1 /* 2 * i.MX Fast Ethernet Controller emulation. 3 * 4 * Copyright (c) 2013 Jean-Christophe Dubois. <jcd@tribudubois.net> 5 * 6 * Based on Coldfire Fast Ethernet Controller emulation. 7 * 8 * Copyright (c) 2007 CodeSourcery. 9 * 10 * This program is free software; you can redistribute it and/or modify it 11 * under the terms of the GNU General Public License as published by the 12 * Free Software Foundation; either version 2 of the License, or 13 * (at your option) any later version. 14 * 15 * This program is distributed in the hope that it will be useful, but WITHOUT 16 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 17 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License 18 * for more details. 19 * 20 * You should have received a copy of the GNU General Public License along 21 * with this program; if not, see <http://www.gnu.org/licenses/>. 22 */ 23 24 #include "qemu/osdep.h" 25 #include "hw/net/imx_fec.h" 26 #include "sysemu/dma.h" 27 #include "qemu/log.h" 28 #include "qemu/module.h" 29 #include "net/checksum.h" 30 #include "net/eth.h" 31 32 /* For crc32 */ 33 #include <zlib.h> 34 35 #ifndef DEBUG_IMX_FEC 36 #define DEBUG_IMX_FEC 0 37 #endif 38 39 #define FEC_PRINTF(fmt, args...) \ 40 do { \ 41 if (DEBUG_IMX_FEC) { \ 42 fprintf(stderr, "[%s]%s: " fmt , TYPE_IMX_FEC, \ 43 __func__, ##args); \ 44 } \ 45 } while (0) 46 47 #ifndef DEBUG_IMX_PHY 48 #define DEBUG_IMX_PHY 0 49 #endif 50 51 #define PHY_PRINTF(fmt, args...) \ 52 do { \ 53 if (DEBUG_IMX_PHY) { \ 54 fprintf(stderr, "[%s.phy]%s: " fmt , TYPE_IMX_FEC, \ 55 __func__, ##args); \ 56 } \ 57 } while (0) 58 59 #define IMX_MAX_DESC 1024 60 61 static const char *imx_default_reg_name(IMXFECState *s, uint32_t index) 62 { 63 static char tmp[20]; 64 sprintf(tmp, "index %d", index); 65 return tmp; 66 } 67 68 static const char *imx_fec_reg_name(IMXFECState *s, uint32_t index) 69 { 70 switch (index) { 71 case ENET_FRBR: 72 return "FRBR"; 73 case ENET_FRSR: 74 return "FRSR"; 75 case ENET_MIIGSK_CFGR: 76 return "MIIGSK_CFGR"; 77 case ENET_MIIGSK_ENR: 78 return "MIIGSK_ENR"; 79 default: 80 return imx_default_reg_name(s, index); 81 } 82 } 83 84 static const char *imx_enet_reg_name(IMXFECState *s, uint32_t index) 85 { 86 switch (index) { 87 case ENET_RSFL: 88 return "RSFL"; 89 case ENET_RSEM: 90 return "RSEM"; 91 case ENET_RAEM: 92 return "RAEM"; 93 case ENET_RAFL: 94 return "RAFL"; 95 case ENET_TSEM: 96 return "TSEM"; 97 case ENET_TAEM: 98 return "TAEM"; 99 case ENET_TAFL: 100 return "TAFL"; 101 case ENET_TIPG: 102 return "TIPG"; 103 case ENET_FTRL: 104 return "FTRL"; 105 case ENET_TACC: 106 return "TACC"; 107 case ENET_RACC: 108 return "RACC"; 109 case ENET_ATCR: 110 return "ATCR"; 111 case ENET_ATVR: 112 return "ATVR"; 113 case ENET_ATOFF: 114 return "ATOFF"; 115 case ENET_ATPER: 116 return "ATPER"; 117 case ENET_ATCOR: 118 return "ATCOR"; 119 case ENET_ATINC: 120 return "ATINC"; 121 case ENET_ATSTMP: 122 return "ATSTMP"; 123 case ENET_TGSR: 124 return "TGSR"; 125 case ENET_TCSR0: 126 return "TCSR0"; 127 case ENET_TCCR0: 128 return "TCCR0"; 129 case ENET_TCSR1: 130 return "TCSR1"; 131 case ENET_TCCR1: 132 return "TCCR1"; 133 case ENET_TCSR2: 134 return "TCSR2"; 135 case ENET_TCCR2: 136 return "TCCR2"; 137 case ENET_TCSR3: 138 return "TCSR3"; 139 case ENET_TCCR3: 140 return "TCCR3"; 141 default: 142 return imx_default_reg_name(s, index); 143 } 144 } 145 146 static const char *imx_eth_reg_name(IMXFECState *s, uint32_t index) 147 { 148 switch (index) { 149 case ENET_EIR: 150 return "EIR"; 151 case ENET_EIMR: 152 return "EIMR"; 153 case ENET_RDAR: 154 return "RDAR"; 155 case ENET_TDAR: 156 return "TDAR"; 157 case ENET_ECR: 158 return "ECR"; 159 case ENET_MMFR: 160 return "MMFR"; 161 case ENET_MSCR: 162 return "MSCR"; 163 case ENET_MIBC: 164 return "MIBC"; 165 case ENET_RCR: 166 return "RCR"; 167 case ENET_TCR: 168 return "TCR"; 169 case ENET_PALR: 170 return "PALR"; 171 case ENET_PAUR: 172 return "PAUR"; 173 case ENET_OPD: 174 return "OPD"; 175 case ENET_IAUR: 176 return "IAUR"; 177 case ENET_IALR: 178 return "IALR"; 179 case ENET_GAUR: 180 return "GAUR"; 181 case ENET_GALR: 182 return "GALR"; 183 case ENET_TFWR: 184 return "TFWR"; 185 case ENET_RDSR: 186 return "RDSR"; 187 case ENET_TDSR: 188 return "TDSR"; 189 case ENET_MRBR: 190 return "MRBR"; 191 default: 192 if (s->is_fec) { 193 return imx_fec_reg_name(s, index); 194 } else { 195 return imx_enet_reg_name(s, index); 196 } 197 } 198 } 199 200 /* 201 * Versions of this device with more than one TX descriptor save the 202 * 2nd and 3rd descriptors in a subsection, to maintain migration 203 * compatibility with previous versions of the device that only 204 * supported a single descriptor. 