1 /* 2 * i.MX Fast Ethernet Controller emulation. 3 * 4 * Copyright (c) 2013 Jean-Christophe Dubois. <jcd@tribudubois.net> 5 * 6 * Based on Coldfire Fast Ethernet Controller emulation. 7 * 8 * Copyright (c) 2007 CodeSourcery. 9 * 10 * This program is free software; you can redistribute it and/or modify it 11 * under the terms of the GNU General Public License as published by the 12 * Free Software Foundation; either version 2 of the License, or 13 * (at your option) any later version. 14 * 15 * This program is distributed in the hope that it will be useful, but WITHOUT 16 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 17 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License 18 * for more details. 19 * 20 * You should have received a copy of the GNU General Public License along 21 * with this program; if not, see <http://www.gnu.org/licenses/>. 22 */ 23 24 #include "qemu/osdep.h" 25 #include "hw/irq.h" 26 #include "hw/net/imx_fec.h" 27 #include "hw/qdev-properties.h" 28 #include "migration/vmstate.h" 29 #include "sysemu/dma.h" 30 #include "qemu/log.h" 31 #include "qemu/module.h" 32 #include "net/checksum.h" 33 #include "net/eth.h" 34 #include "trace.h" 35 36 /* For crc32 */ 37 #include <zlib.h> 38 39 #define IMX_MAX_DESC 1024 40 41 static const char *imx_default_reg_name(IMXFECState *s, uint32_t index) 42 { 43 static char tmp[20]; 44 sprintf(tmp, "index %d", index); 45 return tmp; 46 } 47 48 static const char *imx_fec_reg_name(IMXFECState *s, uint32_t index) 49 { 50 switch (index) { 51 case ENET_FRBR: 52 return "FRBR"; 53 case ENET_FRSR: 54 return "FRSR"; 55 case ENET_MIIGSK_CFGR: 56 return "MIIGSK_CFGR"; 57 case ENET_MIIGSK_ENR: 58 return "MIIGSK_ENR"; 59 default: 60 return imx_default_reg_name(s, index); 61 } 62 } 63 64 static const char *imx_enet_reg_name(IMXFECState *s, uint32_t index) 65 { 66 switch (index) { 67 case ENET_RSFL: 68 return "RSFL"; 69 case ENET_RSEM: 70 return "RSEM"; 71 case ENET_RAEM: 72 return "RAEM"; 73 case ENET_RAFL: 74 return "RAFL"; 75 case ENET_TSEM: 76 return "TSEM"; 77 case ENET_TAEM: 78 return "TAEM"; 79 case ENET_TAFL: 80 return "TAFL"; 81 case ENET_TIPG: 82 return "TIPG"; 83 case ENET_FTRL: 84 return "FTRL"; 85 case ENET_TACC: 86 return "TACC"; 87 case ENET_RACC: 88 return "RACC"; 89 case ENET_ATCR: 90 return "ATCR"; 91 case ENET_ATVR: 92 return "ATVR"; 93 case ENET_ATOFF: 94 return "ATOFF"; 95 case ENET_ATPER: 96 return "ATPER"; 97 case ENET_ATCOR: 98 return "ATCOR"; 99 case ENET_ATINC: 100 return "ATINC"; 101 case ENET_ATSTMP: 102 return "ATSTMP"; 103 case ENET_TGSR: 104 return "TGSR"; 105 case ENET_TCSR0: 106 return "TCSR0"; 107 case ENET_TCCR0: 108 return "TCCR0"; 109 case ENET_TCSR1: 110 return "TCSR1"; 111 case ENET_TCCR1: 112 return "TCCR1"; 113 case ENET_TCSR2: 114 return "TCSR2"; 115 case ENET_TCCR2: 116 return "TCCR2"; 117 case ENET_TCSR3: 118 return "TCSR3"; 119 case ENET_TCCR3: 120 return "TCCR3"; 121 default: 122 return imx_default_reg_name(s, index); 123 } 124 } 125 126 static const char *imx_eth_reg_name(IMXFECState *s, uint32_t index) 127 { 128 switch (index) { 129 case ENET_EIR: 130 return "EIR"; 131 case ENET_EIMR: 132 return "EIMR"; 133 case ENET_RDAR: 134 return "RDAR"; 135 case ENET_TDAR: 136 return "TDAR"; 137 case ENET_ECR: 138 return "ECR"; 139 case ENET_MMFR: 140 return "MMFR"; 141 case ENET_MSCR: 142 return "MSCR"; 143 case ENET_MIBC: 144 return "MIBC"; 145 case ENET_RCR: 146 return "RCR"; 147 case ENET_TCR: 148 return "TCR"; 149 case ENET_PALR: 150 return "PALR"; 151 case ENET_PAUR: 152 return "PAUR"; 153 case ENET_OPD: 154 return "OPD"; 155 case ENET_IAUR: 156 return "IAUR"; 157 case ENET_IALR: 158 return "IALR"; 159 case ENET_GAUR: 160 return "GAUR"; 161 case ENET_GALR: 162 return "GALR"; 163 case ENET_TFWR: 164 return "TFWR"; 165 case ENET_RDSR: 166 return "RDSR"; 167 case ENET_TDSR: 168 return "TDSR"; 169 case ENET_MRBR: 170 return "MRBR"; 171 default: 172 if (s->is_fec) { 173 return imx_fec_reg_name(s, index); 174 } else { 175 return imx_enet_reg_name(s, index); 176 } 177 } 178 } 179 180 /* 181 * Versions of this device with more than one TX descriptor save the 182 * 2nd and 3rd descriptors in a subsection, to maintain migration 183 * compatibility with previous versions of the device that only 184 * supported a single descriptor. 