1 /* 2 * QEMU model of SUN GEM ethernet controller 3 * 4 * As found in Apple ASICs among others 5 * 6 * Copyright 2016 Ben Herrenschmidt 7 * Copyright 2017 Mark Cave-Ayland 8 */ 9 10 #include "qemu/osdep.h" 11 #include "hw/pci/pci_device.h" 12 #include "hw/qdev-properties.h" 13 #include "migration/vmstate.h" 14 #include "qemu/log.h" 15 #include "qemu/module.h" 16 #include "net/net.h" 17 #include "net/eth.h" 18 #include "net/checksum.h" 19 #include "hw/net/mii.h" 20 #include "sysemu/sysemu.h" 21 #include "trace.h" 22 #include "qom/object.h" 23 24 #define TYPE_SUNGEM "sungem" 25 26 OBJECT_DECLARE_SIMPLE_TYPE(SunGEMState, SUNGEM) 27 28 #define MAX_PACKET_SIZE 9016 29 30 #define SUNGEM_MMIO_SIZE 0x200000 31 32 /* Global registers */ 33 #define SUNGEM_MMIO_GREG_SIZE 0x2000 34 35 #define GREG_SEBSTATE 0x0000UL /* SEB State Register */ 36 37 #define GREG_STAT 0x000CUL /* Status Register */ 38 #define GREG_STAT_TXINTME 0x00000001 /* TX INTME frame transferred */ 39 #define GREG_STAT_TXALL 0x00000002 /* All TX frames transferred */ 40 #define GREG_STAT_TXDONE 0x00000004 /* One TX frame transferred */ 41 #define GREG_STAT_RXDONE 0x00000010 /* One RX frame arrived */ 42 #define GREG_STAT_RXNOBUF 0x00000020 /* No free RX buffers available */ 43 #define GREG_STAT_RXTAGERR 0x00000040 /* RX tag framing is corrupt */ 44 #define GREG_STAT_TXMAC 0x00004000 /* TX MAC signalled interrupt */ 45 #define GREG_STAT_RXMAC 0x00008000 /* RX MAC signalled interrupt */ 46 #define GREG_STAT_MAC 0x00010000 /* MAC Control signalled irq */ 47 #define GREG_STAT_TXNR 0xfff80000 /* == TXDMA_TXDONE reg val */ 48 #define GREG_STAT_TXNR_SHIFT 19 49 50 /* These interrupts are edge latches in the status register, 51 * reading it (or writing the corresponding bit in IACK) will 52 * clear them 53 */ 54 #define GREG_STAT_LATCH (GREG_STAT_TXALL | GREG_STAT_TXINTME | \ 55 GREG_STAT_RXDONE | GREG_STAT_RXDONE | \ 56 GREG_STAT_RXNOBUF | GREG_STAT_RXTAGERR) 57 58 #define GREG_IMASK 0x0010UL /* Interrupt Mask Register */ 59 #define GREG_IACK 0x0014UL /* Interrupt ACK Register */ 60 #define GREG_STAT2 0x001CUL /* Alias of GREG_STAT */ 61 #define GREG_PCIESTAT 0x1000UL /* PCI Error Status Register */ 62 #define GREG_PCIEMASK 0x1004UL /* PCI Error Mask Register */ 63 64 #define GREG_SWRST 0x1010UL /* Software Reset Register */ 65 #define GREG_SWRST_TXRST 0x00000001 /* TX Software Reset */ 66 #define GREG_SWRST_RXRST 0x00000002 /* RX Software Reset */ 67 #define GREG_SWRST_RSTOUT 0x00000004 /* Force RST# pin active */ 68 69 /* TX DMA Registers */ 70 #define SUNGEM_MMIO_TXDMA_SIZE 0x1000 71 72 #define TXDMA_KICK 0x0000UL /* TX Kick Register */ 73 74 #define TXDMA_CFG 0x0004UL /* TX Configuration Register */ 75 #define TXDMA_CFG_ENABLE 0x00000001 /* Enable TX DMA channel */ 76 #define TXDMA_CFG_RINGSZ 0x0000001e /* TX descriptor ring size */ 77 78 #define TXDMA_DBLOW 0x0008UL /* TX Desc. Base Low */ 79 #define TXDMA_DBHI 0x000CUL /* TX Desc. Base High */ 80 #define TXDMA_PCNT 0x0024UL /* TX FIFO Packet Counter */ 81 #define TXDMA_SMACHINE 0x0028UL /* TX State Machine Register */ 82 #define TXDMA_DPLOW 0x0030UL /* TX Data Pointer Low */ 83 #define TXDMA_DPHI 0x0034UL /* TX Data Pointer High */ 84 #define TXDMA_TXDONE 0x0100UL /* TX Completion Register */ 85 #define TXDMA_FTAG 0x0108UL /* TX FIFO Tag */ 86 #define TXDMA_FSZ 0x0118UL /* TX FIFO Size */ 87 88 /* Receive DMA Registers */ 89 #define SUNGEM_MMIO_RXDMA_SIZE 0x2000 90 91 #define RXDMA_CFG 0x0000UL /* RX Configuration Register */ 92 #define RXDMA_CFG_ENABLE 0x00000001 /* Enable RX DMA channel */ 93 #define RXDMA_CFG_RINGSZ 0x0000001e /* RX descriptor ring size */ 94 #define RXDMA_CFG_FBOFF 0x00001c00 /* Offset of first data byte */ 95 #define RXDMA_CFG_CSUMOFF 0x000fe000 /* Skip bytes before csum calc */ 96 97 #define RXDMA_DBLOW 0x0004UL /* RX Descriptor Base Low */ 98 #define RXDMA_DBHI 0x0008UL /* RX Descriptor Base High */ 99 #define RXDMA_PCNT 0x0018UL /* RX FIFO Packet Counter */ 100 #define RXDMA_SMACHINE 0x001CUL /* RX State Machine Register */ 101 #define RXDMA_PTHRESH 0x0020UL /* Pause Thresholds */ 102 #define RXDMA_DPLOW 0x0024UL /* RX Data Pointer Low */ 103 #define RXDMA_DPHI 0x0028UL /* RX Data Pointer High */ 104 #define RXDMA_KICK 0x0100UL /* RX Kick Register */ 105 #define RXDMA_DONE 0x0104UL /* RX Completion Register */ 106 #define RXDMA_BLANK 0x0108UL /* RX Blanking Register */ 107 #define RXDMA_FTAG 0x0110UL /* RX FIFO Tag */ 108 #define RXDMA_FSZ 0x0120UL /* RX FIFO Size */ 109 110 /* WOL Registers */ 111 #define SUNGEM_MMIO_WOL_SIZE 0x14 112 113 #define WOL_MATCH0 0x0000UL 114 #define WOL_MATCH1 0x0004UL 115 #define WOL_MATCH2 0x0008UL 116 #define WOL_MCOUNT 0x000CUL 117 #define WOL_WAKECSR 0x0010UL 118 119 /* MAC Registers */ 120 #define SUNGEM_MMIO_MAC_SIZE 0x200 121 122 #define MAC_TXRST 0x0000UL /* TX MAC Software Reset Command */ 123 #define MAC_RXRST 0x0004UL /* RX MAC Software Reset Command */ 124 #define MAC_TXSTAT 0x0010UL /* TX MAC Status Register */ 125 #define MAC_RXSTAT 0x0014UL /* RX MAC Status Register */ 126 127 #define MAC_CSTAT 0x0018UL /* MAC Control Status Register */ 128 #define MAC_CSTAT_PTR 0xffff0000 /* Pause Time Received */ 129 130 #define MAC_TXMASK 0x0020UL /* TX MAC Mask Register */ 131 #define MAC_RXMASK 0x0024UL /* RX MAC Mask Register */ 132 #define MAC_MCMASK 0x0028UL /* MAC Control Mask Register */ 133 134 #define MAC_TXCFG 0x0030UL /* TX MAC Configuration Register */ 135 #define MAC_TXCFG_ENAB 0x00000001 /* TX