1 /* 2 * QEMU model of SUN GEM ethernet controller 3 * 4 * As found in Apple ASICs among others 5 * 6 * Copyright 2016 Ben Herrenschmidt 7 * Copyright 2017 Mark Cave-Ayland 8 */ 9 10 #include "qemu/osdep.h" 11 #include "hw/pci/pci.h" 12 #include "qemu/log.h" 13 #include "net/net.h" 14 #include "net/eth.h" 15 #include "net/checksum.h" 16 #include "hw/net/mii.h" 17 #include "sysemu/sysemu.h" 18 #include "trace.h" 19 20 #define TYPE_SUNGEM "sungem" 21 22 #define SUNGEM(obj) OBJECT_CHECK(SunGEMState, (obj), TYPE_SUNGEM) 23 24 #define MAX_PACKET_SIZE 9016 25 26 #define SUNGEM_MMIO_SIZE 0x200000 27 28 /* Global registers */ 29 #define SUNGEM_MMIO_GREG_SIZE 0x2000 30 31 #define GREG_SEBSTATE 0x0000UL /* SEB State Register */ 32 33 #define GREG_STAT 0x000CUL /* Status Register */ 34 #define GREG_STAT_TXINTME 0x00000001 /* TX INTME frame transferred */ 35 #define GREG_STAT_TXALL 0x00000002 /* All TX frames transferred */ 36 #define GREG_STAT_TXDONE 0x00000004 /* One TX frame transferred */ 37 #define GREG_STAT_RXDONE 0x00000010 /* One RX frame arrived */ 38 #define GREG_STAT_RXNOBUF 0x00000020 /* No free RX buffers available */ 39 #define GREG_STAT_RXTAGERR 0x00000040 /* RX tag framing is corrupt */ 40 #define GREG_STAT_TXMAC 0x00004000 /* TX MAC signalled interrupt */ 41 #define GREG_STAT_RXMAC 0x00008000 /* RX MAC signalled interrupt */ 42 #define GREG_STAT_MAC 0x00010000 /* MAC Control signalled irq */ 43 #define GREG_STAT_TXNR 0xfff80000 /* == TXDMA_TXDONE reg val */ 44 #define GREG_STAT_TXNR_SHIFT 19 45 46 /* These interrupts are edge latches in the status register, 47 * reading it (or writing the corresponding bit in IACK) will 48 * clear them 49 */ 50 #define GREG_STAT_LATCH (GREG_STAT_TXALL | GREG_STAT_TXINTME | \ 51 GREG_STAT_RXDONE | GREG_STAT_RXDONE | \ 52 GREG_STAT_RXNOBUF | GREG_STAT_RXTAGERR) 53 54 #define GREG_IMASK 0x0010UL /* Interrupt Mask Register */ 55 #define GREG_IACK 0x0014UL /* Interrupt ACK Register */ 56 #define GREG_STAT2 0x001CUL /* Alias of GREG_STAT */ 57 #define GREG_PCIESTAT 0x1000UL /* PCI Error Status Register */ 58 #define GREG_PCIEMASK 0x1004UL /* PCI Error Mask Register */ 59 60 #define GREG_SWRST 0x1010UL /* Software Reset Register */ 61 #define GREG_SWRST_TXRST 0x00000001 /* TX Software Reset */ 62 #define GREG_SWRST_RXRST 0x00000002 /* RX Software Reset */ 63 #define GREG_SWRST_RSTOUT 0x00000004 /* Force RST# pin active */ 64 65 /* TX DMA Registers */ 66 #define SUNGEM_MMIO_TXDMA_SIZE 0x1000 67 68 #define TXDMA_KICK 0x0000UL /* TX Kick Register */ 69 70 #define TXDMA_CFG 0x0004UL /* TX Configuration Register */ 71 #define TXDMA_CFG_ENABLE 0x00000001 /* Enable TX DMA channel */ 72 #define TXDMA_CFG_RINGSZ 0x0000001e /* TX descriptor ring size */ 73 74 #define TXDMA_DBLOW 0x0008UL /* TX Desc. Base Low */ 75 #define TXDMA_DBHI 0x000CUL /* TX Desc. Base High */ 76 #define TXDMA_PCNT 0x0024UL /* TX FIFO Packet Counter */ 77 #define TXDMA_SMACHINE 0x0028UL /* TX State Machine Register */ 78 #define TXDMA_DPLOW 0x0030UL /* TX Data Pointer Low */ 79 #define TXDMA_DPHI 0x0034UL /* TX Data Pointer High */ 80 #define TXDMA_TXDONE 0x0100UL /* TX Completion Register */ 81 #define TXDMA_FTAG 0x0108UL /* TX FIFO Tag */ 82 #define TXDMA_FSZ 0x0118UL /* TX FIFO Size */ 83 84 /* Receive DMA Registers */ 85 #define SUNGEM_MMIO_RXDMA_SIZE 0x2000 86 87 #define RXDMA_CFG 0x0000UL /* RX Configuration Register */ 88 #define RXDMA_CFG_ENABLE 0x00000001 /* Enable RX DMA channel */ 89 #define RXDMA_CFG_RINGSZ 0x0000001e /* RX descriptor ring size */ 90 #define RXDMA_CFG_FBOFF 0x00001c00 /* Offset of first data byte */ 91 #define RXDMA_CFG_CSUMOFF 0x000fe000 /* Skip bytes before csum calc */ 92 93 #define RXDMA_DBLOW 0x0004UL /* RX Descriptor Base Low */ 94 #define RXDMA_DBHI 0x0008UL /* RX Descriptor Base High */ 95 #define RXDMA_PCNT 0x0018UL /* RX FIFO Packet Counter */ 96 #define RXDMA_SMACHINE 0x001CUL /* RX State Machine Register */ 97 #define RXDMA_PTHRESH 0x0020UL /* Pause Thresholds */ 98 #define RXDMA_DPLOW 0x0024UL /* RX Data Pointer Low */ 99 #define RXDMA_DPHI 0x0028UL /* RX Data Pointer High */ 100 #define RXDMA_KICK 0x0100UL /* RX Kick Register */ 101 #define RXDMA_DONE 0x0104UL /* RX Completion Register */ 102 #define RXDMA_BLANK 0x0108UL /* RX Blanking Register */ 103 #define RXDMA_FTAG 0x0110UL /* RX FIFO Tag */ 104 #define RXDMA_FSZ 0x0120UL /* RX FIFO Size */ 105 106 /* MAC Registers */ 107 #define SUNGEM_MMIO_MAC_SIZE 0x200 108 109 #define MAC_TXRST 0x0000UL /* TX MAC Software Reset Command */ 110 #define MAC_RXRST 0x0004UL /* RX MAC Software Reset Command */ 111 #define MAC_TXSTAT 0x0010UL /* TX MAC Status Register */ 112 #define MAC_RXSTAT 0x0014UL /* RX MAC Status Register */ 113 114 #define MAC_CSTAT 0x0018UL /* MAC Control Status Register */ 115 #define MAC_CSTAT_PTR 0xffff0000 /* Pause Time Received */ 116 117 #define MAC_TXMASK 0x0020UL /* TX MAC Mask Register */ 118 #define MAC_RXMASK 0x0024UL /* RX MAC Mask Register */ 119 #define MAC_MCMASK 0x0028UL /* MAC Control Mask Register */ 120 121 #define MAC_TXCFG 0x0030UL /* TX MAC Configuration Register */ 122 #define MAC_TXCFG_ENAB 0x00000001 /* TX MAC Enable */ 123 124 #define MAC_RXCFG 0x0034UL /* RX MAC Configuration Register */ 125 #define MAC_RXCFG_ENAB 0x00000001 /* RX MAC Enable */ 126 #define