xref: /qemu/hw/net/rtl8139.c (revision 5691f477)
1 /**
2  * QEMU RTL8139 emulation
3  *
4  * Copyright (c) 2006 Igor Kovalenko
5  *
6  * Permission is hereby granted, free of charge, to any person obtaining a copy
7  * of this software and associated documentation files (the "Software"), to deal
8  * in the Software without restriction, including without limitation the rights
9  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
10  * copies of the Software, and to permit persons to whom the Software is
11  * furnished to do so, subject to the following conditions:
12  *
13  * The above copyright notice and this permission notice shall be included in
14  * all copies or substantial portions of the Software.
15  *
16  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
17  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
18  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
19  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
20  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
21  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
22  * THE SOFTWARE.
23 
24  * Modifications:
25  *  2006-Jan-28  Mark Malakanov :   TSAD and CSCR implementation (for Windows driver)
26  *
27  *  2006-Apr-28  Juergen Lock   :   EEPROM emulation changes for FreeBSD driver
28  *                                  HW revision ID changes for FreeBSD driver
29  *
30  *  2006-Jul-01  Igor Kovalenko :   Implemented loopback mode for FreeBSD driver
31  *                                  Corrected packet transfer reassembly routine for 8139C+ mode
32  *                                  Rearranged debugging print statements
33  *                                  Implemented PCI timer interrupt (disabled by default)
34  *                                  Implemented Tally Counters, increased VM load/save version
35  *                                  Implemented IP/TCP/UDP checksum task offloading
36  *
37  *  2006-Jul-04  Igor Kovalenko :   Implemented TCP segmentation offloading
38  *                                  Fixed MTU=1500 for produced ethernet frames
39  *
40  *  2006-Jul-09  Igor Kovalenko :   Fixed TCP header length calculation while processing
41  *                                  segmentation offloading
42  *                                  Removed slirp.h dependency
43  *                                  Added rx/tx buffer reset when enabling rx/tx operation
44  *
45  *  2010-Feb-04  Frediano Ziglio:   Rewrote timer support using QEMU timer only
46  *                                  when strictly needed (required for
47  *                                  Darwin)
48  *  2011-Mar-22  Benjamin Poirier:  Implemented VLAN offloading
49  */
50 
51 #include "qemu/osdep.h"
52 #include <zlib.h> /* for crc32 */
53 
54 #include "hw/pci/pci_device.h"
55 #include "hw/qdev-properties.h"
56 #include "migration/vmstate.h"
57 #include "sysemu/dma.h"
58 #include "qemu/module.h"
59 #include "qemu/timer.h"
60 #include "net/net.h"
61 #include "net/eth.h"
62 #include "sysemu/sysemu.h"
63 #include "qom/object.h"
64 
65 /* debug RTL8139 card */
66 //#define DEBUG_RTL8139 1
67 
68 #define PCI_PERIOD 30    /* 30 ns period = 33.333333 Mhz frequency */
69 
70 #define SET_MASKED(input, mask, curr) \
71     ( ( (input) & ~(mask) ) | ( (curr) & (mask) ) )
72 
73 /* arg % size for size which is a power of 2 */
74 #define MOD2(input, size) \
75     ( ( input ) & ( size - 1 )  )
76 
77 #define ETHER_TYPE_LEN 2
78 
79 #define VLAN_TCI_LEN 2
80 #define VLAN_HLEN (ETHER_TYPE_LEN + VLAN_TCI_LEN)
81 
82 #if defined (DEBUG_RTL8139)
83 #  define DPRINTF(fmt, ...) \
84     do { fprintf(stderr, "RTL8139: " fmt, ## __VA_ARGS__); } while (0)
85 #else
DPRINTF(const char * fmt,...)86 static inline G_GNUC_PRINTF(1, 2) int DPRINTF(const char *fmt, ...)
87 {
88     return 0;
89 }
90 #endif
91 
92 #define TYPE_RTL8139 "rtl8139"
93 
94 OBJECT_DECLARE_SIMPLE_TYPE(RTL8139State, RTL8139)
95 
96 /* Symbolic offsets to registers. */
97 enum RTL8139_registers {
98     MAC0 = 0,        /* Ethernet hardware address. */
99     MAR0 = 8,        /* Multicast filter. */
100     TxStatus0 = 0x10,/* Transmit status (Four 32bit registers). C mode only */
101                      /* Dump Tally Counter control register(64bit). C+ mode only */
102     TxAddr0 = 0x20,  /* Tx descriptors (also four 32bit). */
103     RxBuf = 0x30,
104     ChipCmd = 0x37,
105     RxBufPtr = 0x38,
106     RxBufAddr = 0x3A,
107     IntrMask = 0x3C,
108     IntrStatus = 0x3E,
109     TxConfig = 0x40,
110     RxConfig = 0x44,
111     Timer = 0x48,        /* A general-purpose counter. */
112     RxMissed = 0x4C,    /* 24 bits valid, write clears. */
113     Cfg9346 = 0x50,
114     Config0 = 0x51,
115     Config1 = 0x52,
116     FlashReg = 0x54,
117     MediaStatus = 0x58,
118     Config3 = 0x59,
119     Config4 = 0x5A,        /* absent on RTL-8139A */
120     HltClk = 0x5B,
121     MultiIntr = 0x5C,
122     PCIRevisionID = 0x5E,
123     TxSummary = 0x60, /* TSAD register. Transmit Status of All Descriptors*/
124     BasicModeCtrl = 0x62,
125     BasicModeStatus = 0x64,
126     NWayAdvert = 0x66,
127     NWayLPAR = 0x68,
128     NWayExpansion = 0x6A,
129     /* Undocumented registers, but required for proper operation. */
130     FIFOTMS = 0x70,        /* FIFO Control and test. */
131     CSCR = 0x74,        /* Chip Status and Configuration Register. */
132     PARA78 = 0x78,
133     PARA7c = 0x7c,        /* Magic transceiver parameter register. */
134     Config5 = 0xD8,        /* absent on RTL-8139A */
135     /* C+ mode */
136     TxPoll        = 0xD9,    /* Tell chip to check Tx descriptors for work */
137     RxMaxSize    = 0xDA, /* Max size of an Rx packet (8169 only) */
138     CpCmd        = 0xE0, /* C+ Command register (C+ mode only) */
139     IntrMitigate    = 0xE2,    /* rx/tx interrupt mitigation control */
140     RxRingAddrLO    = 0xE4, /* 64-bit start addr of Rx ring */
141     RxRingAddrHI    = 0xE8, /* 64-bit start addr of Rx ring */
142     TxThresh    = 0xEC, /* Early Tx threshold */
143 };
144 
145 enum ClearBitMasks {
146     MultiIntrClear = 0xF000,
147     ChipCmdClear = 0xE2,
148     Config1Clear = (1<<7)|(1<<6)|(1<<3)|(1<<2)|(1<<1),
149 };
150 
151 enum ChipCmdBits {
152     CmdReset = 0x10,
153     CmdRxEnb = 0x08,
154     CmdTxEnb = 0x04,
155     RxBufEmpty = 0x01,
156 };
157 
158 /* C+ mode */
159 enum CplusCmdBits {
160     CPlusRxVLAN   = 0x0040, /* enable receive VLAN detagging */
161     CPlusRxChkSum = 0x0020, /* enable receive checksum offloading */
162     CPlusRxEnb    = 0x0002,
163     CPlusTxEnb    = 0x0001,
164 };
165 
166 /* Interrupt register bits, using my own meaningful names. */
167 enum IntrStatusBits {
168     PCIErr = 0x8000,
169     PCSTimeout = 0x4000,
170     RxFIFOOver = 0x40,
171     RxUnderrun = 0x20, /* Packet Underrun / Link Change */
172     RxOverflow = 0x10,
173     TxErr = 0x08,
174     TxOK = 0x04,
175     RxErr = 0x02,
176     RxOK = 0x01,
177 
178     RxAckBits = RxFIFOOver | RxOverflow | RxOK,
179 };
180 
181 enum TxStatusBits {
182     TxHostOwns = 0x2000,
183     TxUnderrun = 0x4000,
184     TxStatOK = 0x8000,
185     TxOutOfWindow = 0x20000000,
186     TxAborted = 0x40000000,
187     TxCarrierLost = 0x80000000,
188 };
189 enum RxStatusBits {
190     RxMulticast = 0x8000,
191     RxPhysical = 0x4000,
192     RxBroadcast = 0x2000,
193     RxBadSymbol = 0x0020,
194     RxRunt = 0x0010,
195     RxTooLong = 0x0008,
196     RxCRCErr = 0x0004,
197     RxBadAlign = 0x0002,
198     RxStatusOK = 0x0001,
199 };
200 
201 /* Bits in RxConfig. */
202 enum rx_mode_bits {
203     AcceptErr = 0x20,
204     AcceptRunt = 0x10,
205     AcceptBroadcast = 0x08,
206     AcceptMulticast = 0x04,
207     AcceptMyPhys = 0x02,
208     AcceptAllPhys = 0x01,
209 };
210 
211 /* Bits in TxConfig. */
212 enum tx_config_bits {
213 
214         /* Interframe Gap Time. Only TxIFG96 doesn't violate IEEE 802.3 */
215         TxIFGShift = 24,
216         TxIFG84 = (0 << TxIFGShift),    /* 8.4us / 840ns (10 / 100Mbps) */
217         TxIFG88 = (1 << TxIFGShift),    /* 8.8us / 880ns (10 / 100Mbps) */
218         TxIFG92 = (2 << TxIFGShift),    /* 9.2us / 920ns (10 / 100Mbps) */
219         TxIFG96 = (3 << TxIFGShift),    /* 9.6us / 960ns (10 / 100Mbps) */
220 
221     TxLoopBack = (1 << 18) | (1 << 17), /* enable loopback test mode */
222     TxCRC = (1 << 16),    /* DISABLE appending CRC to end of Tx packets */
223     TxClearAbt = (1 << 0),    /* Clear abort (WO) */
224     TxDMAShift = 8,        /* DMA burst value (0-7) is shifted this many bits */
225     TxRetryShift = 4,    /* TXRR value (0-15) is shifted this many bits */
226 
227     TxVersionMask = 0x7C800000, /* mask out version bits 30-26, 23 */
228 };
229 
230 
231 /* Transmit Status of All Descriptors (TSAD) Register */
232 enum TSAD_bits {
233  TSAD_TOK3 = 1<<15, // TOK bit of Descriptor 3
234  TSAD_TOK2 = 1<<14, // TOK bit of Descriptor 2
235  TSAD_TOK1 = 1<<13, // TOK bit of Descriptor 1
236  TSAD_TOK0 = 1<<12, // TOK bit of Descriptor 0
237  TSAD_TUN3 = 1<<11, // TUN bit of Descriptor 3
238  TSAD_TUN2 = 1<<10, // TUN bit of Descriptor 2
239  TSAD_TUN1 = 1<<9, // TUN bit of Descriptor 1
240  TSAD_TUN0 = 1<<8, // TUN bit of Descriptor 0
241  TSAD_TABT3 = 1<<07, // TABT bit of Descriptor 3
242  TSAD_TABT2 = 1<<06, // TABT bit of Descriptor 2
243  TSAD_TABT1 = 1<<05, // TABT bit of Descriptor 1
244  TSAD_TABT0 = 1<<04, // TABT bit of Descriptor 0
245  TSAD_OWN3 = 1<<03, // OWN bit of Descriptor 3
246  TSAD_OWN2 = 1<<02, // OWN bit of Descriptor 2
247  TSAD_OWN1 = 1<<01, // OWN bit of Descriptor 1
248  TSAD_OWN0 = 1<<00, // OWN bit of Descriptor 0
249 };
250 
251 
252 /* Bits in Config1 */
253 enum Config1Bits {
254     Cfg1_PM_Enable = 0x01,
255     Cfg1_VPD_Enable = 0x02,
256     Cfg1_PIO = 0x04,
257     Cfg1_MMIO = 0x08,
258     LWAKE = 0x10,        /* not on 8139, 8139A */
259     Cfg1_Driver_Load = 0x20,
260     Cfg1_LED0 = 0x40,
261     Cfg1_LED1 = 0x80,
262     SLEEP = (1 << 1),    /* only on 8139, 8139A */
263     PWRDN = (1 << 0),    /* only on 8139, 8139A */
264 };
265 
266 /* Bits in Config3 */
267 enum Config3Bits {
268     Cfg3_FBtBEn    = (1 << 0), /* 1 = Fast Back to Back */
269     Cfg3_FuncRegEn = (1 << 1), /* 1 = enable CardBus Function registers */
270     Cfg3_CLKRUN_En = (1 << 2), /* 1 = enable CLKRUN */
271     Cfg3_CardB_En  = (1 << 3), /* 1 = enable CardBus registers */
272     Cfg3_LinkUp    = (1 << 4), /* 1 = wake up on link up */
273     Cfg3_Magic     = (1 << 5), /* 1 = wake up on Magic Packet (tm) */
274     Cfg3_PARM_En   = (1 << 6), /* 0 = software can set twister parameters */
275     Cfg3_GNTSel    = (1 << 7), /* 1 = delay 1 clock from PCI GNT signal */
276 };
277 
278 /* Bits in Config4 */
279 enum Config4Bits {
280     LWPTN = (1 << 2),    /* not on 8139, 8139A */
281 };
282 
283 /* Bits in Config5 */
284 enum Config5Bits {
285     Cfg5_PME_STS     = (1 << 0), /* 1 = PCI reset resets PME_Status */
286     Cfg5_LANWake     = (1 << 1), /* 1 = enable LANWake signal */
287     Cfg5_LDPS        = (1 << 2), /* 0 = save power when link is down */
288     Cfg5_FIFOAddrPtr = (1 << 3), /* Realtek internal SRAM testing */
289     Cfg5_UWF         = (1 << 4), /* 1 = accept unicast wakeup frame */
290     Cfg5_MWF         = (1 << 5), /* 1 = accept multicast wakeup frame */
291     Cfg5_BWF         = (1 << 6), /* 1 = accept broadcast wakeup frame */
292 };
293 
294 enum RxConfigBits {
295     /* rx fifo threshold */
296     RxCfgFIFOShift = 13,
297     RxCfgFIFONone = (7 << RxCfgFIFOShift),
298 
299     /* Max DMA burst */
300     RxCfgDMAShift = 8,
301     RxCfgDMAUnlimited = (7 << RxCfgDMAShift),
302 
303     /* rx ring buffer length */
304     RxCfgRcv8K = 0,
305     RxCfgRcv16K = (1 << 11),
306     RxCfgRcv32K = (1 << 12),
307     RxCfgRcv64K = (1 << 11) | (1 << 12),
308 
309     /* Disable packet wrap at end of Rx buffer. (not possible with 64k) */
310     RxNoWrap = (1 << 7),
311 };
312 
313 /* Twister tuning parameters from RealTek.
