1 /* 2 * QEMU TULIP Emulation 3 * 4 * Copyright (c) 2019 Sven Schnelle <svens@stackframe.org> 5 * 6 * This work is licensed under the GNU GPL license version 2 or later. 7 */ 8 9 #include "qemu/osdep.h" 10 #include "qemu/log.h" 11 #include "hw/irq.h" 12 #include "hw/pci/pci_device.h" 13 #include "hw/qdev-properties.h" 14 #include "hw/nvram/eeprom93xx.h" 15 #include "migration/vmstate.h" 16 #include "sysemu/sysemu.h" 17 #include "tulip.h" 18 #include "trace.h" 19 #include "net/eth.h" 20 21 struct TULIPState { 22 PCIDevice dev; 23 MemoryRegion io; 24 MemoryRegion memory; 25 NICConf c; 26 qemu_irq irq; 27 NICState *nic; 28 eeprom_t *eeprom; 29 uint32_t csr[16]; 30 31 /* state for MII */ 32 uint32_t old_csr9; 33 uint32_t mii_word; 34 uint32_t mii_bitcnt; 35 36 hwaddr current_rx_desc; 37 hwaddr current_tx_desc; 38 39 uint8_t rx_frame[2048]; 40 uint8_t tx_frame[2048]; 41 uint16_t tx_frame_len; 42 uint16_t rx_frame_len; 43 uint16_t rx_frame_size; 44 45 uint32_t rx_status; 46 uint8_t filter[16][6]; 47 }; 48 49 static const VMStateDescription vmstate_pci_tulip = { 50 .name = "tulip", 51 .fields = (const VMStateField[]) { 52 VMSTATE_PCI_DEVICE(dev, TULIPState), 53 VMSTATE_UINT32_ARRAY(csr, TULIPState, 16), 54 VMSTATE_UINT32(old_csr9, TULIPState), 55 VMSTATE_UINT32(mii_word, TULIPState), 56 VMSTATE_UINT32(mii_bitcnt, TULIPState), 57 VMSTATE_UINT64(current_rx_desc, TULIPState), 58 VMSTATE_UINT64(current_tx_desc, TULIPState), 59 VMSTATE_BUFFER(rx_frame, TULIPState), 60 VMSTATE_BUFFER(tx_frame, TULIPState), 61 VMSTATE_UINT16(rx_frame_len, TULIPState), 62 VMSTATE_UINT16(tx_frame_len, TULIPState), 63 VMSTATE_UINT16(rx_frame_size, TULIPState), 64 VMSTATE_UINT32(rx_status, TULIPState), 65 VMSTATE_UINT8_2DARRAY(filter, TULIPState, 16, 6), 66 VMSTATE_END_OF_LIST() 67 } 68 }; 69 70 static void tulip_desc_read(TULIPState *s, hwaddr p, 71 struct tulip_descriptor *desc) 72 { 73 const MemTxAttrs attrs = { .memory = true }; 74 75 if (s->csr[0] & CSR0_DBO) { 76 ldl_be_pci_dma(&s->dev, p, &desc->status, attrs); 77 ldl_be_pci_dma(&s->dev, p + 4, &desc->control, attrs); 78 ldl_be_pci_dma(&s->dev, p + 8, &desc->buf_addr1, attrs); 79 ldl_be_pci_dma(&s->dev, p + 12, &desc->buf_addr2, attrs); 80 } else { 81 ldl_le_pci_dma(&s->dev, p, &desc->status, attrs); 82 ldl_le_pci_dma(&s->dev, p + 4, &desc->control, attrs); 83 ldl_le_pci_dma(&s->dev, p + 8, &desc->buf_addr1, attrs); 84 ldl_le_pci_dma(&s->dev, p + 12, &desc->buf_addr2, attrs); 85 } 86 } 87 88 static void tulip_desc_write(TULIPState *s, hwaddr p, 89 struct tulip_descriptor *desc) 90 { 91 const MemTxAttrs attrs = { .memory = true }; 92 93 if (s->csr[0] & CSR0_DBO) { 94 stl_be_pci_dma(&s->dev, p, desc->status, attrs); 95 stl_be_pci_dma(&s->dev, p + 4, desc->control, attrs); 96 stl_be_pci_dma(&s->dev, p + 8, desc->buf_addr1, attrs); 97 stl_be_pci_dma(&s->dev, p + 12, desc->buf_addr2, attrs); 98 } else { 99 stl_le_pci_dma(&s->dev, p, desc->status, attrs); 100 stl_le_pci_dma(&s->dev, p + 4, desc->control, attrs); 101 stl_le_pci_dma(&s->dev, p + 8, desc->buf_addr1, attrs); 102 stl_le_pci_dma(&s->dev, p + 12, desc->buf_addr2, attrs); 103 } 104 } 105 106 static void tulip_update_int(TULIPState *s) 107 { 108 uint32_t ie = s->csr[5] & s->csr[7]; 109 bool assert = false; 110 111 s->csr[5] &= ~(CSR5_AIS | CSR5_NIS); 112 113 if (ie & (CSR5_TI | CSR5_TU | CSR5_RI | CSR5_GTE | CSR5_ERI)) { 114 s->csr[5] |= CSR5_NIS; 115 } 116 117 if (ie & (CSR5_LC | CSR5_GPI | CSR5_FBE | CSR5_LNF | CSR5_ETI | CSR5_RWT | 118 CSR5_RPS | CSR5_RU | CSR5_UNF | CSR5_LNP_ANC | CSR5_TJT | 119 CSR5_TPS)) { 120 s->csr[5] |= CSR5_AIS; 121 } 122 123 assert = s->csr[5] & s->csr[7] & (CSR5_AIS | CSR5_NIS); 124 trace_tulip_irq(s->csr[5], s->csr[7], assert ? "assert" : "deassert"); 125 qemu_set_irq(s->irq, assert); 126 } 127 128 static bool tulip_rx_stopped(TULIPState *s) 129 { 130 return ((s->csr[5] >> CSR5_RS_SHIFT) & CSR5_RS_MASK) == CSR5_RS_STOPPED; 131 } 132 133 static void tulip_dump_tx_descriptor(TULIPState *s, 134 struct tulip_descriptor *desc) 135 { 136 trace_tulip_descriptor("TX ", s->current_tx_desc, 137 desc->status, desc->control >> 22, 138 desc->control & 0x7ff, (desc->control >> 11) & 0x7ff, 139 desc->buf_addr1, desc->buf_addr2); 140 } 141 142 static void tulip_dump_rx_descriptor(TULIPState *s, 143 struct tulip_descriptor *desc) 144 { 145 trace_tulip_descriptor("RX ", s->current_rx_desc, 146 desc->status, desc->control >> 22, 147 desc->control & 0x7ff, (desc->control >> 11) & 0x7ff, 148 desc->buf_addr1, desc->buf_addr2); 149 } 150 151 static void tulip_next_rx_descriptor(TULIPState *s, 152 struct tulip_descriptor *desc) 153 { 154 if (desc->control & RDES1_RER) { 155 s->current_rx_desc = s->csr[3]; 156 } else if (desc->control & RDES1_RCH) { 157 s->current_rx_desc = desc->buf_addr2; 158 } else { 159 s->current_rx_desc += sizeof(struct tulip_descriptor) + 160 (((s->csr[0] >> CSR0_DSL_SHIFT) & CSR0_DSL_MASK) << 2); 161 } 162 s->current_rx_desc &= ~3ULL; 163 } 164 165 static void tulip_copy_rx_bytes(TULIPState *s, struct tulip_descriptor *desc) 166 { 167 int len1 = (desc->control >> RDES1_BUF1_SIZE_SHIFT) & RDES1_BUF1_SIZE_MASK; 168 int len2 = (desc->control >> RDES1_BUF2_SIZE_SHIFT) & RDES1_BUF2_SIZE_MASK; 169 int len; 170 171 if (s->rx_frame_len && len1) { 172 if (s->rx_frame_len > len1) { 173 len = len1; 174 } else { 175 len = s->rx_frame_len; 176 } 177 178 pci_dma_write(&s->dev, desc->buf_addr1, s->rx_frame + 179 (s->rx_frame_size - s->rx_frame_len), len); 180 s->rx_frame_len -= len; 181 } 182 183 if (s->rx_frame_len && len2) { 184 if (s->rx_frame_len > len2) { 185 len = len2; 186 } else { 187 len = s->rx_frame_len; 188 } 189 190 pci_dma_write(&s->dev, desc->buf_addr2, s->rx_frame + 191 (s->rx_frame_size - s->rx_frame_len), len); 192 s->rx_frame_len -= len; 193 } 194 } 195 196 static bool tulip_filter_address(TULIPState *s, const uint8_t *addr) 197 { 198 static const char broadcast[] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }; 199 bool ret = false; 200 int i; 201 202 for (i = 0; i < 16 && ret == false; i++) { 203 if (!memcmp(&s->filter[i], addr, ETH_ALEN)) { 204 ret = true; 205 } 206 } 207 208 if (!memcmp(addr, broadcast, ETH_ALEN)) { 209 return true; 210 } 211 212 if (s->csr[6] & (CSR6_PR | CSR6_RA)) { 213 /* Promiscuous mode enabled */ 214 s->rx_status |= RDES0_FF; 215 return true; 216 } 217 218 if ((s->csr[6] & CSR6_PM) && (addr[0] & 1)) { 219 /* Pass all Multicast enabled */ 220 s->rx_status |= RDES0_MF; 221 return true; 222 } 223 224 if (s->csr[6] & CSR6_IF) { 225 ret ^= true; 226 } 227 return ret; 228 } 229 230 static ssize_t tulip_receive(TULIPState *s, const uint8_t *buf, size_t size) 231 { 232 struct tulip_descriptor desc; 233 234 trace_tulip_receive(buf, size); 235 236 if (size < 14 || size > sizeof(s->rx_frame) - 4 237 || s->rx_frame_len || tulip_rx_stopped(s)) { 238 return 0; 239 } 240 241 if (!tulip_filter_address(s, buf)) { 242 return size; 243 } 244 245 do { 246 tulip_desc_read(s, s->current_rx_desc, &desc); 247 tulip_dump_rx_descriptor(s, &desc); 248 249 if (!