1 /* 2 * i.MX Fast Ethernet Controller emulation. 3 * 4 * Copyright (c) 2013 Jean-Christophe Dubois. <jcd@tribudubois.net> 5 * 6 * Based on Coldfire Fast Ethernet Controller emulation. 7 * 8 * Copyright (c) 2007 CodeSourcery. 9 * 10 * This program is free software; you can redistribute it and/or modify it 11 * under the terms of the GNU General Public License as published by the 12 * Free Software Foundation; either version 2 of the License, or 13 * (at your option) any later version. 14 * 15 * This program is distributed in the hope that it will be useful, but WITHOUT 16 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 17 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License 18 * for more details. 19 * 20 * You should have received a copy of the GNU General Public License along 21 * with this program; if not, see <http://www.gnu.org/licenses/>. 22 */ 23 24 #include "qemu/osdep.h" 25 #include "hw/net/imx_fec.h" 26 #include "sysemu/dma.h" 27 #include "qemu/log.h" 28 #include "net/checksum.h" 29 #include "net/eth.h" 30 31 /* For crc32 */ 32 #include <zlib.h> 33 34 #ifndef DEBUG_IMX_FEC 35 #define DEBUG_IMX_FEC 0 36 #endif 37 38 #define FEC_PRINTF(fmt, args...) \ 39 do { \ 40 if (DEBUG_IMX_FEC) { \ 41 fprintf(stderr, "[%s]%s: " fmt , TYPE_IMX_FEC, \ 42 __func__, ##args); \ 43 } \ 44 } while (0) 45 46 #ifndef DEBUG_IMX_PHY 47 #define DEBUG_IMX_PHY 0 48 #endif 49 50 #define PHY_PRINTF(fmt, args...) \ 51 do { \ 52 if (DEBUG_IMX_PHY) { \ 53 fprintf(stderr, "[%s.phy]%s: " fmt , TYPE_IMX_FEC, \ 54 __func__, ##args); \ 55 } \ 56 } while (0) 57 58 #define IMX_MAX_DESC 1024 59 60 static const char *imx_default_reg_name(IMXFECState *s, uint32_t index) 61 { 62 static char tmp[20]; 63 sprintf(tmp, "index %d", index); 64 return tmp; 65 } 66 67 static const char *imx_fec_reg_name(IMXFECState *s, uint32_t index) 68 { 69 switch (index) { 70 case ENET_FRBR: 71 return "FRBR"; 72 case ENET_FRSR: 73 return "FRSR"; 74 case ENET_MIIGSK_CFGR: 75 return "MIIGSK_CFGR"; 76 case ENET_MIIGSK_ENR: 77 return "MIIGSK_ENR"; 78 default: 79 return imx_default_reg_name(s, index); 80 } 81 } 82 83 static const char *imx_enet_reg_name(IMXFECState *s, uint32_t index) 84 { 85 switch (index) { 86 case ENET_RSFL: 87 return "RSFL"; 88 case ENET_RSEM: 89 return "RSEM"; 90 case ENET_RAEM: 91 return "RAEM"; 92 case ENET_RAFL: 93 return "RAFL"; 94 case ENET_TSEM: 95 return "TSEM"; 96 case ENET_TAEM: 97 return "TAEM"; 98 case ENET_TAFL: 99 return "TAFL"; 100 case ENET_TIPG: 101 return "TIPG"; 102 case ENET_FTRL: 103 return "FTRL"; 104 case ENET_TACC: 105 return "TACC"; 106 case ENET_RACC: 107 return "RACC"; 108 case ENET_ATCR: 109 return "ATCR"; 110 case ENET_ATVR: 111 return "ATVR"; 112 case ENET_ATOFF: 113 return "ATOFF"; 114 case ENET_ATPER: 115 return "ATPER"; 116 case ENET_ATCOR: 117 return "ATCOR"; 118 case ENET_ATINC: 119 return "ATINC"; 120 case ENET_ATSTMP: 121 return "ATSTMP"; 122 case ENET_TGSR: 123 return "TGSR"; 124 case ENET_TCSR0: 125 return "TCSR0"; 126 case ENET_TCCR0: 127 return "TCCR0"; 128 case ENET_TCSR1: 129 return "TCSR1"; 130 case ENET_TCCR1: 131 return "TCCR1"; 132 case ENET_TCSR2: 133 return "TCSR2"; 134 case ENET_TCCR2: 135 return "TCCR2"; 136 case ENET_TCSR3: 137 return "TCSR3"; 138 case ENET_TCCR3: 139 return "TCCR3"; 140 default: 141 return imx_default_reg_name(s, index); 142 } 143 } 144 145 static const char *imx_eth_reg_name(IMXFECState *s, uint32_t index) 146 { 147 switch (index) { 148 case ENET_EIR: 149 return "EIR"; 150 case ENET_EIMR: 151 return "EIMR"; 152 case ENET_RDAR: 153 return "RDAR"; 154 case ENET_TDAR: 155 return "TDAR"; 156 case ENET_ECR: 157 return "ECR"; 158 case ENET_MMFR: 159 return "MMFR"; 160 case ENET_MSCR: 161 return "MSCR"; 162 case ENET_MIBC: 163 return "MIBC"; 164 case ENET_RCR: 165 return "RCR"; 166 case ENET_TCR: 167 return "TCR"; 168 case ENET_PALR: 169 return "PALR"; 170 case ENET_PAUR: 171 return "PAUR"; 172 case ENET_OPD: 173 return "OPD"; 174 case ENET_IAUR: 175 return "IAUR"; 176 case ENET_IALR: 177 return "IALR"; 178 case ENET_GAUR: 179 return "GAUR"; 180 case ENET_GALR: 181 return "GALR"; 182 case ENET_TFWR: 183 return "TFWR"; 184 case ENET_RDSR: 185 return "RDSR"; 186 case ENET_TDSR: 187 return "TDSR"; 188 case ENET_MRBR: 189 return "MRBR"; 190 default: 191 if (s->is_fec) { 192 return imx_fec_reg_name(s, index); 193 } else { 194 return imx_enet_reg_name(s, index); 195 } 196 } 197 } 198 199 /* 200 * Versions of this device with more than one TX descriptor save the 201 * 2nd and 3rd descriptors in a subsection, to maintain migration 202 * compatibility with previous versions of the device that only 203 * supported a single descriptor. 