205 */ 206 static bool imx_eth_is_multi_tx_ring(void *opaque) 207 { 208 IMXFECState *s = IMX_FEC(opaque); 209 210 return s->tx_ring_num > 1; 211 } 212 213 static const VMStateDescription vmstate_imx_eth_txdescs = { 214 .name = "imx.fec/txdescs", 215 .version_id = 1, 216 .minimum_version_id = 1, 217 .needed = imx_eth_is_multi_tx_ring, 218 .fields = (VMStateField[]) { 219 VMSTATE_UINT32(tx_descriptor[1], IMXFECState), 220 VMSTATE_UINT32(tx_descriptor[2], IMXFECState), 221 VMSTATE_END_OF_LIST() 222 } 223 }; 224 225 static const VMStateDescription vmstate_imx_eth = { 226 .name = TYPE_IMX_FEC, 227 .version_id = 2, 228 .minimum_version_id = 2, 229 .fields = (VMStateField[]) { 230 VMSTATE_UINT32_ARRAY(regs, IMXFECState, ENET_MAX), 231 VMSTATE_UINT32(rx_descriptor, IMXFECState), 232 VMSTATE_UINT32(tx_descriptor[0], IMXFECState), 233 VMSTATE_UINT32(phy_status, IMXFECState), 234 VMSTATE_UINT32(phy_control, IMXFECState), 235 VMSTATE_UINT32(phy_advertise, IMXFECState), 236 VMSTATE_UINT32(phy_int, IMXFECState), 237 VMSTATE_UINT32(phy_int_mask, IMXFECState), 238 VMSTATE_END_OF_LIST() 239 }, 240 .subsections = (const VMStateDescription * []) { 241 &vmstate_imx_eth_txdescs, 242 NULL 243 }, 244 }; 245 246 #define PHY_INT_ENERGYON (1 << 7) 247 #define PHY_INT_AUTONEG_COMPLETE (1 << 6) 248 #define PHY_INT_FAULT (1 << 5) 249 #define PHY_INT_DOWN (1 << 4) 250 #define PHY_INT_AUTONEG_LP (1 << 3) 251 #define PHY_INT_PARFAULT (1 << 2) 252 #define PHY_INT_AUTONEG_PAGE (1 << 1) 253 254 static void imx_eth_update(IMXFECState *s); 255 256 /* 257 * The MII phy could raise a GPIO to the processor which in turn 258 * could be handled as an interrpt by the OS. 259 * For now we don't handle any GPIO/interrupt line, so the OS will 260 * have to poll for the PHY status. 261 */ 262 static void phy_update_irq(IMXFECState *s) 263 { 264 imx_eth_update(s); 265 } 266 267 static void phy_update_link(IMXFECState *s) 268 { 269 /* Autonegotiation status mirrors link status. */ 270 if (qemu_get_queue(s->nic)->link_down) { 271 PHY_PRINTF("link is down\n"); 272 s->phy_status &= ~0x0024; 273 s->phy_int |= PHY_INT_DOWN; 274 } else { 275 PHY_PRINTF("link is up\n"); 276 s->phy_status |= 0x0024; 277 s->phy_int |= PHY_INT_ENERGYON; 278 s->phy_int |= PHY_INT_AUTONEG_COMPLETE; 279 } 280 phy_update_irq(s); 281 } 282 283 static void imx_eth_set_link(NetClientState *nc) 284 { 285 phy_update_link(IMX_FEC(qemu_get_nic_opaque(nc))); 286 } 287 288 static void phy_reset(IMXFECState *s) 289 { 290 s->phy_status = 0x7809; 291 s->phy_control = 0x3000; 292 s->phy_advertise = 0x01e1; 293 s->phy_int_mask = 0; 294 s->phy_int = 0; 295 phy_update_link(s); 296 } 297 298 static uint32_t do_phy_read(IMXFECState *s, int reg) 299 { 300 uint32_t val; 301 302 if (reg > 31) { 303 /* we only advertise one phy */ 304 return 0; 305 } 306 307 switch (reg) { 308 case 0: /* Basic Control */ 309 val = s->phy_control; 310 break; 311 case 1: /* Basic Status */ 312 val = s->phy_status; 313 break; 314 case 2: /* ID1 */ 315 val = 0x0007; 316 break; 317 case 3: /* ID2 */ 318 val = 0xc0d1; 319 break; 320 case 4: /* Auto-neg advertisement */ 321 val = s->phy_advertise; 322 break; 323 case 5: /* Auto-neg Link Partner Ability */ 324 val = 0x0f71; 325 break; 326 case 6: /* Auto-neg Expansion */ 327 val = 1; 328 break; 329 case 29: /* Interrupt source. */ 330 val = s->phy_int; 331 s->phy_int = 0; 332 phy_update_irq(s); 333 break; 334 case 30: /* Interrupt mask */ 335 val = s->phy_int_mask; 336 break; 337 case 17: 338 case 18: 339 case 27: 340 case 31: 341 qemu_log_mask(LOG_UNIMP, "[%s.phy]%s: reg %d not implemented\n", 342 TYPE_IMX_FEC, __func__, reg); 343 val = 0; 344 break; 345 default: 346 qemu_log_mask(LOG_GUEST_ERROR, "[%s.phy]%s: Bad address at offset %d\n", 347 TYPE_IMX_FEC, __func__, reg); 348 val = 0; 349 break; 350 } 351 352 PHY_PRINTF("read 0x%04x @ %d\n", val, reg); 353 354 return val; 355 } 356 357 static void do_phy_write(IMXFECState *s, int reg, uint32_t val) 358 { 359 PHY_PRINTF("write 0x%04x @ %d\n", val, reg); 360 361 if (reg > 31) { 362 /* we only advertise one phy */ 363 return; 364 } 365 366 switch (reg) { 367 case 0: /* Basic Control */ 368 if (val & 0x8000) { 369 phy_reset(s); 370 } else { 371 s->phy_control = val & 0x7980; 372 /* Complete autonegotiation immediately. */ 373 if (val & 0x1000) { 374 s->phy_status |= 0x0020; 375 } 376 } 377 break; 378 case 4: /* Auto-neg advertisement */ 379 s->phy_advertise = (val & 0x2d7f) | 0x80; 380 break; 381 case 30: /* Interrupt mask */ 382 s->phy_int_mask = val & 0xff; 383 phy_update_irq(s); 384 break; 385 case 17: 386 case 18: 387 case 27: 388 case 31: 389 qemu_log_mask(LOG_UNIMP, "[%s.phy)%s: reg %d not implemented\n", 390 TYPE_IMX_FEC, __func__, reg); 391 break; 392 default: 393 qemu_log_mask(LOG_GUEST_ERROR, "[%s.phy]%s: Bad address at offset %d\n", 394 TYPE_IMX_FEC, __func__, reg); 395 break; 396 } 397 } 398 399 static void imx_fec_read_bd(IMXFECBufDesc *bd, dma_addr_t addr) 400 { 401 dma_memory_read(&address_space_memory, addr, bd, sizeof(*bd)); 402 } 403 404 static void imx_fec_write_bd(IMXFECBufDesc *bd, dma_addr_t addr) 405 { 406 dma_memory_write(&address_space_memory, addr, bd, sizeof(*bd)); 407 } 408 409 static void imx_enet_read_bd(IMXENETBufDesc *bd, dma_addr_t addr) 410 { 411 dma_memory_read(&address_space_memory, addr, bd, sizeof(*bd)); 412 } 413 414 static void imx_enet_write_bd(IMXENETBufDesc *bd, dma_addr_t addr) 415 { 416 dma_memory_write(&address_space_memory, addr, bd, sizeof(*bd)); 417 } 418 419 static void imx_eth_update(IMXFECState *s) 420 { 421 /* 422 * Previous versions of qemu had the ENET_INT_MAC and ENET_INT_TS_TIMER 423 * interrupts swapped. This worked with older versions of Linux (4.14 424 * and older) since Linux associated both interrupt lines with Ethernet 425 * MAC interrupts. Specifically, 426 * - Linux 4.15 and later have separate interrupt handlers for the MAC and 427 * timer interrupts. Those versions of Linux fail with versions of QEMU 428 * with swapped interrupt assignments. 429 * - In linux 4.14, both interrupt lines were registered with the Ethernet 430 * MAC interrupt handler. As a result, all versions of qemu happen to 431 * work, though that is accidental. 432 * - In Linux 4.9 and older, the timer interrupt was registered directly 433 * with the Ethernet MAC interrupt handler. The MAC interrupt was 434 * redirected to a GPIO interrupt to work around erratum ERR006687. 435 * This was implemented using the SOC's IOMUX block. In qemu, this GPIO 436 * interrupt never fired since IOMUX is currently not supported in qemu. 437 * Linux instead received MAC interrupts on the timer interrupt. 438 * As a result, qemu versions with the swapped interrupt assignment work, 439 * albeit accidentally, but qemu versions with the correct interrupt 440 * assignment fail. 441 * 442 * To ensure that all versions of Linux work, generate ENET_INT_MAC 443 * interrrupts on both interrupt lines. This should be changed if and when 444 * qemu supports IOMUX. 445 */ 446 if (s->regs[ENET_EIR] & s->regs[ENET_EIMR] & 447 (ENET_INT_MAC | ENET_INT_TS_TIMER)) { 448 qemu_set_irq(s->irq[1], 1); 449 } else { 450 qemu_set_irq(s->irq[1], 0); 451 } 452 453 if (s->regs[ENET_EIR] & s->regs[ENET_EIMR] & ENET_INT_MAC) { 454 qemu_set_irq(s->irq[0], 1); 455 } else { 456 qemu_set_irq(s->irq[0], 0); 457 } 458 } 459 460 static void imx_fec_do_tx(IMXFECState *s) 461 { 462 int frame_size = 0, descnt = 0; 463 uint8_t *ptr = s->frame; 464 uint32_t addr = s->tx_descriptor[0]; 465 466 while (descnt++ < IMX_MAX_DESC) { 467 IMXFECBufDesc bd; 468 int len; 469 470 imx_fec_read_bd(&bd, addr); 471 FEC_PRINTF("tx_bd %x flags %04x len %d data %08x\n", 472 addr, bd.flags, bd.length, bd.data); 473 if ((bd.flags & ENET_BD_R) == 0) { 474 /* Run out of descriptors to transmit. */ 475 FEC_PRINTF("tx_bd ran out of descriptors to transmit\n"); 476 break; 477 } 478 len = bd.length; 479 if (frame_size + len > ENET_MAX_FRAME_SIZE) { 480 len = ENET_MAX_FRAME_SIZE - frame_size; 481 s->regs[ENET_EIR] |= ENET_INT_BABT; 482 } 483 dma_memory_read(&address_space_memory, bd.data, ptr, len); 484 ptr += len; 485 frame_size += len; 486 if (bd.flags & ENET_BD_L) { 487 /* Last buffer in frame. */ 488 qemu_send_packet(qemu_get_queue(s->nic), s->frame, frame_size); 489 ptr = s->frame; 490 frame_size = 0; 491 s->regs[ENET_EIR] |= ENET_INT_TXF; 492 } 493 s->regs[ENET_EIR] |= ENET_INT_TXB; 494 bd.flags &= ~ENET_BD_R; 495 /* Write back the modified descriptor. */ 496 imx_fec_write_bd(&bd, addr); 497 /* Advance to the next descriptor. */ 498 if ((bd.flags & ENET_BD_W) != 0) { 499 addr = s->regs[ENET_TDSR]; 500 } else { 501 addr += sizeof(bd); 502 } 503 } 504 505 s->tx_descriptor[0] = addr; 506 507 imx_eth_update(s); 508 } 509 510 static void imx_enet_do_tx(IMXFECState *s, uint32_t