185 */ 186 static bool imx_eth_is_multi_tx_ring(void *opaque) 187 { 188 IMXFECState *s = IMX_FEC(opaque); 189 190 return s->tx_ring_num > 1; 191 } 192 193 static const VMStateDescription vmstate_imx_eth_txdescs = { 194 .name = "imx.fec/txdescs", 195 .version_id = 1, 196 .minimum_version_id = 1, 197 .needed = imx_eth_is_multi_tx_ring, 198 .fields = (VMStateField[]) { 199 VMSTATE_UINT32(tx_descriptor[1], IMXFECState), 200 VMSTATE_UINT32(tx_descriptor[2], IMXFECState), 201 VMSTATE_END_OF_LIST() 202 } 203 }; 204 205 static const VMStateDescription vmstate_imx_eth = { 206 .name = TYPE_IMX_FEC, 207 .version_id = 2, 208 .minimum_version_id = 2, 209 .fields = (VMStateField[]) { 210 VMSTATE_UINT32_ARRAY(regs, IMXFECState, ENET_MAX), 211 VMSTATE_UINT32(rx_descriptor, IMXFECState), 212 VMSTATE_UINT32(tx_descriptor[0], IMXFECState), 213 VMSTATE_UINT32(phy_status, IMXFECState), 214 VMSTATE_UINT32(phy_control, IMXFECState), 215 VMSTATE_UINT32(phy_advertise, IMXFECState), 216 VMSTATE_UINT32(phy_int, IMXFECState), 217 VMSTATE_UINT32(phy_int_mask, IMXFECState), 218 VMSTATE_END_OF_LIST() 219 }, 220 .subsections = (const VMStateDescription * []) { 221 &vmstate_imx_eth_txdescs, 222 NULL 223 }, 224 }; 225 226 #define PHY_INT_ENERGYON (1 << 7) 227 #define PHY_INT_AUTONEG_COMPLETE (1 << 6) 228 #define PHY_INT_FAULT (1 << 5) 229 #define PHY_INT_DOWN (1 << 4) 230 #define PHY_INT_AUTONEG_LP (1 << 3) 231 #define PHY_INT_PARFAULT (1 << 2) 232 #define PHY_INT_AUTONEG_PAGE (1 << 1) 233 234 static void imx_eth_update(IMXFECState *s); 235 236 /* 237 * The MII phy could raise a GPIO to the processor which in turn 238 * could be handled as an interrpt by the OS. 239 * For now we don't handle any GPIO/interrupt line, so the OS will 240 * have to poll for the PHY status. 241 */ 242 static void imx_phy_update_irq(IMXFECState *s) 243 { 244 imx_eth_update(s); 245 } 246 247 static void imx_phy_update_link(IMXFECState *s) 248 { 249 /* Autonegotiation status mirrors link status. */ 250 if (qemu_get_queue(s->nic)->link_down) { 251 trace_imx_phy_update_link("down"); 252 s->phy_status &= ~0x0024; 253 s->phy_int |= PHY_INT_DOWN; 254 } else { 255 trace_imx_phy_update_link("up"); 256 s->phy_status |= 0x0024; 257 s->phy_int |= PHY_INT_ENERGYON; 258 s->phy_int |= PHY_INT_AUTONEG_COMPLETE; 259 } 260 imx_phy_update_irq(s); 261 } 262 263 static void imx_eth_set_link(NetClientState *nc) 264 { 265 imx_phy_update_link(IMX_FEC(qemu_get_nic_opaque(nc))); 266 } 267 268 static void imx_phy_reset(IMXFECState *s) 269 { 270 trace_imx_phy_reset(); 271 272 s->phy_status = 0x7809; 273 s->phy_control = 0x3000; 274 s->phy_advertise = 0x01e1; 275 s->phy_int_mask = 0; 276 s->phy_int = 0; 277 imx_phy_update_link(s); 278 } 279 280 static uint32_t imx_phy_read(IMXFECState *s, int reg) 281 { 282 uint32_t val; 283 284 if (reg > 31) { 285 /* we only advertise one phy */ 286 return 0; 287 } 288 289 switch (reg) { 290 case 0: /* Basic Control */ 291 val = s->phy_control; 292 break; 293 case 1: /* Basic Status */ 294 val = s->phy_status; 295 break; 296 case 2: /* ID1 */ 297 val = 0x0007; 298 break; 299 case 3: /* ID2 */ 300 val = 0xc0d1; 301 break; 302 case 4: /* Auto-neg advertisement */ 303 val = s->phy_advertise; 304 break; 305 case 5: /* Auto-neg Link Partner Ability */ 306 val = 0x0f71; 307 break; 308 case 6: /* Auto-neg Expansion */ 309 val = 1; 310 break; 311 case 29: /* Interrupt source. */ 312 val = s->phy_int; 313 s->phy_int = 0; 314 imx_phy_update_irq(s); 315 break; 316 case 30: /* Interrupt mask */ 317 val = s->phy_int_mask; 318 break; 319 case 17: 320 case 18: 321 case 27: 322 case 31: 323 qemu_log_mask(LOG_UNIMP, "[%s.phy]%s: reg %d not implemented\n", 324 TYPE_IMX_FEC, __func__, reg); 325 val = 0; 326 break; 327 default: 328 qemu_log_mask(LOG_GUEST_ERROR, "[%s.phy]%s: Bad address at offset %d\n", 329 TYPE_IMX_FEC, __func__, reg); 330 val = 0; 331 break; 332 } 333 334 trace_imx_phy_read(val, reg); 335 336 return val; 337 } 338 339 static void imx_phy_write(IMXFECState *s, int reg, uint32_t val) 340 { 341 trace_imx_phy_write(val, reg); 342 343 if (reg > 31) { 344 /* we only advertise one phy */ 345 return; 346 } 347 348 switch (reg) { 349 case 0: /* Basic Control */ 350 if (val & 0x8000) { 351 imx_phy_reset(s); 352 } else { 353 s->phy_control = val & 0x7980; 354 /* Complete autonegotiation immediately. */ 355 if (val & 0x1000) { 356 s->phy_status |= 0x0020; 357 } 358 } 359 break; 360 case 4: /* Auto-neg advertisement */ 361 s->phy_advertise = (val & 0x2d7f) | 0x80; 362 break; 363 case 30: /* Interrupt mask */ 364 s->phy_int_mask = val & 0xff; 365 imx_phy_update_irq(s); 366 break; 367 case 17: 368 case 18: 