MAC Enable */ 136 137 #define MAC_RXCFG 0x0034UL /* RX MAC Configuration Register */ 138 #define MAC_RXCFG_ENAB 0x00000001 /* RX MAC Enable */ 139 #define MAC_RXCFG_SFCS 0x00000004 /* Strip FCS */ 140 #define MAC_RXCFG_PROM 0x00000008 /* Promiscuous Mode */ 141 #define MAC_RXCFG_PGRP 0x00000010 /* Promiscuous Group */ 142 #define MAC_RXCFG_HFE 0x00000020 /* Hash Filter Enable */ 143 144 #define MAC_XIFCFG 0x003CUL /* XIF Configuration Register */ 145 #define MAC_XIFCFG_LBCK 0x00000002 /* Loopback TX to RX */ 146 147 #define MAC_MINFSZ 0x0050UL /* MinFrameSize Register */ 148 #define MAC_MAXFSZ 0x0054UL /* MaxFrameSize Register */ 149 #define MAC_ADDR0 0x0080UL /* MAC Address 0 Register */ 150 #define MAC_ADDR1 0x0084UL /* MAC Address 1 Register */ 151 #define MAC_ADDR2 0x0088UL /* MAC Address 2 Register */ 152 #define MAC_ADDR3 0x008CUL /* MAC Address 3 Register */ 153 #define MAC_ADDR4 0x0090UL /* MAC Address 4 Register */ 154 #define MAC_ADDR5 0x0094UL /* MAC Address 5 Register */ 155 #define MAC_HASH0 0x00C0UL /* Hash Table 0 Register */ 156 #define MAC_PATMPS 0x0114UL /* Peak Attempts Register */ 157 #define MAC_SMACHINE 0x0134UL /* State Machine Register */ 158 159 /* MIF Registers */ 160 #define SUNGEM_MMIO_MIF_SIZE 0x20 161 162 #define MIF_FRAME 0x000CUL /* MIF Frame/Output Register */ 163 #define MIF_FRAME_OP 0x30000000 /* OPcode */ 164 #define MIF_FRAME_PHYAD 0x0f800000 /* PHY ADdress */ 165 #define MIF_FRAME_REGAD 0x007c0000 /* REGister ADdress */ 166 #define MIF_FRAME_TALSB 0x00010000 /* Turn Around LSB */ 167 #define MIF_FRAME_DATA 0x0000ffff /* Instruction Payload */ 168 169 #define MIF_CFG 0x0010UL /* MIF Configuration Register */ 170 #define MIF_CFG_MDI0 0x00000100 /* MDIO_0 present or read-bit */ 171 #define MIF_CFG_MDI1 0x00000200 /* MDIO_1 present or read-bit */ 172 173 #define MIF_STATUS 0x0018UL /* MIF Status Register */ 174 #define MIF_SMACHINE 0x001CUL /* MIF State Machine Register */ 175 176 /* PCS/Serialink Registers */ 177 #define SUNGEM_MMIO_PCS_SIZE 0x60 178 #define PCS_MIISTAT 0x0004UL /* PCS MII Status Register */ 179 #define PCS_ISTAT 0x0018UL /* PCS Interrupt Status Reg */ 180 181 #define PCS_SSTATE 0x005CUL /* Serialink State Register */ 182 183 /* Descriptors */ 184 struct gem_txd { 185 uint64_t control_word; 186 uint64_t buffer; 187 }; 188 189 #define TXDCTRL_BUFSZ 0x0000000000007fffULL /* Buffer Size */ 190 #define TXDCTRL_CSTART 0x00000000001f8000ULL /* CSUM Start Offset */ 191 #define TXDCTRL_COFF 0x000000001fe00000ULL /* CSUM Stuff Offset */ 192 #define TXDCTRL_CENAB 0x0000000020000000ULL /* CSUM Enable */ 193 #define TXDCTRL_EOF 0x0000000040000000ULL /* End of Frame */ 194 #define TXDCTRL_SOF 0x0000000080000000ULL /* Start of Frame */ 195 #define TXDCTRL_INTME 0x0000000100000000ULL /* "Interrupt Me" */ 196 197 struct gem_rxd { 198 uint64_t status_word; 199 uint64_t buffer; 200 }; 201 202 #define RXDCTRL_HPASS 0x1000000000000000ULL /* Passed Hash Filter */ 203 #define RXDCTRL_ALTMAC 0x2000000000000000ULL /* Matched ALT MAC */ 204 205 206 struct SunGEMState { 207 PCIDevice pdev; 208 209 MemoryRegion sungem; 210 MemoryRegion greg; 211 MemoryRegion txdma; 212 MemoryRegion rxdma; 213 MemoryRegion wol; 214 MemoryRegion mac; 215 MemoryRegion mif; 216 MemoryRegion pcs; 217 NICState *nic; 218 NICConf conf; 219 uint32_t phy_addr; 220 221 uint32_t gregs[SUNGEM_MMIO_GREG_SIZE >> 2]; 222 uint32_t txdmaregs[SUNGEM_MMIO_TXDMA_SIZE >> 2]; 223 uint32_t rxdmaregs[SUNGEM_MMIO_RXDMA_SIZE >> 2]; 224 uint32_t macregs[SUNGEM_MMIO_MAC_SIZE >> 2]; 225 uint32_t mifregs[SUNGEM_MMIO_MIF_SIZE >> 2]; 226 uint32_t pcsregs[SUNGEM_MMIO_PCS_SIZE >> 2]; 227 228 /* Cache some useful things */ 229 uint32_t rx_mask; 230 uint32_t tx_mask; 231 232 /* Current tx packet */ 233 uint8_t tx_data[MAX_PACKET_SIZE]; 234 uint32_t tx_size; 235 uint64_t tx_first_ctl; 236 }; 237 238 239 static void sungem_eval_irq(SunGEMState *s) 240 { 241 uint32_t stat, mask; 242 243 mask = s->gregs[GREG_IMASK >> 2]; 244 stat = s->gregs[GREG_STAT >> 2] & ~GREG_STAT_TXNR; 245 if (stat & ~mask) { 246 pci_set_irq(PCI_DEVICE(s), 1); 247 } else { 248 pci_set_irq(PCI_DEVICE(s), 0); 249 } 250 } 251 252 static void sungem_update_status(SunGEMState *s, uint32_t bits, bool val) 253 { 254 uint32_t stat; 255 256 stat = s->gregs[GREG_STAT >> 2]; 257 if (val) { 258 stat |= bits; 259 } else { 260 stat &= ~bits; 261 } 262 s->gregs[GREG_STAT >> 2] = stat; 263 sungem_eval_irq(s); 264 } 265 266 static void sungem_eval_cascade_irq(SunGEMState *s) 267 { 268 uint32_t stat, mask; 269 270 mask = s->macregs[MAC_TXSTAT >> 2]; 271 stat = s->macregs[MAC_TXMASK >> 2]; 272 if (stat & ~mask) { 273 sungem_update_status(s, GREG_STAT_TXMAC, true); 274 } else { 275 sungem_update_status(s, GREG_STAT_TXMAC, false); 276 } 277 278 mask = s->macregs[MAC_RXSTAT >> 2]; 279 stat = s->macregs[MAC_RXMASK >> 2]; 280 if (stat & ~mask) { 281 sungem_update_status(s, GREG_STAT_RXMAC, true); 282 } else { 283 sungem_update_status(s, GREG_STAT_RXMAC, false); 284 } 285 286 mask = s->macregs[MAC_CSTAT >> 2]; 287 stat = s->macregs[MAC_MCMASK >> 2] & ~MAC_CSTAT_PTR; 288 if (stat & ~mask) { 289 sungem_update_status(s, GREG_STAT_MAC, true); 290 } else { 291 sungem_update_status(s, GREG_STAT_MAC, false); 292 } 293 } 294 295 static void sungem_do_tx_csum(SunGEMState *s) 296 { 297 uint16_t start, off; 298 uint32_t csum; 299 300 start = (s->tx_first_ctl & TXDCTRL_CSTART) >> 15; 301 off = (s->tx_first_ctl & TXDCTRL_COFF) >> 21; 302 303 trace_sungem_tx_checksum(start, off); 