1 /*
2 * QEMU model of SUN GEM ethernet controller
3 *
4 * As found in Apple ASICs among others
5 *
6 * Copyright 2016 Ben Herrenschmidt
7 * Copyright 2017 Mark Cave-Ayland
8 */
9
10 #include "qemu/osdep.h"
11 #include "hw/pci/pci_device.h"
12 #include "hw/qdev-properties.h"
13 #include "migration/vmstate.h"
14 #include "qemu/log.h"
15 #include "qemu/module.h"
16 #include "net/net.h"
17 #include "net/eth.h"
18 #include "net/checksum.h"
19 #include "hw/net/mii.h"
20 #include "sysemu/sysemu.h"
21 #include "trace.h"
22 #include "qom/object.h"
23
24 #define TYPE_SUNGEM "sungem"
25
26 OBJECT_DECLARE_SIMPLE_TYPE(SunGEMState, SUNGEM)
27
28 #define MAX_PACKET_SIZE 9016
29
30 #define SUNGEM_MMIO_SIZE 0x200000
31
32 /* Global registers */
33 #define SUNGEM_MMIO_GREG_SIZE 0x2000
34
35 #define GREG_SEBSTATE 0x0000UL /* SEB State Register */
36
37 #define GREG_STAT 0x000CUL /* Status Register */
38 #define GREG_STAT_TXINTME 0x00000001 /* TX INTME frame transferred */
39 #define GREG_STAT_TXALL 0x00000002 /* All TX frames transferred */
40 #define GREG_STAT_TXDONE 0x00000004 /* One TX frame transferred */
41 #define GREG_STAT_RXDONE 0x00000010 /* One RX frame arrived */
42 #define GREG_STAT_RXNOBUF 0x00000020 /* No free RX buffers available */
43 #define GREG_STAT_RXTAGERR 0x00000040 /* RX tag framing is corrupt */
44 #define GREG_STAT_TXMAC 0x00004000 /* TX MAC signalled interrupt */
45 #define GREG_STAT_RXMAC 0x00008000 /* RX MAC signalled interrupt */
46 #define GREG_STAT_MAC 0x00010000 /* MAC Control signalled irq */
47 #define GREG_STAT_TXNR 0xfff80000 /* == TXDMA_TXDONE reg val */
48 #define GREG_STAT_TXNR_SHIFT 19
49
50 /* These interrupts are edge latches in the status register,
51 * reading it (or writing the corresponding bit in IACK) will
52 * clear them
53 */
54 #define GREG_STAT_LATCH (GREG_STAT_TXALL | GREG_STAT_TXINTME | \
55 GREG_STAT_RXDONE | GREG_STAT_RXDONE | \
56 GREG_STAT_RXNOBUF | GREG_STAT_RXTAGERR)
57
58 #define GREG_IMASK 0x0010UL /* Interrupt Mask Register */
59 #define GREG_IACK 0x0014UL /* Interrupt ACK Register */
60 #define GREG_STAT2 0x001CUL /* Alias of GREG_STAT */
61 #define GREG_PCIESTAT 0x1000UL /* PCI Error Status Register */
62 #define GREG_PCIEMASK 0x1004UL /* PCI Error Mask Register */
63
64 #define GREG_SWRST 0x1010UL /* Software Reset Register */
65 #define GREG_SWRST_TXRST 0x00000001 /* TX Software Reset */
66 #define GREG_SWRST_RXRST 0x00000002 /* RX Software Reset */
67 #define GREG_SWRST_RSTOUT 0x00000004 /* Force RST# pin active */
68
69 /* TX DMA Registers */
70 #define SUNGEM_MMIO_TXDMA_SIZE 0x1000
71
72 #define TXDMA_KICK 0x0000UL /* TX Kick Register */
73
74 #define TXDMA_CFG 0x0004UL /* TX Configuration Register */
75 #define TXDMA_CFG_ENABLE 0x00000001 /* Enable TX DMA channel */
76 #define TXDMA_CFG_RINGSZ 0x0000001e /* TX descriptor ring size */
77
78 #define TXDMA_DBLOW 0x0008UL /* TX Desc. Base Low */
79 #define TXDMA_DBHI 0x000CUL /* TX Desc. Base High */
80 #define TXDMA_PCNT 0x0024UL /* TX FIFO Packet Counter */
81 #define TXDMA_SMACHINE 0x0028UL /* TX State Machine Register */
82 #define TXDMA_DPLOW 0x0030UL /* TX Data Pointer Low */
83 #define TXDMA_DPHI 0x0034UL /* TX Data Pointer High */
84 #define TXDMA_TXDONE 0x0100UL /* TX Completion Register */
85 #define TXDMA_FTAG 0x0108UL /* TX FIFO Tag */
86 #define TXDMA_FSZ 0x0118UL /* TX FIFO Size */
87
88 /* Receive DMA Registers */
89 #define SUNGEM_MMIO_RXDMA_SIZE 0x2000
90
91 #define RXDMA_CFG 0x0000UL /* RX Configuration Register */
92 #define RXDMA_CFG_ENABLE 0x00000001 /* Enable RX DMA channel */
93 #define RXDMA_CFG_RINGSZ 0x0000001e /* RX descriptor ring size */
94 #define RXDMA_CFG_FBOFF 0x00001c00 /* Offset of first data byte */
95 #define RXDMA_CFG_CSUMOFF 0x000fe000 /* Skip bytes before csum calc */
96
97 #define RXDMA_DBLOW 0x0004UL /* RX Descriptor Base Low */
98 #define RXDMA_DBHI 0x0008UL /* RX Descriptor Base High */
99 #define RXDMA_PCNT 0x0018UL /* RX FIFO Packet Counter */
100 #define RXDMA_SMACHINE 0x001CUL /* RX State Machine Register */
101 #define RXDMA_PTHRESH 0x0020UL /* Pause Thresholds */
102 #define RXDMA_DPLOW 0x0024UL /* RX Data Pointer Low */
103 #define RXDMA_DPHI 0x0028UL /* RX Data Pointer High */
104 #define RXDMA_KICK 0x0100UL /* RX Kick Register */
105 #define RXDMA_DONE 0x0104UL /* RX Completion Register */
106 #define RXDMA_BLANK 0x0108UL /* RX Blanking Register */
107 #define RXDMA_FTAG 0x0110UL /* RX FIFO Tag */
108 #define RXDMA_FSZ 0x0120UL /* RX FIFO Size */
109
110 /* WOL Registers */
111 #define SUNGEM_MMIO_WOL_SIZE 0x14
112
113 #define WOL_MATCH0 0x0000UL
114 #define WOL_MATCH1 0x0004UL
115 #define WOL_MATCH2 0x0008UL
116 #define WOL_MCOUNT 0x000CUL
117 #define WOL_WAKECSR 0x0010UL
118
119 /* MAC Registers */
120 #define SUNGEM_MMIO_MAC_SIZE 0x200
121
122 #define MAC_TXRST 0x0000UL /* TX MAC Software Reset Command */
123 #define MAC_RXRST 0x0004UL /* RX MAC Software Reset Command */
124 #define MAC_TXSTAT 0x0010UL /* TX MAC Status Register */
125 #define MAC_RXSTAT 0x0014UL /* RX MAC Status Register */
126
127 #define MAC_CSTAT 0x0018UL /* MAC Control Status Register */
128 #define MAC_CSTAT_PTR 0xffff0000 /* Pause Time Received */
129
130 #define MAC_TXMASK 0x0020UL /* TX MAC Mask Register */
131 #define MAC_RXMASK 0x0024UL /* RX MAC Mask Register */
132 #define MAC_MCMASK 0x0028UL /* MAC Control Mask Register */
133
134 #define MAC_TXCFG 0x0030UL /* TX MAC Configuration Register */
