1 /* 2 * QEMU model of SUN GEM ethernet controller 3 * 4 * As found in Apple ASICs among others 5 * 6 * Copyright 2016 Ben Herrenschmidt 7 * Copyright 2017 Mark Cave-Ayland 8 */ 9 10 #include "qemu/osdep.h" 11 #include "hw/pci/pci.h" 12 #include "hw/qdev-properties.h" 13 #include "migration/vmstate.h" 14 #include "qemu/log.h" 15 #include "qemu/module.h" 16 #include "net/net.h" 17 #include "net/eth.h" 18 #include "net/checksum.h" 19 #include "hw/net/mii.h" 20 #include "sysemu/sysemu.h" 21 #include "trace.h" 22 #include "qom/object.h" 23 24 #define TYPE_SUNGEM "sungem" 25 26 typedef struct SunGEMState SunGEMState; 27 #define SUNGEM(obj) OBJECT_CHECK(SunGEMState, (obj), TYPE_SUNGEM) 28 29 #define MAX_PACKET_SIZE 9016 30 31 #define SUNGEM_MMIO_SIZE 0x200000 32 33 /* Global registers */ 34 #define SUNGEM_MMIO_GREG_SIZE 0x2000 35 36 #define GREG_SEBSTATE 0x0000UL /* SEB State Register */ 37 38 #define GREG_STAT 0x000CUL /* Status Register */ 39 #define GREG_STAT_TXINTME 0x00000001 /* TX INTME frame transferred */ 40 #define GREG_STAT_TXALL 0x00000002 /* All TX frames transferred */ 41 #define GREG_STAT_TXDONE 0x00000004 /* One TX frame transferred */ 42 #define GREG_STAT_RXDONE 0x00000010 /* One RX frame arrived */ 43 #define GREG_STAT_RXNOBUF 0x00000020 /* No free RX buffers available */ 44 #define GREG_STAT_RXTAGERR 0x00000040 /* RX tag framing is corrupt */ 45 #define GREG_STAT_TXMAC 0x00004000 /* TX MAC signalled interrupt */ 46 #define GREG_STAT_RXMAC 0x00008000 /* RX MAC signalled interrupt */ 47 #define GREG_STAT_MAC 0x00010000 /* MAC Control signalled irq */ 48 #define GREG_STAT_TXNR 0xfff80000 /* == TXDMA_TXDONE reg val */ 49 #define GREG_STAT_TXNR_SHIFT 19 50 51 /* These interrupts are edge latches in the status register, 52 * reading it (or writing the corresponding bit in IACK) will 53 * clear them 54 */ 55 #define GREG_STAT_LATCH (GREG_STAT_TXALL | GREG_STAT_TXINTME | \ 56 GREG_STAT_RXDONE | GREG_STAT_RXDONE | \ 57 GREG_STAT_RXNOBUF | GREG_STAT_RXTAGERR) 58 59 #define GREG_IMASK 0x0010UL /* Interrupt Mask Register */ 60 #define GREG_IACK 0x0014UL /* Interrupt ACK Register */ 61 #define GREG_STAT2 0x001CUL /* Alias of GREG_STAT */ 62 #define GREG_PCIESTAT 0x1000UL /* PCI Error Status Register */ 63 #define GREG_PCIEMASK 0x1004UL /* PCI Error Mask Register */ 64 65 #define GREG_SWRST 0x1010UL /* Software Reset Register */ 66 #define GREG_SWRST_TXRST 0x00000001 /* TX Software Reset */ 67 #define GREG_SWRST_RXRST 0x00000002 /* RX Software Reset */ 68 #define GREG_SWRST_RSTOUT 0x00000004 /* Force RST# pin active */ 69 70 /* TX DMA Registers */ 71 #define SUNGEM_MMIO_TXDMA_SIZE 0x1000 72 73 #define TXDMA_KICK 0x0000UL /* TX Kick Register */ 74 75 #define TXDMA_CFG 0x0004UL /* TX Configuration Register */ 76 #define TXDMA_CFG_ENABLE 0x00000001 /* Enable TX DMA channel */ 77 #define TXDMA_CFG_RINGSZ 0x0000001e /* TX descriptor ring size */ 78 79 #define TXDMA_DBLOW 0x0008UL /* TX Desc. Base Low */ 80 #define TXDMA_DBHI 0x000CUL /* TX Desc. Base High */ 81 #define TXDMA_PCNT 0x0024UL /* TX FIFO Packet Counter */ 82 #define TXDMA_SMACHINE 0x0028UL /* TX State Machine Register */ 83 #define TXDMA_DPLOW 0x0030UL /* TX Data Pointer Low */ 84 #define TXDMA_DPHI 0x0034UL /* TX Data Pointer High */ 85 #define TXDMA_TXDONE 0x0100UL /* TX Completion Register */ 86 #define TXDMA_FTAG 0x0108UL /* TX FIFO Tag */ 87 #define TXDMA_FSZ 0x0118UL /* TX FIFO Size */ 88 89 /* Receive DMA Registers */ 90 #define SUNGEM_MMIO_RXDMA_SIZE 0x2000 91 92 #define RXDMA_CFG 0x0000UL /* RX Configuration Register */ 93 #define RXDMA_CFG_ENABLE 0x00000001 /* Enable RX DMA channel */ 94 #define RXDMA_CFG_RINGSZ 0x0000001e /* RX descriptor ring size */ 95 #define RXDMA_CFG_FBOFF 0x00001c00 /* Offset of first data byte */ 96 #define RXDMA_CFG_CSUMOFF 0x000fe000 /* Skip bytes before csum calc */ 97 98 #define RXDMA_DBLOW 0x0004UL /* RX Descriptor Base Low */ 99 #define RXDMA_DBHI 0x0008UL /* RX Descriptor Base High */ 100 #define RXDMA_PCNT 0x0018UL /* RX FIFO Packet Counter */ 101 #define RXDMA_SMACHINE 0x001CUL /* RX State Machine Register */ 102 #define RXDMA_PTHRESH 0x0020UL /* Pause Thresholds */ 103 #define RXDMA_DPLOW 0x0024UL /* RX Data Pointer Low */ 104 #define RXDMA_DPHI 0x0028UL /* RX Data Pointer High */ 105 #define RXDMA_KICK 0x0100UL /* RX Kick Register */ 106 #define RXDMA_DONE 0x0104UL /* RX Completion Register */ 107 #define RXDMA_BLANK 0x0108UL /* RX Blanking Register */ 108 #define RXDMA_FTAG 0x0110UL /* RX FIFO Tag */ 109 #define RXDMA_FSZ 0x0120UL /* RX FIFO Size */ 110 111 /* MAC Registers */ 112 #define SUNGEM_MMIO_MAC_SIZE 0x200 113 114 #define MAC_TXRST 0x0000UL /* TX MAC Software Reset Command */ 115 #define MAC_RXRST 0x0004UL /* RX MAC Software Reset Command */ 116 #define MAC_TXSTAT 0x0010UL /* TX MAC Status Register */ 117 #define MAC_RXSTAT 0x0014UL /* RX MAC Status Register */ 118 119 #define MAC_CSTAT 0x0018UL /* MAC Control Status Register */ 120 #define MAC_CSTAT_PTR 0xffff0000 /* Pause Time Received */ 121 122 #define MAC_TXMASK 0x0020UL /* TX MAC Mask Register */ 123 #define MAC_RXMASK 0x0024UL /* RX MAC Mask Register */ 124 #define MAC_MCMASK 0x0028UL /* MAC Control Mask Register */ 125 126 #define MAC_TXCFG 0x0030UL /* TX MAC Configuration Register */ 127 #define MAC_TXCFG_ENAB 0x00000001 /* TX MAC Enable */ 128 129 #define MAC_RXCFG 0x0034UL /* RX MAC Configuration Register */ 130 #define MAC_RXCFG_ENAB 0x00000001 /* RX MAC Enable */ 131 #define MAC_RXCFG_SFCS 0x00000004 /* Strip FCS */ 132 #define MAC_RXCFG_PROM 0x00000008 /* Promiscuous Mode */ 133 #define MAC_RXCFG_PGRP 0x00000010 /* Promiscuous Group */ 134 #define MAC_RXCFG_HFE 0x00000020 /* Hash Filter Enable */ 135 136 #define MAC_XIFCFG 0x003CUL /* XIF Configuration Register */ 137 #define MAC_XIFCFG_LBCK 0x00000002 /* Loopback TX to RX */ 138 139 #define MAC_MINFSZ 0x0050UL /* MinFrameSize Register */ 140 #define MAC_MAXFSZ 0x0054UL /* MaxFrameSize Register */ 141 #define MAC_ADDR0 0x0080UL /* MAC Address 0 Register */ 142 #define MAC_ADDR1 0x0084UL /* MAC Address 1 Register */ 143 #define MAC_ADDR2 0x0088UL /* MAC Address 2 Register */ 144 #define MAC_ADDR3 0x008CUL /* MAC Address 3 Register */ 145 #define MAC_ADDR4 0x0090UL /* MAC Address 4 Register */ 146 #define MAC_ADDR5 0x0094UL /* MAC Address 5 Register */ 147 #define MAC_HASH0 0x00C0UL /* Hash Table 0 Register */ 148 #define MAC_PATMPS 0x0114UL /* Peak Attempts Register */ 149 #define MAC_SMACHINE 0x0134UL /* State Machine Register */ 150 151 /* MIF Registers */ 152 #define SUNGEM_MMIO_MIF_SIZE 0x20 153 154 #define MIF_FRAME 0x000CUL /* MIF Frame/Output Register */ 155 #define MIF_FRAME_OP 0x30000000 /* OPcode */ 156 #define MIF_FRAME_PHYAD 0x0f800000 /* PHY ADdress */ 157 #define MIF_FRAME_REGAD 0x007c0000 /* REGister ADdress */ 158 #define MIF_FRAME_TALSB 0x00010000 /* Turn Around LSB */ 159 #define MIF_FRAME_DATA 0x0000ffff /* Instruction Payload */ 160 161 #define MIF_CFG 0x0010UL /* MIF Configuration Register */ 162 #define MIF_CFG_MDI0 0x00000100 /* MDIO_0 present or read-bit */ 163 #define MIF_CFG_MDI1 0x00000200 /* MDIO_1 present or read-bit */ 164 165 #define MIF_STATUS 0x0018UL /* MIF Status Register */ 166 #define MIF_SMACHINE 0x001CUL /* MIF State Machine Register */ 167 168 /* PCS/Serialink Registers */ 169 #define SUNGEM_MMIO_PCS_SIZE 0x60 170 #define PCS_MIISTAT 0x0004UL /* PCS MII Status Register */ 171 #define PCS_ISTAT 0x0018UL /* PCS Interrupt Status Reg */ 172 #define PCS_SSTATE 0x005CUL /* Serialink State Register */ 173 174 /* Descriptors */ 175 struct gem_txd { 176 uint64_t control_word; 177 uint64_t buffer; 178 }; 179 180 #define TXDCTRL_BUFSZ 0x0000000000007fffULL /* Buffer Size */ 181 #define TXDCTRL_CSTART 0x00000000001f8000ULL /* CSUM Start Offset */ 182 #define TXDCTRL_COFF 0x000000001fe00000ULL /* CSUM Stuff Offset */ 183 #define TXDCTRL_CENAB 0x0000000020000000ULL /* CSUM Enable */ 184 #define TXDCTRL_EOF 0x0000000040000000ULL /* End of Frame */ 185 #define TXDCTRL_SOF 0x0000000080000000ULL /* Start of Frame */ 186 #define TXDCTRL_INTME 0x0000000100000000ULL /* "Interrupt Me" */ 187 188 struct gem_rxd { 189 uint64_t status_word; 190 uint64_t buffer; 191 }; 192 193 #define RXDCTRL_HPASS 0x1000000000000000ULL /* Passed Hash Filter */ 194 #define RXDCTRL_ALTMAC 0x2000000000000000ULL /* Matched ALT MAC */ 195 196 197 struct SunGEMState { 198 PCIDevice pdev; 199 200 MemoryRegion sungem; 201 MemoryRegion greg; 202 MemoryRegion txdma; 203 MemoryRegion rxdma; 204 MemoryRegion mac; 205 MemoryRegion mif; 206 MemoryRegion pcs; 207 NICState *nic; 208 NICConf conf; 209 uint32_t phy_addr; 210 211 uint32_t gregs[SUNGEM_MMIO_GREG_SIZE >> 2]; 212 uint32_t txdmaregs[SUNGEM_MMIO_TXDMA_SIZE >> 2]; 213 uint32_t rxdmaregs[SUNGEM_MMIO_RXDMA_SIZE >> 2]; 214 uint32_t macregs[SUNGEM_MMIO_MAC_SIZE >> 2]; 215 uint32_t mifregs[SUNGEM_MMIO_MIF_SIZE >> 2]; 216 uint32_t pcsregs[SUNGEM_MMIO_PCS_SIZE >> 2]; 217 218 /* Cache some useful things */ 219 uint32_t rx_mask; 220 uint32_t tx_mask; 221 222 /* Current tx packet */ 223 uint8_t tx_data[MAX_PACKET_SIZE]; 224 uint32_t tx_size; 225 uint64_t tx_first_ctl; 226 }; 227 228 229 static void sungem_eval_irq(SunGEMState *s) 230 { 231 uint32_t stat, mask; 232 233 mask = s->gregs[GREG_IMASK >> 2]; 234 stat = s->gregs[GREG_STAT >> 2] & ~GREG_STAT_TXNR; 235 if (stat & ~mask) { 236 pci_set_irq(PCI_DEVICE(s), 1); 237 } else { 238 pci_set_irq(PCI_DEVICE(s), 0); 239 } 240 } 241 242 static void sungem_update_status(SunGEMState *s, uint32_t bits, bool val) 243 { 244 uint32_t stat; 245 246 stat = s->gregs[GREG_STAT >> 2]; 247 if (val) { 248 stat |= bits; 249 } else { 250 stat &= ~bits; 251 } 252 s->gregs[GREG_STAT >> 2] = stat; 253 sungem_eval_irq(s); 254 } 255 256 static void sungem_eval_cascade_irq(SunGEMState *s) 257 { 258 uint32_t stat, mask; 259 260 mask = s->macregs[MAC_TXSTAT >> 2]; 261 stat = s->macregs[MAC_TXMASK >> 2]; 262 if (stat & ~mask) { 263 sungem_update_status(s, GREG_STAT_TXMAC, true); 264 } else { 265 sungem_update_status(s, GREG_STAT_TXMAC, false); 266 } 267 268 mask = s->macregs[MAC_RXSTAT >> 2]; 269 stat = s->macregs[MAC_RXMASK >> 2]; 270 if (stat & ~mask) { 271 sungem_update_status(s, GREG_STAT_RXMAC, true); 272 } else { 273 sungem_update_status(s, GREG_STAT_RXMAC, false); 274 } 275 276 mask = s->macregs[MAC_CSTAT >> 2]; 277 stat = s->macregs[MAC_MCMASK >> 2] & ~MAC_CSTAT_PTR; 278 if (stat & ~mask) { 279 sungem_update_status(s, GREG_STAT_MAC, true); 280 } else { 281 sungem_update_status(s, GREG_STAT_MAC, false); 282 } 283 } 284 285 static void sungem_do_tx_csum(SunGEMState *s) 286 { 287 uint16_t start, off; 288 uint32_t csum; 289 290 