RTL8139
|
|
The RTL8139 Network Chip is used on many old and budget Ethernet Network Devices. It supports 10 and 100 MBit.
While the original chip lacks the features of newer Gigabit devices, it is a commonly emulated device in virtualization environments, due to its simplicity (fewer IO operations means faster traps to the Hypervisor), and extensive OS support.
It also makes a for a simple driver (and so is an excellent first choice for OS development hobbyists).
NB If you find your driver suddenly freezes and stops receiving interrupts and you're using kvm/qemu. Try the option -no-kvm-irqchip
The PCI vendor ID is 0x10EC and the device ID is 0x8139.
Contents |
Overview
RTL8139 is configured via registers. The IO base address and the IRQ number for the device is taken from PCI configuration.
Registers
These are the registers used for using RTL8139.
| Offset (from IO base) | Size | Name |
|---|---|---|
| 0x00 | 6 | MAC0-5 |
| 0x08 | 8 | MAR0-7 |
| 0x30 | 4 | RBSTART |
| 0x37 | 1 | CMD |
| 0x3C | 2 | IMR |
| 0x3E | 2 | ISR |
Programming Guide
PCI Bus Mastering
First, you need to enable PCI Bus Mastering for this device. This allows the NIC to perform DMA. To do it, you can read the Command Register from the device's PCI Configuration Space, set bit 2 (bus mastering bit) and write the modified Command Register. Note this Command Register is that of the PCI Configuration Space and has nothing to do with the Command Register that will be evoked in the following sections: the latter is specific to the RTL8139, whereas every PCI device (not only NICs) have a PCI Configuration Space with a Command Register.
Some BIOS may enable Bus Mastering at startup, but some versions of qemu don't. You should thus be careful about this step.
Turning on the RTL8139
Send 0x00 to the CONFIG_1 register (0x52) to set the LWAKE + LWPTN to active high. this should essentially *power on* the device.
outportb( ioaddr + 0x52, 0x0);
Software Reset!
Next, we should do a software reset to clear the RX and TX buffers and set everything back to defaults. Do this to eliminate the possibility of there still being garbage left in the buffers or registers on power on.
Sending 0x10 to the Command register (0x37) will send the RTL8139 into a software reset. Once that byte is sent, the RST bit must be checked to make sure that the chip has finished the reset. If the RST bit is high (1), then the reset is still in operation.
NB: There is a minor bug in Qemu. If you check the command register before performing a soft reset, you may find the RST bit is high (1). Just ignore it and carry on with the initialization procedure.
outportb( ioaddr + 0x37, 0x10); while( (inb(ioaddr + 0x37) & 0x10) != 0) { }
Init Receive buffer
For this part, we will send the chip a memory location to use as its receive buffer start location. One way to do it, would be to define a buffer variable and send that variables memory location to the RBSTART register (0x30).
//ioaddr is obtained from PCI configuration outportd(ioaddr + 0x30, (uintptr_t)rx_buffer); // send uint32_t memory location to RBSTART (0x30)
Note that 'rx_buffer' needs to be a pointer to a physical address. In this case a size of 8192 + 16 (8K + 16 bytes) is recommended, see below.
Set IMR + ISR
The Interrupt Mask Register (IMR) and Interrupt Service Register (ISR) are responsible for firing up different IRQs. The IMR bits line up with the ISR bits to work in sync. If an IMR bit is low, then the corresponding ISR bit with never fire an IRQ when the time comes for it to happen. The IMR is located at 0x3C and the ISR is located at 0x3E.
To set the RTL8139 to accept only the Transmit OK (TOK) and Receive OK (ROK) interrupts, we would have the TOK and ROK bits of the IMR high and leave the rest low. That way when a TOK or ROK IRQ happens, it actually will go through and fire up an IRQ.
outportw(ioaddr + 0x3C, 0x0005); // Sets the TOK and ROK bits high
Configuring receive buffer (RCR)
Before hoping to see a packet coming to you, you should tell the RTL8139 to accept packets based on various rules. The configuration register is RCR.
You can enable different "matching" rules:
- AB - Accept Broadcast: Accept broadcast packets sent to mac ff:ff:ff:ff:ff:ff
- AM - Accept Multicast: Accept multicast packets.
- APM - Accept Physical Match: Accept packets send to NIC's MAC address.
- AAP - Accept All Packets. Accept all packets (run in promiscuous mode).
Another bit, the WRAP bit, controls the handling of receive buffer wrap around.
If WRAP is 0, the Rx buffer is treated as a traditional ring buffer: if a packet is being written near the end of the buffer and the RTL8139 knows you've already handled data before this (thanks to CAPR), the packet will continue at the beginning of the buffer.