314    Completely undocumented, but required to tune bad links on some boards. */
315 /*
316 enum CSCRBits {
317     CSCR_LinkOKBit = 0x0400,
318     CSCR_LinkChangeBit = 0x0800,
319     CSCR_LinkStatusBits = 0x0f000,
320     CSCR_LinkDownOffCmd = 0x003c0,
321     CSCR_LinkDownCmd = 0x0f3c0,
322 */
323 enum CSCRBits {
324     CSCR_Testfun = 1<<15, /* 1 = Auto-neg speeds up internal timer, WO, def 0 */
325     CSCR_LD  = 1<<9,  /* Active low TPI link disable signal. When low, TPI still transmits link pulses and TPI stays in good link state. def 1*/
326     CSCR_HEART_BIT = 1<<8,  /* 1 = HEART BEAT enable, 0 = HEART BEAT disable. HEART BEAT function is only valid in 10Mbps mode. def 1*/
327     CSCR_JBEN = 1<<7,  /* 1 = enable jabber function. 0 = disable jabber function, def 1*/
328     CSCR_F_LINK_100 = 1<<6, /* Used to login force good link in 100Mbps for diagnostic purposes. 1 = DISABLE, 0 = ENABLE. def 1*/
329     CSCR_F_Connect  = 1<<5,  /* Assertion of this bit forces the disconnect function to be bypassed. def 0*/
330     CSCR_Con_status = 1<<3, /* This bit indicates the status of the connection. 1 = valid connected link detected; 0 = disconnected link detected. RO def 0*/
331     CSCR_Con_status_En = 1<<2, /* Assertion of this bit configures LED1 pin to indicate connection status. def 0*/
332     CSCR_PASS_SCR = 1<<0, /* Bypass Scramble, def 0*/
333 };
334 
335 enum Cfg9346Bits {
336     Cfg9346_Normal = 0x00,
337     Cfg9346_Autoload = 0x40,
338     Cfg9346_Programming = 0x80,
339     Cfg9346_ConfigWrite = 0xC0,
340 };
341 
342 typedef enum {
343     CH_8139 = 0,
344     CH_8139_K,
345     CH_8139A,
346     CH_8139A_G,
347     CH_8139B,
348     CH_8130,
349     CH_8139C,
350     CH_8100,
351     CH_8100B_8139D,
352     CH_8101,
353 } chip_t;
354 
355 enum chip_flags {
356     HasHltClk = (1 << 0),
357     HasLWake = (1 << 1),
358 };
359 
360 #define HW_REVID(b30, b29, b28, b27, b26, b23, b22) \
361     (b30<<30 | b29<<29 | b28<<28 | b27<<27 | b26<<26 | b23<<23 | b22<<22)
362 #define HW_REVID_MASK    HW_REVID(1, 1, 1, 1, 1, 1, 1)
363 
364 #define RTL8139_PCI_REVID_8139      0x10
365 #define RTL8139_PCI_REVID_8139CPLUS 0x20
366 
367 #define RTL8139_PCI_REVID           RTL8139_PCI_REVID_8139CPLUS
368 
369 /* Size is 64 * 16bit words */
370 #define EEPROM_9346_ADDR_BITS 6
371 #define EEPROM_9346_SIZE  (1 << EEPROM_9346_ADDR_BITS)
372 #define EEPROM_9346_ADDR_MASK (EEPROM_9346_SIZE - 1)
373 
374 enum Chip9346Operation
375 {
376     Chip9346_op_mask = 0xc0,          /* 10 zzzzzz */
377     Chip9346_op_read = 0x80,          /* 10 AAAAAA */
378     Chip9346_op_write = 0x40,         /* 01 AAAAAA D(15)..D(0) */
379     Chip9346_op_ext_mask = 0xf0,      /* 11 zzzzzz */
380     Chip9346_op_write_enable = 0x30,  /* 00 11zzzz */
381     Chip9346_op_write_all = 0x10,     /* 00 01zzzz */
382     Chip9346_op_write_disable = 0x00, /* 00 00zzzz */
383 };
384 
385 enum Chip9346Mode
386 {
387     Chip9346_none = 0,
388     Chip9346_enter_command_mode,
389     Chip9346_read_command,
390     Chip9346_data_read,      /* from output register */
391     Chip9346_data_write,     /* to input register, then to contents at specified address */
392     Chip9346_data_write_all, /* to input register, then filling contents */
393 };
394 
395 typedef struct EEprom9346
396 {
397     uint16_t contents[EEPROM_9346_SIZE];
398     int      mode;
399     uint32_t tick;
400     uint8_t  address;
401     uint16_t input;
402     uint16_t output;
403 
404     uint8_t eecs;
405     uint8_t eesk;
406     uint8_t eedi;
407     uint8_t eedo;
408 } EEprom9346;
409 
410 typedef struct RTL8139TallyCounters
411 {
412     /* Tally counters */
413     uint64_t   TxOk;
414     uint64_t   RxOk;
415     uint64_t   TxERR;
416     uint32_t   RxERR;
417     uint16_t   MissPkt;
418     uint16_t   FAE;
419     uint32_t   Tx1Col;
420     uint32_t   TxMCol;
421     uint64_t   RxOkPhy;
422     uint64_t   RxOkBrd;
423     uint32_t   RxOkMul;
424     uint16_t   TxAbt;
425     uint16_t   TxUndrn;
426 } RTL8139TallyCounters;
427 
428 /* Clears all tally counters */
429 static void RTL8139TallyCounters_clear(RTL8139TallyCounters* counters);
430 
431 struct RTL8139State {
432     /*< private >*/
433     PCIDevice parent_obj;
434     /*< public >*/
435 
436     uint8_t phys[8]; /* mac address */
437     uint8_t mult[8]; /* multicast mask array */
438 
439     uint32_t TxStatus[4]; /* TxStatus0 in C mode*/ /* also DTCCR[0] and DTCCR[1] in C+ mode */
440     uint32_t TxAddr[4];   /* TxAddr0 */
441     uint32_t RxBuf;       /* Receive buffer */
442     uint32_t RxBufferSize;/* internal variable, receive ring buffer size in C mode */
443     uint32_t RxBufPtr;
444     uint32_t RxBufAddr;
445 
446     uint16_t IntrStatus;
447     uint16_t IntrMask;
448 
449     uint32_t TxConfig;
450     uint32_t RxConfig;
451     uint32_t RxMissed;
452 
453     uint16_t CSCR;
454 
455     uint8_t  Cfg9346;
456     uint8_t  Config0;
457     uint8_t  Config1;
458     uint8_t  Config3;
459     uint8_t  Config4;
460     uint8_t  Config5;
461 
462     uint8_t  clock_enabled;
463     uint8_t  bChipCmdState;
464 
465     uint16_t MultiIntr;
466 
467     uint16_t BasicModeCtrl;
468     uint16_t BasicModeStatus;
469     uint16_t NWayAdvert;
470     uint16_t NWayLPAR;
471     uint16_t NWayExpansion;
472 
473     uint16_t CpCmd;
474     uint8_t  TxThresh;
475 
476     NICState *nic;
477     NICConf conf;
478 
479     /* C ring mode */
480     uint32_t   currTxDesc;
481 
482     /* C+ mode */
483     uint32_t   cplus_enabled;
484 
485     uint32_t   currCPlusRxDesc;
486     uint32_t   currCPlusTxDesc;
487 
488     uint32_t   RxRingAddrLO;
489     uint32_t   RxRingAddrHI;
490 
491     EEprom9346 eeprom;
492 
493     uint32_t   TCTR;
494     uint32_t   TimerInt;
495     int64_t    TCTR_base;
496 
497     /* Tally counters */
498     RTL8139TallyCounters tally_counters;
499 
500     /* Non-persistent data */
501     uint8_t   *cplus_txbuffer;
502     int        cplus_txbuffer_len;
503     int        cplus_txbuffer_offset;
504 
505     /* PCI interrupt timer */
506     QEMUTimer *timer;
507 
508     MemoryRegion bar_io;
509     MemoryRegion bar_mem;
510 
511     /* Support migration to/from old versions */
512     int rtl8139_mmio_io_addr_dummy;
513 };
514 
515 /* Writes tally counters to memory via DMA */
516 static void RTL8139TallyCounters_dma_write(RTL8139State *s, dma_addr_t tc_addr);
517 
518 static void rtl8139_set_next_tctr_time(RTL8139State *s);
519 
prom9346_decode_command(EEprom9346 * eeprom,uint8_t command)520 static void prom9346_decode_command(EEprom9346 *eeprom, uint8_t command)
521 {
522     DPRINTF("eeprom command 0x%02x\n", command);
523 
524     switch (command & Chip9346_op_mask)
525     {
526         case Chip9346_op_read:
527         {
528             eeprom->address = command & EEPROM_9346_ADDR_MASK;
529             eeprom->output = eeprom->contents[eeprom->address];
530             eeprom->eedo = 0;
531             eeprom->tick = 0;
532             eeprom->mode = Chip9346_data_read;
533             DPRINTF("eeprom read from address 0x%02x data=0x%04x\n",
534                 eeprom->address, eeprom->output);
535         }
536         break;
537 
538         case Chip9346_op_write:
539         {
540             eeprom->address = command & EEPROM_9346_ADDR_MASK;
541             eeprom->input = 0;
542             eeprom->tick = 0;
543             eeprom->mode = Chip9346_none; /* Chip9346_data_write */
544             DPRINTF("eeprom begin write to address 0x%02x\n",
545                 eeprom->address);
546         }
547         break;
548         default:
549             eeprom->mode = Chip9346_none;
550             switch (command & Chip9346_op_ext_mask)
551             {
552                 case Chip9346_op_write_enable:
553                     DPRINTF("eeprom write enabled\n");
554                     break;
555                 case Chip9346_op_write_all:
556                     DPRINTF("eeprom begin write all\n");
557                     break;
558                 case Chip9346_op_write_disable:
559                     DPRINTF("eeprom write disabled\n");
560                     break;
561             }
562             break;
563     }
564 }
565 
prom9346_shift_clock(EEprom9346 * eeprom)566 static void prom9346_shift_clock(EEprom9346 *eeprom)
567 {
568     int bit = eeprom->eedi?1:0;
569 
570     ++ eeprom->tick;
571 
572     DPRINTF("eeprom: tick %d eedi=%d eedo=%d\n", eeprom->tick, eeprom->eedi,
573         eeprom->eedo);
574 
575     switch (eeprom->mode)
576     {
577         case Chip9346_enter_command_mode:
578             if (bit)
579             {
580                 eeprom->mode = Chip9346_read_command;
581                 eeprom->tick = 0;
582                 eeprom->input = 0;
583                 DPRINTF("eeprom: +++ synchronized, begin command read\n");
584             }
585             break;
586 
587         case Chip9346_read_command:
588             eeprom->input = (eeprom->input << 1) | (bit & 1);
589             if (eeprom->tick == 8)
590             {
591                 prom9346_decode_command(eeprom, eeprom->input & 0xff);
592             }
593             break;
594 
595         case Chip9346_data_read:
596             eeprom->eedo = (eeprom->output & 0x8000)?1:0;
597             eeprom->output <<= 1;
598             if (eeprom->tick == 16)
599             {
600 #if 1
601         // the FreeBSD drivers (rl and re) don't explicitly toggle
602         // CS between reads (or does setting Cfg9346 to 0 count too?),
603         // so we need to enter wait-for-command state here
604                 eeprom->mode = Chip9346_enter_command_mode;
605                 eeprom->input = 0;
606                 eeprom->tick = 0;
607 
608                 DPRINTF("eeprom: +++ end of read, awaiting next command\n");
609 #else
610         // original behaviour
611                 ++eeprom->address;
612                 eeprom->address &= EEPROM_9346_ADDR_MASK;
613                 eeprom->output = eeprom->contents[eeprom->address];
614                 eeprom->tick = 0;
615 
616                 DPRINTF("eeprom: +++ read next address 0x%02x data=0x%04x\n",
617                     eeprom->address, eeprom->output);
618 #endif
619             }
620             break;
621 
622         case Chip9346_data_write:
623             eeprom->input = (eeprom->input << 1) | (bit & 1);
624             if (eeprom->tick == 16)
625             {
626                 DPRINTF("eeprom write to address 0x%02x data=0x%04x\n",
627                     eeprom->address, eeprom->input);
628 
629                 eeprom->contents[eeprom->address] = eeprom->input;
630                 eeprom->mode = Chip9346_none; /* waiting for next command after CS cycle */
631                 eeprom->tick = 0;
632                 eeprom->input = 0;
633             }
634             break;
635 
636         case Chip9346_data_write_all:
637             eeprom->input = (eeprom->input << 1) | (bit & 1);
638             if (eeprom->tick == 16)
639             {
640                 int i;
641                 for (i = 0; i < EEPROM_9346_SIZE; i++)
642                 {
643                     eeprom->contents[i] = eeprom->input;
644                 }
645                 DPRINTF("eeprom filled with data=0x%04x\n", eeprom->input);
646 
647                 eeprom->mode = Chip9346_enter_command_mode;
648                 eeprom->tick = 0;
649                 eeprom->input = 0;
650             }
651             break;
652 
653         default:
654             break;
655     }
656 }
657 
prom9346_get_wire(RTL8139State * s)658 static int prom9346_get_wire(RTL8139State *s)
659 {
660     EEprom9346 *eeprom = &s->eeprom;
661     if (!eeprom->eecs)
662         return 0;
663 
664     return eeprom->eedo;
665 }
666 
667 /* FIXME: This should be merged into/replaced by eeprom93xx.c.  */
prom9346_set_wire(RTL8139State * s,int eecs,int eesk,int eedi)668 static void prom9346_set_wire(RTL8139State *s, int eecs, int eesk, int eedi)
669 {
670     EEprom9346 *eeprom = &s->eeprom;
671     uint8_t old_eecs = eeprom->eecs;
672     uint8_t old_eesk = eeprom->eesk;
673 
674     eeprom->eecs = eecs;
675     eeprom->eesk = eesk;
676     eeprom->eedi = eedi;
677 
678     DPRINTF("eeprom: +++ wires CS=%d SK=%d DI=%d DO=%d\n", eeprom->eecs,
679         eeprom->eesk, eeprom->eedi, eeprom->eedo);
680 
681     if (!old_eecs && eecs)
682     {
683         /* Synchronize start */
684         eeprom->tick = 0;
685         eeprom->input = 0;
686         eeprom->output = 0;
687         eeprom->mode = Chip9346_enter_command_mode;
688 
689         DPRINTF("=== eeprom: begin access, enter command mode\n");
690     }
691 
692     if (!eecs)
693     {
694         DPRINTF("=== eeprom: end access\n");
695         return;
696     }
697 
698     if (!old_eesk && eesk)
699     {
700         /* SK front rules */
701         prom9346_shift_clock(eeprom);
702     }
703 }
704 
rtl8139_update_irq(RTL8139State * s)705 static void rtl8139_update_irq(RTL8139State *s)
706 {
707     PCIDevice *d = PCI_DEVICE(s);
708     int isr;
709     isr = (s->IntrStatus & s->IntrMask) & 0xffff;
710 
711     DPRINTF("Set IRQ to %d (%04x %04x)\n", isr ? 1 : 0, s->IntrStatus,
712         s->IntrMask);
713 
714     pci_set_irq(d, (isr != 0));
715 }
716 
rtl8139_RxWrap(RTL8139State * s)717 static int rtl8139_RxWrap(RTL8139State *s)
718 {
719     /* wrapping enabled; assume 1.5k more buffer space if size < 65536 */
720     return (s->RxConfig & (1 << 7));
721 }
722 
rtl8139_receiver_enabled(RTL8139State * s)723 static int rtl8139_receiver_enabled(RTL8139State *s)
724 {
725     return s->bChipCmdState & CmdRxEnb;
726 }
727 
rtl8139_transmitter_enabled(RTL8139State * s)728 static int rtl8139_transmitter_enabled(RTL8139State *s)
729 {
730     return s->bChipCmdState & CmdTxEnb;
731 }
732 
rtl8139_cp_receiver_enabled(RTL8139State * s)733 static int rtl8139_cp_receiver_enabled(RTL8139State *s)
734 {
735     return s->CpCmd & CPlusRxEnb;
736 }
737 
rtl8139_cp_transmitter_enabled(RTL8139State * s)738 static int rtl8139_cp_transmitter_enabled(RTL8139State *s)
739 {
740     return s->CpCmd & CPlusTxEnb;
741 }
742 
rtl8139_write_buffer(RTL8139State * s,const void * buf,int size)743 static void rtl8139_write_buffer(RTL8139State *s, const void *buf, int size)
744 {
745     PCIDevice *d = PCI_DEVICE(s);
746 
747     if (s->RxBufAddr + size > s->RxBufferSize)
748     {
749         int wrapped = MOD2(s->RxBufAddr + size, s->RxBufferSize);
750 
751         /* write packet data */
752         if (wrapped && !(s->RxBufferSize < 65536 && rtl8139_RxWrap(s)))
753         {
754             DPRINTF(">>> rx packet wrapped in buffer at %d\n", size - wrapped);
755 
756             if (size > wrapped)
757             {
758                 pci_dma_write(d, s->RxBuf + s->RxBufAddr,
759                               buf, size-wrapped);
760             }
761 
762             /* reset buffer pointer */
763             s->RxBufAddr = 0;
764 
765             pci_dma_write(d, s->RxBuf + s->RxBufAddr,
766                           buf + (size-wrapped), wrapped);
767 
768             s->RxBufAddr = wrapped;
769 
770             return;
771         }
772     }
773 
774     /* non-wrapping path or overwrapping enabled */
775     pci_dma_write(d, s->RxBuf + s->RxBufAddr, buf, size);
776 
777     s->RxBufAddr += size;
778 }
779 
780 #define MIN_BUF_SIZE 60
rtl8139_addr64(uint32_t low,uint32_t high)781 static inline dma_addr_t rtl8139_addr64(uint32_t low, uint32_t high)
782 {
783     return low | ((uint64_t)high << 32);
784 }
785 
786 /* Workaround for buggy guest driver such as linux who allocates rx
787  * rings after the receiver were enabled. */
rtl8139_cp_rx_valid(RTL8139State * s)788 static bool rtl8139_cp_rx_valid(RTL8139State *s)
789 {
790     return !(s->RxRingAddrLO == 0 && s->RxRingAddrHI == 0);
791 }
792 
rtl8139_can_receive(NetClientState * nc)793 static bool rtl8139_can_receive(NetClientState *nc)
794 {
795     RTL8139State *s = qemu_get_nic_opaque(nc);
796     int avail;
797 
798     /* Receive (drop) packets if card is disabled.  */
799     if (!s->clock_enabled) {
800         return true;
801     }
802     if (!rtl8139_receiver_enabled(s)) {
803         return true;
804     }
805 
806     if (rtl8139_cp_receiver_enabled(s) && rtl8139_cp_rx_valid(s)) {
807         /* ??? Flow control not implemented in c+ mode.