MAC_RXCFG_SFCS 0x00000004 /* Strip FCS */ 127 #define MAC_RXCFG_PROM 0x00000008 /* Promiscuous Mode */ 128 #define MAC_RXCFG_PGRP 0x00000010 /* Promiscuous Group */ 129 #define MAC_RXCFG_HFE 0x00000020 /* Hash Filter Enable */ 130 131 #define MAC_XIFCFG 0x003CUL /* XIF Configuration Register */ 132 #define MAC_XIFCFG_LBCK 0x00000002 /* Loopback TX to RX */ 133 134 #define MAC_MINFSZ 0x0050UL /* MinFrameSize Register */ 135 #define MAC_MAXFSZ 0x0054UL /* MaxFrameSize Register */ 136 #define MAC_ADDR0 0x0080UL /* MAC Address 0 Register */ 137 #define MAC_ADDR1 0x0084UL /* MAC Address 1 Register */ 138 #define MAC_ADDR2 0x0088UL /* MAC Address 2 Register */ 139 #define MAC_ADDR3 0x008CUL /* MAC Address 3 Register */ 140 #define MAC_ADDR4 0x0090UL /* MAC Address 4 Register */ 141 #define MAC_ADDR5 0x0094UL /* MAC Address 5 Register */ 142 #define MAC_HASH0 0x00C0UL /* Hash Table 0 Register */ 143 #define MAC_PATMPS 0x0114UL /* Peak Attempts Register */ 144 #define MAC_SMACHINE 0x0134UL /* State Machine Register */ 145 146 /* MIF Registers */ 147 #define SUNGEM_MMIO_MIF_SIZE 0x20 148 149 #define MIF_FRAME 0x000CUL /* MIF Frame/Output Register */ 150 #define MIF_FRAME_OP 0x30000000 /* OPcode */ 151 #define MIF_FRAME_PHYAD 0x0f800000 /* PHY ADdress */ 152 #define MIF_FRAME_REGAD 0x007c0000 /* REGister ADdress */ 153 #define MIF_FRAME_TALSB 0x00010000 /* Turn Around LSB */ 154 #define MIF_FRAME_DATA 0x0000ffff /* Instruction Payload */ 155 156 #define MIF_CFG 0x0010UL /* MIF Configuration Register */ 157 #define MIF_CFG_MDI0 0x00000100 /* MDIO_0 present or read-bit */ 158 #define MIF_CFG_MDI1 0x00000200 /* MDIO_1 present or read-bit */ 159 160 #define MIF_STATUS 0x0018UL /* MIF Status Register */ 161 #define MIF_SMACHINE 0x001CUL /* MIF State Machine Register */ 162 163 /* PCS/Serialink Registers */ 164 #define SUNGEM_MMIO_PCS_SIZE 0x60 165 #define PCS_MIISTAT 0x0004UL /* PCS MII Status Register */ 166 #define PCS_ISTAT 0x0018UL /* PCS Interrupt Status Reg */ 167 #define PCS_SSTATE 0x005CUL /* Serialink State Register */ 168 169 /* Descriptors */ 170 struct gem_txd { 171 uint64_t control_word; 172 uint64_t buffer; 173 }; 174 175 #define TXDCTRL_BUFSZ 0x0000000000007fffULL /* Buffer Size */ 176 #define TXDCTRL_CSTART 0x00000000001f8000ULL /* CSUM Start Offset */ 177 #define TXDCTRL_COFF 0x000000001fe00000ULL /* CSUM Stuff Offset */ 178 #define TXDCTRL_CENAB 0x0000000020000000ULL /* CSUM Enable */ 179 #define TXDCTRL_EOF 0x0000000040000000ULL /* End of Frame */ 180 #define TXDCTRL_SOF 0x0000000080000000ULL /* Start of Frame */ 181 #define TXDCTRL_INTME 0x0000000100000000ULL /* "Interrupt Me" */ 182 183 struct gem_rxd { 184 uint64_t status_word; 185 uint64_t buffer; 186 }; 187 188 #define RXDCTRL_HPASS 0x1000000000000000ULL /* Passed Hash Filter */ 189 #define RXDCTRL_ALTMAC 0x2000000000000000ULL /* Matched ALT MAC */ 190 191 192 typedef struct { 193 PCIDevice pdev; 194 195 MemoryRegion sungem; 196 MemoryRegion greg; 197 MemoryRegion txdma; 198 MemoryRegion rxdma; 199 MemoryRegion mac; 200 MemoryRegion mif; 201 MemoryRegion pcs; 202 NICState *nic; 203 NICConf conf; 204 uint32_t phy_addr; 205 206 uint32_t gregs[SUNGEM_MMIO_GREG_SIZE >> 2]; 207 uint32_t txdmaregs[SUNGEM_MMIO_TXDMA_SIZE >> 2]; 208 uint32_t rxdmaregs[SUNGEM_MMIO_RXDMA_SIZE >> 2]; 209 uint32_t macregs[SUNGEM_MMIO_MAC_SIZE >> 2]; 210 uint32_t mifregs[SUNGEM_MMIO_MIF_SIZE >> 2]; 211 uint32_t pcsregs[SUNGEM_MMIO_PCS_SIZE >> 2]; 212 213 /* Cache some useful things */ 214 uint32_t rx_mask; 215 uint32_t tx_mask; 216 217 /* Current tx packet */ 218 uint8_t tx_data[MAX_PACKET_SIZE]; 219 uint32_t tx_size; 220 uint64_t tx_first_ctl; 221 } SunGEMState; 222 223 224 static void sungem_eval_irq(SunGEMState *s) 225 { 226 uint32_t stat, mask; 227 228 mask = s->gregs[GREG_IMASK >> 2]; 229 stat = s->gregs[GREG_STAT >> 2] & ~GREG_STAT_TXNR; 230 if (stat & ~mask) { 231 pci_set_irq(PCI_DEVICE(s), 1); 232 } else { 233 pci_set_irq(PCI_DEVICE(s), 0); 234 } 235 } 236 237 static void sungem_update_status(SunGEMState *s, uint32_t bits, bool val) 238 { 239 uint32_t stat; 240 241 stat = s->gregs[GREG_STAT >> 2]; 242 if (val) { 243 stat |= bits; 244 } else { 245 stat &= ~bits; 246 } 247 s->gregs[GREG_STAT >> 2] = stat; 248 sungem_eval_irq(s); 249 } 250 251 static void sungem_eval_cascade_irq(SunGEMState *s) 252 { 253 uint32_t stat, mask; 254 255 mask = s->macregs[MAC_TXSTAT >> 2]; 256 stat = s->macregs[MAC_TXMASK >> 2]; 257 if (stat & ~mask) { 258 sungem_update_status(s, GREG_STAT_TXMAC, true); 259 } else { 260 sungem_update_status(s, GREG_STAT_TXMAC, false); 261 } 262 263 mask = s->macregs[MAC_RXSTAT >> 2]; 264 stat = s->macregs[MAC_RXMASK >> 2]; 265 if (stat & ~mask) { 266 sungem_update_status(s, GREG_STAT_RXMAC, true); 267 } else { 268 sungem_update_status(s, GREG_STAT_RXMAC, false); 269 } 270 271 mask = s->macregs[MAC_CSTAT >> 2]; 272 stat = s->macregs[MAC_MCMASK >> 2] & ~MAC_CSTAT_PTR; 273 if (stat & ~mask) { 274 sungem_update_status(s, GREG_STAT_MAC, true); 275 } else { 276 sungem_update_status(s, GREG_STAT_MAC, false); 277 } 278 } 279 280 static void sungem_do_tx_csum(SunGEMState *s) 281 { 282 uint16_t start, off; 283 uint32_t csum; 284 285 start = (s->tx_first_ctl & TXDCTRL_CSTART) >> 15; 286 off = (s->tx_first_ctl & TXDCTRL_COFF) >> 21; 287 288 