote write */
89 #define E8390_NODMA 0x20 /* Remote DMA */
90 #define E8390_PAGE0 0x00 /* Select page chip registers */
91 #define E8390_PAGE1 0x40 /* using the two high-order bits */
92 #define E8390_PAGE2 0x80 /* Page 3 is invalid. */
94 /* Bits in EN0_ISR - Interrupt status register */
95 #define ENISR_RX 0x01 /* Receiver, no error */
96 #define ENISR_TX 0x02 /* Transmitter, no error */
97 #define ENISR_RX_ERR 0x04 /* Receiver, with error */
98 #define ENISR_TX_ERR 0x08 /* Transmitter, with error */
99 #define ENISR_OVER 0x10 /* Receiver overwrote the ring */
100 #define ENISR_COUNTERS 0x20 /* Counters need emptying */
101 #define ENISR_RDC 0x40 /* remote dma complete */
102 #define ENISR_RESET 0x80 /* Reset completed */
103 #define ENISR_ALL 0x3f /* Interrupts we will enable */
105 /* Bits in received packet status byte and EN0_RSR*/
106 #define ENRSR_RXOK 0x01 /* Received a good packet */
107 #define ENRSR_CRC 0x02 /* CRC error */
108 #define ENRSR_FAE 0x04 /* frame alignment error */
109 #define ENRSR_FO 0x08 /* FIFO overrun */
110 #define ENRSR_MPA 0x10 /* missed pkt */
111 #define ENRSR_PHY 0x20 /* physical/multicast address */
112 #define ENRSR_DIS 0x40 /* receiver disable. set in monitor mode */
113 #define ENRSR_DEF 0x80 /* deferring */
115 /* Transmitted packet status, EN0_TSR. */
116 #define ENTSR_PTX 0x01 /* Packet transmitted without error */
117 #define ENTSR_ND 0x02 /* The transmit wasn't deferred. */
118 #define ENTSR_COL 0x04 /* The transmit collided at least once. */
119 #define ENTSR_ABT 0x08 /* The transmit collided 16 times, and was deferred. */
120 #define ENTSR_CRS 0x10 /* The carrier sense was lost. */
121 #define ENTSR_FU 0x20 /* A "FIFO underrun" occurred during transmit. */
122 #define ENTSR_CDH 0x40 /* The collision detect "heartbeat" signal was lost. */
123 #define ENTSR_OWC 0x80 /* There was an out-of-window collision. */
125 void ne2000_reset(NE2000State
*s
)
129 s
->isr
= ENISR_RESET
;
130 memcpy(s
->mem
, &s
->c
.macaddr
, 6);
134 /* duplicate prom data */
135 for(i
= 15;i
>= 0; i
--) {
136 s
->mem
[2 * i
] = s
->mem
[i
];
137 s
->mem
[2 * i
+ 1] = s
->mem
[i
];
141 static void ne2000_update_irq(NE2000State
*s
)
144 isr
= (s
->isr
& s
->imr
) & 0x7f;
145 #if defined(DEBUG_NE2000)
146 printf("NE2000: Set IRQ to %d (%02x %02x)\n",
147 isr
? 1 : 0, s
->isr
, s
->imr
);
149 qemu_set_irq(s
->irq
, (isr
!= 0));
152 static int ne2000_buffer_full(NE2000State
*s
)
154 int avail
, index
, boundary
;
156 if (s
->stop
<= s
->start
) {
160 index
= s
->curpag
<< 8;
161 boundary
= s
->boundary
<< 8;
162 if (index
< boundary
)
163 avail
= boundary
- index
;
165 avail
= (s
->stop
- s
->start
) - (index
- boundary
);
166 if (avail
< (MAX_ETH_FRAME_SIZE
+ 4))
171 #define MIN_BUF_SIZE 60
173 ssize_t
ne2000_receive(NetClientState
*nc
, const uint8_t *buf
, size_t size_
)
175 NE2000State
*s
= qemu_get_nic_opaque(nc
);
178 unsigned int total_len
, next
, avail
, len
, index
, mcast_idx
;
180 static const uint8_t broadcast_macaddr
[6] =
