]> git.proxmox.com Git - mirror_qemu.git/blame - hw/net/e1000.c
projects / mirror_qemu.git / blame
? search:
summary | shortlog | log | commit | commitdiff | tree
blob | blame (incremental) | history | HEAD
e1000: move e1000_autoneg_timer() to after set_ics()
[mirror_qemu.git] / hw / net / e1000.c
CommitLineData
7c23b892
AZ		 1/*
2 * QEMU e1000 emulation
3 *
2758aa52
MT		 4 * Software developer's manual:
5 * http://download.intel.com/design/network/manuals/8254x_GBe_SDM.pdf
6 *
7c23b892
AZ		 7 * Nir Peleg, Tutis Systems Ltd. for Qumranet Inc.
8 * Copyright (c) 2008 Qumranet
9 * Based on work done by:
10 * Copyright (c) 2007 Dan Aloni
11 * Copyright (c) 2004 Antony T Curtis
12 *
13 * This library is free software; you can redistribute it and/or
14 * modify it under the terms of the GNU Lesser General Public
15 * License as published by the Free Software Foundation; either
16 * version 2 of the License, or (at your option) any later version.
17 *
18 * This library is distributed in the hope that it will be useful,
19 * but WITHOUT ANY WARRANTY; without even the implied warranty of
20 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
21 * Lesser General Public License for more details.
22 *
23 * You should have received a copy of the GNU Lesser General Public
8167ee88 24 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
7c23b892
AZ		 25 */
26
27
83c9f4ca
PB		 28#include "hw/hw.h"
29#include "hw/pci/pci.h"
1422e32d 30#include "net/net.h"
7200ac3c 31#include "net/checksum.h"
83c9f4ca 32#include "hw/loader.h"
9c17d615
PB		 33#include "sysemu/sysemu.h"
34#include "sysemu/dma.h"
97410dde 35#include "qemu/iov.h"
7c23b892 36
47b43a1f 37#include "e1000_regs.h"
7c23b892 38
27124888 39#define E1000_DEBUG
7c23b892 40
27124888 41#ifdef E1000_DEBUG
7c23b892
AZ		 42enum {
43 DEBUG_GENERAL, DEBUG_IO, DEBUG_MMIO, DEBUG_INTERRUPT,
44 DEBUG_RX, DEBUG_TX, DEBUG_MDIC, DEBUG_EEPROM,
45 DEBUG_UNKNOWN, DEBUG_TXSUM, DEBUG_TXERR, DEBUG_RXERR,
f9c1cdf4 46 DEBUG_RXFILTER, DEBUG_PHY, DEBUG_NOTYET,
7c23b892
AZ		 47};
48#define DBGBIT(x) (1<<DEBUG_##x)
49static int debugflags = DBGBIT(TXERR) | DBGBIT(GENERAL);
50
6c7f4b47 51#define DBGOUT(what, fmt, ...) do { \
7c23b892 52 if (debugflags & DBGBIT(what)) \
6c7f4b47 53 fprintf(stderr, "e1000: " fmt, ## __VA_ARGS__); \
7c23b892
AZ		 54 } while (0)
55#else
6c7f4b47 56#define DBGOUT(what, fmt, ...) do {} while (0)
7c23b892
AZ		 57#endif
58
59#define IOPORT_SIZE 0x40
e94bbefe 60#define PNPMMIO_SIZE 0x20000
78aeb23e 61#define MIN_BUF_SIZE 60 /* Min. octets in an ethernet frame sans FCS */
7c23b892 62
b0d9ffcd
MC		 63/* this is the size past which hardware will drop packets when setting LPE=0 */
64#define MAXIMUM_ETHERNET_VLAN_SIZE 1522
2c0331f4
MC		 65/* this is the size past which hardware will drop packets when setting LPE=1 */
66#define MAXIMUM_ETHERNET_LPE_SIZE 16384
b0d9ffcd 67
97410dde
VM		 68#define MAXIMUM_ETHERNET_HDR_LEN (14+4)
69
7c23b892
AZ		 70/*
71 * HW models:
8597f2e1 72 * E1000_DEV_ID_82540EM works with Windows, Linux, and OS X <= 10.8
7c23b892 73 * E1000_DEV_ID_82544GC_COPPER appears to work; not well tested
8597f2e1 74 * E1000_DEV_ID_82545EM_COPPER works with Linux and OS X >= 10.6
7c23b892
AZ		 75 * Others never tested
76 */
7c23b892
AZ		 77
78typedef struct E1000State_st {
b08340d5
AF		 79 /*< private >*/
80 PCIDevice parent_obj;
81 /*< public >*/
82
a03e2aec 83 NICState *nic;
fbdaa002 84 NICConf conf;
ad00a9b9
AK		 85 MemoryRegion mmio;
86 MemoryRegion io;
7c23b892
AZ		 87
88 uint32_t mac_reg[0x8000];
89 uint16_t phy_reg[0x20];
90 uint16_t eeprom_data[64];
91
92 uint32_t rxbuf_size;
93 uint32_t rxbuf_min_shift;
7c23b892
AZ		 94 struct e1000_tx {
95 unsigned char header[256];
8f2e8d1f 96 unsigned char vlan_header[4];
b10fec9b 97 /* Fields vlan and data must not be reordered or separated. */
8f2e8d1f 98 unsigned char vlan[4];
7c23b892
AZ		 99 unsigned char data[0x10000];
100 uint16_t size;
101 unsigned char sum_needed;
8f2e8d1f 102 unsigned char vlan_needed;
7c23b892
AZ		 103 uint8_t ipcss;
104 uint8_t ipcso;
105 uint16_t ipcse;
106 uint8_t tucss;
107 uint8_t tucso;
108 uint16_t tucse;
109 uint8_t hdr_len;
110 uint16_t mss;
111 uint32_t paylen;
112 uint16_t tso_frames;
113 char tse;
b6c4f71f
BS		 114 int8_t ip;
115 int8_t tcp;
1b0009db 116 char cptse; // current packet tse bit
7c23b892
AZ		 117 } tx;
118
119 struct {
120 uint32_t val_in; // shifted in from guest driver
121 uint16_t bitnum_in;
122 uint16_t bitnum_out;
123 uint16_t reading;
124 uint32_t old_eecd;
125 } eecd_state;
b9d03e35
JW		 126
127 QEMUTimer *autoneg_timer;
2af234e6 128
e9845f09
VM		 129 QEMUTimer *mit_timer; /* Mitigation timer. */
130 bool mit_timer_on; /* Mitigation timer is running. */
131 bool mit_irq_level; /* Tracks interrupt pin level. */
132 uint32_t mit_ide; /* Tracks E1000_TXD_CMD_IDE bit. */
133
2af234e6
MT		 134/* Compatibility flags for migration to/from qemu 1.3.0 and older */
135#define E1000_FLAG_AUTONEG_BIT 0
e9845f09 136#define E1000_FLAG_MIT_BIT 1
2af234e6 137#define E1000_FLAG_AUTONEG (1 << E1000_FLAG_AUTONEG_BIT)
e9845f09 138#define E1000_FLAG_MIT (1 << E1000_FLAG_MIT_BIT)
2af234e6 139 uint32_t compat_flags;
7c23b892
AZ		 140} E1000State;
141
8597f2e1
GS		 142typedef struct E1000BaseClass {
143 PCIDeviceClass parent_class;
144 uint16_t phy_id2;
8597f2e1
GS		 145} E1000BaseClass;
146
147#define TYPE_E1000_BASE "e1000-base"
567a3c9e
PC		 148
149#define E1000(obj) \
8597f2e1
GS		 150 OBJECT_CHECK(E1000State, (obj), TYPE_E1000_BASE)
151
152#define E1000_DEVICE_CLASS(klass) \
153 OBJECT_CLASS_CHECK(E1000BaseClass, (klass), TYPE_E1000_BASE)
154#define E1000_DEVICE_GET_CLASS(obj) \
155 OBJECT_GET_CLASS(E1000BaseClass, (obj), TYPE_E1000_BASE)
567a3c9e 156
7c23b892
AZ		 157#define defreg(x) x = (E1000_##x>>2)
158enum {
159 defreg(CTRL), defreg(EECD), defreg(EERD), defreg(GPRC),
160 defreg(GPTC), defreg(ICR), defreg(ICS), defreg(IMC),
161 defreg(IMS), defreg(LEDCTL), defreg(MANC), defreg(MDIC),
162 defreg(MPC), defreg(PBA), defreg(RCTL), defreg(RDBAH),
163 defreg(RDBAL), defreg(RDH), defreg(RDLEN), defreg(RDT),
164 defreg(STATUS), defreg(SWSM), defreg(TCTL), defreg(TDBAH),
165 defreg(TDBAL), defreg(TDH), defreg(TDLEN), defreg(TDT),
166 defreg(TORH), defreg(TORL), defreg(TOTH), defreg(TOTL),
167 defreg(TPR), defreg(TPT), defreg(TXDCTL), defreg(WUFC),
8f2e8d1f 168 defreg(RA), defreg(MTA), defreg(CRCERRS),defreg(VFTA),
e9845f09
VM		 169 defreg(VET), defreg(RDTR), defreg(RADV), defreg(TADV),
170 defreg(ITR),
7c23b892
AZ		 171};
172
71aadd3c
JW		 173static void
174e1000_link_down(E1000State *s)
175{
176 s->mac_reg[STATUS] &= ~E1000_STATUS_LU;
177 s->phy_reg[PHY_STATUS] &= ~MII_SR_LINK_STATUS;
6a2acedb 178 s->phy_reg[PHY_STATUS] &= ~MII_SR_AUTONEG_COMPLETE;
6883b591 179 s->phy_reg[PHY_LP_ABILITY] &= ~MII_LPAR_LPACK;
71aadd3c
JW		 180}
181
182static void
183e1000_link_up(E1000State *s)
184{
185 s->mac_reg[STATUS] |= E1000_STATUS_LU;
186 s->phy_reg[PHY_STATUS] |= MII_SR_LINK_STATUS;
187}
188
b9d03e35
JW		 189static void
190set_phy_ctrl(E1000State *s, int index, uint16_t val)
191{
2af234e6
MT		 192 /*
193 * QEMU 1.3 does not support link auto-negotiation emulation, so if we
194 * migrate during auto negotiation, after migration the link will be
195 * down.