304 305 if (start > (s->tx_size - 2) || off > (s->tx_size - 2)) { 306 trace_sungem_tx_checksum_oob(); 307 return; 308 } 309 310 csum = net_raw_checksum(s->tx_data + start, s->tx_size - start); 311 stw_be_p(s->tx_data + off, csum); 312 } 313 314 static void sungem_send_packet(SunGEMState *s, const uint8_t *buf, 315 int size) 316 { 317 NetClientState *nc = qemu_get_queue(s->nic); 318 319 if (s->macregs[MAC_XIFCFG >> 2] & MAC_XIFCFG_LBCK) { 320 qemu_receive_packet(nc, buf, size); 321 } else { 322 qemu_send_packet(nc, buf, size); 323 } 324 } 325 326 static void sungem_process_tx_desc(SunGEMState *s, struct gem_txd *desc) 327 { 328 PCIDevice *d = PCI_DEVICE(s); 329 uint32_t len; 330 331 /* If it's a start of frame, discard anything we had in the 332 * buffer and start again. This should be an error condition 333 * if we had something ... for now we ignore it 334 */ 335 if (desc->control_word & TXDCTRL_SOF) { 336 if (s->tx_first_ctl) { 337 trace_sungem_tx_unfinished(); 338 } 339 s->tx_size = 0; 340 s->tx_first_ctl = desc->control_word; 341 } 342 343 /* Grab data size */ 344 len = desc->control_word & TXDCTRL_BUFSZ; 345 346 /* Clamp it to our max size */ 347 if ((s->tx_size + len) > MAX_PACKET_SIZE) { 348 trace_sungem_tx_overflow(); 349 len = MAX_PACKET_SIZE - s->tx_size; 350 } 351 352 /* Read the data */ 353 pci_dma_read(d, desc->buffer, &s->tx_data[s->tx_size], len); 354 s->tx_size += len; 355 356 /* If end of frame, send packet */ 357 if (desc->control_word & TXDCTRL_EOF) { 358 trace_sungem_tx_finished(s->tx_size); 359 360 /* Handle csum */ 361 if (s->tx_first_ctl & TXDCTRL_CENAB) { 362 sungem_do_tx_csum(s); 363 } 364 365 /* Send it */ 366 sungem_send_packet(s, s->tx_data, s->tx_size); 367 368 /* No more pending packet */ 369 s->tx_size = 0; 370 s->tx_first_ctl = 0; 371 } 372 } 373 374 static void sungem_tx_kick(SunGEMState *s) 375 { 376 PCIDevice *d = PCI_DEVICE(s); 377 uint32_t comp, kick; 378 uint32_t txdma_cfg, txmac_cfg, ints; 379 uint64_t dbase; 380 381 trace_sungem_tx_kick(); 382 383 /* Check that both TX MAC and TX DMA are enabled. We don't 384 * handle DMA-less direct FIFO operations (we don't emulate 385 * the FIFO at all). 386 * 387 * A write to TXDMA_KICK while DMA isn't enabled can happen 388 * when the driver is resetting the pointer. 389 */ 390 txdma_cfg = s->txdmaregs[TXDMA_CFG >> 2]; 391 txmac_cfg = s->macregs[MAC_TXCFG >> 2]; 392 if (!(txdma_cfg & TXDMA_CFG_ENABLE) || 393 !(txmac_cfg & MAC_TXCFG_ENAB)) { 394 trace_sungem_tx_disabled(); 395 return; 396 } 397 398 /* XXX Test min frame size register ? */ 399 /* XXX Test max frame size register ? */ 400 401 dbase = s->txdmaregs[TXDMA_DBHI >> 2]; 402 dbase = (dbase << 32) | s->txdmaregs[TXDMA_DBLOW >> 2]; 403 404 comp = s->txdmaregs[TXDMA_TXDONE >> 2] & s->tx_mask; 405 kick = s->txdmaregs[TXDMA_KICK >> 2] & s->tx_mask; 406 407 trace_sungem_tx_process(comp, kick, s->tx_mask + 1); 408 409 /* This is rather primitive for now, we just send everything we 410 * can in one go, like e1000. Ideally we should do the sending 411 * from some kind of background task 412 */ 413 while (comp != kick) { 414 struct gem_txd desc; 415 416 /* Read the next descriptor */ 417 pci_dma_read(d, dbase + comp * sizeof(desc), &desc, sizeof(desc)); 418 419 /* Byteswap descriptor */ 420 desc.control_word = le64_to_cpu(desc.control_word); 421 desc.buffer = le64_to_cpu(desc.buffer); 422 trace_sungem_tx_desc(comp, desc.control_word, desc.buffer); 423 424 /* Send it for processing */ 425 sungem_process_tx_desc(s, &desc); 426 427 /* Interrupt */ 428 ints = GREG_STAT_TXDONE; 429 if (desc.control_word & TXDCTRL_INTME) { 430 ints |= GREG_STAT_TXINTME; 431 } 432 sungem_update_status(s, ints, true); 433 434 /* Next ! */ 435 comp = (comp + 1) & s->tx_mask; 436 s->txdmaregs[TXDMA_TXDONE >> 2] = comp; 437 } 438 439 /* We sent everything, set status/irq bit */ 440 sungem_update_status(s, GREG_STAT_TXALL, true); 441 } 442 443 static bool sungem_rx_full(SunGEMState *s, uint32_t kick, uint32_t done) 444 { 445 return kick == ((done + 1) & s->rx_mask); 446 } 447 448 static bool sungem_can_receive(NetClientState *nc) 449 { 450 SunGEMState *s = qemu_get_nic_opaque(nc); 451 uint32_t kick, done, rxdma_cfg, rxmac_cfg; 452 bool full; 453 454 rxmac_cfg = s->macregs[MAC_RXCFG >> 2]; 455 rxdma_cfg = s->rxdmaregs[RXDMA_CFG >> 2]; 456 457 /* If MAC disabled, can't receive */ 458 if ((rxmac_cfg & MAC_RXCFG_ENAB) == 0) { 459 trace_sungem_rx_mac_disabled(); 460 return false; 461 } 462 if ((rxdma_cfg & RXDMA_CFG_ENABLE) == 0) { 463 trace_sungem_rx_txdma_disabled(); 464 return false; 465 } 466 467 /* Check RX availability */ 468 kick = s->rxdmaregs[RXDMA_KICK >> 2]; 469 done = s->rxdmaregs[RXDMA_DONE >> 2]; 470 full = sungem_rx_full(s, kick, done); 471 472 trace_sungem_rx_check(!full, kick, done); 473 474 return !full; 475 } 476 477 enum { 478 rx_no_match, 479 rx_match_promisc, 480 rx_match_bcast, 481 rx_match_allmcast, 482 rx_match_mcast, 483 rx_match_mac, 484 rx_match_altmac, 485 }; 486 487 static int sungem_check_rx_mac(SunGEMState *s, const uint8_t *mac, uint32_t crc) 488 { 489 uint32_t rxcfg = s->macregs[MAC_RXCFG >> 2]; 490 uint32_t mac0, mac1, mac2; 491 492 /* Promisc enabled ? */ 493 if (rxcfg & MAC_RXCFG_PROM) { 494 return rx_match_promisc; 495 } 496 497 /* Format MAC address into dwords */ 498 mac0 = (mac[4] << 8) | mac[5]; 499 mac1 = (mac[2] << 8) | mac[3]; 500 mac2 = (mac[0] << 8) | mac[1]; 501 502 trace_sungem_rx_mac_check(mac0, mac1, mac2); 503 