181 { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
183 #if defined(DEBUG_NE2000)
184 printf("NE2000: received len=%zu\n", size
);
187 if (s
->cmd
& E8390_STOP
|| ne2000_buffer_full(s
))
190 /* XXX: check this */
191 if (s
->rxcr
& 0x10) {
192 /* promiscuous: receive all */
194 if (!memcmp(buf
, broadcast_macaddr
, 6)) {
195 /* broadcast address */
196 if (!(s
->rxcr
& 0x04))
198 } else if (buf
[0] & 0x01) {
200 if (!(s
->rxcr
& 0x08))
202 mcast_idx
= net_crc32(buf
, ETH_ALEN
) >> 26;
203 if (!(s
->mult
[mcast_idx
>> 3] & (1 << (mcast_idx
& 7))))
205 } else if (s
->mem
[0] == buf
[0] &&
206 s
->mem
[2] == buf
[1] &&
207 s
->mem
[4] == buf
[2] &&
208 s
->mem
[6] == buf
[3] &&
209 s
->mem
[8] == buf
[4] &&
210 s
->mem
[10] == buf
[5]) {
218 /* if too small buffer, then expand it */
219 if (size
< MIN_BUF_SIZE
) {
220 memcpy(buf1
, buf
, size
);
221 memset(buf1
+ size
, 0, MIN_BUF_SIZE
- size
);
226 index
= s
->curpag
<< 8;
227 if (index
>= NE2000_PMEM_END
) {
230 /* 4 bytes for header */
231 total_len
= size
+ 4;
232 /* address for next packet (4 bytes for CRC) */
233 next
= index
+ ((total_len
+ 4 + 255) & ~0xff);
235 next
-= (s
->stop
- s
->start
);
236 /* prepare packet header */
238 s
->rsr
= ENRSR_RXOK
; /* receive status */
239 /* XXX: check this */
245 p
[3] = total_len
>> 8;
248 /* write packet data */
250 if (index
<= s
->stop
)
251 avail
= s
->stop
- index
;
257 memcpy(s
->mem
+ index
, buf
, len
);
260 if (index
== s
->stop
)
264 s
->curpag
= next
>> 8;
266 /* now we can signal we have received something */
268 ne2000_update_irq(s
);
273 static void ne2000_ioport_write(void *opaque
, uint32_t addr
, uint32_t val
)
275 NE2000State
*s
= opaque
;
276 int offset
, page
, index
;
279 trace_ne2000_ioport_write(addr
, val
);
280 if (addr
== E8390_CMD
) {
281 /* control register */
283 if (!(val
& E8390_STOP
)) { /* START bit makes no sense on RTL8029... */
284 s
->isr
&= ~ENISR_RESET
;
285 /* test specific case: zero length transfer */
286 if ((val
& (E8390_RREAD
| E8390_RWRITE
)) &&
289 ne2000_update_irq(s
);
291 if (val
& E8390_TRANS
) {
292 index
= (s
->tpsr
<< 8);
293 /* XXX: next 2 lines are a hack to make netware 3.11 work */
294 if (index
>= NE2000_PMEM_END
)
295 index
-= NE2000_PMEM_SIZE
;
296 /* fail safe: check range on the transmitted length */
297 if (index
+ s
->tcnt
<= NE2000_PMEM_END
) {
298 qemu_send_packet(qemu_get_queue(s
->nic
), s
->mem
+ index
,
301 /* signal end of transfer */
304 s
->cmd
&= ~E8390_TRANS
;
305 ne2000_update_irq(s
);
310 offset
= addr
| (page
<< 4);
313 if (val
<< 8 <= NE2000_PMEM_END
) {
318 if (val
<< 8 <= NE2000_PMEM_END
) {
323 if (val
<< 8 < NE2000_PMEM_END
) {
329 ne2000_update_irq(s
);
335 s
->tcnt
= (s
->tcnt
& 0xff00) | val
;
338 s
->tcnt
= (s
->tcnt
& 0x00ff) | (val
<< 8);
341 s
->rsar
= (s
->rsar
& 0xff00) | val
;
344 s
->rsar
= (s
->rsar
& 0x00ff) | (val
<< 8);
347 s
->rcnt
= (s
->rcnt
& 0xff00) | val
;
350 s
->rcnt
= (s
->rcnt
& 0x00ff) | (val
<< 8);
359 s
->isr
&= ~(val
& 0x7f);
360 ne2000_update_irq(s
);