196 */
197 if (!(s->compat_flags & E1000_FLAG_AUTONEG)) {
198 return;
199 }
b9d03e35 200 if ((val & MII_CR_AUTO_NEG_EN) && (val & MII_CR_RESTART_AUTO_NEG)) {
b9d03e35 201 e1000_link_down(s);
b9d03e35 202 DBGOUT(PHY, "Start link auto negotiation\n");
bc72ad67 203 timer_mod(s->autoneg_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + 500);
b9d03e35
JW		 204 }
205}
206
b9d03e35
JW		 207static void (*phyreg_writeops[])(E1000State *, int, uint16_t) = {
208 [PHY_CTRL] = set_phy_ctrl,
209};
210
211enum { NPHYWRITEOPS = ARRAY_SIZE(phyreg_writeops) };
212
7c23b892 213enum { PHY_R = 1, PHY_W = 2, PHY_RW = PHY_R | PHY_W };
88b4e9db 214static const char phy_regcap[0x20] = {
7c23b892
AZ		 215 [PHY_STATUS] = PHY_R, [M88E1000_EXT_PHY_SPEC_CTRL] = PHY_RW,
216 [PHY_ID1] = PHY_R, [M88E1000_PHY_SPEC_CTRL] = PHY_RW,
217 [PHY_CTRL] = PHY_RW, [PHY_1000T_CTRL] = PHY_RW,
218 [PHY_LP_ABILITY] = PHY_R, [PHY_1000T_STATUS] = PHY_R,
219 [PHY_AUTONEG_ADV] = PHY_RW, [M88E1000_RX_ERR_CNTR] = PHY_R,
6883b591
GS		 220 [PHY_ID2] = PHY_R, [M88E1000_PHY_SPEC_STATUS] = PHY_R,
221 [PHY_AUTONEG_EXP] = PHY_R,
7c23b892
AZ		 222};
223
8597f2e1 224/* PHY_ID2 documented in 8254x_GBe_SDM.pdf, pp. 250 */
814cd3ac 225static const uint16_t phy_reg_init[] = {
b9d03e35
JW		 226 [PHY_CTRL] = 0x1140,
227 [PHY_STATUS] = 0x794d, /* link initially up with not completed autoneg */
8597f2e1 228 [PHY_ID1] = 0x141, /* [PHY_ID2] configured per DevId, from e1000_reset() */
814cd3ac
MT		 229 [PHY_1000T_CTRL] = 0x0e00, [M88E1000_PHY_SPEC_CTRL] = 0x360,
230 [M88E1000_EXT_PHY_SPEC_CTRL] = 0x0d60, [PHY_AUTONEG_ADV] = 0xde1,
231 [PHY_LP_ABILITY] = 0x1e0, [PHY_1000T_STATUS] = 0x3c00,
232 [M88E1000_PHY_SPEC_STATUS] = 0xac00,
233};
234
235static const uint32_t mac_reg_init[] = {
236 [PBA] = 0x00100030,
237 [LEDCTL] = 0x602,
238 [CTRL] = E1000_CTRL_SWDPIN2 | E1000_CTRL_SWDPIN0 |
239 E1000_CTRL_SPD_1000 | E1000_CTRL_SLU,
240 [STATUS] = 0x80000000 | E1000_STATUS_GIO_MASTER_ENABLE |
241 E1000_STATUS_ASDV | E1000_STATUS_MTXCKOK |
242 E1000_STATUS_SPEED_1000 | E1000_STATUS_FD |
243 E1000_STATUS_LU,
244 [MANC] = E1000_MANC_EN_MNG2HOST | E1000_MANC_RCV_TCO_EN |
245 E1000_MANC_ARP_EN | E1000_MANC_0298_EN |
246 E1000_MANC_RMCP_EN,
247};
248
e9845f09
VM		 249/* Helper function, *curr == 0 means the value is not set */
250static inline void
251mit_update_delay(uint32_t *curr, uint32_t value)
252{
253 if (value && (*curr == 0 || value < *curr)) {
254 *curr = value;
255 }
256}
257
7c23b892
AZ		 258static void
259set_interrupt_cause(E1000State *s, int index, uint32_t val)
260{
b08340d5 261 PCIDevice *d = PCI_DEVICE(s);
e9845f09
VM		 262 uint32_t pending_ints;
263 uint32_t mit_delay;
b08340d5 264
7c23b892 265 s->mac_reg[ICR] = val;
a52a8841
MT		 266
267 /*
268 * Make sure ICR and ICS registers have the same value.
269 * The spec says that the ICS register is write-only. However in practice,
270 * on real hardware ICS is readable, and for reads it has the same value as
271 * ICR (except that ICS does not have the clear on read behaviour of ICR).
272 *
273 * The VxWorks PRO/1000 driver uses this behaviour.
274 */
b1332393 275 s->mac_reg[ICS] = val;
a52a8841 276
e9845f09
VM		 277 pending_ints = (s->mac_reg[IMS] & s->mac_reg[ICR]);
278 if (!s->mit_irq_level && pending_ints) {
279 /*
280 * Here we detect a potential raising edge. We postpone raising the
281 * interrupt line if we are inside the mitigation delay window
282 * (s->mit_timer_on == 1).
283 * We provide a partial implementation of interrupt mitigation,
284 * emulating only RADV, TADV and ITR (lower 16 bits, 1024ns units for
285 * RADV and TADV, 256ns units for ITR). RDTR is only used to enable
286 * RADV; relative timers based on TIDV and RDTR are not implemented.
287 */
288 if (s->mit_timer_on) {
289 return;
290 }
291 if (s->compat_flags & E1000_FLAG_MIT) {
292 /* Compute the next mitigation delay according to pending
293 * interrupts and the current values of RADV (provided
294 * RDTR!=0), TADV and ITR.
295 * Then rearm the timer.
296 */
297 mit_delay = 0;
298 if (s->mit_ide &&
299 (pending_ints & (E1000_ICR_TXQE | E1000_ICR_TXDW))) {
300 mit_update_delay(&mit_delay, s->mac_reg[TADV] * 4);
301 }
302 if (s->mac_reg[RDTR] && (pending_ints & E1000_ICS_RXT0)) {
303 mit_update_delay(&mit_delay, s->mac_reg[RADV] * 4);
304 }
305 mit_update_delay(&mit_delay, s->mac_reg[ITR]);
306
307 if (mit_delay) {
308 s->mit_timer_on = 1;
309 timer_mod(s->mit_timer, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) +
310 mit_delay * 256);
311 }
312 s->mit_ide = 0;
313 }
314 }
315
316 s->mit_irq_level = (pending_ints != 0);
9e64f8a3 317 pci_set_irq(d, s->mit_irq_level);
e9845f09
VM		 318}
319
320static void
321e1000_mit_timer(void *opaque)
322{
323 E1000State *s = opaque;
324
325 s->mit_timer_on = 0;
326 /* Call set_interrupt_cause to update the irq level (if necessary). */
327 set_interrupt_cause(s, 0, s->mac_reg[ICR]);
7c23b892
AZ		 328}
329
330static void
331set_ics(E1000State *s, int index, uint32_t val)
332{
333 DBGOUT(INTERRUPT, "set_ics %x, ICR %x, IMR %x\n", val, s->mac_reg[ICR],
334 s->mac_reg[IMS]);
335 set_interrupt_cause(s, 0, val | s->mac_reg[ICR]);
336}
337
d52aec95
GS		 338static void
339e1000_autoneg_timer(void *opaque)
340{
341 E1000State *s = opaque;
342 if (!qemu_get_queue(s->nic)->link_down) {
343 e1000_link_up(s);
344 s->phy_reg[PHY_LP_ABILITY] |= MII_LPAR_LPACK;
345 s->phy_reg[PHY_STATUS] |= MII_SR_AUTONEG_COMPLETE;
346 DBGOUT(PHY, "Auto negotiation is completed\n");
347 set_ics(s, 0, E1000_ICS_LSC); /* signal link status change to guest */
348 }
349}
350
7c23b892
AZ		 351static int
352rxbufsize(uint32_t v)
353{
354 v &= E1000_RCTL_BSEX | E1000_RCTL_SZ_16384 | E1000_RCTL_SZ_8192 |
355 E1000_RCTL_SZ_4096 | E1000_RCTL_SZ_2048 | E1000_RCTL_SZ_1024 |
356 E1000_RCTL_SZ_512 | E1000_RCTL_SZ_256;
357 switch (v) {
358 case E1000_RCTL_BSEX | E1000_RCTL_SZ_16384:
359 return 16384;
360 case E1000_RCTL_BSEX | E1000_RCTL_SZ_8192:
361 return 8192;
362 case E1000_RCTL_BSEX | E1000_RCTL_SZ_4096:
363 return 4096;
364 case E1000_RCTL_SZ_1024:
365 return 1024;
366 case E1000_RCTL_SZ_512:
367 return 512;
368 case E1000_RCTL_SZ_256:
369 return 256;
370 }
371 return 2048;
372}
373
814cd3ac
MT		 374static void e1000_reset(void *opaque)
375{
376 E1000State *d = opaque;
8597f2e1 377 E1000BaseClass *edc = E1000_DEVICE_GET_CLASS(d);
372254c6
GS		 378 uint8_t *macaddr = d->conf.macaddr.a;
379 int i;
814cd3ac 380
bc72ad67 381 timer_del(d->autoneg_timer);
e9845f09
VM		 382 timer_del(d->mit_timer);
383 d->mit_timer_on = 0;
384 d->mit_irq_level = 0;
385 d->mit_ide = 0;
814cd3ac
MT		 386 memset(d->phy_reg, 0, sizeof d->phy_reg);
387 memmove(d->phy_reg, phy_reg_init, sizeof phy_reg_init);
8597f2e1 388 d->phy_reg[PHY_ID2] = edc->phy_id2;
814cd3ac
MT		 389 memset(d->mac_reg, 0, sizeof d->mac_reg);
390 memmove(d->mac_reg, mac_reg_init, sizeof mac_reg_init);
391 d->rxbuf_min_shift = 1;
392 memset(&d->tx, 0, sizeof d->tx);
393
b356f76d 394 if (qemu_get_queue(d->nic)->link_down) {