135 #define MAC_TXCFG_ENAB 0x00000001 /* TX MAC Enable */
136
137 #define MAC_RXCFG 0x0034UL /* RX MAC Configuration Register */
138 #define MAC_RXCFG_ENAB 0x00000001 /* RX MAC Enable */
139 #define MAC_RXCFG_SFCS 0x00000004 /* Strip FCS */
140 #define MAC_RXCFG_PROM 0x00000008 /* Promiscuous Mode */
141 #define MAC_RXCFG_PGRP 0x00000010 /* Promiscuous Group */
142 #define MAC_RXCFG_HFE 0x00000020 /* Hash Filter Enable */
143
144 #define MAC_XIFCFG 0x003CUL /* XIF Configuration Register */
145 #define MAC_XIFCFG_LBCK 0x00000002 /* Loopback TX to RX */
146
147 #define MAC_MINFSZ 0x0050UL /* MinFrameSize Register */
148 #define MAC_MAXFSZ 0x0054UL /* MaxFrameSize Register */
149 #define MAC_ADDR0 0x0080UL /* MAC Address 0 Register */
150 #define MAC_ADDR1 0x0084UL /* MAC Address 1 Register */
151 #define MAC_ADDR2 0x0088UL /* MAC Address 2 Register */
152 #define MAC_ADDR3 0x008CUL /* MAC Address 3 Register */
153 #define MAC_ADDR4 0x0090UL /* MAC Address 4 Register */
154 #define MAC_ADDR5 0x0094UL /* MAC Address 5 Register */
155 #define MAC_HASH0 0x00C0UL /* Hash Table 0 Register */
156 #define MAC_PATMPS 0x0114UL /* Peak Attempts Register */
157 #define MAC_SMACHINE 0x0134UL /* State Machine Register */
158
159 /* MIF Registers */
160 #define SUNGEM_MMIO_MIF_SIZE 0x20
161
162 #define MIF_FRAME 0x000CUL /* MIF Frame/Output Register */
163 #define MIF_FRAME_OP 0x30000000 /* OPcode */
164 #define MIF_FRAME_PHYAD 0x0f800000 /* PHY ADdress */
165 #define MIF_FRAME_REGAD 0x007c0000 /* REGister ADdress */
166 #define MIF_FRAME_TALSB 0x00010000 /* Turn Around LSB */
167 #define MIF_FRAME_DATA 0x0000ffff /* Instruction Payload */
168
169 #define MIF_CFG 0x0010UL /* MIF Configuration Register */
170 #define MIF_CFG_MDI0 0x00000100 /* MDIO_0 present or read-bit */
171 #define MIF_CFG_MDI1 0x00000200 /* MDIO_1 present or read-bit */
172
173 #define MIF_STATUS 0x0018UL /* MIF Status Register */
174 #define MIF_SMACHINE 0x001CUL /* MIF State Machine Register */
175
176 /* PCS/Serialink Registers */
177 #define SUNGEM_MMIO_PCS_SIZE 0x60
178 #define PCS_MIISTAT 0x0004UL /* PCS MII Status Register */
179 #define PCS_ISTAT 0x0018UL /* PCS Interrupt Status Reg */
180
181 #define PCS_SSTATE 0x005CUL /* Serialink State Register */
182
183 /* Descriptors */
184 struct gem_txd {
185 uint64_t control_word;
186 uint64_t buffer;
187 };
188
189 #define TXDCTRL_BUFSZ 0x0000000000007fffULL /* Buffer Size */
190 #define TXDCTRL_CSTART 0x00000000001f8000ULL /* CSUM Start Offset */
191 #define TXDCTRL_COFF 0x000000001fe00000ULL /* CSUM Stuff Offset */
192 #define TXDCTRL_CENAB 0x0000000020000000ULL /* CSUM Enable */
193 #define TXDCTRL_EOF 0x0000000040000000ULL /* End of Frame */
194 #define TXDCTRL_SOF 0x0000000080000000ULL /* Start of Frame */
195 #define TXDCTRL_INTME 0x0000000100000000ULL /* "Interrupt Me" */
196
197 struct gem_rxd {
198 uint64_t status_word;
199 uint64_t buffer;
200 };
201
202 #define RXDCTRL_HPASS 0x1000000000000000ULL /* Passed Hash Filter */
203 #define RXDCTRL_ALTMAC 0x2000000000000000ULL /* Matched ALT MAC */
204
205
206 struct SunGEMState {
207 PCIDevice pdev;
208
209 MemoryRegion sungem;
210 MemoryRegion greg;
211 MemoryRegion txdma;
212 MemoryRegion rxdma;
213 MemoryRegion wol;
214 MemoryRegion mac;
215 MemoryRegion mif;
216 MemoryRegion pcs;
217 NICState *nic;
218 NICConf conf;
219 uint32_t phy_addr;
220
221 uint32_t gregs[SUNGEM_MMIO_GREG_SIZE >> 2];
222 uint32_t txdmaregs[SUNGEM_MMIO_TXDMA_SIZE >> 2];
223 uint32_t rxdmaregs[SUNGEM_MMIO_RXDMA_SIZE >> 2];
224 uint32_t macregs[SUNGEM_MMIO_MAC_SIZE >> 2];
225 uint32_t mifregs[SUNGEM_MMIO_MIF_SIZE >> 2];
226 uint32_t pcsregs[SUNGEM_MMIO_PCS_SIZE >> 2];
227
228 /* Cache some useful things */
229 uint32_t rx_mask;
230 uint32_t tx_mask;
231
232 /* Current tx packet */
233 uint8_t tx_data[MAX_PACKET_SIZE];
234 uint32_t tx_size;
235 uint64_t tx_first_ctl;
236 };
237
238
sungem_eval_irq(SunGEMState * s)239 static void sungem_eval_irq(SunGEMState *s)
240 {
241 uint32_t stat, mask;
242
243 mask = s->gregs[GREG_IMASK >> 2];
244 stat = s->gregs[GREG_STAT >> 2] & ~GREG_STAT_TXNR;
245 if (stat & ~mask) {
246 pci_set_irq(PCI_DEVICE(s), 1);
247 } else {
248 pci_set_irq(PCI_DEVICE(s), 0);
249 }
250 }
251
sungem_update_status(SunGEMState * s,uint32_t bits,bool val)252 static void sungem_update_status(SunGEMState *s, uint32_t bits, bool val)
253 {
254 uint32_t stat;
255
256 stat = s->gregs[GREG_STAT >> 2];
257 if (val) {
258 stat |= bits;
259 } else {
260 stat &= ~bits;
261 }
262 s->gregs[GREG_STAT >> 2] = stat;
263 sungem_eval_irq(s);
264 }
265
sungem_eval_cascade_irq(SunGEMState * s)266 static void sungem_eval_cascade_irq(SunGEMState *s)
267 {
268 uint32_t stat, mask;
269
270 mask = s->macregs[MAC_TXSTAT >> 2];
271 stat = s->macregs[MAC_TXMASK >> 2];
272 if (stat & ~mask) {
273 sungem_update_status(s, GREG_STAT_TXMAC, true);
274 } else {
275 sungem_update_status(s, GREG_STAT_TXMAC, false);
276 }
277
278 mask = s->macregs[MAC_RXSTAT >> 2];
279 stat = s->macregs[MAC_RXMASK >> 2];
280 if (stat & ~mask) {
281 sungem_update_status(s, GREG_STAT_RXMAC, true);
282 } else {
283 sungem_update_status(s, GREG_STAT_RXMAC, false);
284 }
285
286 mask = s->macregs[MAC_CSTAT >> 2];
287 stat = s->macregs[MAC_MCMASK >> 2] & ~MAC_CSTAT_PTR;
288 if (stat & ~mask) {
289 sungem_update_status(s, GREG_STAT_MAC, true);
290 } else {
291 sungem_update_status(s, GREG_STAT_MAC, false);
292 }
293 }
294
sungem_do_tx_csum(SunGEMState * s)295 static void sungem_do_tx_csum(SunGEMState *s)