369 case 27: 370 case 31: 371 qemu_log_mask(LOG_UNIMP, "[%s.phy)%s: reg %d not implemented\n", 372 TYPE_IMX_FEC, __func__, reg); 373 break; 374 default: 375 qemu_log_mask(LOG_GUEST_ERROR, "[%s.phy]%s: Bad address at offset %d\n", 376 TYPE_IMX_FEC, __func__, reg); 377 break; 378 } 379 } 380 381 static void imx_fec_read_bd(IMXFECBufDesc *bd, dma_addr_t addr) 382 { 383 dma_memory_read(&address_space_memory, addr, bd, sizeof(*bd)); 384 385 trace_imx_fec_read_bd(addr, bd->flags, bd->length, bd->data); 386 } 387 388 static void imx_fec_write_bd(IMXFECBufDesc *bd, dma_addr_t addr) 389 { 390 dma_memory_write(&address_space_memory, addr, bd, sizeof(*bd)); 391 } 392 393 static void imx_enet_read_bd(IMXENETBufDesc *bd, dma_addr_t addr) 394 { 395 dma_memory_read(&address_space_memory, addr, bd, sizeof(*bd)); 396 397 trace_imx_enet_read_bd(addr, bd->flags, bd->length, bd->data, 398 bd->option, bd->status); 399 } 400 401 static void imx_enet_write_bd(IMXENETBufDesc *bd, dma_addr_t addr) 402 { 403 dma_memory_write(&address_space_memory, addr, bd, sizeof(*bd)); 404 } 405 406 static void imx_eth_update(IMXFECState *s) 407 { 408 /* 409 * Previous versions of qemu had the ENET_INT_MAC and ENET_INT_TS_TIMER 410 * interrupts swapped. This worked with older versions of Linux (4.14 411 * and older) since Linux associated both interrupt lines with Ethernet 412 * MAC interrupts. Specifically, 413 * - Linux 4.15 and later have separate interrupt handlers for the MAC and 414 * timer interrupts. Those versions of Linux fail with versions of QEMU 415 * with swapped interrupt assignments. 416 * - In linux 4.14, both interrupt lines were registered with the Ethernet 417 * MAC interrupt handler. As a result, all versions of qemu happen to 418 * work, though that is accidental. 419 * - In Linux 4.9 and older, the timer interrupt was registered directly 420 * with the Ethernet MAC interrupt handler. The MAC interrupt was 421 * redirected to a GPIO interrupt to work around erratum ERR006687. 422 * This was implemented using the SOC's IOMUX block. In qemu, this GPIO 423 * interrupt never fired since IOMUX is currently not supported in qemu. 424 * Linux instead received MAC interrupts on the timer interrupt. 425 * As a result, qemu versions with the swapped interrupt assignment work, 426 * albeit accidentally, but qemu versions with the correct interrupt 427 * assignment fail. 428 * 429 * To ensure that all versions of Linux work, generate ENET_INT_MAC 430 * interrrupts on both interrupt lines. This should be changed if and when 431 * qemu supports IOMUX. 432 */ 433 if (s->regs[ENET_EIR] & s->regs[ENET_EIMR] & 434 (ENET_INT_MAC | ENET_INT_TS_TIMER)) { 435 qemu_set_irq(s->irq[1], 1); 436 } else { 437 qemu_set_irq(s->irq[1], 0); 438 } 439 440 if (s->regs[ENET_EIR] & s->regs[ENET_EIMR] & ENET_INT_MAC) { 441 qemu_set_irq(s->irq[0], 1); 442 } else { 443 qemu_set_irq(s->irq[0], 0); 444 } 445 } 446 447 static void imx_fec_do_tx(IMXFECState *s) 448 { 449 int frame_size = 0, descnt = 0; 450 uint8_t *ptr = s->frame; 451 uint32_t addr = s->tx_descriptor[0]; 452 453 while (descnt++ < IMX_MAX_DESC) { 454 IMXFECBufDesc bd; 455 int len; 456 457 imx_fec_read_bd(&bd, addr); 458 if ((bd.flags & ENET_BD_R) == 0) { 459 460 /* Run out of descriptors to transmit. */ 461 trace_imx_eth_tx_bd_busy(); 462 463 break; 464 } 465 len = bd.length; 466 if (frame_size + len > ENET_MAX_FRAME_SIZE) { 467 len = ENET_MAX_FRAME_SIZE - frame_size; 468 s->regs[ENET_EIR] |= ENET_INT_BABT; 469 } 470 dma_memory_read(&address_space_memory, bd.data, ptr, len); 471 ptr += len; 472 frame_size += len; 473 if (bd.flags & ENET_BD_L) { 474 /* Last buffer in frame. */ 475 qemu_send_packet(qemu_get_queue(s->nic), s->frame, frame_size); 476 ptr = s->frame; 477 frame_size = 0; 478 s->regs[ENET_EIR] |= ENET_INT_TXF; 479 } 480 s->regs[ENET_EIR] |= ENET_INT_TXB; 481 bd.flags &= ~ENET_BD_R; 482 /* Write back the modified descriptor. */ 483 imx_fec_write_bd(&bd, addr); 484 /* Advance to the next descriptor. */ 485 if ((bd.flags & ENET_BD_W) != 0) { 486 addr = s->regs[ENET_TDSR]; 487 } else { 488 addr += sizeof(bd); 489 } 490 } 491 492 s->tx_descriptor[0] = addr; 493 494 imx_eth_update(s); 495 } 496 497 static void imx_enet_do_tx(IMXFECState *s, uint32_t index) 498 { 499 int frame_size = 0, descnt = 0; 500 501 uint8_t *ptr = s->frame; 502 uint32_t addr, int_txb, int_txf, tdsr; 503 size_t ring; 504 505 switch (index) { 506 case ENET_TDAR: 507 ring = 0; 508 int_txb = ENET_INT_TXB; 