71aadd3c 395 e1000_link_down(d);
814cd3ac 396 }
372254c6
GS		 397
398 /* Some guests expect pre-initialized RAH/RAL (AddrValid flag + MACaddr) */
399 d->mac_reg[RA] = 0;
400 d->mac_reg[RA + 1] = E1000_RAH_AV;
401 for (i = 0; i < 4; i++) {
402 d->mac_reg[RA] |= macaddr[i] << (8 * i);
403 d->mac_reg[RA + 1] |= (i < 2) ? macaddr[i + 4] << (8 * i) : 0;
404 }
655d3b63 405 qemu_format_nic_info_str(qemu_get_queue(d->nic), macaddr);
814cd3ac
MT		 406}
407
cab3c825
KW		 408static void
409set_ctrl(E1000State *s, int index, uint32_t val)
410{
411 /* RST is self clearing */
412 s->mac_reg[CTRL] = val & ~E1000_CTRL_RST;
413}
414
7c23b892
AZ		 415static void
416set_rx_control(E1000State *s, int index, uint32_t val)
417{
418 s->mac_reg[RCTL] = val;
419 s->rxbuf_size = rxbufsize(val);
420 s->rxbuf_min_shift = ((val / E1000_RCTL_RDMTS_QUAT) & 3) + 1;
421 DBGOUT(RX, "RCTL: %d, mac_reg[RCTL] = 0x%x\n", s->mac_reg[RDT],
422 s->mac_reg[RCTL]);
b356f76d 423 qemu_flush_queued_packets(qemu_get_queue(s->nic));
7c23b892
AZ		 424}
425
426static void
427set_mdic(E1000State *s, int index, uint32_t val)
428{
429 uint32_t data = val & E1000_MDIC_DATA_MASK;
430 uint32_t addr = ((val & E1000_MDIC_REG_MASK) >> E1000_MDIC_REG_SHIFT);
431
432 if ((val & E1000_MDIC_PHY_MASK) >> E1000_MDIC_PHY_SHIFT != 1) // phy #
433 val = s->mac_reg[MDIC] | E1000_MDIC_ERROR;
434 else if (val & E1000_MDIC_OP_READ) {
435 DBGOUT(MDIC, "MDIC read reg 0x%x\n", addr);
436 if (!(phy_regcap[addr] & PHY_R)) {
437 DBGOUT(MDIC, "MDIC read reg %x unhandled\n", addr);
438 val |= E1000_MDIC_ERROR;
439 } else
440 val = (val ^ data) | s->phy_reg[addr];
441 } else if (val & E1000_MDIC_OP_WRITE) {
442 DBGOUT(MDIC, "MDIC write reg 0x%x, value 0x%x\n", addr, data);
443 if (!(phy_regcap[addr] & PHY_W)) {
444 DBGOUT(MDIC, "MDIC write reg %x unhandled\n", addr);
445 val |= E1000_MDIC_ERROR;
b9d03e35
JW		 446 } else {
447 if (addr < NPHYWRITEOPS && phyreg_writeops[addr]) {
448 phyreg_writeops[addr](s, index, data);
449 }
7c23b892 450 s->phy_reg[addr] = data;
b9d03e35 451 }
7c23b892
AZ		 452 }
453 s->mac_reg[MDIC] = val | E1000_MDIC_READY;
17fbbb0b
JW		 454
455 if (val & E1000_MDIC_INT_EN) {
456 set_ics(s, 0, E1000_ICR_MDAC);
457 }
7c23b892
AZ		 458}
459
460static uint32_t
461get_eecd(E1000State *s, int index)
462{
463 uint32_t ret = E1000_EECD_PRES|E1000_EECD_GNT | s->eecd_state.old_eecd;
464
465 DBGOUT(EEPROM, "reading eeprom bit %d (reading %d)\n",
466 s->eecd_state.bitnum_out, s->eecd_state.reading);
467 if (!s->eecd_state.reading ||
468 ((s->eeprom_data[(s->eecd_state.bitnum_out >> 4) & 0x3f] >>
469 ((s->eecd_state.bitnum_out & 0xf) ^ 0xf))) & 1)
470 ret |= E1000_EECD_DO;
471 return ret;
472}
473
474static void
475set_eecd(E1000State *s, int index, uint32_t val)
476{
477 uint32_t oldval = s->eecd_state.old_eecd;
478
479 s->eecd_state.old_eecd = val & (E1000_EECD_SK | E1000_EECD_CS |
480 E1000_EECD_DI|E1000_EECD_FWE_MASK|E1000_EECD_REQ);
9651ac55
IT		 481 if (!(E1000_EECD_CS & val)) // CS inactive; nothing to do
482 return;
483 if (E1000_EECD_CS & (val ^ oldval)) { // CS rise edge; reset state
484 s->eecd_state.val_in = 0;
485 s->eecd_state.bitnum_in = 0;
486 s->eecd_state.bitnum_out = 0;
487 s->eecd_state.reading = 0;
488 }
7c23b892
AZ		 489 if (!(E1000_EECD_SK & (val ^ oldval))) // no clock edge
490 return;
491 if (!(E1000_EECD_SK & val)) { // falling edge
492 s->eecd_state.bitnum_out++;
493 return;
494 }
7c23b892
AZ		 495 s->eecd_state.val_in <<= 1;
496 if (val & E1000_EECD_DI)
497 s->eecd_state.val_in |= 1;
498 if (++s->eecd_state.bitnum_in == 9 && !s->eecd_state.reading) {
499 s->eecd_state.bitnum_out = ((s->eecd_state.val_in & 0x3f)<<4)-1;
500 s->eecd_state.reading = (((s->eecd_state.val_in >> 6) & 7) ==
501 EEPROM_READ_OPCODE_MICROWIRE);
502 }
503 DBGOUT(EEPROM, "eeprom bitnum in %d out %d, reading %d\n",
504 s->eecd_state.bitnum_in, s->eecd_state.bitnum_out,
505 s->eecd_state.reading);
506}
507
508static uint32_t
509flash_eerd_read(E1000State *s, int x)
510{
511 unsigned int index, r = s->mac_reg[EERD] & ~E1000_EEPROM_RW_REG_START;
512
b1332393
BP		 513 if ((s->mac_reg[EERD] & E1000_EEPROM_RW_REG_START) == 0)
514 return (s->mac_reg[EERD]);
515
7c23b892 516 if ((index = r >> E1000_EEPROM_RW_ADDR_SHIFT) > EEPROM_CHECKSUM_REG)
b1332393
BP		 517 return (E1000_EEPROM_RW_REG_DONE | r);
518
519 return ((s->eeprom_data[index] << E1000_EEPROM_RW_REG_DATA) |
520 E1000_EEPROM_RW_REG_DONE | r);
7c23b892
AZ		 521}
522
7c23b892
AZ		 523static void
524putsum(uint8_t *data, uint32_t n, uint32_t sloc, uint32_t css, uint32_t cse)
525{
c6a6a5e3
AL		 526 uint32_t sum;
527
7c23b892
AZ		 528 if (cse && cse < n)
529 n = cse + 1;
c6a6a5e3
AL		 530 if (sloc < n-1) {
531 sum = net_checksum_add(n-css, data+css);
d8ee2591 532 stw_be_p(data + sloc, net_checksum_finish(sum));
c6a6a5e3 533 }
7c23b892
AZ		 534}
535
8f2e8d1f
AL		 536static inline int
537vlan_enabled(E1000State *s)
538{
539 return ((s->mac_reg[CTRL] & E1000_CTRL_VME) != 0);
540}
541
542static inline int
543vlan_rx_filter_enabled(E1000State *s)
544{
545 return ((s->mac_reg[RCTL] & E1000_RCTL_VFE) != 0);
546}
547
548static inline int
549is_vlan_packet(E1000State *s, const uint8_t *buf)
550{
551 return (be16_to_cpup((uint16_t *)(buf + 12)) ==
552 le16_to_cpup((uint16_t *)(s->mac_reg + VET)));
553}
554
555static inline int
556is_vlan_txd(uint32_t txd_lower)
557{
558 return ((txd_lower & E1000_TXD_CMD_VLE) != 0);
559}
560
55e8d1ce
MT		 561/* FCS aka Ethernet CRC-32. We don't get it from backends and can't
562 * fill it in, just pad descriptor length by 4 bytes unless guest
a05e8a6e 563 * told us to strip it off the packet. */
55e8d1ce
MT		 564static inline int
565fcs_len(E1000State *s)
566{
567 return (s->mac_reg[RCTL] & E1000_RCTL_SECRC) ? 0 : 4;
568}
569
93e37d76
JW		 570static void
571e1000_send_packet(E1000State *s, const uint8_t *buf, int size)
572{
b356f76d 573 NetClientState *nc = qemu_get_queue(s->nic);
93e37d76 574 if (s->phy_reg[PHY_CTRL] & MII_CR_LOOPBACK) {
b356f76d 575 nc->info->receive(nc, buf, size);
93e37d76 576 } else {
b356f76d 577 qemu_send_packet(nc, buf, size);
93e37d76
JW		 578 }
579}
580
7c23b892
AZ		 581static void
582xmit_seg(E1000State *s)
583{
584 uint16_t len, *sp;
585 unsigned int frames = s->tx.tso_frames, css, sofar, n;
586 struct e1000_tx *tp = &s->tx;
587
1b0009db 588 if (tp->tse && tp->cptse) {
7c23b892
AZ		 589 css = tp->ipcss;
590 DBGOUT(TXSUM, "frames %d size %d ipcss %d\n",
591 frames, tp->size, css);
592 if (tp->ip) { // IPv4
d8ee2591
PM		 593 stw_be_p(tp->data+css+2, tp->size - css);
594 stw_be_p(tp->data+css+4,
7c23b892
AZ		 595 be16_to_cpup((uint16_t *)(tp->data+css+4))+frames);
596 } else // IPv6
d8ee2591 597 stw_be_p(tp->data+css+4, tp->size - css);
7c23b892
AZ		 598 css = tp->tucss;
599 len = tp->size - css;
600 DBGOUT(TXSUM, "tcp %d tucss %d len %d\n", tp->tcp, css, len);
601 if (tp->tcp) {
602 sofar = frames * tp->mss;
6bd194ab 603 stl_be_p(tp->data+css+4, ldl_be_p(tp->data+css+4)+sofar); /* seq */