204 */ 205 static bool imx_eth_is_multi_tx_ring(void *opaque) 206 { 207 IMXFECState *s = IMX_FEC(opaque); 208 209 return s->tx_ring_num > 1; 210 } 211 212 static const VMStateDescription vmstate_imx_eth_txdescs = { 213 .name = "imx.fec/txdescs", 214 .version_id = 1, 215 .minimum_version_id = 1, 216 .needed = imx_eth_is_multi_tx_ring, 217 .fields = (VMStateField[]) { 218 VMSTATE_UINT32(tx_descriptor[1], IMXFECState), 219 VMSTATE_UINT32(tx_descriptor[2], IMXFECState), 220 VMSTATE_END_OF_LIST() 221 } 222 }; 223 224 static const VMStateDescription vmstate_imx_eth = { 225 .name = TYPE_IMX_FEC, 226 .version_id = 2, 227 .minimum_version_id = 2, 228 .fields = (VMStateField[]) { 229 VMSTATE_UINT32_ARRAY(regs, IMXFECState, ENET_MAX), 230 VMSTATE_UINT32(rx_descriptor, IMXFECState), 231 VMSTATE_UINT32(tx_descriptor[0], IMXFECState), 232 VMSTATE_UINT32(phy_status, IMXFECState), 233 VMSTATE_UINT32(phy_control, IMXFECState), 234 VMSTATE_UINT32(phy_advertise, IMXFECState), 235 VMSTATE_UINT32(phy_int, IMXFECState), 236 VMSTATE_UINT32(phy_int_mask, IMXFECState), 237 VMSTATE_END_OF_LIST() 238 }, 239 .subsections = (const VMStateDescription * []) { 240 &vmstate_imx_eth_txdescs, 241 NULL 242 }, 243 }; 244 245 #define PHY_INT_ENERGYON (1 << 7) 246 #define PHY_INT_AUTONEG_COMPLETE (1 << 6) 247 #define PHY_INT_FAULT (1 << 5) 248 #define PHY_INT_DOWN (1 << 4) 249 #define PHY_INT_AUTONEG_LP (1 << 3) 250 #define PHY_INT_PARFAULT (1 << 2) 251 #define PHY_INT_AUTONEG_PAGE (1 << 1) 252 253 static void imx_eth_update(IMXFECState *s); 254 255 /* 256 * The MII phy could raise a GPIO to the processor which in turn 257 * could be handled as an interrpt by the OS. 258 * For now we don't handle any GPIO/interrupt line, so the OS will 259 * have to poll for the PHY status. 260 */ 261 static void phy_update_irq(IMXFECState *s) 262 { 263 imx_eth_update(s); 264 } 265 266 static void phy_update_link(IMXFECState *s) 267 { 268 /* Autonegotiation status mirrors link status. */ 269 if (qemu_get_queue(s->nic)->link_down) { 270 PHY_PRINTF("link is down\n"); 271 s->phy_status &= ~0x0024; 272 s->phy_int |= PHY_INT_DOWN; 273 } else { 274 PHY_PRINTF("link is up\n"); 275 s->phy_status |= 0x0024; 276 s->phy_int |= PHY_INT_ENERGYON; 277 s->phy_int |= PHY_INT_AUTONEG_COMPLETE; 278 } 279 phy_update_irq(s); 280 } 281 282 static void imx_eth_set_link(NetClientState *nc) 283 { 284 phy_update_link(IMX_FEC(qemu_get_nic_opaque(nc))); 285 } 286 287 static void phy_reset(IMXFECState *s) 288 { 289 s->phy_status = 0x7809; 290 s->phy_control = 0x3000; 291 s->phy_advertise = 0x01e1; 292 s->phy_int_mask = 0; 293 s->phy_int = 0; 294 phy_update_link(s); 295 } 296 297 static uint32_t do_phy_read(IMXFECState *s, int reg) 298 { 299 uint32_t val; 300 301 if (reg > 31) { 302 /* we only advertise one phy */ 303 return 0; 304 } 305 306 switch (reg) { 307 case 0: /* Basic Control */ 308 val = s->phy_control; 309 break; 310 case 1: /* Basic Status */ 311 val = s->phy_status; 312 break; 313 case 2: /* ID1 */ 314 val = 0x0007; 315 break; 316 case 3: /* ID2 */ 317 val = 0xc0d1; 318 break; 319 case 4: /* Auto-neg advertisement */ 320 val = s->phy_advertise; 321 break; 322 case 5: /* Auto-neg Link Partner Ability */ 323 val = 0x0f71; 324 break; 325 case 6: /* Auto-neg Expansion */ 326 val = 1; 327 break; 328 case 29: /* Interrupt source. */ 329 val = s->phy_int; 330 s->phy_int = 0; 331 phy_update_irq(s); 332 break; 333 case 30: /* Interrupt mask */ 334 val = s->phy_int_mask; 335 break; 336 case 17: 337 case 18: 338 case 27: 339 case 31: 340 qemu_log_mask(LOG_UNIMP, "[%s.phy]%s: reg %d not implemented\n", 341 TYPE_IMX_FEC, __func__, reg); 342 val = 0; 343 break; 344 default: 345 qemu_log_mask(LOG_GUEST_ERROR, "[%s.phy]%s: Bad address at offset %d\n", 346 TYPE_IMX_FEC, __func__, reg); 347 val = 0; 348 break; 349 } 350 351 PHY_PRINTF("read 0x%04x @ %d\n", val, reg); 352 353 return val; 354 } 355 356 static void do_phy_write(IMXFECState *s, int reg, uint32_t val) 357 { 358 PHY_PRINTF("write 0x%04x @ %d\n", val, reg); 359 360 if (reg > 31) { 361 /* we only advertise one phy */ 362 return; 363 } 364 365 switch (reg) { 366 case 0: /* Basic Control */ 367 if (val & 0x8000) { 368 phy_reset(s); 369 } else { 370 s->phy_control = val & 0x7980; 371 /* Complete autonegotiation immediately. */ 372 if (val & 0x1000) { 373 