296 {
297 uint16_t start, off;
298 uint32_t csum;
299
300 start = (s->tx_first_ctl & TXDCTRL_CSTART) >> 15;
301 off = (s->tx_first_ctl & TXDCTRL_COFF) >> 21;
302
303 trace_sungem_tx_checksum(start, off);
304
305 if (start > (s->tx_size - 2) || off > (s->tx_size - 2)) {
306 trace_sungem_tx_checksum_oob();
307 return;
308 }
309
310 csum = net_raw_checksum(s->tx_data + start, s->tx_size - start);
311 stw_be_p(s->tx_data + off, csum);
312 }
313
sungem_send_packet(SunGEMState * s,const uint8_t * buf,int size)314 static void sungem_send_packet(SunGEMState *s, const uint8_t *buf,
315 int size)
316 {
317 NetClientState *nc = qemu_get_queue(s->nic);
318
319 if (s->macregs[MAC_XIFCFG >> 2] & MAC_XIFCFG_LBCK) {
320 qemu_receive_packet(nc, buf, size);
321 } else {
322 qemu_send_packet(nc, buf, size);
323 }
324 }
325
sungem_process_tx_desc(SunGEMState * s,struct gem_txd * desc)326 static void sungem_process_tx_desc(SunGEMState *s, struct gem_txd *desc)
327 {
328 PCIDevice *d = PCI_DEVICE(s);
329 uint32_t len;
330
331 /* If it's a start of frame, discard anything we had in the
332 * buffer and start again. This should be an error condition
333 * if we had something ... for now we ignore it
334 */
335 if (desc->control_word & TXDCTRL_SOF) {
336 if (s->tx_first_ctl) {
337 trace_sungem_tx_unfinished();
338 }
339 s->tx_size = 0;
340 s->tx_first_ctl = desc->control_word;
341 }
342
343 /* Grab data size */
344 len = desc->control_word & TXDCTRL_BUFSZ;
345
346 /* Clamp it to our max size */
347 if ((s->tx_size + len) > MAX_PACKET_SIZE) {
348 trace_sungem_tx_overflow();
349 len = MAX_PACKET_SIZE - s->tx_size;
350 }
351
352 /* Read the data */
353 pci_dma_read(d, desc->buffer, &s->tx_data[s->tx_size], len);
354 s->tx_size += len;
355
356 /* If end of frame, send packet */
357 if (desc->control_word & TXDCTRL_EOF) {
358 trace_sungem_tx_finished(s->tx_size);
359
360 /* Handle csum */
361 if (s->tx_first_ctl & TXDCTRL_CENAB) {
362 sungem_do_tx_csum(s);
363 }
364
365 /* Send it */
366 sungem_send_packet(s, s->tx_data, s->tx_size);
367
368 /* No more pending packet */
369 s->tx_size = 0;
370 s->tx_first_ctl = 0;
371 }
372 }
373
sungem_tx_kick(SunGEMState * s)374 static void sungem_tx_kick(SunGEMState *s)
375 {
376 PCIDevice *d = PCI_DEVICE(s);
377 uint32_t comp, kick;
378 uint32_t txdma_cfg, txmac_cfg, ints;
379 uint64_t dbase;
380
381 trace_sungem_tx_kick();
382
383 /* Check that both TX MAC and TX DMA are enabled. We don't
384 * handle DMA-less direct FIFO operations (we don't emulate
385 * the FIFO at all).
386 *
387 * A write to TXDMA_KICK while DMA isn't enabled can happen
388 * when the driver is resetting the pointer.
389 */
390 txdma_cfg = s->txdmaregs[TXDMA_CFG >> 2];
391 txmac_cfg = s->macregs[MAC_TXCFG >> 2];
392 if (!(txdma_cfg & TXDMA_CFG_ENABLE) ||
393 !(txmac_cfg & MAC_TXCFG_ENAB)) {
394 trace_sungem_tx_disabled();
395 return;
396 }
397
398 /* XXX Test min frame size register ? */
399 /* XXX Test max frame size register ? */
400
401 dbase = s->txdmaregs[TXDMA_DBHI >> 2];
402 dbase = (dbase << 32) | s->txdmaregs[TXDMA_DBLOW >> 2];
403
404 comp = s->txdmaregs[TXDMA_TXDONE >> 2] & s->tx_mask;
405 kick = s->txdmaregs[TXDMA_KICK >> 2] & s->tx_mask;
406
407 trace_sungem_tx_process(comp, kick, s->tx_mask + 1);
408
409 /* This is rather primitive for now, we just send everything we
410 * can in one go, like e1000. Ideally we should do the sending
411 * from some kind of background task
412 */
413 while (comp != kick) {
414 struct gem_txd desc;
415
416 /* Read the next descriptor */
417 pci_dma_read(d, dbase + comp * sizeof(desc), &desc, sizeof(desc));
418
419 /* Byteswap descriptor */
420 desc.control_word = le64_to_cpu(desc.control_word);
421 desc.buffer = le64_to_cpu(desc.buffer);
422 trace_sungem_tx_desc(comp, desc.control_word, desc.buffer);
423
424 /* Send it for processing */
425 sungem_process_tx_desc(s, &desc);
426
427 /* Interrupt */
428 ints = GREG_STAT_TXDONE;
429 if (desc.control_word & TXDCTRL_INTME) {
430 ints |= GREG_STAT_TXINTME;
431 }
432 sungem_update_status(s, ints, true);
433
434 /* Next ! */
435 comp = (comp + 1) & s->tx_mask;
436 s->txdmaregs[TXDMA_TXDONE >> 2] = comp;
437 }
438
439 /* We sent everything, set status/irq bit */
440 sungem_update_status(s, GREG_STAT_TXALL, true);
441 }
442
sungem_rx_full(SunGEMState * s,uint32_t kick,uint32_t done)443 static bool sungem_rx_full(SunGEMState *s, uint32_t kick, uint32_t done)
444 {
445 return kick == ((done + 1) & s->rx_mask);
446 }
447
sungem_can_receive(NetClientState * nc)448 static bool sungem_can_receive(NetClientState *nc)
449 {
450 SunGEMState *s = qemu_get_nic_opaque(nc);
451 uint32_t kick, done, rxdma_cfg, rxmac_cfg;
452 bool full;
453
454 rxmac_cfg = s->macregs[MAC_RXCFG >> 2];
455 rxdma_cfg = s->rxdmaregs[RXDMA_CFG >> 2];
456
457 /* If MAC disabled, can't receive */
458 if ((rxmac_cfg & MAC_RXCFG_ENAB) == 0) {
459 trace_sungem_rx_mac_disabled();
460 return false;
461 }
462 if ((rxdma_cfg & RXDMA_CFG_ENABLE) == 0) {
463 trace_sungem_rx_txdma_disabled();
464 return false;
465 }
466
467 /* Check RX availability */
468 kick = s->rxdmaregs[RXDMA_KICK >> 2];
469 done = s->rxdmaregs[RXDMA_DONE >> 2];
470 full = sungem_rx_full(s, kick, done);
471
472 trace_sungem_rx_check(!full, kick, done);
473
474 return !full;
475 }
476
477 enum {
478 rx_no_match,
479 rx_match_promisc,
480 rx_match_bcast,
481 rx_match_allmcast,
482 rx_match_mcast,
483 rx_match_mac,
484 rx_match_altmac,
485 };
486