504 /* Is this a broadcast frame ? */ 505 if (mac0 == 0xffff && mac1 == 0xffff && mac2 == 0xffff) { 506 return rx_match_bcast; 507 } 508 509 /* TODO: Implement address filter registers (or we don't care ?) */ 510 511 /* Is this a multicast frame ? */ 512 if (mac[0] & 1) { 513 trace_sungem_rx_mac_multicast(); 514 515 /* Promisc group enabled ? */ 516 if (rxcfg & MAC_RXCFG_PGRP) { 517 return rx_match_allmcast; 518 } 519 520 /* TODO: Check MAC control frames (or we don't care) ? */ 521 522 /* Check hash filter (somebody check that's correct ?) */ 523 if (rxcfg & MAC_RXCFG_HFE) { 524 uint32_t hash, idx; 525 526 crc >>= 24; 527 idx = (crc >> 2) & 0x3c; 528 hash = s->macregs[(MAC_HASH0 + idx) >> 2]; 529 if (hash & (1 << (15 - (crc & 0xf)))) { 530 return rx_match_mcast; 531 } 532 } 533 return rx_no_match; 534 } 535 536 /* Main MAC check */ 537 trace_sungem_rx_mac_compare(s->macregs[MAC_ADDR0 >> 2], 538 s->macregs[MAC_ADDR1 >> 2], 539 s->macregs[MAC_ADDR2 >> 2]); 540 541 if (mac0 == s->macregs[MAC_ADDR0 >> 2] && 542 mac1 == s->macregs[MAC_ADDR1 >> 2] && 543 mac2 == s->macregs[MAC_ADDR2 >> 2]) { 544 return rx_match_mac; 545 } 546 547 /* Alt MAC check */ 548 if (mac0 == s->macregs[MAC_ADDR3 >> 2] && 549 mac1 == s->macregs[MAC_ADDR4 >> 2] && 550 mac2 == s->macregs[MAC_ADDR5 >> 2]) { 551 return rx_match_altmac; 552 } 553 554 return rx_no_match; 555 } 556 557 static ssize_t sungem_receive(NetClientState *nc, const uint8_t *buf, 558 size_t size) 559 { 560 SunGEMState *s = qemu_get_nic_opaque(nc); 561 PCIDevice *d = PCI_DEVICE(s); 562 uint32_t mac_crc, done, kick, max_fsize; 563 uint32_t fcs_size, ints, rxdma_cfg, rxmac_cfg, csum, coff; 564 uint8_t smallbuf[60]; 565 struct gem_rxd desc; 566 uint64_t dbase, baddr; 567 unsigned int rx_cond; 568 569 trace_sungem_rx_packet(size); 570 571 rxmac_cfg = s->macregs[MAC_RXCFG >> 2]; 572 rxdma_cfg = s->rxdmaregs[RXDMA_CFG >> 2]; 573 max_fsize = s->macregs[MAC_MAXFSZ >> 2] & 0x7fff; 574 575 /* If MAC or DMA disabled, can't receive */ 576 if (!(rxdma_cfg & RXDMA_CFG_ENABLE) || 577 !(rxmac_cfg & MAC_RXCFG_ENAB)) { 578 trace_sungem_rx_disabled(); 579 return 0; 580 } 581 582 /* Size adjustment for FCS */ 583 if (rxmac_cfg & MAC_RXCFG_SFCS) { 584 fcs_size = 0; 585 } else { 586 fcs_size = 4; 587 } 588 589 /* Discard frame smaller than a MAC or larger than max frame size 590 * (when accounting for FCS) 591 */ 592 if (size < 6 || (size + 4) > max_fsize) { 593 trace_sungem_rx_bad_frame_size(size); 594 /* XXX Increment error statistics ? */ 595 return size; 596 } 597 598 /* We don't drop too small frames since we get them in qemu, we pad 599 * them instead. We should probably use the min frame size register 600 * but I don't want to use a variable size staging buffer and I 601 * know both MacOS and Linux use the default 64 anyway. We use 60 602 * here to account for the non-existent FCS. 603 */ 604 if (size < 60) { 605 memcpy(smallbuf, buf, size); 606 memset(&smallbuf[size], 0, 60 - size); 607 buf = smallbuf; 608 size = 60; 609 } 610 611 /* Get MAC crc */ 612 mac_crc = net_crc32_le(buf, ETH_ALEN); 613 614 /* Packet isn't for me ? */ 615 rx_cond = sungem_check_rx_mac(s, buf, mac_crc); 616 if (rx_cond == rx_no_match) { 617 /* Just drop it */ 618 trace_sungem_rx_unmatched(); 619 return size; 620 } 621 622 /* Get ring pointers */ 623 kick = s->rxdmaregs[RXDMA_KICK >> 2] & s->rx_mask; 624 done = s->rxdmaregs[RXDMA_DONE >> 2] & s->rx_mask; 625 626 trace_sungem_rx_process(done, kick, s->rx_mask + 1); 627 628 /* Ring full ? Can't receive */ 629 if (sungem_rx_full(s, kick, done)) { 630 trace_sungem_rx_ringfull(); 631 return 0; 632 } 633 634 /* Note: The real GEM will fetch descriptors in blocks of 4, 635 * for now we handle them one at a time, I think the driver will 636 * cope 637 */ 638 639 dbase = s->rxdmaregs[RXDMA_DBHI >> 2]; 640 dbase = (dbase << 32) | s->rxdmaregs[RXDMA_DBLOW >> 2]; 641 642 /* Read the next descriptor */ 643 pci_dma_read(d, dbase + done * sizeof(desc), &desc, sizeof(desc)); 644 645 trace_sungem_rx_desc(le64_to_cpu(desc.status_word), 646 le64_to_cpu(desc.buffer)); 647 648 /* Effective buffer address */ 649 baddr = le64_to_cpu(desc.buffer) & ~7ull; 650 baddr |= (rxdma_cfg & RXDMA_CFG_FBOFF) >> 10; 651 652 /* Write buffer out */ 653 pci_dma_write(d, baddr, buf, size); 654 655 if (fcs_size) { 656 /* Should we add an FCS ? Linux doesn't ask us to strip it, 657 * however I believe nothing checks it... For now we just 658 * do nothing. It's faster this way. 659 */ 660 } 661 662 /* Calculate the checksum */ 663 coff = (rxdma_cfg & RXDMA_CFG_CSUMOFF) >> 13; 664 csum = net_raw_checksum((uint8_t *)buf + coff, size - coff); 665 666 /* Build the updated descriptor */ 667 desc.status_word = (size + fcs_size) << 16; 668 desc.status_word |= ((uint64_t)(mac_crc >> 16)) << 44; 669 desc.status_word |= csum; 670 if (rx_cond == rx_match_mcast) { 671 desc.status_word |= RXDCTRL_HPASS; 672 } 673 if (rx_cond == rx_match_altmac) { 674 desc.status_word |= RXDCTRL_ALTMAC; 675 } 676 desc.status_word = cpu_to_le64(desc.status_word); 677 678 pci_dma_write(d, dbase + done * sizeof(desc), &desc, sizeof(desc)); 679 680 done = (done + 1) & s->rx_mask; 681 s->rxdmaregs[RXDMA_DONE >> 2] = done; 682 683 /* XXX Unconditionally set RX interrupt for now. The interrupt 684 * mitigation timer might well end up adding more overhead than 685 * helping here... 686 */ 687 ints = GREG_STAT_RXDONE; 688 if (sungem_rx_full(s, kick, done)) { 689 ints |= GREG_STAT_RXNOBUF; 690 } 691 