7c23b892
AZ		 604 if (tp->paylen - sofar > tp->mss)
605 tp->data[css + 13] &= ~9; // PSH, FIN
606 } else // UDP
d8ee2591 607 stw_be_p(tp->data+css+4, len);
7c23b892 608 if (tp->sum_needed & E1000_TXD_POPTS_TXSM) {
e685b4eb 609 unsigned int phsum;
7c23b892
AZ		 610 // add pseudo-header length before checksum calculation
611 sp = (uint16_t *)(tp->data + tp->tucso);
e685b4eb
AW		 612 phsum = be16_to_cpup(sp) + len;
613 phsum = (phsum >> 16) + (phsum & 0xffff);
d8ee2591 614 stw_be_p(sp, phsum);
7c23b892
AZ		 615 }
616 tp->tso_frames++;
617 }
618
619 if (tp->sum_needed & E1000_TXD_POPTS_TXSM)
620 putsum(tp->data, tp->size, tp->tucso, tp->tucss, tp->tucse);
621 if (tp->sum_needed & E1000_TXD_POPTS_IXSM)
622 putsum(tp->data, tp->size, tp->ipcso, tp->ipcss, tp->ipcse);
8f2e8d1f 623 if (tp->vlan_needed) {
b10fec9b
SW		 624 memmove(tp->vlan, tp->data, 4);
625 memmove(tp->data, tp->data + 4, 8);
8f2e8d1f 626 memcpy(tp->data + 8, tp->vlan_header, 4);
93e37d76 627 e1000_send_packet(s, tp->vlan, tp->size + 4);
8f2e8d1f 628 } else
93e37d76 629 e1000_send_packet(s, tp->data, tp->size);
7c23b892
AZ		 630 s->mac_reg[TPT]++;
631 s->mac_reg[GPTC]++;
632 n = s->mac_reg[TOTL];
633 if ((s->mac_reg[TOTL] += s->tx.size) < n)
634 s->mac_reg[TOTH]++;
635}
636
637static void
638process_tx_desc(E1000State *s, struct e1000_tx_desc *dp)
639{
b08340d5 640 PCIDevice *d = PCI_DEVICE(s);
7c23b892
AZ		 641 uint32_t txd_lower = le32_to_cpu(dp->lower.data);
642 uint32_t dtype = txd_lower & (E1000_TXD_CMD_DEXT | E1000_TXD_DTYP_D);
643 unsigned int split_size = txd_lower & 0xffff, bytes, sz, op;
a0ae17a6 644 unsigned int msh = 0xfffff;
7c23b892
AZ		 645 uint64_t addr;
646 struct e1000_context_desc *xp = (struct e1000_context_desc *)dp;
647 struct e1000_tx *tp = &s->tx;
648
e9845f09 649 s->mit_ide |= (txd_lower & E1000_TXD_CMD_IDE);
7c23b892
AZ		 650 if (dtype == E1000_TXD_CMD_DEXT) { // context descriptor
651 op = le32_to_cpu(xp->cmd_and_length);
652 tp->ipcss = xp->lower_setup.ip_fields.ipcss;
653 tp->ipcso = xp->lower_setup.ip_fields.ipcso;
654 tp->ipcse = le16_to_cpu(xp->lower_setup.ip_fields.ipcse);
655 tp->tucss = xp->upper_setup.tcp_fields.tucss;
656 tp->tucso = xp->upper_setup.tcp_fields.tucso;
657 tp->tucse = le16_to_cpu(xp->upper_setup.tcp_fields.tucse);
658 tp->paylen = op & 0xfffff;
659 tp->hdr_len = xp->tcp_seg_setup.fields.hdr_len;
660 tp->mss = le16_to_cpu(xp->tcp_seg_setup.fields.mss);
661 tp->ip = (op & E1000_TXD_CMD_IP) ? 1 : 0;
662 tp->tcp = (op & E1000_TXD_CMD_TCP) ? 1 : 0;
663 tp->tse = (op & E1000_TXD_CMD_TSE) ? 1 : 0;
664 tp->tso_frames = 0;
665 if (tp->tucso == 0) { // this is probably wrong
666 DBGOUT(TXSUM, "TCP/UDP: cso 0!\n");
667 tp->tucso = tp->tucss + (tp->tcp ? 16 : 6);
668 }
669 return;
1b0009db
AZ		 670 } else if (dtype == (E1000_TXD_CMD_DEXT | E1000_TXD_DTYP_D)) {
671 // data descriptor
735e77ec
SH		 672 if (tp->size == 0) {
673 tp->sum_needed = le32_to_cpu(dp->upper.data) >> 8;
674 }
1b0009db 675 tp->cptse = ( txd_lower & E1000_TXD_CMD_TSE ) ? 1 : 0;
43ad7e3e 676 } else {
1b0009db
AZ		 677 // legacy descriptor
678 tp->cptse = 0;
43ad7e3e 679 }
7c23b892 680
8f2e8d1f
AL		 681 if (vlan_enabled(s) && is_vlan_txd(txd_lower) &&
682 (tp->cptse || txd_lower & E1000_TXD_CMD_EOP)) {
683 tp->vlan_needed = 1;
d8ee2591 684 stw_be_p(tp->vlan_header,
8f2e8d1f 685 le16_to_cpup((uint16_t *)(s->mac_reg + VET)));
d8ee2591 686 stw_be_p(tp->vlan_header + 2,
8f2e8d1f
AL		 687 le16_to_cpu(dp->upper.fields.special));
688 }
689
7c23b892 690 addr = le64_to_cpu(dp->buffer_addr);
1b0009db 691 if (tp->tse && tp->cptse) {
a0ae17a6 692 msh = tp->hdr_len + tp->mss;
1b0009db
AZ		 693 do {
694 bytes = split_size;
695 if (tp->size + bytes > msh)
696 bytes = msh - tp->size;
65f82df0
AL		 697
698 bytes = MIN(sizeof(tp->data) - tp->size, bytes);
b08340d5 699 pci_dma_read(d, addr, tp->data + tp->size, bytes);
a0ae17a6
AJ		 700 sz = tp->size + bytes;
701 if (sz >= tp->hdr_len && tp->size < tp->hdr_len) {
702 memmove(tp->header, tp->data, tp->hdr_len);
703 }
1b0009db
AZ		 704 tp->size = sz;
705 addr += bytes;
706 if (sz == msh) {
707 xmit_seg(s);
a0ae17a6
AJ		 708 memmove(tp->data, tp->header, tp->hdr_len);
709 tp->size = tp->hdr_len;
1b0009db
AZ		 710 }
711 } while (split_size -= bytes);
712 } else if (!tp->tse && tp->cptse) {
713 // context descriptor TSE is not set, while data descriptor TSE is set
362f5fb5 714 DBGOUT(TXERR, "TCP segmentation error\n");
1b0009db 715 } else {
65f82df0 716 split_size = MIN(sizeof(tp->data) - tp->size, split_size);
b08340d5 717 pci_dma_read(d, addr, tp->data + tp->size, split_size);
1b0009db 718 tp->size += split_size;
7c23b892 719 }
7c23b892
AZ		 720
721 if (!(txd_lower & E1000_TXD_CMD_EOP))
722 return;
a0ae17a6 723 if (!(tp->tse && tp->cptse && tp->size < tp->hdr_len)) {
7c23b892 724 xmit_seg(s);
a0ae17a6 725 }
7c23b892
AZ		 726 tp->tso_frames = 0;
727 tp->sum_needed = 0;
8f2e8d1f 728 tp->vlan_needed = 0;
7c23b892 729 tp->size = 0;
1b0009db 730 tp->cptse = 0;
7c23b892
AZ		 731}
732
733static uint32_t
62ecbd35 734txdesc_writeback(E1000State *s, dma_addr_t base, struct e1000_tx_desc *dp)
7c23b892 735{
b08340d5 736 PCIDevice *d = PCI_DEVICE(s);
7c23b892
AZ		 737 uint32_t txd_upper, txd_lower = le32_to_cpu(dp->lower.data);
738
739 if (!(txd_lower & (E1000_TXD_CMD_RS|E1000_TXD_CMD_RPS)))
740 return 0;
741 txd_upper = (le32_to_cpu(dp->upper.data) | E1000_TXD_STAT_DD) &
742 ~(E1000_TXD_STAT_EC | E1000_TXD_STAT_LC | E1000_TXD_STAT_TU);
743 dp->upper.data = cpu_to_le32(txd_upper);
b08340d5 744 pci_dma_write(d, base + ((char *)&dp->upper - (char *)dp),
00c3a05b 745 &dp->upper, sizeof(dp->upper));
7c23b892
AZ		 746 return E1000_ICR_TXDW;
747}
748
d17161f6
KW		 749static uint64_t tx_desc_base(E1000State *s)
750{
751 uint64_t bah = s->mac_reg[TDBAH];
752 uint64_t bal = s->mac_reg[TDBAL] & ~0xf;
753
754 return (bah << 32) + bal;
755}
756
7c23b892
AZ		 757static void
758start_xmit(E1000State *s)
759{
b08340d5 760 PCIDevice *d = PCI_DEVICE(s);
62ecbd35 761 dma_addr_t base;
7c23b892
AZ		 762 struct e1000_tx_desc desc;
763 uint32_t tdh_start = s->mac_reg[TDH], cause = E1000_ICS_TXQE;
764
765 if (!(s->mac_reg[TCTL] & E1000_TCTL_EN)) {
766 DBGOUT(TX, "tx disabled\n");
767 return;
768 }
769
770 while (s->mac_reg[TDH] != s->mac_reg[TDT]) {
d17161f6 771 base = tx_desc_base(s) +
7c23b892 772 sizeof(struct e1000_tx_desc) * s->mac_reg[TDH];
b08340d5 773 pci_dma_read(d, base, &desc, sizeof(desc));
7c23b892
AZ		 774
775 DBGOUT(TX, "index %d: %p : %x %x\n", s->mac_reg[TDH],
6106075b 776 (void *)(intptr_t)desc.buffer_addr, desc.lower.data,
7c23b892
AZ		 777 desc.upper.data);
778
779 process_tx_desc(s, &desc);
62ecbd35 780 cause |= txdesc_writeback(s, base, &desc);
7c23b892
AZ		 781
782 if (++s->mac_reg[TDH] * sizeof(desc) >= s->mac_reg[TDLEN])
783 s->mac_reg[TDH] = 0;
784 /*
785 * the following could happen only if guest sw assigns
786 * bogus values to TDT/TDLEN.
787 * there's nothing too intelligent we could do about this.