trace_sungem_tx_checksum(start, off); 289 290 if (start > (s->tx_size - 2) || off > (s->tx_size - 2)) { 291 trace_sungem_tx_checksum_oob(); 292 return; 293 } 294 295 csum = net_raw_checksum(s->tx_data + start, s->tx_size - start); 296 stw_be_p(s->tx_data + off, csum); 297 } 298 299 static void sungem_send_packet(SunGEMState *s, const uint8_t *buf, 300 int size) 301 { 302 NetClientState *nc = qemu_get_queue(s->nic); 303 304 if (s->macregs[MAC_XIFCFG >> 2] & MAC_XIFCFG_LBCK) { 305 nc->info->receive(nc, buf, size); 306 } else { 307 qemu_send_packet(nc, buf, size); 308 } 309 } 310 311 static void sungem_process_tx_desc(SunGEMState *s, struct gem_txd *desc) 312 { 313 PCIDevice *d = PCI_DEVICE(s); 314 uint32_t len; 315 316 /* If it's a start of frame, discard anything we had in the 317 * buffer and start again. This should be an error condition 318 * if we had something ... for now we ignore it 319 */ 320 if (desc->control_word & TXDCTRL_SOF) { 321 if (s->tx_first_ctl) { 322 trace_sungem_tx_unfinished(); 323 } 324 s->tx_size = 0; 325 s->tx_first_ctl = desc->control_word; 326 } 327 328 /* Grab data size */ 329 len = desc->control_word & TXDCTRL_BUFSZ; 330 331 /* Clamp it to our max size */ 332 if ((s->tx_size + len) > MAX_PACKET_SIZE) { 333 trace_sungem_tx_overflow(); 334 len = MAX_PACKET_SIZE - s->tx_size; 335 } 336 337 /* Read the data */ 338 pci_dma_read(d, desc->buffer, &s->tx_data[s->tx_size], len); 339 s->tx_size += len; 340 341 /* If end of frame, send packet */ 342 if (desc->control_word & TXDCTRL_EOF) { 343 trace_sungem_tx_finished(s->tx_size); 344 345 /* Handle csum */ 346 if (s->tx_first_ctl & TXDCTRL_CENAB) { 347 sungem_do_tx_csum(s); 348 } 349 350 /* Send it */ 351 sungem_send_packet(s, s->tx_data, s->tx_size); 352 353 /* No more pending packet */ 354 s->tx_size = 0; 355 s->tx_first_ctl = 0; 356 } 357 } 358 359 static void sungem_tx_kick(SunGEMState *s) 360 { 361 PCIDevice *d = PCI_DEVICE(s); 362 uint32_t comp, kick; 363 uint32_t txdma_cfg, txmac_cfg, ints; 364 uint64_t dbase; 365 366 trace_sungem_tx_kick(); 367 368 /* Check that both TX MAC and TX DMA are enabled. We don't 369 * handle DMA-less direct FIFO operations (we don't emulate 370 * the FIFO at all). 371 * 372 * A write to TXDMA_KICK while DMA isn't enabled can happen 373 * when the driver is resetting the pointer. 374 */ 375 txdma_cfg = s->txdmaregs[TXDMA_CFG >> 2]; 376 txmac_cfg = s->macregs[MAC_TXCFG >> 2]; 377 if (!(txdma_cfg & TXDMA_CFG_ENABLE) || 378 !(txmac_cfg & MAC_TXCFG_ENAB)) { 379 trace_sungem_tx_disabled(); 380 return; 381 } 382 383 /* XXX Test min frame size register ? */ 384 /* XXX Test max frame size register ? */ 385 386 dbase = s->txdmaregs[TXDMA_DBHI >> 2]; 387 dbase = (dbase << 32) | s->txdmaregs[TXDMA_DBLOW >> 2]; 388 389 comp = s->txdmaregs[TXDMA_TXDONE >> 2] & s->tx_mask; 390 kick = s->txdmaregs[TXDMA_KICK >> 2] & s->tx_mask; 391 392 trace_sungem_tx_process(comp, kick, s->tx_mask + 1); 393 394 /* This is rather primitive for now, we just send everything we 395 * can in one go, like e1000. Ideally we should do the sending 396 * from some kind of background task 397 */ 398 while (comp != kick) { 399 struct gem_txd desc; 400 401 /* Read the next descriptor */ 402 pci_dma_read(d, dbase + comp * sizeof(desc), &desc, sizeof(desc)); 403 404 /* Byteswap descriptor */ 405 desc.control_word = le64_to_cpu(desc.control_word); 406 desc.buffer = le64_to_cpu(desc.buffer); 407 trace_sungem_tx_desc(comp, desc.control_word, desc.buffer); 408 409 /* Send it for processing */ 410 sungem_process_tx_desc(s, &desc); 411 412 /* Interrupt */ 413 ints = GREG_STAT_TXDONE; 414 if (desc.control_word & TXDCTRL_INTME) { 415 ints |= GREG_STAT_TXINTME; 416 } 417 sungem_update_status(s, ints, true); 418 419 /* Next ! */ 420 comp = (comp + 1) & s->tx_mask; 421 s->txdmaregs[TXDMA_TXDONE >> 2] = comp; 422 } 423 424 /* We sent everything, set status/irq bit */ 425 sungem_update_status(s, GREG_STAT_TXALL, true); 426 } 427 428 static bool sungem_rx_full(SunGEMState *s, uint32_t kick, uint32_t done) 429 { 430 return kick == ((done + 1) & s->rx_mask); 431 } 432 433 static int sungem_can_receive(NetClientState *nc) 434 { 435 SunGEMState *s = qemu_get_nic_opaque(nc); 436 uint32_t kick, done, rxdma_cfg, rxmac_cfg; 437 bool full; 438 439 rxmac_cfg = s->macregs[MAC_RXCFG >> 2]; 440 rxdma_cfg = s->rxdmaregs[RXDMA_CFG >> 2]; 441 442 /* If MAC disabled, can't receive */ 443 if ((rxmac_cfg & MAC_RXCFG_ENAB) == 0) { 444 trace_sungem_rx_mac_disabled(); 445 return 0; 446 } 447 if ((rxdma_cfg & RXDMA_CFG_ENABLE) == 0) { 448 trace_sungem_rx_txdma_disabled(); 449 return 0; 450 } 451 452 /* Check RX availability */ 453 kick = s->rxdmaregs[RXDMA_KICK >> 2]; 454 done = s->rxdmaregs[RXDMA_DONE >> 2]; 455 full = sungem_rx_full(s, kick, done); 456 457 trace_sungem_rx_check(!full, kick, done); 458 459 return !full; 460 } 461 462 enum { 463 rx_no_match, 464 rx_match_promisc, 465 rx_match_bcast, 466 rx_match_allmcast, 467 rx_match_mcast, 468 rx_match_mac, 469 rx_match_altmac, 470 }; 471 472 static int sungem_check_rx_mac(SunGEMState *s, const uint8_t *mac, uint32_t crc) 473 { 474 uint32_t rxcfg = s->macregs[MAC_RXCFG >> 2]; 475 uint32_t mac0, mac1, mac2; 476 477 /* Promisc enabled ? */ 478 if (rxcfg & MAC_RXCFG_PROM) { 479 return rx_match_promisc; 480 } 481 482 /* Format