sungem_check_rx_mac(SunGEMState * s,const uint8_t * mac,uint32_t crc)487 static int sungem_check_rx_mac(SunGEMState *s, const uint8_t *mac, uint32_t crc)
488 {
489 uint32_t rxcfg = s->macregs[MAC_RXCFG >> 2];
490 uint32_t mac0, mac1, mac2;
491
492 /* Promisc enabled ? */
493 if (rxcfg & MAC_RXCFG_PROM) {
494 return rx_match_promisc;
495 }
496
497 /* Format MAC address into dwords */
498 mac0 = (mac[4] << 8) | mac[5];
499 mac1 = (mac[2] << 8) | mac[3];
500 mac2 = (mac[0] << 8) | mac[1];
501
502 trace_sungem_rx_mac_check(mac0, mac1, mac2);
503
504 /* Is this a broadcast frame ? */
505 if (mac0 == 0xffff && mac1 == 0xffff && mac2 == 0xffff) {
506 return rx_match_bcast;
507 }
508
509 /* TODO: Implement address filter registers (or we don't care ?) */
510
511 /* Is this a multicast frame ? */
512 if (mac[0] & 1) {
513 trace_sungem_rx_mac_multicast();
514
515 /* Promisc group enabled ? */
516 if (rxcfg & MAC_RXCFG_PGRP) {
517 return rx_match_allmcast;
518 }
519
520 /* TODO: Check MAC control frames (or we don't care) ? */
521
522 /* Check hash filter (somebody check that's correct ?) */
523 if (rxcfg & MAC_RXCFG_HFE) {
524 uint32_t hash, idx;
525
526 crc >>= 24;
527 idx = (crc >> 2) & 0x3c;
528 hash = s->macregs[(MAC_HASH0 + idx) >> 2];
529 if (hash & (1 << (15 - (crc & 0xf)))) {
530 return rx_match_mcast;
531 }
532 }
533 return rx_no_match;
534 }
535
536 /* Main MAC check */
537 trace_sungem_rx_mac_compare(s->macregs[MAC_ADDR0 >> 2],
538 s->macregs[MAC_ADDR1 >> 2],
539 s->macregs[MAC_ADDR2 >> 2]);
540
541 if (mac0 == s->macregs[MAC_ADDR0 >> 2] &&
542 mac1 == s->macregs[MAC_ADDR1 >> 2] &&
543 mac2 == s->macregs[MAC_ADDR2 >> 2]) {
544 return rx_match_mac;
545 }
546
547 /* Alt MAC check */
548 if (mac0 == s->macregs[MAC_ADDR3 >> 2] &&
549 mac1 == s->macregs[MAC_ADDR4 >> 2] &&
550 mac2 == s->macregs[MAC_ADDR5 >> 2]) {
551 return rx_match_altmac;
552 }
553
554 return rx_no_match;
555 }
556
sungem_receive(NetClientState * nc,const uint8_t * buf,size_t size)557 static ssize_t sungem_receive(NetClientState *nc, const uint8_t *buf,
558 size_t size)
559 {
560 SunGEMState *s = qemu_get_nic_opaque(nc);
561 PCIDevice *d = PCI_DEVICE(s);
562 uint32_t mac_crc, done, kick, max_fsize;
563 uint32_t fcs_size, ints, rxdma_cfg, rxmac_cfg, csum, coff;
564 struct gem_rxd desc;
565 uint64_t dbase, baddr;
566 unsigned int rx_cond;
567
568 trace_sungem_rx_packet(size);
569
570 rxmac_cfg = s->macregs[MAC_RXCFG >> 2];
571 rxdma_cfg = s->rxdmaregs[RXDMA_CFG >> 2];
572 max_fsize = s->macregs[MAC_MAXFSZ >> 2] & 0x7fff;
573
574 /* If MAC or DMA disabled, can't receive */
575 if (!(rxdma_cfg & RXDMA_CFG_ENABLE) ||
576 !(rxmac_cfg & MAC_RXCFG_ENAB)) {
577 trace_sungem_rx_disabled();
578 return 0;
579 }
580
581 /* Size adjustment for FCS */
582 if (rxmac_cfg & MAC_RXCFG_SFCS) {
583 fcs_size = 0;
584 } else {
585 fcs_size = 4;
586 }
587
588 /* Discard frame smaller than a MAC or larger than max frame size
589 * (when accounting for FCS)
590 */
591 if (size < 6 || (size + 4) > max_fsize) {
592 trace_sungem_rx_bad_frame_size(size);
593 /* XXX Increment error statistics ? */
594 return size;
595 }
596
597 /* Get MAC crc */
598 mac_crc = net_crc32_le(buf, ETH_ALEN);
599
600 /* Packet isn't for me ? */
601 rx_cond = sungem_check_rx_mac(s, buf, mac_crc);
602 if (rx_cond == rx_no_match) {
603 /* Just drop it */
604 trace_sungem_rx_unmatched();
605 return size;
606 }
607
608 /* Get ring pointers */
609 kick = s->rxdmaregs[RXDMA_KICK >> 2] & s->rx_mask;
610 done = s->rxdmaregs[RXDMA_DONE >> 2] & s->rx_mask;
611
612 trace_sungem_rx_process(done, kick, s->rx_mask + 1);
613
614 /* Ring full ? Can't receive */
615 if (sungem_rx_full(s, kick, done)) {
616 trace_sungem_rx_ringfull();
617 return 0;
618 }
619
620 /* Note: The real GEM will fetch descriptors in blocks of 4,
621 * for now we handle them one at a time, I think the driver will
622 * cope
623 */
624
625 dbase = s->rxdmaregs[RXDMA_DBHI >> 2];
626 dbase = (dbase << 32) | s->rxdmaregs[RXDMA_DBLOW >> 2];
627
628 /* Read the next descriptor */
629 pci_dma_read(d, dbase + done * sizeof(desc), &desc, sizeof(desc));
630
631 trace_sungem_rx_desc(le64_to_cpu(desc.status_word),
632 le64_to_cpu(desc.buffer));
633
634 /* Effective buffer address */
635 baddr = le64_to_cpu(desc.buffer) & ~7ull;
636 baddr |= (rxdma_cfg & RXDMA_CFG_FBOFF) >> 10;
637
638 /* Write buffer out */
639 pci_dma_write(d, baddr, buf, size);
640
641 if (fcs_size) {
642 /* Should we add an FCS ? Linux doesn't ask us to strip it,
643 * however I believe nothing checks it... For now we just
644 * do nothing. It's faster this way.
645 */
646 }
647
648 /* Calculate the checksum */
649 coff = (rxdma_cfg & RXDMA_CFG_CSUMOFF) >> 13;
650 csum = net_raw_checksum((uint8_t *)buf + coff, size - coff);
651
652 /* Build the updated descriptor */
653 desc.status_word = (size + fcs_size) << 16;
654 desc.status_word |= ((uint64_t)(mac_crc >> 16)) << 44;
655 desc.status_word |= csum;
656 if (rx_cond == rx_match_mcast) {
657 desc.status_word |= RXDCTRL_HPASS;
658 }
659 if (rx_cond == rx_match_altmac) {
660 desc.status_word |= RXDCTRL_ALTMAC;
661 }
662 desc.status_word = cpu_to_le64(desc.status_word);
663
664 pci_dma_write(d, dbase + done * sizeof(desc), &desc, sizeof(desc));
665
666 done = (done + 1) & s->rx_mask;
667 s->rxdmaregs[RXDMA_DONE >> 2] = done;
668
669 /* XXX Unconditionally set RX interrupt for now. The interrupt
670 * mitigation timer might well end up adding more overhead than
671 * helping here...