808            This is a hack to work around slirp deficiencies anyway.  */
809         return true;
810     }
811 
812     avail = MOD2(s->RxBufferSize + s->RxBufPtr - s->RxBufAddr,
813                  s->RxBufferSize);
814     return avail == 0 || avail >= 1514 || (s->IntrMask & RxOverflow);
815 }
816 
rtl8139_do_receive(NetClientState * nc,const uint8_t * buf,size_t size_,int do_interrupt)817 static ssize_t rtl8139_do_receive(NetClientState *nc, const uint8_t *buf, size_t size_, int do_interrupt)
818 {
819     RTL8139State *s = qemu_get_nic_opaque(nc);
820     PCIDevice *d = PCI_DEVICE(s);
821     /* size is the length of the buffer passed to the driver */
822     size_t size = size_;
823     const uint8_t *dot1q_buf = NULL;
824 
825     uint32_t packet_header = 0;
826 
827     static const uint8_t broadcast_macaddr[6] =
828         { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff };
829 
830     DPRINTF(">>> received len=%zu\n", size);
831 
832     /* test if board clock is stopped */
833     if (!s->clock_enabled)
834     {
835         DPRINTF("stopped ==========================\n");
836         return -1;
837     }
838 
839     /* first check if receiver is enabled */
840 
841     if (!rtl8139_receiver_enabled(s))
842     {
843         DPRINTF("receiver disabled ================\n");
844         return -1;
845     }
846 
847     /* XXX: check this */
848     if (s->RxConfig & AcceptAllPhys) {
849         /* promiscuous: receive all */
850         DPRINTF(">>> packet received in promiscuous mode\n");
851 
852     } else {
853         if (!memcmp(buf,  broadcast_macaddr, 6)) {
854             /* broadcast address */
855             if (!(s->RxConfig & AcceptBroadcast))
856             {
857                 DPRINTF(">>> broadcast packet rejected\n");
858 
859                 /* update tally counter */
860                 ++s->tally_counters.RxERR;
861 
862                 return size;
863             }
864 
865             packet_header |= RxBroadcast;
866 
867             DPRINTF(">>> broadcast packet received\n");
868 
869             /* update tally counter */
870             ++s->tally_counters.RxOkBrd;
871 
872         } else if (buf[0] & 0x01) {
873             /* multicast */
874             if (!(s->RxConfig & AcceptMulticast))
875             {
876                 DPRINTF(">>> multicast packet rejected\n");
877 
878                 /* update tally counter */
879                 ++s->tally_counters.RxERR;
880 
881                 return size;
882             }
883 
884             int mcast_idx = net_crc32(buf, ETH_ALEN) >> 26;
885 
886             if (!(s->mult[mcast_idx >> 3] & (1 << (mcast_idx & 7))))
887             {
888                 DPRINTF(">>> multicast address mismatch\n");
889 
890                 /* update tally counter */
891                 ++s->tally_counters.RxERR;
892 
893                 return size;
894             }
895 
896             packet_header |= RxMulticast;
897 
898             DPRINTF(">>> multicast packet received\n");
899 
900             /* update tally counter */
901             ++s->tally_counters.RxOkMul;
902 
903         } else if (s->phys[0] == buf[0] &&
904                    s->phys[1] == buf[1] &&
905                    s->phys[2] == buf[2] &&
906                    s->phys[3] == buf[3] &&
907                    s->phys[4] == buf[4] &&
908                    s->phys[5] == buf[5]) {
909             /* match */
910             if (!(s->RxConfig & AcceptMyPhys))
911             {
912                 DPRINTF(">>> rejecting physical address matching packet\n");
913 
914                 /* update tally counter */
915                 ++s->tally_counters.RxERR;
916 
917                 return size;
918             }
919 
920             packet_header |= RxPhysical;
921 
922             DPRINTF(">>> physical address matching packet received\n");
923 
924             /* update tally counter */
925             ++s->tally_counters.RxOkPhy;
926 
927         } else {
928 
929             DPRINTF(">>> unknown packet\n");
930 
931             /* update tally counter */
932             ++s->tally_counters.RxERR;
933 
934             return size;
935         }
936     }
937 
938     if (rtl8139_cp_receiver_enabled(s))
939     {
940         if (!rtl8139_cp_rx_valid(s)) {
941             return size;
942         }
943 
944         DPRINTF("in C+ Rx mode ================\n");
945 
946         /* begin C+ receiver mode */
947 
948 /* w0 ownership flag */
949 #define CP_RX_OWN (1<<31)
950 /* w0 end of ring flag */
951 #define CP_RX_EOR (1<<30)
952 /* w0 bits 0...12 : buffer size */
953 #define CP_RX_BUFFER_SIZE_MASK ((1<<13) - 1)
954 /* w1 tag available flag */
955 #define CP_RX_TAVA (1<<16)
956 /* w1 bits 0...15 : VLAN tag */
957 #define CP_RX_VLAN_TAG_MASK ((1<<16) - 1)
958 /* w2 low  32bit of Rx buffer ptr */
959 /* w3 high 32bit of Rx buffer ptr */
960 
961         int descriptor = s->currCPlusRxDesc;
962         dma_addr_t cplus_rx_ring_desc;
963 
964         cplus_rx_ring_desc = rtl8139_addr64(s->RxRingAddrLO, s->RxRingAddrHI);
965         cplus_rx_ring_desc += 16 * descriptor;
966 
967         DPRINTF("+++ C+ mode reading RX descriptor %d from host memory at "
968             "%08x %08x = "DMA_ADDR_FMT"\n", descriptor, s->RxRingAddrHI,
969             s->RxRingAddrLO, cplus_rx_ring_desc);
970 
971         uint32_t val, rxdw0,rxdw1,rxbufLO,rxbufHI;
972 
973         pci_dma_read(d, cplus_rx_ring_desc, &val, 4);
974         rxdw0 = le32_to_cpu(val);
975         pci_dma_read(d, cplus_rx_ring_desc+4, &val, 4);
976         rxdw1 = le32_to_cpu(val);
977         pci_dma_read(d, cplus_rx_ring_desc+8, &val, 4);
978         rxbufLO = le32_to_cpu(val);
979         pci_dma_read(d, cplus_rx_ring_desc+12, &val, 4);
980         rxbufHI = le32_to_cpu(val);
981 
982         DPRINTF("+++ C+ mode RX descriptor %d %08x %08x %08x %08x\n",
983             descriptor, rxdw0, rxdw1, rxbufLO, rxbufHI);
984 
985         if (!(rxdw0 & CP_RX_OWN))
986         {
987             DPRINTF("C+ Rx mode : descriptor %d is owned by host\n",
988                 descriptor);
989 
990             s->IntrStatus |= RxOverflow;
991             ++s->RxMissed;
992 
993             /* update tally counter */
994             ++s->tally_counters.RxERR;
995             ++s->tally_counters.MissPkt;
996 
997             rtl8139_update_irq(s);
998             return size_;
999         }
1000 
1001         uint32_t rx_space = rxdw0 & CP_RX_BUFFER_SIZE_MASK;
1002 
1003         /* write VLAN info to descriptor variables. */
1004         if (s->CpCmd & CPlusRxVLAN &&
1005             lduw_be_p(&buf[ETH_ALEN * 2]) == ETH_P_VLAN) {
1006             dot1q_buf = &buf[ETH_ALEN * 2];
1007             size -= VLAN_HLEN;
1008             /* if too small buffer, use the tailroom added duing expansion */
1009             if (size < MIN_BUF_SIZE) {
1010                 size = MIN_BUF_SIZE;
1011             }
1012 
1013             rxdw1 &= ~CP_RX_VLAN_TAG_MASK;
1014             /* BE + ~le_to_cpu()~ + cpu_to_le() = BE */
1015             rxdw1 |= CP_RX_TAVA | lduw_le_p(&dot1q_buf[ETHER_TYPE_LEN]);
1016 
1017             DPRINTF("C+ Rx mode : extracted vlan tag with tci: ""%u\n",
1018                 lduw_be_p(&dot1q_buf[ETHER_TYPE_LEN]));
1019         } else {
1020             /* reset VLAN tag flag */
1021             rxdw1 &= ~CP_RX_TAVA;
1022         }
1023 
1024         /* TODO: scatter the packet over available receive ring descriptors space */
1025 
1026         if (size+4 > rx_space)
1027         {
1028             DPRINTF("C+ Rx mode : descriptor %d size %d received %zu + 4\n",
1029                 descriptor, rx_space, size);
1030 
1031             s->IntrStatus |= RxOverflow;
1032             ++s->RxMissed;
1033 
1034             /* update tally counter */
1035             ++s->tally_counters.RxERR;
1036             ++s->tally_counters.MissPkt;
1037 
1038             rtl8139_update_irq(s);
1039             return size_;
1040         }
1041 
1042         dma_addr_t rx_addr = rtl8139_addr64(rxbufLO, rxbufHI);
1043 
1044         /* receive/copy to target memory */
1045         if (dot1q_buf) {
1046             pci_dma_write(d, rx_addr, buf, 2 * ETH_ALEN);
1047             pci_dma_write(d, rx_addr + 2 * ETH_ALEN,
1048                           buf + 2 * ETH_ALEN + VLAN_HLEN,
1049                           size - 2 * ETH_ALEN);
1050         } else {
1051             pci_dma_write(d, rx_addr, buf, size);
1052         }
1053 
1054         if (s->CpCmd & CPlusRxChkSum)
1055         {
1056             /* do some packet checksumming */
1057         }
1058 
1059         /* write checksum */
1060         val = cpu_to_le32(crc32(0, buf, size_));
1061         pci_dma_write(d, rx_addr+size, (uint8_t *)&val, 4);
1062 
1063 /* first segment of received packet flag */
1064 #define CP_RX_STATUS_FS (1<<29)
1065 /* last segment of received packet flag */
1066 #define CP_RX_STATUS_LS (1<<28)
1067 /* multicast packet flag */
1068 #define CP_RX_STATUS_MAR (1<<26)
1069 /* physical-matching packet flag */
1070 #define CP_RX_STATUS_PAM (1<<25)
1071 /* broadcast packet flag */
1072 #define CP_RX_STATUS_BAR (1<<24)
1073 /* runt packet flag */
1074 #define CP_RX_STATUS_RUNT (1<<19)
1075 /* crc error flag */
1076 #define CP_RX_STATUS_CRC (1<<18)
1077 /* IP checksum error flag */
1078 #define CP_RX_STATUS_IPF (1<<15)
1079 /* UDP checksum error flag */
1080 #define CP_RX_STATUS_UDPF (1<<14)
1081 /* TCP checksum error flag */
1082 #define CP_RX_STATUS_TCPF (1<<13)
1083 
1084         /* transfer ownership to target */
1085         rxdw0 &= ~CP_RX_OWN;
1086 
1087         /* set first segment bit */
1088         rxdw0 |= CP_RX_STATUS_FS;
1089 
1090         /* set last segment bit */
1091         rxdw0 |= CP_RX_STATUS_LS;
1092 
1093         /* set received packet type flags */
1094         if (packet_header & RxBroadcast)
1095             rxdw0 |= CP_RX_STATUS_BAR;
1096         if (packet_header & RxMulticast)
1097             rxdw0 |= CP_RX_STATUS_MAR;
1098         if (packet_header & RxPhysical)
1099             rxdw0 |= CP_RX_STATUS_PAM;
1100 
1101         /* set received size */
1102         rxdw0 &= ~CP_RX_BUFFER_SIZE_MASK;
1103         rxdw0 |= (size+4);
1104 
1105         /* update ring data */
1106         val = cpu_to_le32(rxdw0);
1107         pci_dma_write(d, cplus_rx_ring_desc, (uint8_t *)&val, 4);
1108         val = cpu_to_le32(rxdw1);
1109         pci_dma_write(d, cplus_rx_ring_desc+4, (uint8_t *)&val, 4);
1110 
1111         /* update tally counter */
1112         ++s->tally_counters.RxOk;
1113 
1114         /* seek to next Rx descriptor */
1115         if (rxdw0 & CP_RX_EOR)
1116         {
1117             s->currCPlusRxDesc = 0;
1118         }
1119         else
1120         {
1121             ++s->currCPlusRxDesc;
1122         }
1123 
1124         DPRINTF("done C+ Rx mode ----------------\n");
1125 
1126     }
1127     else
1128     {
1129         DPRINTF("in ring Rx mode ================\n");
1130 
1131         /* begin ring receiver mode */
1132         int avail = MOD2(s->RxBufferSize + s->RxBufPtr - s->RxBufAddr, s->RxBufferSize);
1133 
1134         /* if receiver buffer is empty then avail == 0 */
1135 
1136 #define RX_ALIGN(x) (((x) + 3) & ~0x3)
1137 
1138         if (avail != 0 && RX_ALIGN(size + 8) >= avail)
1139         {
1140             DPRINTF("rx overflow: rx buffer length %d head 0x%04x "
1141                 "read 0x%04x === available 0x%04x need 0x%04zx\n",
1142                 s->RxBufferSize, s->RxBufAddr, s->RxBufPtr, avail, size + 8);
1143 
1144             s->IntrStatus |= RxOverflow;
1145             ++s->RxMissed;
1146             rtl8139_update_irq(s);
1147             return 0;
1148         }
1149 
1150         packet_header |= RxStatusOK;
1151 
1152         packet_header |= (((size+4) << 16) & 0xffff0000);
1153 
1154         /* write header */
1155         uint32_t val = cpu_to_le32(packet_header);
1156 
1157         rtl8139_write_buffer(s, (uint8_t *)&val, 4);
1158 
1159         rtl8139_write_buffer(s, buf, size);
1160 
1161         /* write checksum */
1162         val = cpu_to_le32(crc32(0, buf, size));
1163         rtl8139_write_buffer(s, (uint8_t *)&val, 4);
1164 
1165         /* correct buffer write pointer */
1166         s->RxBufAddr = MOD2(RX_ALIGN(s->RxBufAddr), s->RxBufferSize);
1167 
1168         /* now we can signal we have received something */
1169 
1170         DPRINTF("received: rx buffer length %d head 0x%04x read 0x%04x\n",
1171             s->RxBufferSize, s->RxBufAddr, s->RxBufPtr);
1172     }
1173 
1174     s->IntrStatus |= RxOK;
1175 
1176     if (do_interrupt)
1177     {
1178         rtl8139_update_irq(s);
1179     }
1180 
1181     return size_;
1182 }
1183 
rtl8139_receive(NetClientState * nc,const uint8_t * buf,size_t size)1184 static ssize_t rtl8139_receive(NetClientState *nc, const uint8_t *buf, size_t size)
1185 {
1186     return rtl8139_do_receive(nc, buf, size, 1);
1187 }
1188 
rtl8139_reset_rxring(RTL8139State * s,uint32_t bufferSize)1189 static void rtl8139_reset_rxring(RTL8139State *s, uint32_t bufferSize)
1190 {
1191     s->RxBufferSize = bufferSize;
1192     s->RxBufPtr  = 0;
1193     s->RxBufAddr = 0;
1194 }
1195 
rtl8139_reset_phy(RTL8139State * s)1196 static void rtl8139_reset_phy(RTL8139State *s)
1197 {
1198     s->BasicModeStatus  = 0x7809;
1199     s->BasicModeStatus |= 0x0020; /* autonegotiation completed */
1200     /* preserve link state */
1201     s->BasicModeStatus |= qemu_get_queue(s->nic)->link_down ? 0 : 0x04;
1202 
1203     s->NWayAdvert    = 0x05e1; /* all modes, full duplex */
1204     s->NWayLPAR      = 0x05e1; /* all modes, full duplex */
1205     s->NWayExpansion = 0x0001; /* autonegotiation supported */
1206 
1207     s->CSCR = CSCR_F_LINK_100 | CSCR_HEART_BIT | CSCR_LD;
1208 }
1209 
rtl8139_reset(DeviceState * d)1210 static void rtl8139_reset(DeviceState *d)
1211 {
1212     RTL8139State *s = RTL8139(d);
1213     int i;
1214 
1215     /* restore MAC address */
1216     memcpy(s->phys, s->conf.macaddr.a, 6);
1217     qemu_format_nic_info_str(qemu_get_queue(s->nic), s->phys);
1218 
1219     /* reset interrupt mask */
1220     s->IntrStatus = 0;
1221     s->IntrMask = 0;