MAC address into dwords */ 483 mac0 = (mac[4] << 8) | mac[5]; 484 mac1 = (mac[2] << 8) | mac[3]; 485 mac2 = (mac[0] << 8) | mac[1]; 486 487 trace_sungem_rx_mac_check(mac0, mac1, mac2); 488 489 /* Is this a broadcast frame ? */ 490 if (mac0 == 0xffff && mac1 == 0xffff && mac2 == 0xffff) { 491 return rx_match_bcast; 492 } 493 494 /* TODO: Implement address filter registers (or we don't care ?) */ 495 496 /* Is this a multicast frame ? */ 497 if (mac[0] & 1) { 498 trace_sungem_rx_mac_multicast(); 499 500 /* Promisc group enabled ? */ 501 if (rxcfg & MAC_RXCFG_PGRP) { 502 return rx_match_allmcast; 503 } 504 505 /* TODO: Check MAC control frames (or we don't care) ? */ 506 507 /* Check hash filter (somebody check that's correct ?) */ 508 if (rxcfg & MAC_RXCFG_HFE) { 509 uint32_t hash, idx; 510 511 crc >>= 24; 512 idx = (crc >> 2) & 0x3c; 513 hash = s->macregs[(MAC_HASH0 + idx) >> 2]; 514 if (hash & (1 << (15 - (crc & 0xf)))) { 515 return rx_match_mcast; 516 } 517 } 518 return rx_no_match; 519 } 520 521 /* Main MAC check */ 522 trace_sungem_rx_mac_compare(s->macregs[MAC_ADDR0 >> 2], 523 s->macregs[MAC_ADDR1 >> 2], 524 s->macregs[MAC_ADDR2 >> 2]); 525 526 if (mac0 == s->macregs[MAC_ADDR0 >> 2] && 527 mac1 == s->macregs[MAC_ADDR1 >> 2] && 528 mac2 == s->macregs[MAC_ADDR2 >> 2]) { 529 return rx_match_mac; 530 } 531 532 /* Alt MAC check */ 533 if (mac0 == s->macregs[MAC_ADDR3 >> 2] && 534 mac1 == s->macregs[MAC_ADDR4 >> 2] && 535 mac2 == s->macregs[MAC_ADDR5 >> 2]) { 536 return rx_match_altmac; 537 } 538 539 return rx_no_match; 540 } 541 542 static ssize_t sungem_receive(NetClientState *nc, const uint8_t *buf, 543 size_t size) 544 { 545 SunGEMState *s = qemu_get_nic_opaque(nc); 546 PCIDevice *d = PCI_DEVICE(s); 547 uint32_t mac_crc, done, kick, max_fsize; 548 uint32_t fcs_size, ints, rxdma_cfg, rxmac_cfg, csum, coff; 549 uint8_t smallbuf[60]; 550 struct gem_rxd desc; 551 uint64_t dbase, baddr; 552 unsigned int rx_cond; 553 554 trace_sungem_rx_packet(size); 555 556 rxmac_cfg = s->macregs[MAC_RXCFG >> 2]; 557 rxdma_cfg = s->rxdmaregs[RXDMA_CFG >> 2]; 558 max_fsize = s->macregs[MAC_MAXFSZ >> 2] & 0x7fff; 559 560 /* If MAC or DMA disabled, can't receive */ 561 if (!(rxdma_cfg & RXDMA_CFG_ENABLE) || 562 !(rxmac_cfg & MAC_RXCFG_ENAB)) { 563 trace_sungem_rx_disabled(); 564 return 0; 565 } 566 567 /* Size adjustment for FCS */ 568 if (rxmac_cfg & MAC_RXCFG_SFCS) { 569 fcs_size = 0; 570 } else { 571 fcs_size = 4; 572 } 573 574 /* Discard frame smaller than a MAC or larger than max frame size 575 * (when accounting for FCS) 576 */ 577 if (size < 6 || (size + 4) > max_fsize) { 578 trace_sungem_rx_bad_frame_size(size); 579 /* XXX Increment error statistics ? */ 580 return size; 581 } 582 583 /* We don't drop too small frames since we get them in qemu, we pad 584 * them instead. We should probably use the min frame size register 585 * but I don't want to use a variable size staging buffer and I 586 * know both MacOS and Linux use the default 64 anyway. We use 60 587 * here to account for the non-existent FCS. 588 */ 589 if (size < 60) { 590 memcpy(smallbuf, buf, size); 591 memset(&smallbuf[size], 0, 60 - size); 592 buf = smallbuf; 593 size = 60; 594 } 595 596 /* Get MAC crc */ 597 mac_crc = net_crc32_le(buf, ETH_ALEN); 598 599 /* Packet isn't for me ? */ 600 rx_cond = sungem_check_rx_mac(s, buf, mac_crc); 601 if (rx_cond == rx_no_match) { 602 /* Just drop it */ 603 trace_sungem_rx_unmatched(); 604 return size; 605 } 606 607 /* Get ring pointers */ 608 kick = s->rxdmaregs[RXDMA_KICK >> 2] & s->rx_mask; 609 done = s->rxdmaregs[RXDMA_DONE >> 2] & s->rx_mask; 610 611 trace_sungem_rx_process(done, kick, s->rx_mask + 1); 612 613 /* Ring full ? Can't receive */ 614 if (sungem_rx_full(s, kick, done)) { 615 trace_sungem_rx_ringfull(); 616 return 0; 617 } 618 619 /* Note: The real GEM will fetch descriptors in blocks of 4, 620 * for now we handle them one at a time, I think the driver will 621 * cope 622 */ 623 624 dbase = s->rxdmaregs[RXDMA_DBHI >> 2]; 625 dbase = (dbase << 32) | s->rxdmaregs[RXDMA_DBLOW >> 2]; 626 627 /* Read the next descriptor */ 628 pci_dma_read(d, dbase + done * sizeof(desc), &desc, sizeof(desc)); 629 630 trace_sungem_rx_desc(le64_to_cpu(desc.status_word), 631 le64_to_cpu(desc.buffer)); 632 633 /* Effective buffer address */ 634 baddr = le64_to_cpu(desc.buffer) & ~7ull; 635 baddr |= (rxdma_cfg & RXDMA_CFG_FBOFF) >> 10; 636 637 /* Write buffer out */ 638 pci_dma_write(d, baddr, buf, size); 639 640 if (fcs_size) { 641 /* Should we add an FCS ? Linux doesn't ask us to strip it, 642 * however I believe nothing checks it... For now we just 643 * do nothing. It's faster this way. 644 */ 645 } 646 647 /* Calculate the checksum */ 648 coff = (rxdma_cfg & RXDMA_CFG_CSUMOFF) >> 13; 649 csum = net_raw_checksum((uint8_t *)buf + coff, size - coff); 650 651 /* Build the updated descriptor */ 652 desc.status_word = (size + fcs_size) << 16; 653 desc.status_word |= ((uint64_t)(mac_crc >> 16)) << 44; 654 desc.status_word |= csum; 655 if (rx_cond == rx_match_mcast) { 656 desc.status_word |= RXDCTRL_HPASS; 657 } 658 if (rx_cond == rx_match_altmac) { 659 desc.status_word |= RXDCTRL_ALTMAC; 660 } 661 desc.status_word = cpu_to_le64(desc.status_word); 662 663 pci_dma_write(d, dbase + done * sizeof(desc), &desc, sizeof(desc)); 