If WRAP is 1, the remainder of the packet will be written contiguously (overflowing the actual receive buffer) so that it can be handled more efficiently. This means the buffer must be an additional 1500 bytes (to hold the largest potentially overflowing packet).
You can also tell the size of your RX buffer here, however if you use a 8k + 16 buffer as described before, writing zeroes is enough. To use the WRAP=1 bit, an 8K buffer must in fact be 8k+16+1500 bytes.
outportl(ioaddr + 0x44, 0xf | (1 << 7)); // (1 << 7) is the WRAP bit, 0xf is AB+AM+APM+AAP
Enable Receive and Transmitter
Now is the time to start up the RX and TX functions. This is quite an easy piece, and should (in my opinion) only be done after all of the configurations to the RTL8139's registers have been set to what is desired. The RE (Receiver Enabled) and the TE (Transmitter Enabled) bits are located in the Command Register (0x37). Starting up the RE and TE is pretty straight-forward, but lets go through it anyways.
To enable the RTL8139 to accept and transmit packets, the RE and TE bits must go high. Once this is completed, then the card will start allowing packets in and/or out.
outportb(ioaddr + 0x37, 0x0C); // Sets the RE and TE bits high
Transmitting Packets
The RTL8139 NIC uses a round robin style for transmitting packets. It has four transmit buffer (a.k.a. transmit start) registers, and four transmit status/command registers. The transmit start registers are each 32 bits long, and are in I/O offsets 0x20, 0x24, 0x28 and 0x2C. The transmit status/command registers are also each 32 bits long and are in I/O offsets 0x10, 0x14, 0x18 and 0x1C. Each pair of transmit start and status registers work together (i.e. registers 0x20 and 0x10 work together, 0x24 and 0x14 work together, etc.)
After performing a controller reset as mentioned above, the controller ignores all transmit registers except pair zero (i.e. register 0x20 for the transmit start and register 0x10 for the status/command.) After software transmits a packet using those registers, the round robin counter increments, to use pair one (i.e. register 0x24 for the transmit start and register 0x14 for the status/command.) This continues until pair number three, which is the last transmit register pair, and the counter then overflows and goes back to pair number zero. When the controller is using a specific transmit register pair, all other transmit registers are ignored, and cannot be used to transmit packets at all. Software is responsible for keeping track which pair is being used.
Each transmit start register contains the 32-bit physical address of the packet which is to be sent over the network.
Each transmit status/command register contains various bit fields that control the transmission of the packet. The table below only gives a brief about these bits. For the full format, take a look at the RTL8139 specification under "External links" below.
| Bit Range | Description |
| 0-12 | Data size. This field contains the total size of the data to be sent across the network. The maximum value for this field is 1792, and larger numbers will cause an error. |
| 13 | Own bit. When this bit is set to 1, the controller is idle and not performing any DMA transfers on this descriptor. The driver sets this bit to zero to tell the controller to start transmitting the packet. The bit then remains zero until the entire packet has been copied from RAM into the controller's internal memory via DMA. The default value after a reset is one. Setting this bit to zero also clears all other status bits in this register. |
| 15 | Transmit OK. After the own bit has been set by the hardware, indicating the DMA transfer has completed, the hardware will start to transmit the packet across the actual network. This bit will be set to one after the network transmission has completed. |
ISR Handler
When you handle an interrupt, you have to write the bit corresponding to the interrupt to reset it. The datasheet says reading the register is enough to reset the buffer to zero and writing has no effect. This is not the case on QEMU, and probably on some/most hardware too.
Note that it is important you write to this register before you read any packets from your buffers, or the write to the register will have no effect, and any other packets than the first will not be delivered to your ISR.
For example, this is tested and works on QEmu:
void rtl8139_handler(uint8_t isr, uint64_t error, uint64_t irq) { uint16_t status = inw(io_base + 0x3e); outw(io_base + 0x3E, 0x05); if(status & TOK) { // Sent } if (status & ROK) { // Received receive_packet(); } }
Related Articles
- RTL8169 Successor Chipset
External Links
- xOS RTL8139 Driver (MIT license)
- http://www.magnesium.net/~wpaul/rt/spec-8139cp(150).pdf, Datasheet for the RTL8139C
- http://www.cs.usfca.edu/~cruse/cs326f04/RTL8139D_DataSheet.pdf, Datasheet for the RTL8139D, has more information
- http://www.cs.usfca.edu/~cruse/cs326f04/RTL8139_ProgrammersGuide.pdf, Programming guide for the RTL8139
- http://www.jbox.dk/sanos/source/sys/dev/rtl8139.c.html, Example Driver implementation (GPL Licensed)