509 int_txf = ENET_INT_TXF; 510 tdsr = ENET_TDSR; 511 break; 512 case ENET_TDAR1: 513 ring = 1; 514 int_txb = ENET_INT_TXB1; 515 int_txf = ENET_INT_TXF1; 516 tdsr = ENET_TDSR1; 517 break; 518 case ENET_TDAR2: 519 ring = 2; 520 int_txb = ENET_INT_TXB2; 521 int_txf = ENET_INT_TXF2; 522 tdsr = ENET_TDSR2; 523 break; 524 default: 525 qemu_log_mask(LOG_GUEST_ERROR, 526 "%s: bogus value for index %x\n", 527 __func__, index); 528 abort(); 529 break; 530 } 531 532 addr = s->tx_descriptor[ring]; 533 534 while (descnt++ < IMX_MAX_DESC) { 535 IMXENETBufDesc bd; 536 int len; 537 538 imx_enet_read_bd(&bd, addr); 539 if ((bd.flags & ENET_BD_R) == 0) { 540 /* Run out of descriptors to transmit. */ 541 542 trace_imx_eth_tx_bd_busy(); 543 544 break; 545 } 546 len = bd.length; 547 if (frame_size + len > ENET_MAX_FRAME_SIZE) { 548 len = ENET_MAX_FRAME_SIZE - frame_size; 549 s->regs[ENET_EIR] |= ENET_INT_BABT; 550 } 551 dma_memory_read(&address_space_memory, bd.data, ptr, len); 552 ptr += len; 553 frame_size += len; 554 if (bd.flags & ENET_BD_L) { 555 if (bd.option & ENET_BD_PINS) { 556 struct ip_header *ip_hd = PKT_GET_IP_HDR(s->frame); 557 if (IP_HEADER_VERSION(ip_hd) == 4) { 558 net_checksum_calculate(s->frame, frame_size); 559 } 560 } 561 if (bd.option & ENET_BD_IINS) { 562 struct ip_header *ip_hd = PKT_GET_IP_HDR(s->frame); 563 /* We compute checksum only for IPv4 frames */ 564 if (IP_HEADER_VERSION(ip_hd) == 4) { 565 uint16_t csum; 566 ip_hd->ip_sum = 0; 567 csum = net_raw_checksum((uint8_t *)ip_hd, sizeof(*ip_hd)); 568 ip_hd->ip_sum = cpu_to_be16(csum); 569 } 570 } 571 /* Last buffer in frame. */ 572 573 qemu_send_packet(qemu_get_queue(s->nic), s->frame, frame_size); 574 ptr = s->frame; 575 576 frame_size = 0; 577 if (bd.option & ENET_BD_TX_INT) { 578 s->regs[ENET_EIR] |= int_txf; 579 } 580 /* Indicate that we've updated the last buffer descriptor. */ 581 bd.last_buffer = ENET_BD_BDU; 582 } 583 if (bd.option & ENET_BD_TX_INT) { 584 s->regs[ENET_EIR] |= int_txb; 585 } 586 bd.flags &= ~ENET_BD_R; 587 /* Write back the modified descriptor. */ 588 imx_enet_write_bd(&bd, addr); 589 /* Advance to the next descriptor. */ 590 if ((bd.flags & ENET_BD_W) != 0) { 591 addr = s->regs[tdsr]; 592 } else { 593 addr += sizeof(bd); 594 } 595 } 596 597 s->tx_descriptor[ring] = addr; 598 599 imx_eth_update(s); 600 } 601 602 static void imx_eth_do_tx(IMXFECState *s, uint32_t index) 603 { 604 if (!s->is_fec && (s->regs[ENET_ECR] & ENET_ECR_EN1588)) { 605 imx_enet_do_tx(s, index); 606 } else { 607 imx_fec_do_tx(s); 608 } 609 } 610 611 static void imx_eth_enable_rx(IMXFECState *s, bool flush) 612 { 613 IMXFECBufDesc bd; 614 615 imx_fec_read_bd(&bd, s->rx_descriptor); 616 617 s->regs[ENET_RDAR] = (bd.flags & ENET_BD_E) ? ENET_RDAR_RDAR : 0; 618 619 if (!s->regs[ENET_RDAR]) { 620 trace_imx_eth_rx_bd_full(); 621 } else if (flush) { 622 qemu_flush_queued_packets(qemu_get_queue(s->nic)); 623 } 624 } 625 626 static void imx_eth_reset(DeviceState *d) 627 { 628 IMXFECState *s = IMX_FEC(d); 629 630 /* Reset the Device */ 631 memset(s->regs, 0, sizeof(s->regs)); 632 s->regs[ENET_ECR] = 0xf0000000; 633 s->regs[ENET_MIBC] = 0xc0000000; 634 s->regs[ENET_RCR] = 0x05ee0001; 635 s->regs[ENET_OPD] = 0x00010000; 636 637 s->regs[ENET_PALR] = (s->conf.macaddr.a[0] << 24) 638 | (s->conf.macaddr.a[1] << 16) 639 | (s->conf.macaddr.a[2] << 8) 640 | s->conf.macaddr.a[3]; 641 s->regs[ENET_PAUR] = (s->conf.macaddr.a[4] << 24) 642 | (s->conf.macaddr.a[5] << 16) 643 | 0x8808; 644 645 if (s->is_fec) { 646 s->regs[ENET_FRBR] = 0x00000600; 647 s->regs[ENET_FRSR] = 0x00000500; 648 s->regs[ENET_MIIGSK_ENR] = 0x00000006; 649 } else { 650 s->regs[ENET_RAEM] = 0x00000004; 651 s->regs[ENET_RAFL] = 0x00000004; 652 s->regs[ENET_TAEM] = 0x00000004; 653 s->regs[ENET_TAFL] = 0x00000008; 654 s->regs[ENET_TIPG] = 0x0000000c; 655 s->regs[ENET_FTRL] = 0x000007ff; 656 s->regs[ENET_ATPER] = 0x3b9aca00; 657 } 658 659 s->rx_descriptor = 0; 660 memset(s->tx_descriptor, 0, sizeof(s->tx_descriptor)); 661 662 /* We also reset the PHY */ 663 imx_phy_reset(s); 664 } 665 666 static uint32_t imx_default_read(IMXFECState *s, uint32_t index) 667 { 668 qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Bad register at offset 0x%" 669 PRIx32 "\n", TYPE_IMX_FEC, __func__, index * 4); 670 return 0; 671 } 672 673 static uint32_t imx_fec_read(IMXFECState *s, uint32_t index) 674 { 675 switch (index) { 676 case ENET_FRBR: 677 case ENET_FRSR: 678 case ENET_MIIGSK_CFGR: 