(desc.status & RDES0_OWN)) { 250 s->csr[5] |= CSR5_RU; 251 tulip_update_int(s); 252 return s->rx_frame_size - s->rx_frame_len; 253 } 254 desc.status = 0; 255 256 if (!s->rx_frame_len) { 257 s->rx_frame_size = size + 4; 258 s->rx_status = RDES0_LS | 259 ((s->rx_frame_size & RDES0_FL_MASK) << RDES0_FL_SHIFT); 260 desc.status |= RDES0_FS; 261 memcpy(s->rx_frame, buf, size); 262 s->rx_frame_len = s->rx_frame_size; 263 } 264 265 tulip_copy_rx_bytes(s, &desc); 266 267 if (!s->rx_frame_len) { 268 desc.status |= s->rx_status; 269 s->csr[5] |= CSR5_RI; 270 tulip_update_int(s); 271 } 272 tulip_dump_rx_descriptor(s, &desc); 273 tulip_desc_write(s, s->current_rx_desc, &desc); 274 tulip_next_rx_descriptor(s, &desc); 275 } while (s->rx_frame_len); 276 return size; 277 } 278 279 static ssize_t tulip_receive_nc(NetClientState *nc, 280 const uint8_t *buf, size_t size) 281 { 282 return tulip_receive(qemu_get_nic_opaque(nc), buf, size); 283 } 284 285 static NetClientInfo net_tulip_info = { 286 .type = NET_CLIENT_DRIVER_NIC, 287 .size = sizeof(NICState), 288 .receive = tulip_receive_nc, 289 }; 290 291 static const char *tulip_reg_name(const hwaddr addr) 292 { 293 switch (addr) { 294 case CSR(0): 295 return "CSR0"; 296 297 case CSR(1): 298 return "CSR1"; 299 300 case CSR(2): 301 return "CSR2"; 302 303 case CSR(3): 304 return "CSR3"; 305 306 case CSR(4): 307 return "CSR4"; 308 309 case CSR(5): 310 return "CSR5"; 311 312 case CSR(6): 313 return "CSR6"; 314 315 case CSR(7): 316 return "CSR7"; 317 318 case CSR(8): 319 return "CSR8"; 320 321 case CSR(9): 322 return "CSR9"; 323 324 case CSR(10): 325 return "CSR10"; 326 327 case CSR(11): 328 return "CSR11"; 329 330 case CSR(12): 331 return "CSR12"; 332 333 case CSR(13): 334 return "CSR13"; 335 336 case CSR(14): 337 return "CSR14"; 338 339 case CSR(15): 340 return "CSR15"; 341 342 default: 343 break; 344 } 345 return ""; 346 } 347 348 static const char *tulip_rx_state_name(int state) 349 { 350 switch (state) { 351 case CSR5_RS_STOPPED: 352 return "STOPPED"; 353 354 case CSR5_RS_RUNNING_FETCH: 355 return "RUNNING/FETCH"; 356 357 case CSR5_RS_RUNNING_CHECK_EOR: 358 return "RUNNING/CHECK EOR"; 359 360 case CSR5_RS_RUNNING_WAIT_RECEIVE: 361 return "WAIT RECEIVE"; 362 363 case CSR5_RS_SUSPENDED: 364 return "SUSPENDED"; 365 366 case CSR5_RS_RUNNING_CLOSE: 367 return "RUNNING/CLOSE"; 368 369 case CSR5_RS_RUNNING_FLUSH: 370 return "RUNNING/FLUSH"; 371 372 case CSR5_RS_RUNNING_QUEUE: 373 return "RUNNING/QUEUE"; 374 375 default: 376 break; 377 } 378 return ""; 379 } 380 381 static const char *tulip_tx_state_name(int state) 382 { 383 switch (state) { 384 case CSR5_TS_STOPPED: 385 return "STOPPED"; 386 387 case CSR5_TS_RUNNING_FETCH: 388 return "RUNNING/FETCH"; 389 390 case CSR5_TS_RUNNING_WAIT_EOT: 391 return "RUNNING/WAIT EOT"; 392 393 case CSR5_TS_RUNNING_READ_BUF: 394 return "RUNNING/READ BUF"; 395 396 case CSR5_TS_RUNNING_SETUP: 397 return "RUNNING/SETUP"; 398 399 case CSR5_TS_SUSPENDED: 400 return "SUSPENDED"; 401 402 case CSR5_TS_RUNNING_CLOSE: 403 return "RUNNING/CLOSE"; 404 405 default: 406 break; 407 } 408 return ""; 409 } 410 411 static void tulip_update_rs(TULIPState *s, int state) 412 { 413 s->csr[5] &= ~(CSR5_RS_MASK << CSR5_RS_SHIFT); 414 s->csr[5] |= (state & CSR5_RS_MASK) << CSR5_RS_SHIFT; 415 trace_tulip_rx_state(tulip_rx_state_name(state)); 416 } 417 418 static uint16_t tulip_mdi_default[] = { 419 /* MDI Registers 0 - 6, 7 */ 420 0x3100, 0xf02c, 0x7810, 0x0000, 0x0501, 0x4181, 0x0000, 0x0000, 421 /* MDI Registers 8 - 15 */ 422 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 423 /* MDI Registers 16 - 31 */ 424 0x0003, 0x0000, 0x0001, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 425 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 426 }; 427 428 /* Readonly mask for MDI (PHY) registers */ 429 static const uint16_t tulip_mdi_mask[] = { 430 0x0000, 0xffff, 0xffff, 0xffff, 0xc01f, 0xffff, 0xffff, 0x0000, 431 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 432 0x0fff, 0x0000, 0xffff, 0xffff, 0xffff, 0xffff, 0xffff, 0xffff, 433 0xffff, 0xffff, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 0x0000, 434 }; 435 436 static uint16_t tulip_mii_read(TULIPState *s, int phy, int reg) 437 { 438 uint16_t ret = 0; 439 if (phy == 1) { 440 ret = tulip_mdi_default[reg]; 441 } 442 trace_tulip_mii_read(phy, reg, ret); 443 return ret; 444 } 445 446 static void tulip_mii_write(TULIPState *s, int phy, int reg, uint16_t data) 447 { 448 trace_tulip_mii_write(phy, reg, data); 449 450 if (phy != 1) { 451 return; 452 } 453 454 tulip_mdi_default[reg] &= ~tulip_mdi_mask[reg]; 455 tulip_mdi_default[reg] |= (data & tulip_mdi_mask[reg]); 456 } 457 458 static void tulip_mii(TULIPState *s) 459 { 460 uint32_t changed = s->old_csr9 ^ s->csr[9]; 461 uint16_t data; 462 int op, phy, reg; 463 464 if (!(changed & CSR9_MDC)) { 465 return; 466 } 467 468 if (!(s->csr[9] & CSR9_MDC)) { 469 return; 470 } 471 472 s->mii_bitcnt++; 473 s->mii_word <<= 1; 474 475 if (s->csr[9] & CSR9_MDO && (s->mii_bitcnt < 16 || 476 !(s->csr[9] & CSR9_MII))) { 477 /* write op or address bits */ 478 s->mii_word |= 1; 479 } 480 481 if (s->mii_bitcnt >= 16 && (s->csr[9] & CSR9_MII)) { 482 if (s->mii_word & 0x8000) { 483 s->csr[9] |= CSR9_MDI; 484 } else { 485 s->csr[9] &= ~CSR9_MDI; 486 } 487 } 488 489 if (s->mii_word == 0xffffffff) { 490 s->mii_bitcnt = 0; 491 } else if (s->mii_bitcnt == 16) { 492 op = (s->mii_word >> 12) & 0x0f; 493 phy = (s->mii_word >> 7) & 0x1f; 494 reg = (s->mii_word >> 2) & 0x1f; 495 496 if (op == 6) { 497 s->mii_word = tulip_mii_read(s, phy, reg); 498 } 499 } else if (s->mii_bitcnt == 32) { 500 op = (s->mii_word >> 28) & 0x0f; 501 phy = (s->mii_word >> 23) & 0x1f; 502 reg = (s->mii_word >> 18) & 0x1f; 503 data = s->mii_word & 0xffff; 504 505 if (op == 5) { 506 tulip_mii_write(s, phy, reg, data); 507 } 508 } 509 } 510 511 static uint32_t tulip_csr9_read(TULIPState *s) 512 { 513 if (s->csr[9] & CSR9_SR) { 514 if (eeprom93xx_read(s->eeprom)) { 515 s->csr[9] |= CSR9_SR_DO; 516 } else { 517 s->csr[9] &= ~CSR9_SR_DO; 518 } 519 } 520 521 tulip_mii(s); 522 return s->csr[9]; 523 } 524 525 static void tulip_update_ts(TULIPState *s, int state) 526 { 527 s->csr[5] &= ~(CSR5_TS_MASK << CSR5_TS_SHIFT); 528 s->csr[5] |= (state & CSR5_TS_MASK) << CSR5_TS_SHIFT; 529 trace_tulip_tx_state(tulip_tx_state_name(state)); 530 } 531 532 static uint64_t tulip_read(void *opaque, hwaddr addr, 533 unsigned size) 534 { 535 TULIPState *s = opaque; 536 uint64_t data = 0; 537 538 switch (addr) { 539 case CSR(9): 540 data = tulip_csr9_read(s); 541 break; 542 543 case CSR(12): 544 /* Fake autocompletion complete