sungem_update_status(s, ints, true); 692 693 return size; 694 } 695 696 static void sungem_set_link_status(NetClientState *nc) 697 { 698 /* We don't do anything for now as I believe none of the OSes 699 * drivers use the MIF autopoll feature nor the PHY interrupt 700 */ 701 } 702 703 static void sungem_update_masks(SunGEMState *s) 704 { 705 uint32_t sz; 706 707 sz = 1 << (((s->rxdmaregs[RXDMA_CFG >> 2] & RXDMA_CFG_RINGSZ) >> 1) + 5); 708 s->rx_mask = sz - 1; 709 710 sz = 1 << (((s->txdmaregs[TXDMA_CFG >> 2] & TXDMA_CFG_RINGSZ) >> 1) + 5); 711 s->tx_mask = sz - 1; 712 } 713 714 static void sungem_reset_rx(SunGEMState *s) 715 { 716 trace_sungem_rx_reset(); 717 718 /* XXX Do RXCFG */ 719 /* XXX Check value */ 720 s->rxdmaregs[RXDMA_FSZ >> 2] = 0x140; 721 s->rxdmaregs[RXDMA_DONE >> 2] = 0; 722 s->rxdmaregs[RXDMA_KICK >> 2] = 0; 723 s->rxdmaregs[RXDMA_CFG >> 2] = 0x1000010; 724 s->rxdmaregs[RXDMA_PTHRESH >> 2] = 0xf8; 725 s->rxdmaregs[RXDMA_BLANK >> 2] = 0; 726 727 sungem_update_masks(s); 728 } 729 730 static void sungem_reset_tx(SunGEMState *s) 731 { 732 trace_sungem_tx_reset(); 733 734 /* XXX Do TXCFG */ 735 /* XXX Check value */ 736 s->txdmaregs[TXDMA_FSZ >> 2] = 0x90; 737 s->txdmaregs[TXDMA_TXDONE >> 2] = 0; 738 s->txdmaregs[TXDMA_KICK >> 2] = 0; 739 s->txdmaregs[TXDMA_CFG >> 2] = 0x118010; 740 741 sungem_update_masks(s); 742 743 s->tx_size = 0; 744 s->tx_first_ctl = 0; 745 } 746 747 static void sungem_reset_all(SunGEMState *s, bool pci_reset) 748 { 749 trace_sungem_reset(pci_reset); 750 751 sungem_reset_rx(s); 752 sungem_reset_tx(s); 753 754 s->gregs[GREG_IMASK >> 2] = 0xFFFFFFF; 755 s->gregs[GREG_STAT >> 2] = 0; 756 if (pci_reset) { 757 uint8_t *ma = s->conf.macaddr.a; 758 759 s->gregs[GREG_SWRST >> 2] = 0; 760 s->macregs[MAC_ADDR0 >> 2] = (ma[4] << 8) | ma[5]; 761 s->macregs[MAC_ADDR1 >> 2] = (ma[2] << 8) | ma[3]; 762 s->macregs[MAC_ADDR2 >> 2] = (ma[0] << 8) | ma[1]; 763 } else { 764 s->gregs[GREG_SWRST >> 2] &= GREG_SWRST_RSTOUT; 765 } 766 s->mifregs[MIF_CFG >> 2] = MIF_CFG_MDI0; 767 } 768 769 static void sungem_mii_write(SunGEMState *s, uint8_t phy_addr, 770 uint8_t reg_addr, uint16_t val) 771 { 772 trace_sungem_mii_write(phy_addr, reg_addr, val); 773 774 /* XXX TODO */ 775 } 776 777 static uint16_t __sungem_mii_read(SunGEMState *s, uint8_t phy_addr, 778 uint8_t reg_addr) 779 { 780 if (phy_addr != s->phy_addr) { 781 return 0xffff; 782 } 783 /* Primitive emulation of a BCM5201 to please the driver, 784 * ID is 0x00406210. TODO: Do a gigabit PHY like BCM5400 785 */ 786 switch (reg_addr) { 787 case MII_BMCR: 788 return 0; 789 case MII_PHYID1: 790 return 0x0040; 791 case MII_PHYID2: 792 return 0x6210; 793 case MII_BMSR: 794 if (qemu_get_queue(s->nic)->link_down) { 795 return MII_BMSR_100TX_FD | MII_BMSR_AUTONEG; 796 } else { 797 return MII_BMSR_100TX_FD | MII_BMSR_AN_COMP | 798 MII_BMSR_AUTONEG | MII_BMSR_LINK_ST; 799 } 800 case MII_ANLPAR: 801 case MII_ANAR: 802 return MII_ANLPAR_TXFD; 803 case 0x18: /* 5201 AUX status */ 804 return 3; /* 100FD */ 805 default: 806 return 0; 807 }; 808 } 809 static uint16_t sungem_mii_read(SunGEMState *s, uint8_t phy_addr, 810 uint8_t reg_addr) 811 { 812 uint16_t val; 813 814 val = __sungem_mii_read(s, phy_addr, reg_addr); 815 816 trace_sungem_mii_read(phy_addr, reg_addr, val); 817 818 return val; 819 } 820 821 static uint32_t sungem_mii_op(SunGEMState *s, uint32_t val) 822 { 823 uint8_t phy_addr, reg_addr, op; 824 825 /* Ignore not start of frame */ 826 if ((val >> 30) != 1) { 827 trace_sungem_mii_invalid_sof(val >> 30); 828 return 0xffff; 829 } 830 phy_addr = (val & MIF_FRAME_PHYAD) >> 23; 831 reg_addr = (val & MIF_FRAME_REGAD) >> 18; 832 op = (val & MIF_FRAME_OP) >> 28; 833 switch (op) { 834 case 1: 835 sungem_mii_write(s, phy_addr, reg_addr, val & MIF_FRAME_DATA); 836 return val | MIF_FRAME_TALSB; 837 case 2: 838 return sungem_mii_read(s, phy_addr, reg_addr) | MIF_FRAME_TALSB; 839 default: 840 trace_sungem_mii_invalid_op(op); 841 } 842 return 0xffff | MIF_FRAME_TALSB; 843 } 844 845 static void sungem_mmio_greg_write(void *opaque, hwaddr addr, uint64_t val, 846 unsigned size) 847 { 848 SunGEMState *s = opaque; 849 850 if (!(addr < 0x20) && !(addr >= 0x1000 && addr <= 0x1010)) { 851 qemu_log_mask(LOG_GUEST_ERROR, 852 "Write to unknown GREG register 0x%"HWADDR_PRIx"\n", 853 addr); 854 return; 855 } 856 857 trace_sungem_mmio_greg_write(addr, val); 858 859 /* Pre-write filter */ 860 switch (addr) { 861 /* Read only registers */ 862 case GREG_SEBSTATE: 863 case GREG_STAT: 864 case GREG_STAT2: 865 case GREG_PCIESTAT: 866 return; /* No actual write */ 867 case GREG_IACK: 868 val &= GREG_STAT_LATCH; 869 s->gregs[GREG_STAT >> 2] &= ~val; 870 sungem_eval_irq(s); 871 return; /* No actual write */ 872 case GREG_PCIEMASK: 873 val &= 0x7; 874 break; 875 } 876 877 s->gregs[addr >> 2] = val; 878 879 /* Post write action */ 880 switch (addr) { 881 case GREG_IMASK: 882 /* Re-evaluate interrupt */ 883 sungem_eval_irq(s); 884 break; 885 case GREG_SWRST: 886 switch (val & (GREG_SWRST_TXRST | GREG_SWRST_RXRST)) { 887 case GREG_SWRST_RXRST: 888 sungem_reset_rx(s); 889 break; 890 case GREG_SWRST_TXRST: 891 sungem_reset_tx(s); 892 break; 893 case GREG_SWRST_RXRST | GREG_SWRST_TXRST: 894 sungem_reset_all(s, false); 895 } 896 break; 897 } 898 } 899 900 static uint64_t sungem_mmio_greg_read(void *opaque, hwaddr addr, unsigned size) 901 { 902 SunGEMState *s = opaque; 903 uint32_t val; 904 905 if (!(addr < 0x20) && !