679 case ENET_MIIGSK_ENR: 680 return s->regs[index]; 681 default: 682 return imx_default_read(s, index); 683 } 684 } 685 686 static uint32_t imx_enet_read(IMXFECState *s, uint32_t index) 687 { 688 switch (index) { 689 case ENET_RSFL: 690 case ENET_RSEM: 691 case ENET_RAEM: 692 case ENET_RAFL: 693 case ENET_TSEM: 694 case ENET_TAEM: 695 case ENET_TAFL: 696 case ENET_TIPG: 697 case ENET_FTRL: 698 case ENET_TACC: 699 case ENET_RACC: 700 case ENET_ATCR: 701 case ENET_ATVR: 702 case ENET_ATOFF: 703 case ENET_ATPER: 704 case ENET_ATCOR: 705 case ENET_ATINC: 706 case ENET_ATSTMP: 707 case ENET_TGSR: 708 case ENET_TCSR0: 709 case ENET_TCCR0: 710 case ENET_TCSR1: 711 case ENET_TCCR1: 712 case ENET_TCSR2: 713 case ENET_TCCR2: 714 case ENET_TCSR3: 715 case ENET_TCCR3: 716 return s->regs[index]; 717 default: 718 return imx_default_read(s, index); 719 } 720 } 721 722 static uint64_t imx_eth_read(void *opaque, hwaddr offset, unsigned size) 723 { 724 uint32_t value = 0; 725 IMXFECState *s = IMX_FEC(opaque); 726 uint32_t index = offset >> 2; 727 728 switch (index) { 729 case ENET_EIR: 730 case ENET_EIMR: 731 case ENET_RDAR: 732 case ENET_TDAR: 733 case ENET_ECR: 734 case ENET_MMFR: 735 case ENET_MSCR: 736 case ENET_MIBC: 737 case ENET_RCR: 738 case ENET_TCR: 739 case ENET_PALR: 740 case ENET_PAUR: 741 case ENET_OPD: 742 case ENET_IAUR: 743 case ENET_IALR: 744 case ENET_GAUR: 745 case ENET_GALR: 746 case ENET_TFWR: 747 case ENET_RDSR: 748 case ENET_TDSR: 749 case ENET_MRBR: 750 value = s->regs[index]; 751 break; 752 default: 753 if (s->is_fec) { 754 value = imx_fec_read(s, index); 755 } else { 756 value = imx_enet_read(s, index); 757 } 758 break; 759 } 760 761 trace_imx_eth_read(index, imx_eth_reg_name(s, index), value); 762 763 return value; 764 } 765 766 static void imx_default_write(IMXFECState *s, uint32_t index, uint32_t value) 767 { 768 qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Bad address at offset 0x%" 769 PRIx32 "\n", TYPE_IMX_FEC, __func__, index * 4); 770 return; 771 } 772 773 static void imx_fec_write(IMXFECState *s, uint32_t index, uint32_t value) 774 { 775 switch (index) { 776 case ENET_FRBR: 777 /* FRBR is read only */ 778 qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Register FRBR is read only\n", 779 TYPE_IMX_FEC, __func__); 780 break; 781 case ENET_FRSR: 782 s->regs[index] = (value & 0x000003fc) | 0x00000400; 783 break; 784 case ENET_MIIGSK_CFGR: 785 s->regs[index] = value & 0x00000053; 786 break; 787 case ENET_MIIGSK_ENR: 788 s->regs[index] = (value & 0x00000002) ? 0x00000006 : 0; 789 break; 790 default: 791 imx_default_write(s, index, value); 792 break; 793 } 794 } 795 796 static void imx_enet_write(IMXFECState *s, uint32_t index, uint32_t value) 797 { 798 switch (index) { 799 case ENET_RSFL: 800 case ENET_RSEM: 801 case ENET_RAEM: 802 case ENET_RAFL: 803 case ENET_TSEM: 804 case ENET_TAEM: 805 case ENET_TAFL: 806 s->regs[index] = value & 0x000001ff; 807 break; 808 case ENET_TIPG: 809 s->regs[index] = value & 0x0000001f; 810 break; 811 case ENET_FTRL: 812 s->regs[index] = value & 0x00003fff; 813 break; 814 case ENET_TACC: 815 s->regs[index] = value & 0x00000019; 816 break; 817 case ENET_RACC: 818 s->regs[index] = value & 0x000000C7; 819 break; 820 case ENET_ATCR: 821 s->regs[index] = value & 0x00002a9d; 822 break; 823 case ENET_ATVR: 824 case ENET_ATOFF: 825 case ENET_ATPER: 826 s->regs[index] = value; 827 break; 828 case ENET_ATSTMP: 829 /* ATSTMP is read only */ 830 qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Register ATSTMP is read only\n", 831 TYPE_IMX_FEC, __func__); 832 break; 833 case ENET_ATCOR: 834 s->regs[index] = value & 0x7fffffff; 835 break; 836 case ENET_ATINC: 837 s->regs[index] = value & 0x00007f7f; 838 break; 839 case ENET_TGSR: 840 /* implement clear timer flag */ 841 s->regs[index] &= ~(value & 0x0000000f); /* all bits W1C */ 842 break; 843 case ENET_TCSR0: 844 case ENET_TCSR1: 845 case ENET_TCSR2: 846 case ENET_TCSR3: 847 s->regs[index] &= ~(value & 0x00000080); /* W1C bits */ 848 s->regs[index] &= ~0x0000007d; /* writable fields */ 849 s->regs[index] |= (value & 0x0000007d); 850 break; 851 case ENET_TCCR0: 852 case ENET_TCCR1: 853 case ENET_TCCR2: 854 case ENET_TCCR3: 855 s->regs[index] = value; 856 break; 857 default: 858 imx_default_write(s, index, value); 859 break; 860 } 861 } 862 863 static void imx_eth_write(void *opaque, hwaddr offset, uint64_t value, 864 unsigned size) 865 { 866 IMXFECState *s = IMX_FEC(opaque); 