index) 511 { 512 int frame_size = 0, descnt = 0; 513 514 uint8_t *ptr = s->frame; 515 uint32_t addr, int_txb, int_txf, tdsr; 516 size_t ring; 517 518 switch (index) { 519 case ENET_TDAR: 520 ring = 0; 521 int_txb = ENET_INT_TXB; 522 int_txf = ENET_INT_TXF; 523 tdsr = ENET_TDSR; 524 break; 525 case ENET_TDAR1: 526 ring = 1; 527 int_txb = ENET_INT_TXB1; 528 int_txf = ENET_INT_TXF1; 529 tdsr = ENET_TDSR1; 530 break; 531 case ENET_TDAR2: 532 ring = 2; 533 int_txb = ENET_INT_TXB2; 534 int_txf = ENET_INT_TXF2; 535 tdsr = ENET_TDSR2; 536 break; 537 default: 538 qemu_log_mask(LOG_GUEST_ERROR, 539 "%s: bogus value for index %x\n", 540 __func__, index); 541 abort(); 542 break; 543 } 544 545 addr = s->tx_descriptor[ring]; 546 547 while (descnt++ < IMX_MAX_DESC) { 548 IMXENETBufDesc bd; 549 int len; 550 551 imx_enet_read_bd(&bd, addr); 552 FEC_PRINTF("tx_bd %x flags %04x len %d data %08x option %04x " 553 "status %04x\n", addr, bd.flags, bd.length, bd.data, 554 bd.option, bd.status); 555 if ((bd.flags & ENET_BD_R) == 0) { 556 /* Run out of descriptors to transmit. */ 557 break; 558 } 559 len = bd.length; 560 if (frame_size + len > ENET_MAX_FRAME_SIZE) { 561 len = ENET_MAX_FRAME_SIZE - frame_size; 562 s->regs[ENET_EIR] |= ENET_INT_BABT; 563 } 564 dma_memory_read(&address_space_memory, bd.data, ptr, len); 565 ptr += len; 566 frame_size += len; 567 if (bd.flags & ENET_BD_L) { 568 if (bd.option & ENET_BD_PINS) { 569 struct ip_header *ip_hd = PKT_GET_IP_HDR(s->frame); 570 if (IP_HEADER_VERSION(ip_hd) == 4) { 571 net_checksum_calculate(s->frame, frame_size); 572 } 573 } 574 if (bd.option & ENET_BD_IINS) { 575 struct ip_header *ip_hd = PKT_GET_IP_HDR(s->frame); 576 /* We compute checksum only for IPv4 frames */ 577 if (IP_HEADER_VERSION(ip_hd) == 4) { 578 uint16_t csum; 579 ip_hd->ip_sum = 0; 580 csum = net_raw_checksum((uint8_t *)ip_hd, sizeof(*ip_hd)); 581 ip_hd->ip_sum = cpu_to_be16(csum); 582 } 583 } 584 /* Last buffer in frame. */ 585 586 qemu_send_packet(qemu_get_queue(s->nic), s->frame, frame_size); 587 ptr = s->frame; 588 589 frame_size = 0; 590 if (bd.option & ENET_BD_TX_INT) { 591 s->regs[ENET_EIR] |= int_txf; 592 } 593 } 594 if (bd.option & ENET_BD_TX_INT) { 595 s->regs[ENET_EIR] |= int_txb; 596 } 597 bd.flags &= ~ENET_BD_R; 598 /* Write back the modified descriptor. */ 599 imx_enet_write_bd(&bd, addr); 600 /* Advance to the next descriptor. */ 601 if ((bd.flags & ENET_BD_W) != 0) { 602 addr = s->regs[tdsr]; 603 } else { 604 addr += sizeof(bd); 605 } 606 } 607 608 s->tx_descriptor[ring] = addr; 609 610 imx_eth_update(s); 611 } 612 613 static void imx_eth_do_tx(IMXFECState *s, uint32_t index) 614 { 615 if (!s->is_fec && (s->regs[ENET_ECR] & ENET_ECR_EN1588)) { 616 imx_enet_do_tx(s, index); 617 } else { 618 imx_fec_do_tx(s); 619 } 620 } 621 622 static void imx_eth_enable_rx(IMXFECState *s, bool flush) 623 { 624 IMXFECBufDesc bd; 625 626 imx_fec_read_bd(&bd, s->rx_descriptor); 627 628 s->regs[ENET_RDAR] = (bd.flags & ENET_BD_E) ? ENET_RDAR_RDAR : 0; 629 630 if (!s->regs[ENET_RDAR]) { 631 FEC_PRINTF("RX buffer full\n"); 632 } else if (flush) { 633 qemu_flush_queued_packets(qemu_get_queue(s->nic)); 634 } 635 } 636 637 static void imx_eth_reset(DeviceState *d) 638 { 639 IMXFECState *s = IMX_FEC(d); 640 641 /* Reset the Device */ 642 memset(s->regs, 0, sizeof(s->regs)); 643 s->regs[ENET_ECR] = 0xf0000000; 644 s->regs[ENET_MIBC] = 0xc0000000; 645 s->regs[ENET_RCR] = 0x05ee0001; 646 s->regs[ENET_OPD] = 0x00010000; 647 648 s->regs[ENET_PALR] = (s->conf.macaddr.a[0] << 24) 649 | (s->conf.macaddr.a[1] << 16) 650 | (s->conf.macaddr.a[2] << 8) 651 | s->conf.macaddr.a[3]; 652 s->regs[ENET_PAUR] = (s->conf.macaddr.a[4] << 24) 653 | (s->conf.macaddr.a[5] << 16) 654 | 0x8808; 655 656 if (s->is_fec) { 657 s->regs[ENET_FRBR] = 0x00000600; 658 s->regs[ENET_FRSR] = 0x00000500; 659 s->regs[ENET_MIIGSK_ENR] = 0x00000006; 660 } else { 661 s->regs[ENET_RAEM] = 0x00000004; 662 s->regs[ENET_RAFL] = 0x00000004; 663 s->regs[ENET_TAEM] = 0x00000004; 664 s->regs[ENET_TAFL] = 0x00000008; 665 s->regs[ENET_TIPG] = 0x0000000c; 666 s->regs[ENET_FTRL] = 0x000007ff; 667 s->regs[ENET_ATPER] = 0x3b9aca00; 668 } 669 670 s->rx_descriptor = 0; 671 memset(s->tx_descriptor, 0, sizeof(s->tx_descriptor)); 672 673 /* We also reset the PHY */ 674 phy_reset(s); 675 } 676 677 static uint32_t imx_default_read(IMXFECState *s, uint32_t index) 678 { 679 qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Bad register at offset 0x%" 680 PRIx32 "\n", TYPE_IMX_FEC, __func__, index * 4); 681 return 0; 682 } 683 684 static uint32_t imx_fec_read(IMXFECState *s, uint32_t index) 685 { 686 switch (index) { 687 case ENET_FRBR: 688 case ENET_FRSR: 689 case ENET_MIIGSK_CFGR: 690 case ENET_MIIGSK_ENR: 691 return s->regs[index]; 692 default: 693 return imx_default_read(s, index); 694 } 695 } 696 697 static uint32_t imx_enet_read(IMXFECState *s, uint32_t index) 698 { 699 switch (index) { 700 case ENET_RSFL: 701 case ENET_RSEM: 702 case ENET_RAEM: 703 case ENET_RAFL: 704 case ENET_TSEM: 705 case ENET_TAEM: 706 case ENET_TAFL: 707 case ENET_TIPG: 708 case ENET_FTRL: 709 case ENET_TACC: 710 case ENET_RACC: 711 case ENET_ATCR: 712 case ENET_ATVR: 713 case ENET_ATOFF: 714 case ENET_ATPER: 715 case ENET_ATCOR: 716 case ENET_ATINC: 717 case ENET_ATSTMP: 718 case ENET_TGSR: 719 case ENET_TCSR0: 720 case ENET_TCCR0: 721 case ENET_TCSR1: 722 case ENET_TCCR1: 723 case ENET_TCSR2: 724 case ENET_TCCR2: 725 case ENET_TCSR3: 726 case ENET_TCCR3: 727 return s->regs[index]; 728 default: 729 return imx_default_read(s, index); 730 } 731 } 732 733 static uint64_t imx_eth_read(void *opaque, hwaddr offset, unsigned size) 734 { 735 uint32_t value = 0; 736 IMXFECState *s = IMX_FEC(opaque); 737 uint32_t index = offset >> 2; 738 739 switch (index) { 740 case ENET_EIR: 741 case ENET_EIMR: 742 case ENET_RDAR: 743 case ENET_TDAR: 744 case ENET_ECR: 745 case ENET_MMFR: 746 case ENET_MSCR: 747 case ENET_MIBC: 748 case ENET_RCR: 749 case ENET_TCR: 750 case ENET_PALR: 751 case ENET_PAUR: 752 case ENET_OPD: 753 case ENET_IAUR: 754 case ENET_IALR: 755 case ENET_GAUR: 756 case ENET_GALR: 757 case ENET_TFWR: 758 case ENET_RDSR: 759 case ENET_TDSR: 760 case ENET_MRBR: 761 value = s->regs[index]; 762 break; 763 default: 764 if (s->is_fec) { 765 value = imx_fec_read(s, index); 766 } else { 767 value = imx_enet_read(s, index); 768 } 769 break; 770 } 771 772 FEC_PRINTF("reg[%s] => 0x%" PRIx32 "\n", imx_eth_reg_name(s, index), 773 value); 774 775 return value; 776 } 777 778 static void imx_default_write(IMXFECState *s, uint32_t index, uint32_t value) 779 { 780 qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Bad address at offset 0x%" 781 PRIx32 "\n", TYPE_IMX_FEC, __func__, index * 4); 782 return; 783 } 784 785 static void imx_fec_write(IMXFECState *s, uint32_t index, uint32_t value) 786 { 787 switch (index) { 788 case ENET_FRBR: 789 /* FRBR is read only */ 790 qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Register FRBR is read only\n", 791 TYPE_IMX_FEC, __func__); 792 break; 793 case ENET_FRSR: 794 s->regs[index] = (value & 0x000003fc) | 0x00000400; 795 break; 796 case ENET_MIIGSK_CFGR: 797 s->regs[index] = value & 0x00000053; 798 break; 799 case ENET_MIIGSK_ENR: 800 s->regs[index] = (value & 0x00000002) ? 0x00000006 : 0; 801 break; 802 default: 803 imx_default_write(s, index, value); 804 break; 805 } 806 } 807 808 static void imx_enet_write(IMXFECState *s, uint32_t index, uint32_t value) 809 { 810 switch (index) { 811 case ENET_RSFL: 812 case ENET_RSEM: 813 case ENET_RAEM: 814 case ENET_RAFL: 815 case ENET_TSEM: 816 case ENET_TAEM: 817 case ENET_TAFL: 818 s->regs[index] = value & 0x000001ff; 819 break; 820 case ENET_TIPG: 821 s->regs[index] = value & 0x0000001f; 822 break; 823 case ENET_FTRL: 824 s->regs[index] = value & 0x00003fff; 825 break; 826 case ENET_TACC: 827 s->regs[index] = value & 0x00000019; 828 break; 829 case ENET_RACC: 830 s->regs[index] = value & 0x000000C7; 831 break; 832 case ENET_ATCR: 833 s->regs[index] = value & 0x00002a9d; 834 break; 835 case ENET_ATVR: 836 case ENET_ATOFF: 837 case ENET_ATPER: 838 s->regs[index] = value; 839 break; 840 case ENET_ATSTMP: 841 /* ATSTMP is read only */ 842 qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Register ATSTMP is read only\n", 843 TYPE_IMX_FEC, __func__); 844 break; 845 case ENET_ATCOR: 846 s->regs[index] = value & 0x7fffffff; 847 break; 848 case ENET_ATINC: 849 s->regs[index] = value & 0x00007f7f; 850 break; 851 case ENET_TGSR: 852 /* implement clear timer flag */ 853 value = value & 0x0000000f; 854 break; 855 case ENET_TCSR0: 856 case ENET_TCSR1: 857 case ENET_TCSR2: 858 case ENET_TCSR3: 859 value = value & 0x000000fd; 860 break; 861 case ENET_TCCR0: 862 case ENET_TCCR1: 863 case ENET_TCCR2: 864 case ENET_TCCR3: 865 s->regs[index] = value; 866 break; 867 default: 868 imx_default_write(s, index, value); 869 break; 870 } 871 } 872 873 static void imx_eth_write(void *opaque, hwaddr offset, uint64_t value, 874 unsigned