1 /* 2 * ColdFire Fast Ethernet Controller emulation. 3 * 4 * Copyright (c) 2007 CodeSourcery. 5 * 6 * This code is licensed under the GPL 7 */ 8 #include "qemu/osdep.h" 9 #include "hw/hw.h" 10 #include "net/net.h" 11 #include "hw/m68k/mcf.h" 12 #include "hw/net/mii.h" 13 /* For crc32 */ 14 #include <zlib.h> 15 #include "exec/address-spaces.h" 16 17 //#define DEBUG_FEC 1 18 19 #ifdef DEBUG_FEC 20 #define DPRINTF(fmt, ...) \ 21 do { printf("mcf_fec: " fmt , ## __VA_ARGS__); } while (0) 22 #else 23 #define DPRINTF(fmt, ...) do {} while(0) 24 #endif 25 26 #define FEC_MAX_FRAME_SIZE 2032 27 28 typedef struct { 29 MemoryRegion *sysmem; 30 MemoryRegion iomem; 31 qemu_irq *irq; 32 NICState *nic; 33 NICConf conf; 34 uint32_t irq_state; 35 uint32_t eir; 36 uint32_t eimr; 37 int rx_enabled; 38 uint32_t rx_descriptor; 39 uint32_t tx_descriptor; 40 uint32_t ecr; 41 uint32_t mmfr; 42 uint32_t mscr; 43 uint32_t rcr; 44 uint32_t tcr; 45 uint32_t tfwr; 46 uint32_t rfsr; 47 uint32_t erdsr; 48 uint32_t etdsr; 49 uint32_t emrbr; 50 } mcf_fec_state; 51 52 #define FEC_INT_HB 0x80000000 53 #define FEC_INT_BABR 0x40000000 54 #define FEC_INT_BABT 0x20000000 55 #define FEC_INT_GRA 0x10000000 56 #define FEC_INT_TXF 0x08000000 57 #define FEC_INT_TXB 0x04000000 58 #define FEC_INT_RXF 0x02000000 59 #define FEC_INT_RXB 0x01000000 60 #define FEC_INT_MII 0x00800000 61 #define FEC_INT_EB 0x00400000 62 #define FEC_INT_LC 0x00200000 63 #define FEC_INT_RL 0x00100000 64 #define FEC_INT_UN 0x00080000 65 66 #define FEC_EN 2 67 #define FEC_RESET 1 68 69 /* Map interrupt flags onto IRQ lines. */ 70 #define FEC_NUM_IRQ 13 71 static const uint32_t mcf_fec_irq_map[FEC_NUM_IRQ] = { 72 FEC_INT_TXF, 73 FEC_INT_TXB, 74 FEC_INT_UN, 75 FEC_INT_RL, 76 FEC_INT_RXF, 77 FEC_INT_RXB, 78 FEC_INT_MII, 79 FEC_INT_LC, 80 FEC_INT_HB, 81 FEC_INT_GRA, 82 FEC_INT_EB, 83 FEC_INT_BABT, 84 FEC_INT_BABR 85 }; 86 87 /* Buffer Descriptor. */ 88 typedef struct { 89 uint16_t flags; 90 uint16_t length; 91 uint32_t data; 92 } mcf_fec_bd; 93 94 #define FEC_BD_R 0x8000 95 #define FEC_BD_E 0x8000 96 #define FEC_BD_O1 0x4000 97 #define FEC_BD_W 0x2000 98 #define FEC_BD_O2 0x1000 99 #define FEC_BD_L 0x0800 100 #define FEC_BD_TC 0x0400 101 #define FEC_BD_ABC 0x0200 102 #define FEC_BD_M 0x0100 103 #define FEC_BD_BC 0x0080 104 #define FEC_BD_MC 0x0040 105 #define FEC_BD_LG 0x0020 106 #define FEC_BD_NO 0x0010 107 #define FEC_BD_CR 0x0004 108 #define FEC_BD_OV 0x0002 109 #define FEC_BD_TR 0x0001 110 111 static void mcf_fec_read_bd(mcf_fec_bd *bd, uint32_t addr) 112 { 113 cpu_physical_memory_read(addr, bd, sizeof(*bd)); 114 be16_to_cpus(&bd->flags); 115 be16_to_cpus(&bd->length); 116 be32_to_cpus(&bd->data); 