(addr >= 0x1000 && addr <= 0x1010)) { 906 qemu_log_mask(LOG_GUEST_ERROR, 907 "Read from unknown GREG register 0x%"HWADDR_PRIx"\n", 908 addr); 909 return 0; 910 } 911 912 val = s->gregs[addr >> 2]; 913 914 trace_sungem_mmio_greg_read(addr, val); 915 916 switch (addr) { 917 case GREG_STAT: 918 /* Side effect, clear bottom 7 bits */ 919 s->gregs[GREG_STAT >> 2] &= ~GREG_STAT_LATCH; 920 sungem_eval_irq(s); 921 922 /* Inject TX completion in returned value */ 923 val = (val & ~GREG_STAT_TXNR) | 924 (s->txdmaregs[TXDMA_TXDONE >> 2] << GREG_STAT_TXNR_SHIFT); 925 break; 926 case GREG_STAT2: 927 /* Return the status reg without side effect 928 * (and inject TX completion in returned value) 929 */ 930 val = (s->gregs[GREG_STAT >> 2] & ~GREG_STAT_TXNR) | 931 (s->txdmaregs[TXDMA_TXDONE >> 2] << GREG_STAT_TXNR_SHIFT); 932 break; 933 } 934 935 return val; 936 } 937 938 static const MemoryRegionOps sungem_mmio_greg_ops = { 939 .read = sungem_mmio_greg_read, 940 .write = sungem_mmio_greg_write, 941 .endianness = DEVICE_LITTLE_ENDIAN, 942 .impl = { 943 .min_access_size = 4, 944 .max_access_size = 4, 945 }, 946 }; 947 948 static void sungem_mmio_txdma_write(void *opaque, hwaddr addr, uint64_t val, 949 unsigned size) 950 { 951 SunGEMState *s = opaque; 952 953 if (!(addr < 0x38) && !(addr >= 0x100 && addr <= 0x118)) { 954 qemu_log_mask(LOG_GUEST_ERROR, 955 "Write to unknown TXDMA register 0x%"HWADDR_PRIx"\n", 956 addr); 957 return; 958 } 959 960 trace_sungem_mmio_txdma_write(addr, val); 961 962 /* Pre-write filter */ 963 switch (addr) { 964 /* Read only registers */ 965 case TXDMA_TXDONE: 966 case TXDMA_PCNT: 967 case TXDMA_SMACHINE: 968 case TXDMA_DPLOW: 969 case TXDMA_DPHI: 970 case TXDMA_FSZ: 971 case TXDMA_FTAG: 972 return; /* No actual write */ 973 } 974 975 s->txdmaregs[addr >> 2] = val; 976 977 /* Post write action */ 978 switch (addr) { 979 case TXDMA_KICK: 980 sungem_tx_kick(s); 981 break; 982 case TXDMA_CFG: 983 sungem_update_masks(s); 984 break; 985 } 986 } 987 988 static uint64_t sungem_mmio_txdma_read(void *opaque, hwaddr addr, unsigned size) 989 { 990 SunGEMState *s = opaque; 991 uint32_t val; 992 993 if (!(addr < 0x38) && !(addr >= 0x100 && addr <= 0x118)) { 994 qemu_log_mask(LOG_GUEST_ERROR, 995 "Read from unknown TXDMA register 0x%"HWADDR_PRIx"\n", 996 addr); 997 return 0; 998 } 999 1000 val = s->txdmaregs[addr >> 2]; 1001 1002 trace_sungem_mmio_txdma_read(addr, val); 1003 1004 return val; 1005 } 1006 1007 static const MemoryRegionOps sungem_mmio_txdma_ops = { 1008 .read = sungem_mmio_txdma_read, 1009 .write = sungem_mmio_txdma_write, 1010 .endianness = DEVICE_LITTLE_ENDIAN, 1011 .impl = { 1012 .min_access_size = 4, 1013 .max_access_size = 4, 1014 }, 1015 }; 1016 1017 static void sungem_mmio_rxdma_write(void *opaque, hwaddr addr, uint64_t val, 1018 unsigned size) 1019 { 1020 SunGEMState *s = opaque; 1021 1022 if (!(addr <= 0x28) && !(addr >= 0x100 && addr <= 0x120)) { 1023 qemu_log_mask(LOG_GUEST_ERROR, 1024 "Write to unknown RXDMA register 0x%"HWADDR_PRIx"\n", 1025 addr); 1026 return; 1027 } 1028 1029 trace_sungem_mmio_rxdma_write(addr, val); 1030 1031 /* Pre-write filter */ 1032 switch (addr) { 1033 /* Read only registers */ 1034 case RXDMA_DONE: 1035 case RXDMA_PCNT: 1036 case RXDMA_SMACHINE: 1037 case RXDMA_DPLOW: 1038 case RXDMA_DPHI: 1039 case RXDMA_FSZ: 1040 case RXDMA_FTAG: 1041 return; /* No actual write */ 1042 } 1043 1044 s->rxdmaregs[addr >> 2] = val; 1045 1046 /* Post write action */ 1047 switch (addr) { 1048 case RXDMA_KICK: 1049 trace_sungem_rx_kick(val); 1050 break; 1051 case RXDMA_CFG: 1052 sungem_update_masks(s); 1053 if ((s->macregs[MAC_RXCFG >> 2] & MAC_RXCFG_ENAB) != 0 && 1054 (s->rxdmaregs[RXDMA_CFG >> 2] & RXDMA_CFG_ENABLE) != 0) { 1055 qemu_flush_queued_packets(qemu_get_queue(s->nic)); 1056 } 1057 break; 1058 } 1059 } 1060 1061 static uint64_t sungem_mmio_rxdma_read(void *opaque, hwaddr addr, unsigned size) 1062 { 1063 SunGEMState *s = opaque; 1064 uint32_t val; 1065 1066 if (!(addr <= 0x28) && !(addr >= 0x100 && addr <= 0x120)) { 1067 qemu_log_mask(LOG_GUEST_ERROR, 1068 "Read from unknown RXDMA register 0x%"HWADDR_PRIx"\n", 1069 addr); 1070 return 0; 1071 } 1072 1073 val = s->rxdmaregs[addr >> 2]; 1074 1075 trace_sungem_mmio_rxdma_read(addr, val); 1076 1077 return val; 1078 } 1079 1080 static const MemoryRegionOps sungem_mmio_rxdma_ops = { 1081 .read = sungem_mmio_rxdma_read, 1082 .write = sungem_mmio_rxdma_write, 1083 .endianness = DEVICE_LITTLE_ENDIAN, 1084 .impl = { 1085 .min_access_size = 4, 1086 .max_access_size = 4, 1087 }, 1088 }; 1089 1090 static void sungem_mmio_wol_write(void *opaque, hwaddr addr, uint64_t val, 1091 unsigned size) 1092 { 1093 trace_sungem_mmio_wol_write(addr, val); 1094 1095 switch (addr) { 1096 case WOL_WAKECSR: 1097 if (val != 0) { 1098 qemu_log_mask(LOG_UNIMP, "sungem: WOL not supported\n"); 1099 } 1100 break; 1101 default: 1102 qemu_log_mask(LOG_UNIMP, "sungem: WOL not supported\n"); 1103 } 1104 } 1105 1106 static uint64_t sungem_mmio_wol_read(void *opaque, hwaddr addr, unsigned size) 1107 { 1108 uint32_t val = -1; 1109 1110 qemu_log_mask(LOG_UNIMP, "sungem: WOL not supported\n"); 1111 1112 trace_sungem_mmio_wol_read(addr, val); 1113 1114 return val; 1115 } 1116 1117 static const MemoryRegionOps sungem_mmio_wol_ops = { 1118 .read = sungem_mmio_wol_read, 1119 .write = sungem_mmio_wol_write, 1120 .endianness = DEVICE_LITTLE_ENDIAN, 1121 .impl = { 1122 .min_access_size = 4, 1123 .max_access_size = 4, 1124 }, 1125 }; 1126 1127 static void sungem_mmio_mac_write(void *opaque, hwaddr addr, uint64_t val, 1128 unsigned size) 1129 { 1130 SunGEMState *s = opaque; 1131 1132 if (!