until we have PHY emulation */ 545 data = 5 << CSR12_ANS_SHIFT; 546 break; 547 548 default: 549 if (addr & 7) { 550 qemu_log_mask(LOG_GUEST_ERROR, "%s: read access at unknown address" 551 " 0x%"PRIx64"\n", __func__, addr); 552 } else { 553 data = s->csr[addr >> 3]; 554 } 555 break; 556 } 557 trace_tulip_reg_read(addr, tulip_reg_name(addr), size, data); 558 return data; 559 } 560 561 static void tulip_tx(TULIPState *s, struct tulip_descriptor *desc) 562 { 563 if (s->tx_frame_len) { 564 if ((s->csr[6] >> CSR6_OM_SHIFT) & CSR6_OM_MASK) { 565 /* Internal or external Loopback */ 566 tulip_receive(s, s->tx_frame, s->tx_frame_len); 567 } else if (s->tx_frame_len <= sizeof(s->tx_frame)) { 568 qemu_send_packet(qemu_get_queue(s->nic), 569 s->tx_frame, s->tx_frame_len); 570 } 571 } 572 573 if (desc->control & TDES1_IC) { 574 s->csr[5] |= CSR5_TI; 575 tulip_update_int(s); 576 } 577 } 578 579 static int tulip_copy_tx_buffers(TULIPState *s, struct tulip_descriptor *desc) 580 { 581 int len1 = (desc->control >> TDES1_BUF1_SIZE_SHIFT) & TDES1_BUF1_SIZE_MASK; 582 int len2 = (desc->control >> TDES1_BUF2_SIZE_SHIFT) & TDES1_BUF2_SIZE_MASK; 583 584 if (s->tx_frame_len + len1 > sizeof(s->tx_frame)) { 585 qemu_log_mask(LOG_GUEST_ERROR, 586 "%s: descriptor overflow (ofs: %u, len:%d, size:%zu)\n", 587 __func__, s->tx_frame_len, len1, sizeof(s->tx_frame)); 588 return -1; 589 } 590 if (len1) { 591 pci_dma_read(&s->dev, desc->buf_addr1, 592 s->tx_frame + s->tx_frame_len, len1); 593 s->tx_frame_len += len1; 594 } 595 596 if (s->tx_frame_len + len2 > sizeof(s->tx_frame)) { 597 qemu_log_mask(LOG_GUEST_ERROR, 598 "%s: descriptor overflow (ofs: %u, len:%d, size:%zu)\n", 599 __func__, s->tx_frame_len, len2, sizeof(s->tx_frame)); 600 return -1; 601 } 602 if (len2) { 603 pci_dma_read(&s->dev, desc->buf_addr2, 604 s->tx_frame + s->tx_frame_len, len2); 605 s->tx_frame_len += len2; 606 } 607 desc->status = (len1 + len2) ? 0 : 0x7fffffff; 608 609 return 0; 610 } 611 612 static void tulip_setup_filter_addr(TULIPState *s, uint8_t *buf, int n) 613 { 614 int offset = n * 12; 615 616 s->filter[n][0] = buf[offset]; 617 s->filter[n][1] = buf[offset + 1]; 618 619 s->filter[n][2] = buf[offset + 4]; 620 s->filter[n][3] = buf[offset + 5]; 621 622 s->filter[n][4] = buf[offset + 8]; 623 s->filter[n][5] = buf[offset + 9]; 624 625 trace_tulip_setup_filter(n, s->filter[n][5], s->filter[n][4], 626 s->filter[n][3], s->filter[n][2], s->filter[n][1], s->filter[n][0]); 627 } 628 629 static void tulip_setup_frame(TULIPState *s, 630 struct tulip_descriptor *desc) 631 { 632 uint8_t buf[4096]; 633 int len = (desc->control >> TDES1_BUF1_SIZE_SHIFT) & TDES1_BUF1_SIZE_MASK; 634 int i; 635 636 trace_tulip_setup_frame(); 637 638 if (len == 192) { 639 pci_dma_read(&s->dev, desc->buf_addr1, buf, len); 640 for (i = 0; i < 16; i++) { 641 tulip_setup_filter_addr(s, buf, i); 642 } 643 } 644 645 desc->status = 0x7fffffff; 646 647 if (desc->control & TDES1_IC) { 648 s->csr[5] |= CSR5_TI; 649 tulip_update_int(s); 650 } 651 } 652 653 static void tulip_next_tx_descriptor(TULIPState *s, 654 struct tulip_descriptor *desc) 655 { 656 if (desc->control & TDES1_TER) { 657 s->current_tx_desc = s->csr[4]; 658 } else if (desc->control & TDES1_TCH) { 659 s->current_tx_desc = desc->buf_addr2; 660 } else { 661 s->current_tx_desc += sizeof(struct tulip_descriptor) + 662 (((s->csr[0] >> CSR0_DSL_SHIFT) & CSR0_DSL_MASK) << 2); 663 } 664 