117 } 118 119 static void mcf_fec_write_bd(mcf_fec_bd *bd, uint32_t addr) 120 { 121 mcf_fec_bd tmp; 122 tmp.flags = cpu_to_be16(bd->flags); 123 tmp.length = cpu_to_be16(bd->length); 124 tmp.data = cpu_to_be32(bd->data); 125 cpu_physical_memory_write(addr, &tmp, sizeof(tmp)); 126 } 127 128 static void mcf_fec_update(mcf_fec_state *s) 129 { 130 uint32_t active; 131 uint32_t changed; 132 uint32_t mask; 133 int i; 134 135 active = s->eir & s->eimr; 136 changed = active ^s->irq_state; 137 for (i = 0; i < FEC_NUM_IRQ; i++) { 138 mask = mcf_fec_irq_map[i]; 139 if (changed & mask) { 140 DPRINTF("IRQ %d = %d\n", i, (active & mask) != 0); 141 qemu_set_irq(s->irq[i], (active & mask) != 0); 142 } 143 } 144 s->irq_state = active; 145 } 146 147 static void mcf_fec_do_tx(mcf_fec_state *s) 148 { 149 uint32_t addr; 150 mcf_fec_bd bd; 151 int frame_size; 152 int len; 153 uint8_t frame[FEC_MAX_FRAME_SIZE]; 154 uint8_t *ptr; 155 156 DPRINTF("do_tx\n"); 157 ptr = frame; 158 frame_size = 0; 159 addr = s->tx_descriptor; 160 while (1) { 161 mcf_fec_read_bd(&bd, addr); 162 DPRINTF("tx_bd %x flags %04x len %d data %08x\n", 163 addr, bd.flags, bd.length, bd.data); 164 if ((bd.flags & FEC_BD_R) == 0) { 165 /* Run out of descriptors to transmit. */ 166 break; 167 } 168 len = bd.length; 169 if (frame_size + len > FEC_MAX_FRAME_SIZE) { 170 len = FEC_MAX_FRAME_SIZE - frame_size; 171 s->eir |= FEC_INT_BABT; 172 } 173 cpu_physical_memory_read(bd.data, ptr, len); 174 ptr += len; 175 frame_size += len; 176 if (bd.flags & FEC_BD_L) { 177 /* Last buffer in frame. */ 178 DPRINTF("Sending packet\n"); 179 qemu_send_packet(qemu_get_queue(s->nic), frame, len); 180 ptr = frame; 181 frame_size = 0; 182 s->eir |= FEC_INT_TXF; 183 } 184 s->eir |= FEC_INT_TXB; 185 bd.flags &= ~FEC_BD_R; 186 /* Write back the modified descriptor. */ 187 mcf_fec_write_bd(&bd, addr); 188 /* Advance to the next descriptor. */ 189 if ((bd.flags & FEC_BD_W) != 0) { 190 addr = s->etdsr; 191 } else { 192 addr += 8; 193 } 194 } 195 s->tx_descriptor = addr; 196 } 197 198 static void mcf_fec_enable_rx(mcf_fec_state *s) 199 { 200 NetClientState *nc = qemu_get_queue(s->nic); 201 mcf_fec_bd bd; 202 203 mcf_fec_read_bd(&bd, s->rx_descriptor); 204 s->rx_enabled = ((bd.flags & FEC_BD_E) != 0); 205 if (s->rx_enabled) { 206 qemu_flush_queued_packets(nc); 207 } 208 } 209 210 static void mcf_fec_reset(mcf_fec_state *s) 211 { 212 s->eir = 0; 213 s->eimr = 0; 214 s->rx_enabled = 0; 215 s->ecr = 0; 216 s->mscr = 0; 217 s->rcr = 0x05ee0001; 218 s->tcr = 0; 219 s->tfwr = 0; 220 s->rfsr = 0x500; 221 } 222 223 #define MMFR_WRITE_OP (1 << 28) 224 #define MMFR_READ_OP (2 << 28) 225 #define MMFR_PHYADDR(v) (((v) >> 