672 */
673 ints = GREG_STAT_RXDONE;
674 if (sungem_rx_full(s, kick, done)) {
675 ints |= GREG_STAT_RXNOBUF;
676 }
677 sungem_update_status(s, ints, true);
678
679 return size;
680 }
681
sungem_set_link_status(NetClientState * nc)682 static void sungem_set_link_status(NetClientState *nc)
683 {
684 /* We don't do anything for now as I believe none of the OSes
685 * drivers use the MIF autopoll feature nor the PHY interrupt
686 */
687 }
688
sungem_update_masks(SunGEMState * s)689 static void sungem_update_masks(SunGEMState *s)
690 {
691 uint32_t sz;
692
693 sz = 1 << (((s->rxdmaregs[RXDMA_CFG >> 2] & RXDMA_CFG_RINGSZ) >> 1) + 5);
694 s->rx_mask = sz - 1;
695
696 sz = 1 << (((s->txdmaregs[TXDMA_CFG >> 2] & TXDMA_CFG_RINGSZ) >> 1) + 5);
697 s->tx_mask = sz - 1;
698 }
699
sungem_reset_rx(SunGEMState * s)700 static void sungem_reset_rx(SunGEMState *s)
701 {
702 trace_sungem_rx_reset();
703
704 /* XXX Do RXCFG */
705 /* XXX Check value */
706 s->rxdmaregs[RXDMA_FSZ >> 2] = 0x140;
707 s->rxdmaregs[RXDMA_DONE >> 2] = 0;
708 s->rxdmaregs[RXDMA_KICK >> 2] = 0;
709 s->rxdmaregs[RXDMA_CFG >> 2] = 0x1000010;
710 s->rxdmaregs[RXDMA_PTHRESH >> 2] = 0xf8;
711 s->rxdmaregs[RXDMA_BLANK >> 2] = 0;
712
713 sungem_update_masks(s);
714 }
715
sungem_reset_tx(SunGEMState * s)716 static void sungem_reset_tx(SunGEMState *s)
717 {
718 trace_sungem_tx_reset();
719
720 /* XXX Do TXCFG */
721 /* XXX Check value */
722 s->txdmaregs[TXDMA_FSZ >> 2] = 0x90;
723 s->txdmaregs[TXDMA_TXDONE >> 2] = 0;
724 s->txdmaregs[TXDMA_KICK >> 2] = 0;
725 s->txdmaregs[TXDMA_CFG >> 2] = 0x118010;
726
727 sungem_update_masks(s);
728
729 s->tx_size = 0;
730 s->tx_first_ctl = 0;
731 }
732
sungem_reset_all(SunGEMState * s,bool pci_reset)733 static void sungem_reset_all(SunGEMState *s, bool pci_reset)
734 {
735 trace_sungem_reset(pci_reset);
736
737 sungem_reset_rx(s);
738 sungem_reset_tx(s);
739
740 s->gregs[GREG_IMASK >> 2] = 0xFFFFFFF;
741 s->gregs[GREG_STAT >> 2] = 0;
742 if (pci_reset) {
743 uint8_t *ma = s->conf.macaddr.a;
744
745 s->gregs[GREG_SWRST >> 2] = 0;
746 s->macregs[MAC_ADDR0 >> 2] = (ma[4] << 8) | ma[5];
747 s->macregs[MAC_ADDR1 >> 2] = (ma[2] << 8) | ma[3];
748 s->macregs[MAC_ADDR2 >> 2] = (ma[0] << 8) | ma[1];
749 } else {
750 s->gregs[GREG_SWRST >> 2] &= GREG_SWRST_RSTOUT;
751 }
752 s->mifregs[MIF_CFG >> 2] = MIF_CFG_MDI0;
753 }
754
sungem_mii_write(SunGEMState * s,uint8_t phy_addr,uint8_t reg_addr,uint16_t val)755 static void sungem_mii_write(SunGEMState *s, uint8_t phy_addr,
756 uint8_t reg_addr, uint16_t val)
757 {
758 trace_sungem_mii_write(phy_addr, reg_addr, val);
759
760 /* XXX TODO */
761 }
762
__sungem_mii_read(SunGEMState * s,uint8_t phy_addr,uint8_t reg_addr)763 static uint16_t __sungem_mii_read(SunGEMState *s, uint8_t phy_addr,
764 uint8_t reg_addr)
765 {
766 if (phy_addr != s->phy_addr) {
767 return 0xffff;
768 }
769 /* Primitive emulation of a BCM5201 to please the driver,
770 * ID is 0x00406210. TODO: Do a gigabit PHY like BCM5400
771 */
772 switch (reg_addr) {
773 case MII_BMCR:
774 return 0;
775 case MII_PHYID1:
776 return 0x0040;
777 case MII_PHYID2:
778 return 0x6210;
779 case MII_BMSR:
780 if (qemu_get_queue(s->nic)->link_down) {
781 return MII_BMSR_100TX_FD | MII_BMSR_AUTONEG;
782 } else {
783 return MII_BMSR_100TX_FD | MII_BMSR_AN_COMP |
784 MII_BMSR_AUTONEG | MII_BMSR_LINK_ST;
785 }
786 case MII_ANLPAR:
787 case MII_ANAR:
788 return MII_ANLPAR_TXFD;
789 case 0x18: /* 5201 AUX status */
790 return 3; /* 100FD */
791 default:
792 return 0;
793 };
794 }
sungem_mii_read(SunGEMState * s,uint8_t phy_addr,uint8_t reg_addr)795 static uint16_t sungem_mii_read(SunGEMState *s, uint8_t phy_addr,
796 uint8_t reg_addr)
797 {
798 uint16_t val;
799
800 val = __sungem_mii_read(s, phy_addr, reg_addr);
801
802 trace_sungem_mii_read(phy_addr, reg_addr, val);
803
804 return val;
805 }
806
sungem_mii_op(SunGEMState * s,uint32_t val)807 static uint32_t sungem_mii_op(SunGEMState *s, uint32_t val)
808 {
809 uint8_t phy_addr, reg_addr, op;
810
811 /* Ignore not start of frame */
812 if ((val >> 30) != 1) {
813 trace_sungem_mii_invalid_sof(val >> 30);
814 return 0xffff;
815 }
816 phy_addr = (val & MIF_FRAME_PHYAD) >> 23;
817 reg_addr = (val & MIF_FRAME_REGAD) >> 18;
818 op = (val & MIF_FRAME_OP) >> 28;
819 switch (op) {
820 case 1:
821 sungem_mii_write(s, phy_addr, reg_addr, val & MIF_FRAME_DATA);
822 return val | MIF_FRAME_TALSB;
823 case 2:
824 return sungem_mii_read(s, phy_addr, reg_addr) | MIF_FRAME_TALSB;
825 default:
826 trace_sungem_mii_invalid_op(op);
827 }
828 return 0xffff | MIF_FRAME_TALSB;
829 }
830
sungem_mmio_greg_write(void * opaque,hwaddr addr,uint64_t val,unsigned size)831 static void sungem_mmio_greg_write(void *opaque, hwaddr addr, uint64_t val,
832 unsigned size)
833 {
834 SunGEMState *s = opaque;
835
836 if (!(addr < 0x20) && !(addr >= 0x1000 && addr <= 0x1010)) {
837 qemu_log_mask(LOG_GUEST_ERROR,
838 "Write to unknown GREG register 0x%"HWADDR_PRIx"\n",
839 addr);
840 return;
841 }
842
843 trace_sungem_mmio_greg_write(addr, val);
844
845 /* Pre-write filter */
846 switch (addr) {
847 /* Read only registers */
848 case GREG_SEBSTATE:
849 case GREG_STAT:
850 case GREG_STAT2:
851 case GREG_PCIESTAT:
852 return; /* No actual write */
853 case GREG_IACK:
854 val &= GREG_STAT_LATCH;
855 s->gregs[GREG_STAT >> 2] &= ~val;
856 sungem_eval_irq(s);
857 return; /* No actual write */
858 case GREG_PCIEMASK:
859 val &= 0x7;
860 break;
861 }
862
863 s->gregs[addr >> 2] = val;
864
865 /* Post write action */
866 switch (addr) {
867 case GREG_IMASK:
868 /* Re-evaluate interrupt */
869 sungem_eval_irq(s);
870 break;
871 case GREG_SWRST:
872 switch (val & (GREG_SWRST_TXRST | GREG_SWRST_RXRST)) {
873 case GREG_SWRST_RXRST:
874 sungem_reset_rx(s);
875 break;
876 case GREG_SWRST_TXRST:
877 sungem_reset_tx(s);
878 break;
879 case GREG_SWRST_RXRST | GREG_SWRST_TXRST:
880 sungem_reset_all(s, false);
881 }
882 break;
883 }
884 }
885