start = (s->tx_first_ctl & TXDCTRL_CSTART) >> 15; 291 off = (s->tx_first_ctl & TXDCTRL_COFF) >> 21; 292 293 trace_sungem_tx_checksum(start, off); 294 295 if (start > (s->tx_size - 2) || off > (s->tx_size - 2)) { 296 trace_sungem_tx_checksum_oob(); 297 return; 298 } 299 300 csum = net_raw_checksum(s->tx_data + start, s->tx_size - start); 301 stw_be_p(s->tx_data + off, csum); 302 } 303 304 static void sungem_send_packet(SunGEMState *s, const uint8_t *buf, 305 int size) 306 { 307 NetClientState *nc = qemu_get_queue(s->nic); 308 309 if (s->macregs[MAC_XIFCFG >> 2] & MAC_XIFCFG_LBCK) { 310 nc->info->receive(nc, buf, size); 311 } else { 312 qemu_send_packet(nc, buf, size); 313 } 314 } 315 316 static void sungem_process_tx_desc(SunGEMState *s, struct gem_txd *desc) 317 { 318 PCIDevice *d = PCI_DEVICE(s); 319 uint32_t len; 320 321 /* If it's a start of frame, discard anything we had in the 322 * buffer and start again. This should be an error condition 323 * if we had something ... for now we ignore it 324 */ 325 if (desc->control_word & TXDCTRL_SOF) { 326 if (s->tx_first_ctl) { 327 trace_sungem_tx_unfinished(); 328 } 329 s->tx_size = 0; 330 s->tx_first_ctl = desc->control_word; 331 } 332 333 /* Grab data size */ 334 len = desc->control_word & TXDCTRL_BUFSZ; 335 336 /* Clamp it to our max size */ 337 if ((s->tx_size + len) > MAX_PACKET_SIZE) { 338 trace_sungem_tx_overflow(); 339 len = MAX_PACKET_SIZE - s->tx_size; 340 } 341 342 /* Read the data */ 343 pci_dma_read(d, desc->buffer, &s->tx_data[s->tx_size], len); 344 s->tx_size += len; 345 346 /* If end of frame, send packet */ 347 if (desc->control_word & TXDCTRL_EOF) { 348 trace_sungem_tx_finished(s->tx_size); 349 350 /* Handle csum */ 351 if (s->tx_first_ctl & TXDCTRL_CENAB) { 352 sungem_do_tx_csum(s); 353 } 354 355 /* Send it */ 356 sungem_send_packet(s, s->tx_data, s->tx_size); 357 358 /* No more pending packet */ 359 s->tx_size = 0; 360 s->tx_first_ctl = 0; 361 } 362 } 363 364 static void sungem_tx_kick(SunGEMState *s) 365 { 366 PCIDevice *d = PCI_DEVICE(s); 367 uint32_t comp, kick; 368 uint32_t txdma_cfg, txmac_cfg, ints; 369 uint64_t dbase; 370 371 trace_sungem_tx_kick(); 372 373 /* Check that both TX MAC and TX DMA are enabled. We don't 374 * handle DMA-less direct FIFO operations (we don't emulate 375 * the FIFO at all). 376 * 377 * A write to TXDMA_KICK while DMA isn't enabled can happen 378 * when the driver is resetting the pointer. 379 */ 380 txdma_cfg = s->txdmaregs[TXDMA_CFG >> 2]; 381 txmac_cfg = s->macregs[MAC_TXCFG >> 2]; 382 if (!(txdma_cfg & TXDMA_CFG_ENABLE) || 383 !(txmac_cfg & MAC_TXCFG_ENAB)) { 384 trace_sungem_tx_disabled(); 385 return; 386 } 387 388 /* XXX Test min frame size register ? */ 389 /* XXX Test max frame size register ? */ 390 391 dbase = s->txdmaregs[TXDMA_DBHI >> 2]; 392 dbase = (dbase << 32) | s->txdmaregs[TXDMA_DBLOW >> 2]; 393 394 comp = s->txdmaregs[TXDMA_TXDONE >> 2] & s->tx_mask; 395 kick = s->txdmaregs[TXDMA_KICK >> 2] & s->tx_mask; 396 397 trace_sungem_tx_process(comp, kick, s->tx_mask + 1); 398 399 /* This is rather primitive for now, we just send everything we 400 * can in one go, like e1000. Ideally we should do the sending 401 * from some kind of background task 402 */ 403 while (comp != kick) { 404 struct gem_txd desc; 405 406 /* Read the next descriptor */ 407 pci_dma_read(d, dbase + comp * sizeof(desc), &desc, sizeof(desc)); 408 409 /* Byteswap descriptor */ 410 desc.control_word = le64_to_cpu(desc.control_word); 411 desc.buffer = le64_to_cpu(desc.buffer); 412 trace_sungem_tx_desc(comp, desc.control_word, desc.buffer); 413 414 /* Send it for processing */ 415 sungem_process_tx_desc(s, &desc); 416 417 /* Interrupt */ 418 ints = GREG_STAT_TXDONE; 419 if (desc.control_word & TXDCTRL_INTME) { 420 ints |= GREG_STAT_TXINTME; 421 } 422 sungem_update_status(s, ints, true); 423 424 /* Next ! */ 425 comp = (comp + 1) & s->tx_mask; 426 s->txdmaregs[TXDMA_TXDONE >> 2] = comp; 427 } 428 429 /* We sent everything, set status/irq bit */ 430 sungem_update_status(s, GREG_STAT_TXALL, true); 431 } 432 433 static bool sungem_rx_full(SunGEMState *s, uint32_t kick, uint32_t done) 434 { 435 return kick == ((done + 1) & s->rx_mask); 436 } 437 438 static bool sungem_can_receive(NetClientState *nc) 439 { 440 SunGEMState *s = qemu_get_nic_opaque(nc); 441 uint32_t kick, done, rxdma_cfg, rxmac_cfg; 442 bool full; 443 444 rxmac_cfg = s->macregs[MAC_RXCFG >> 2]; 445 rxdma_cfg = s->rxdmaregs[RXDMA_CFG >> 2]; 446 447 /* If MAC disabled, can't receive */ 448 if ((rxmac_cfg & MAC_RXCFG_ENAB) == 0) { 449 trace_sungem_rx_mac_disabled(); 450 return false; 451 } 452 if ((rxdma_cfg & RXDMA_CFG_ENABLE) == 0) { 453 trace_sungem_rx_txdma_disabled(); 454 return false; 455 } 456 457 /* Check RX availability */ 458 kick = s->rxdmaregs[RXDMA_KICK >> 2]; 459 done = s->rxdmaregs[RXDMA_DONE >> 2]; 460 full = sungem_rx_full(s, kick, done); 461 462 trace_sungem_rx_check(!full, kick, done); 463 464 return !full; 465 } 466 467 enum { 468 rx_no_match, 469 rx_match_promisc, 470 rx_match_bcast, 471 rx_match_allmcast, 472 rx_match_mcast, 473 rx_match_mac, 474 rx_match_altmac, 475 }; 476 477 static int sungem_check_rx_mac(SunGEMState *s, const uint8_t *mac, uint32_t crc) 478 { 479 uint32_t rxcfg = s->macregs[MAC_RXCFG >> 2]; 480 uint32_t mac0, mac1, mac2; 481 482 /* Promisc