23) & 0x1f) 226 #define MMFR_REGNUM(v) (((v) >> 18) & 0x1f) 227 228 static uint64_t mcf_fec_read_mdio(mcf_fec_state *s) 229 { 230 uint64_t v; 231 232 if (s->mmfr & MMFR_WRITE_OP) 233 return s->mmfr; 234 if (MMFR_PHYADDR(s->mmfr) != 1) 235 return s->mmfr |= 0xffff; 236 237 switch (MMFR_REGNUM(s->mmfr)) { 238 case MII_BMCR: 239 v = MII_BMCR_SPEED | MII_BMCR_AUTOEN | MII_BMCR_FD; 240 break; 241 case MII_BMSR: 242 v = MII_BMSR_100TX_FD | MII_BMSR_100TX_HD | MII_BMSR_10T_FD | 243 MII_BMSR_10T_HD | MII_BMSR_MFPS | MII_BMSR_AN_COMP | 244 MII_BMSR_AUTONEG | MII_BMSR_LINK_ST; 245 break; 246 case MII_PHYID1: 247 v = DP83848_PHYID1; 248 break; 249 case MII_PHYID2: 250 v = DP83848_PHYID2; 251 break; 252 case MII_ANAR: 253 v = MII_ANAR_TXFD | MII_ANAR_TX | MII_ANAR_10FD | 254 MII_ANAR_10 | MII_ANAR_CSMACD; 255 break; 256 case MII_ANLPAR: 257 v = MII_ANLPAR_ACK | MII_ANLPAR_TXFD | MII_ANLPAR_TX | 258 MII_ANLPAR_10FD | MII_ANLPAR_10 | MII_ANLPAR_CSMACD; 259 break; 260 default: 261 v = 0xffff; 262 break; 263 } 264 s->mmfr = (s->mmfr & ~0xffff) | v; 265 return s->mmfr; 266 } 267 268 static uint64_t mcf_fec_read(void *opaque, hwaddr addr, 269 unsigned size) 270 { 271 mcf_fec_state *s = (mcf_fec_state *)opaque; 272 switch (addr & 0x3ff) { 273 case 0x004: return s->eir; 274 case 0x008: return s->eimr; 275 case 0x010: return s->rx_enabled ? (1 << 24) : 0; /* RDAR */ 276 case 0x014: return 0; /* TDAR */ 277 case 0x024: return s->ecr; 278 case 0x040: return mcf_fec_read_mdio(s); 279 case 0x044: return s->mscr; 280 case 0x064: return 0; /* MIBC */ 281 case 0x084: return s->rcr; 282 case 0x0c4: return s->tcr; 283 case 0x0e4: /* PALR */ 284 return (s->conf.macaddr.a[0] << 24) | (s->conf.macaddr.a[1] << 16) 285 | (s->conf.macaddr.a[2] << 8) | s->conf.macaddr.a[3]; 286 break; 287 case 0x0e8: /* PAUR */ 288 return (s->conf.macaddr.a[4] << 24) | (s->conf.macaddr.a[5] << 16) | 0x8808; 289 case 0x0ec: return 0x10000; /* OPD */ 290 case 0x118: return 0; 291 case 0x11c: return 0; 292 case 0x120: return 0; 293 case 0x124: return 0; 294 case 0x144: return s->tfwr; 295 case 0x14c: return 0x600; 296 case 0x150: return s->rfsr; 297 case 0x180: return s->erdsr; 298 case 0x184: return s->etdsr; 299 case 0x188: return s->emrbr; 300 default: 301 hw_error("mcf_fec_read: Bad address 0x%x\n", (int)addr); 302 return 0; 303 } 304 } 305 306 static void mcf_fec_write(void *opaque, hwaddr addr, 307 uint64_t value, unsigned size) 308 { 309 mcf_fec_state *s = (mcf_fec_state *)opaque; 310 switch (addr & 0x3ff) { 311 case 0x004: 312 s->eir &= ~value; 313 break; 314 case 0x008: 315 s->eimr = value; 316 break; 317 case 0x010: /* RDAR */ 318 if ((s->ecr & FEC_EN) && !s->rx_enabled) { 