size) 875 { 876 IMXFECState *s = IMX_FEC(opaque); 877 const bool single_tx_ring = !imx_eth_is_multi_tx_ring(s); 878 uint32_t index = offset >> 2; 879 880 FEC_PRINTF("reg[%s] <= 0x%" PRIx32 "\n", imx_eth_reg_name(s, index), 881 (uint32_t)value); 882 883 switch (index) { 884 case ENET_EIR: 885 s->regs[index] &= ~value; 886 break; 887 case ENET_EIMR: 888 s->regs[index] = value; 889 break; 890 case ENET_RDAR: 891 if (s->regs[ENET_ECR] & ENET_ECR_ETHEREN) { 892 if (!s->regs[index]) { 893 imx_eth_enable_rx(s, true); 894 } 895 } else { 896 s->regs[index] = 0; 897 } 898 break; 899 case ENET_TDAR1: /* FALLTHROUGH */ 900 case ENET_TDAR2: /* FALLTHROUGH */ 901 if (unlikely(single_tx_ring)) { 902 qemu_log_mask(LOG_GUEST_ERROR, 903 "[%s]%s: trying to access TDAR2 or TDAR1\n", 904 TYPE_IMX_FEC, __func__); 905 return; 906 } 907 case ENET_TDAR: /* FALLTHROUGH */ 908 if (s->regs[ENET_ECR] & ENET_ECR_ETHEREN) { 909 s->regs[index] = ENET_TDAR_TDAR; 910 imx_eth_do_tx(s, index); 911 } 912 s->regs[index] = 0; 913 break; 914 case ENET_ECR: 915 if (value & ENET_ECR_RESET) { 916 return imx_eth_reset(DEVICE(s)); 917 } 918 s->regs[index] = value; 919 if ((s->regs[index] & ENET_ECR_ETHEREN) == 0) { 920 s->regs[ENET_RDAR] = 0; 921 s->rx_descriptor = s->regs[ENET_RDSR]; 922 s->regs[ENET_TDAR] = 0; 923 s->regs[ENET_TDAR1] = 0; 924 s->regs[ENET_TDAR2] = 0; 925 s->tx_descriptor[0] = s->regs[ENET_TDSR]; 926 s->tx_descriptor[1] = s->regs[ENET_TDSR1]; 927 s->tx_descriptor[2] = s->regs[ENET_TDSR2]; 928 } 929 break; 930 case ENET_MMFR: 931 s->regs[index] = value; 932 if (extract32(value, 29, 1)) { 933 /* This is a read operation */ 934 s->regs[ENET_MMFR] = deposit32(s->regs[ENET_MMFR], 0, 16, 935 do_phy_read(s, 936 extract32(value, 937 18, 10))); 938 } else { 939 /* This a write operation */ 940 do_phy_write(s, extract32(value, 18, 10), extract32(value, 0, 16)); 941 } 942 /* raise the interrupt as the PHY operation is done */ 943 s->regs[ENET_EIR] |= ENET_INT_MII; 944 break; 945 case ENET_MSCR: 946 s->regs[index] = value & 0xfe; 947 break; 948 case ENET_MIBC: 949 /* TODO: Implement MIB. */ 950 s->regs[index] = (value & 0x80000000) ? 0xc0000000 : 0; 951 break; 952 case ENET_RCR: 953 s->regs[index] = value & 0x07ff003f; 954 /* TODO: Implement LOOP mode. */ 955 break; 956 case ENET_TCR: 957 /* We transmit immediately, so raise GRA immediately. */ 958 s->regs[index] = value; 959 if (value & 1) { 960 s->regs[ENET_EIR] |= ENET_INT_GRA; 961 } 962 break; 963 case ENET_PALR: 964 s->regs[index] = value; 965 s->conf.macaddr.a[0] = value >> 24; 966 s->conf.macaddr.a[1] = value >> 16; 967 s->conf.macaddr.a[2] = value >> 8; 968 s->conf.macaddr.a[3] = value; 969 break; 970 case ENET_PAUR: 971 s->regs[index] = (value | 0x0000ffff) & 0xffff8808; 972 s->conf.macaddr.a[4] = value >> 24; 973 s->conf.macaddr.a[5] = value >> 16; 974 break; 975 case ENET_OPD: 976 s->regs[index] = (value & 0x0000ffff) | 0x00010000; 977 break; 978 case ENET_IAUR: 979 case ENET_IALR: 980 case ENET_GAUR: 981 case ENET_GALR: 982 /* TODO: implement MAC hash filtering. */ 983 break; 984 case ENET_TFWR: 985 if (s->is_fec) { 986 s->regs[index] = value & 0x3; 987 } else { 988 s->regs[index] = value & 0x13f; 989 } 990 break; 991 case ENET_RDSR: 992 if (s->is_fec) { 993 s->regs[index] = value & ~3; 994 } else { 995 s->regs[index] = value & ~7; 996 } 997 s->rx_descriptor = s->regs[index]; 998 break; 999 case ENET_TDSR: 1000 if (s->is_fec) { 1001 s->regs[index] = value & ~3; 1002 } else { 1003 s->regs[index] = value & ~7; 1004 } 1005 s->tx_descriptor[0] = s->regs[index]; 1006 break; 1007 case ENET_TDSR1: 1008 if (unlikely(single_tx_ring)) { 1009 qemu_log_mask(LOG_GUEST_ERROR, 1010 "[%s]%s: trying to access TDSR1\n", 1011 TYPE_IMX_FEC, __func__); 1012 return; 1013 } 1014 1015 s->regs[index] = value & ~7; 1016 s->tx_descriptor[1] = s->regs[index]; 1017 break; 1018 case ENET_TDSR2: 1019 if (unlikely(single_tx_ring)) { 1020 qemu_log_mask(LOG_GUEST_ERROR, 1021 "[%s]%s: trying to access TDSR2\n", 1022 TYPE_IMX_FEC, __func__); 1023 return; 1024 } 1025 1026 s->regs[index] = value & ~7; 1027 s->tx_descriptor[2] = s->regs[index]; 1028 break; 1029 case ENET_MRBR: 1030 s->regs[index] = value & 0x00003ff0; 1031 break; 1032 default: 1033 if (s->is_fec) { 1034 imx_fec_write(s, index, value); 1035 } else { 1036 imx_enet_write(s, index, value); 1037 } 1038 return; 1039 } 1040 1041 imx_eth_update(s); 1042 } 1043 1044 static int imx_eth_can_receive(NetClientState *nc) 1045 { 1046 IMXFECState *s = IMX_FEC(qemu_get_nic_opaque(nc)); 1047 1048 FEC_PRINTF("\n"); 1049 1050 return !!s->regs[ENET_RDAR]; 1051 } 1052 1053 static ssize_t imx_fec_receive(NetClientState *nc, const uint8_t *buf, 1054 size_t len) 1055 { 1056 IMXFECState *s = IMX_FEC(qemu_get_nic_opaque(nc)); 1057 IMXFECBufDesc bd; 1058 uint32_t flags = 0; 1059 uint32_t addr; 1060 uint32_t crc; 1061 uint32_t buf_addr; 1062 uint8_t *crc_ptr; 1063 unsigned int buf_len; 1064 size_t size = len; 1065 1066 FEC_PRINTF("len %d\n", (int)size); 1067 1068 if (!s->regs[ENET_RDAR]) { 1069 qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Unexpected packet\n", 1070 TYPE_IMX_FEC, __func__); 1071 return 0; 1072 } 1073 1074 /* 4 bytes for the CRC. */ 1075 size += 4; 1076 crc = cpu_to_be32(crc32(~0, buf, size)); 1077 crc_ptr = (uint8_t *) &crc; 1078 1079 /* Huge frames are truncated. */ 1080 if (size > ENET_MAX_FRAME_SIZE) { 1081 size = ENET_MAX_FRAME_SIZE; 1082 flags |= ENET_BD_TR | ENET_BD_LG; 1083 } 1084 1085 /* Frames larger than the user limit just set error flags. */ 1086 if (size > (s->regs[ENET_RCR] >> 16)) { 1087 flags |= ENET_BD_LG; 1088 } 1089 1090 addr = s->rx_descriptor; 1091 while (size > 0) { 1092 imx_fec_read_bd(&bd, addr); 1093 if ((bd.flags & ENET_BD_E) == 0) { 1094 /* No descriptors available. Bail out. */ 1095 /* 1096 * FIXME: This is wrong. We should probably either 1097 * save the remainder for when more RX buffers are 1098 * available, or flag an error. 1099 */ 1100 qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Lost end of frame\n", 1101 TYPE_IMX_FEC, __func__); 1102 break; 1103 } 1104 buf_len = (size <= s->regs[ENET_MRBR]) ? size : s->regs[ENET_MRBR]; 1105 bd.length = buf_len; 1106 size -= buf_len; 1107 1108 FEC_PRINTF("rx_bd 0x%x length %d\n", addr, bd.length); 1109 1110 /* The last 4 bytes are the CRC. */ 1111 if (size < 4) { 1112 buf_len += size - 4; 1113 } 1114 buf_addr = bd.data; 1115 dma_memory_write(&address_space_memory, buf_addr, buf, buf_len); 1116 buf += buf_len; 1117 if (size < 4) { 1118 dma_memory_write(&address_space_memory, buf_addr + buf_len, 1119 crc_ptr, 4 - size); 1120 crc_ptr += 4 - size; 1121 } 1122 bd.flags &= ~ENET_BD_E; 1123 if (size == 0) { 1124 /* Last buffer in frame. */ 1125 bd.flags |= flags | ENET_BD_L; 1126 FEC_PRINTF("rx frame flags %04x\n", bd.flags); 1127 s->regs[ENET_EIR] |= ENET_INT_RXF; 1128 } else { 1129 s->regs[ENET_EIR] |= ENET_INT_RXB; 1130 } 1131 imx_fec_write_bd(&bd, addr); 1132 /* Advance to the next descriptor. */ 1133 if ((bd.flags & ENET_BD_W) != 0) { 1134 addr = s->regs[ENET_RDSR]; 1135 } else { 1136 addr += sizeof(bd); 1137 } 1138 } 1139 s->rx_descriptor = addr; 1140 imx_eth_enable_rx(s, false); 1141 imx_eth_update(s); 1142 return len; 1143 } 1144 1145 static ssize_t imx_enet_receive(NetClientState *nc, const uint8_t *buf, 1146 size_t len) 1147 { 1148 IMXFECState *s = IMX_FEC(qemu_get_nic_opaque(nc)); 1149 IMXENETBufDesc bd; 1150 uint32_t flags = 0; 1151 uint32_t addr; 1152 uint32_t crc; 1153 uint32_t buf_addr; 1154 uint8_t *crc_ptr; 1155 unsigned int buf_len; 1156 size_t size = len; 1157 bool shift16 = s->regs[ENET_RACC] & ENET_RACC_SHIFT16; 1158 1159 FEC_PRINTF("len %d\n", (int)size); 1160 1161 if (!s->regs[ENET_RDAR]) { 1162 qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Unexpected packet\n", 1163 TYPE_IMX_FEC, __func__); 1164 return 0; 1165 } 1166 1167 /* 4 bytes for the CRC. */ 1168 size += 4; 1169 crc = cpu_to_be32(crc32(~0, buf, size)); 1170 crc_ptr = (uint8_t *) &crc; 1171 1172 if (shift16) { 1173 size += 2; 1174 } 1175 1176 /* Huge frames are truncated. */ 1177 if (size > s->regs[ENET_FTRL]) { 1178 size = s->regs[ENET_FTRL]; 1179 flags |= ENET_BD_TR | ENET_BD_LG; 1180 } 1181 1182 /* Frames larger than the user limit just set error flags. */ 1183 if (size > (s->regs[ENET_RCR] >> 16)) { 1184 flags |= ENET_BD_LG; 1185 } 1186 1187 addr = s->rx_descriptor; 1188 while (size > 0) { 1189 imx_enet_read_bd(&bd, addr); 1190 if ((bd.flags & ENET_BD_E) == 0) { 1191 /* No descriptors available. Bail out. */ 1192 /* 1193 * FIXME: This is wrong. We should probably either 1194 * save the remainder for when more RX buffers are 1195 * available, or flag an error. 1196 */ 1197 qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Lost end of frame\n", 1198 TYPE_IMX_FEC, __func__); 1199 break; 1200 } 1201 buf_len = MIN(size, s->regs[ENET_MRBR]); 1202 bd.length = buf_len; 1203 size -= buf_len; 1204 1205 FEC_PRINTF("rx_bd 0x%x length %d\n", addr, bd.length); 1206 1207 /* The last 4 bytes are the CRC. */ 1208 if (size < 4) { 1209 buf_len += size - 4; 1210 } 1211 buf_addr = bd.data; 1212 1213 if (shift16) { 1214 /* 1215 * If SHIFT16 bit of ENETx_RACC register is set we need to 1216 * align the payload to 4-byte boundary. 