enabled ? */ 483 if (rxcfg & MAC_RXCFG_PROM) { 484 return rx_match_promisc; 485 } 486 487 /* Format MAC address into dwords */ 488 mac0 = (mac[4] << 8) | mac[5]; 489 mac1 = (mac[2] << 8) | mac[3]; 490 mac2 = (mac[0] << 8) | mac[1]; 491 492 trace_sungem_rx_mac_check(mac0, mac1, mac2); 493 494 /* Is this a broadcast frame ? */ 495 if (mac0 == 0xffff && mac1 == 0xffff && mac2 == 0xffff) { 496 return rx_match_bcast; 497 } 498 499 /* TODO: Implement address filter registers (or we don't care ?) */ 500 501 /* Is this a multicast frame ? */ 502 if (mac[0] & 1) { 503 trace_sungem_rx_mac_multicast(); 504 505 /* Promisc group enabled ? */ 506 if (rxcfg & MAC_RXCFG_PGRP) { 507 return rx_match_allmcast; 508 } 509 510 /* TODO: Check MAC control frames (or we don't care) ? */ 511 512 /* Check hash filter (somebody check that's correct ?) */ 513 if (rxcfg & MAC_RXCFG_HFE) { 514 uint32_t hash, idx; 515 516 crc >>= 24; 517 idx = (crc >> 2) & 0x3c; 518 hash = s->macregs[(MAC_HASH0 + idx) >> 2]; 519 if (hash & (1 << (15 - (crc & 0xf)))) { 520 return rx_match_mcast; 521 } 522 } 523 return rx_no_match; 524 } 525 526 /* Main MAC check */ 527 trace_sungem_rx_mac_compare(s->macregs[MAC_ADDR0 >> 2], 528 s->macregs[MAC_ADDR1 >> 2], 529 s->macregs[MAC_ADDR2 >> 2]); 530 531 if (mac0 == s->macregs[MAC_ADDR0 >> 2] && 532 mac1 == s->macregs[MAC_ADDR1 >> 2] && 533 mac2 == s->macregs[MAC_ADDR2 >> 2]) { 534 return rx_match_mac; 535 } 536 537 /* Alt MAC check */ 538 if (mac0 == s->macregs[MAC_ADDR3 >> 2] && 539 mac1 == s->macregs[MAC_ADDR4 >> 2] && 540 mac2 == s->macregs[MAC_ADDR5 >> 2]) { 541 return rx_match_altmac; 542 } 543 544 return rx_no_match; 545 } 546 547 static ssize_t sungem_receive(NetClientState *nc, const uint8_t *buf, 548 size_t size) 549 { 550 SunGEMState *s = qemu_get_nic_opaque(nc); 551 PCIDevice *d = PCI_DEVICE(s); 552 uint32_t mac_crc, done, kick, max_fsize; 553 uint32_t fcs_size, ints, rxdma_cfg, rxmac_cfg, csum, coff; 554 uint8_t smallbuf[60]; 555 struct gem_rxd desc; 556 uint64_t dbase, baddr; 557 unsigned int rx_cond; 558 559 trace_sungem_rx_packet(size); 560 561 rxmac_cfg = s->macregs[MAC_RXCFG >> 2]; 562 rxdma_cfg = s->rxdmaregs[RXDMA_CFG >> 2]; 563 max_fsize = s->macregs[MAC_MAXFSZ >> 2] & 0x7fff; 564 565 /* If MAC or DMA disabled, can't receive */ 566 if (!(rxdma_cfg & RXDMA_CFG_ENABLE) || 567 !(rxmac_cfg & MAC_RXCFG_ENAB)) { 568 trace_sungem_rx_disabled(); 569 return 0; 570 } 571 572 /* Size adjustment for FCS */ 573 if (rxmac_cfg & MAC_RXCFG_SFCS) { 574 fcs_size = 0; 575 } else { 576 fcs_size = 4; 577 } 578 579 /* Discard frame smaller than a MAC or larger than max frame size 580 * (when accounting for FCS) 581 */ 582 if (size < 6 || (size + 4) > max_fsize) { 583 trace_sungem_rx_bad_frame_size(size); 584 /* XXX Increment error statistics ? */ 585 return size; 586 } 587 588 /* We don't drop too small frames since we get them in qemu, we pad 589 * them instead. We should probably use the min frame size register 590 * but I don't want to use a variable size staging buffer and I 591 * know both MacOS and Linux use the default 64 anyway. We use 60 592 * here to account for the non-existent FCS. 593 */ 594 if (size < 60) { 595 memcpy(smallbuf, buf, size); 596 memset(&smallbuf[size], 0, 60 - size); 597 buf = smallbuf; 598 size = 60; 599 } 600 601 /* Get MAC crc */ 602 mac_crc = net_crc32_le(buf, ETH_ALEN); 603 604 /* Packet isn't for me ? */ 605 rx_cond = sungem_check_rx_mac(s, buf, mac_crc); 606 if (rx_cond == rx_no_match) { 607 /* Just drop it */ 608 trace_sungem_rx_unmatched(); 609 return size; 610 } 611 612 /* Get ring pointers */ 613 kick = s->rxdmaregs[RXDMA_KICK >> 2] & s->rx_mask; 614 done = s->rxdmaregs[RXDMA_DONE >> 2] & s->rx_mask; 615 616 trace_sungem_rx_process(done, kick, s->rx_mask + 1); 617 618 /* Ring full ? Can't receive */ 619 if (sungem_rx_full(s, kick, done)) { 620 trace_sungem_rx_ringfull(); 621 return 0; 622 } 623 624 /* Note: The real GEM will fetch descriptors in blocks of 4, 625 * for now we handle them one at a time, I think the driver will 626 * cope 627 */ 628 629 dbase = s->rxdmaregs[RXDMA_DBHI >> 2]; 630 dbase = (dbase << 32) | s->rxdmaregs[RXDMA_DBLOW >> 2]; 631 632 /* Read the next descriptor */ 633 pci_dma_read(d, dbase + done * sizeof(desc), &desc, sizeof(desc)); 634 635 trace_sungem_rx_desc(le64_to_cpu(desc.status_word), 636 le64_to_cpu(desc.buffer)); 637 638 /* Effective buffer address */ 639 baddr = le64_to_cpu(desc.buffer) & ~7ull; 640 baddr |= (rxdma_cfg & RXDMA_CFG_FBOFF) >> 10; 641 642 /* Write buffer out */ 643 pci_dma_write(d, baddr, buf, size); 644 645 if (fcs_size) { 646 /* Should we add an FCS ? Linux doesn't ask us to strip it, 647 * however I believe nothing checks it... For now we just 648 * do nothing. It's faster this way. 649 */ 650 } 651 652 /* Calculate the checksum */ 653 coff = (rxdma_cfg & RXDMA_CFG_CSUMOFF) >> 13; 654 csum = net_raw_checksum((uint8_t *)buf + coff, size - coff); 655 656 /* Build the updated descriptor */ 657 desc.status_word = (size + fcs_size) << 16; 658 desc.status_word |= ((uint64_t)(mac_crc >> 16)) << 44; 659 desc.status_word |= csum; 660 if (rx_cond == rx_match_mcast) { 661 desc.status_word |= RXDCTRL_HPASS; 662 } 663 if (rx_cond == rx_match_altmac) { 664 desc.status_word |= RXDCTRL_ALTMAC; 665 } 666 desc.status_word = cpu_to_le64(desc.status_word); 