319 DPRINTF("RX enable\n"); 320 mcf_fec_enable_rx(s); 321 } 322 break; 323 case 0x014: /* TDAR */ 324 if (s->ecr & FEC_EN) { 325 mcf_fec_do_tx(s); 326 } 327 break; 328 case 0x024: 329 s->ecr = value; 330 if (value & FEC_RESET) { 331 DPRINTF("Reset\n"); 332 mcf_fec_reset(s); 333 } 334 if ((s->ecr & FEC_EN) == 0) { 335 s->rx_enabled = 0; 336 } 337 break; 338 case 0x040: 339 s->mmfr = value; 340 s->eir |= FEC_INT_MII; 341 break; 342 case 0x044: 343 s->mscr = value & 0xfe; 344 break; 345 case 0x064: 346 /* TODO: Implement MIB. */ 347 break; 348 case 0x084: 349 s->rcr = value & 0x07ff003f; 350 /* TODO: Implement LOOP mode. */ 351 break; 352 case 0x0c4: /* TCR */ 353 /* We transmit immediately, so raise GRA immediately. */ 354 s->tcr = value; 355 if (value & 1) 356 s->eir |= FEC_INT_GRA; 357 break; 358 case 0x0e4: /* PALR */ 359 s->conf.macaddr.a[0] = value >> 24; 360 s->conf.macaddr.a[1] = value >> 16; 361 s->conf.macaddr.a[2] = value >> 8; 362 s->conf.macaddr.a[3] = value; 363 break; 364 case 0x0e8: /* PAUR */ 365 s->conf.macaddr.a[4] = value >> 24; 366 s->conf.macaddr.a[5] = value >> 16; 367 break; 368 case 0x0ec: 369 /* OPD */ 370 break; 371 case 0x118: 372 case 0x11c: 373 case 0x120: 374 case 0x124: 375 /* TODO: implement MAC hash filtering. */ 376 break; 377 case 0x144: 378 s->tfwr = value & 3; 379 break; 380 case 0x14c: 381 /* FRBR writes ignored. */ 382 break; 383 case 0x150: 384 s->rfsr = (value & 0x3fc) | 0x400; 385 break; 386 case 0x180: 387 s->erdsr = value & ~3; 388 s->rx_descriptor = s->erdsr; 389 break; 390 case 0x184: 391 s->etdsr = value & ~3; 392 s->tx_descriptor = s->etdsr; 393 break; 394 case 0x188: 395 s->emrbr = value & 0x7f0; 396 break; 397 default: 398 hw_error("mcf_fec_write Bad address 0x%x\n", (int)addr); 399 } 400 mcf_fec_update(s); 401 } 402 403 static int mcf_fec_have_receive_space(mcf_fec_state *s, size_t want) 404 { 405 mcf_fec_bd bd; 406 uint32_t addr; 407 408 /* Walk descriptor list to determine if we have enough buffer */ 409 addr = s->rx_descriptor; 410 while (want > 0) { 411 mcf_fec_read_bd(&bd, addr); 412 if ((bd.flags & FEC_BD_E) == 0) { 413 return 0; 414 } 415 if (want < s->emrbr) { 416 return 1; 417 } 418 want -= s->emrbr; 419 /* Advance to the next descriptor. */ 420 if ((bd.flags & FEC_BD_W) != 0) { 421 addr = s->erdsr; 422 } else { 423 addr += 8; 424 } 425 } 426 return 0; 427 } 428 429 static ssize_t mcf_fec_receive(NetClientState *nc, const uint8_t *buf, size_t size) 430 { 431 mcf_fec_state *s = qemu_get_nic_opaque(nc); 432 mcf_fec_bd bd; 433 uint32_t flags = 0; 434 uint32_t addr; 435 uint32_t crc; 436 uint32_t buf_addr; 437 uint8_t *crc_ptr; 438 unsigned int buf_len; 