867 const bool single_tx_ring = !imx_eth_is_multi_tx_ring(s); 868 uint32_t index = offset >> 2; 869 870 trace_imx_eth_write(index, imx_eth_reg_name(s, index), value); 871 872 switch (index) { 873 case ENET_EIR: 874 s->regs[index] &= ~value; 875 break; 876 case ENET_EIMR: 877 s->regs[index] = value; 878 break; 879 case ENET_RDAR: 880 if (s->regs[ENET_ECR] & ENET_ECR_ETHEREN) { 881 if (!s->regs[index]) { 882 imx_eth_enable_rx(s, true); 883 } 884 } else { 885 s->regs[index] = 0; 886 } 887 break; 888 case ENET_TDAR1: 889 case ENET_TDAR2: 890 if (unlikely(single_tx_ring)) { 891 qemu_log_mask(LOG_GUEST_ERROR, 892 "[%s]%s: trying to access TDAR2 or TDAR1\n", 893 TYPE_IMX_FEC, __func__); 894 return; 895 } 896 /* fall through */ 897 case ENET_TDAR: 898 if (s->regs[ENET_ECR] & ENET_ECR_ETHEREN) { 899 s->regs[index] = ENET_TDAR_TDAR; 900 imx_eth_do_tx(s, index); 901 } 902 s->regs[index] = 0; 903 break; 904 case ENET_ECR: 905 if (value & ENET_ECR_RESET) { 906 return imx_eth_reset(DEVICE(s)); 907 } 908 s->regs[index] = value; 909 if ((s->regs[index] & ENET_ECR_ETHEREN) == 0) { 910 s->regs[ENET_RDAR] = 0; 911 s->rx_descriptor = s->regs[ENET_RDSR]; 912 s->regs[ENET_TDAR] = 0; 913 s->regs[ENET_TDAR1] = 0; 914 s->regs[ENET_TDAR2] = 0; 915 s->tx_descriptor[0] = s->regs[ENET_TDSR]; 916 s->tx_descriptor[1] = s->regs[ENET_TDSR1]; 917 s->tx_descriptor[2] = s->regs[ENET_TDSR2]; 918 } 919 break; 920 case ENET_MMFR: 921 s->regs[index] = value; 922 if (extract32(value, 29, 1)) { 923 /* This is a read operation */ 924 s->regs[ENET_MMFR] = deposit32(s->regs[ENET_MMFR], 0, 16, 925 imx_phy_read(s, 926 extract32(value, 927 18, 10))); 928 } else { 929 /* This a write operation */ 930 imx_phy_write(s, extract32(value, 18, 10), extract32(value, 0, 16)); 931 } 932 /* raise the interrupt as the PHY operation is done */ 933 s->regs[ENET_EIR] |= ENET_INT_MII; 934 break; 935 case ENET_MSCR: 936 s->regs[index] = value & 0xfe; 937 break; 938 case ENET_MIBC: 939 /* TODO: Implement MIB. */ 940 s->regs[index] = (value & 0x80000000) ? 0xc0000000 : 0; 941 break; 942 case ENET_RCR: 943 s->regs[index] = value & 0x07ff003f; 944 /* TODO: Implement LOOP mode. */ 945 break; 946 case ENET_TCR: 947 /* We transmit immediately, so raise GRA immediately. */ 948 s->regs[index] = value; 949 if (value & 1) { 950 s->regs[ENET_EIR] |= ENET_INT_GRA; 951 } 952 break; 953 case ENET_PALR: 954 s->regs[index] = value; 955 s->conf.macaddr.a[0] = value >> 24; 956 s->conf.macaddr.a[1] = value >> 16; 957 s->conf.macaddr.a[2] = value >> 8; 958 s->conf.macaddr.a[3] = value; 959 break; 960 case ENET_PAUR: 961 s->regs[index] = (value | 0x0000ffff) & 0xffff8808; 962 s->conf.macaddr.a[4] = value >> 24; 963 s->conf.macaddr.a[5] = value >> 16; 964 break; 965 case ENET_OPD: 966 s->regs[index] = (value & 0x0000ffff) | 0x00010000; 967 break; 968 case ENET_IAUR: 969 case ENET_IALR: 970 case ENET_GAUR: 971 case ENET_GALR: 972 /* TODO: implement MAC hash filtering. */ 973 break; 974 case ENET_TFWR: 975 if (s->is_fec) { 976 s->regs[index] = value & 0x3; 977 } else { 978 s->regs[index] = value & 0x13f; 979 } 980 break; 981 case ENET_RDSR: 982 if (s->is_fec) { 983 s->regs[index] = value & ~3; 984 } else { 985 s->regs[index] = value & ~7; 986 } 987 s->rx_descriptor = s->regs[index]; 988 break; 989 case ENET_TDSR: 990 if (s->is_fec) { 991 s->regs[index] = value & ~3; 992 } else { 993 s->regs[index] = value & ~7; 994 } 995 s->tx_descriptor[0] = s->regs[index]; 996 break; 997 case ENET_TDSR1: 998 if (unlikely(single_tx_ring)) { 999 qemu_log_mask(LOG_GUEST_ERROR, 1000 "[%s]%s: trying to access TDSR1\n", 1001 TYPE_IMX_FEC, __func__); 1002 return; 1003 } 1004 1005 s->regs[index] = value & ~7; 1006 s->tx_descriptor[1] = s->regs[index]; 1007 break; 1008 case ENET_TDSR2: 1009 if (unlikely(single_tx_ring)) { 1010 qemu_log_mask(LOG_GUEST_ERROR, 1011 "[%s]%s: trying to access TDSR2\n", 1012 TYPE_IMX_FEC, __func__); 1013 return; 1014 } 1015 1016 s->regs[index] = value & ~7; 1017 s->tx_descriptor[2] = s->regs[index]; 1018 break; 1019 case ENET_MRBR: 1020 s->regs[index] = value & 0x00003ff0; 1021 break; 1022 default: 1023 if (s->is_fec) { 1024 imx_fec_write(s, index, value); 1025 } else { 1026 imx_enet_write(s, index, value); 1027 } 1028 return; 1029 } 1030 1031 imx_eth_update(s); 1032 } 1033 1034 static bool imx_eth_can_receive(NetClientState *nc) 1035 { 1036 IMXFECState *s = IMX_FEC(qemu_get_nic_opaque(nc)); 1037 1038 return !!s->regs[ENET_RDAR]; 1039 } 1040 1041 static ssize_t