667 668 pci_dma_write(d, dbase + done * sizeof(desc), &desc, sizeof(desc)); 669 670 done = (done + 1) & s->rx_mask; 671 s->rxdmaregs[RXDMA_DONE >> 2] = done; 672 673 /* XXX Unconditionally set RX interrupt for now. The interrupt 674 * mitigation timer might well end up adding more overhead than 675 * helping here... 676 */ 677 ints = GREG_STAT_RXDONE; 678 if (sungem_rx_full(s, kick, done)) { 679 ints |= GREG_STAT_RXNOBUF; 680 } 681 sungem_update_status(s, ints, true); 682 683 return size; 684 } 685 686 static void sungem_set_link_status(NetClientState *nc) 687 { 688 /* We don't do anything for now as I believe none of the OSes 689 * drivers use the MIF autopoll feature nor the PHY interrupt 690 */ 691 } 692 693 static void sungem_update_masks(SunGEMState *s) 694 { 695 uint32_t sz; 696 697 sz = 1 << (((s->rxdmaregs[RXDMA_CFG >> 2] & RXDMA_CFG_RINGSZ) >> 1) + 5); 698 s->rx_mask = sz - 1; 699 700 sz = 1 << (((s->txdmaregs[TXDMA_CFG >> 2] & TXDMA_CFG_RINGSZ) >> 1) + 5); 701 s->tx_mask = sz - 1; 702 } 703 704 static void sungem_reset_rx(SunGEMState *s) 705 { 706 trace_sungem_rx_reset(); 707 708 /* XXX Do RXCFG */ 709 /* XXX Check value */ 710 s->rxdmaregs[RXDMA_FSZ >> 2] = 0x140; 711 s->rxdmaregs[RXDMA_DONE >> 2] = 0; 712 s->rxdmaregs[RXDMA_KICK >> 2] = 0; 713 s->rxdmaregs[RXDMA_CFG >> 2] = 0x1000010; 714 s->rxdmaregs[RXDMA_PTHRESH >> 2] = 0xf8; 715 s->rxdmaregs[RXDMA_BLANK >> 2] = 0; 716 717 sungem_update_masks(s); 718 } 719 720 static void sungem_reset_tx(SunGEMState *s) 721 { 722 trace_sungem_tx_reset(); 723 724 /* XXX Do TXCFG */ 725 /* XXX Check value */ 726 s->txdmaregs[TXDMA_FSZ >> 2] = 0x90; 727 s->txdmaregs[TXDMA_TXDONE >> 2] = 0; 728 s->txdmaregs[TXDMA_KICK >> 2] = 0; 729 s->txdmaregs[TXDMA_CFG >> 2] = 0x118010; 730 731 sungem_update_masks(s); 732 733 s->tx_size = 0; 734 s->tx_first_ctl = 0; 735 } 736 737 static void sungem_reset_all(SunGEMState *s, bool pci_reset) 738 { 739 trace_sungem_reset(pci_reset); 740 741 sungem_reset_rx(s); 742 sungem_reset_tx(s); 743 744 s->gregs[GREG_IMASK >> 2] = 0xFFFFFFF; 745 s->gregs[GREG_STAT >> 2] = 0; 746 if (pci_reset) { 747 uint8_t *ma = s->conf.macaddr.a; 748 749 s->gregs[GREG_SWRST >> 2] = 0; 750 s->macregs[MAC_ADDR0 >> 2] = (ma[4] << 8) | ma[5]; 751 s->macregs[MAC_ADDR1 >> 2] = (ma[2] << 8) | ma[3]; 752 s->macregs[MAC_ADDR2 >> 2] = (ma[0] << 8) | ma[1]; 753 } else { 754 s->gregs[GREG_SWRST >> 2] &= GREG_SWRST_RSTOUT; 755 } 756 s->mifregs[MIF_CFG >> 2] = MIF_CFG_MDI0; 757 } 758 759 static void sungem_mii_write(SunGEMState *s, uint8_t phy_addr, 760 uint8_t reg_addr, uint16_t val) 761 { 762 trace_sungem_mii_write(phy_addr, reg_addr, val); 763 764 /* XXX TODO */ 765 } 766 767 static uint16_t __sungem_mii_read(SunGEMState *s, uint8_t phy_addr, 768 uint8_t reg_addr) 769 { 770 if (phy_addr != s->phy_addr) { 771 return 0xffff; 772 } 773 /* Primitive emulation of a BCM5201 to please the driver, 774 * ID is 0x00406210. TODO: Do a gigabit PHY like BCM5400 775 */ 776 switch (reg_addr) { 777 case MII_BMCR: 778 return 0; 779 case MII_PHYID1: 780 return 0x0040; 781 case MII_PHYID2: 782 return 0x6210; 783 case MII_BMSR: 784 if (qemu_get_queue(s->nic)->link_down) { 785 return MII_BMSR_100TX_FD | MII_BMSR_AUTONEG; 786 } else { 787 return MII_BMSR_100TX_FD | MII_BMSR_AN_COMP | 788 MII_BMSR_AUTONEG | MII_BMSR_LINK_ST; 789 } 790 case MII_ANLPAR: 791 case MII_ANAR: 792 return MII_ANLPAR_TXFD; 793 case 0x18: /* 5201 AUX status */ 794 return 3; /* 100FD */ 795 default: 796 return 0; 797 }; 798 } 799 static uint16_t sungem_mii_read(SunGEMState *s, uint8_t phy_addr, 800 uint8_t reg_addr) 801 { 802 uint16_t val; 803 804 val = __sungem_mii_read(s, phy_addr, reg_addr); 805 806 trace_sungem_mii_read(phy_addr, reg_addr, val); 807 808 return val; 809 } 810 811 static uint32_t sungem_mii_op(SunGEMState *s, uint32_t val) 812 { 813 uint8_t phy_addr, reg_addr, op; 814 815 /* Ignore not start of frame */ 816 if ((val >> 30) != 1) { 817 trace_sungem_mii_invalid_sof(val >> 30); 818 return 0xffff; 819 } 820 phy_addr = (val & MIF_FRAME_PHYAD) >> 23; 821 reg_addr = (val & MIF_FRAME_REGAD) >> 18; 822 op = (val & MIF_FRAME_OP) >> 28; 823 switch (op) { 824 case 1: 825 sungem_mii_write(s, phy_addr, reg_addr, val & MIF_FRAME_DATA); 826 return val | MIF_FRAME_TALSB; 827 case 2: 828 return sungem_mii_read(s, phy_addr, reg_addr) | MIF_FRAME_TALSB; 829 default: 830 trace_sungem_mii_invalid_op(op); 831 } 832 return 0xffff | MIF_FRAME_TALSB; 833 } 834 835 static void sungem_mmio_greg_write(void *opaque, hwaddr addr, uint64_t val, 836 unsigned size) 837 { 838 SunGEMState *s = opaque; 839 840 if (!(addr < 0x20) && !(addr >= 0x1000 && addr <= 0x1010)) { 841 qemu_log_mask(LOG_GUEST_ERROR, 842 "Write to unknown GREG register 0x%"HWADDR_PRIx"\n", 843 addr); 844 return; 845 } 846 847 trace_sungem_mmio_greg_write(addr, val); 848 849 /* Pre-write filter */ 850 switch (addr) { 851 /* Read only registers */ 852 case GREG_SEBSTATE: 853 case GREG_STAT: 854 case GREG_STAT2: 855 case GREG_PCIESTAT: 856 return; /* No actual write */ 857 case GREG_IACK: 858 val &= GREG_STAT_LATCH; 859 s->gregs[GREG_STAT >> 2] &= ~val; 860 sungem_eval_irq(s); 861 return; /* No actual write */ 862 case GREG_PCIEMASK: 863 val &= 0x7; 864 break; 865 } 866 867 s->gregs[addr >> 2] = val; 868 869 /* Post write action */ 870 switch (addr) { 871 case GREG_IMASK: 872 /* Re-evaluate interrupt */ 873 sungem_eval_irq(s); 874 break; 875 case GREG_SWRST: 876 switch (val & (GREG_SWRST_TXRST | GREG_SWRST_RXRST)) { 877 case GREG_SWRST_RXRST: 878 sungem_reset_rx(s); 879 break; 880 case GREG_SWRST_TXRST: 881 sungem_reset_tx(s); 882 break; 883 case GREG_SWRST_RXRST | GREG_SWRST_TXRST: 884 sungem_reset_all(s, false); 885 } 886 break; 887 } 888 } 889 890 static uint64_t sungem_mmio_greg_read(void *opaque, hwaddr addr, unsigned size) 891 { 892 SunGEMState *s = opaque; 893 uint32_t val; 894 895 if (!