439 size_t retsize; 440 441 DPRINTF("do_rx len %d\n", size); 442 if (!s->rx_enabled) { 443 return -1; 444 } 445 /* 4 bytes for the CRC. */ 446 size += 4; 447 crc = cpu_to_be32(crc32(~0, buf, size)); 448 crc_ptr = (uint8_t *)&crc; 449 /* Huge frames are truncted. */ 450 if (size > FEC_MAX_FRAME_SIZE) { 451 size = FEC_MAX_FRAME_SIZE; 452 flags |= FEC_BD_TR | FEC_BD_LG; 453 } 454 /* Frames larger than the user limit just set error flags. */ 455 if (size > (s->rcr >> 16)) { 456 flags |= FEC_BD_LG; 457 } 458 /* Check if we have enough space in current descriptors */ 459 if (!mcf_fec_have_receive_space(s, size)) { 460 return 0; 461 } 462 addr = s->rx_descriptor; 463 retsize = size; 464 while (size > 0) { 465 mcf_fec_read_bd(&bd, addr); 466 buf_len = (size <= s->emrbr) ? size: s->emrbr; 467 bd.length = buf_len; 468 size -= buf_len; 469 DPRINTF("rx_bd %x length %d\n", addr, bd.length); 470 /* The last 4 bytes are the CRC. */ 471 if (size < 4) 472 buf_len += size - 4; 473 buf_addr = bd.data; 474 cpu_physical_memory_write(buf_addr, buf, buf_len); 475 buf += buf_len; 476 if (size < 4) { 477 cpu_physical_memory_write(buf_addr + buf_len, crc_ptr, 4 - size); 478 crc_ptr += 4 - size; 479 } 480 bd.flags &= ~FEC_BD_E; 481 if (size == 0) { 482 /* Last buffer in frame. */ 483 bd.flags |= flags | FEC_BD_L; 484 DPRINTF("rx frame flags %04x\n", bd.flags); 485 s->eir |= FEC_INT_RXF; 486 } else { 487 s->eir |= FEC_INT_RXB; 488 } 489 mcf_fec_write_bd(&bd, addr); 490 /* Advance to the next descriptor. */ 491 if ((bd.flags & FEC_BD_W) != 0) { 492 addr = s->erdsr; 493 } else { 494 addr += 8; 495 } 496 } 497 s->rx_descriptor = addr; 498 mcf_fec_enable_rx(s); 499 mcf_fec_update(s); 500 return retsize; 501 } 502 503 static const MemoryRegionOps mcf_fec_ops = { 504 .read = mcf_fec_read, 505 .write = mcf_fec_write, 506 .endianness = DEVICE_NATIVE_ENDIAN, 507 }; 508 509 static NetClientInfo net_mcf_fec_info = { 510 .type = NET_CLIENT_OPTIONS_KIND_NIC, 511 .size = sizeof(NICState), 512 .receive = mcf_fec_receive, 513 }; 514 515 void mcf_fec_init(MemoryRegion *sysmem, NICInfo *nd, 516 hwaddr base, qemu_irq *irq) 517 { 518 mcf_fec_state *s; 519 520 qemu_check_nic_model(nd, "mcf_fec"); 521 522 s = (mcf_fec_state *)g_malloc0(sizeof(mcf_fec_state)); 523 s->sysmem = sysmem; 524 s->irq = irq; 525 526 memory_region_init_io(&s->iomem, NULL, &mcf_fec_ops, s, "fec", 0x400); 527 memory_region_add_subregion(sysmem, base, &s->iomem); 528 529 s->conf.macaddr = nd->macaddr; 530 s->conf.peers.ncs[0] = nd->netdev; 531 532 s->nic = qemu_new_nic(&net_mcf_fec_info, &s->conf, nd->model, nd->name, s); 533 534 qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a); 535 } 536