1222 
1223     rtl8139_update_irq(s);
1224 
1225     /* mark all status registers as owned by host */
1226     for (i = 0; i < 4; ++i)
1227     {
1228         s->TxStatus[i] = TxHostOwns;
1229     }
1230 
1231     s->currTxDesc = 0;
1232     s->currCPlusRxDesc = 0;
1233     s->currCPlusTxDesc = 0;
1234 
1235     s->RxRingAddrLO = 0;
1236     s->RxRingAddrHI = 0;
1237 
1238     s->RxBuf = 0;
1239 
1240     rtl8139_reset_rxring(s, 8192);
1241 
1242     /* ACK the reset */
1243     s->TxConfig = 0;
1244 
1245 #if 0
1246 //    s->TxConfig |= HW_REVID(1, 0, 0, 0, 0, 0, 0); // RTL-8139  HasHltClk
1247     s->clock_enabled = 0;
1248 #else
1249     s->TxConfig |= HW_REVID(1, 1, 1, 0, 1, 1, 0); // RTL-8139C+ HasLWake
1250     s->clock_enabled = 1;
1251 #endif
1252 
1253     s->bChipCmdState = CmdReset; /* RxBufEmpty bit is calculated on read from ChipCmd */;
1254 
1255     /* set initial state data */
1256     s->Config0 = 0x0; /* No boot ROM */
1257     s->Config1 = 0xC; /* IO mapped and MEM mapped registers available */
1258     s->Config3 = 0x1; /* fast back-to-back compatible */
1259     s->Config5 = 0x0;
1260 
1261     s->CpCmd   = 0x0; /* reset C+ mode */
1262     s->cplus_enabled = 0;
1263 
1264 //    s->BasicModeCtrl = 0x3100; // 100Mbps, full duplex, autonegotiation
1265 //    s->BasicModeCtrl = 0x2100; // 100Mbps, full duplex
1266     s->BasicModeCtrl = 0x1000; // autonegotiation
1267 
1268     rtl8139_reset_phy(s);
1269 
1270     /* also reset timer and disable timer interrupt */
1271     s->TCTR = 0;
1272     s->TimerInt = 0;
1273     s->TCTR_base = 0;
1274     rtl8139_set_next_tctr_time(s);
1275 
1276     /* reset tally counters */
1277     RTL8139TallyCounters_clear(&s->tally_counters);
1278 }
1279 
RTL8139TallyCounters_clear(RTL8139TallyCounters * counters)1280 static void RTL8139TallyCounters_clear(RTL8139TallyCounters* counters)
1281 {
1282     counters->TxOk = 0;
1283     counters->RxOk = 0;
1284     counters->TxERR = 0;
1285     counters->RxERR = 0;
1286     counters->MissPkt = 0;
1287     counters->FAE = 0;
1288     counters->Tx1Col = 0;
1289     counters->TxMCol = 0;
1290     counters->RxOkPhy = 0;
1291     counters->RxOkBrd = 0;
1292     counters->RxOkMul = 0;
1293     counters->TxAbt = 0;
1294     counters->TxUndrn = 0;
1295 }
1296 
RTL8139TallyCounters_dma_write(RTL8139State * s,dma_addr_t tc_addr)1297 static void RTL8139TallyCounters_dma_write(RTL8139State *s, dma_addr_t tc_addr)
1298 {
1299     PCIDevice *d = PCI_DEVICE(s);
1300     RTL8139TallyCounters *tally_counters = &s->tally_counters;
1301     uint16_t val16;
1302     uint32_t val32;
1303     uint64_t val64;
1304 
1305     val64 = cpu_to_le64(tally_counters->TxOk);
1306     pci_dma_write(d, tc_addr + 0,     (uint8_t *)&val64, 8);
1307 
1308     val64 = cpu_to_le64(tally_counters->RxOk);
1309     pci_dma_write(d, tc_addr + 8,     (uint8_t *)&val64, 8);
1310 
1311     val64 = cpu_to_le64(tally_counters->TxERR);
1312     pci_dma_write(d, tc_addr + 16,    (uint8_t *)&val64, 8);
1313 
1314     val32 = cpu_to_le32(tally_counters->RxERR);
1315     pci_dma_write(d, tc_addr + 24,    (uint8_t *)&val32, 4);
1316 
1317     val16 = cpu_to_le16(tally_counters->MissPkt);
1318     pci_dma_write(d, tc_addr + 28,    (uint8_t *)&val16, 2);
1319 
1320     val16 = cpu_to_le16(tally_counters->FAE);
1321     pci_dma_write(d, tc_addr + 30,    (uint8_t *)&val16, 2);
1322 
1323     val32 = cpu_to_le32(tally_counters->Tx1Col);
1324     pci_dma_write(d, tc_addr + 32,    (uint8_t *)&val32, 4);
1325 
1326     val32 = cpu_to_le32(tally_counters->TxMCol);
1327     pci_dma_write(d, tc_addr + 36,    (uint8_t *)&val32, 4);
1328 
1329     val64 = cpu_to_le64(tally_counters->RxOkPhy);
1330     pci_dma_write(d, tc_addr + 40,    (uint8_t *)&val64, 8);
1331 
1332     val64 = cpu_to_le64(tally_counters->RxOkBrd);
1333     pci_dma_write(d, tc_addr + 48,    (uint8_t *)&val64, 8);
1334 
1335     val32 = cpu_to_le32(tally_counters->RxOkMul);
1336     pci_dma_write(d, tc_addr + 56,    (uint8_t *)&val32, 4);
1337 
1338     val16 = cpu_to_le16(tally_counters->TxAbt);
1339     pci_dma_write(d, tc_addr + 60,    (uint8_t *)&val16, 2);
1340 
1341     val16 = cpu_to_le16(tally_counters->TxUndrn);
1342     pci_dma_write(d, tc_addr + 62,    (uint8_t *)&val16, 2);
1343 }
1344 
rtl8139_ChipCmd_write(RTL8139State * s,uint32_t val)1345 static void rtl8139_ChipCmd_write(RTL8139State *s, uint32_t val)
1346 {
1347     DeviceState *d = DEVICE(s);
1348 
1349     val &= 0xff;
1350 
1351     DPRINTF("ChipCmd write val=0x%08x\n", val);
1352 
1353     if (val & CmdReset)
1354     {
1355         DPRINTF("ChipCmd reset\n");
1356         rtl8139_reset(d);
1357     }
1358     if (val & CmdRxEnb)
1359     {
1360         DPRINTF("ChipCmd enable receiver\n");
1361 
1362         s->currCPlusRxDesc = 0;
1363     }
1364     if (val & CmdTxEnb)
1365     {
1366         DPRINTF("ChipCmd enable transmitter\n");
1367 
1368         s->currCPlusTxDesc = 0;
1369     }
1370 
1371     /* mask unwritable bits */
1372     val = SET_MASKED(val, 0xe3, s->bChipCmdState);
1373 
1374     /* Deassert reset pin before next read */
1375     val &= ~CmdReset;
1376 
1377     s->bChipCmdState = val;
1378 }
1379 
rtl8139_RxBufferEmpty(RTL8139State * s)1380 static int rtl8139_RxBufferEmpty(RTL8139State *s)
1381 {
1382     int unread = MOD2(s->RxBufferSize + s->RxBufAddr - s->RxBufPtr, s->RxBufferSize);
1383 
1384     if (unread != 0)
1385     {
1386         DPRINTF("receiver buffer data available 0x%04x\n", unread);
1387         return 0;
1388     }
1389 
1390     DPRINTF("receiver buffer is empty\n");
1391 
1392     return 1;
1393 }
1394 
rtl8139_ChipCmd_read(RTL8139State * s)1395 static uint32_t rtl8139_ChipCmd_read(RTL8139State *s)
1396 {
1397     uint32_t ret = s->bChipCmdState;
1398 
1399     if (rtl8139_RxBufferEmpty(s))
1400         ret |= RxBufEmpty;
1401 
1402     DPRINTF("ChipCmd read val=0x%04x\n", ret);
1403 
1404     return ret;
1405 }
1406 
rtl8139_CpCmd_write(RTL8139State * s,uint32_t val)1407 static void rtl8139_CpCmd_write(RTL8139State *s, uint32_t val)
1408 {
1409     val &= 0xffff;
1410 
1411     DPRINTF("C+ command register write(w) val=0x%04x\n", val);
1412 
1413     s->cplus_enabled = 1;
1414 
1415     /* mask unwritable bits */
1416     val = SET_MASKED(val, 0xff84, s->CpCmd);
1417 
1418     s->CpCmd = val;
1419 }
1420 
rtl8139_CpCmd_read(RTL8139State * s)1421 static uint32_t rtl8139_CpCmd_read(RTL8139State *s)
1422 {
1423     uint32_t ret = s->CpCmd;
1424 
1425     DPRINTF("C+ command register read(w) val=0x%04x\n", ret);
1426 
1427     return ret;
1428 }
1429 
rtl8139_IntrMitigate_write(RTL8139State * s,uint32_t val)1430 static void rtl8139_IntrMitigate_write(RTL8139State *s, uint32_t val)
1431 {
1432     DPRINTF("C+ IntrMitigate register write(w) val=0x%04x\n", val);
1433 }
1434 
rtl8139_IntrMitigate_read(RTL8139State * s)1435 static uint32_t rtl8139_IntrMitigate_read(RTL8139State *s)
1436 {
1437     uint32_t ret = 0;
1438 
1439     DPRINTF("C+ IntrMitigate register read(w) val=0x%04x\n", ret);
1440 
1441     return ret;
1442 }
1443 
rtl8139_config_writable(RTL8139State * s)1444 static int rtl8139_config_writable(RTL8139State *s)
1445 {
1446     if ((s->Cfg9346 & Chip9346_op_mask) == Cfg9346_ConfigWrite)
1447     {
1448         return 1;
1449     }
1450 
1451     DPRINTF("Configuration registers are write-protected\n");
1452 
1453     return 0;
1454 }
1455 
rtl8139_BasicModeCtrl_write(RTL8139State * s,uint32_t val)1456 static void rtl8139_BasicModeCtrl_write(RTL8139State *s, uint32_t val)
1457 {
1458     val &= 0xffff;
1459 
1460     DPRINTF("BasicModeCtrl register write(w) val=0x%04x\n", val);
1461 
1462     /* mask unwritable bits */
1463     uint32_t mask = 0xccff;
1464 
1465     if (1 || !rtl8139_config_writable(s))
1466     {
1467         /* Speed setting and autonegotiation enable bits are read-only */
1468         mask |= 0x3000;
1469         /* Duplex mode setting is read-only */
1470         mask |= 0x0100;
1471     }
1472 
1473     if (val & 0x8000) {
1474         /* Reset PHY */
1475         rtl8139_reset_phy(s);
1476     }
1477 
1478     val = SET_MASKED(val, mask, s->BasicModeCtrl);
1479 
1480     s->BasicModeCtrl = val;
1481 }
1482 
rtl8139_BasicModeCtrl_read(RTL8139State * s)1483 static uint32_t rtl8139_BasicModeCtrl_read(RTL8139State *s)
1484 {
1485     uint32_t ret = s->BasicModeCtrl;
1486 
1487     DPRINTF("BasicModeCtrl register read(w) val=0x%04x\n", ret);
1488 
1489     return ret;
1490 }
1491 
rtl8139_BasicModeStatus_write(RTL8139State * s,uint32_t val)1492 static void rtl8139_BasicModeStatus_write(RTL8139State *s, uint32_t val)
1493 {
1494     val &= 0xffff;
1495 
1496     DPRINTF("BasicModeStatus register write(w) val=0x%04x\n", val);
1497 
1498     /* mask unwritable bits */
1499     val = SET_MASKED(val, 0xff3f, s->BasicModeStatus);
1500 
1501     s->BasicModeStatus = val;
1502 }
1503 
rtl8139_BasicModeStatus_read(RTL8139State * s)1504 static uint32_t rtl8139_BasicModeStatus_read(RTL8139State *s)
1505 {
1506     uint32_t ret = s->BasicModeStatus;
1507 
1508     DPRINTF("BasicModeStatus register read(w) val=0x%04x\n", ret);
1509 
1510     return ret;
1511 }
1512 
rtl8139_Cfg9346_write(RTL8139State * s,uint32_t val)1513 static void rtl8139_Cfg9346_write(RTL8139State *s, uint32_t val)
1514 {
1515     DeviceState *d = DEVICE(s);
1516 
1517     val &= 0xff;
1518 
1519     DPRINTF("Cfg9346 write val=0x%02x\n", val);
1520 
1521     /* mask unwritable bits */
1522     val = SET_MASKED(val, 0x31, s->Cfg9346);
1523 
1524     uint32_t opmode = val & 0xc0;
1525     uint32_t eeprom_val = val & 0xf;
1526 
1527     if (opmode == 0x80) {
1528         /* eeprom access */
1529         int eecs = (eeprom_val & 0x08)?1:0;
1530         int eesk = (eeprom_val & 0x04)?1:0;
1531         int eedi = (eeprom_val & 0x02)?1:0;
1532         prom9346_set_wire(s, eecs, eesk, eedi);
1533     } else if (opmode == 0x40) {
1534         /* Reset.  */
1535         val = 0;
1536         rtl8139_reset(d);
1537     }
1538 
1539     s->Cfg9346 = val;
1540 }
1541 
rtl8139_Cfg9346_read(RTL8139State * s)1542 static uint32_t rtl8139_Cfg9346_read(RTL8139State *s)
1543 {
1544     uint32_t ret = s->Cfg9346;
1545 
1546     uint32_t opmode = ret & 0xc0;
1547 
1548     if (opmode == 0x80)
1549     {
1550         /* eeprom access */
1551         int eedo = prom9346_get_wire(s);
1552         if (eedo)
1553         {
1554             ret |=  0x01;
1555         }
1556         else
1557         {
1558             ret &= ~0x01;
1559         }
1560     }
1561 
1562     DPRINTF("Cfg9346 read val=0x%02x\n", ret);
1563 
1564     return ret;
1565 }
1566 
rtl8139_Config0_write(RTL8139State * s,uint32_t val)1567 static void rtl8139_Config0_write(RTL8139State *s, uint32_t val)
1568 {
1569     val &= 0xff;
1570 
1571     DPRINTF("Config0 write val=0x%02x\n", val);
1572 
1573     if (!rtl8139_config_writable(s)) {
1574         return;
1575     }
1576 
1577     /* mask unwritable bits */
1578     val = SET_MASKED(val, 0xf8, s->Config0);
1579 
1580     s->Config0 = val;
1581 }
1582 
rtl8139_Config0_read(RTL8139State * s)1583 static uint32_t rtl8139_Config0_read(RTL8139State *s)
1584 {
1585     uint32_t ret = s->Config0;
1586 
1587     DPRINTF("Config0 read val=0x%02x\n", ret);
1588 
1589     return ret;
1590 }
1591 
rtl8139_Config1_write(RTL8139State * s,uint32_t val)1592 static void rtl8139_Config1_write(RTL8139State *s, uint32_t val)
1593 {
1594     val &= 0xff;
1595 
1596     DPRINTF("Config1 write val=0x%02x\n", val);
1597 
1598     if (!rtl8139_config_writable(s)) {
1599         return;
1600     }
1601 
1602     /* mask unwritable bits */
1603     val = SET_MASKED(val, 0xC, s->Config1);
1604 
1605     s->Config1 = val;
1606 }
1607 
rtl8139_Config1_read(RTL8139State * s)1608 static uint32_t rtl8139_Config1_read(RTL8139State *s)
1609 {
1610     uint32_t ret = s->Config1;
1611 
1612     DPRINTF("Config1 read val=0x%02x\n", ret);
1613 
1614     return ret;
1615 }
1616 
rtl8139_Config3_write(RTL8139State * s,uint32_t val)1617 static void rtl8139_Config3_write(RTL8139State *s, uint32_t val)
1618 {
1619     val &= 0xff;
1620 
1621     DPRINTF("Config3 write val=0x%02x\n", val);
1622 
1623     if (!rtl8139_config_writable(s)) {
1624         return;
1625     }
1626 
1627     /* mask unwritable bits */
1628     val = SET_MASKED(val, 0x8F, s->Config3);
1629 
1630     s->Config3 = val;
1631 }
1632 
rtl8139_Config3_read(RTL8139State * s)1633 static uint32_t rtl8139_Config3_read(RTL8139State *s)
1634 {
1635     uint32_t ret = s->Config3;
1636 
1637     DPRINTF("Config3 read val=0x%02x\n", ret);
1638 
1639     return ret;
1640 }
1641 
rtl8139_Config4_write(RTL8139State * s,uint32_t val)1642 static void rtl8139_Config4_write(RTL8139State *s, uint32_t val)
1643 {
1644     val &= 0xff;
1645 
1646     DPRINTF("Config4 write val=0x%02x\n", val);
1647 
1648     if (!rtl8139_config_writable(s)) {
1649         return;
1650     }
1651 
1652     /* mask unwritable bits */
1653     val = SET_MASKED(val, 0x0a, s->Config4);
1654 
1655     s->Config4 = val;
1656 }
1657 
rtl8139_Config4_read(RTL8139State * s)1658 static uint32_t rtl8139_Config4_read(RTL8139State *s)
1659 {
1660     uint32_t ret = s->Config4;
1661 
1662     DPRINTF("Config4 read val=0x%02x\n", ret);
1663 
1664     return ret;
1665 }
1666 
rtl8139_Config5_write(RTL8139State * s,uint32_t val)1667 static void rtl8139_Config5_write(RTL8139State *s, uint32_t val)
1668 {
1669     val &= 0xff;
1670 
1671     DPRINTF("Config5 write val=0x%02x\n", val);
1672 
1673     /* mask unwritable bits */
1674     val = SET_MASKED(val, 0x80, s->Config5);
1675 
1676     s->Config5 = val;
1677 }
1678 
rtl8139_Config5_read(RTL8139State * s)1679 static uint32_t rtl8139_Config5_read(RTL8139State *s)
1680 {
1681     uint32_t ret = s->Config5;
1682 
1683     DPRINTF("Config5 read val=0x%02x\n", ret);
1684 
1685     return ret;
1686 }
1687 
rtl8139_TxConfig_write(RTL8139State * s,uint32_t val)1688 static void rtl8139_TxConfig_write(RTL8139State *s, uint32_t val)
1689 {
1690     if (!rtl8139_transmitter_enabled(s))
1691     {
1692         DPRINTF("transmitter disabled; no TxConfig write val=0x%08x\n", val);
1693         return;