362 case EN1_PHYS
... EN1_PHYS
+ 5:
363 s
->phys
[offset
- EN1_PHYS
] = val
;
366 if (val
<< 8 < NE2000_PMEM_END
) {
370 case EN1_MULT
... EN1_MULT
+ 7:
371 s
->mult
[offset
- EN1_MULT
] = val
;
377 static uint32_t ne2000_ioport_read(void *opaque
, uint32_t addr
)
379 NE2000State
*s
= opaque
;
380 int offset
, page
, ret
;
383 if (addr
== E8390_CMD
) {
387 offset
= addr
| (page
<< 4);
399 ret
= s
->rsar
& 0x00ff;
404 case EN1_PHYS
... EN1_PHYS
+ 5:
405 ret
= s
->phys
[offset
- EN1_PHYS
];
410 case EN1_MULT
... EN1_MULT
+ 7:
411 ret
= s
->mult
[offset
- EN1_MULT
];
429 ret
= 0; /* 10baseT media */
432 ret
= 0x40; /* 10baseT active */
435 ret
= 0x40; /* Full duplex */
442 trace_ne2000_ioport_read(addr
, ret
);
446 static inline void ne2000_mem_writeb(NE2000State
*s
, uint32_t addr
,
450 (addr
>= NE2000_PMEM_START
&& addr
< NE2000_MEM_SIZE
)) {
455 static inline void ne2000_mem_writew(NE2000State
*s
, uint32_t addr
,
458 addr
&= ~1; /* XXX: check exact behaviour if not even */
460 (addr
>= NE2000_PMEM_START
&& addr
< NE2000_MEM_SIZE
)) {
461 *(uint16_t *)(s
->mem
+ addr
) = cpu_to_le16(val
);
465 static inline void ne2000_mem_writel(NE2000State
*s
, uint32_t addr
,
468 addr
&= ~1; /* XXX: check exact behaviour if not even */
470 || (addr
>= NE2000_PMEM_START
471 && addr
+ sizeof(uint32_t) <= NE2000_MEM_SIZE
)) {
472 stl_le_p(s
->mem
+ addr
, val
);
476 static inline uint32_t ne2000_mem_readb(NE2000State
*s
, uint32_t addr
)
479 (addr
>= NE2000_PMEM_START
&& addr
< NE2000_MEM_SIZE
)) {
486 static inline uint32_t ne2000_mem_readw(NE2000State
*s
, uint32_t addr
)
488 addr
&= ~1; /* XXX: check exact behaviour if not even */
490 (addr
>= NE2000_PMEM_START
&& addr
< NE2000_MEM_SIZE
)) {
491 return le16_to_cpu(*(uint16_t *)(s
->mem
+ addr
));
497 static inline uint32_t ne2000_mem_readl(NE2000State
*s
, uint32_t addr
)
499 addr
&= ~1; /* XXX: check exact behaviour if not even */
501 || (addr
>= NE2000_PMEM_START
502 && addr
+ sizeof(uint32_t) <= NE2000_MEM_SIZE
)) {
503 return ldl_le_p(s
->mem
+ addr
);
509 static inline void ne2000_dma_update(NE2000State
*s
, int len
)
513 /* XXX: check what to do if rsar > stop */
514 if (s
->rsar
== s
->stop
)
517 if (s
->rcnt
<= len
) {
519 /* signal end of transfer */
521 ne2000_update_irq(s
);
527 static void ne2000_asic_ioport_write(void *opaque
, uint32_t addr
, uint32_t val
)
529 NE2000State
*s
= opaque
;
532 printf("NE2000: asic write val=0x%04x\n", val
);
536 if (s
->dcfg
& 0x01) {
538 ne2000_mem_writew(s
, s
->rsar
, val
);
539 ne2000_dma_update(s
, 2);
542 ne2000_mem_writeb(s
, s
->rsar
, val
);
543 ne2000_dma_update(s
, 1);
547 static uint32_t ne2000_asic_ioport_read(void *opaque
, uint32_t addr
)
549 NE2000State
*s
= opaque
;
552 if (s
->dcfg
& 0x01) {
554 ret
= ne2000_mem_readw(s
, s
->rsar
);
555 ne2000_dma_update(s
, 2);
558 ret
= ne2000_mem_readb(s
, s
->rsar
);
559 ne2000_dma_update(s
, 1);
562 printf("NE2000: asic read val=0x%04x\n", ret
);
567 static void ne2000_asic_ioport_writel(void *opaque
, uint32_t addr