664 665 done = (done + 1) & s->rx_mask; 666 s->rxdmaregs[RXDMA_DONE >> 2] = done; 667 668 /* XXX Unconditionally set RX interrupt for now. The interrupt 669 * mitigation timer might well end up adding more overhead than 670 * helping here... 671 */ 672 ints = GREG_STAT_RXDONE; 673 if (sungem_rx_full(s, kick, done)) { 674 ints |= GREG_STAT_RXNOBUF; 675 } 676 sungem_update_status(s, ints, true); 677 678 return size; 679 } 680 681 static void sungem_set_link_status(NetClientState *nc) 682 { 683 /* We don't do anything for now as I believe none of the OSes 684 * drivers use the MIF autopoll feature nor the PHY interrupt 685 */ 686 } 687 688 static void sungem_update_masks(SunGEMState *s) 689 { 690 uint32_t sz; 691 692 sz = 1 << (((s->rxdmaregs[RXDMA_CFG >> 2] & RXDMA_CFG_RINGSZ) >> 1) + 5); 693 s->rx_mask = sz - 1; 694 695 sz = 1 << (((s->txdmaregs[TXDMA_CFG >> 2] & TXDMA_CFG_RINGSZ) >> 1) + 5); 696 s->tx_mask = sz - 1; 697 } 698 699 static void sungem_reset_rx(SunGEMState *s) 700 { 701 trace_sungem_rx_reset(); 702 703 /* XXX Do RXCFG */ 704 /* XXX Check value */ 705 s->rxdmaregs[RXDMA_FSZ >> 2] = 0x140; 706 s->rxdmaregs[RXDMA_DONE >> 2] = 0; 707 s->rxdmaregs[RXDMA_KICK >> 2] = 0; 708 s->rxdmaregs[RXDMA_CFG >> 2] = 0x1000010; 709 s->rxdmaregs[RXDMA_PTHRESH >> 2] = 0xf8; 710 s->rxdmaregs[RXDMA_BLANK >> 2] = 0; 711 712 sungem_update_masks(s); 713 } 714 715 static void sungem_reset_tx(SunGEMState *s) 716 { 717 trace_sungem_tx_reset(); 718 719 /* XXX Do TXCFG */ 720 /* XXX Check value */ 721 s->txdmaregs[TXDMA_FSZ >> 2] = 0x90; 722 s->txdmaregs[TXDMA_TXDONE >> 2] = 0; 723 s->txdmaregs[TXDMA_KICK >> 2] = 0; 724 s->txdmaregs[TXDMA_CFG >> 2] = 0x118010; 725 726 sungem_update_masks(s); 727 728 s->tx_size = 0; 729 s->tx_first_ctl = 0; 730 } 731 732 static void sungem_reset_all(SunGEMState *s, bool pci_reset) 733 { 734 trace_sungem_reset(pci_reset); 735 736 sungem_reset_rx(s); 737 sungem_reset_tx(s); 738 739 s->gregs[GREG_IMASK >> 2] = 0xFFFFFFF; 740 s->gregs[GREG_STAT >> 2] = 0; 741 if (pci_reset) { 742 uint8_t *ma = s->conf.macaddr.a; 743 744 s->gregs[GREG_SWRST >> 2] = 0; 745 s->macregs[MAC_ADDR0 >> 2] = (ma[4] << 8) | ma[5]; 746 s->macregs[MAC_ADDR1 >> 2] = (ma[2] << 8) | ma[3]; 747 s->macregs[MAC_ADDR2 >> 2] = (ma[0] << 8) | ma[1]; 748 } else { 749 s->gregs[GREG_SWRST >> 2] &= GREG_SWRST_RSTOUT; 750 } 751 s->mifregs[MIF_CFG >> 2] = MIF_CFG_MDI0; 752 } 753 754 static void sungem_mii_write(SunGEMState *s, uint8_t phy_addr, 755 uint8_t reg_addr, uint16_t val) 756 { 757 trace_sungem_mii_write(phy_addr, reg_addr, val); 758 759 /* XXX TODO */ 760 } 761 762 static uint16_t __sungem_mii_read(SunGEMState *s, uint8_t phy_addr, 763 uint8_t reg_addr) 764 { 765 if (phy_addr != s->phy_addr) { 766 return 0xffff; 767 } 768 /* Primitive emulation of a BCM5201 to please the driver, 769 * ID is 0x00406210. TODO: Do a gigabit PHY like BCM5400 770 */ 771 switch (reg_addr) { 772 case MII_BMCR: 773 return 0; 774 case MII_PHYID1: 775 return 0x0040; 776 case MII_PHYID2: 777 return 0x6210; 778 case MII_BMSR: 779 if (qemu_get_queue(s->nic)->link_down) { 780 return MII_BMSR_100TX_FD | MII_BMSR_AUTONEG; 781 } else { 782 return MII_BMSR_100TX_FD | MII_BMSR_AN_COMP | 783 MII_BMSR_AUTONEG | MII_BMSR_LINK_ST; 784 } 785 case MII_ANLPAR: 786 case MII_ANAR: 787 return MII_ANLPAR_TXFD; 788 case 0x18: /* 5201 AUX status */ 789 return 3; /* 100FD */ 790 default: 791 return 0; 792 }; 793 } 794 static uint16_t sungem_mii_read(SunGEMState *s, uint8_t phy_addr, 795 uint8_t reg_addr) 796 { 797 uint16_t val; 798 799 val = __sungem_mii_read(s, phy_addr, reg_addr); 800 801 trace_sungem_mii_read(phy_addr, reg_addr, val); 802 803 return val; 804 } 805 806 static uint32_t sungem_mii_op(SunGEMState *s, uint32_t val) 807 { 808 uint8_t phy_addr, reg_addr, op; 809 810 /* Ignore not start of frame */ 811 if ((val >> 30) != 1) { 812 trace_sungem_mii_invalid_sof(val >> 30); 813 return 0xffff; 814 } 815 phy_addr = (val & MIF_FRAME_PHYAD) >> 23; 816 reg_addr = (val & MIF_FRAME_REGAD) >> 18; 817 op = (val & MIF_FRAME_OP) >> 28; 818 switch (op) { 819 case 1: 820 sungem_mii_write(s, phy_addr, reg_addr, val & MIF_FRAME_DATA); 821 return val | MIF_FRAME_TALSB; 822 case 2: 823 return sungem_mii_read(s, phy_addr, reg_addr) | MIF_FRAME_TALSB; 824 default: 825 trace_sungem_mii_invalid_op(op); 826 } 827 return 0xffff | MIF_FRAME_TALSB; 828 } 829 830 static void sungem_mmio_greg_write(void *opaque, hwaddr addr, uint64_t val, 831 unsigned size) 832 { 833 SunGEMState *s = opaque; 834 835 if (!(addr < 0x20) && !(addr >= 0x1000 && addr <= 0x1010)) { 836 qemu_log_mask(LOG_GUEST_ERROR, 837 "Write to unknown GREG register 0x%"HWADDR_PRIx"\n", 838 addr); 839 return; 840 } 841 842 trace_sungem_mmio_greg_write(addr, val); 843 844 /* Pre-write filter */ 845 switch (addr) { 846 /* Read only registers */ 847 case GREG_SEBSTATE: 848 case GREG_STAT: 849 case GREG_STAT2: 850 case GREG_PCIESTAT: 851 return; /* No actual write */ 852 case GREG_IACK: 853 val &= GREG_STAT_LATCH; 854 s->gregs[GREG_STAT >> 2] &= ~val; 855 sungem_eval_irq(s); 856 return; /* No actual write */ 857 case GREG_PCIEMASK: 858 val &= 0x7; 859 break; 860 } 861 862 s->gregs[addr >> 2] = val; 863 864 /* Post write action */ 865 switch (addr) { 866 case GREG_IMASK: 867 /* Re-evaluate interrupt */ 868 sungem_eval_irq(s); 869 break; 870 case GREG_SWRST: 871 switch (val & (GREG_SWRST_TXRST | GREG_SWRST_RXRST)) { 872 case GREG_SWRST_RXRST: 873 sungem_reset_rx(s); 874 break; 875 case GREG_SWRST_TXRST: 876 sungem_reset_tx(s); 877 break; 878 case GREG_SWRST_RXRST | GREG_SWRST_TXRST: 879 sungem_reset_all(s, false); 880 } 881 break; 882 } 883 } 884 885 static uint64_t sungem_mmio_greg_read(void *opaque, hwaddr addr, unsigned size) 886 { 887 SunGEMState *s = opaque; 888 uint32_t val; 889 890 if (!