(addr < 0x20) && !(addr >= 0x1000 && addr <= 0x1010)) { 896 qemu_log_mask(LOG_GUEST_ERROR, 897 "Read from unknown GREG register 0x%"HWADDR_PRIx"\n", 898 addr); 899 return 0; 900 } 901 902 val = s->gregs[addr >> 2]; 903 904 trace_sungem_mmio_greg_read(addr, val); 905 906 switch (addr) { 907 case GREG_STAT: 908 /* Side effect, clear bottom 7 bits */ 909 s->gregs[GREG_STAT >> 2] &= ~GREG_STAT_LATCH; 910 sungem_eval_irq(s); 911 912 /* Inject TX completion in returned value */ 913 val = (val & ~GREG_STAT_TXNR) | 914 (s->txdmaregs[TXDMA_TXDONE >> 2] << GREG_STAT_TXNR_SHIFT); 915 break; 916 case GREG_STAT2: 917 /* Return the status reg without side effect 918 * (and inject TX completion in returned value) 919 */ 920 val = (s->gregs[GREG_STAT >> 2] & ~GREG_STAT_TXNR) | 921 (s->txdmaregs[TXDMA_TXDONE >> 2] << GREG_STAT_TXNR_SHIFT); 922 break; 923 } 924 925 return val; 926 } 927 928 static const MemoryRegionOps sungem_mmio_greg_ops = { 929 .read = sungem_mmio_greg_read, 930 .write = sungem_mmio_greg_write, 931 .endianness = DEVICE_LITTLE_ENDIAN, 932 .impl = { 933 .min_access_size = 4, 934 .max_access_size = 4, 935 }, 936 }; 937 938 static void sungem_mmio_txdma_write(void *opaque, hwaddr addr, uint64_t val, 939 unsigned size) 940 { 941 SunGEMState *s = opaque; 942 943 if (!(addr < 0x38) && !(addr >= 0x100 && addr <= 0x118)) { 944 qemu_log_mask(LOG_GUEST_ERROR, 945 "Write to unknown TXDMA register 0x%"HWADDR_PRIx"\n", 946 addr); 947 return; 948 } 949 950 trace_sungem_mmio_txdma_write(addr, val); 951 952 /* Pre-write filter */ 953 switch (addr) { 954 /* Read only registers */ 955 case TXDMA_TXDONE: 956 case TXDMA_PCNT: 957 case TXDMA_SMACHINE: 958 case TXDMA_DPLOW: 959 case TXDMA_DPHI: 960 case TXDMA_FSZ: 961 case TXDMA_FTAG: 962 return; /* No actual write */ 963 } 964 965 s->txdmaregs[addr >> 2] = val; 966 967 /* Post write action */ 968 switch (addr) { 969 case TXDMA_KICK: 970 sungem_tx_kick(s); 971 break; 972 case TXDMA_CFG: 973 sungem_update_masks(s); 974 break; 975 } 976 } 977 978 static uint64_t sungem_mmio_txdma_read(void *opaque, hwaddr addr, unsigned size) 979 { 980 SunGEMState *s = opaque; 981 uint32_t val; 982 983 if (!(addr < 0x38) && !(addr >= 0x100 && addr <= 0x118)) { 984 qemu_log_mask(LOG_GUEST_ERROR, 985 "Read from unknown TXDMA register 0x%"HWADDR_PRIx"\n", 986 addr); 987 return 0; 988 } 989 990 val = s->txdmaregs[addr >> 2]; 991 992 trace_sungem_mmio_txdma_read(addr, val); 993 994 return val; 995 } 996 997 static const MemoryRegionOps sungem_mmio_txdma_ops = { 998 .read = sungem_mmio_txdma_read, 999 .write = sungem_mmio_txdma_write, 1000 .endianness = DEVICE_LITTLE_ENDIAN, 1001 .impl = { 1002 .min_access_size = 4, 1003 .max_access_size = 4, 1004 }, 1005 }; 1006 1007 static void sungem_mmio_rxdma_write(void *opaque, hwaddr addr, uint64_t val, 1008 unsigned size) 1009 { 1010 SunGEMState *s = opaque; 1011 1012 if (!(addr <= 0x28) && !(addr >= 0x100 && addr <= 0x120)) { 1013 qemu_log_mask(LOG_GUEST_ERROR, 1014 "Write to unknown RXDMA register 0x%"HWADDR_PRIx"\n", 1015 addr); 1016 return; 1017 } 1018 1019 trace_sungem_mmio_rxdma_write(addr, val); 1020 1021 /* Pre-write filter */ 1022 switch (addr) { 1023 /* Read only registers */ 1024 case RXDMA_DONE: 1025 case RXDMA_PCNT: 1026 case RXDMA_SMACHINE: 1027 case RXDMA_DPLOW: 1028 case RXDMA_DPHI: 1029 case RXDMA_FSZ: 1030 case RXDMA_FTAG: 1031 return; /* No actual write */ 1032 } 1033 1034 s->rxdmaregs[addr >> 2] = val; 1035 1036 /* Post write action */ 1037 switch (addr) { 1038 case RXDMA_KICK: 1039 trace_sungem_rx_kick(val); 1040 break; 1041 case RXDMA_CFG: 1042 sungem_update_masks(s); 1043 if ((s->macregs[MAC_RXCFG >> 2] & MAC_RXCFG_ENAB) != 0 && 1044 (s->rxdmaregs[RXDMA_CFG >> 2] & RXDMA_CFG_ENABLE) != 0) { 1045 qemu_flush_queued_packets(qemu_get_queue(s->nic)); 1046 } 1047 break; 1048 } 1049 } 1050 1051 static uint64_t sungem_mmio_rxdma_read(void *opaque, hwaddr addr, unsigned size) 1052 { 1053 SunGEMState *s = opaque; 1054 uint32_t val; 1055 1056 if (!(addr <= 0x28) && !(addr >= 0x100 && addr <= 0x120)) { 1057 qemu_log_mask(LOG_GUEST_ERROR, 1058 "Read from unknown RXDMA register 0x%"HWADDR_PRIx"\n", 1059 addr); 1060 return 0; 1061 } 1062 1063 val = s->rxdmaregs[addr >> 2]; 1064 1065 trace_sungem_mmio_rxdma_read(addr, val); 1066 1067 return val; 1068 } 1069 1070 static const MemoryRegionOps sungem_mmio_rxdma_ops = { 1071 .read = sungem_mmio_rxdma_read, 1072 .write = sungem_mmio_rxdma_write, 1073 .endianness = DEVICE_LITTLE_ENDIAN, 1074 .impl = { 1075 .min_access_size = 4, 1076 .max_access_size = 4, 1077 }, 1078 }; 1079 1080 static void sungem_mmio_mac_write(void *opaque, hwaddr addr, uint64_t val, 1081 unsigned size) 1082 { 1083 SunGEMState *s = opaque; 1084 1085 if (!