s->phy_status |= 0x0020; 374 } 375 } 376 break; 377 case 4: /* Auto-neg advertisement */ 378 s->phy_advertise = (val & 0x2d7f) | 0x80; 379 break; 380 case 30: /* Interrupt mask */ 381 s->phy_int_mask = val & 0xff; 382 phy_update_irq(s); 383 break; 384 case 17: 385 case 18: 386 case 27: 387 case 31: 388 qemu_log_mask(LOG_UNIMP, "[%s.phy)%s: reg %d not implemented\n", 389 TYPE_IMX_FEC, __func__, reg); 390 break; 391 default: 392 qemu_log_mask(LOG_GUEST_ERROR, "[%s.phy]%s: Bad address at offset %d\n", 393 TYPE_IMX_FEC, __func__, reg); 394 break; 395 } 396 } 397 398 static void imx_fec_read_bd(IMXFECBufDesc *bd, dma_addr_t addr) 399 { 400 dma_memory_read(&address_space_memory, addr, bd, sizeof(*bd)); 401 } 402 403 static void imx_fec_write_bd(IMXFECBufDesc *bd, dma_addr_t addr) 404 { 405 dma_memory_write(&address_space_memory, addr, bd, sizeof(*bd)); 406 } 407 408 static void imx_enet_read_bd(IMXENETBufDesc *bd, dma_addr_t addr) 409 { 410 dma_memory_read(&address_space_memory, addr, bd, sizeof(*bd)); 411 } 412 413 static void imx_enet_write_bd(IMXENETBufDesc *bd, dma_addr_t addr) 414 { 415 dma_memory_write(&address_space_memory, addr, bd, sizeof(*bd)); 416 } 417 418 static void imx_eth_update(IMXFECState *s) 419 { 420 /* 421 * Previous versions of qemu had the ENET_INT_MAC and ENET_INT_TS_TIMER 422 * interrupts swapped. This worked with older versions of Linux (4.14 423 * and older) since Linux associated both interrupt lines with Ethernet 424 * MAC interrupts. Specifically, 425 * - Linux 4.15 and later have separate interrupt handlers for the MAC and 426 * timer interrupts. Those versions of Linux fail with versions of QEMU 427 * with swapped interrupt assignments. 428 * - In linux 4.14, both interrupt lines were registered with the Ethernet 429 * MAC interrupt handler. As a result, all versions of qemu happen to 430 * work, though that is accidental. 431 * - In Linux 4.9 and older, the timer interrupt was registered directly 432 * with the Ethernet MAC interrupt handler. The MAC interrupt was 433 * redirected to a GPIO interrupt to work around erratum ERR006687. 434 * This was implemented using the SOC's IOMUX block. In qemu, this GPIO 435 * interrupt never fired since IOMUX is currently not supported in qemu. 436 * Linux instead received MAC interrupts on the timer interrupt. 437 * As a result, qemu versions with the swapped interrupt assignment work, 438 * albeit accidentally, but qemu versions with the correct interrupt 439 * assignment fail. 440 * 441 * To ensure that all versions of Linux work, generate ENET_INT_MAC 442 * interrrupts on both interrupt lines. This should be changed if and when 443 * qemu supports IOMUX. 444 */ 445 if (s->regs[ENET_EIR] & s->regs[ENET_EIMR] & 446 (ENET_INT_MAC | ENET_INT_TS_TIMER)) { 447 qemu_set_irq(s->irq[1], 1); 448 } else { 449 qemu_set_irq(s->irq[1], 0); 450 } 451 452 if (s->regs[ENET_EIR] & s->regs[ENET_EIMR] & ENET_INT_MAC) { 453 qemu_set_irq(s->irq[0], 1); 454 } else { 455 qemu_set_irq(s->irq[0], 0); 456 } 457 } 458 459 static void imx_fec_do_tx(IMXFECState *s) 460 { 461 int frame_size = 0, descnt = 0; 462 uint8_t *ptr = s->frame; 463 uint32_t addr = s->tx_descriptor[0]; 464 465 while (descnt++ < IMX_MAX_DESC) { 466 IMXFECBufDesc bd; 467 int len; 468 469 imx_fec_read_bd(&bd, addr); 470 FEC_PRINTF("tx_bd %x flags %04x len %d data %08x\n", 471 addr, bd.flags, bd.length, bd.data); 472 if ((bd.flags & ENET_BD_R) == 0) { 473 /* Run out of descriptors to transmit. */ 474 FEC_PRINTF("tx_bd ran out of descriptors to transmit\n"); 475 break; 476 } 477 len = bd.length; 478 if (frame_size + len > ENET_MAX_FRAME_SIZE) { 479 len = ENET_MAX_FRAME_SIZE - frame_size; 480 s->regs[ENET_EIR] |= ENET_INT_BABT; 481 } 482 dma_memory_read(&address_space_memory, bd.data, ptr, len); 483 ptr += len; 484 frame_size += len; 485 if (bd.flags & ENET_BD_L) { 486 /* Last buffer in frame. */ 487 qemu_send_packet(qemu_get_queue(s->nic), s->frame, frame_size); 488 ptr = s->frame; 489 frame_size = 0; 490 s->regs[ENET_EIR] |= ENET_INT_TXF; 491 } 492 s->regs[ENET_EIR] |= ENET_INT_TXB; 493 bd.flags &= ~ENET_BD_R; 494 /* Write back the modified descriptor. */ 495 imx_fec_write_bd(&bd, addr); 496 /* Advance to the next descriptor. */ 497 if ((bd.flags & ENET_BD_W) != 0) { 498 addr = s->regs[ENET_TDSR]; 499 } else { 500 addr += sizeof(bd); 501 } 502 } 503 504 s->tx_descriptor[0] = addr; 505 506 imx_eth_update(s); 507 } 508 509 static void imx_enet_do_tx(IMXFECState *s, uint32_t index) 510 { 