1694     }
1695 
1696     DPRINTF("TxConfig write val=0x%08x\n", val);
1697 
1698     val = SET_MASKED(val, TxVersionMask | 0x8070f80f, s->TxConfig);
1699 
1700     s->TxConfig = val;
1701 }
1702 
rtl8139_TxConfig_writeb(RTL8139State * s,uint32_t val)1703 static void rtl8139_TxConfig_writeb(RTL8139State *s, uint32_t val)
1704 {
1705     DPRINTF("RTL8139C TxConfig via write(b) val=0x%02x\n", val);
1706 
1707     uint32_t tc = s->TxConfig;
1708     tc &= 0xFFFFFF00;
1709     tc |= (val & 0x000000FF);
1710     rtl8139_TxConfig_write(s, tc);
1711 }
1712 
rtl8139_TxConfig_read(RTL8139State * s)1713 static uint32_t rtl8139_TxConfig_read(RTL8139State *s)
1714 {
1715     uint32_t ret = s->TxConfig;
1716 
1717     DPRINTF("TxConfig read val=0x%04x\n", ret);
1718 
1719     return ret;
1720 }
1721 
rtl8139_RxConfig_write(RTL8139State * s,uint32_t val)1722 static void rtl8139_RxConfig_write(RTL8139State *s, uint32_t val)
1723 {
1724     DPRINTF("RxConfig write val=0x%08x\n", val);
1725 
1726     /* mask unwritable bits */
1727     val = SET_MASKED(val, 0xf0fc0040, s->RxConfig);
1728 
1729     s->RxConfig = val;
1730 
1731     /* reset buffer size and read/write pointers */
1732     rtl8139_reset_rxring(s, 8192 << ((s->RxConfig >> 11) & 0x3));
1733 
1734     DPRINTF("RxConfig write reset buffer size to %d\n", s->RxBufferSize);
1735 }
1736 
rtl8139_RxConfig_read(RTL8139State * s)1737 static uint32_t rtl8139_RxConfig_read(RTL8139State *s)
1738 {
1739     uint32_t ret = s->RxConfig;
1740 
1741     DPRINTF("RxConfig read val=0x%08x\n", ret);
1742 
1743     return ret;
1744 }
1745 
rtl8139_transfer_frame(RTL8139State * s,uint8_t * buf,int size,int do_interrupt,const uint8_t * dot1q_buf)1746 static void rtl8139_transfer_frame(RTL8139State *s, uint8_t *buf, int size,
1747     int do_interrupt, const uint8_t *dot1q_buf)
1748 {
1749     struct iovec *iov = NULL;
1750     struct iovec vlan_iov[3];
1751 
1752     if (!size)
1753     {
1754         DPRINTF("+++ empty ethernet frame\n");
1755         return;
1756     }
1757 
1758     if (dot1q_buf && size >= ETH_ALEN * 2) {
1759         iov = (struct iovec[3]) {
1760             { .iov_base = buf, .iov_len = ETH_ALEN * 2 },
1761             { .iov_base = (void *) dot1q_buf, .iov_len = VLAN_HLEN },
1762             { .iov_base = buf + ETH_ALEN * 2,
1763                 .iov_len = size - ETH_ALEN * 2 },
1764         };
1765 
1766         memcpy(vlan_iov, iov, sizeof(vlan_iov));
1767         iov = vlan_iov;
1768     }
1769 
1770     if (TxLoopBack == (s->TxConfig & TxLoopBack))
1771     {
1772         size_t buf2_size;
1773         uint8_t *buf2;
1774 
1775         if (iov) {
1776             buf2_size = iov_size(iov, 3);
1777             buf2 = g_malloc(buf2_size);
1778             iov_to_buf(iov, 3, 0, buf2, buf2_size);
1779             buf = buf2;
1780         }
1781 
1782         DPRINTF("+++ transmit loopback mode\n");
1783         qemu_receive_packet(qemu_get_queue(s->nic), buf, size);
1784 
1785         if (iov) {
1786             g_free(buf2);
1787         }
1788     }
1789     else
1790     {
1791         if (iov) {
1792             qemu_sendv_packet(qemu_get_queue(s->nic), iov, 3);
1793         } else {
1794             qemu_send_packet(qemu_get_queue(s->nic), buf, size);
1795         }
1796     }
1797 }
1798 
rtl8139_transmit_one(RTL8139State * s,int descriptor)1799 static int rtl8139_transmit_one(RTL8139State *s, int descriptor)
1800 {
1801     if (!rtl8139_transmitter_enabled(s))
1802     {
1803         DPRINTF("+++ cannot transmit from descriptor %d: transmitter "
1804             "disabled\n", descriptor);
1805         return 0;
1806     }
1807 
1808     if (s->TxStatus[descriptor] & TxHostOwns)
1809     {
1810         DPRINTF("+++ cannot transmit from descriptor %d: owned by host "
1811             "(%08x)\n", descriptor, s->TxStatus[descriptor]);
1812         return 0;
1813     }
1814 
1815     DPRINTF("+++ transmitting from descriptor %d\n", descriptor);
1816 
1817     PCIDevice *d = PCI_DEVICE(s);
1818     int txsize = s->TxStatus[descriptor] & 0x1fff;
1819     uint8_t txbuffer[0x2000];
1820 
1821     DPRINTF("+++ transmit reading %d bytes from host memory at 0x%08x\n",
1822         txsize, s->TxAddr[descriptor]);
1823 
1824     pci_dma_read(d, s->TxAddr[descriptor], txbuffer, txsize);
1825 
1826     /* Mark descriptor as transferred */
1827     s->TxStatus[descriptor] |= TxHostOwns;
1828     s->TxStatus[descriptor] |= TxStatOK;
1829 
1830     rtl8139_transfer_frame(s, txbuffer, txsize, 0, NULL);
1831 
1832     DPRINTF("+++ transmitted %d bytes from descriptor %d\n", txsize,
1833         descriptor);
1834 
1835     /* update interrupt */
1836     s->IntrStatus |= TxOK;
1837     rtl8139_update_irq(s);
1838 
1839     return 1;
1840 }
1841 
1842 #define TCP_HEADER_CLEAR_FLAGS(tcp, off) ((tcp)->th_offset_flags &= cpu_to_be16(~TCP_FLAGS_ONLY(off)))
1843 
1844 /* produces ones' complement sum of data */
ones_complement_sum(uint8_t * data,size_t len)1845 static uint16_t ones_complement_sum(uint8_t *data, size_t len)
1846 {
1847     uint32_t result = 0;
1848 
1849     for (; len > 1; data+=2, len-=2)
1850     {
1851         result += *(uint16_t*)data;
1852     }
1853 
1854     /* add the remainder byte */
1855     if (len)
1856     {
1857         uint8_t odd[2] = {*data, 0};
1858         result += *(uint16_t*)odd;
1859     }
1860 
1861     while (result>>16)
1862         result = (result & 0xffff) + (result >> 16);
1863 
1864     return result;
1865 }
1866 
ip_checksum(void * data,size_t len)1867 static uint16_t ip_checksum(void *data, size_t len)
1868 {
1869     return ~ones_complement_sum((uint8_t*)data, len);
1870 }
1871 
rtl8139_cplus_transmit_one(RTL8139State * s)1872 static int rtl8139_cplus_transmit_one(RTL8139State *s)
1873 {
1874     if (!rtl8139_transmitter_enabled(s))
1875     {
1876         DPRINTF("+++ C+ mode: transmitter disabled\n");
1877         return 0;
1878     }
1879 
1880     if (!rtl8139_cp_transmitter_enabled(s))
1881     {
1882         DPRINTF("+++ C+ mode: C+ transmitter disabled\n");
1883         return 0 ;
1884     }
1885 
1886     PCIDevice *d = PCI_DEVICE(s);
1887     int descriptor = s->currCPlusTxDesc;
1888 
1889     dma_addr_t cplus_tx_ring_desc = rtl8139_addr64(s->TxAddr[0], s->TxAddr[1]);
1890 
1891     /* Normal priority ring */
1892     cplus_tx_ring_desc += 16 * descriptor;
1893 
1894     DPRINTF("+++ C+ mode reading TX descriptor %d from host memory at "
1895         "%08x %08x = 0x"DMA_ADDR_FMT"\n", descriptor, s->TxAddr[1],
1896         s->TxAddr[0], cplus_tx_ring_desc);
1897 
1898     uint32_t val, txdw0,txdw1,txbufLO,txbufHI;
1899 
1900     pci_dma_read(d, cplus_tx_ring_desc,    (uint8_t *)&val, 4);
1901     txdw0 = le32_to_cpu(val);
1902     pci_dma_read(d, cplus_tx_ring_desc+4,  (uint8_t *)&val, 4);
1903     txdw1 = le32_to_cpu(val);
1904     pci_dma_read(d, cplus_tx_ring_desc+8,  (uint8_t *)&val, 4);
1905     txbufLO = le32_to_cpu(val);
1906     pci_dma_read(d, cplus_tx_ring_desc+12, (uint8_t *)&val, 4);
1907     txbufHI = le32_to_cpu(val);
1908 
1909     DPRINTF("+++ C+ mode TX descriptor %d %08x %08x %08x %08x\n", descriptor,
1910         txdw0, txdw1, txbufLO, txbufHI);
1911 
1912 /* w0 ownership flag */
1913 #define CP_TX_OWN (1<<31)
1914 /* w0 end of ring flag */
1915 #define CP_TX_EOR (1<<30)
1916 /* first segment of received packet flag */
1917 #define CP_TX_FS (1<<29)
1918 /* last segment of received packet flag */
1919 #define CP_TX_LS (1<<28)
1920 /* large send packet flag */
1921 #define CP_TX_LGSEN (1<<27)
1922 /* large send MSS mask, bits 16...26 */
1923 #define CP_TC_LGSEN_MSS_SHIFT 16
1924 #define CP_TC_LGSEN_MSS_MASK ((1 << 11) - 1)
1925 
1926 /* IP checksum offload flag */
1927 #define CP_TX_IPCS (1<<18)
1928 /* UDP checksum offload flag */
1929 #define CP_TX_UDPCS (1<<17)
1930 /* TCP checksum offload flag */
1931 #define CP_TX_TCPCS (1<<16)
1932 
1933 /* w0 bits 0...15 : buffer size */
1934 #define CP_TX_BUFFER_SIZE (1<<16)
1935 #define CP_TX_BUFFER_SIZE_MASK (CP_TX_BUFFER_SIZE - 1)
1936 /* w1 add tag flag */
1937 #define CP_TX_TAGC (1<<17)
1938 /* w1 bits 0...15 : VLAN tag (big endian) */
1939 #define CP_TX_VLAN_TAG_MASK ((1<<16) - 1)
1940 /* w2 low  32bit of Rx buffer ptr */
1941 /* w3 high 32bit of Rx buffer ptr */
1942 
1943 /* set after transmission */
1944 /* FIFO underrun flag */
1945 #define CP_TX_STATUS_UNF (1<<25)
1946 /* transmit error summary flag, valid if set any of three below */
1947 #define CP_TX_STATUS_TES (1<<23)
1948 /* out-of-window collision flag */
1949 #define CP_TX_STATUS_OWC (1<<22)
1950 /* link failure flag */
1951 #define CP_TX_STATUS_LNKF (1<<21)
1952 /* excessive collisions flag */
1953 #define CP_TX_STATUS_EXC (1<<20)
1954 
1955     if (!(txdw0 & CP_TX_OWN))
1956     {
1957         DPRINTF("C+ Tx mode : descriptor %d is owned by host\n", descriptor);
1958         return 0 ;
1959     }
1960 
1961     DPRINTF("+++ C+ Tx mode : transmitting from descriptor %d\n", descriptor);
1962 
1963     if (txdw0 & CP_TX_FS)
1964     {
1965         DPRINTF("+++ C+ Tx mode : descriptor %d is first segment "
1966             "descriptor\n", descriptor);
1967 
1968         /* reset internal buffer offset */
1969         s->cplus_txbuffer_offset = 0;
1970     }
1971 
1972     int txsize = txdw0 & CP_TX_BUFFER_SIZE_MASK;
1973     dma_addr_t tx_addr = rtl8139_addr64(txbufLO, txbufHI);
1974 
1975     /* make sure we have enough space to assemble the packet */
1976     if (!s->cplus_txbuffer)
1977     {
1978         s->cplus_txbuffer_len = CP_TX_BUFFER_SIZE;
1979         s->cplus_txbuffer = g_malloc(s->cplus_txbuffer_len);
1980         s->cplus_txbuffer_offset = 0;
1981 
1982         DPRINTF("+++ C+ mode transmission buffer allocated space %d\n",
1983             s->cplus_txbuffer_len);
1984     }
1985 
1986     if (s->cplus_txbuffer_offset + txsize >= s->cplus_txbuffer_len)
1987     {
1988         /* The spec didn't tell the maximum size, stick to CP_TX_BUFFER_SIZE */
1989         txsize = s->cplus_txbuffer_len - s->cplus_txbuffer_offset;
1990         DPRINTF("+++ C+ mode transmission buffer overrun, truncated descriptor"
1991                 "length to %d\n", txsize);
1992     }
1993 
1994     /* append more data to the packet */
1995 
1996     DPRINTF("+++ C+ mode transmit reading %d bytes from host memory at "
1997             DMA_ADDR_FMT" to offset %d\n", txsize, tx_addr,
1998             s->cplus_txbuffer_offset);
1999 
2000     pci_dma_read(d, tx_addr,
2001                  s->cplus_txbuffer + s->cplus_txbuffer_offset, txsize);
2002     s->cplus_txbuffer_offset += txsize;
2003 
2004     /* seek to next Rx descriptor */
2005     if (txdw0 & CP_TX_EOR)
2006     {
2007         s->currCPlusTxDesc = 0;
2008     }
2009     else
2010     {
2011         ++s->currCPlusTxDesc;
2012         if (s->currCPlusTxDesc >= 64)
2013             s->currCPlusTxDesc = 0;
2014     }
2015 
2016     /* Build the Tx Status Descriptor */
2017     uint32_t tx_status = txdw0;
2018 
2019     /* transfer ownership to target */
2020     tx_status &= ~CP_TX_OWN;
2021 
2022     /* reset error indicator bits */
2023     tx_status &= ~CP_TX_STATUS_UNF;
2024     tx_status &= ~CP_TX_STATUS_TES;
2025     tx_status &= ~CP_TX_STATUS_OWC;
2026     tx_status &= ~CP_TX_STATUS_LNKF;
2027     tx_status &= ~CP_TX_STATUS_EXC;
2028 
2029     /* update ring data */
2030     val = cpu_to_le32(tx_status);
2031     pci_dma_write(d, cplus_tx_ring_desc, (uint8_t *)&val, 4);
2032 
2033     /* Now decide if descriptor being processed is holding the last segment of packet */
2034     if (txdw0 & CP_TX_LS)
2035     {
2036         uint8_t dot1q_buffer_space[VLAN_HLEN];
2037         uint16_t *dot1q_buffer;
2038 
2039         DPRINTF("+++ C+ Tx mode : descriptor %d is last segment descriptor\n",
2040             descriptor);
2041 
2042         /* can transfer fully assembled packet */
2043 
2044         uint8_t *saved_buffer  = s->cplus_txbuffer;
2045         int      saved_size    = s->cplus_txbuffer_offset;
2046         int      saved_buffer_len = s->cplus_txbuffer_len;
2047 
2048         /* create vlan tag */
2049         if (txdw1 & CP_TX_TAGC) {
2050             /* the vlan tag is in BE byte order in the descriptor
2051              * BE + le_to_cpu() + ~swap()~ = cpu */
2052             DPRINTF("+++ C+ Tx mode : inserting vlan tag with ""tci: %u\n",
2053                 bswap16(txdw1 & CP_TX_VLAN_TAG_MASK));
2054 
2055             dot1q_buffer = (uint16_t *) dot1q_buffer_space;
2056             dot1q_buffer[0] = cpu_to_be16(ETH_P_VLAN);
2057             /* BE + le_to_cpu() + ~cpu_to_le()~ = BE */
2058             dot1q_buffer[1] = cpu_to_le16(txdw1 & CP_TX_VLAN_TAG_MASK);
2059         } else {
2060             dot1q_buffer = NULL;
2061         }
2062 
2063         /* reset the card space to protect from recursive call */
2064         s->cplus_txbuffer = NULL;
2065         s->cplus_txbuffer_offset = 0;
2066         s->cplus_txbuffer_len = 0;
2067 
2068         if (txdw0 & (CP_TX_IPCS | CP_TX_UDPCS | CP_TX_TCPCS | CP_TX_LGSEN))
2069         {
2070             DPRINTF("+++ C+ mode offloaded task checksum\n");
2071 
2072             /* Large enough for Ethernet and IP headers? */
2073             if (saved_size < ETH_HLEN + sizeof(struct ip_header)) {
2074                 goto skip_offload;
2075             }
2076 
2077             /* ip packet header */
2078             struct ip_header *ip = NULL;
2079             int hlen = 0;
2080             uint8_t  ip_protocol = 0;
2081             uint16_t ip_data_len = 0;
2082 
2083             uint8_t *eth_payload_data = NULL;
2084             size_t   eth_payload_len  = 0;
2085 
2086             int proto = be16_to_cpu(*(uint16_t *)(saved_buffer + 12));
2087             if (proto != ETH_P_IP)
2088             {
2089                 goto skip_offload;
2090             }
2091 
2092             DPRINTF("+++ C+ mode has IP packet\n");
2093 
2094             /* Note on memory alignment: eth_payload_data is 16-bit aligned
2095              * since saved_buffer is allocated with g_malloc() and ETH_HLEN is
2096              * even.  32-bit accesses must use ldl/stl wrappers to avoid
2097              * unaligned accesses.