, uint32_t val
)
569 NE2000State
*s
= opaque
;
572 printf("NE2000: asic writel val=0x%04x\n", val
);
577 ne2000_mem_writel(s
, s
->rsar
, val
);
578 ne2000_dma_update(s
, 4);
581 static uint32_t ne2000_asic_ioport_readl(void *opaque
, uint32_t addr
)
583 NE2000State
*s
= opaque
;
587 ret
= ne2000_mem_readl(s
, s
->rsar
);
588 ne2000_dma_update(s
, 4);
590 printf("NE2000: asic readl val=0x%04x\n", ret
);
595 static void ne2000_reset_ioport_write(void *opaque
, uint32_t addr
, uint32_t val
)
597 /* nothing to do (end of reset pulse) */
600 static uint32_t ne2000_reset_ioport_read(void *opaque
, uint32_t addr
)
602 NE2000State
*s
= opaque
;
607 static int ne2000_post_load(void* opaque
, int version_id
)
609 NE2000State
* s
= opaque
;
611 if (version_id
< 2) {
617 const VMStateDescription vmstate_ne2000
= {
620 .minimum_version_id
= 0,
621 .post_load
= ne2000_post_load
,
622 .fields
= (VMStateField
[]) {
623 VMSTATE_UINT8_V(rxcr
, NE2000State
, 2),
624 VMSTATE_UINT8(cmd
, NE2000State
),
625 VMSTATE_UINT32(start
, NE2000State
),
626 VMSTATE_UINT32(stop
, NE2000State
),
627 VMSTATE_UINT8(boundary
, NE2000State
),
628 VMSTATE_UINT8(tsr
, NE2000State
),
629 VMSTATE_UINT8(tpsr
, NE2000State
),
630 VMSTATE_UINT16(tcnt
, NE2000State
),
631 VMSTATE_UINT16(rcnt
, NE2000State
),
632 VMSTATE_UINT32(rsar
, NE2000State
),
633 VMSTATE_UINT8(rsr
, NE2000State
),
634 VMSTATE_UINT8(isr
, NE2000State
),
635 VMSTATE_UINT8(dcfg
, NE2000State
),
636 VMSTATE_UINT8(imr
, NE2000State
),
637 VMSTATE_BUFFER(phys
, NE2000State
),
638 VMSTATE_UINT8(curpag
, NE2000State
),
639 VMSTATE_BUFFER(mult
, NE2000State
),
640 VMSTATE_UNUSED(4), /* was irq */
641 VMSTATE_BUFFER(mem
, NE2000State
),
642 VMSTATE_END_OF_LIST()
646 static uint64_t ne2000_read(void *opaque
, hwaddr addr
,
649 NE2000State
*s
= opaque
;
652 if (addr
< 0x10 && size
== 1) {
653 val
= ne2000_ioport_read(s
, addr
);
654 } else if (addr
== 0x10) {
656 val
= ne2000_asic_ioport_read(s
, addr
);
658 val
= ne2000_asic_ioport_readl(s
, addr
);
660 } else if (addr
== 0x1f && size
== 1) {
661 val
= ne2000_reset_ioport_read(s
, addr
);
663 val
= ((uint64_t)1 << (size
* 8)) - 1;
665 trace_ne2000_read(addr
, val
);
670 static void ne2000_write(void *opaque
, hwaddr addr
,
671 uint64_t data
, unsigned size
)
673 NE2000State
*s
= opaque
;
675 trace_ne2000_write(addr
, data
);
676 if (addr
< 0x10 && size
== 1) {
677 ne2000_ioport_write(s
, addr
, data
);
678 } else if (addr
== 0x10) {
680 ne2000_asic_ioport_write(s
, addr
, data
);
682 ne2000_asic_ioport_writel(s
, addr
, data
);
684 } else if (addr
== 0x1f && size
== 1) {
685 ne2000_reset_ioport_write(s
, addr
, data
);
689 static const MemoryRegionOps ne2000_ops
= {
691 .write
= ne2000_write
,
692 .endianness
= DEVICE_LITTLE_ENDIAN
,
695 /***********************************************************/
696 /* PCI NE2000 definitions */
698 void ne2000_setup_io(NE2000State
*s
, DeviceState
*dev
, unsigned size
)
700 memory_region_init_io(&s
->io
, OBJECT(dev
), &ne2000_ops
, s
, "ne2000", size
);