788 */
789 if (s->mac_reg[TDH] == tdh_start) {
790 DBGOUT(TXERR, "TDH wraparound @%x, TDT %x, TDLEN %x\n",
791 tdh_start, s->mac_reg[TDT], s->mac_reg[TDLEN]);
792 break;
793 }
794 }
795 set_ics(s, 0, cause);
796}
797
798static int
799receive_filter(E1000State *s, const uint8_t *buf, int size)
800{
af2960f9
BS		 801 static const uint8_t bcast[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
802 static const int mta_shift[] = {4, 3, 2, 0};
7c23b892
AZ		 803 uint32_t f, rctl = s->mac_reg[RCTL], ra[2], *rp;
804
8f2e8d1f
AL		 805 if (is_vlan_packet(s, buf) && vlan_rx_filter_enabled(s)) {
806 uint16_t vid = be16_to_cpup((uint16_t *)(buf + 14));
807 uint32_t vfta = le32_to_cpup((uint32_t *)(s->mac_reg + VFTA) +
808 ((vid >> 5) & 0x7f));
809 if ((vfta & (1 << (vid & 0x1f))) == 0)
810 return 0;
811 }
812
7c23b892
AZ		 813 if (rctl & E1000_RCTL_UPE) // promiscuous
814 return 1;
815
816 if ((buf[0] & 1) && (rctl & E1000_RCTL_MPE)) // promiscuous mcast
817 return 1;
818
819 if ((rctl & E1000_RCTL_BAM) && !memcmp(buf, bcast, sizeof bcast))
820 return 1;
821
822 for (rp = s->mac_reg + RA; rp < s->mac_reg + RA + 32; rp += 2) {
823 if (!(rp[1] & E1000_RAH_AV))
824 continue;
825 ra[0] = cpu_to_le32(rp[0]);
826 ra[1] = cpu_to_le32(rp[1]);
827 if (!memcmp(buf, (uint8_t *)ra, 6)) {
828 DBGOUT(RXFILTER,
829 "unicast match[%d]: %02x:%02x:%02x:%02x:%02x:%02x\n",
830 (int)(rp - s->mac_reg - RA)/2,
831 buf[0], buf[1], buf[2], buf[3], buf[4], buf[5]);
832 return 1;
833 }
834 }
835 DBGOUT(RXFILTER, "unicast mismatch: %02x:%02x:%02x:%02x:%02x:%02x\n",
836 buf[0], buf[1], buf[2], buf[3], buf[4], buf[5]);
837
838 f = mta_shift[(rctl >> E1000_RCTL_MO_SHIFT) & 3];
839 f = (((buf[5] << 8) | buf[4]) >> f) & 0xfff;
840 if (s->mac_reg[MTA + (f >> 5)] & (1 << (f & 0x1f)))
841 return 1;
842 DBGOUT(RXFILTER,
843 "dropping, inexact filter mismatch: %02x:%02x:%02x:%02x:%02x:%02x MO %d MTA[%d] %x\n",
844 buf[0], buf[1], buf[2], buf[3], buf[4], buf[5],
845 (rctl >> E1000_RCTL_MO_SHIFT) & 3, f >> 5,
846 s->mac_reg[MTA + (f >> 5)]);
847
848 return 0;
849}
850
99ed7e30 851static void
4e68f7a0 852e1000_set_link_status(NetClientState *nc)
99ed7e30 853{
cc1f0f45 854 E1000State *s = qemu_get_nic_opaque(nc);
99ed7e30
AL		 855 uint32_t old_status = s->mac_reg[STATUS];
856
d4044c2a 857 if (nc->link_down) {
71aadd3c 858 e1000_link_down(s);
d4044c2a 859 } else {
6a2acedb
GS		 860 if (s->compat_flags & E1000_FLAG_AUTONEG &&
861 s->phy_reg[PHY_CTRL] & MII_CR_AUTO_NEG_EN &&
862 s->phy_reg[PHY_CTRL] & MII_CR_RESTART_AUTO_NEG &&
863 !(s->phy_reg[PHY_STATUS] & MII_SR_AUTONEG_COMPLETE)) {
864 /* emulate auto-negotiation if supported */
865 timer_mod(s->autoneg_timer,
866 qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + 500);
867 } else {
868 e1000_link_up(s);
869 }
d4044c2a 870 }
99ed7e30
AL		 871
872 if (s->mac_reg[STATUS] != old_status)
873 set_ics(s, 0, E1000_ICR_LSC);
874}
875
322fd48a
MT		 876static bool e1000_has_rxbufs(E1000State *s, size_t total_size)
877{
878 int bufs;
879 /* Fast-path short packets */
880 if (total_size <= s->rxbuf_size) {
e5b8b0d4 881 return s->mac_reg[RDH] != s->mac_reg[RDT];
322fd48a
MT		 882 }
883 if (s->mac_reg[RDH] < s->mac_reg[RDT]) {
884 bufs = s->mac_reg[RDT] - s->mac_reg[RDH];
e5b8b0d4 885 } else if (s->mac_reg[RDH] > s->mac_reg[RDT]) {
322fd48a
MT		 886 bufs = s->mac_reg[RDLEN] / sizeof(struct e1000_rx_desc) +
887 s->mac_reg[RDT] - s->mac_reg[RDH];
888 } else {
889 return false;
890 }
891 return total_size <= bufs * s->rxbuf_size;
892}
893
6cdfab28 894static int
4e68f7a0 895e1000_can_receive(NetClientState *nc)
6cdfab28 896{
cc1f0f45 897 E1000State *s = qemu_get_nic_opaque(nc);
6cdfab28 898
ddcb73b7
MT		 899 return (s->mac_reg[STATUS] & E1000_STATUS_LU) &&
900 (s->mac_reg[RCTL] & E1000_RCTL_EN) && e1000_has_rxbufs(s, 1);
6cdfab28
MT		 901}
902
d17161f6
KW		 903static uint64_t rx_desc_base(E1000State *s)
904{
905 uint64_t bah = s->mac_reg[RDBAH];
906 uint64_t bal = s->mac_reg[RDBAL] & ~0xf;
907
908 return (bah << 32) + bal;
909}
910
4f1c942b 911static ssize_t
97410dde 912e1000_receive_iov(NetClientState *nc, const struct iovec *iov, int iovcnt)
7c23b892 913{
cc1f0f45 914 E1000State *s = qemu_get_nic_opaque(nc);
b08340d5 915 PCIDevice *d = PCI_DEVICE(s);
7c23b892 916 struct e1000_rx_desc desc;
62ecbd35 917 dma_addr_t base;
7c23b892
AZ		 918 unsigned int n, rdt;
919 uint32_t rdh_start;
8f2e8d1f 920 uint16_t vlan_special = 0;
97410dde 921 uint8_t vlan_status = 0;
78aeb23e 922 uint8_t min_buf[MIN_BUF_SIZE];
97410dde
VM		 923 struct iovec min_iov;
924 uint8_t *filter_buf = iov->iov_base;
925 size_t size = iov_size(iov, iovcnt);
926 size_t iov_ofs = 0;
b19487e2
MT		 927 size_t desc_offset;
928 size_t desc_size;
929 size_t total_size;
7c23b892 930
ddcb73b7
MT		 931 if (!(s->mac_reg[STATUS] & E1000_STATUS_LU)) {
932 return -1;
933 }
934
935 if (!(s->mac_reg[RCTL] & E1000_RCTL_EN)) {
4f1c942b 936 return -1;
ddcb73b7 937 }
7c23b892 938
78aeb23e
SH		 939 /* Pad to minimum Ethernet frame length */
940 if (size < sizeof(min_buf)) {
97410dde 941 iov_to_buf(iov, iovcnt, 0, min_buf, size);
78aeb23e 942 memset(&min_buf[size], 0, sizeof(min_buf) - size);
97410dde
VM		 943 min_iov.iov_base = filter_buf = min_buf;
944 min_iov.iov_len = size = sizeof(min_buf);
945 iovcnt = 1;
946 iov = &min_iov;
947 } else if (iov->iov_len < MAXIMUM_ETHERNET_HDR_LEN) {
948 /* This is very unlikely, but may happen. */
949 iov_to_buf(iov, iovcnt, 0, min_buf, MAXIMUM_ETHERNET_HDR_LEN);
950 filter_buf = min_buf;
78aeb23e
SH		 951 }
952
b0d9ffcd 953 /* Discard oversized packets if !LPE and !SBP. */
2c0331f4
MC		 954 if ((size > MAXIMUM_ETHERNET_LPE_SIZE ||
955 (size > MAXIMUM_ETHERNET_VLAN_SIZE
956 && !(s->mac_reg[RCTL] & E1000_RCTL_LPE)))
b0d9ffcd
MC		 957 && !(s->mac_reg[RCTL] & E1000_RCTL_SBP)) {
958 return size;
959 }
960
97410dde 961 if (!receive_filter(s, filter_buf, size)) {
4f1c942b 962 return size;
97410dde 963 }
7c23b892 964
97410dde
VM		 965 if (vlan_enabled(s) && is_vlan_packet(s, filter_buf)) {
966 vlan_special = cpu_to_le16(be16_to_cpup((uint16_t *)(filter_buf
967 + 14)));
968 iov_ofs = 4;
969 if (filter_buf == iov->iov_base) {
970 memmove(filter_buf + 4, filter_buf, 12);
971 } else {
972 iov_from_buf(iov, iovcnt, 4, filter_buf, 12);
973 while (iov->iov_len <= iov_ofs) {
974 iov_ofs -= iov->iov_len;
975 iov++;
976 }
977 }
8f2e8d1f 978 vlan_status = E1000_RXD_STAT_VP;
8f2e8d1f
AL		 979 size -= 4;
980 }
981
7c23b892 982 rdh_start = s->mac_reg[RDH];
b19487e2
MT		 983 desc_offset = 0;
984 total_size = size + fcs_len(s);
322fd48a
MT		 985 if (!e1000_has_rxbufs(s, total_size)) {
986 set_ics(s, 0, E1000_ICS_RXO);
987 return -1;
988 }
7c23b892 989 do {
b19487e2
MT		 990 desc_size = total_size - desc_offset;
991 if (desc_size > s->rxbuf_size) {
992 desc_size = s->rxbuf_size;
993 }
d17161f6 994 base = rx_desc_base(s) + sizeof(desc) * s->mac_reg[RDH];
b08340d5 995 pci_dma_read(d, base, &desc, sizeof(desc));
8f2e8d1f
AL		 996 desc.special = vlan_special;
997 desc.status |= (vlan_status | E1000_RXD_STAT_DD);
7c23b892 998 if (desc.buffer_addr) {
b19487e2 999 if (desc_offset < size) {
97410dde
VM		 1000 size_t iov_copy;
1001 hwaddr ba = le64_to_cpu(desc.buffer_addr);
b19487e2
MT		 1002 size_t copy_size = size - desc_offset;
1003 if (copy_size > s->rxbuf_size) {
1004 copy_size = s->rxbuf_size;
1005 }
97410dde
VM		 1006 do {
1007 iov_copy = MIN(copy_size, iov->iov_len - iov_ofs);
1008 pci_dma_write(d, ba, iov->iov_base + iov_ofs, iov_copy);
1009 copy_size -= iov_copy;
1010 ba += iov_copy;
1011 iov_ofs += iov_copy;
1012 if (iov_ofs == iov->iov_len) {
1013 iov++;
1014 iov_ofs = 0;
1015 }
1016 } while (copy_size);
b19487e2
MT		 1017 }
1018 desc_offset += desc_size;
ee912ccf 1019 desc.length = cpu_to_le16(desc_size);
b19487e2 1020 if (desc_offset >= total_size) {
b19487e2
MT		 1021 desc.status |= E1000_RXD_STAT_EOP | E1000_RXD_STAT_IXSM;
1022 } else {
ee912ccf
MT		 1023 /* Guest zeroing out status is not a hardware requirement.