1217 */ 1218 const uint8_t zeros[2] = { 0 }; 1219 1220 dma_memory_write(&address_space_memory, buf_addr, 1221 zeros, sizeof(zeros)); 1222 1223 buf_addr += sizeof(zeros); 1224 buf_len -= sizeof(zeros); 1225 1226 /* We only do this once per Ethernet frame */ 1227 shift16 = false; 1228 } 1229 1230 dma_memory_write(&address_space_memory, buf_addr, buf, buf_len); 1231 buf += buf_len; 1232 if (size < 4) { 1233 dma_memory_write(&address_space_memory, buf_addr + buf_len, 1234 crc_ptr, 4 - size); 1235 crc_ptr += 4 - size; 1236 } 1237 bd.flags &= ~ENET_BD_E; 1238 if (size == 0) { 1239 /* Last buffer in frame. */ 1240 bd.flags |= flags | ENET_BD_L; 1241 FEC_PRINTF("rx frame flags %04x\n", bd.flags); 1242 if (bd.option & ENET_BD_RX_INT) { 1243 s->regs[ENET_EIR] |= ENET_INT_RXF; 1244 } 1245 } else { 1246 if (bd.option & ENET_BD_RX_INT) { 1247 s->regs[ENET_EIR] |= ENET_INT_RXB; 1248 } 1249 } 1250 imx_enet_write_bd(&bd, addr); 1251 /* Advance to the next descriptor. */ 1252 if ((bd.flags & ENET_BD_W) != 0) { 1253 addr = s->regs[ENET_RDSR]; 1254 } else { 1255 addr += sizeof(bd); 1256 } 1257 } 1258 s->rx_descriptor = addr; 1259 imx_eth_enable_rx(s, false); 1260 imx_eth_update(s); 1261 return len; 1262 } 1263 1264 static ssize_t imx_eth_receive(NetClientState *nc, const uint8_t *buf, 1265 size_t len) 1266 { 1267 IMXFECState *s = IMX_FEC(qemu_get_nic_opaque(nc)); 1268 1269 if (!s->is_fec && (s->regs[ENET_ECR] & ENET_ECR_EN1588)) { 1270 return imx_enet_receive(nc, buf, len); 1271 } else { 1272 return imx_fec_receive(nc, buf, len); 1273 } 1274 } 1275 1276 static const MemoryRegionOps imx_eth_ops = { 1277 .read = imx_eth_read, 1278 .write = imx_eth_write, 1279 .valid.min_access_size = 4, 1280 .valid.max_access_size = 4, 1281 .endianness = DEVICE_NATIVE_ENDIAN, 1282 }; 1283 1284 static void imx_eth_cleanup(NetClientState *nc) 1285 { 1286 IMXFECState *s = IMX_FEC(qemu_get_nic_opaque(nc)); 1287 1288 s->nic = NULL; 1289 } 1290 1291 static NetClientInfo imx_eth_net_info = { 1292 .type = NET_CLIENT_DRIVER_NIC, 1293 .size = sizeof(NICState), 1294 .can_receive = imx_eth_can_receive, 1295 .receive = imx_eth_receive, 1296 .cleanup = imx_eth_cleanup, 1297 .link_status_changed = imx_eth_set_link, 1298 }; 1299 1300 1301 static void imx_eth_realize(DeviceState *dev, Error **errp) 1302 { 1303 IMXFECState *s = IMX_FEC(dev); 1304 SysBusDevice *sbd = SYS_BUS_DEVICE(dev); 1305 1306 memory_region_init_io(&s->iomem, OBJECT(dev), &imx_eth_ops, s, 1307 TYPE_IMX_FEC, FSL_IMX25_FEC_SIZE); 1308 sysbus_init_mmio(sbd, &s->iomem); 1309 sysbus_init_irq(sbd, &s->irq[0]); 1310 sysbus_init_irq(sbd, &s->irq[1]); 1311 1312 qemu_macaddr_default_if_unset(&s->conf.macaddr); 1313 1314 s->nic = qemu_new_nic(&imx_eth_net_info, &s->conf, 1315 object_get_typename(OBJECT(dev)), 1316 DEVICE(dev)->id, s); 1317 1318 qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a); 1319 } 1320 1321 static Property imx_eth_properties[] = { 1322 DEFINE_NIC_PROPERTIES(IMXFECState, conf), 1323 DEFINE_PROP_UINT32("tx-ring-num", IMXFECState, tx_ring_num, 1), 1324 DEFINE_PROP_END_OF_LIST(), 1325 }; 1326 1327 static void imx_eth_class_init(ObjectClass *klass, void *data) 1328 { 1329 DeviceClass *dc = DEVICE_CLASS(klass); 1330 1331 dc->vmsd = &vmstate_imx_eth; 1332 dc->reset = imx_eth_reset; 1333 dc->props = imx_eth_properties; 1334 dc->realize = imx_eth_realize; 1335 dc->desc = "i.MX FEC/ENET Ethernet Controller"; 1336 } 1337 1338 static void imx_fec_init(Object *obj) 1339 { 1340 IMXFECState *s = IMX_FEC(obj); 1341 1342 s->is_fec = true; 1343 } 1344 1345 static void imx_enet_init(Object *obj) 1346 { 1347 IMXFECState *s = IMX_FEC(obj); 1348 1349 s->is_fec = false; 1350 } 1351 1352 static const TypeInfo imx_fec_info = { 1353 .name = TYPE_IMX_FEC, 1354 .parent = TYPE_SYS_BUS_DEVICE, 1355 .instance_size = sizeof(IMXFECState), 1356 .instance_init = imx_fec_init, 1357 .class_init = imx_eth_class_init, 1358 }; 1359 1360 static const TypeInfo imx_enet_info = { 1361 .name = TYPE_IMX_ENET, 1362 .parent = TYPE_IMX_FEC, 1363 .instance_init = imx_enet_init, 1364 }; 1365 1366 static void imx_eth_register_types(void) 1367 { 1368 type_register_static(&imx_fec_info); 1369 type_register_static(&imx_enet_info); 1370 } 1371 1372 type_init(imx_eth_register_types) 1373