s->current_tx_desc &= ~3ULL; 665 } 666 667 static uint32_t tulip_ts(TULIPState *s) 668 { 669 return (s->csr[5] >> CSR5_TS_SHIFT) & CSR5_TS_MASK; 670 } 671 672 static void tulip_xmit_list_update(TULIPState *s) 673 { 674 #define TULIP_DESC_MAX 128 675 uint8_t i = 0; 676 struct tulip_descriptor desc; 677 678 if (tulip_ts(s) != CSR5_TS_SUSPENDED) { 679 return; 680 } 681 682 for (i = 0; i < TULIP_DESC_MAX; i++) { 683 tulip_desc_read(s, s->current_tx_desc, &desc); 684 tulip_dump_tx_descriptor(s, &desc); 685 686 if (!(desc.status & TDES0_OWN)) { 687 tulip_update_ts(s, CSR5_TS_SUSPENDED); 688 s->csr[5] |= CSR5_TU; 689 tulip_update_int(s); 690 return; 691 } 692 693 if (desc.control & TDES1_SET) { 694 tulip_setup_frame(s, &desc); 695 } else { 696 if (desc.control & TDES1_FS) { 697 s->tx_frame_len = 0; 698 } 699 700 if (!tulip_copy_tx_buffers(s, &desc)) { 701 if (desc.control & TDES1_LS) { 702 tulip_tx(s, &desc); 703 } 704 } 705 } 706 tulip_desc_write(s, s->current_tx_desc, &desc); 707 tulip_next_tx_descriptor(s, &desc); 708 } 709 } 710 711 static void tulip_csr9_write(TULIPState *s, uint32_t old_val, 712 uint32_t new_val) 713 { 714 if (new_val & CSR9_SR) { 715 eeprom93xx_write(s->eeprom, 716 !!(new_val & CSR9_SR_CS), 717 !!(new_val & CSR9_SR_SK), 718 !!(new_val & CSR9_SR_DI)); 719 } 720 } 721 722 static void tulip_reset(TULIPState *s) 723 { 724 trace_tulip_reset(); 725 726 s->csr[0] = 0xfe000000; 727 s->csr[1] = 0xffffffff; 728 s->csr[2] = 0xffffffff; 729 s->csr[5] = 0xf0000000; 730 s->csr[6] = 0x32000040; 731 s->csr[7] = 0xf3fe0000; 732 s->csr[8] = 0xe0000000; 733 s->csr[9] = 0xfff483ff; 734 s->csr[11] = 0xfffe0000; 735 s->csr[12] = 0x000000c6; 736 s->csr[13] = 0xffff0000; 737 s->csr[14] = 0xffffffff; 738 s->csr[15] = 0x8ff00000; 739 } 740 741 static void tulip_qdev_reset(DeviceState *dev) 742 { 743 PCIDevice *d = PCI_DEVICE(dev); 744 TULIPState *s = TULIP(d); 745 746 tulip_reset(s); 747 } 748 749 static void tulip_write(void *opaque, hwaddr addr, 750 uint64_t data, unsigned size) 751 { 752 TULIPState *s = opaque; 753 trace_tulip_reg_write(addr, tulip_reg_name(addr), size, data); 754 755 switch (addr) { 756 case CSR(0): 757 s->csr[0] = data; 758 if (data & CSR0_SWR) { 759 tulip_reset(s); 760 tulip_update_int(s); 761 } 762 break; 763 764 case CSR(1): 765 tulip_xmit_list_update(s); 766 break; 767 768 case CSR(2): 769 qemu_flush_queued_packets(qemu_get_queue(s->nic)); 770 break; 771 772 case CSR(3): 773 s->csr[3] = data & ~3ULL; 774 s->current_rx_desc = s->csr[3]; 775 qemu_flush_queued_packets(qemu_get_queue(s->nic)); 776 break; 777 778 case CSR(4): 779 s->csr[4] = data & ~3ULL; 780 s->current_tx_desc = s->csr[4]; 781 tulip_xmit_list_update(s); 782 break; 783 784 case CSR(5): 785 /* Status register, write clears bit */ 786 s->csr[5] &= ~(data & (CSR5_TI | CSR5_TPS | CSR5_TU | CSR5_TJT | 787 CSR5_LNP_ANC | CSR5_UNF | CSR5_RI | CSR5_RU | 788 CSR5_RPS | CSR5_RWT | CSR5_ETI | CSR5_GTE | 789 CSR5_LNF | CSR5_FBE | CSR5_ERI | CSR5_AIS | 790 CSR5_NIS | CSR5_GPI | CSR5_LC)); 791 tulip_update_int(s); 792 break; 793 794 case CSR(6): 795 s->csr[6] = data; 796 if (s->csr[6] & CSR6_SR) { 797 tulip_update_rs(s, CSR5_RS_RUNNING_WAIT_RECEIVE); 798 qemu_flush_queued_packets(qemu_get_queue(s->nic)); 799 } else { 800 tulip_update_rs(s, CSR5_RS_STOPPED); 801 } 802 803 if (s->csr[6] & CSR6_ST) { 804 tulip_update_ts(s, CSR5_TS_SUSPENDED); 805 tulip_xmit_list_update(s); 806 } else { 807 tulip_update_ts(s, CSR5_TS_STOPPED); 808 } 809 break; 810 811 case CSR(7): 812 s->csr[7] = data; 813 tulip_update_int(s); 814 break; 815 816 case CSR(8): 817 s->csr[9] = data; 818 break; 819 820 case CSR(9): 821 tulip_csr9_write(s, s->csr[9], data); 822 /* don't clear MII read data */ 823 s->csr[9] &= CSR9_MDI; 824 s->csr[9] |= (data & ~CSR9_MDI); 825 tulip_mii(s); 826 s->old_csr9 = s->csr[9]; 827 break; 828 829 case CSR(10): 830 s->csr[10] = data; 831 break; 832 833 case CSR(11): 834 s->csr[11] = data; 835 break; 836 837 case CSR(12): 838 /* SIA Status register, some bits are cleared by writing 1 */ 839 s->csr[12] &= ~(data & (CSR12_MRA | CSR12_TRA | CSR12_ARA)); 840 break; 841 842 case CSR(13): 843 s->csr[13] = data; 844 break; 845 846 case CSR(14): 847 s->csr[14] = data; 848 break; 849 850 case CSR(15): 851 s->csr[15] = data; 852 break; 853 854 default: 855 qemu_log_mask(LOG_GUEST_ERROR, "%s: write to CSR at unknown address " 856 "0x%"PRIx64"\n", __func__, addr); 857 break; 858 } 859 } 860 861 static const MemoryRegionOps tulip_ops = { 862 .read = tulip_read, 863 .write = tulip_write, 864 .endianness = DEVICE_LITTLE_ENDIAN, 865 .impl = { 866 .min_access_size = 4, 867 .max_access_size = 4, 868 }, 869 }; 870 871 static void tulip_idblock_crc(TULIPState *s, uint16_t *srom) 872 { 873 int word; 874 int bit; 875 unsigned char bitval, crc; 876 const int len = 9; 877 crc = -1; 878 879 for (word = 0; word < len; word++) { 880 for (bit = 15; bit >= 0; bit--) { 881 if ((word == (len - 1)) && (bit == 7)) { 882 /* 883 * Insert the correct CRC result into input data stream 884 * in place. 885 */ 886 srom[len - 1] = (srom[len - 1] & 0xff00) | (unsigned short)crc; 887 break; 888 } 889 bitval = ((srom[word] >> bit) & 1) ^ ((crc >> 7) & 1); 890 crc = crc << 1; 891 if (bitval == 1) { 892 crc ^= 6; 893 crc |= 0x01; 894 } 895 } 896 } 897 } 898 899 static uint16_t tulip_srom_crc(TULIPState *s, uint8_t *eeprom, size_t len) 900 { 901 unsigned long crc = 0xffffffff; 902 unsigned long flippedcrc = 0; 903 unsigned char currentbyte; 904 unsigned int msb, bit, i; 905 906 for (i = 0; i < len; i++) { 907 currentbyte = eeprom[i]; 908 for (bit = 0; bit < 8; bit++) { 909 msb = (crc >> 31) & 1; 910 crc <<= 1; 911 if (msb ^ (currentbyte & 1)) { 912 crc ^= 0x04c11db6; 913 crc |= 0x00000001; 914 } 915 currentbyte >>= 1; 916 } 917 } 918 919 for (i = 0; i < 32; i++) { 920 flippedcrc <<= 1; 921 bit = crc & 1; 922 crc >>= 1; 923 flippedcrc += bit; 924 } 925 return (flippedcrc ^ 0xffffffff) & 0xffff; 926 } 927 928 static const uint8_t eeprom_default[128] = { 929 0x3c, 0x10, 0x4f, 0x10, 0x00, 0x00, 0x00, 0x00, 930 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 931 0x56, 0x08, 0x04, 0x01, 0x00, 0x80, 0x48, 0xb3, 932 0x0e, 0xa7, 0x00, 0x1e, 0x00, 0x00, 0x00, 0x08, 933 0x01, 0x8d, 0x03, 0x00, 0x00, 0x00, 0x00, 0x78, 934 0xe0, 0x01, 0x00, 0x50, 0x00, 0x18, 0x00, 0x00, 935 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 936 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 937 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 938 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 939 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 940 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0xe8, 0x6b, 941 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x80, 942 0x48, 0xb3, 0x0e, 0xa7, 0x40, 0x00, 0x00, 0x00, 943 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 