1024 Clear EOP in case guest didn't do it. */
1025 desc.status &= ~E1000_RXD_STAT_EOP;
b19487e2 1026 }
43ad7e3e 1027 } else { // as per intel docs; skip descriptors with null buf addr
7c23b892 1028 DBGOUT(RX, "Null RX descriptor!!\n");
43ad7e3e 1029 }
b08340d5 1030 pci_dma_write(d, base, &desc, sizeof(desc));
7c23b892
AZ		 1031
1032 if (++s->mac_reg[RDH] * sizeof(desc) >= s->mac_reg[RDLEN])
1033 s->mac_reg[RDH] = 0;
7c23b892
AZ		 1034 /* see comment in start_xmit; same here */
1035 if (s->mac_reg[RDH] == rdh_start) {
1036 DBGOUT(RXERR, "RDH wraparound @%x, RDT %x, RDLEN %x\n",
1037 rdh_start, s->mac_reg[RDT], s->mac_reg[RDLEN]);
1038 set_ics(s, 0, E1000_ICS_RXO);
4f1c942b 1039 return -1;
7c23b892 1040 }
b19487e2 1041 } while (desc_offset < total_size);
7c23b892
AZ		 1042
1043 s->mac_reg[GPRC]++;
1044 s->mac_reg[TPR]++;
a05e8a6e
MT		 1045 /* TOR - Total Octets Received:
1046 * This register includes bytes received in a packet from the <Destination
1047 * Address> field through the <CRC> field, inclusively.
1048 */
1049 n = s->mac_reg[TORL] + size + /* Always include FCS length. */ 4;
1050 if (n < s->mac_reg[TORL])
7c23b892 1051 s->mac_reg[TORH]++;
a05e8a6e 1052 s->mac_reg[TORL] = n;
7c23b892
AZ		 1053
1054 n = E1000_ICS_RXT0;
1055 if ((rdt = s->mac_reg[RDT]) < s->mac_reg[RDH])
1056 rdt += s->mac_reg[RDLEN] / sizeof(desc);
bf16cc8f
AL		 1057 if (((rdt - s->mac_reg[RDH]) * sizeof(desc)) <= s->mac_reg[RDLEN] >>
1058 s->rxbuf_min_shift)
7c23b892
AZ		 1059 n |= E1000_ICS_RXDMT0;
1060
1061 set_ics(s, 0, n);
4f1c942b
MM		 1062
1063 return size;
7c23b892
AZ		 1064}
1065
97410dde
VM		 1066static ssize_t
1067e1000_receive(NetClientState *nc, const uint8_t *buf, size_t size)
1068{
1069 const struct iovec iov = {
1070 .iov_base = (uint8_t *)buf,
1071 .iov_len = size
1072 };
1073
1074 return e1000_receive_iov(nc, &iov, 1);
1075}
1076
7c23b892
AZ		 1077static uint32_t
1078mac_readreg(E1000State *s, int index)
1079{
1080 return s->mac_reg[index];
1081}
1082
1083static uint32_t
1084mac_icr_read(E1000State *s, int index)
1085{
1086 uint32_t ret = s->mac_reg[ICR];
1087
1088 DBGOUT(INTERRUPT, "ICR read: %x\n", ret);
1089 set_interrupt_cause(s, 0, 0);
1090 return ret;
1091}
1092
1093static uint32_t
1094mac_read_clr4(E1000State *s, int index)
1095{
1096 uint32_t ret = s->mac_reg[index];
1097
1098 s->mac_reg[index] = 0;
1099 return ret;
1100}
1101
1102static uint32_t
1103mac_read_clr8(E1000State *s, int index)
1104{
1105 uint32_t ret = s->mac_reg[index];
1106
1107 s->mac_reg[index] = 0;
1108 s->mac_reg[index-1] = 0;
1109 return ret;
1110}
1111
1112static void
1113mac_writereg(E1000State *s, int index, uint32_t val)
1114{
7c36507c
AK		 1115 uint32_t macaddr[2];
1116
7c23b892 1117 s->mac_reg[index] = val;
7c36507c 1118
90d131fb 1119 if (index == RA + 1) {
7c36507c
AK		 1120 macaddr[0] = cpu_to_le32(s->mac_reg[RA]);
1121 macaddr[1] = cpu_to_le32(s->mac_reg[RA + 1]);
1122 qemu_format_nic_info_str(qemu_get_queue(s->nic), (uint8_t *)macaddr);
1123 }
7c23b892
AZ		 1124}
1125
1126static void
1127set_rdt(E1000State *s, int index, uint32_t val)
1128{
7c23b892 1129 s->mac_reg[index] = val & 0xffff;
e8b4c680 1130 if (e1000_has_rxbufs(s, 1)) {
b356f76d 1131 qemu_flush_queued_packets(qemu_get_queue(s->nic));
e8b4c680 1132 }
7c23b892
AZ		 1133}
1134
1135static void
1136set_16bit(E1000State *s, int index, uint32_t val)
1137{
1138 s->mac_reg[index] = val & 0xffff;
1139}
1140
1141static void
1142set_dlen(E1000State *s, int index, uint32_t val)
1143{
1144 s->mac_reg[index] = val & 0xfff80;
1145}
1146
1147static void
1148set_tctl(E1000State *s, int index, uint32_t val)
1149{
1150 s->mac_reg[index] = val;
1151 s->mac_reg[TDT] &= 0xffff;
1152 start_xmit(s);
1153}
1154
1155static void
1156set_icr(E1000State *s, int index, uint32_t val)
1157{
1158 DBGOUT(INTERRUPT, "set_icr %x\n", val);
1159 set_interrupt_cause(s, 0, s->mac_reg[ICR] & ~val);
1160}
1161
1162static void
1163set_imc(E1000State *s, int index, uint32_t val)
1164{
1165 s->mac_reg[IMS] &= ~val;
1166 set_ics(s, 0, 0);
1167}
1168
1169static void
1170set_ims(E1000State *s, int index, uint32_t val)
1171{
1172 s->mac_reg[IMS] |= val;
1173 set_ics(s, 0, 0);
1174}
1175
1176#define getreg(x) [x] = mac_readreg
1177static uint32_t (*macreg_readops[])(E1000State *, int) = {
1178 getreg(PBA), getreg(RCTL), getreg(TDH), getreg(TXDCTL),
1179 getreg(WUFC), getreg(TDT), getreg(CTRL), getreg(LEDCTL),
1180 getreg(MANC), getreg(MDIC), getreg(SWSM), getreg(STATUS),
1181 getreg(TORL), getreg(TOTL), getreg(IMS), getreg(TCTL),
b1332393 1182 getreg(RDH), getreg(RDT), getreg(VET), getreg(ICS),
a00b2335 1183 getreg(TDBAL), getreg(TDBAH), getreg(RDBAH), getreg(RDBAL),
e9845f09
VM		 1184 getreg(TDLEN), getreg(RDLEN), getreg(RDTR), getreg(RADV),
1185 getreg(TADV), getreg(ITR),
7c23b892
AZ		 1186
1187 [TOTH] = mac_read_clr8, [TORH] = mac_read_clr8, [GPRC] = mac_read_clr4,
1188 [GPTC] = mac_read_clr4, [TPR] = mac_read_clr4, [TPT] = mac_read_clr4,
1189 [ICR] = mac_icr_read, [EECD] = get_eecd, [EERD] = flash_eerd_read,
1190 [CRCERRS ... MPC] = &mac_readreg,
1191 [RA ... RA+31] = &mac_readreg,
1192 [MTA ... MTA+127] = &mac_readreg,
8f2e8d1f 1193 [VFTA ... VFTA+127] = &mac_readreg,
7c23b892 1194};
b1503cda 1195enum { NREADOPS = ARRAY_SIZE(macreg_readops) };
7c23b892
AZ		 1196
1197#define putreg(x) [x] = mac_writereg
1198static void (*macreg_writeops[])(E1000State *, int, uint32_t) = {
1199 putreg(PBA), putreg(EERD), putreg(SWSM), putreg(WUFC),
1200 putreg(TDBAL), putreg(TDBAH), putreg(TXDCTL), putreg(RDBAH),
cab3c825 1201 putreg(RDBAL), putreg(LEDCTL), putreg(VET),
7c23b892
AZ		 1202 [TDLEN] = set_dlen, [RDLEN] = set_dlen, [TCTL] = set_tctl,
1203 [TDT] = set_tctl, [MDIC] = set_mdic, [ICS] = set_ics,
1204 [TDH] = set_16bit, [RDH] = set_16bit, [RDT] = set_rdt,
1205 [IMC] = set_imc, [IMS] = set_ims, [ICR] = set_icr,
cab3c825 1206 [EECD] = set_eecd, [RCTL] = set_rx_control, [CTRL] = set_ctrl,
e9845f09
VM		 1207 [RDTR] = set_16bit, [RADV] = set_16bit, [TADV] = set_16bit,
1208 [ITR] = set_16bit,
7c23b892
AZ		 1209 [RA ... RA+31] = &mac_writereg,
1210 [MTA ... MTA+127] = &mac_writereg,
8f2e8d1f 1211 [VFTA ... VFTA+127] = &mac_writereg,
7c23b892 1212};
b9d03e35 1213
b1503cda 1214enum { NWRITEOPS = ARRAY_SIZE(macreg_writeops) };
7c23b892
AZ		 1215
1216static void
a8170e5e 1217e1000_mmio_write(void *opaque, hwaddr addr, uint64_t val,
ad00a9b9 1218 unsigned size)
7c23b892
AZ		 1219{
1220 E1000State *s = opaque;
8da3ff18 1221 unsigned int index = (addr & 0x1ffff) >> 2;
7c23b892 1222
43ad7e3e 1223 if (index < NWRITEOPS && macreg_writeops[index]) {
6b59fc74 1224 macreg_writeops[index](s, index, val);
43ad7e3e 1225 } else if (index < NREADOPS && macreg_readops[index]) {
ad00a9b9 1226 DBGOUT(MMIO, "e1000_mmio_writel RO %x: 0x%04"PRIx64"\n", index<<2, val);
43ad7e3e 1227 } else {
ad00a9b9 1228 DBGOUT(UNKNOWN, "MMIO unknown write addr=0x%08x,val=0x%08"PRIx64"\n",
7c23b892 1229 index<<2, val);
43ad7e3e 1230 }
7c23b892
AZ		 1231}
1232
ad00a9b9 1233static uint64_t
a8170e5e 1234e1000_mmio_read(void *opaque, hwaddr addr, unsigned size)
7c23b892
AZ		 1235{
1236 E1000State *s = opaque;
8da3ff18 1237 unsigned int index = (addr & 0x1ffff) >> 2;
7c23b892
AZ		 1238
1239 if (index < NREADOPS && macreg_readops[index])
6b59fc74 1240 {
32600a30 1241 return macreg_readops[index](s, index);
6b59fc74 1242 }
7c23b892
AZ		 1243 DBGOUT(UNKNOWN, "MMIO unknown read addr=0x%08x\n", index<<2);
1244 return 0;
1245}
1246
ad00a9b9
AK		 1247static const MemoryRegionOps e1000_mmio_ops = {
1248 .read = e1000_mmio_read,
1249 .write = e1000_mmio_write,
1250 .endianness = DEVICE_LITTLE_ENDIAN,
1251 .impl = {
1252 .min_access_size = 4,
1253 .max_access_size = 4,
1254 },
1255};
1256
a8170e5e 1257static uint64_t e1000_io_read(void *opaque, hwaddr addr,
ad00a9b9 1258 unsigned size)
7c23b892 1259{
ad00a9b9
AK		 1260 E1000State *s = opaque;
1261
1262 (void)s;
1263 return 0;
7c23b892
AZ		 1264}
1265
a8170e5e 1266static void e1000_io_write(void *opaque, hwaddr addr,
ad00a9b9 1267 uint64_t val, unsigned size)
7c23b892 1268{
ad00a9b9
AK		 1269 E1000State *s = opaque;
1270
1271 (void)s;
7c23b892
AZ		 1272}
1273
ad00a9b9
AK		 1274static const MemoryRegionOps e1000_io_ops = {
1275 .read = e1000_io_read,
1276 .write = e1000_io_write,
1277 .endianness = DEVICE_LITTLE_ENDIAN,
1278};
1279
e482dc3e 1280static bool is_version_1(void *opaque, int version_id)
7c23b892 1281{
e482dc3e 1282 return version_id == 1;
7c23b892
AZ		 1283}
1284
ddcb73b7
MT		 1285static void e1000_pre_save(void *opaque)
1286{
1287 E1000State *s = opaque;
1288 NetClientState *nc = qemu_get_queue(s->nic);
2af234e6 1289
e9845f09
VM		 1290 /* If the mitigation timer is active, emulate a timeout now. */
1291 if (s->mit_timer_on) {
1292 e1000_mit_timer(s);
1293 }
1294
ddcb73b7 1295 /*
6a2acedb
GS		 1296 * If link is down and auto-negotiation is supported and ongoing,
1297 * complete auto-negotiation immediately. This allows us to look
1298 * at MII_SR_AUTONEG_COMPLETE to infer link status on load.