(addr <= 0x134)) { 1086 qemu_log_mask(LOG_GUEST_ERROR, 1087 "Write to unknown MAC register 0x%"HWADDR_PRIx"\n", 1088 addr); 1089 return; 1090 } 1091 1092 trace_sungem_mmio_mac_write(addr, val); 1093 1094 /* Pre-write filter */ 1095 switch (addr) { 1096 /* Read only registers */ 1097 case MAC_TXRST: /* Not technically read-only but will do for now */ 1098 case MAC_RXRST: /* Not technically read-only but will do for now */ 1099 case MAC_TXSTAT: 1100 case MAC_RXSTAT: 1101 case MAC_CSTAT: 1102 case MAC_PATMPS: 1103 case MAC_SMACHINE: 1104 return; /* No actual write */ 1105 case MAC_MINFSZ: 1106 /* 10-bits implemented */ 1107 val &= 0x3ff; 1108 break; 1109 } 1110 1111 s->macregs[addr >> 2] = val; 1112 1113 /* Post write action */ 1114 switch (addr) { 1115 case MAC_TXMASK: 1116 case MAC_RXMASK: 1117 case MAC_MCMASK: 1118 sungem_eval_cascade_irq(s); 1119 break; 1120 case MAC_RXCFG: 1121 sungem_update_masks(s); 1122 if ((s->macregs[MAC_RXCFG >> 2] & MAC_RXCFG_ENAB) != 0 && 1123 (s->rxdmaregs[RXDMA_CFG >> 2] & RXDMA_CFG_ENABLE) != 0) { 1124 qemu_flush_queued_packets(qemu_get_queue(s->nic)); 1125 } 1126 break; 1127 } 1128 } 1129 1130 static uint64_t sungem_mmio_mac_read(void *opaque, hwaddr addr, unsigned size) 1131 { 1132 SunGEMState *s = opaque; 1133 uint32_t val; 1134 1135 if (!(addr <= 0x134)) { 1136 qemu_log_mask(LOG_GUEST_ERROR, 1137 "Read from unknown MAC register 0x%"HWADDR_PRIx"\n", 1138 addr); 1139 return 0; 1140 } 1141 1142 val = s->macregs[addr >> 2]; 1143 1144 trace_sungem_mmio_mac_read(addr, val); 1145 1146 switch (addr) { 1147 case MAC_TXSTAT: 1148 /* Side effect, clear all */ 1149 s->macregs[addr >> 2] = 0; 1150 sungem_update_status(s, GREG_STAT_TXMAC, false); 1151 break; 1152 case MAC_RXSTAT: 1153 /* Side effect, clear all */ 1154 s->macregs[addr >> 2] = 0; 1155 sungem_update_status(s, GREG_STAT_RXMAC, false); 1156 break; 1157 case MAC_CSTAT: 1158 /* Side effect, interrupt bits */ 1159 s->macregs[addr >> 2] &= MAC_CSTAT_PTR; 1160 sungem_update_status(s, GREG_STAT_MAC, false); 1161 break; 1162 } 1163 1164 return val; 1165 } 1166 1167 static const MemoryRegionOps sungem_mmio_mac_ops = { 1168 .read = sungem_mmio_mac_read, 1169 .write = sungem_mmio_mac_write, 1170 .endianness = DEVICE_LITTLE_ENDIAN, 1171 .impl = { 1172 .min_access_size = 4, 1173 .max_access_size = 4, 1174 }, 1175 }; 1176 1177 static void sungem_mmio_mif_write(void *opaque, hwaddr addr, uint64_t val, 1178 unsigned size) 1179 { 1180 SunGEMState *s = opaque; 1181 1182 if (!(addr <= 0x1c)) { 1183 qemu_log_mask(LOG_GUEST_ERROR, 1184 "Write to unknown MIF register 0x%"HWADDR_PRIx"\n", 1185 addr); 1186 return; 1187 } 1188 1189 trace_sungem_mmio_mif_write(addr, val); 1190 1191 /* Pre-write filter */ 1192 switch (addr) { 1193 /* Read only registers */ 1194 case MIF_STATUS: 1195 case MIF_SMACHINE: 1196 return; /* No actual write */ 1197 case MIF_CFG: 1198 /* Maintain the RO MDI bits to advertize an MDIO PHY on MDI0 */ 1199 val &= ~MIF_CFG_MDI1; 1200 val |= MIF_CFG_MDI0; 1201 break; 1202 } 1203 1204 s->mifregs[addr >> 2] = val; 1205 1206 /* Post write action */ 1207 switch (addr) { 1208 case MIF_FRAME: 1209 s->mifregs[addr >> 2] = sungem_mii_op(s, val); 1210 break; 1211 } 1212 } 1213 1214 static uint64_t sungem_mmio_mif_read(void *opaque, hwaddr addr, unsigned size) 1215 { 1216 SunGEMState *s = opaque; 1217 uint32_t val; 1218 1219 if (!(addr <= 0x1c)) { 1220 qemu_log_mask(LOG_GUEST_ERROR, 1221 "Read from unknown MIF register 0x%"HWADDR_PRIx"\n", 1222 addr); 1223 return 0; 1224 } 1225 1226 val = s->mifregs[addr >> 2]; 1227 1228 trace_sungem_mmio_mif_read(addr, val); 1229 1230 return val; 1231 } 1232 1233 static const MemoryRegionOps sungem_mmio_mif_ops = { 1234 .read = sungem_mmio_mif_read, 1235 .write = sungem_mmio_mif_write, 1236 .endianness = DEVICE_LITTLE_ENDIAN, 1237 .impl = { 1238 .min_access_size = 4, 1239 .max_access_size = 4, 1240 }, 1241 }; 1242 1243 static void sungem_mmio_pcs_write(void *opaque, hwaddr addr, uint64_t val, 1244 unsigned size) 1245 { 1246 SunGEMState *s = opaque; 1247 1248 if (!(addr <= 0x18) && !(addr >= 0x50 && addr <= 0x5c)) { 1249 qemu_log_mask(LOG_GUEST_ERROR, 1250 "Write to unknown PCS register 0x%"HWADDR_PRIx"\n", 1251 addr); 1252 return; 1253 } 1254 1255 trace_sungem_mmio_pcs_write(addr, val); 1256 1257 /* Pre-write filter */ 1258 switch (addr) { 1259 /* Read only registers */ 1260 case PCS_MIISTAT: 1261 case PCS_ISTAT: 1262 case PCS_SSTATE: 1263 return; /* No actual write */ 1264 } 1265 1266 s->pcsregs[addr >> 2] = val; 1267 } 1268 1269 static uint64_t sungem_mmio_pcs_read(void *opaque, hwaddr addr, unsigned size) 1270 { 1271 SunGEMState *s = opaque; 1272 uint32_t val; 1273 1274 if (!(addr <= 0x18) && !