511 int frame_size = 0, descnt = 0; 512 513 uint8_t *ptr = s->frame; 514 uint32_t addr, int_txb, int_txf, tdsr; 515 size_t ring; 516 517 switch (index) { 518 case ENET_TDAR: 519 ring = 0; 520 int_txb = ENET_INT_TXB; 521 int_txf = ENET_INT_TXF; 522 tdsr = ENET_TDSR; 523 break; 524 case ENET_TDAR1: 525 ring = 1; 526 int_txb = ENET_INT_TXB1; 527 int_txf = ENET_INT_TXF1; 528 tdsr = ENET_TDSR1; 529 break; 530 case ENET_TDAR2: 531 ring = 2; 532 int_txb = ENET_INT_TXB2; 533 int_txf = ENET_INT_TXF2; 534 tdsr = ENET_TDSR2; 535 break; 536 default: 537 qemu_log_mask(LOG_GUEST_ERROR, 538 "%s: bogus value for index %x\n", 539 __func__, index); 540 abort(); 541 break; 542 } 543 544 addr = s->tx_descriptor[ring]; 545 546 while (descnt++ < IMX_MAX_DESC) { 547 IMXENETBufDesc bd; 548 int len; 549 550 imx_enet_read_bd(&bd, addr); 551 FEC_PRINTF("tx_bd %x flags %04x len %d data %08x option %04x " 552 "status %04x\n", addr, bd.flags, bd.length, bd.data, 553 bd.option, bd.status); 554 if ((bd.flags & ENET_BD_R) == 0) { 555 /* Run out of descriptors to transmit. */ 556 break; 557 } 558 len = bd.length; 559 if (frame_size + len > ENET_MAX_FRAME_SIZE) { 560 len = ENET_MAX_FRAME_SIZE - frame_size; 561 s->regs[ENET_EIR] |= ENET_INT_BABT; 562 } 563 dma_memory_read(&address_space_memory, bd.data, ptr, len); 564 ptr += len; 565 frame_size += len; 566 if (bd.flags & ENET_BD_L) { 567 if (bd.option & ENET_BD_PINS) { 568 struct ip_header *ip_hd = PKT_GET_IP_HDR(s->frame); 569 if (IP_HEADER_VERSION(ip_hd) == 4) { 570 net_checksum_calculate(s->frame, frame_size); 571 } 572 } 573 if (bd.option & ENET_BD_IINS) { 574 struct ip_header *ip_hd = PKT_GET_IP_HDR(s->frame); 575 /* We compute checksum only for IPv4 frames */ 576 if (IP_HEADER_VERSION(ip_hd) == 4) { 577 uint16_t csum; 578 ip_hd->ip_sum = 0; 579 csum = net_raw_checksum((uint8_t *)ip_hd, sizeof(*ip_hd)); 580 ip_hd->ip_sum = cpu_to_be16(csum); 581 } 582 } 583 /* Last buffer in frame. */ 584 585 qemu_send_packet(qemu_get_queue(s->nic), s->frame, frame_size); 586 ptr = s->frame; 587 588 frame_size = 0; 589 if (bd.option & ENET_BD_TX_INT) { 590 s->regs[ENET_EIR] |= int_txf; 591 } 592 } 593 if (bd.option & ENET_BD_TX_INT) { 594 s->regs[ENET_EIR] |= int_txb; 595 } 596 bd.flags &= ~ENET_BD_R; 597 /* Write back the modified descriptor. */ 598 imx_enet_write_bd(&bd, addr); 599 /* Advance to the next descriptor. */ 600 if ((bd.flags & ENET_BD_W) != 0) { 601 addr = s->regs[tdsr]; 602 } else { 603 addr += sizeof(bd); 604 } 605 } 606 607 s->tx_descriptor[ring] = addr; 608 609 imx_eth_update(s); 610 } 611 612 static void imx_eth_do_tx(IMXFECState *s, uint32_t index) 613 { 614 if (!s->is_fec && (s->regs[ENET_ECR] & ENET_ECR_EN1588)) { 615 imx_enet_do_tx(s, index); 616 } else { 617 imx_fec_do_tx(s); 618 } 619 } 620 621 static void imx_eth_enable_rx(IMXFECState *s, bool flush) 622 { 623 IMXFECBufDesc bd; 624 625 imx_fec_read_bd(&bd, s->rx_descriptor); 626 627 s->regs[ENET_RDAR] = (bd.flags & ENET_BD_E) ? ENET_RDAR_RDAR : 0; 628 629 if (!s->regs[ENET_RDAR]) { 630 FEC_PRINTF("RX buffer full\n"); 631 } else if (flush) { 632 qemu_flush_queued_packets(qemu_get_queue(s->nic)); 633 } 634 } 635 636 static void imx_eth_reset(DeviceState *d) 637 { 638 IMXFECState *s = IMX_FEC(d); 639 640 /* Reset the Device */ 641 memset(s->regs, 0, sizeof(s->regs)); 642 s->regs[ENET_ECR] = 0xf0000000; 643 s->regs[ENET_MIBC] = 0xc0000000; 644 s->regs[ENET_RCR] = 0x05ee0001; 645 s->regs[ENET_OPD] = 0x00010000; 646 647 s->regs[ENET_PALR] = (s->conf.macaddr.a[0] << 24) 648 | (s->conf.macaddr.a[1] << 16) 649 | (s->conf.macaddr.a[2] << 8) 650 | s->conf.macaddr.a[3]; 651 s->regs[ENET_PAUR] = (s->conf.macaddr.a[4] << 24) 652 | (s->conf.macaddr.a[5] << 16) 653 | 0x8808; 654 655 if (s->is_fec) { 656 s->regs[ENET_FRBR] = 0x00000600; 657 s->regs[ENET_FRSR] = 0x00000500; 658 s->regs[ENET_MIIGSK_ENR] = 0x00000006; 659 } else { 660 s->regs[ENET_RAEM] = 0x00000004; 661 s->regs[ENET_RAFL] = 0x00000004; 662 s->regs[ENET_TAEM] = 0x00000004; 663 s->regs[ENET_TAFL] = 0x00000008; 664 s->regs[ENET_TIPG] = 0x0000000c; 665 s->regs[ENET_FTRL] = 0x000007ff; 666 s->regs[ENET_ATPER] = 0x3b9aca00; 667 } 668 669 s->rx_descriptor = 0; 670 memset(s->tx_descriptor, 0, sizeof(s->tx_descriptor)); 671 672 /* We also reset the PHY */ 673 phy_reset(s); 674 } 675 676 static uint32_t imx_default_read(IMXFECState *s, uint32_t index) 677 { 678 qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Bad register at offset 0x%" 679 PRIx32 "\n", TYPE_IMX_FEC, __func__, index * 4); 680 return 0; 681 } 682 683 static uint32_t imx_fec_read(IMXFECState *s, uint32_t index) 684 { 685 switch (index) { 686 case ENET_FRBR: 687 case ENET_FRSR: 688 case ENET_MIIGSK_CFGR: 689 case ENET_MIIGSK_ENR: 690 return s->regs[index]; 691 default: 692 return imx_default_read(s, index); 693 } 694 } 695 696 static uint32_t imx_enet_read(IMXFECState *s, uint32_t index) 697 { 698 switch (index) { 699 case ENET_RSFL: 700 case ENET_RSEM: 701 case ENET_RAEM: 702 case ENET_RAFL: 703 case ENET_TSEM: 704 case ENET_TAEM: 705 case ENET_TAFL: 706 case ENET_TIPG: 707 case ENET_FTRL: 708 case ENET_TACC: 709 case ENET_RACC: 710 case ENET_ATCR: 711 case ENET_ATVR: 712 case ENET_ATOFF: 713 case ENET_ATPER: 714 case ENET_ATCOR: 715 case ENET_ATINC: 716 case ENET_ATSTMP: 717 case ENET_TGSR: 718 case ENET_TCSR0: 719 case ENET_TCCR0: 720 case ENET_TCSR1: 721 case ENET_TCCR1: 722 case ENET_TCSR2: 723 case ENET_TCCR2: 724 case ENET_TCSR3: 725 case ENET_TCCR3: 726 return s->regs[index]; 727 default: 728 return imx_default_read(s, index); 729 } 730 } 731 732 static uint64_t imx_eth_read(void *opaque, hwaddr offset, unsigned size) 733 { 734 uint32_t value = 0; 735 IMXFECState *s = IMX_FEC(opaque); 736 uint32_t index = offset >> 2; 737 738 switch (index) { 739 case ENET_EIR: 740 case ENET_EIMR: 741 case ENET_RDAR: 742 case ENET_TDAR: 743 case ENET_ECR: 744 case ENET_MMFR: 745 case ENET_MSCR: 746 case ENET_MIBC: 747 case ENET_RCR: 748 case ENET_TCR: 749 case ENET_PALR: 750 case ENET_PAUR: 751 case ENET_OPD: 752 case ENET_IAUR: 753 case ENET_IALR: 754 case ENET_GAUR: 755 case ENET_GALR: 756 case ENET_TFWR: 757 case ENET_RDSR: 758 case ENET_TDSR: 759 case ENET_MRBR: 760 value = s->regs[index]; 761 break; 762 default: 763 if (s->is_fec) { 764 value = imx_fec_read(s, index); 765 } else { 766 value = imx_enet_read(s, index); 767 } 768 break; 769 } 770 771 FEC_PRINTF("reg[%s] => 0x%" PRIx32 "\n", imx_eth_reg_name(s, index), 772 value); 773 774 return value; 775 } 776 777 static void imx_default_write(IMXFECState *s, uint32_t index, uint32_t value) 778 { 779 qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Bad address at offset 0x%" 780 PRIx32 "\n", TYPE_IMX_FEC, __func__, index * 4); 781 return; 782 } 783 784 static void imx_fec_write(IMXFECState *s, uint32_t index, uint32_t value) 785 { 786 switch (index) { 787 case ENET_FRBR: 788 /* FRBR is read only */ 789 qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Register FRBR is read only\n", 790 TYPE_IMX_FEC, __func__); 791 break; 792 case ENET_FRSR: 793 s->regs[index] = (value & 0x000003fc) | 0x00000400; 794 break; 795 case ENET_MIIGSK_CFGR: 796 s->regs[index] = value & 0x00000053; 797 break; 798 case ENET_MIIGSK_ENR: 799 s->regs[index] = (value & 0x00000002) ? 0x00000006 : 0; 800 break; 801 default: 802 imx_default_write(s, index, value); 803 break; 804 } 805 } 806 807 static void imx_enet_write(IMXFECState *s, uint32_t index, uint32_t value) 808 { 809 switch (index) { 810 case ENET_RSFL: 811 case ENET_RSEM: 812 case ENET_RAEM: 813 case ENET_RAFL: 814 case ENET_TSEM: 815 case ENET_TAEM: 816 case ENET_TAFL: 817 s->regs[index] = value & 0x000001ff; 818 break; 819 case ENET_TIPG: 820 s->regs[index] = value & 0x0000001f; 821 break; 822 case ENET_FTRL: 823 s->regs[index] = value & 0x00003fff; 824 break; 825 case ENET_TACC: 826 s->regs[index] = value & 0x00000019; 827 break; 828 case ENET_RACC: 829 s->regs[index] = value & 0x000000C7; 830 break; 831 case ENET_ATCR: 832 s->regs[index] = value & 0x00002a9d; 833 break; 834 case ENET_ATVR: 835 case ENET_ATOFF: 836 case ENET_ATPER: 837 s->regs[index] = value; 838 break; 839 case ENET_ATSTMP: 840 /* ATSTMP is read only */ 841 qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Register ATSTMP is read only\n", 842 TYPE_IMX_FEC, __func__); 843 break; 844 case ENET_ATCOR: 845 s->regs[index] = value & 0x7fffffff; 846 break; 847 case ENET_ATINC: 848 s->regs[index] = value & 0x00007f7f; 849 break; 850 case ENET_TGSR: 851 /* implement clear timer flag */ 852 value = value & 0x0000000f; 853 break; 854 case ENET_TCSR0: 855 case ENET_TCSR1: 856 case ENET_TCSR2: 857 case ENET_TCSR3: 858 value = value & 0x000000fd; 859 break; 860 case ENET_TCCR0: 861 case ENET_TCCR1: 862 case ENET_TCCR2: 863 case ENET_TCCR3: 864 s->regs[index] = value; 865 break; 866 default: 867 imx_default_write(s, index, value); 868 break; 869 } 870 } 871 872 static void imx_eth_write(void *opaque, hwaddr offset, uint64_t value, 873 unsigned size) 874 { 875 IMXFECState *s = IMX_FEC(opaque); 876 const bool single_tx_ring = !imx_eth_is_multi_tx_ring(s); 877 uint32_t index = offset >> 2; 878 879 FEC_PRINTF("reg[%s] <= 0x%" PRIx32 "\n", imx_eth_reg_name(s, index), 880 (uint32_t)value); 881 882 switch (index) { 883 case ENET_EIR: 884 s->regs[index] &= ~value; 885 break; 886 case ENET_EIMR: 887 s->regs[index] = value; 888 break; 889 case ENET_RDAR: 890 if (s->regs[ENET_ECR] & ENET_ECR_ETHEREN) { 891 if (!s->regs[index]) { 892 imx_eth_enable_rx(s, true); 893 } 894 } else { 895 s->regs[index] = 0; 896 } 897 break; 898 case ENET_TDAR1: /* FALLTHROUGH */ 899 case ENET_TDAR2: /* FALLTHROUGH */ 900 if (unlikely(single_tx_ring)) { 901 qemu_log_mask(LOG_GUEST_ERROR, 902 "[%s]%s: trying to access TDAR2 or TDAR1\n", 903 TYPE_IMX_FEC, __func__); 904 return; 905 } 906 case ENET_TDAR: /* FALLTHROUGH */ 907 if (s->regs[ENET_ECR] & ENET_ECR_ETHEREN) { 908 s->regs[index] = ENET_TDAR_TDAR; 909 imx_eth_do_tx(s, index); 910 } 911 s->regs[index] = 0; 912 break; 913 case ENET_ECR: 914 if (value & ENET_ECR_RESET) { 915 return imx_eth_reset(DEVICE(s)); 916 } 917 s->regs[index] = value; 918 if ((s->regs[index] & ENET_ECR_ETHEREN) == 0) { 919 s->regs[ENET_RDAR] = 0; 920 s->rx_descriptor = s->regs[ENET_RDSR]; 921 s->regs[ENET_TDAR] = 0; 922 s->regs[ENET_TDAR1] = 0; 923 s->regs[ENET_TDAR2] = 0; 924 s->tx_descriptor[0] = s->regs[ENET_TDSR]; 925 s->tx_descriptor[1] = s->regs[ENET_TDSR1]; 926 s->tx_descriptor[2] = s->regs[ENET_TDSR2]; 927 } 928 break; 929 case ENET_MMFR: 930 s->regs[index] = value; 931 if (extract32(value, 29, 1)) { 932 /* This is a read operation */ 933 s->regs[ENET_MMFR] = deposit32(s->regs[ENET_MMFR], 0, 16, 934 do_phy_read(s, 935 extract32(value, 936 18, 10))); 937 } else { 938 /* This a write operation */ 939 do_phy_write(s, extract32(value, 18, 10), extract32(value, 0, 16)); 940 } 941 /* raise the interrupt as the PHY operation is done */ 942 s->regs[ENET_EIR] |= ENET_INT_MII; 943 break; 944 case ENET_MSCR: 945 s->regs[index] = value & 0xfe; 946 break; 947 case ENET_MIBC: 948 /* TODO: Implement MIB. */ 949 s->regs[index] = (value & 0x80000000) ? 0xc0000000 : 0; 950 break; 951 case ENET_RCR: 952 s->regs[index] = value & 0x07ff003f; 953 /* TODO: Implement LOOP mode. */ 954 break; 955 case ENET_TCR: 956 /* We transmit immediately, so raise GRA immediately. */ 957 s->regs[index] = value; 958 if (value & 1) { 959 s->regs[ENET_EIR] |= ENET_INT_GRA; 960 } 961 break; 962 case ENET_PALR: 963 s->regs[index] = value; 964 s->conf.macaddr.a[0] = value >> 24; 965 s->conf.macaddr.a[1] = value >> 16; 966 s->conf.macaddr.a[2] = value >> 8; 967 s->conf.macaddr.a[3] = value; 968 break; 969 case ENET_PAUR: 970 s->regs[index] = (value | 0x0000ffff) & 0xffff8808; 971 s->conf.macaddr.a[4] = value >> 24; 972 s->conf.macaddr.a[5] = value >> 16; 973 break; 974 case ENET_OPD: 975 s->regs[index] = (value & 0x0000ffff) | 0x00010000; 976 break; 977 case ENET_IAUR: 978 case ENET_IALR: 979 case ENET_GAUR: 980 case ENET_GALR: 981 /* TODO: implement MAC hash filtering. */ 982 break; 983 case ENET_TFWR: 984 if (s->is_fec) { 985 s->regs[index] = value & 0x3; 986 } else { 987 s->regs[index] = value & 0x13f; 988 } 989 break; 990 case ENET_RDSR: 991 if (s->is_fec) { 992 s->regs[index] = value & ~3; 993 } else { 994 s->regs[index] = value & ~7; 995 } 996 s->rx_descriptor = s->regs[index]; 997 break; 998 case ENET_TDSR: 999 if (s->is_fec) { 1000 s->regs[index] = value & ~3; 1001 } else { 1002 s->regs[index] = value & ~7; 1003 } 1004 s->tx_descriptor[0] = s->regs[index]; 1005 break; 1006 case ENET_TDSR1: 1007 if (unlikely(single_tx_ring)) { 1008 qemu_log_mask(LOG_GUEST_ERROR, 1009 "[%s]%s: trying to access TDSR1\n", 1010 TYPE_IMX_FEC, __func__); 1011 return; 1012 } 1013 1014 s->regs[index] = value & ~7; 1015 s->tx_descriptor[1] = s->regs[index]; 1016 break; 1017 case ENET_TDSR2: 1018 if (unlikely(single_tx_ring)) { 1019 qemu_log_mask(LOG_GUEST_ERROR, 1020 "[%s]%s: trying to access TDSR2\n", 1021 TYPE_IMX_FEC, __func__); 1022 return; 1023 } 1024 1025 s->regs[index] = value & ~7; 1026 s->tx_descriptor[2] = s->regs[index]; 1027 break; 1028 case ENET_MRBR: 1029 s->regs[index] = value & 0x00003ff0; 1030 break; 1031 default: 1032 if (s->is_fec) { 1033 imx_fec_write(s, index, value); 1034 } else { 1035 imx_enet_write(s, index, value); 1036 } 1037 return; 1038 } 1039 1040 imx_eth_update(s); 1041 } 1042 1043 static int imx_eth_can_receive(NetClientState *nc) 1044 { 1045 IMXFECState *s = IMX_FEC(qemu_get_nic_opaque(nc)); 1046 1047 FEC_PRINTF("\n"); 1048 1049 return !!s->regs[ENET_RDAR]; 1050 } 1051 1052 static ssize_t imx_fec_receive(NetClientState *nc, const uint8_t *buf, 1053 size_t len) 1054 { 1055 IMXFECState *s = IMX_FEC(qemu_get_nic_opaque(nc)); 1056 IMXFECBufDesc bd; 1057 uint32_t flags = 0; 1058 uint32_t addr; 1059 uint32_t crc; 1060 uint32_t buf_addr; 1061 uint8_t *crc_ptr; 1062 unsigned int buf_len; 1063 size_t size = len; 1064 1065 FEC_PRINTF("len %d\n", (int)size); 1066 1067 if (!s->regs[ENET_RDAR]) { 1068 qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Unexpected packet\n", 1069 TYPE_IMX_FEC, __func__); 1070 return 0; 1071 } 1072 1073 /* 4 bytes for the CRC. */ 1074 size += 4; 1075 crc = cpu_to_be32(crc32(~0, buf, size)); 1076 crc_ptr = (uint8_t *) &crc; 1077 1078 /* Huge frames are truncated. */ 1079 if (size > ENET_MAX_FRAME_SIZE) { 1080 size = ENET_MAX_FRAME_SIZE; 1081 flags |= ENET_BD_TR | ENET_BD_LG; 1082 } 1083 1084 /* Frames larger than the user limit just set error flags. */ 1085 if (size > (s->regs[ENET_RCR] >> 16)) { 1086 flags |= ENET_BD_LG; 1087 } 1088 1089 addr = s->rx_descriptor; 1090 while (size > 0) { 1091 imx_fec_read_bd(&bd, addr); 1092 if ((bd.flags & ENET_BD_E) == 0) { 1093 /* No descriptors available. Bail out. */ 1094 /* 1095 * FIXME: This is wrong. We should probably either 1096 * save the remainder for when more RX buffers are 1097 * available, or flag an error. 1098 */ 1099 qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Lost end of frame\n", 1100 TYPE_IMX_FEC, __func__); 1101 break; 1102 } 1103 buf_len = (size <= s->regs[ENET_MRBR]) ? size : s->regs[ENET_MRBR]; 1104 bd.length = buf_len; 1105 size -= buf_len; 1106 1107 FEC_PRINTF("rx_bd 0x%x length %d\n", addr, bd.length); 1108 1109 /* The last 4 bytes are the CRC. */ 1110 if (size < 4) { 1111 buf_len += size - 4; 1112 } 1113 buf_addr = bd.data; 1114 dma_memory_write(&address_space_memory, buf_addr, buf, buf_len); 1115 buf += buf_len; 1116 if (size < 4) { 1117 dma_memory_write(&address_space_memory, buf_addr + buf_len, 1118 crc_ptr, 4 - size); 1119 crc_ptr += 4 - size; 1120 } 1121 bd.flags &= ~ENET_BD_E; 1122 if (size == 0) { 1123 /* Last buffer in frame. */ 1124 bd.flags |= flags | ENET_BD_L; 1125 FEC_PRINTF("rx frame flags %04x\n", bd.flags); 1126 s->regs[ENET_EIR] |= ENET_INT_RXF; 1127 } else { 1128 s->regs[ENET_EIR] |= ENET_INT_RXB; 1129 } 1130 imx_fec_write_bd(&bd, addr); 1131 /* Advance to the next descriptor. */ 1132 if ((bd.flags & ENET_BD_W) != 0) { 1133 addr = s->regs[ENET_RDSR]; 1134 } else { 1135 addr += sizeof(bd); 1136 } 1137 } 1138 s->rx_descriptor = addr; 1139 imx_eth_enable_rx(s, false); 1140 imx_eth_update(s); 1141 return len; 1142 } 1143 1144 static ssize_t imx_enet_receive(NetClientState *nc, const uint8_t *buf, 1145 size_t len) 1146 { 1147 IMXFECState *s = IMX_FEC(qemu_get_nic_opaque(nc)); 1148 IMXENETBufDesc bd; 1149 uint32_t flags = 0; 1150 uint32_t addr; 1151 uint32_t crc; 1152 uint32_t buf_addr; 1153 uint8_t *crc_ptr; 1154 unsigned int buf_len; 1155 size_t size = len; 1156 bool shift16 = s->regs[ENET_RACC] & ENET_RACC_SHIFT16; 1157 1158 FEC_PRINTF("len %d\n", (int)size); 1159 1160 if (!s->regs[ENET_RDAR]) { 1161 qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Unexpected packet\n", 1162 TYPE_IMX_FEC, __func__); 1163 return 0; 1164 } 1165 1166 /* 4 bytes for the CRC. */ 1167 size += 4; 1168 crc = cpu_to_be32(crc32(~0, buf, size)); 1169 crc_ptr = (uint8_t *) &crc; 1170 1171 if (shift16) { 1172 size += 2; 1173 } 1174 1175 /* Huge frames are truncated. */ 1176 if (size > s->regs[ENET_FTRL]) { 1177 size = s->regs[ENET_FTRL]; 1178 flags |= ENET_BD_TR | ENET_BD_LG; 1179 } 1180 1181 /* Frames larger than the user limit just set error flags. */ 1182 if (size > (s->regs[ENET_RCR] >> 16)) { 1183 flags |= ENET_BD_LG; 1184 } 1185 1186 addr = s->rx_descriptor; 1187 while (size > 0) { 1188 imx_enet_read_bd(&bd, addr); 1189 if ((bd.flags & ENET_BD_E) == 0) { 1190 /* No descriptors available. Bail out. */ 1191 /* 1192 * FIXME: This is wrong. We should probably either 1193 * save the remainder for when more RX buffers are 1194 * available, or flag an error. 1195 */ 1196 qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Lost end of frame\n", 1197 TYPE_IMX_FEC, __func__); 1198 break; 1199 } 1200 buf_len = MIN(size, s->regs[ENET_MRBR]); 1201 bd.length = buf_len; 1202 size -= buf_len; 1203 1204 FEC_PRINTF("rx_bd 0x%x length %d\n", addr, bd.length); 1205 1206 /* The last 4 bytes are the CRC. */ 1207 if (size < 4) { 1208 buf_len += size - 4; 1209 } 1210 buf_addr = bd.data; 1211 1212 if (shift16) { 1213 /* 1214 * If SHIFT16 bit of ENETx_RACC register is set we need to 1215 * align the payload to 4-byte boundary. 