ddcb73b7
MT		 1299 */
1300 if (nc->link_down &&
6a2acedb 1301 s->compat_flags & E1000_FLAG_AUTONEG &&
ddcb73b7
MT		 1302 s->phy_reg[PHY_CTRL] & MII_CR_AUTO_NEG_EN &&
1303 s->phy_reg[PHY_CTRL] & MII_CR_RESTART_AUTO_NEG) {
1304 s->phy_reg[PHY_STATUS] |= MII_SR_AUTONEG_COMPLETE;
1305 }
1306}
1307
e4b82364
AK		 1308static int e1000_post_load(void *opaque, int version_id)
1309{
1310 E1000State *s = opaque;
b356f76d 1311 NetClientState *nc = qemu_get_queue(s->nic);
e4b82364 1312
e9845f09
VM		 1313 if (!(s->compat_flags & E1000_FLAG_MIT)) {
1314 s->mac_reg[ITR] = s->mac_reg[RDTR] = s->mac_reg[RADV] =
1315 s->mac_reg[TADV] = 0;
1316 s->mit_irq_level = false;
1317 }
1318 s->mit_ide = 0;
1319 s->mit_timer_on = false;
1320
e4b82364 1321 /* nc.link_down can't be migrated, so infer link_down according
ddcb73b7
MT		 1322 * to link status bit in mac_reg[STATUS].
1323 * Alternatively, restart link negotiation if it was in progress. */
b356f76d 1324 nc->link_down = (s->mac_reg[STATUS] & E1000_STATUS_LU) == 0;
2af234e6 1325
6a2acedb
GS		 1326 if (s->compat_flags & E1000_FLAG_AUTONEG &&
1327 s->phy_reg[PHY_CTRL] & MII_CR_AUTO_NEG_EN &&
ddcb73b7
MT		 1328 s->phy_reg[PHY_CTRL] & MII_CR_RESTART_AUTO_NEG &&
1329 !(s->phy_reg[PHY_STATUS] & MII_SR_AUTONEG_COMPLETE)) {
1330 nc->link_down = false;
bc72ad67 1331 timer_mod(s->autoneg_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + 500);
ddcb73b7 1332 }
e4b82364
AK		 1333
1334 return 0;
1335}
1336
e9845f09
VM		 1337static bool e1000_mit_state_needed(void *opaque)
1338{
1339 E1000State *s = opaque;
1340
1341 return s->compat_flags & E1000_FLAG_MIT;
1342}
1343
1344static const VMStateDescription vmstate_e1000_mit_state = {
1345 .name = "e1000/mit_state",
1346 .version_id = 1,
1347 .minimum_version_id = 1,
d49805ae 1348 .fields = (VMStateField[]) {
e9845f09
VM		 1349 VMSTATE_UINT32(mac_reg[RDTR], E1000State),
1350 VMSTATE_UINT32(mac_reg[RADV], E1000State),
1351 VMSTATE_UINT32(mac_reg[TADV], E1000State),
1352 VMSTATE_UINT32(mac_reg[ITR], E1000State),
1353 VMSTATE_BOOL(mit_irq_level, E1000State),
1354 VMSTATE_END_OF_LIST()
1355 }
1356};
1357
e482dc3e
JQ		 1358static const VMStateDescription vmstate_e1000 = {
1359 .name = "e1000",
1360 .version_id = 2,
1361 .minimum_version_id = 1,
ddcb73b7 1362 .pre_save = e1000_pre_save,
e4b82364 1363 .post_load = e1000_post_load,
d49805ae 1364 .fields = (VMStateField[]) {
b08340d5 1365 VMSTATE_PCI_DEVICE(parent_obj, E1000State),
e482dc3e
JQ		 1366 VMSTATE_UNUSED_TEST(is_version_1, 4), /* was instance id */
1367 VMSTATE_UNUSED(4), /* Was mmio_base. */
1368 VMSTATE_UINT32(rxbuf_size, E1000State),
1369 VMSTATE_UINT32(rxbuf_min_shift, E1000State),
1370 VMSTATE_UINT32(eecd_state.val_in, E1000State),
1371 VMSTATE_UINT16(eecd_state.bitnum_in, E1000State),
1372 VMSTATE_UINT16(eecd_state.bitnum_out, E1000State),
1373 VMSTATE_UINT16(eecd_state.reading, E1000State),
1374 VMSTATE_UINT32(eecd_state.old_eecd, E1000State),
1375 VMSTATE_UINT8(tx.ipcss, E1000State),
1376 VMSTATE_UINT8(tx.ipcso, E1000State),
1377 VMSTATE_UINT16(tx.ipcse, E1000State),
1378 VMSTATE_UINT8(tx.tucss, E1000State),
1379 VMSTATE_UINT8(tx.tucso, E1000State),
1380 VMSTATE_UINT16(tx.tucse, E1000State),
1381 VMSTATE_UINT32(tx.paylen, E1000State),
1382 VMSTATE_UINT8(tx.hdr_len, E1000State),
1383 VMSTATE_UINT16(tx.mss, E1000State),
1384 VMSTATE_UINT16(tx.size, E1000State),
1385 VMSTATE_UINT16(tx.tso_frames, E1000State),
1386 VMSTATE_UINT8(tx.sum_needed, E1000State),
1387 VMSTATE_INT8(tx.ip, E1000State),
1388 VMSTATE_INT8(tx.tcp, E1000State),
1389 VMSTATE_BUFFER(tx.header, E1000State),
1390 VMSTATE_BUFFER(tx.data, E1000State),
1391 VMSTATE_UINT16_ARRAY(eeprom_data, E1000State, 64),
1392 VMSTATE_UINT16_ARRAY(phy_reg, E1000State, 0x20),
1393 VMSTATE_UINT32(mac_reg[CTRL], E1000State),
1394 VMSTATE_UINT32(mac_reg[EECD], E1000State),
1395 VMSTATE_UINT32(mac_reg[EERD], E1000State),
1396 VMSTATE_UINT32(mac_reg[GPRC], E1000State),
1397 VMSTATE_UINT32(mac_reg[GPTC], E1000State),
1398 VMSTATE_UINT32(mac_reg[ICR], E1000State),
1399 VMSTATE_UINT32(mac_reg[ICS], E1000State),
1400 VMSTATE_UINT32(mac_reg[IMC], E1000State),
1401 VMSTATE_UINT32(mac_reg[IMS], E1000State),
1402 VMSTATE_UINT32(mac_reg[LEDCTL], E1000State),
1403 VMSTATE_UINT32(mac_reg[MANC], E1000State),
1404 VMSTATE_UINT32(mac_reg[MDIC], E1000State),
1405 VMSTATE_UINT32(mac_reg[MPC], E1000State),
1406 VMSTATE_UINT32(mac_reg[PBA], E1000State),
1407 VMSTATE_UINT32(mac_reg[RCTL], E1000State),
1408 VMSTATE_UINT32(mac_reg[RDBAH], E1000State),
1409 VMSTATE_UINT32(mac_reg[RDBAL], E1000State),
1410 VMSTATE_UINT32(mac_reg[RDH], E1000State),
1411 VMSTATE_UINT32(mac_reg[RDLEN], E1000State),
1412 VMSTATE_UINT32(mac_reg[RDT], E1000State),
1413 VMSTATE_UINT32(mac_reg[STATUS], E1000State),
1414 VMSTATE_UINT32(mac_reg[SWSM], E1000State),
1415 VMSTATE_UINT32(mac_reg[TCTL], E1000State),
1416 VMSTATE_UINT32(mac_reg[TDBAH], E1000State),
1417 VMSTATE_UINT32(mac_reg[TDBAL], E1000State),
1418 VMSTATE_UINT32(mac_reg[TDH], E1000State),
1419 VMSTATE_UINT32(mac_reg[TDLEN], E1000State),
1420 VMSTATE_UINT32(mac_reg[TDT], E1000State),
1421 VMSTATE_UINT32(mac_reg[TORH], E1000State),
1422 VMSTATE_UINT32(mac_reg[TORL], E1000State),
1423 VMSTATE_UINT32(mac_reg[TOTH], E1000State),
1424 VMSTATE_UINT32(mac_reg[TOTL], E1000State),
1425 VMSTATE_UINT32(mac_reg[TPR], E1000State),
1426 VMSTATE_UINT32(mac_reg[TPT], E1000State),
1427 VMSTATE_UINT32(mac_reg[TXDCTL], E1000State),
1428 VMSTATE_UINT32(mac_reg[WUFC], E1000State),
1429 VMSTATE_UINT32(mac_reg[VET], E1000State),
1430 VMSTATE_UINT32_SUB_ARRAY(mac_reg, E1000State, RA, 32),
1431 VMSTATE_UINT32_SUB_ARRAY(mac_reg, E1000State, MTA, 128),
1432 VMSTATE_UINT32_SUB_ARRAY(mac_reg, E1000State, VFTA, 128),
1433 VMSTATE_END_OF_LIST()
e9845f09
VM		 1434 },
1435 .subsections = (VMStateSubsection[]) {
1436 {
1437 .vmsd = &vmstate_e1000_mit_state,
1438 .needed = e1000_mit_state_needed,
1439 }, {
1440 /* empty */
1441 }
e482dc3e
JQ		 1442 }
1443};
7c23b892 1444
8597f2e1
GS		 1445/*
1446 * EEPROM contents documented in Tables 5-2 and 5-3, pp. 98-102.