(addr <= 0x134)) { 1133 qemu_log_mask(LOG_GUEST_ERROR, 1134 "Write to unknown MAC register 0x%"HWADDR_PRIx"\n", 1135 addr); 1136 return; 1137 } 1138 1139 trace_sungem_mmio_mac_write(addr, val); 1140 1141 /* Pre-write filter */ 1142 switch (addr) { 1143 /* Read only registers */ 1144 case MAC_TXRST: /* Not technically read-only but will do for now */ 1145 case MAC_RXRST: /* Not technically read-only but will do for now */ 1146 case MAC_TXSTAT: 1147 case MAC_RXSTAT: 1148 case MAC_CSTAT: 1149 case MAC_PATMPS: 1150 case MAC_SMACHINE: 1151 return; /* No actual write */ 1152 case MAC_MINFSZ: 1153 /* 10-bits implemented */ 1154 val &= 0x3ff; 1155 break; 1156 } 1157 1158 s->macregs[addr >> 2] = val; 1159 1160 /* Post write action */ 1161 switch (addr) { 1162 case MAC_TXMASK: 1163 case MAC_RXMASK: 1164 case MAC_MCMASK: 1165 sungem_eval_cascade_irq(s); 1166 break; 1167 case MAC_RXCFG: 1168 sungem_update_masks(s); 1169 if ((s->macregs[MAC_RXCFG >> 2] & MAC_RXCFG_ENAB) != 0 && 1170 (s->rxdmaregs[RXDMA_CFG >> 2] & RXDMA_CFG_ENABLE) != 0) { 1171 qemu_flush_queued_packets(qemu_get_queue(s->nic)); 1172 } 1173 break; 1174 } 1175 } 1176 1177 static uint64_t sungem_mmio_mac_read(void *opaque, hwaddr addr, unsigned size) 1178 { 1179 SunGEMState *s = opaque; 1180 uint32_t val; 1181 1182 if (!(addr <= 0x134)) { 1183 qemu_log_mask(LOG_GUEST_ERROR, 1184 "Read from unknown MAC register 0x%"HWADDR_PRIx"\n", 1185 addr); 1186 return 0; 1187 } 1188 1189 val = s->macregs[addr >> 2]; 1190 1191 trace_sungem_mmio_mac_read(addr, val); 1192 1193 switch (addr) { 1194 case MAC_TXSTAT: 1195 /* Side effect, clear all */ 1196 s->macregs[addr >> 2] = 0; 1197 sungem_update_status(s, GREG_STAT_TXMAC, false); 1198 break; 1199 case MAC_RXSTAT: 1200 /* Side effect, clear all */ 1201 s->macregs[addr >> 2] = 0; 1202 sungem_update_status(s, GREG_STAT_RXMAC, false); 1203 break; 1204 case MAC_CSTAT: 1205 /* Side effect, interrupt bits */ 1206 s->macregs[addr >> 2] &= MAC_CSTAT_PTR; 1207 sungem_update_status(s, GREG_STAT_MAC, false); 1208 break; 1209 } 1210 1211 return val; 1212 } 1213 1214 static const MemoryRegionOps sungem_mmio_mac_ops = { 1215 .read = sungem_mmio_mac_read, 1216 .write = sungem_mmio_mac_write, 1217 .endianness = DEVICE_LITTLE_ENDIAN, 1218 .impl = { 1219 .min_access_size = 4, 1220 .max_access_size = 4, 1221 }, 1222 }; 1223 1224 static void sungem_mmio_mif_write(void *opaque, hwaddr addr, uint64_t val, 1225 unsigned size) 1226 { 1227 SunGEMState *s = opaque; 1228 1229 if (!(addr <= 0x1c)) { 1230 qemu_log_mask(LOG_GUEST_ERROR, 1231 "Write to unknown MIF register 0x%"HWADDR_PRIx"\n", 1232 addr); 1233 return; 1234 } 1235 1236 trace_sungem_mmio_mif_write(addr, val); 1237 1238 /* Pre-write filter */ 1239 switch (addr) { 1240 /* Read only registers */ 1241 case MIF_STATUS: 1242 case MIF_SMACHINE: 1243 return; /* No actual write */ 1244 case MIF_CFG: 1245 /* Maintain the RO MDI bits to advertize an MDIO PHY on MDI0 */ 1246 val &= ~MIF_CFG_MDI1; 1247 val |= MIF_CFG_MDI0; 1248 break; 1249 } 1250 1251 s->mifregs[addr >> 2] = val; 1252 1253 /* Post write action */ 1254 switch (addr) { 1255 case MIF_FRAME: 1256 s->mifregs[addr >> 2] = sungem_mii_op(s, val); 1257 break; 1258 } 1259 } 1260 1261 static uint64_t sungem_mmio_mif_read(void *opaque, hwaddr addr, unsigned size) 1262 { 1263 SunGEMState *s = opaque; 1264 uint32_t val; 1265 1266 if (!(addr <= 0x1c)) { 1267 qemu_log_mask(LOG_GUEST_ERROR, 1268 "Read from unknown MIF register 0x%"HWADDR_PRIx"\n", 1269 addr); 1270 return 0; 1271 } 1272 1273 val = s->mifregs[addr >> 2]; 1274 1275 trace_sungem_mmio_mif_read(addr, val); 1276 1277 return val; 1278 } 1279 1280 static const MemoryRegionOps sungem_mmio_mif_ops = { 1281 .read = sungem_mmio_mif_read, 1282 .write = sungem_mmio_mif_write, 1283 .endianness = DEVICE_LITTLE_ENDIAN, 1284 .impl = { 1285 .min_access_size = 4, 1286 .max_access_size = 4, 1287 }, 1288 }; 1289 1290 static void sungem_mmio_pcs_write(void *opaque, hwaddr addr, uint64_t val, 1291 unsigned size) 1292 { 1293 SunGEMState *s = opaque; 1294 1295 if (!(addr <= 0x18) && !(addr >= 0x50 && addr <= 0x5c)) { 1296 qemu_log_mask(LOG_GUEST_ERROR, 1297 "Write to unknown PCS register 0x%"HWADDR_PRIx"\n", 1298 addr); 1299 return; 1300 } 1301 1302 trace_sungem_mmio_pcs_write(addr, val); 1303 1304 /* Pre-write filter */ 1305 switch (addr) { 1306 /* Read only registers */ 1307 case PCS_MIISTAT: 1308 case PCS_ISTAT: 1309 case PCS_SSTATE: 1310 return; /* No actual write */ 1311 } 1312 1313 s->pcsregs[addr >> 2] = val; 1314 } 1315 1316 static uint64_t sungem_mmio_pcs_read(void *opaque, hwaddr addr, unsigned size) 1317 { 1318 SunGEMState *s = opaque; 1319 uint32_t val; 1320 1321 if (!(addr <= 0x18) && !