sungem_mmio_greg_read(void * opaque,hwaddr addr,unsigned size)886 static uint64_t sungem_mmio_greg_read(void *opaque, hwaddr addr, unsigned size)
887 {
888 SunGEMState *s = opaque;
889 uint32_t val;
890
891 if (!(addr < 0x20) && !(addr >= 0x1000 && addr <= 0x1010)) {
892 qemu_log_mask(LOG_GUEST_ERROR,
893 "Read from unknown GREG register 0x%"HWADDR_PRIx"\n",
894 addr);
895 return 0;
896 }
897
898 val = s->gregs[addr >> 2];
899
900 trace_sungem_mmio_greg_read(addr, val);
901
902 switch (addr) {
903 case GREG_STAT:
904 /* Side effect, clear bottom 7 bits */
905 s->gregs[GREG_STAT >> 2] &= ~GREG_STAT_LATCH;
906 sungem_eval_irq(s);
907
908 /* Inject TX completion in returned value */
909 val = (val & ~GREG_STAT_TXNR) |
910 (s->txdmaregs[TXDMA_TXDONE >> 2] << GREG_STAT_TXNR_SHIFT);
911 break;
912 case GREG_STAT2:
913 /* Return the status reg without side effect
914 * (and inject TX completion in returned value)
915 */
916 val = (s->gregs[GREG_STAT >> 2] & ~GREG_STAT_TXNR) |
917 (s->txdmaregs[TXDMA_TXDONE >> 2] << GREG_STAT_TXNR_SHIFT);
918 break;
919 }
920
921 return val;
922 }
923
924 static const MemoryRegionOps sungem_mmio_greg_ops = {
925 .read = sungem_mmio_greg_read,
926 .write = sungem_mmio_greg_write,
927 .endianness = DEVICE_LITTLE_ENDIAN,
928 .impl = {
929 .min_access_size = 4,
930 .max_access_size = 4,
931 },
932 };
933
sungem_mmio_txdma_write(void * opaque,hwaddr addr,uint64_t val,unsigned size)934 static void sungem_mmio_txdma_write(void *opaque, hwaddr addr, uint64_t val,
935 unsigned size)
936 {
937 SunGEMState *s = opaque;
938
939 if (!(addr < 0x38) && !(addr >= 0x100 && addr <= 0x118)) {
940 qemu_log_mask(LOG_GUEST_ERROR,
941 "Write to unknown TXDMA register 0x%"HWADDR_PRIx"\n",
942 addr);
943 return;
944 }
945
946 trace_sungem_mmio_txdma_write(addr, val);
947
948 /* Pre-write filter */
949 switch (addr) {
950 /* Read only registers */
951 case TXDMA_TXDONE:
952 case TXDMA_PCNT:
953 case TXDMA_SMACHINE:
954 case TXDMA_DPLOW:
955 case TXDMA_DPHI:
956 case TXDMA_FSZ:
957 case TXDMA_FTAG:
958 return; /* No actual write */
959 }
960
961 s->txdmaregs[addr >> 2] = val;
962
963 /* Post write action */
964 switch (addr) {
965 case TXDMA_KICK:
966 sungem_tx_kick(s);
967 break;
968 case TXDMA_CFG:
969 sungem_update_masks(s);
970 break;
971 }
972 }
973
sungem_mmio_txdma_read(void * opaque,hwaddr addr,unsigned size)974 static uint64_t sungem_mmio_txdma_read(void *opaque, hwaddr addr, unsigned size)
975 {
976 SunGEMState *s = opaque;
977 uint32_t val;
978
979 if (!(addr < 0x38) && !(addr >= 0x100 && addr <= 0x118)) {
980 qemu_log_mask(LOG_GUEST_ERROR,
981 "Read from unknown TXDMA register 0x%"HWADDR_PRIx"\n",
982 addr);
983 return 0;
984 }
985
986 val = s->txdmaregs[addr >> 2];
987
988 trace_sungem_mmio_txdma_read(addr, val);
989
990 return val;
991 }
992
993 static const MemoryRegionOps sungem_mmio_txdma_ops = {
994 .read = sungem_mmio_txdma_read,
995 .write = sungem_mmio_txdma_write,
996 .endianness = DEVICE_LITTLE_ENDIAN,
997 .impl = {
998 .min_access_size = 4,
999 .max_access_size = 4,
1000 },
1001 };
1002
sungem_mmio_rxdma_write(void * opaque,hwaddr addr,uint64_t val,unsigned size)1003 static void sungem_mmio_rxdma_write(void *opaque, hwaddr addr, uint64_t val,
1004 unsigned size)
1005 {
1006 SunGEMState *s = opaque;
1007
1008 if (!(addr <= 0x28) && !(addr >= 0x100 && addr <= 0x120)) {
1009 qemu_log_mask(LOG_GUEST_ERROR,
1010 "Write to unknown RXDMA register 0x%"HWADDR_PRIx"\n",
1011 addr);
1012 return;
1013 }
1014
1015 trace_sungem_mmio_rxdma_write(addr, val);
1016
1017 /* Pre-write filter */
1018 switch (addr) {
1019 /* Read only registers */
1020 case RXDMA_DONE:
1021 case RXDMA_PCNT:
1022 case RXDMA_SMACHINE:
1023 case RXDMA_DPLOW:
1024 case RXDMA_DPHI:
1025 case RXDMA_FSZ:
1026 case RXDMA_FTAG:
1027 return; /* No actual write */
1028 }
1029
1030 s->rxdmaregs[addr >> 2] = val;
1031
1032 /* Post write action */
1033 switch (addr) {
1034 case RXDMA_KICK:
1035 trace_sungem_rx_kick(val);
1036 break;
1037 case RXDMA_CFG:
1038 sungem_update_masks(s);
1039 if ((s->macregs[MAC_RXCFG >> 2] & MAC_RXCFG_ENAB) != 0 &&
1040 (s->rxdmaregs[RXDMA_CFG >> 2] & RXDMA_CFG_ENABLE) != 0) {
1041 qemu_flush_queued_packets(qemu_get_queue(s->nic));
1042 }
1043 break;
1044 }
1045 }
1046
sungem_mmio_rxdma_read(void * opaque,hwaddr addr,unsigned size)1047 static uint64_t sungem_mmio_rxdma_read(void *opaque, hwaddr addr, unsigned size)
1048 {
1049 SunGEMState *s = opaque;
1050 uint32_t val;
1051
1052 if (!(addr <= 0x28) && !(addr >= 0x100 && addr <= 0x120)) {
1053 qemu_log_mask(LOG_GUEST_ERROR,
1054 "Read from unknown RXDMA register 0x%"HWADDR_PRIx"\n",
1055 addr);
1056 return 0;
1057 }
1058
1059 val = s->rxdmaregs[addr >> 2];
1060
1061 trace_sungem_mmio_rxdma_read(addr, val);
1062
1063 return val;
1064 }
1065
1066 static const MemoryRegionOps sungem_mmio_rxdma_ops = {
1067 .read = sungem_mmio_rxdma_read,
1068 .write = sungem_mmio_rxdma_write,
1069 .endianness = DEVICE_LITTLE_ENDIAN,
1070 .impl = {
1071 .min_access_size = 4,
1072 .max_access_size = 4,
1073 },
1074 };
1075
sungem_mmio_wol_write(void * opaque,hwaddr addr,uint64_t val,unsigned size)1076 static void sungem_mmio_wol_write(void *opaque, hwaddr addr, uint64_t val,
1077 unsigned size)
1078 {
1079 trace_sungem_mmio_wol_write(addr, val);
1080
1081 switch (addr) {
1082 case WOL_WAKECSR:
1083 if (val != 0) {
1084 qemu_log_mask(LOG_UNIMP, "sungem: WOL not supported\n");
1085 }
1086 break;
1087 default:
1088 qemu_log_mask(LOG_UNIMP, "sungem: WOL not supported\n");
1089 }
1090 }
1091
sungem_mmio_wol_read(void * opaque,hwaddr addr,unsigned size)1092 static uint64_t sungem_mmio_wol_read(void *opaque, hwaddr addr, unsigned size)
1093 {
1094 uint32_t val = -1;
1095
1096 qemu_log_mask(LOG_UNIMP, "sungem: WOL not supported\n");
1097
1098 trace_sungem_mmio_wol_read(addr, val);
1099
1100 return val;
1101 }
1102
1103 static const MemoryRegionOps sungem_mmio_wol_ops = {
1104 .read = sungem_mmio_wol_read,