1216 */ 1217 const uint8_t zeros[2] = { 0 }; 1218 1219 dma_memory_write(&address_space_memory, buf_addr, 1220 zeros, sizeof(zeros)); 1221 1222 buf_addr += sizeof(zeros); 1223 buf_len -= sizeof(zeros); 1224 1225 /* We only do this once per Ethernet frame */ 1226 shift16 = false; 1227 } 1228 1229 dma_memory_write(&address_space_memory, buf_addr, buf, buf_len); 1230 buf += buf_len; 1231 if (size < 4) { 1232 dma_memory_write(&address_space_memory, buf_addr + buf_len, 1233 crc_ptr, 4 - size); 1234 crc_ptr += 4 - size; 1235 } 1236 bd.flags &= ~ENET_BD_E; 1237 if (size == 0) { 1238 /* Last buffer in frame. */ 1239 bd.flags |= flags | ENET_BD_L; 1240 FEC_PRINTF("rx frame flags %04x\n", bd.flags); 1241 if (bd.option & ENET_BD_RX_INT) { 1242 s->regs[ENET_EIR] |= ENET_INT_RXF; 1243 } 1244 } else { 1245 if (bd.option & ENET_BD_RX_INT) { 1246 s->regs[ENET_EIR] |= ENET_INT_RXB; 1247 } 1248 } 1249 imx_enet_write_bd(&bd, addr); 1250 /* Advance to the next descriptor. */ 1251 if ((bd.flags & ENET_BD_W) != 0) { 1252 addr = s->regs[ENET_RDSR]; 1253 } else { 1254 addr += sizeof(bd); 1255 } 1256 } 1257 s->rx_descriptor = addr; 1258 imx_eth_enable_rx(s, false); 1259 imx_eth_update(s); 1260 return len; 1261 } 1262 1263 static ssize_t imx_eth_receive(NetClientState *nc, const uint8_t *buf, 1264 size_t len) 1265 { 1266 IMXFECState *s = IMX_FEC(qemu_get_nic_opaque(nc)); 1267 1268 if (!s->is_fec && (s->regs[ENET_ECR] & ENET_ECR_EN1588)) { 1269 return imx_enet_receive(nc, buf, len); 1270 } else { 1271 return imx_fec_receive(nc, buf, len); 1272 } 1273 } 1274 1275 static const MemoryRegionOps imx_eth_ops = { 1276 .read = imx_eth_read, 1277 .write = imx_eth_write, 1278 .valid.min_access_size = 4, 1279 .valid.max_access_size = 4, 1280 .endianness = DEVICE_NATIVE_ENDIAN, 1281 }; 1282 1283 static void imx_eth_cleanup(NetClientState *nc) 1284 { 1285 IMXFECState *s = IMX_FEC(qemu_get_nic_opaque(nc)); 1286 1287 s->nic = NULL; 1288 } 1289 1290 static NetClientInfo imx_eth_net_info = { 1291 .type = NET_CLIENT_DRIVER_NIC, 1292 .size = sizeof(NICState), 1293 .can_receive = imx_eth_can_receive, 1294 .receive = imx_eth_receive, 1295 .cleanup = imx_eth_cleanup, 1296 .link_status_changed = imx_eth_set_link, 1297 }; 1298 1299 1300 static void imx_eth_realize(DeviceState *dev, Error **errp) 1301 { 1302 IMXFECState *s = IMX_FEC(dev); 1303 SysBusDevice *sbd = SYS_BUS_DEVICE(dev); 1304 1305 memory_region_init_io(&s->iomem, OBJECT(dev), &imx_eth_ops, s, 1306 TYPE_IMX_FEC, FSL_IMX25_FEC_SIZE); 1307 sysbus_init_mmio(sbd, &s->iomem); 1308 sysbus_init_irq(sbd, &s->irq[0]); 1309 sysbus_init_irq(sbd, &s->irq[1]); 1310 1311 qemu_macaddr_default_if_unset(&s->conf.macaddr); 1312 1313 s->nic = qemu_new_nic(&imx_eth_net_info, &s->conf, 1314 object_get_typename(OBJECT(dev)), 1315 DEVICE(dev)->id, s); 1316 1317 qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a); 1318 } 1319 1320 static Property imx_eth_properties[] = { 1321 DEFINE_NIC_PROPERTIES(IMXFECState, conf), 1322 DEFINE_PROP_UINT32("tx-ring-num", IMXFECState, tx_ring_num, 1), 1323 DEFINE_PROP_END_OF_LIST(), 1324 }; 1325 1326 static void imx_eth_class_init(ObjectClass *klass, void *data) 1327 { 1328 DeviceClass *dc = DEVICE_CLASS(klass); 1329 1330 dc->vmsd = &vmstate_imx_eth; 1331 dc->reset = imx_eth_reset; 1332 dc->props = imx_eth_properties; 1333 dc->realize = imx_eth_realize; 1334 dc->desc = "i.MX FEC/ENET Ethernet Controller"; 1335 } 1336 1337 static void imx_fec_init(Object *obj) 1338 { 1339 IMXFECState *s = IMX_FEC(obj); 1340 1341 s->is_fec = true; 1342 } 1343 1344 static void imx_enet_init(Object *obj) 1345 { 1346 IMXFECState *s = IMX_FEC(obj); 1347 1348 s->is_fec = false; 1349 } 1350 1351 static const TypeInfo imx_fec_info = { 1352 .name = TYPE_IMX_FEC, 1353 .parent = TYPE_SYS_BUS_DEVICE, 1354 .instance_size = sizeof(IMXFECState), 1355 .instance_init = imx_fec_init, 1356 .class_init = imx_eth_class_init, 1357 }; 1358 1359 static const TypeInfo imx_enet_info = { 1360 .name = TYPE_IMX_ENET, 1361 .parent = TYPE_IMX_FEC, 1362 .instance_init = imx_enet_init, 1363 }; 1364 1365 static void imx_eth_register_types(void) 1366 { 1367 type_register_static(&imx_fec_info); 1368 type_register_static(&imx_enet_info); 1369 } 1370 1371 type_init(imx_eth_register_types) 1372