(addr < 0x20) && !(addr >= 0x1000 && addr <= 0x1010)) { 891 qemu_log_mask(LOG_GUEST_ERROR, 892 "Read from unknown GREG register 0x%"HWADDR_PRIx"\n", 893 addr); 894 return 0; 895 } 896 897 val = s->gregs[addr >> 2]; 898 899 trace_sungem_mmio_greg_read(addr, val); 900 901 switch (addr) { 902 case GREG_STAT: 903 /* Side effect, clear bottom 7 bits */ 904 s->gregs[GREG_STAT >> 2] &= ~GREG_STAT_LATCH; 905 sungem_eval_irq(s); 906 907 /* Inject TX completion in returned value */ 908 val = (val & ~GREG_STAT_TXNR) | 909 (s->txdmaregs[TXDMA_TXDONE >> 2] << GREG_STAT_TXNR_SHIFT); 910 break; 911 case GREG_STAT2: 912 /* Return the status reg without side effect 913 * (and inject TX completion in returned value) 914 */ 915 val = (s->gregs[GREG_STAT >> 2] & ~GREG_STAT_TXNR) | 916 (s->txdmaregs[TXDMA_TXDONE >> 2] << GREG_STAT_TXNR_SHIFT); 917 break; 918 } 919 920 return val; 921 } 922 923 static const MemoryRegionOps sungem_mmio_greg_ops = { 924 .read = sungem_mmio_greg_read, 925 .write = sungem_mmio_greg_write, 926 .endianness = DEVICE_LITTLE_ENDIAN, 927 .impl = { 928 .min_access_size = 4, 929 .max_access_size = 4, 930 }, 931 }; 932 933 static void sungem_mmio_txdma_write(void *opaque, hwaddr addr, uint64_t val, 934 unsigned size) 935 { 936 SunGEMState *s = opaque; 937 938 if (!(addr < 0x38) && !(addr >= 0x100 && addr <= 0x118)) { 939 qemu_log_mask(LOG_GUEST_ERROR, 940 "Write to unknown TXDMA register 0x%"HWADDR_PRIx"\n", 941 addr); 942 return; 943 } 944 945 trace_sungem_mmio_txdma_write(addr, val); 946 947 /* Pre-write filter */ 948 switch (addr) { 949 /* Read only registers */ 950 case TXDMA_TXDONE: 951 case TXDMA_PCNT: 952 case TXDMA_SMACHINE: 953 case TXDMA_DPLOW: 954 case TXDMA_DPHI: 955 case TXDMA_FSZ: 956 case TXDMA_FTAG: 957 return; /* No actual write */ 958 } 959 960 s->txdmaregs[addr >> 2] = val; 961 962 /* Post write action */ 963 switch (addr) { 964 case TXDMA_KICK: 965 sungem_tx_kick(s); 966 break; 967 case TXDMA_CFG: 968 sungem_update_masks(s); 969 break; 970 } 971 } 972 973 static uint64_t sungem_mmio_txdma_read(void *opaque, hwaddr addr, unsigned size) 974 { 975 SunGEMState *s = opaque; 976 uint32_t val; 977 978 if (!(addr < 0x38) && !(addr >= 0x100 && addr <= 0x118)) { 979 qemu_log_mask(LOG_GUEST_ERROR, 980 "Read from unknown TXDMA register 0x%"HWADDR_PRIx"\n", 981 addr); 982 return 0; 983 } 984 985 val = s->txdmaregs[addr >> 2]; 986 987 trace_sungem_mmio_txdma_read(addr, val); 988 989 return val; 990 } 991 992 static const MemoryRegionOps sungem_mmio_txdma_ops = { 993 .read = sungem_mmio_txdma_read, 994 .write = sungem_mmio_txdma_write, 995 .endianness = DEVICE_LITTLE_ENDIAN, 996 .impl = { 997 .min_access_size = 4, 998 .max_access_size = 4, 999 }, 1000 }; 1001 1002 static void sungem_mmio_rxdma_write(void *opaque, hwaddr addr, uint64_t val, 1003 unsigned size) 1004 { 1005 SunGEMState *s = opaque; 1006 1007 if (!(addr <= 0x28) && !(addr >= 0x100 && addr <= 0x120)) { 1008 qemu_log_mask(LOG_GUEST_ERROR, 1009 "Write to unknown RXDMA register 0x%"HWADDR_PRIx"\n", 1010 addr); 1011 return; 1012 } 1013 1014 trace_sungem_mmio_rxdma_write(addr, val); 1015 1016 /* Pre-write filter */ 1017 switch (addr) { 1018 /* Read only registers */ 1019 case RXDMA_DONE: 1020 case RXDMA_PCNT: 1021 case RXDMA_SMACHINE: 1022 case RXDMA_DPLOW: 1023 case RXDMA_DPHI: 1024 case RXDMA_FSZ: 1025 case RXDMA_FTAG: 1026 return; /* No actual write */ 1027 } 1028 1029 s->rxdmaregs[addr >> 2] = val; 1030 1031 /* Post write action */ 1032 switch (addr) { 1033 case RXDMA_KICK: 1034 trace_sungem_rx_kick(val); 1035 break; 1036 case RXDMA_CFG: 1037 sungem_update_masks(s); 1038 if ((s->macregs[MAC_RXCFG >> 2] & MAC_RXCFG_ENAB) != 0 && 1039 (s->rxdmaregs[RXDMA_CFG >> 2] & RXDMA_CFG_ENABLE) != 0) { 1040 qemu_flush_queued_packets(qemu_get_queue(s->nic)); 1041 } 1042 break; 1043 } 1044 } 1045 1046 static uint64_t sungem_mmio_rxdma_read(void *opaque, hwaddr addr, unsigned size) 1047 { 1048 SunGEMState *s = opaque; 1049 uint32_t val; 1050 1051 if (!(addr <= 0x28) && !(addr >= 0x100 && addr <= 0x120)) { 1052 qemu_log_mask(LOG_GUEST_ERROR, 1053 "Read from unknown RXDMA register 0x%"HWADDR_PRIx"\n", 1054 addr); 1055 return 0; 1056 } 1057 1058 val = s->rxdmaregs[addr >> 2]; 1059 1060 trace_sungem_mmio_rxdma_read(addr, val); 1061 1062 return val; 1063 } 1064 1065 static const MemoryRegionOps sungem_mmio_rxdma_ops = { 1066 .read = sungem_mmio_rxdma_read, 1067 .write = sungem_mmio_rxdma_write, 1068 .endianness = DEVICE_LITTLE_ENDIAN, 1069 .impl = { 1070 .min_access_size = 4, 1071 .max_access_size = 4, 1072 }, 1073 }; 1074 1075 static void sungem_mmio_mac_write(void *opaque, hwaddr addr, uint64_t val, 1076 unsigned size) 1077 { 1078 SunGEMState *s = opaque; 1079 1080 if (!