2098              */
2099             eth_payload_data = saved_buffer + ETH_HLEN;
2100             eth_payload_len  = saved_size   - ETH_HLEN;
2101 
2102             ip = (struct ip_header*)eth_payload_data;
2103 
2104             if (IP_HEADER_VERSION(ip) != IP_HEADER_VERSION_4) {
2105                 DPRINTF("+++ C+ mode packet has bad IP version %d "
2106                     "expected %d\n", IP_HEADER_VERSION(ip),
2107                     IP_HEADER_VERSION_4);
2108                 goto skip_offload;
2109             }
2110 
2111             hlen = IP_HDR_GET_LEN(ip);
2112             if (hlen < sizeof(struct ip_header) || hlen > eth_payload_len) {
2113                 goto skip_offload;
2114             }
2115 
2116             ip_protocol = ip->ip_p;
2117 
2118             ip_data_len = be16_to_cpu(ip->ip_len);
2119             if (ip_data_len < hlen || ip_data_len > eth_payload_len) {
2120                 goto skip_offload;
2121             }
2122             ip_data_len -= hlen;
2123 
2124             if (!(txdw0 & CP_TX_LGSEN) && (txdw0 & CP_TX_IPCS))
2125             {
2126                 DPRINTF("+++ C+ mode need IP checksum\n");
2127 
2128                 ip->ip_sum = 0;
2129                 ip->ip_sum = ip_checksum(ip, hlen);
2130                 DPRINTF("+++ C+ mode IP header len=%d checksum=%04x\n",
2131                     hlen, ip->ip_sum);
2132             }
2133 
2134             if ((txdw0 & CP_TX_LGSEN) && ip_protocol == IP_PROTO_TCP)
2135             {
2136                 /* Large enough for the TCP header? */
2137                 if (ip_data_len < sizeof(tcp_header)) {
2138                     goto skip_offload;
2139                 }
2140 
2141                 int large_send_mss = (txdw0 >> CP_TC_LGSEN_MSS_SHIFT) &
2142                                      CP_TC_LGSEN_MSS_MASK;
2143                 if (large_send_mss == 0) {
2144                     goto skip_offload;
2145                 }
2146 
2147                 DPRINTF("+++ C+ mode offloaded task TSO IP data %d "
2148                     "frame data %d specified MSS=%d\n",
2149                     ip_data_len, saved_size - ETH_HLEN, large_send_mss);
2150 
2151                 int tcp_send_offset = 0;
2152 
2153                 /* maximum IP header length is 60 bytes */
2154                 uint8_t saved_ip_header[60];
2155 
2156                 /* save IP header template; data area is used in tcp checksum calculation */
2157                 memcpy(saved_ip_header, eth_payload_data, hlen);
2158 
2159                 /* a placeholder for checksum calculation routine in tcp case */
2160                 uint8_t *data_to_checksum     = eth_payload_data + hlen - 12;
2161                 //                    size_t   data_to_checksum_len = eth_payload_len  - hlen + 12;
2162 
2163                 /* pointer to TCP header */
2164                 tcp_header *p_tcp_hdr = (tcp_header*)(eth_payload_data + hlen);
2165 
2166                 int tcp_hlen = TCP_HEADER_DATA_OFFSET(p_tcp_hdr);
2167 
2168                 /* Invalid TCP data offset? */
2169                 if (tcp_hlen < sizeof(tcp_header) || tcp_hlen > ip_data_len) {
2170                     goto skip_offload;
2171                 }
2172 
2173                 int tcp_data_len = ip_data_len - tcp_hlen;
2174 
2175                 DPRINTF("+++ C+ mode TSO IP data len %d TCP hlen %d TCP "
2176                     "data len %d\n", ip_data_len, tcp_hlen, tcp_data_len);
2177 
2178                 /* note the cycle below overwrites IP header data,
2179                    but restores it from saved_ip_header before sending packet */
2180 
2181                 int is_last_frame = 0;
2182 
2183                 for (tcp_send_offset = 0; tcp_send_offset < tcp_data_len; tcp_send_offset += large_send_mss)
2184                 {
2185                     uint16_t chunk_size = large_send_mss;
2186 
2187                     /* check if this is the last frame */
2188                     if (tcp_send_offset + large_send_mss >= tcp_data_len)
2189                     {
2190                         is_last_frame = 1;
2191                         chunk_size = tcp_data_len - tcp_send_offset;
2192                     }
2193 
2194                     DPRINTF("+++ C+ mode TSO TCP seqno %08x\n",
2195                             ldl_be_p(&p_tcp_hdr->th_seq));
2196 
2197                     /* add 4 TCP pseudoheader fields */
2198                     /* copy IP source and destination fields */
2199                     memcpy(data_to_checksum, saved_ip_header + 12, 8);
2200 
2201                     DPRINTF("+++ C+ mode TSO calculating TCP checksum for "
2202                         "packet with %d bytes data\n", tcp_hlen +
2203                         chunk_size);
2204 
2205                     if (tcp_send_offset)
2206                     {
2207                         memcpy((uint8_t*)p_tcp_hdr + tcp_hlen, (uint8_t*)p_tcp_hdr + tcp_hlen + tcp_send_offset, chunk_size);
2208                     }
2209 
2210                     /* keep PUSH and FIN flags only for the last frame */
2211                     if (!is_last_frame)
2212                     {
2213                         TCP_HEADER_CLEAR_FLAGS(p_tcp_hdr, TH_PUSH | TH_FIN);
2214                     }
2215 
2216                     /* recalculate TCP checksum */
2217                     ip_pseudo_header *p_tcpip_hdr = (ip_pseudo_header *)data_to_checksum;
2218                     p_tcpip_hdr->zeros      = 0;
2219                     p_tcpip_hdr->ip_proto   = IP_PROTO_TCP;
2220                     p_tcpip_hdr->ip_payload = cpu_to_be16(tcp_hlen + chunk_size);
2221 
2222                     p_tcp_hdr->th_sum = 0;
2223 
2224                     int tcp_checksum = ip_checksum(data_to_checksum, tcp_hlen + chunk_size + 12);
2225                     DPRINTF("+++ C+ mode TSO TCP checksum %04x\n",
2226                         tcp_checksum);
2227 
2228                     p_tcp_hdr->th_sum = tcp_checksum;
2229 
2230                     /* restore IP header */
2231                     memcpy(eth_payload_data, saved_ip_header, hlen);
2232 
2233                     /* set IP data length and recalculate IP checksum */
2234                     ip->ip_len = cpu_to_be16(hlen + tcp_hlen + chunk_size);
2235 
2236                     /* increment IP id for subsequent frames */
2237                     ip->ip_id = cpu_to_be16(tcp_send_offset/large_send_mss + be16_to_cpu(ip->ip_id));
2238 
2239                     ip->ip_sum = 0;
2240                     ip->ip_sum = ip_checksum(eth_payload_data, hlen);
2241                     DPRINTF("+++ C+ mode TSO IP header len=%d "
2242                         "checksum=%04x\n", hlen, ip->ip_sum);
2243 
2244                     int tso_send_size = ETH_HLEN + hlen + tcp_hlen + chunk_size;
2245                     DPRINTF("+++ C+ mode TSO transferring packet size "
2246                         "%d\n", tso_send_size);
2247                     rtl8139_transfer_frame(s, saved_buffer, tso_send_size,
2248                         0, (uint8_t *) dot1q_buffer);
2249 
2250                     /* add transferred count to TCP sequence number */
2251                     stl_be_p(&p_tcp_hdr->th_seq,
2252                              chunk_size + ldl_be_p(&p_tcp_hdr->th_seq));
2253                 }
2254 
2255                 /* Stop sending this frame */
2256                 saved_size = 0;
2257             }
2258             else if (!(txdw0 & CP_TX_LGSEN) && (txdw0 & (CP_TX_TCPCS|CP_TX_UDPCS)))
2259             {
2260                 DPRINTF("+++ C+ mode need TCP or UDP checksum\n");
2261 
2262                 /* maximum IP header length is 60 bytes */
2263                 uint8_t saved_ip_header[60];
2264                 memcpy(saved_ip_header, eth_payload_data, hlen);
2265 
2266                 uint8_t *data_to_checksum     = eth_payload_data + hlen - 12;
2267                 //                    size_t   data_to_checksum_len = eth_payload_len  - hlen + 12;
2268 
2269                 /* add 4 TCP pseudoheader fields */
2270                 /* copy IP source and destination fields */
2271                 memcpy(data_to_checksum, saved_ip_header + 12, 8);
2272 
2273                 if ((txdw0 & CP_TX_TCPCS) && ip_protocol == IP_PROTO_TCP)
2274                 {
2275                     DPRINTF("+++ C+ mode calculating TCP checksum for "
2276                         "packet with %d bytes data\n", ip_data_len);
2277 
2278                     ip_pseudo_header *p_tcpip_hdr = (ip_pseudo_header *)data_to_checksum;
2279                     p_tcpip_hdr->zeros      = 0;
2280                     p_tcpip_hdr->ip_proto   = IP_PROTO_TCP;
2281                     p_tcpip_hdr->ip_payload = cpu_to_be16(ip_data_len);
2282 
2283                     tcp_header* p_tcp_hdr = (tcp_header *) (data_to_checksum+12);
2284 
2285                     p_tcp_hdr->th_sum = 0;
2286 
2287                     int tcp_checksum = ip_checksum(data_to_checksum, ip_data_len + 12);
2288                     DPRINTF("+++ C+ mode TCP checksum %04x\n",
2289                         tcp_checksum);
2290 
2291                     p_tcp_hdr->th_sum = tcp_checksum;
2292                 }
2293                 else if ((txdw0 & CP_TX_UDPCS) && ip_protocol == IP_PROTO_UDP)
2294                 {
2295                     DPRINTF("+++ C+ mode calculating UDP checksum for "
2296                         "packet with %d bytes data\n", ip_data_len);
2297 
2298                     ip_pseudo_header *p_udpip_hdr = (ip_pseudo_header *)data_to_checksum;
2299                     p_udpip_hdr->zeros      = 0;
2300                     p_udpip_hdr->ip_proto   = IP_PROTO_UDP;
2301                     p_udpip_hdr->ip_payload = cpu_to_be16(ip_data_len);
2302 
2303                     udp_header *p_udp_hdr = (udp_header *) (data_to_checksum+12);
2304 
2305                     p_udp_hdr->uh_sum = 0;
2306 
2307                     int udp_checksum = ip_checksum(data_to_checksum, ip_data_len + 12);
2308                     DPRINTF("+++ C+ mode UDP checksum %04x\n",
2309                         udp_checksum);
2310 
2311                     p_udp_hdr->uh_sum = udp_checksum;
2312                 }
2313 
2314                 /* restore IP header */
2315                 memcpy(eth_payload_data, saved_ip_header, hlen);
2316             }
2317         }
2318 
2319 skip_offload:
2320         /* update tally counter */
2321         ++s->tally_counters.TxOk;
2322 
2323         DPRINTF("+++ C+ mode transmitting %d bytes packet\n", saved_size);
2324 
2325         rtl8139_transfer_frame(s, saved_buffer, saved_size, 1,
2326             (uint8_t *) dot1q_buffer);
2327 
2328         /* restore card space if there was no recursion and reset offset */
2329         if (!s->cplus_txbuffer)
2330         {
2331             s->cplus_txbuffer        = saved_buffer;
2332             s->cplus_txbuffer_len    = saved_buffer_len;
2333             s->cplus_txbuffer_offset = 0;
2334         }
2335         else
2336         {
2337             g_free(saved_buffer);
2338         }
2339     }
2340     else
2341     {
2342         DPRINTF("+++ C+ mode transmission continue to next descriptor\n");
2343     }
2344 
2345     return 1;
2346 }
2347 
rtl8139_cplus_transmit(RTL8139State * s)2348 static void rtl8139_cplus_transmit(RTL8139State *s)
2349 {
2350     int txcount = 0;
2351 
2352     while (txcount < 64 && rtl8139_cplus_transmit_one(s))
2353     {
2354         ++txcount;
2355     }
2356 
2357     /* Mark transfer completed */
2358     if (!txcount)
2359     {
2360         DPRINTF("C+ mode : transmitter queue stalled, current TxDesc = %d\n",
2361             s->currCPlusTxDesc);
2362     }
2363     else
2364     {
2365         /* update interrupt status */
2366         s->IntrStatus |= TxOK;
2367         rtl8139_update_irq(s);
2368     }
2369 }
2370 
rtl8139_transmit(RTL8139State * s)2371 static void rtl8139_transmit(RTL8139State *s)
2372 {
2373     int descriptor = s->currTxDesc, txcount = 0;
2374 
2375     /*while*/
2376     if (rtl8139_transmit_one(s, descriptor))
2377     {
2378         ++s->currTxDesc;
2379         s->currTxDesc %= 4;
2380         ++txcount;
2381     }
2382 
2383     /* Mark transfer completed */
2384     if (!txcount)
2385     {
2386         DPRINTF("transmitter queue stalled, current TxDesc = %d\n",
2387             s->currTxDesc);
2388     }
2389 }
2390 
rtl8139_TxStatus_write(RTL8139State * s,uint32_t txRegOffset,uint32_t val)2391 static void rtl8139_TxStatus_write(RTL8139State *s, uint32_t txRegOffset, uint32_t val)
2392 {
2393 
2394     int descriptor = txRegOffset/4;
2395 
2396     /* handle C+ transmit mode register configuration */
2397 
2398     if (s->cplus_enabled)
2399     {
2400         DPRINTF("RTL8139C+ DTCCR write offset=0x%x val=0x%08x "
2401             "descriptor=%d\n", txRegOffset, val, descriptor);
2402 
2403         /* handle Dump Tally Counters command */
2404         s->TxStatus[descriptor] = val;
2405 
2406         if (descriptor == 0 && (val & 0x8))
2407         {
2408             hwaddr tc_addr = rtl8139_addr64(s->TxStatus[0] & ~0x3f, s->TxStatus[1]);
2409 
2410             /* dump tally counters to specified memory location */
2411             RTL8139TallyCounters_dma_write(s, tc_addr);
2412 
2413             /* mark dump completed */
2414             s->TxStatus[0] &= ~0x8;
2415         }
2416 
2417         return;
2418     }
2419 
2420     DPRINTF("TxStatus write offset=0x%x val=0x%08x descriptor=%d\n",
2421         txRegOffset, val, descriptor);
2422 
2423     /* mask only reserved bits */
2424     val &= ~0xff00c000; /* these bits are reset on write */
2425     val = SET_MASKED(val, 0x00c00000, s->TxStatus[descriptor]);
2426 
2427     s->TxStatus[descriptor] = val;
2428 
2429     /* attempt to start transmission */
2430     rtl8139_transmit(s);
2431 }
2432 
rtl8139_TxStatus_TxAddr_read(RTL8139State * s,uint32_t regs[],uint32_t base,uint8_t addr,int size)2433 static uint32_t rtl8139_TxStatus_TxAddr_read(RTL8139State *s, uint32_t regs[],
2434                                              uint32_t base, uint8_t addr,
2435                                              int size)
2436 {
2437     uint32_t reg = (addr - base) / 4;
2438     uint32_t offset = addr & 0x3;
2439     uint32_t ret = 0;
2440 
2441     if (addr & (size - 1)) {
2442         DPRINTF("not implemented read for TxStatus/TxAddr "
2443                 "addr=0x%x size=0x%x\n", addr, size);
2444         return ret;
2445     }
2446 
2447     switch (size) {
2448     case 1: /* fall through */
2449     case 2: /* fall through */
2450     case 4:
2451         ret = (regs[reg] >> offset * 8) & (((uint64_t)1 << (size * 8)) - 1);
2452         DPRINTF("TxStatus/TxAddr[%d] read addr=0x%x size=0x%x val=0x%08x\n",
2453                 reg, addr, size, ret);
2454         break;
2455     default:
2456         DPRINTF("unsupported size 0x%x of TxStatus/TxAddr reading\n", size);
2457         break;
2458     }
2459 
2460     return ret;
2461 }
2462 
rtl8139_TSAD_read(RTL8139State * s)2463 static uint16_t rtl8139_TSAD_read(RTL8139State *s)
2464 {
2465     uint16_t ret = 0;
2466 
2467     /* Simulate TSAD, it is read only anyway */
2468 
2469     ret = ((s->TxStatus[3] & TxStatOK  )?TSAD_TOK3:0)
2470          |((s->TxStatus[2] & TxStatOK  )?TSAD_TOK2:0)
2471          |((s->TxStatus[1] & TxStatOK  )?TSAD_TOK1:0)
2472          |((s->TxStatus[0] & TxStatOK  )?TSAD_TOK0:0)
2473 
2474          |((s->TxStatus[3] & TxUnderrun)?TSAD_TUN3:0)
2475          |((s->TxStatus[2] & TxUnderrun)?TSAD_TUN2:0)
2476          |((s->TxStatus[1] & TxUnderrun)?TSAD_TUN1:0)
2477          |((s->TxStatus[0] & TxUnderrun)?TSAD_TUN0:0)
2478 
2479          |((s->TxStatus[3] & TxAborted )?TSAD_TABT3:0)
2480          |((s->TxStatus[2] & TxAborted )?TSAD_TABT2:0)
2481          |((s->TxStatus[1] & TxAborted )?TSAD_TABT1:0)
2482          |((s->TxStatus[0] & TxAborted )?TSAD_TABT0:0)
2483 
2484          |((s->TxStatus[3] & TxHostOwns )?TSAD_OWN3:0)
2485          |((s->TxStatus[2] & TxHostOwns )?TSAD_OWN2:0)
2486          |((s->TxStatus[1] & TxHostOwns )?TSAD_OWN1:0)
2487          |((s->TxStatus[0] & TxHostOwns )?TSAD_OWN0:0) ;
2488 
2489 
2490     DPRINTF("TSAD read val=0x%04x\n", ret);
2491 
2492     return ret;
2493 }
2494 
rtl8139_CSCR_read(RTL8139State * s)2495 static uint16_t rtl8139_CSCR_read(RTL8139State *s)
2496 {
2497     uint16_t ret = s->CSCR;
2498 
2499     DPRINTF("CSCR read val=0x%04x\n", ret);
2500 
2501     return ret;
2502 }
2503 