imx_fec_receive(NetClientState *nc, const uint8_t *buf, 1042 size_t len) 1043 { 1044 IMXFECState *s = IMX_FEC(qemu_get_nic_opaque(nc)); 1045 IMXFECBufDesc bd; 1046 uint32_t flags = 0; 1047 uint32_t addr; 1048 uint32_t crc; 1049 uint32_t buf_addr; 1050 uint8_t *crc_ptr; 1051 unsigned int buf_len; 1052 size_t size = len; 1053 1054 trace_imx_fec_receive(size); 1055 1056 if (!s->regs[ENET_RDAR]) { 1057 qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Unexpected packet\n", 1058 TYPE_IMX_FEC, __func__); 1059 return 0; 1060 } 1061 1062 /* 4 bytes for the CRC. */ 1063 size += 4; 1064 crc = cpu_to_be32(crc32(~0, buf, size)); 1065 crc_ptr = (uint8_t *) &crc; 1066 1067 /* Huge frames are truncated. */ 1068 if (size > ENET_MAX_FRAME_SIZE) { 1069 size = ENET_MAX_FRAME_SIZE; 1070 flags |= ENET_BD_TR | ENET_BD_LG; 1071 } 1072 1073 /* Frames larger than the user limit just set error flags. */ 1074 if (size > (s->regs[ENET_RCR] >> 16)) { 1075 flags |= ENET_BD_LG; 1076 } 1077 1078 addr = s->rx_descriptor; 1079 while (size > 0) { 1080 imx_fec_read_bd(&bd, addr); 1081 if ((bd.flags & ENET_BD_E) == 0) { 1082 /* No descriptors available. Bail out. */ 1083 /* 1084 * FIXME: This is wrong. We should probably either 1085 * save the remainder for when more RX buffers are 1086 * available, or flag an error. 1087 */ 1088 qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Lost end of frame\n", 1089 TYPE_IMX_FEC, __func__); 1090 break; 1091 } 1092 buf_len = (size <= s->regs[ENET_MRBR]) ? size : s->regs[ENET_MRBR]; 1093 bd.length = buf_len; 1094 size -= buf_len; 1095 1096 trace_imx_fec_receive_len(addr, bd.length); 1097 1098 /* The last 4 bytes are the CRC. */ 1099 if (size < 4) { 1100 buf_len += size - 4; 1101 } 1102 buf_addr = bd.data; 1103 dma_memory_write(&address_space_memory, buf_addr, buf, buf_len); 1104 buf += buf_len; 1105 if (size < 4) { 1106 dma_memory_write(&address_space_memory, buf_addr + buf_len, 1107 crc_ptr, 4 - size); 1108 crc_ptr += 4 - size; 1109 } 1110 bd.flags &= ~ENET_BD_E; 1111 if (size == 0) { 1112 /* Last buffer in frame. */ 1113 bd.flags |= flags | ENET_BD_L; 1114 1115 trace_imx_fec_receive_last(bd.flags); 1116 1117 s->regs[ENET_EIR] |= ENET_INT_RXF; 1118 } else { 1119 s->regs[ENET_EIR] |= ENET_INT_RXB; 1120 } 1121 imx_fec_write_bd(&bd, addr); 1122 /* Advance to the next descriptor. */ 1123 if ((bd.flags & ENET_BD_W) != 0) { 1124 addr = s->regs[ENET_RDSR]; 1125 } else { 1126 addr += sizeof(bd); 1127 } 1128 } 1129 s->rx_descriptor = addr; 1130 imx_eth_enable_rx(s, false); 1131 imx_eth_update(s); 1132 return len; 1133 } 1134 1135 static ssize_t imx_enet_receive(NetClientState *nc, const uint8_t *buf, 1136 size_t len) 1137 { 1138 IMXFECState *s = IMX_FEC(qemu_get_nic_opaque(nc)); 1139 IMXENETBufDesc bd; 1140 uint32_t flags = 0; 1141 uint32_t addr; 1142 uint32_t crc; 1143 uint32_t buf_addr; 1144 uint8_t *crc_ptr; 1145 unsigned int buf_len; 1146 size_t size = len; 1147 bool shift16 = s->regs[ENET_RACC] & ENET_RACC_SHIFT16; 1148 1149 trace_imx_enet_receive(size); 1150 1151 if (!s->regs[ENET_RDAR]) { 1152 qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Unexpected packet\n", 1153 TYPE_IMX_FEC, __func__); 1154 return 0; 1155 } 1156 1157 /* 4 bytes for the CRC. */ 1158 size += 4; 1159 crc = cpu_to_be32(crc32(~0, buf, size)); 1160 crc_ptr = (uint8_t *) &crc; 1161 1162 if (shift16) { 1163 size += 2; 1164 } 1165 1166 /* Huge frames are truncated. */ 1167 if (size > s->regs[ENET_FTRL]) { 1168 size = s->regs[ENET_FTRL]; 1169 flags |= ENET_BD_TR | ENET_BD_LG; 1170 } 1171 1172 /* Frames larger than the user limit just set error flags. */ 1173 if (size > (s->regs[ENET_RCR] >> 16)) { 1174 flags |= ENET_BD_LG; 1175 } 1176 1177 addr = s->rx_descriptor; 1178 while (size > 0) { 1179 imx_enet_read_bd(&bd, addr); 1180 if ((bd.flags & ENET_BD_E) == 0) { 1181 /* No descriptors available. Bail out. */ 1182 /* 1183 * FIXME: This is wrong. We should probably either 1184 * save the remainder for when more RX buffers are 1185 * available, or flag an error. 1186 */ 1187 qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Lost end of frame\n", 1188 TYPE_IMX_FEC, __func__); 1189 break; 1190 } 1191 buf_len = MIN(size, s->regs[ENET_MRBR]); 1192 bd.length = buf_len; 1193 size -= buf_len; 1194 1195 trace_imx_enet_receive_len(addr, bd.length); 1196 1197 /* The last 4 bytes are the CRC. */ 1198 if (size < 4) { 1199 buf_len += size - 4; 1200 } 1201 buf_addr = bd.data; 1202 1203 if (shift16) { 1204 /* 1205 * If SHIFT16 bit of ENETx_RACC register is set we need to 1206 * align the payload to 4-byte boundary. 