944 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 0x00, 945 }; 946 947 static void tulip_fill_eeprom(TULIPState *s) 948 { 949 uint16_t *eeprom = eeprom93xx_data(s->eeprom); 950 memcpy(eeprom, eeprom_default, 128); 951 952 /* patch in our mac address */ 953 eeprom[10] = cpu_to_le16(s->c.macaddr.a[0] | (s->c.macaddr.a[1] << 8)); 954 eeprom[11] = cpu_to_le16(s->c.macaddr.a[2] | (s->c.macaddr.a[3] << 8)); 955 eeprom[12] = cpu_to_le16(s->c.macaddr.a[4] | (s->c.macaddr.a[5] << 8)); 956 tulip_idblock_crc(s, eeprom); 957 eeprom[63] = cpu_to_le16(tulip_srom_crc(s, (uint8_t *)eeprom, 126)); 958 } 959 960 static void pci_tulip_realize(PCIDevice *pci_dev, Error **errp) 961 { 962 TULIPState *s = DO_UPCAST(TULIPState, dev, pci_dev); 963 uint8_t *pci_conf; 964 965 pci_conf = s->dev.config; 966 pci_conf[PCI_INTERRUPT_PIN] = 1; /* interrupt pin A */ 967 968 qemu_macaddr_default_if_unset(&s->c.macaddr); 969 970 s->eeprom = eeprom93xx_new(&pci_dev->qdev, 64); 971 tulip_fill_eeprom(s); 972 973 memory_region_init_io(&s->io, OBJECT(&s->dev), &tulip_ops, s, 974 "tulip-io", 128); 975 976 memory_region_init_io(&s->memory, OBJECT(&s->dev), &tulip_ops, s, 977 "tulip-mem", 128); 978 979 pci_register_bar(&s->dev, 0, PCI_BASE_ADDRESS_SPACE_IO, &s->io); 980 pci_register_bar(&s->dev, 1, PCI_BASE_ADDRESS_SPACE_MEMORY, &s->memory); 981 982 s->irq = pci_allocate_irq(&s->dev); 983 984 s->nic = qemu_new_nic(&net_tulip_info, &s->c, 985 object_get_typename(OBJECT(pci_dev)), 986 pci_dev->qdev.id, 987 &pci_dev->qdev.mem_reentrancy_guard, s); 988 qemu_format_nic_info_str(qemu_get_queue(s->nic), s->c.macaddr.a); 989 } 990 991 static void pci_tulip_exit(PCIDevice *pci_dev) 992 { 993 TULIPState *s = DO_UPCAST(TULIPState, dev, pci_dev); 994 995 qemu_del_nic(s->nic); 996 qemu_free_irq(s->irq); 997 eeprom93xx_free(&pci_dev->qdev, s->eeprom); 998 } 999 1000 static void tulip_instance_init(Object *obj) 1001 { 1002 PCIDevice *pci_dev = PCI_DEVICE(obj); 1003 TULIPState *d = DO_UPCAST(TULIPState, dev, pci_dev); 1004 1005 device_add_bootindex_property(obj, &d->c.bootindex, 1006 "bootindex", "/ethernet-phy@0", 1007 &pci_dev->qdev); 1008 } 1009 1010 static Property tulip_properties[] = { 1011 DEFINE_NIC_PROPERTIES(TULIPState, c), 1012 DEFINE_PROP_END_OF_LIST(), 1013 }; 1014 1015 static void tulip_class_init(ObjectClass *klass, void *data) 1016 { 1017 DeviceClass *dc = DEVICE_CLASS(klass); 1018 PCIDeviceClass *k = PCI_DEVICE_CLASS(klass); 1019 1020 k->realize = pci_tulip_realize; 1021 k->exit = pci_tulip_exit; 1022 k->vendor_id = PCI_VENDOR_ID_DEC; 1023 k->device_id = PCI_DEVICE_ID_DEC_21143; 1024 k->subsystem_vendor_id = PCI_VENDOR_ID_HP; 1025 k->subsystem_id = 0x104f; 1026 k->class_id = PCI_CLASS_NETWORK_ETHERNET; 1027 dc->vmsd = &vmstate_pci_tulip; 1028 device_class_set_props(dc, tulip_properties); 1029 dc->reset = tulip_qdev_reset; 1030 set_bit(DEVICE_CATEGORY_NETWORK, dc->categories); 1031 } 1032 1033 static const TypeInfo tulip_info = { 1034 .name = TYPE_TULIP, 1035 .parent = TYPE_PCI_DEVICE, 1036 .instance_size = sizeof(TULIPState), 1037 .class_init = tulip_class_init, 1038 .instance_init = tulip_instance_init, 1039 .interfaces = (InterfaceInfo[]) { 1040 { INTERFACE_CONVENTIONAL_PCI_DEVICE }, 1041 { }, 1042 }, 1043 }; 1044 1045 static void tulip_register_types(void) 1046 { 1047 type_register_static(&tulip_info); 1048 } 1049 1050 type_init(tulip_register_types) 1051