rtl8139_TxAddr_write(RTL8139State * s,uint32_t txAddrOffset,uint32_t val)2504 static void rtl8139_TxAddr_write(RTL8139State *s, uint32_t txAddrOffset, uint32_t val)
2505 {
2506     DPRINTF("TxAddr write offset=0x%x val=0x%08x\n", txAddrOffset, val);
2507 
2508     s->TxAddr[txAddrOffset/4] = val;
2509 }
2510 
rtl8139_TxAddr_read(RTL8139State * s,uint32_t txAddrOffset)2511 static uint32_t rtl8139_TxAddr_read(RTL8139State *s, uint32_t txAddrOffset)
2512 {
2513     uint32_t ret = s->TxAddr[txAddrOffset/4];
2514 
2515     DPRINTF("TxAddr read offset=0x%x val=0x%08x\n", txAddrOffset, ret);
2516 
2517     return ret;
2518 }
2519 
rtl8139_RxBufPtr_write(RTL8139State * s,uint32_t val)2520 static void rtl8139_RxBufPtr_write(RTL8139State *s, uint32_t val)
2521 {
2522     DPRINTF("RxBufPtr write val=0x%04x\n", val);
2523 
2524     /* this value is off by 16 */
2525     s->RxBufPtr = MOD2(val + 0x10, s->RxBufferSize);
2526 
2527     /* more buffer space may be available so try to receive */
2528     qemu_flush_queued_packets(qemu_get_queue(s->nic));
2529 
2530     DPRINTF(" CAPR write: rx buffer length %d head 0x%04x read 0x%04x\n",
2531         s->RxBufferSize, s->RxBufAddr, s->RxBufPtr);
2532 }
2533 
rtl8139_RxBufPtr_read(RTL8139State * s)2534 static uint32_t rtl8139_RxBufPtr_read(RTL8139State *s)
2535 {
2536     /* this value is off by 16 */
2537     uint32_t ret = s->RxBufPtr - 0x10;
2538 
2539     DPRINTF("RxBufPtr read val=0x%04x\n", ret);
2540 
2541     return ret;
2542 }
2543 
rtl8139_RxBufAddr_read(RTL8139State * s)2544 static uint32_t rtl8139_RxBufAddr_read(RTL8139State *s)
2545 {
2546     /* this value is NOT off by 16 */
2547     uint32_t ret = s->RxBufAddr;
2548 
2549     DPRINTF("RxBufAddr read val=0x%04x\n", ret);
2550 
2551     return ret;
2552 }
2553 
rtl8139_RxBuf_write(RTL8139State * s,uint32_t val)2554 static void rtl8139_RxBuf_write(RTL8139State *s, uint32_t val)
2555 {
2556     DPRINTF("RxBuf write val=0x%08x\n", val);
2557 
2558     s->RxBuf = val;
2559 
2560     /* may need to reset rxring here */
2561 }
2562 
rtl8139_RxBuf_read(RTL8139State * s)2563 static uint32_t rtl8139_RxBuf_read(RTL8139State *s)
2564 {
2565     uint32_t ret = s->RxBuf;
2566 
2567     DPRINTF("RxBuf read val=0x%08x\n", ret);
2568 
2569     return ret;
2570 }
2571 
rtl8139_IntrMask_write(RTL8139State * s,uint32_t val)2572 static void rtl8139_IntrMask_write(RTL8139State *s, uint32_t val)
2573 {
2574     DPRINTF("IntrMask write(w) val=0x%04x\n", val);
2575 
2576     /* mask unwritable bits */
2577     val = SET_MASKED(val, 0x1e00, s->IntrMask);
2578 
2579     s->IntrMask = val;
2580 
2581     rtl8139_update_irq(s);
2582 
2583 }
2584 
rtl8139_IntrMask_read(RTL8139State * s)2585 static uint32_t rtl8139_IntrMask_read(RTL8139State *s)
2586 {
2587     uint32_t ret = s->IntrMask;
2588 
2589     DPRINTF("IntrMask read(w) val=0x%04x\n", ret);
2590 
2591     return ret;
2592 }
2593 
rtl8139_IntrStatus_write(RTL8139State * s,uint32_t val)2594 static void rtl8139_IntrStatus_write(RTL8139State *s, uint32_t val)
2595 {
2596     DPRINTF("IntrStatus write(w) val=0x%04x\n", val);
2597 
2598 #if 0
2599 
2600     /* writing to ISR has no effect */
2601 
2602     return;
2603 
2604 #else
2605     uint16_t newStatus = s->IntrStatus & ~val;
2606 
2607     /* mask unwritable bits */
2608     newStatus = SET_MASKED(newStatus, 0x1e00, s->IntrStatus);
2609 
2610     /* writing 1 to interrupt status register bit clears it */
2611     s->IntrStatus = 0;
2612     rtl8139_update_irq(s);
2613 
2614     s->IntrStatus = newStatus;
2615     rtl8139_set_next_tctr_time(s);
2616     rtl8139_update_irq(s);
2617 
2618 #endif
2619 }
2620 
rtl8139_IntrStatus_read(RTL8139State * s)2621 static uint32_t rtl8139_IntrStatus_read(RTL8139State *s)
2622 {
2623     uint32_t ret = s->IntrStatus;
2624 
2625     DPRINTF("IntrStatus read(w) val=0x%04x\n", ret);
2626 
2627 #if 0
2628 
2629     /* reading ISR clears all interrupts */
2630     s->IntrStatus = 0;
2631 
2632     rtl8139_update_irq(s);
2633 
2634 #endif
2635 
2636     return ret;
2637 }
2638 
rtl8139_MultiIntr_write(RTL8139State * s,uint32_t val)2639 static void rtl8139_MultiIntr_write(RTL8139State *s, uint32_t val)
2640 {
2641     DPRINTF("MultiIntr write(w) val=0x%04x\n", val);
2642 
2643     /* mask unwritable bits */
2644     val = SET_MASKED(val, 0xf000, s->MultiIntr);
2645 
2646     s->MultiIntr = val;
2647 }
2648 
rtl8139_MultiIntr_read(RTL8139State * s)2649 static uint32_t rtl8139_MultiIntr_read(RTL8139State *s)
2650 {
2651     uint32_t ret = s->MultiIntr;
2652 
2653     DPRINTF("MultiIntr read(w) val=0x%04x\n", ret);
2654 
2655     return ret;
2656 }
2657 
rtl8139_io_writeb(void * opaque,uint8_t addr,uint32_t val)2658 static void rtl8139_io_writeb(void *opaque, uint8_t addr, uint32_t val)
2659 {
2660     RTL8139State *s = opaque;
2661 
2662     switch (addr)
2663     {
2664         case MAC0 ... MAC0+4:
2665             s->phys[addr - MAC0] = val;
2666             break;
2667         case MAC0+5:
2668             s->phys[addr - MAC0] = val;
2669             qemu_format_nic_info_str(qemu_get_queue(s->nic), s->phys);
2670             break;
2671         case MAC0+6 ... MAC0+7:
2672             /* reserved */
2673             break;
2674         case MAR0 ... MAR0+7:
2675             s->mult[addr - MAR0] = val;
2676             break;
2677         case ChipCmd:
2678             rtl8139_ChipCmd_write(s, val);
2679             break;
2680         case Cfg9346:
2681             rtl8139_Cfg9346_write(s, val);
2682             break;
2683         case TxConfig: /* windows driver sometimes writes using byte-lenth call */
2684             rtl8139_TxConfig_writeb(s, val);
2685             break;
2686         case Config0:
2687             rtl8139_Config0_write(s, val);
2688             break;
2689         case Config1:
2690             rtl8139_Config1_write(s, val);
2691             break;
2692         case Config3:
2693             rtl8139_Config3_write(s, val);
2694             break;
2695         case Config4:
2696             rtl8139_Config4_write(s, val);
2697             break;
2698         case Config5:
2699             rtl8139_Config5_write(s, val);
2700             break;
2701         case MediaStatus:
2702             /* ignore */
2703             DPRINTF("not implemented write(b) to MediaStatus val=0x%02x\n",
2704                 val);
2705             break;
2706 
2707         case HltClk:
2708             DPRINTF("HltClk write val=0x%08x\n", val);
2709             if (val == 'R')
2710             {
2711                 s->clock_enabled = 1;
2712             }
2713             else if (val == 'H')
2714             {
2715                 s->clock_enabled = 0;
2716             }
2717             break;
2718 
2719         case TxThresh:
2720             DPRINTF("C+ TxThresh write(b) val=0x%02x\n", val);
2721             s->TxThresh = val;
2722             break;
2723 
2724         case TxPoll:
2725             DPRINTF("C+ TxPoll write(b) val=0x%02x\n", val);
2726             if (val & (1 << 7))
2727             {
2728                 DPRINTF("C+ TxPoll high priority transmission (not "
2729                     "implemented)\n");
2730                 //rtl8139_cplus_transmit(s);
2731             }
2732             if (val & (1 << 6))
2733             {
2734                 DPRINTF("C+ TxPoll normal priority transmission\n");
2735                 rtl8139_cplus_transmit(s);
2736             }
2737 
2738             break;
2739         case RxConfig:
2740             DPRINTF("RxConfig write(b) val=0x%02x\n", val);
2741             rtl8139_RxConfig_write(s,
2742                 (rtl8139_RxConfig_read(s) & 0xFFFFFF00) | val);
2743             break;
2744         default:
2745             DPRINTF("not implemented write(b) addr=0x%x val=0x%02x\n", addr,
2746                 val);
2747             break;
2748     }
2749 }
2750 
rtl8139_io_writew(void * opaque,uint8_t addr,uint32_t val)2751 static void rtl8139_io_writew(void *opaque, uint8_t addr, uint32_t val)
2752 {
2753     RTL8139State *s = opaque;
2754 
2755     switch (addr)
2756     {
2757         case IntrMask:
2758             rtl8139_IntrMask_write(s, val);
2759             break;
2760 
2761         case IntrStatus:
2762             rtl8139_IntrStatus_write(s, val);
2763             break;
2764 
2765         case MultiIntr:
2766             rtl8139_MultiIntr_write(s, val);
2767             break;
2768 
2769         case RxBufPtr:
2770             rtl8139_RxBufPtr_write(s, val);
2771             break;
2772 
2773         case BasicModeCtrl:
2774             rtl8139_BasicModeCtrl_write(s, val);
2775             break;
2776         case BasicModeStatus:
2777             rtl8139_BasicModeStatus_write(s, val);
2778             break;
2779         case NWayAdvert:
2780             DPRINTF("NWayAdvert write(w) val=0x%04x\n", val);
2781             s->NWayAdvert = val;
2782             break;
2783         case NWayLPAR:
2784             DPRINTF("forbidden NWayLPAR write(w) val=0x%04x\n", val);
2785             break;
2786         case NWayExpansion:
2787             DPRINTF("NWayExpansion write(w) val=0x%04x\n", val);
2788             s->NWayExpansion = val;
2789             break;
2790 
2791         case CpCmd:
2792             rtl8139_CpCmd_write(s, val);
2793             break;
2794 
2795         case IntrMitigate:
2796             rtl8139_IntrMitigate_write(s, val);
2797             break;
2798 
2799         default:
2800             DPRINTF("ioport write(w) addr=0x%x val=0x%04x via write(b)\n",
2801                 addr, val);
2802 
2803             rtl8139_io_writeb(opaque, addr, val & 0xff);
2804             rtl8139_io_writeb(opaque, addr + 1, (val >> 8) & 0xff);
2805             break;
2806     }
2807 }
2808 
rtl8139_set_next_tctr_time(RTL8139State * s)2809 static void rtl8139_set_next_tctr_time(RTL8139State *s)
2810 {
2811     const uint64_t ns_per_period = (uint64_t)PCI_PERIOD << 32;
2812 
2813     DPRINTF("entered rtl8139_set_next_tctr_time\n");
2814 
2815     /* This function is called at least once per period, so it is a good
2816      * place to update the timer base.
2817      *
2818      * After one iteration of this loop the value in the Timer register does
2819      * not change, but the device model is counting up by 2^32 ticks (approx.
2820      * 130 seconds).
2821      */
2822     while (s->TCTR_base + ns_per_period <= qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL)) {
2823         s->TCTR_base += ns_per_period;
2824     }
2825 
2826     if (!s->TimerInt) {
2827         timer_del(s->timer);
2828     } else {
2829         uint64_t delta = (uint64_t)s->TimerInt * PCI_PERIOD;
2830         if (s->TCTR_base + delta <= qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL)) {
2831             delta += ns_per_period;
2832         }
2833         timer_mod(s->timer, s->TCTR_base + delta);
2834     }
2835 }
2836 
rtl8139_io_writel(void * opaque,uint8_t addr,uint32_t val)2837 static void rtl8139_io_writel(void *opaque, uint8_t addr, uint32_t val)
2838 {
2839     RTL8139State *s = opaque;
2840 
2841     switch (addr)
2842     {
2843         case RxMissed:
2844             DPRINTF("RxMissed clearing on write\n");
2845             s->RxMissed = 0;
2846             break;
2847 
2848         case TxConfig:
2849             rtl8139_TxConfig_write(s, val);
2850             break;
2851 
2852         case RxConfig:
2853             rtl8139_RxConfig_write(s, val);
2854             break;
2855 
2856         case TxStatus0 ... TxStatus0+4*4-1:
2857             rtl8139_TxStatus_write(s, addr-TxStatus0, val);
2858             break;
2859 
2860         case TxAddr0 ... TxAddr0+4*4-1:
2861             rtl8139_TxAddr_write(s, addr-TxAddr0, val);
2862             break;
2863 
2864         case RxBuf:
2865             rtl8139_RxBuf_write(s, val);
2866             break;
2867 
2868         case RxRingAddrLO:
2869             DPRINTF("C+ RxRing low bits write val=0x%08x\n", val);
2870             s->RxRingAddrLO = val;
2871             break;
2872 
2873         case RxRingAddrHI:
2874             DPRINTF("C+ RxRing high bits write val=0x%08x\n", val);
2875             s->RxRingAddrHI = val;
2876             break;
2877 
2878         case Timer:
2879             DPRINTF("TCTR Timer reset on write\n");
2880             s->TCTR_base = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
2881             rtl8139_set_next_tctr_time(s);
2882             break;
2883 
2884         case FlashReg:
2885             DPRINTF("FlashReg TimerInt write val=0x%08x\n", val);
2886             if (s->TimerInt != val) {
2887                 s->TimerInt = val;
2888                 rtl8139_set_next_tctr_time(s);
2889             }
2890             break;
2891 
2892         default:
2893             DPRINTF("ioport write(l) addr=0x%x val=0x%08x via write(b)\n",
2894                 addr, val);
2895             rtl8139_io_writeb(opaque, addr, val & 0xff);
2896             rtl8139_io_writeb(opaque, addr + 1, (val >> 8) & 0xff);
2897             rtl8139_io_writeb(opaque, addr + 2, (val >> 16) & 0xff);
2898             rtl8139_io_writeb(opaque, addr + 3, (val >> 24) & 0xff);
2899             break;
2900     }
2901 }
2902 
rtl8139_io_readb(void * opaque,uint8_t addr)2903 static uint32_t rtl8139_io_readb(void *opaque, uint8_t addr)
2904 {
2905     RTL8139State *s = opaque;
2906     int ret;
2907 
2908     switch (addr)
2909     {
2910         case MAC0 ... MAC0+5:
2911             ret = s->phys[addr - MAC0];
2912             break;
2913         case MAC0+6 ... MAC0+7:
2914             ret = 0;
2915             break;
2916         case MAR0 ... MAR0+7:
2917             ret = s->mult[addr - MAR0];
2918             break;
2919         case TxStatus0 ... TxStatus0+4*4-1:
2920             ret = rtl8139_TxStatus_TxAddr_read(s, s->TxStatus, TxStatus0,
2921                                                addr, 1);
2922             break;
2923         case ChipCmd:
2924             ret = rtl8139_ChipCmd_read(s);
2925             break;
2926         case Cfg9346:
2927             ret = rtl8139_Cfg9346_read(s);
2928             break;
2929         case Config0:
2930             ret = rtl8139_Config0_read(s);
2931             break;
2932         case Config1:
2933             ret = rtl8139_Config1_read(s);
2934             break;
2935         case Config3:
2936             ret = rtl8139_Config3_read(s);
2937             break;
2938         case Config4:
2939             ret = rtl8139_Config4_read(s);
2940             break;
2941         case Config5:
2942             ret = rtl8139_Config5_read(s);
2943             break;
2944 
2945         case MediaStatus:
2946             /* The LinkDown bit of MediaStatus is inverse with link status */
2947             ret = 0xd0 | (~s->BasicModeStatus & 0x04);
2948             DPRINTF("MediaStatus read 0x%x\n", ret);
2949             break;
2950 
2951         case HltClk:
2952             ret = s->clock_enabled;
2953             DPRINTF("HltClk read 0x%x\n", ret);
2954             break;
2955 
2956         case PCIRevisionID:
2957             ret = RTL8139_PCI_REVID;
2958             DPRINTF("PCI Revision ID read 0x%x\n", ret);
2959             break;
2960 
2961         case TxThresh:
2962             ret = s->TxThresh;
2963             DPRINTF("C+ TxThresh read(b) val=0x%02x\n", ret);
2964             break;
2965 
2966         case 0x43: /* Part of TxConfig register. Windows driver tries to read it */
2967             ret = s->TxConfig >> 24;
2968             DPRINTF("RTL8139C TxConfig at 0x43 read(b) val=0x%02x\n", ret);
2969             break;
2970 
2971         default:
2972             DPRINTF("not implemented read(b) addr=0x%x\n", addr);
2973             ret = 0;
2974             break;
2975     }
2976 
2977     return ret;
2978 }
2979 
rtl8139_io_readw(void * opaque,uint8_t addr)2980 static uint32_t rtl8139_io_readw(void *opaque, uint8_t addr)
2981 {
2982     RTL8139State *s = opaque;
2983     uint32_t ret;
2984 
2985     switch (addr)
2986     {
2987         case TxAddr0 ... TxAddr0+4*4-1:
2988             ret = rtl8139_TxStatus_TxAddr_read(s, s->TxAddr, TxAddr0, addr, 2);
2989             break;
2990         case IntrMask:
2991             ret = rtl8139_IntrMask_read(s);
2992             break;
2993 
2994         case IntrStatus:
2995             ret = rtl8139_IntrStatus_read(s);
2996             break;
2997 
2998         case MultiIntr:
2999             ret = rtl8139_MultiIntr_read(s);
3000             break;
3001 
3002         case RxBufPtr:
3003             ret = rtl8139_RxBufPtr_read(s);
3004             break;
3005 
3006         case RxBufAddr:
3007             ret = rtl8139_RxBufAddr_read(s);
3008             break;
3009 
3010         case BasicModeCtrl:
3011             ret = rtl8139_BasicModeCtrl_read(s);
3012             break;
3013         case BasicModeStatus:
3014             ret = rtl8139_BasicModeStatus_read(s);
3015             break;
3016         case NWayAdvert:
3017             ret = s->NWayAdvert;
3018             DPRINTF("NWayAdvert read(w) val=0x%04x\n", ret);
3019             break;
3020         case NWayLPAR:
3021             ret = s->NWayLPAR;
3022             DPRINTF("NWayLPAR read(w) val=0x%04x\n", ret);
3023             break;
3024         case NWayExpansion:
3025             ret = s->NWayExpansion;
3026             DPRINTF("NWayExpansion read(w) val=0x%04x\n", ret);
3027             break;
3028 
3029         case CpCmd:
3030             ret = rtl8139_CpCmd_read(s);
3031             break;
3032 
3033         case IntrMitigate:
3034             ret = rtl8139_IntrMitigate_read(s);
3035             break;
3036 
3037         case TxSummary:
3038             ret = rtl8139_TSAD_read(s);
3039             break;
3040 
3041         case CSCR:
3042             ret = rtl8139_CSCR_read(s);
3043             break;
3044 
3045         default:
3046             DPRINTF("ioport read(w) addr=0x%x via read(b)\n", addr);
3047 
3048             ret  = rtl8139_io_readb(opaque, addr);
3049             ret |= rtl8139_io_readb(opaque, addr + 1) << 8;
3050 
3051             DPRINTF("ioport read(w) addr=0x%x val=0x%04x\n", addr, ret);
3052             break;
3053     }
3054 
3055     return ret;
3056 }
3057 
rtl8139_io_readl(void * opaque,uint8_t addr)3058 static uint32_t rtl8139_io_readl(void *opaque, uint8_t addr)
3059 {
3060     RTL8139State *s = opaque;
3061     uint32_t ret;
3062 
3063     switch (addr)
3064     {
3065         case RxMissed:
3066             ret = s->RxMissed;
3067 
3068             DPRINTF("RxMissed read val=0x%08x\n", ret);
3069             break;
3070 
3071         case TxConfig:
3072             ret = rtl8139_TxConfig_read(s);
3073             break;
3074 
3075         case RxConfig:
3076             ret = rtl8139_RxConfig_read(s);
3077             break;
3078 
3079         case TxStatus0 ... TxStatus0+4*4-1:
3080             ret = rtl8139_TxStatus_TxAddr_read(s, s->TxStatus, TxStatus0,
3081                                                addr, 4);
3082             break;
3083 
3084         case TxAddr0 ... TxAddr0+4*4-1:
3085             ret = rtl8139_TxAddr_read(s, addr-TxAddr0);
3086             break;
3087 
3088         case RxBuf:
3089             ret = rtl8139_RxBuf_read(s);
3090             break;
3091 
3092         case RxRingAddrLO:
3093             ret = s->RxRingAddrLO;
3094             DPRINTF("C+ RxRing low bits read val=0x%08x\n", ret);
3095             break;
3096 
3097         case RxRingAddrHI:
3098             ret = s->RxRingAddrHI;
3099             DPRINTF("C+ RxRing high bits read val=0x%08x\n", ret);
3100             break;
3101 
3102         case Timer:
3103             ret = (qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) - s->TCTR_base) /
3104                   PCI_PERIOD;
3105             DPRINTF("TCTR Timer read val=0x%08x\n", ret);
3106             break;
3107 
3108         case FlashReg:
3109             ret = s->TimerInt;
3110             DPRINTF("FlashReg TimerInt read val=0x%08x\n", ret);
3111             break;
3112 
3113         default:
3114             DPRINTF("ioport read(l) addr=0x%x via read(b)\n", addr);
3115 
3116             ret  = rtl8139_io_readb(opaque, addr);
3117             ret |= rtl8139_io_readb(opaque, addr + 1) << 8;
3118             ret |= rtl8139_io_readb(opaque, addr + 2) << 16;
3119             ret |= rtl8139_io_readb(opaque, addr + 3) << 24;
3120 
3121             DPRINTF("read(l) addr=0x%x val=%08x\n", addr, ret);
3122             break;
3123     }
3124 
3125     return ret;
3126 }
3127 
3128 /* */
3129 
rtl8139_post_load(void * opaque,int version_id)3130 static int rtl8139_post_load(void *opaque, int version_id)
3131 {
3132     RTL8139State* s = opaque;
3133     rtl8139_set_next_tctr_time(s);
3134     if (version_id < 4) {
3135         s->cplus_enabled = s->CpCmd != 0;
3136     }
3137 
3138     /* nc.link_down can't be migrated, so infer link_down according
3139      * to link status bit in BasicModeStatus */
3140     qemu_get_queue(s->nic)->link_down = (s->BasicModeStatus & 0x04) == 0;
3141 
3142     return 0;
3143 }
3144 
rtl8139_hotplug_ready_needed(void * opaque)3145 static bool rtl8139_hotplug_ready_needed(void *opaque)
3146 {
3147     return qdev_machine_modified();
3148 }
3149 
3150 static const VMStateDescription vmstate_rtl8139_hotplug_ready ={
3151     .name = "rtl8139/hotplug_ready",
3152     .version_id = 1,
3153     .minimum_version_id = 1,
3154     .needed = rtl8139_hotplug_ready_needed,
3155     .fields = (const VMStateField[]) {
3156         VMSTATE_END_OF_LIST()
3157     }
3158 };
3159 
rtl8139_pre_save(void * opaque)3160 static int rtl8139_pre_save(void *opaque)
3161 {
3162     RTL8139State* s = opaque;
3163     int64_t current_time = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
3164 
3165     /* for migration to older versions */
3166     s->TCTR = (current_time - s->TCTR_base) / PCI_PERIOD;
3167     s->rtl8139_mmio_io_addr_dummy = 0;
3168 
3169     return 0;
3170 }
3171 
3172 static const VMStateDescription vmstate_rtl8139 = {
3173     .name = "rtl8139",
3174     .version_id = 5,
3175     .minimum_version_id = 3,
3176     .post_load = rtl8139_post_load,
3177     .pre_save  = rtl8139_pre_save,
3178     .fields = (const VMStateField[]) {
3179         VMSTATE_PCI_DEVICE(parent_obj, RTL8139State),
3180         VMSTATE_PARTIAL_BUFFER(phys, RTL8139State, 6),
3181         VMSTATE_BUFFER(mult, RTL8139State),
3182         VMSTATE_UINT32_ARRAY(TxStatus, RTL8139State, 4),
3183         VMSTATE_UINT32_ARRAY(TxAddr, RTL8139State, 4),
3184 
3185         VMSTATE_UINT32(RxBuf, RTL8139State),
3186         VMSTATE_UINT32(RxBufferSize, RTL8139State),
3187         VMSTATE_UINT32(RxBufPtr, RTL8139State),
3188         VMSTATE_UINT32(RxBufAddr, RTL8139State),
3189 
3190         VMSTATE_UINT16(IntrStatus, RTL8139State),
3191         VMSTATE_UINT16(IntrMask, RTL8139State),
3192 
3193         VMSTATE_UINT32(TxConfig, RTL8139State),
3194         VMSTATE_UINT32(RxConfig, RTL8139State),
3195         VMSTATE_UINT32(RxMissed, RTL8139State),
3196         VMSTATE_UINT16(CSCR, RTL8139State),
3197 
3198         VMSTATE_UINT8(Cfg9346, RTL8139State),
3199         VMSTATE_UINT8(Config0, RTL8139State),
3200         VMSTATE_UINT8(Config1, RTL8139State),
3201         VMSTATE_UINT8(Config3, RTL8139State),
3202         VMSTATE_UINT8(Config4, RTL8139State),
3203         VMSTATE_UINT8(Config5, RTL8139State),
3204 
3205         VMSTATE_UINT8(clock_enabled, RTL8139State),
3206         VMSTATE_UINT8(bChipCmdState, RTL8139State),
3207 
3208         VMSTATE_UINT16(MultiIntr, RTL8139State),
3209 
3210         VMSTATE_UINT16(BasicModeCtrl, RTL8139State),
3211         VMSTATE_UINT16(BasicModeStatus, RTL8139State),
3212         VMSTATE_UINT16(NWayAdvert, RTL8139State),
3213         VMSTATE_UINT16(NWayLPAR, RTL8139State),
3214         VMSTATE_UINT16(NWayExpansion, RTL8139State),
3215 
3216         VMSTATE_UINT16(CpCmd, RTL8139State),
3217         VMSTATE_UINT8(TxThresh, RTL8139State),
3218 
3219         VMSTATE_UNUSED(4),
3220         VMSTATE_MACADDR(conf.macaddr, RTL8139State),
3221         VMSTATE_INT32(rtl8139_mmio_io_addr_dummy, RTL8139State),
3222 
3223         VMSTATE_UINT32(currTxDesc, RTL8139State),
3224         VMSTATE_UINT32(currCPlusRxDesc, RTL8139State),
3225         VMSTATE_UINT32(currCPlusTxDesc, RTL8139State),
3226         VMSTATE_UINT32(RxRingAddrLO, RTL8139State),
3227         VMSTATE_UINT32(RxRingAddrHI, RTL8139State),
3228 
3229         VMSTATE_UINT16_ARRAY(eeprom.contents, RTL8139State, EEPROM_9346_SIZE),
3230         VMSTATE_INT32(eeprom.mode, RTL8139State),
3231         VMSTATE_UINT32(eeprom.tick, RTL8139State),
3232         VMSTATE_UINT8(eeprom.address, RTL8139State),
3233         VMSTATE_UINT16(eeprom.input, RTL8139State),
3234         VMSTATE_UINT16(eeprom.output, RTL8139State),
3235 
3236         VMSTATE_UINT8(eeprom.eecs, RTL8139State),
3237         VMSTATE_UINT8(eeprom.eesk, RTL8139State),
3238         VMSTATE_UINT8(eeprom.eedi, RTL8139State),
3239         VMSTATE_UINT8(eeprom.eedo, RTL8139State),
3240 
3241         VMSTATE_UINT32(TCTR, RTL8139State),
3242         VMSTATE_UINT32(TimerInt, RTL8139State),
3243         VMSTATE_INT64(TCTR_base, RTL8139State),
3244 
3245         VMSTATE_UINT64(tally_counters.TxOk, RTL8139State),
3246         VMSTATE_UINT64(tally_counters.RxOk, RTL8139State),
3247         VMSTATE_UINT64(tally_counters.TxERR, RTL8139State),
3248         VMSTATE_UINT32(tally_counters.RxERR, RTL8139State),
3249         VMSTATE_UINT16(tally_counters.MissPkt, RTL8139State),
3250         VMSTATE_UINT16(tally_counters.FAE, RTL8139State),
3251         VMSTATE_UINT32(tally_counters.Tx1Col, RTL8139State),
3252         VMSTATE_UINT32(tally_counters.TxMCol, RTL8139State),
3253         VMSTATE_UINT64(tally_counters.RxOkPhy, RTL8139State),
3254         VMSTATE_UINT64(tally_counters.RxOkBrd, RTL8139State),
3255         VMSTATE_UINT32_V(tally_counters.RxOkMul, RTL8139State, 5),
3256         VMSTATE_UINT16(tally_counters.TxAbt, RTL8139State),
3257         VMSTATE_UINT16(tally_counters.TxUndrn, RTL8139State),
3258 
3259         VMSTATE_UINT32_V(cplus_enabled, RTL8139State, 4),
3260         VMSTATE_END_OF_LIST()
3261     },
3262     .subsections = (const VMStateDescription * const []) {
3263         &vmstate_rtl8139_hotplug_ready,
3264         NULL
3265     }
3266 };
3267 
3268 /***********************************************************/
3269 /* PCI RTL8139 definitions */
3270 
rtl8139_ioport_write(void * opaque,hwaddr addr,uint64_t val,unsigned size)3271 static void rtl8139_ioport_write(void *opaque, hwaddr addr,
3272                                  uint64_t val, unsigned size)
3273 {
3274     switch (size) {
3275     case 1:
3276         rtl8139_io_writeb(opaque, addr, val);
3277         break;
3278     case 2:
3279         rtl8139_io_writew(opaque, addr, val);
3280         break;
3281     case 4:
3282         rtl8139_io_writel(opaque, addr, val);
3283         break;
3284     }
3285 }
3286 
rtl8139_ioport_read(void * opaque,hwaddr addr,unsigned size)3287 static uint64_t rtl8139_ioport_read(void *opaque, hwaddr addr,
3288                                     unsigned size)
3289 {
3290     switch (size) {
3291     case 1:
3292         return rtl8139_io_readb(opaque, addr);
3293     case 2:
3294         return rtl8139_io_readw(opaque, addr);
3295     case 4:
3296         return rtl8139_io_readl(opaque, addr);
3297     }
3298 
3299     return -1;
3300 }
3301 
3302 static const MemoryRegionOps rtl8139_io_ops = {
3303     .read = rtl8139_ioport_read,
3304     .write = rtl8139_ioport_write,
3305     .impl = {
3306         .min_access_size = 1,
3307         .max_access_size = 4,
3308     },
3309     .endianness = DEVICE_LITTLE_ENDIAN,
3310 };
3311 
rtl8139_timer(void * opaque)3312 static void rtl8139_timer(void *opaque)
3313 {
3314     RTL8139State *s = opaque;
3315 
3316     if (!s->clock_enabled)
3317     {
3318         DPRINTF(">>> timer: clock is not running\n");
3319         return;
3320     }
3321 
3322     s->IntrStatus |= PCSTimeout;
3323     rtl8139_update_irq(s);
3324     rtl8139_set_next_tctr_time(s);
3325 }
3326 
pci_rtl8139_uninit(PCIDevice * dev)3327 static void pci_rtl8139_uninit(PCIDevice *dev)
3328 {
3329     RTL8139State *s = RTL8139(dev);
3330 
3331     g_free(s->cplus_txbuffer);
3332     s->cplus_txbuffer = NULL;
3333     timer_free(s->timer);
3334     qemu_del_nic(s->nic);
3335 }
3336 
rtl8139_set_link_status(NetClientState * nc)3337 static void rtl8139_set_link_status(NetClientState *nc)
3338 {
3339     RTL8139State *s = qemu_get_nic_opaque(nc);
3340 
3341     if (nc->link_down) {
3342         s->BasicModeStatus &= ~0x04;
3343     } else {
3344         s->BasicModeStatus |= 0x04;
3345     }
3346 
3347     s->IntrStatus |= RxUnderrun;
3348     rtl8139_update_irq(s);
3349 }
3350 
3351 static NetClientInfo net_rtl8139_info = {
3352     .type = NET_CLIENT_DRIVER_NIC,
3353     .size = sizeof(NICState),
3354     .can_receive = rtl8139_can_receive,
3355     .receive = rtl8139_receive,
3356     .link_status_changed = rtl8139_set_link_status,
3357 };
3358 
pci_rtl8139_realize(PCIDevice * dev,Error ** errp)3359 static void pci_rtl8139_realize(PCIDevice *dev, Error **errp)
3360 {
3361     RTL8139State *s = RTL8139(dev);
3362     DeviceState *d = DEVICE(dev);
3363     uint8_t *pci_conf;
3364 
3365     pci_conf = dev->config;
3366     pci_conf[PCI_INTERRUPT_PIN] = 1;    /* interrupt pin A */
3367     /* TODO: start of capability list, but no capability
3368      * list bit in status register, and offset 0xdc seems unused. */
3369     pci_conf[PCI_CAPABILITY_LIST] = 0xdc;
3370 
3371     memory_region_init_io(&s->bar_io, OBJECT(s), &rtl8139_io_ops, s,
3372                           "rtl8139", 0x100);
3373     memory_region_init_alias(&s->bar_mem, OBJECT(s), "rtl8139-mem", &s->bar_io,
3374                              0, 0x100);
3375 
3376     pci_register_bar(dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->bar_io);
3377     pci_register_bar(dev, 1, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->bar_mem);
3378 
3379     qemu_macaddr_default_if_unset(&s->conf.macaddr);
3380 
3381     /* prepare eeprom */
3382     s->eeprom.contents[0] = 0x8129;
3383 #if 1
3384     /* PCI vendor and device ID should be mirrored here */
3385     s->eeprom.contents[1] = PCI_VENDOR_ID_REALTEK;
3386     s->eeprom.contents[2] = PCI_DEVICE_ID_REALTEK_8139;
3387 #endif
3388     s->eeprom.contents[7] = s->conf.macaddr.a[0] | s->conf.macaddr.a[1] << 8;
3389     s->eeprom.contents[8] = s->conf.macaddr.a[2] | s->conf.macaddr.a[3] << 8;
3390     s->eeprom.contents[9] = s->conf.macaddr.a[4] | s->conf.macaddr.a[5] << 8;
3391 
3392     s->nic = qemu_new_nic(&net_rtl8139_info, &s->conf,
3393                           object_get_typename(OBJECT(dev)), d->id,
3394                           &d->mem_reentrancy_guard, s);
3395     qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
3396 
3397     s->cplus_txbuffer = NULL;
3398     s->cplus_txbuffer_len = 0;
3399     s->cplus_txbuffer_offset = 0;
3400 
3401     s->timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, rtl8139_timer, s);
3402 }
3403 
rtl8139_instance_init(Object * obj)3404 static void rtl8139_instance_init(Object *obj)
3405 {
3406     RTL8139State *s = RTL8139(obj);
3407 
3408     device_add_bootindex_property(obj, &s->conf.bootindex,
3409                                   "bootindex", "/ethernet-phy@0",
3410                                   DEVICE(obj));
3411 }
3412 
3413 static Property rtl8139_properties[] = {
3414     DEFINE_NIC_PROPERTIES(RTL8139State, conf),
3415     DEFINE_PROP_END_OF_LIST(),
3416 };
3417 
rtl8139_class_init(ObjectClass * klass,void * data)3418 static void rtl8139_class_init(ObjectClass *klass, void *data)
3419 {
3420     DeviceClass *dc = DEVICE_CLASS(klass);
3421     PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
3422 
3423     k->realize = pci_rtl8139_realize;
3424     k->exit = pci_rtl8139_uninit;
3425     k->romfile = "efi-rtl8139.rom";
3426     k->vendor_id = PCI_VENDOR_ID_REALTEK;
3427     k->device_id = PCI_DEVICE_ID_REALTEK_8139;
3428     k->revision = RTL8139_PCI_REVID; /* >=0x20 is for 8139C+ */
3429     k->class_id = PCI_CLASS_NETWORK_ETHERNET;
3430     device_class_set_legacy_reset(dc, rtl8139_reset);
3431     dc->vmsd = &vmstate_rtl8139;
3432     device_class_set_props(dc, rtl8139_properties);
3433     set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
3434 }
3435 
3436 static const TypeInfo rtl8139_info = {
3437     .name          = TYPE_RTL8139,
3438     .parent        = TYPE_PCI_DEVICE,
3439     .instance_size = sizeof(RTL8139State),
3440     .class_init    = rtl8139_class_init,
3441     .instance_init = rtl8139_instance_init,
3442     .interfaces = (InterfaceInfo[]) {
3443         { INTERFACE_CONVENTIONAL_PCI_DEVICE },
3444         { },
3445     },
3446 };
3447 
rtl8139_register_types(void)3448 static void rtl8139_register_types(void)
3449 {
3450     type_register_static(&rtl8139_info);
3451 }
3452 
3453 type_init(rtl8139_register_types)
3454