1207 */ 1208 const uint8_t zeros[2] = { 0 }; 1209 1210 dma_memory_write(&address_space_memory, buf_addr, 1211 zeros, sizeof(zeros)); 1212 1213 buf_addr += sizeof(zeros); 1214 buf_len -= sizeof(zeros); 1215 1216 /* We only do this once per Ethernet frame */ 1217 shift16 = false; 1218 } 1219 1220 dma_memory_write(&address_space_memory, buf_addr, buf, buf_len); 1221 buf += buf_len; 1222 if (size < 4) { 1223 dma_memory_write(&address_space_memory, buf_addr + buf_len, 1224 crc_ptr, 4 - size); 1225 crc_ptr += 4 - size; 1226 } 1227 bd.flags &= ~ENET_BD_E; 1228 if (size == 0) { 1229 /* Last buffer in frame. */ 1230 bd.flags |= flags | ENET_BD_L; 1231 1232 trace_imx_enet_receive_last(bd.flags); 1233 1234 /* Indicate that we've updated the last buffer descriptor. */ 1235 bd.last_buffer = ENET_BD_BDU; 1236 if (bd.option & ENET_BD_RX_INT) { 1237 s->regs[ENET_EIR] |= ENET_INT_RXF; 1238 } 1239 } else { 1240 if (bd.option & ENET_BD_RX_INT) { 1241 s->regs[ENET_EIR] |= ENET_INT_RXB; 1242 } 1243 } 1244 imx_enet_write_bd(&bd, addr); 1245 /* Advance to the next descriptor. */ 1246 if ((bd.flags & ENET_BD_W) != 0) { 1247 addr = s->regs[ENET_RDSR]; 1248 } else { 1249 addr += sizeof(bd); 1250 } 1251 } 1252 s->rx_descriptor = addr; 1253 imx_eth_enable_rx(s, false); 1254 imx_eth_update(s); 1255 return len; 1256 } 1257 1258 static ssize_t imx_eth_receive(NetClientState *nc, const uint8_t *buf, 1259 size_t len) 1260 { 1261 IMXFECState *s = IMX_FEC(qemu_get_nic_opaque(nc)); 1262 1263 if (!s->is_fec && (s->regs[ENET_ECR] & ENET_ECR_EN1588)) { 1264 return imx_enet_receive(nc, buf, len); 1265 } else { 1266 return imx_fec_receive(nc, buf, len); 1267 } 1268 } 1269 1270 static const MemoryRegionOps imx_eth_ops = { 1271 .read = imx_eth_read, 1272 .write = imx_eth_write, 1273 .valid.min_access_size = 4, 1274 .valid.max_access_size = 4, 1275 .endianness = DEVICE_NATIVE_ENDIAN, 1276 }; 1277 1278 static void imx_eth_cleanup(NetClientState *nc) 1279 { 1280 IMXFECState *s = IMX_FEC(qemu_get_nic_opaque(nc)); 1281 1282 s->nic = NULL; 1283 } 1284 1285 static NetClientInfo imx_eth_net_info = { 1286 .type = NET_CLIENT_DRIVER_NIC, 1287 .size = sizeof(NICState), 1288 .can_receive = imx_eth_can_receive, 1289 .receive = imx_eth_receive, 1290 .cleanup = imx_eth_cleanup, 1291 .link_status_changed = imx_eth_set_link, 1292 }; 1293 1294 1295 static void imx_eth_realize(DeviceState *dev, Error **errp) 1296 { 1297 IMXFECState *s = IMX_FEC(dev); 1298 SysBusDevice *sbd = SYS_BUS_DEVICE(dev); 1299 1300 memory_region_init_io(&s->iomem, OBJECT(dev), &imx_eth_ops, s, 1301 TYPE_IMX_FEC, FSL_IMX25_FEC_SIZE); 1302 sysbus_init_mmio(sbd, &s->iomem); 1303 sysbus_init_irq(sbd, &s->irq[0]); 1304 sysbus_init_irq(sbd, &s->irq[1]); 1305 1306 qemu_macaddr_default_if_unset(&s->conf.macaddr); 1307 1308 s->nic = qemu_new_nic(&imx_eth_net_info, &s->conf, 1309 object_get_typename(OBJECT(dev)), 1310 dev->id, s); 1311 1312 qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a); 1313 } 1314 1315 static Property imx_eth_properties[] = { 1316 DEFINE_NIC_PROPERTIES(IMXFECState, conf), 1317 DEFINE_PROP_UINT32("tx-ring-num", IMXFECState, tx_ring_num, 1), 1318 DEFINE_PROP_END_OF_LIST(), 1319 }; 1320 1321 static void imx_eth_class_init(ObjectClass *klass, void *data) 1322 { 1323 DeviceClass *dc = DEVICE_CLASS(klass); 1324 1325 dc->vmsd = &vmstate_imx_eth; 1326 dc->reset = imx_eth_reset; 1327 device_class_set_props(dc, imx_eth_properties); 1328 dc->realize = imx_eth_realize; 1329 dc->desc = "i.MX FEC/ENET Ethernet Controller"; 1330 } 1331 1332 static void imx_fec_init(Object *obj) 1333 { 1334 IMXFECState *s = IMX_FEC(obj); 1335 1336 s->is_fec = true; 1337 } 1338 1339 static void imx_enet_init(Object *obj) 1340 { 1341 IMXFECState *s = IMX_FEC(obj); 1342 1343 s->is_fec = false; 1344 } 1345 1346 static const TypeInfo imx_fec_info = { 1347 .name = TYPE_IMX_FEC, 1348 .parent = TYPE_SYS_BUS_DEVICE, 1349 .instance_size = sizeof(IMXFECState), 1350 .instance_init = imx_fec_init, 1351 .class_init = imx_eth_class_init, 1352 }; 1353 1354 static const TypeInfo imx_enet_info = { 1355 .name = TYPE_IMX_ENET, 1356 .parent = TYPE_IMX_FEC, 1357 .instance_init = imx_enet_init, 1358 }; 1359 1360 static void imx_eth_register_types(void) 1361 { 1362 type_register_static(&imx_fec_info); 1363 type_register_static(&imx_enet_info); 1364 } 1365 1366 type_init(imx_eth_register_types) 1367