(addr >= 0x50 && addr <= 0x5c)) { 1275 qemu_log_mask(LOG_GUEST_ERROR, 1276 "Read from unknown PCS register 0x%"HWADDR_PRIx"\n", 1277 addr); 1278 return 0; 1279 } 1280 1281 val = s->pcsregs[addr >> 2]; 1282 1283 trace_sungem_mmio_pcs_read(addr, val); 1284 1285 return val; 1286 } 1287 1288 static const MemoryRegionOps sungem_mmio_pcs_ops = { 1289 .read = sungem_mmio_pcs_read, 1290 .write = sungem_mmio_pcs_write, 1291 .endianness = DEVICE_LITTLE_ENDIAN, 1292 .impl = { 1293 .min_access_size = 4, 1294 .max_access_size = 4, 1295 }, 1296 }; 1297 1298 static void sungem_uninit(PCIDevice *dev) 1299 { 1300 SunGEMState *s = SUNGEM(dev); 1301 1302 qemu_del_nic(s->nic); 1303 } 1304 1305 static NetClientInfo net_sungem_info = { 1306 .type = NET_CLIENT_DRIVER_NIC, 1307 .size = sizeof(NICState), 1308 .can_receive = sungem_can_receive, 1309 .receive = sungem_receive, 1310 .link_status_changed = sungem_set_link_status, 1311 }; 1312 1313 static void sungem_realize(PCIDevice *pci_dev, Error **errp) 1314 { 1315 DeviceState *dev = DEVICE(pci_dev); 1316 SunGEMState *s = SUNGEM(pci_dev); 1317 uint8_t *pci_conf; 1318 1319 pci_conf = pci_dev->config; 1320 1321 pci_set_word(pci_conf + PCI_STATUS, 1322 PCI_STATUS_FAST_BACK | 1323 PCI_STATUS_DEVSEL_MEDIUM | 1324 PCI_STATUS_66MHZ); 1325 1326 pci_set_word(pci_conf + PCI_SUBSYSTEM_VENDOR_ID, 0x0); 1327 pci_set_word(pci_conf + PCI_SUBSYSTEM_ID, 0x0); 1328 1329 pci_conf[PCI_INTERRUPT_PIN] = 1; /* interrupt pin A */ 1330 pci_conf[PCI_MIN_GNT] = 0x40; 1331 pci_conf[PCI_MAX_LAT] = 0x40; 1332 1333 sungem_reset_all(s, true); 1334 memory_region_init(&s->sungem, OBJECT(s), "sungem", SUNGEM_MMIO_SIZE); 1335 1336 memory_region_init_io(&s->greg, OBJECT(s), &sungem_mmio_greg_ops, s, 1337 "sungem.greg", SUNGEM_MMIO_GREG_SIZE); 1338 memory_region_add_subregion(&s->sungem, 0, &s->greg); 1339 1340 memory_region_init_io(&s->txdma, OBJECT(s), &sungem_mmio_txdma_ops, s, 1341 "sungem.txdma", SUNGEM_MMIO_TXDMA_SIZE); 1342 memory_region_add_subregion(&s->sungem, 0x2000, &s->txdma); 1343 1344 memory_region_init_io(&s->rxdma, OBJECT(s), &sungem_mmio_rxdma_ops, s, 1345 "sungem.rxdma", SUNGEM_MMIO_RXDMA_SIZE); 1346 memory_region_add_subregion(&s->sungem, 0x4000, &s->rxdma); 1347 1348 memory_region_init_io(&s->mac, OBJECT(s), &sungem_mmio_mac_ops, s, 1349 "sungem.mac", SUNGEM_MMIO_MAC_SIZE); 1350 memory_region_add_subregion(&s->sungem, 0x6000, &s->mac); 1351 1352 memory_region_init_io(&s->mif, OBJECT(s), &sungem_mmio_mif_ops, s, 1353 "sungem.mif", SUNGEM_MMIO_MIF_SIZE); 1354 memory_region_add_subregion(&s->sungem, 0x6200, &s->mif); 1355 1356 memory_region_init_io(&s->pcs, OBJECT(s), &sungem_mmio_pcs_ops, s, 1357 "sungem.pcs", SUNGEM_MMIO_PCS_SIZE); 1358 memory_region_add_subregion(&s->sungem, 0x9000, &s->pcs); 1359 1360 pci_register_bar(pci_dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->sungem); 1361 1362 qemu_macaddr_default_if_unset(&s->conf.macaddr); 1363 s->nic = qemu_new_nic(&net_sungem_info, &s->conf, 1364 object_get_typename(OBJECT(dev)), 1365 dev->id, s); 1366 qemu_format_nic_info_str(qemu_get_queue(s->nic), 1367 s->conf.macaddr.a); 1368 } 1369 1370 static void sungem_reset(DeviceState *dev) 1371 { 1372 SunGEMState *s = SUNGEM(dev); 1373 1374 sungem_reset_all(s, true); 1375 } 1376 1377 static void sungem_instance_init(Object *obj) 1378 { 1379 SunGEMState *s = SUNGEM(obj); 1380 1381 device_add_bootindex_property(obj, &s->conf.bootindex, 1382 "bootindex", "/ethernet-phy@0", 1383 DEVICE(obj)); 1384 } 1385 1386 static Property sungem_properties[] = { 1387 DEFINE_NIC_PROPERTIES(SunGEMState, conf), 1388 /* Phy address should be 0 for most Apple machines except 1389 * for K2 in which case it's 1. Will be set by a machine 1390 * override. 1391 */ 1392 DEFINE_PROP_UINT32("phy_addr", SunGEMState, phy_addr, 0), 1393 DEFINE_PROP_END_OF_LIST(), 1394 }; 1395 1396 static const VMStateDescription vmstate_sungem = { 1397 .name = "sungem", 1398 .version_id = 0, 1399 .minimum_version_id = 0, 1400 .fields = (VMStateField[]) { 1401 VMSTATE_PCI_DEVICE(pdev, SunGEMState), 1402 VMSTATE_MACADDR(conf.macaddr, SunGEMState), 1403 VMSTATE_UINT32(phy_addr, SunGEMState), 1404 VMSTATE_UINT32_ARRAY(gregs, SunGEMState, (SUNGEM_MMIO_GREG_SIZE >> 2)), 1405 VMSTATE_UINT32_ARRAY(txdmaregs, SunGEMState, 1406 (SUNGEM_MMIO_TXDMA_SIZE >> 2)), 1407 VMSTATE_UINT32_ARRAY(rxdmaregs, SunGEMState, 1408 (SUNGEM_MMIO_RXDMA_SIZE >> 2)), 1409 VMSTATE_UINT32_ARRAY(macregs, SunGEMState, (SUNGEM_MMIO_MAC_SIZE >> 2)), 1410 VMSTATE_UINT32_ARRAY(mifregs, SunGEMState, (SUNGEM_MMIO_MIF_SIZE >> 2)), 1411 VMSTATE_UINT32_ARRAY(pcsregs, SunGEMState, (SUNGEM_MMIO_PCS_SIZE >> 2)), 1412 VMSTATE_UINT32(rx_mask, SunGEMState), 1413 VMSTATE_UINT32(tx_mask, SunGEMState), 1414 VMSTATE_UINT8_ARRAY(tx_data, SunGEMState, MAX_PACKET_SIZE), 1415 VMSTATE_UINT32(tx_size, SunGEMState), 1416 VMSTATE_UINT64(tx_first_ctl, SunGEMState), 1417 VMSTATE_END_OF_LIST() 1418 } 1419 }; 1420 1421 static void sungem_class_init(ObjectClass *klass, void *data) 1422 { 1423 DeviceClass *dc = DEVICE_CLASS(klass); 1424 PCIDeviceClass *k = PCI_DEVICE_CLASS(klass); 1425 1426 k->realize = sungem_realize; 1427 k->exit = sungem_uninit; 1428 k->vendor_id = PCI_VENDOR_ID_APPLE; 1429 k->device_id = PCI_DEVICE_ID_APPLE_UNI_N_GMAC; 1430 k->revision = 0x01; 1431 k->class_id = PCI_CLASS_NETWORK_ETHERNET; 1432 dc->vmsd = &vmstate_sungem; 1433 dc->reset = sungem_reset; 1434 device_class_set_props(dc, sungem_properties); 1435 set_bit(DEVICE_CATEGORY_NETWORK, dc->categories); 1436 } 1437 1438 static const TypeInfo sungem_info = { 1439 .name = TYPE_SUNGEM, 1440 .parent = TYPE_PCI_DEVICE, 1441 .instance_size = sizeof(SunGEMState), 1442 .class_init = sungem_class_init, 1443 .instance_init = sungem_instance_init, 1444 .interfaces = (InterfaceInfo[]) { 1445 { INTERFACE_CONVENTIONAL_PCI_DEVICE }, 1446 { } 1447 } 1448 }; 1449 1450 static void sungem_register_types(void) 1451 { 1452 type_register_static(&sungem_info); 1453 } 1454 1455 type_init(sungem_register_types) 1456