1105 .write = sungem_mmio_wol_write,
1106 .endianness = DEVICE_LITTLE_ENDIAN,
1107 .impl = {
1108 .min_access_size = 4,
1109 .max_access_size = 4,
1110 },
1111 };
1112
sungem_mmio_mac_write(void * opaque,hwaddr addr,uint64_t val,unsigned size)1113 static void sungem_mmio_mac_write(void *opaque, hwaddr addr, uint64_t val,
1114 unsigned size)
1115 {
1116 SunGEMState *s = opaque;
1117
1118 if (!(addr <= 0x134)) {
1119 qemu_log_mask(LOG_GUEST_ERROR,
1120 "Write to unknown MAC register 0x%"HWADDR_PRIx"\n",
1121 addr);
1122 return;
1123 }
1124
1125 trace_sungem_mmio_mac_write(addr, val);
1126
1127 /* Pre-write filter */
1128 switch (addr) {
1129 /* Read only registers */
1130 case MAC_TXRST: /* Not technically read-only but will do for now */
1131 case MAC_RXRST: /* Not technically read-only but will do for now */
1132 case MAC_TXSTAT:
1133 case MAC_RXSTAT:
1134 case MAC_CSTAT:
1135 case MAC_PATMPS:
1136 case MAC_SMACHINE:
1137 return; /* No actual write */
1138 case MAC_MINFSZ:
1139 /* 10-bits implemented */
1140 val &= 0x3ff;
1141 break;
1142 }
1143
1144 s->macregs[addr >> 2] = val;
1145
1146 /* Post write action */
1147 switch (addr) {
1148 case MAC_TXMASK:
1149 case MAC_RXMASK:
1150 case MAC_MCMASK:
1151 sungem_eval_cascade_irq(s);
1152 break;
1153 case MAC_RXCFG:
1154 sungem_update_masks(s);
1155 if ((s->macregs[MAC_RXCFG >> 2] & MAC_RXCFG_ENAB) != 0 &&
1156 (s->rxdmaregs[RXDMA_CFG >> 2] & RXDMA_CFG_ENABLE) != 0) {
1157 qemu_flush_queued_packets(qemu_get_queue(s->nic));
1158 }
1159 break;
1160 }
1161 }
1162
sungem_mmio_mac_read(void * opaque,hwaddr addr,unsigned size)1163 static uint64_t sungem_mmio_mac_read(void *opaque, hwaddr addr, unsigned size)
1164 {
1165 SunGEMState *s = opaque;
1166 uint32_t val;
1167
1168 if (!(addr <= 0x134)) {
1169 qemu_log_mask(LOG_GUEST_ERROR,
1170 "Read from unknown MAC register 0x%"HWADDR_PRIx"\n",
1171 addr);
1172 return 0;
1173 }
1174
1175 val = s->macregs[addr >> 2];
1176
1177 trace_sungem_mmio_mac_read(addr, val);
1178
1179 switch (addr) {
1180 case MAC_TXSTAT:
1181 /* Side effect, clear all */
1182 s->macregs[addr >> 2] = 0;
1183 sungem_update_status(s, GREG_STAT_TXMAC, false);
1184 break;
1185 case MAC_RXSTAT:
1186 /* Side effect, clear all */
1187 s->macregs[addr >> 2] = 0;
1188 sungem_update_status(s, GREG_STAT_RXMAC, false);
1189 break;
1190 case MAC_CSTAT:
1191 /* Side effect, interrupt bits */
1192 s->macregs[addr >> 2] &= MAC_CSTAT_PTR;
1193 sungem_update_status(s, GREG_STAT_MAC, false);
1194 break;
1195 }
1196
1197 return val;
1198 }
1199
1200 static const MemoryRegionOps sungem_mmio_mac_ops = {
1201 .read = sungem_mmio_mac_read,
1202 .write = sungem_mmio_mac_write,
1203 .endianness = DEVICE_LITTLE_ENDIAN,
1204 .impl = {
1205 .min_access_size = 4,
1206 .max_access_size = 4,
1207 },
1208 };
1209
sungem_mmio_mif_write(void * opaque,hwaddr addr,uint64_t val,unsigned size)1210 static void sungem_mmio_mif_write(void *opaque, hwaddr addr, uint64_t val,
1211 unsigned size)
1212 {
1213 SunGEMState *s = opaque;
1214
1215 if (!(addr <= 0x1c)) {
1216 qemu_log_mask(LOG_GUEST_ERROR,
1217 "Write to unknown MIF register 0x%"HWADDR_PRIx"\n",
1218 addr);
1219 return;
1220 }
1221
1222 trace_sungem_mmio_mif_write(addr, val);
1223
1224 /* Pre-write filter */
1225 switch (addr) {
1226 /* Read only registers */
1227 case MIF_STATUS:
1228 case MIF_SMACHINE:
1229 return; /* No actual write */
1230 case MIF_CFG:
1231 /* Maintain the RO MDI bits to advertise an MDIO PHY on MDI0 */
1232 val &= ~MIF_CFG_MDI1;
1233 val |= MIF_CFG_MDI0;
1234 break;
1235 }
1236
1237 s->mifregs[addr >> 2] = val;
1238
1239 /* Post write action */
1240 switch (addr) {
1241 case MIF_FRAME:
1242 s->mifregs[addr >> 2] = sungem_mii_op(s, val);
1243 break;
1244 }
1245 }
1246
sungem_mmio_mif_read(void * opaque,hwaddr addr,unsigned size)1247 static uint64_t sungem_mmio_mif_read(void *opaque, hwaddr addr, unsigned size)
1248 {
1249 SunGEMState *s = opaque;
1250 uint32_t val;
1251
1252 if (!(addr <= 0x1c)) {
1253 qemu_log_mask(LOG_GUEST_ERROR,
1254 "Read from unknown MIF register 0x%"HWADDR_PRIx"\n",
1255 addr);
1256 return 0;
1257 }
1258
1259 val = s->mifregs[addr >> 2];
1260
1261 trace_sungem_mmio_mif_read(addr, val);
1262
1263 return val;
1264 }
1265
1266 static const MemoryRegionOps sungem_mmio_mif_ops = {
1267 .read = sungem_mmio_mif_read,
1268 .write = sungem_mmio_mif_write,
1269 .endianness = DEVICE_LITTLE_ENDIAN,
1270 .impl = {
1271 .min_access_size = 4,
1272 .max_access_size = 4,
1273 },
1274 };
1275
sungem_mmio_pcs_write(void * opaque,hwaddr addr,uint64_t val,unsigned size)1276 static void sungem_mmio_pcs_write(void *opaque, hwaddr addr, uint64_t val,
1277 unsigned size)
1278 {
1279 SunGEMState *s = opaque;
1280
1281 if (!(addr <= 0x18) && !(addr >= 0x50 && addr <= 0x5c)) {
1282 qemu_log_mask(LOG_GUEST_ERROR,
1283 "Write to unknown PCS register 0x%"HWADDR_PRIx"\n",
1284 addr);
1285 return;
1286 }
1287
1288 trace_sungem_mmio_pcs_write(addr, val);
1289
1290 /* Pre-write filter */
1291 switch (addr) {
1292 /* Read only registers */
1293 case PCS_MIISTAT:
1294 case PCS_ISTAT:
1295 case PCS_SSTATE:
1296 return; /* No actual write */
1297 }
1298
1299 s->pcsregs[addr >> 2] = val;
1300 }
1301
sungem_mmio_pcs_read(void * opaque,hwaddr addr,unsigned size)1302 static uint64_t sungem_mmio_pcs_read(void *opaque, hwaddr addr, unsigned size)
1303 {
1304 SunGEMState *s = opaque;
1305 uint32_t val;
1306
1307 if (!(addr <= 0x18) && !(addr >= 0x50 && addr <= 0x5c)) {
1308 qemu_log_mask(LOG_GUEST_ERROR,
1309 "Read from unknown PCS register 0x%"HWADDR_PRIx"\n",
1310 addr);
1311 return 0;
1312 }
1313
1314 val = s->pcsregs[addr >> 2];
1315
1316 trace_sungem_mmio_pcs_read(addr, val);
1317
1318 return val;
1319 }
1320
1321 static const MemoryRegionOps sungem_mmio_pcs_ops = {
1322 .read = sungem_mmio_pcs_read,
1323 .write = sungem_mmio_pcs_write,
1324 .endianness = DEVICE_LITTLE_ENDIAN,
1325 .impl = {
1326 .min_access_size = 4,
1327 .max_access_size = 4,