(addr <= 0x134)) { 1081 qemu_log_mask(LOG_GUEST_ERROR, 1082 "Write to unknown MAC register 0x%"HWADDR_PRIx"\n", 1083 addr); 1084 return; 1085 } 1086 1087 trace_sungem_mmio_mac_write(addr, val); 1088 1089 /* Pre-write filter */ 1090 switch (addr) { 1091 /* Read only registers */ 1092 case MAC_TXRST: /* Not technically read-only but will do for now */ 1093 case MAC_RXRST: /* Not technically read-only but will do for now */ 1094 case MAC_TXSTAT: 1095 case MAC_RXSTAT: 1096 case MAC_CSTAT: 1097 case MAC_PATMPS: 1098 case MAC_SMACHINE: 1099 return; /* No actual write */ 1100 case MAC_MINFSZ: 1101 /* 10-bits implemented */ 1102 val &= 0x3ff; 1103 break; 1104 } 1105 1106 s->macregs[addr >> 2] = val; 1107 1108 /* Post write action */ 1109 switch (addr) { 1110 case MAC_TXMASK: 1111 case MAC_RXMASK: 1112 case MAC_MCMASK: 1113 sungem_eval_cascade_irq(s); 1114 break; 1115 case MAC_RXCFG: 1116 sungem_update_masks(s); 1117 if ((s->macregs[MAC_RXCFG >> 2] & MAC_RXCFG_ENAB) != 0 && 1118 (s->rxdmaregs[RXDMA_CFG >> 2] & RXDMA_CFG_ENABLE) != 0) { 1119 qemu_flush_queued_packets(qemu_get_queue(s->nic)); 1120 } 1121 break; 1122 } 1123 } 1124 1125 static uint64_t sungem_mmio_mac_read(void *opaque, hwaddr addr, unsigned size) 1126 { 1127 SunGEMState *s = opaque; 1128 uint32_t val; 1129 1130 if (!(addr <= 0x134)) { 1131 qemu_log_mask(LOG_GUEST_ERROR, 1132 "Read from unknown MAC register 0x%"HWADDR_PRIx"\n", 1133 addr); 1134 return 0; 1135 } 1136 1137 val = s->macregs[addr >> 2]; 1138 1139 trace_sungem_mmio_mac_read(addr, val); 1140 1141 switch (addr) { 1142 case MAC_TXSTAT: 1143 /* Side effect, clear all */ 1144 s->macregs[addr >> 2] = 0; 1145 sungem_update_status(s, GREG_STAT_TXMAC, false); 1146 break; 1147 case MAC_RXSTAT: 1148 /* Side effect, clear all */ 1149 s->macregs[addr >> 2] = 0; 1150 sungem_update_status(s, GREG_STAT_RXMAC, false); 1151 break; 1152 case MAC_CSTAT: 1153 /* Side effect, interrupt bits */ 1154 s->macregs[addr >> 2] &= MAC_CSTAT_PTR; 1155 sungem_update_status(s, GREG_STAT_MAC, false); 1156 break; 1157 } 1158 1159 return val; 1160 } 1161 1162 static const MemoryRegionOps sungem_mmio_mac_ops = { 1163 .read = sungem_mmio_mac_read, 1164 .write = sungem_mmio_mac_write, 1165 .endianness = DEVICE_LITTLE_ENDIAN, 1166 .impl = { 1167 .min_access_size = 4, 1168 .max_access_size = 4, 1169 }, 1170 }; 1171 1172 static void sungem_mmio_mif_write(void *opaque, hwaddr addr, uint64_t val, 1173 unsigned size) 1174 { 1175 SunGEMState *s = opaque; 1176 1177 if (!(addr <= 0x1c)) { 1178 qemu_log_mask(LOG_GUEST_ERROR, 1179 "Write to unknown MIF register 0x%"HWADDR_PRIx"\n", 1180 addr); 1181 return; 1182 } 1183 1184 trace_sungem_mmio_mif_write(addr, val); 1185 1186 /* Pre-write filter */ 1187 switch (addr) { 1188 /* Read only registers */ 1189 case MIF_STATUS: 1190 case MIF_SMACHINE: 1191 return; /* No actual write */ 1192 case MIF_CFG: 1193 /* Maintain the RO MDI bits to advertize an MDIO PHY on MDI0 */ 1194 val &= ~MIF_CFG_MDI1; 1195 val |= MIF_CFG_MDI0; 1196 break; 1197 } 1198 1199 s->mifregs[addr >> 2] = val; 1200 1201 /* Post write action */ 1202 switch (addr) { 1203 case MIF_FRAME: 1204 s->mifregs[addr >> 2] = sungem_mii_op(s, val); 1205 break; 1206 } 1207 } 1208 1209 static uint64_t sungem_mmio_mif_read(void *opaque, hwaddr addr, unsigned size) 1210 { 1211 SunGEMState *s = opaque; 1212 uint32_t val; 1213 1214 if (!(addr <= 0x1c)) { 1215 qemu_log_mask(LOG_GUEST_ERROR, 1216 "Read from unknown MIF register 0x%"HWADDR_PRIx"\n", 1217 addr); 1218 return 0; 1219 } 1220 1221 val = s->mifregs[addr >> 2]; 1222 1223 trace_sungem_mmio_mif_read(addr, val); 1224 1225 return val; 1226 } 1227 1228 static const MemoryRegionOps sungem_mmio_mif_ops = { 1229 .read = sungem_mmio_mif_read, 1230 .write = sungem_mmio_mif_write, 1231 .endianness = DEVICE_LITTLE_ENDIAN, 1232 .impl = { 1233 .min_access_size = 4, 1234 .max_access_size = 4, 1235 }, 1236 }; 1237 1238 static void sungem_mmio_pcs_write(void *opaque, hwaddr addr, uint64_t val, 1239 unsigned size) 1240 { 1241 SunGEMState *s = opaque; 1242 1243 if (!(addr <= 0x18) && !(addr >= 0x50 && addr <= 0x5c)) { 1244 qemu_log_mask(LOG_GUEST_ERROR, 1245 "Write to unknown PCS register 0x%"HWADDR_PRIx"\n", 1246 addr); 1247 return; 1248 } 1249 1250 trace_sungem_mmio_pcs_write(addr, val); 1251 1252 /* Pre-write filter */ 1253 switch (addr) { 1254 /* Read only registers */ 1255 case PCS_MIISTAT: 1256 case PCS_ISTAT: 1257 case PCS_SSTATE: 1258 return; /* No actual write */ 1259 } 1260 1261 s->pcsregs[addr >> 2] = val; 1262 } 1263 1264 static uint64_t sungem_mmio_pcs_read(void *opaque, hwaddr addr, unsigned size) 1265 { 1266 SunGEMState *s = opaque; 1267 uint32_t val; 1268 1269 if (!(addr <= 0x18) && !