More documentation

README.md

@@ -4,18 +4,23 @@ It provides a minimal alternative firmware for the unmanaged switches. At this p
 the firmware can be installed on the hardware as given below, how much of the switch
 will actually work as a switch, will vary. On the 
 keepLINK kp-9000-6hx-x (RTL8372 + RTL8221B 2.5GBit PHY: 5 x 2.5GBit + 1x 10GBit SFP+),
-at present the system will provide switching capabilities between the 5 Ethernet ports.
+at present the system will provide the same featurs as a dumb switch plus a tiny
+TCP stack that will allow to reply to ARP and ping messages, thus enabling pinging the device.
 The ports served by the RTL8372 will be 100M/1G/2.5G auto-detect. Port 5 to RTL8221B PHY
 SerDes configuration works and supports 1GBit and 2.5GBit Ethernet (SGMII/HISGMII).
 SFP module insert/removal identification and reading of the SFP EEProm works. SFP
 module configuration works, too, tested for 1G modules.
+
+On the 9-port devices with RTL8273 + RTL8224, the 4 Ports served by the RTL8273 and
+SFP+ port will work normally and TCP connectivity will work as above. The RTL8224
+is currently not correctly initialized.
+
 All configuration must be done via serial
 connection (there is no web-interface), so soldering skills are required. Flashing
 must be done via a SOIC-8 PatchClamp or by soldering a socket for the flash chip.
-The SFP+ port does not work. There is no access to the CPU-port (NIC).
 
-If you don't want to solder, you can use this to learn about the devices by looking at
-the image using e.g. Ghidra.
+If you don't want to solder, you can use the project's code to learn about the
+devices by looking at the image using e.g. Ghidra.
 
 ## Compiling
 Install the following particular build requisites (Debian 12, should work on Ubuntu)

doc/CpuPort.md

@@ -0,0 +1,54 @@
+# The CPU Port
+
+The RTL827x provide a CPU Port for a NIC on the 8051 side of the SoC.
+
+## Receiving packets
+Packets are received by either polling the RTL837X_REG_RX_AVAIL register
+(0x7874), which will be > 0 if data is within a ring-buffer on the ASIC side
+of the SoC. Alternatively, an interrupt can be triggered (EX1).
+
+Data is transferred to the 8051 side by calling an SFR function. First, the
+frame header of the received frame will be copied over. For this, provide
+the destination memory location in xdata memory in SFRs B3 and B4 (little
+endian), the source location on the ASIC-side in SFRs B5/B6 (also little
+endian, found in RTL837X_REG_RX_RINGPTR, 0x787c) and execute the function
+by setting SFR_NIC_CTRL (B7) to the length to be transferred divided by 8,
+i.e. 1.
+
+The frame header has the following format:
+```
+SS xx xx xP LL LH xx xx
+SS:	8-bit sequence number
+P:	Port number
+LHLL:	Length of Ethernet frame (little endian)
+xx:	Unknown
+``` 
+
+Next, transfer the actual packet over by repeating the SFR function with a
+pointer to the frame on the ASIC directly after the frame header and a
+length as given by the length in the frame header + 7, again divided by 8.
+
+The received frame will have an RTL proprietary Ethernet frame type of
+0x8899 (RRPC) where normally the frame type 0x0800 for IPv4 would be located.
+Further 6 bytes follow describing the frame, before the normal IPv4 data
+starts.
+
+After copying over header and frame, the frame is marked read in the ring
+buffer on the ASIC side by writing 0x1 to RTL837X_REG_RX_DONE (0x784c).
+
+## Transmissing packets
+Packets are transmitted by preparing a frame-header plus frame in xdata memory
+and transferring both to the ASIC side via the SFRs.
+
+```
+SS 07 00 00 LL LH 00 00 
+SS:	8-bit sequence number
+LHLL:	Length of the Ethernet frame
+```
+The Ethernet frame data starts immediately after the frame header in xdata
+memory. The frame is transferred to the ASIC side by setting SFRs B3 and B4
+to the xdata source address of the frame header, and the ring pointer to the
+free space indicated by register XXXXXXXX multiplied by 8 and the MSB set.
+The length is given by the length of the frame plus 15, divided by 8.
+
+