1328 },
1329 };
1330
sungem_uninit(PCIDevice * dev)1331 static void sungem_uninit(PCIDevice *dev)
1332 {
1333 SunGEMState *s = SUNGEM(dev);
1334
1335 qemu_del_nic(s->nic);
1336 }
1337
1338 static NetClientInfo net_sungem_info = {
1339 .type = NET_CLIENT_DRIVER_NIC,
1340 .size = sizeof(NICState),
1341 .can_receive = sungem_can_receive,
1342 .receive = sungem_receive,
1343 .link_status_changed = sungem_set_link_status,
1344 };
1345
sungem_realize(PCIDevice * pci_dev,Error ** errp)1346 static void sungem_realize(PCIDevice *pci_dev, Error **errp)
1347 {
1348 DeviceState *dev = DEVICE(pci_dev);
1349 SunGEMState *s = SUNGEM(pci_dev);
1350 uint8_t *pci_conf;
1351
1352 pci_conf = pci_dev->config;
1353
1354 pci_set_word(pci_conf + PCI_STATUS,
1355 PCI_STATUS_FAST_BACK |
1356 PCI_STATUS_DEVSEL_MEDIUM |
1357 PCI_STATUS_66MHZ);
1358
1359 pci_set_word(pci_conf + PCI_SUBSYSTEM_VENDOR_ID, 0x0);
1360 pci_set_word(pci_conf + PCI_SUBSYSTEM_ID, 0x0);
1361
1362 pci_conf[PCI_INTERRUPT_PIN] = 1; /* interrupt pin A */
1363 pci_conf[PCI_MIN_GNT] = 0x40;
1364 pci_conf[PCI_MAX_LAT] = 0x40;
1365
1366 sungem_reset_all(s, true);
1367 memory_region_init(&s->sungem, OBJECT(s), "sungem", SUNGEM_MMIO_SIZE);
1368
1369 memory_region_init_io(&s->greg, OBJECT(s), &sungem_mmio_greg_ops, s,
1370 "sungem.greg", SUNGEM_MMIO_GREG_SIZE);
1371 memory_region_add_subregion(&s->sungem, 0, &s->greg);
1372
1373 memory_region_init_io(&s->txdma, OBJECT(s), &sungem_mmio_txdma_ops, s,
1374 "sungem.txdma", SUNGEM_MMIO_TXDMA_SIZE);
1375 memory_region_add_subregion(&s->sungem, 0x2000, &s->txdma);
1376
1377 memory_region_init_io(&s->rxdma, OBJECT(s), &sungem_mmio_rxdma_ops, s,
1378 "sungem.rxdma", SUNGEM_MMIO_RXDMA_SIZE);
1379 memory_region_add_subregion(&s->sungem, 0x4000, &s->rxdma);
1380
1381 memory_region_init_io(&s->wol, OBJECT(s), &sungem_mmio_wol_ops, s,
1382 "sungem.wol", SUNGEM_MMIO_WOL_SIZE);
1383 memory_region_add_subregion(&s->sungem, 0x3000, &s->wol);
1384
1385 memory_region_init_io(&s->mac, OBJECT(s), &sungem_mmio_mac_ops, s,
1386 "sungem.mac", SUNGEM_MMIO_MAC_SIZE);
1387 memory_region_add_subregion(&s->sungem, 0x6000, &s->mac);
1388
1389 memory_region_init_io(&s->mif, OBJECT(s), &sungem_mmio_mif_ops, s,
1390 "sungem.mif", SUNGEM_MMIO_MIF_SIZE);
1391 memory_region_add_subregion(&s->sungem, 0x6200, &s->mif);
1392
1393 memory_region_init_io(&s->pcs, OBJECT(s), &sungem_mmio_pcs_ops, s,
1394 "sungem.pcs", SUNGEM_MMIO_PCS_SIZE);
1395 memory_region_add_subregion(&s->sungem, 0x9000, &s->pcs);
1396
1397 pci_register_bar(pci_dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->sungem);
1398
1399 qemu_macaddr_default_if_unset(&s->conf.macaddr);
1400 s->nic = qemu_new_nic(&net_sungem_info, &s->conf,
1401 object_get_typename(OBJECT(dev)),
1402 dev->id, &dev->mem_reentrancy_guard, s);
1403 qemu_format_nic_info_str(qemu_get_queue(s->nic),
1404 s->conf.macaddr.a);
1405 }
1406
sungem_reset(DeviceState * dev)1407 static void sungem_reset(DeviceState *dev)
1408 {
1409 SunGEMState *s = SUNGEM(dev);
1410
1411 sungem_reset_all(s, true);
1412 }
1413
sungem_instance_init(Object * obj)1414 static void sungem_instance_init(Object *obj)
1415 {
1416 SunGEMState *s = SUNGEM(obj);
1417
1418 device_add_bootindex_property(obj, &s->conf.bootindex,
1419 "bootindex", "/ethernet-phy@0",
1420 DEVICE(obj));
1421 }
1422
1423 static Property sungem_properties[] = {
1424 DEFINE_NIC_PROPERTIES(SunGEMState, conf),
1425 /* Phy address should be 0 for most Apple machines except
1426 * for K2 in which case it's 1. Will be set by a machine
1427 * override.
1428 */
1429 DEFINE_PROP_UINT32("phy_addr", SunGEMState, phy_addr, 0),
1430 DEFINE_PROP_END_OF_LIST(),
1431 };
1432
1433 static const VMStateDescription vmstate_sungem = {
1434 .name = "sungem",
1435 .version_id = 0,
1436 .minimum_version_id = 0,
1437 .fields = (const VMStateField[]) {
1438 VMSTATE_PCI_DEVICE(pdev, SunGEMState),
1439 VMSTATE_MACADDR(conf.macaddr, SunGEMState),
1440 VMSTATE_UINT32(phy_addr, SunGEMState),
1441 VMSTATE_UINT32_ARRAY(gregs, SunGEMState, (SUNGEM_MMIO_GREG_SIZE >> 2)),
1442 VMSTATE_UINT32_ARRAY(txdmaregs, SunGEMState,
1443 (SUNGEM_MMIO_TXDMA_SIZE >> 2)),
1444 VMSTATE_UINT32_ARRAY(rxdmaregs, SunGEMState,
1445 (SUNGEM_MMIO_RXDMA_SIZE >> 2)),
1446 VMSTATE_UINT32_ARRAY(macregs, SunGEMState, (SUNGEM_MMIO_MAC_SIZE >> 2)),
1447 VMSTATE_UINT32_ARRAY(mifregs, SunGEMState, (SUNGEM_MMIO_MIF_SIZE >> 2)),
1448 VMSTATE_UINT32_ARRAY(pcsregs, SunGEMState, (SUNGEM_MMIO_PCS_SIZE >> 2)),
1449 VMSTATE_UINT32(rx_mask, SunGEMState),
1450 VMSTATE_UINT32(tx_mask, SunGEMState),
1451 VMSTATE_UINT8_ARRAY(tx_data, SunGEMState, MAX_PACKET_SIZE),
1452 VMSTATE_UINT32(tx_size, SunGEMState),
1453 VMSTATE_UINT64(tx_first_ctl, SunGEMState),
1454 VMSTATE_END_OF_LIST()
1455 }
1456 };
1457
sungem_class_init(ObjectClass * klass,void * data)1458 static void sungem_class_init(ObjectClass *klass, void *data)
1459 {
1460 DeviceClass *dc = DEVICE_CLASS(klass);
1461 PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
1462
1463 k->realize = sungem_realize;
1464 k->exit = sungem_uninit;
1465 k->vendor_id = PCI_VENDOR_ID_APPLE;
1466 k->device_id = PCI_DEVICE_ID_APPLE_UNI_N_GMAC;
1467 k->revision = 0x01;
1468 k->class_id = PCI_CLASS_NETWORK_ETHERNET;
1469 dc->vmsd = &vmstate_sungem;
1470 device_class_set_legacy_reset(dc, sungem_reset);
1471 device_class_set_props(dc, sungem_properties);
1472 set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
1473 }
1474
1475 static const TypeInfo sungem_info = {
1476 .name = TYPE_SUNGEM,
1477 .parent = TYPE_PCI_DEVICE,
1478 .instance_size = sizeof(SunGEMState),
1479 .class_init = sungem_class_init,
1480 .instance_init = sungem_instance_init,
1481 .interfaces = (InterfaceInfo[]) {
1482 { INTERFACE_CONVENTIONAL_PCI_DEVICE },
1483 { }
1484 }
1485 };
1486
sungem_register_types(void)1487 static void sungem_register_types(void)
1488 {
1489 type_register_static(&sungem_info);
1490 }
1491
1492 type_init(sungem_register_types)
1493