(addr >= 0x50 && addr <= 0x5c)) { 1270 qemu_log_mask(LOG_GUEST_ERROR, 1271 "Read from unknown PCS register 0x%"HWADDR_PRIx"\n", 1272 addr); 1273 return 0; 1274 } 1275 1276 val = s->pcsregs[addr >> 2]; 1277 1278 trace_sungem_mmio_pcs_read(addr, val); 1279 1280 return val; 1281 } 1282 1283 static const MemoryRegionOps sungem_mmio_pcs_ops = { 1284 .read = sungem_mmio_pcs_read, 1285 .write = sungem_mmio_pcs_write, 1286 .endianness = DEVICE_LITTLE_ENDIAN, 1287 .impl = { 1288 .min_access_size = 4, 1289 .max_access_size = 4, 1290 }, 1291 }; 1292 1293 static void sungem_uninit(PCIDevice *dev) 1294 { 1295 SunGEMState *s = SUNGEM(dev); 1296 1297 qemu_del_nic(s->nic); 1298 } 1299 1300 static NetClientInfo net_sungem_info = { 1301 .type = NET_CLIENT_DRIVER_NIC, 1302 .size = sizeof(NICState), 1303 .can_receive = sungem_can_receive, 1304 .receive = sungem_receive, 1305 .link_status_changed = sungem_set_link_status, 1306 }; 1307 1308 static void sungem_realize(PCIDevice *pci_dev, Error **errp) 1309 { 1310 DeviceState *dev = DEVICE(pci_dev); 1311 SunGEMState *s = SUNGEM(pci_dev); 1312 uint8_t *pci_conf; 1313 1314 pci_conf = pci_dev->config; 1315 1316 pci_set_word(pci_conf + PCI_STATUS, 1317 PCI_STATUS_FAST_BACK | 1318 PCI_STATUS_DEVSEL_MEDIUM | 1319 PCI_STATUS_66MHZ); 1320 1321 pci_set_word(pci_conf + PCI_SUBSYSTEM_VENDOR_ID, 0x0); 1322 pci_set_word(pci_conf + PCI_SUBSYSTEM_ID, 0x0); 1323 1324 pci_conf[PCI_INTERRUPT_PIN] = 1; /* interrupt pin A */ 1325 pci_conf[PCI_MIN_GNT] = 0x40; 1326 pci_conf[PCI_MAX_LAT] = 0x40; 1327 1328 sungem_reset_all(s, true); 1329 memory_region_init(&s->sungem, OBJECT(s), "sungem", SUNGEM_MMIO_SIZE); 1330 1331 memory_region_init_io(&s->greg, OBJECT(s), &sungem_mmio_greg_ops, s, 1332 "sungem.greg", SUNGEM_MMIO_GREG_SIZE); 1333 memory_region_add_subregion(&s->sungem, 0, &s->greg); 1334 1335 memory_region_init_io(&s->txdma, OBJECT(s), &sungem_mmio_txdma_ops, s, 1336 "sungem.txdma", SUNGEM_MMIO_TXDMA_SIZE); 1337 memory_region_add_subregion(&s->sungem, 0x2000, &s->txdma); 1338 1339 memory_region_init_io(&s->rxdma, OBJECT(s), &sungem_mmio_rxdma_ops, s, 1340 "sungem.rxdma", SUNGEM_MMIO_RXDMA_SIZE); 1341 memory_region_add_subregion(&s->sungem, 0x4000, &s->rxdma); 1342 1343 memory_region_init_io(&s->mac, OBJECT(s), &sungem_mmio_mac_ops, s, 1344 "sungem.mac", SUNGEM_MMIO_MAC_SIZE); 1345 memory_region_add_subregion(&s->sungem, 0x6000, &s->mac); 1346 1347 memory_region_init_io(&s->mif, OBJECT(s), &sungem_mmio_mif_ops, s, 1348 "sungem.mif", SUNGEM_MMIO_MIF_SIZE); 1349 memory_region_add_subregion(&s->sungem, 0x6200, &s->mif); 1350 1351 memory_region_init_io(&s->pcs, OBJECT(s), &sungem_mmio_pcs_ops, s, 1352 "sungem.pcs", SUNGEM_MMIO_PCS_SIZE); 1353 memory_region_add_subregion(&s->sungem, 0x9000, &s->pcs); 1354 1355 pci_register_bar(pci_dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->sungem); 1356 1357 qemu_macaddr_default_if_unset(&s->conf.macaddr); 1358 s->nic = qemu_new_nic(&net_sungem_info, &s->conf, 1359 object_get_typename(OBJECT(dev)), 1360 dev->id, s); 1361 qemu_format_nic_info_str(qemu_get_queue(s->nic), 1362 s->conf.macaddr.a); 1363 } 1364 1365 static void sungem_reset(DeviceState *dev) 1366 { 1367 SunGEMState *s = SUNGEM(dev); 1368 1369 sungem_reset_all(s, true); 1370 } 1371 1372 static void sungem_instance_init(Object *obj) 1373 { 1374 SunGEMState *s = SUNGEM(obj); 1375 1376 device_add_bootindex_property(obj, &s->conf.bootindex, 1377 "bootindex", "/ethernet-phy@0", 1378 DEVICE(obj), NULL); 1379 } 1380 1381 static Property sungem_properties[] = { 1382 DEFINE_NIC_PROPERTIES(SunGEMState, conf), 1383 /* Phy address should be 0 for most Apple machines except 1384 * for K2 in which case it's 1. Will be set by a machine 1385 * override. 1386 */ 1387 DEFINE_PROP_UINT32("phy_addr", SunGEMState, phy_addr, 0), 1388 DEFINE_PROP_END_OF_LIST(), 1389 }; 1390 1391 static const VMStateDescription vmstate_sungem = { 1392 .name = "sungem", 1393 .version_id = 0, 1394 .minimum_version_id = 0, 1395 .fields = (VMStateField[]) { 1396 VMSTATE_PCI_DEVICE(pdev, SunGEMState), 1397 VMSTATE_MACADDR(conf.macaddr, SunGEMState), 1398 VMSTATE_UINT32(phy_addr, SunGEMState), 1399 VMSTATE_UINT32_ARRAY(gregs, SunGEMState, (SUNGEM_MMIO_GREG_SIZE >> 2)), 1400 VMSTATE_UINT32_ARRAY(txdmaregs, SunGEMState, 1401 (SUNGEM_MMIO_TXDMA_SIZE >> 2)), 1402 VMSTATE_UINT32_ARRAY(rxdmaregs, SunGEMState, 1403 (SUNGEM_MMIO_RXDMA_SIZE >> 2)), 1404 VMSTATE_UINT32_ARRAY(macregs, SunGEMState, (SUNGEM_MMIO_MAC_SIZE >> 2)), 1405 VMSTATE_UINT32_ARRAY(mifregs, SunGEMState, (SUNGEM_MMIO_MIF_SIZE >> 2)), 1406 VMSTATE_UINT32_ARRAY(pcsregs, SunGEMState, (SUNGEM_MMIO_PCS_SIZE >> 2)), 1407 VMSTATE_UINT32(rx_mask, SunGEMState), 1408 VMSTATE_UINT32(tx_mask, SunGEMState), 1409 VMSTATE_UINT8_ARRAY(tx_data, SunGEMState, MAX_PACKET_SIZE), 1410 VMSTATE_UINT32(tx_size, SunGEMState), 1411 VMSTATE_UINT64(tx_first_ctl, SunGEMState), 1412 VMSTATE_END_OF_LIST() 1413 } 1414 }; 1415 1416 static void sungem_class_init(ObjectClass *klass, void *data) 1417 { 1418 DeviceClass *dc = DEVICE_CLASS(klass); 1419 PCIDeviceClass *k = PCI_DEVICE_CLASS(klass); 1420 1421 k->realize = sungem_realize; 1422 k->exit = sungem_uninit; 1423 k->vendor_id = PCI_VENDOR_ID_APPLE; 1424 k->device_id = PCI_DEVICE_ID_APPLE_UNI_N_GMAC; 1425 k->revision = 0x01; 1426 k->class_id = PCI_CLASS_NETWORK_ETHERNET; 1427 dc->vmsd = &vmstate_sungem; 1428 dc->reset = sungem_reset; 1429 dc->props = sungem_properties; 1430 set_bit(DEVICE_CATEGORY_NETWORK, dc->categories); 1431 } 1432 1433 static const TypeInfo sungem_info = { 1434 .name = TYPE_SUNGEM, 1435 .parent = TYPE_PCI_DEVICE, 1436 .instance_size = sizeof(SunGEMState), 1437 .class_init = sungem_class_init, 1438 .instance_init = sungem_instance_init, 1439 .interfaces = (InterfaceInfo[]) { 1440 { INTERFACE_CONVENTIONAL_PCI_DEVICE }, 1441 { } 1442 } 1443 }; 1444 1445 static void sungem_register_types(void) 1446 { 1447 type_register_static(&sungem_info); 1448 } 1449 1450 type_init(sungem_register_types) 1451