(addr >= 0x50 && addr <= 0x5c)) { 1322 qemu_log_mask(LOG_GUEST_ERROR, 1323 "Read from unknown PCS register 0x%"HWADDR_PRIx"\n", 1324 addr); 1325 return 0; 1326 } 1327 1328 val = s->pcsregs[addr >> 2]; 1329 1330 trace_sungem_mmio_pcs_read(addr, val); 1331 1332 return val; 1333 } 1334 1335 static const MemoryRegionOps sungem_mmio_pcs_ops = { 1336 .read = sungem_mmio_pcs_read, 1337 .write = sungem_mmio_pcs_write, 1338 .endianness = DEVICE_LITTLE_ENDIAN, 1339 .impl = { 1340 .min_access_size = 4, 1341 .max_access_size = 4, 1342 }, 1343 }; 1344 1345 static void sungem_uninit(PCIDevice *dev) 1346 { 1347 SunGEMState *s = SUNGEM(dev); 1348 1349 qemu_del_nic(s->nic); 1350 } 1351 1352 static NetClientInfo net_sungem_info = { 1353 .type = NET_CLIENT_DRIVER_NIC, 1354 .size = sizeof(NICState), 1355 .can_receive = sungem_can_receive, 1356 .receive = sungem_receive, 1357 .link_status_changed = sungem_set_link_status, 1358 }; 1359 1360 static void sungem_realize(PCIDevice *pci_dev, Error **errp) 1361 { 1362 DeviceState *dev = DEVICE(pci_dev); 1363 SunGEMState *s = SUNGEM(pci_dev); 1364 uint8_t *pci_conf; 1365 1366 pci_conf = pci_dev->config; 1367 1368 pci_set_word(pci_conf + PCI_STATUS, 1369 PCI_STATUS_FAST_BACK | 1370 PCI_STATUS_DEVSEL_MEDIUM | 1371 PCI_STATUS_66MHZ); 1372 1373 pci_set_word(pci_conf + PCI_SUBSYSTEM_VENDOR_ID, 0x0); 1374 pci_set_word(pci_conf + PCI_SUBSYSTEM_ID, 0x0); 1375 1376 pci_conf[PCI_INTERRUPT_PIN] = 1; /* interrupt pin A */ 1377 pci_conf[PCI_MIN_GNT] = 0x40; 1378 pci_conf[PCI_MAX_LAT] = 0x40; 1379 1380 sungem_reset_all(s, true); 1381 memory_region_init(&s->sungem, OBJECT(s), "sungem", SUNGEM_MMIO_SIZE); 1382 1383 memory_region_init_io(&s->greg, OBJECT(s), &sungem_mmio_greg_ops, s, 1384 "sungem.greg", SUNGEM_MMIO_GREG_SIZE); 1385 memory_region_add_subregion(&s->sungem, 0, &s->greg); 1386 1387 memory_region_init_io(&s->txdma, OBJECT(s), &sungem_mmio_txdma_ops, s, 1388 "sungem.txdma", SUNGEM_MMIO_TXDMA_SIZE); 1389 memory_region_add_subregion(&s->sungem, 0x2000, &s->txdma); 1390 1391 memory_region_init_io(&s->rxdma, OBJECT(s), &sungem_mmio_rxdma_ops, s, 1392 "sungem.rxdma", SUNGEM_MMIO_RXDMA_SIZE); 1393 memory_region_add_subregion(&s->sungem, 0x4000, &s->rxdma); 1394 1395 memory_region_init_io(&s->wol, OBJECT(s), &sungem_mmio_wol_ops, s, 1396 "sungem.wol", SUNGEM_MMIO_WOL_SIZE); 1397 memory_region_add_subregion(&s->sungem, 0x3000, &s->wol); 1398 1399 memory_region_init_io(&s->mac, OBJECT(s), &sungem_mmio_mac_ops, s, 1400 "sungem.mac", SUNGEM_MMIO_MAC_SIZE); 1401 memory_region_add_subregion(&s->sungem, 0x6000, &s->mac); 1402 1403 memory_region_init_io(&s->mif, OBJECT(s), &sungem_mmio_mif_ops, s, 1404 "sungem.mif", SUNGEM_MMIO_MIF_SIZE); 1405 memory_region_add_subregion(&s->sungem, 0x6200, &s->mif); 1406 1407 memory_region_init_io(&s->pcs, OBJECT(s), &sungem_mmio_pcs_ops, s, 1408 "sungem.pcs", SUNGEM_MMIO_PCS_SIZE); 1409 memory_region_add_subregion(&s->sungem, 0x9000, &s->pcs); 1410 1411 pci_register_bar(pci_dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->sungem); 1412 1413 qemu_macaddr_default_if_unset(&s->conf.macaddr); 1414 s->nic = qemu_new_nic(&net_sungem_info, &s->conf, 1415 object_get_typename(OBJECT(dev)), 1416 dev->id, s); 1417 qemu_format_nic_info_str(qemu_get_queue(s->nic), 1418 s->conf.macaddr.a); 1419 } 1420 1421 static void sungem_reset(DeviceState *dev) 1422 { 1423 SunGEMState *s = SUNGEM(dev); 1424 1425 sungem_reset_all(s, true); 1426 } 1427 1428 static void sungem_instance_init(Object *obj) 1429 { 1430 SunGEMState *s = SUNGEM(obj); 1431 1432 device_add_bootindex_property(obj, &s->conf.bootindex, 1433 "bootindex", "/ethernet-phy@0", 1434 DEVICE(obj)); 1435 } 1436 1437 static Property sungem_properties[] = { 1438 DEFINE_NIC_PROPERTIES(SunGEMState, conf), 1439 /* Phy address should be 0 for most Apple machines except 1440 * for K2 in which case it's 1. Will be set by a machine 1441 * override. 1442 */ 1443 DEFINE_PROP_UINT32("phy_addr", SunGEMState, phy_addr, 0), 1444 DEFINE_PROP_END_OF_LIST(), 1445 }; 1446 1447 static const VMStateDescription vmstate_sungem = { 1448 .name = "sungem", 1449 .version_id = 0, 1450 .minimum_version_id = 0, 1451 .fields = (VMStateField[]) { 1452 VMSTATE_PCI_DEVICE(pdev, SunGEMState), 1453 VMSTATE_MACADDR(conf.macaddr, SunGEMState), 1454 VMSTATE_UINT32(phy_addr, SunGEMState), 1455 VMSTATE_UINT32_ARRAY(gregs, SunGEMState, (SUNGEM_MMIO_GREG_SIZE >> 2)), 1456 VMSTATE_UINT32_ARRAY(txdmaregs, SunGEMState, 1457 (SUNGEM_MMIO_TXDMA_SIZE >> 2)), 1458 VMSTATE_UINT32_ARRAY(rxdmaregs, SunGEMState, 1459 (SUNGEM_MMIO_RXDMA_SIZE >> 2)), 1460 VMSTATE_UINT32_ARRAY(macregs, SunGEMState, (SUNGEM_MMIO_MAC_SIZE >> 2)), 1461 VMSTATE_UINT32_ARRAY(mifregs, SunGEMState, (SUNGEM_MMIO_MIF_SIZE >> 2)), 1462 VMSTATE_UINT32_ARRAY(pcsregs, SunGEMState, (SUNGEM_MMIO_PCS_SIZE >> 2)), 1463 VMSTATE_UINT32(rx_mask, SunGEMState), 1464 VMSTATE_UINT32(tx_mask, SunGEMState), 1465 VMSTATE_UINT8_ARRAY(tx_data, SunGEMState, MAX_PACKET_SIZE), 1466 VMSTATE_UINT32(tx_size, SunGEMState), 1467 VMSTATE_UINT64(tx_first_ctl, SunGEMState), 1468 VMSTATE_END_OF_LIST() 1469 } 1470 }; 1471 1472 static void sungem_class_init(ObjectClass *klass, void *data) 1473 { 1474 DeviceClass *dc = DEVICE_CLASS(klass); 1475 PCIDeviceClass *k = PCI_DEVICE_CLASS(klass); 1476 1477 k->realize = sungem_realize; 1478 k->exit = sungem_uninit; 1479 k->vendor_id = PCI_VENDOR_ID_APPLE; 1480 k->device_id = PCI_DEVICE_ID_APPLE_UNI_N_GMAC; 1481 k->revision = 0x01; 1482 k->class_id = PCI_CLASS_NETWORK_ETHERNET; 1483 dc->vmsd = &vmstate_sungem; 1484 dc->reset = sungem_reset; 1485 device_class_set_props(dc, sungem_properties); 1486 set_bit(DEVICE_CATEGORY_NETWORK, dc->categories); 1487 } 1488 1489 static const TypeInfo sungem_info = { 1490 .name = TYPE_SUNGEM, 1491 .parent = TYPE_PCI_DEVICE, 1492 .instance_size = sizeof(SunGEMState), 1493 .class_init = sungem_class_init, 1494 .instance_init = sungem_instance_init, 1495 .interfaces = (InterfaceInfo[]) { 1496 { INTERFACE_CONVENTIONAL_PCI_DEVICE }, 1497 { } 1498 } 1499 }; 1500 1501 static void sungem_register_types(void) 1502 { 1503 type_register_static(&sungem_info); 1504 } 1505 1506 type_init(sungem_register_types) 1507