1447 * Note: A valid DevId will be inserted during pci_e1000_init().
1448 */
88b4e9db 1449static const uint16_t e1000_eeprom_template[64] = {
7c23b892 1450 0x0000, 0x0000, 0x0000, 0x0000, 0xffff, 0x0000, 0x0000, 0x0000,
8597f2e1 1451 0x3000, 0x1000, 0x6403, 0 /*DevId*/, 0x8086, 0 /*DevId*/, 0x8086, 0x3040,
7c23b892
AZ		 1452 0x0008, 0x2000, 0x7e14, 0x0048, 0x1000, 0x00d8, 0x0000, 0x2700,
1453 0x6cc9, 0x3150, 0x0722, 0x040b, 0x0984, 0x0000, 0xc000, 0x0706,
1454 0x1008, 0x0000, 0x0f04, 0x7fff, 0x4d01, 0xffff, 0xffff, 0xffff,
1455 0xffff, 0xffff, 0xffff, 0xffff, 0xffff, 0xffff, 0xffff, 0xffff,
1456 0x0100, 0x4000, 0x121c, 0xffff, 0xffff, 0xffff, 0xffff, 0xffff,
1457 0xffff, 0xffff, 0xffff, 0xffff, 0xffff, 0xffff, 0xffff, 0x0000,
1458};
1459
7c23b892
AZ		 1460/* PCI interface */
1461
7c23b892 1462static void
ad00a9b9 1463e1000_mmio_setup(E1000State *d)
7c23b892 1464{
f65ed4c1
AL		 1465 int i;
1466 const uint32_t excluded_regs[] = {
1467 E1000_MDIC, E1000_ICR, E1000_ICS, E1000_IMS,
1468 E1000_IMC, E1000_TCTL, E1000_TDT, PNPMMIO_SIZE
1469 };
1470
eedfac6f
PB		 1471 memory_region_init_io(&d->mmio, OBJECT(d), &e1000_mmio_ops, d,
1472 "e1000-mmio", PNPMMIO_SIZE);
ad00a9b9 1473 memory_region_add_coalescing(&d->mmio, 0, excluded_regs[0]);
f65ed4c1 1474 for (i = 0; excluded_regs[i] != PNPMMIO_SIZE; i++)
ad00a9b9
AK		 1475 memory_region_add_coalescing(&d->mmio, excluded_regs[i] + 4,
1476 excluded_regs[i+1] - excluded_regs[i] - 4);
eedfac6f 1477 memory_region_init_io(&d->io, OBJECT(d), &e1000_io_ops, d, "e1000-io", IOPORT_SIZE);
7c23b892
AZ		 1478}
1479
b946a153 1480static void
4e68f7a0 1481e1000_cleanup(NetClientState *nc)
b946a153 1482{
cc1f0f45 1483 E1000State *s = qemu_get_nic_opaque(nc);
b946a153 1484
a03e2aec 1485 s->nic = NULL;
b946a153
AL		 1486}
1487
f90c2bcd 1488static void
4b09be85
AL		 1489pci_e1000_uninit(PCIDevice *dev)
1490{
567a3c9e 1491 E1000State *d = E1000(dev);
4b09be85 1492
bc72ad67
AB		 1493 timer_del(d->autoneg_timer);
1494 timer_free(d->autoneg_timer);
e9845f09
VM		 1495 timer_del(d->mit_timer);
1496 timer_free(d->mit_timer);
ad00a9b9
AK		 1497 memory_region_destroy(&d->mmio);
1498 memory_region_destroy(&d->io);
948ecf21 1499 qemu_del_nic(d->nic);
4b09be85
AL		 1500}
1501
a03e2aec 1502static NetClientInfo net_e1000_info = {
2be64a68 1503 .type = NET_CLIENT_OPTIONS_KIND_NIC,
a03e2aec
MM		 1504 .size = sizeof(NICState),
1505 .can_receive = e1000_can_receive,
1506 .receive = e1000_receive,
97410dde 1507 .receive_iov = e1000_receive_iov,
a03e2aec
MM		 1508 .cleanup = e1000_cleanup,
1509 .link_status_changed = e1000_set_link_status,
1510};
1511
81a322d4 1512static int pci_e1000_init(PCIDevice *pci_dev)
7c23b892 1513{
567a3c9e
PC		 1514 DeviceState *dev = DEVICE(pci_dev);
1515 E1000State *d = E1000(pci_dev);
8597f2e1 1516 PCIDeviceClass *pdc = PCI_DEVICE_GET_CLASS(pci_dev);
7c23b892 1517 uint8_t *pci_conf;
7c23b892 1518 uint16_t checksum = 0;
7c23b892 1519 int i;
fbdaa002 1520 uint8_t *macaddr;
aff427a1 1521
b08340d5 1522 pci_conf = pci_dev->config;
7c23b892 1523
a9cbacb0
MT		 1524 /* TODO: RST# value should be 0, PCI spec 6.2.4 */
1525 pci_conf[PCI_CACHE_LINE_SIZE] = 0x10;
7c23b892 1526
817e0b6f 1527 pci_conf[PCI_INTERRUPT_PIN] = 1; /* interrupt pin A */
7c23b892 1528
ad00a9b9 1529 e1000_mmio_setup(d);
7c23b892 1530
b08340d5 1531 pci_register_bar(pci_dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &d->mmio);
7c23b892 1532
b08340d5 1533 pci_register_bar(pci_dev, 1, PCI_BASE_ADDRESS_SPACE_IO, &d->io);
7c23b892 1534
7c23b892
AZ		 1535 memmove(d->eeprom_data, e1000_eeprom_template,
1536 sizeof e1000_eeprom_template);
fbdaa002
GH		 1537 qemu_macaddr_default_if_unset(&d->conf.macaddr);
1538 macaddr = d->conf.macaddr.a;
7c23b892 1539 for (i = 0; i < 3; i++)
9d07d757 1540 d->eeprom_data[i] = (macaddr[2*i+1]<<8) | macaddr[2*i];
8597f2e1 1541 d->eeprom_data[11] = d->eeprom_data[13] = pdc->device_id;
7c23b892
AZ		 1542 for (i = 0; i < EEPROM_CHECKSUM_REG; i++)
1543 checksum += d->eeprom_data[i];
1544 checksum = (uint16_t) EEPROM_SUM - checksum;
1545 d->eeprom_data[EEPROM_CHECKSUM_REG] = checksum;
1546
a03e2aec 1547 d->nic = qemu_new_nic(&net_e1000_info, &d->conf,
567a3c9e 1548 object_get_typename(OBJECT(d)), dev->id, d);
7c23b892 1549
b356f76d 1550 qemu_format_nic_info_str(qemu_get_queue(d->nic), macaddr);
1ca4d09a 1551
567a3c9e 1552 add_boot_device_path(d->conf.bootindex, dev, "/ethernet-phy@0");
1ca4d09a 1553
bc72ad67 1554 d->autoneg_timer = timer_new_ms(QEMU_CLOCK_VIRTUAL, e1000_autoneg_timer, d);
e9845f09 1555 d->mit_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, e1000_mit_timer, d);
b9d03e35 1556
81a322d4 1557 return 0;
9d07d757 1558}
72da4208 1559
fbdaa002
GH		 1560static void qdev_e1000_reset(DeviceState *dev)
1561{
567a3c9e 1562 E1000State *d = E1000(dev);
fbdaa002
GH		 1563 e1000_reset(d);
1564}
1565
40021f08
AL		 1566static Property e1000_properties[] = {
1567 DEFINE_NIC_PROPERTIES(E1000State, conf),
2af234e6
MT		 1568 DEFINE_PROP_BIT("autonegotiation", E1000State,
1569 compat_flags, E1000_FLAG_AUTONEG_BIT, true),
e9845f09
VM		 1570 DEFINE_PROP_BIT("mitigation", E1000State,
1571 compat_flags, E1000_FLAG_MIT_BIT, true),
40021f08
AL		 1572 DEFINE_PROP_END_OF_LIST(),
1573};
1574
8597f2e1
GS		 1575typedef struct E1000Info {
1576 const char *name;
1577 uint16_t device_id;
1578 uint8_t revision;
1579 uint16_t phy_id2;
8597f2e1
GS		 1580} E1000Info;
1581
40021f08
AL		 1582static void e1000_class_init(ObjectClass *klass, void *data)
1583{
39bffca2 1584 DeviceClass *dc = DEVICE_CLASS(klass);
40021f08 1585 PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
8597f2e1
GS		 1586 E1000BaseClass *e = E1000_DEVICE_CLASS(klass);
1587 const E1000Info *info = data;
40021f08
AL		 1588
1589 k->init = pci_e1000_init;
1590 k->exit = pci_e1000_uninit;
c45e5b5b 1591 k->romfile = "efi-e1000.rom";
40021f08 1592 k->vendor_id = PCI_VENDOR_ID_INTEL;
8597f2e1
GS		 1593 k->device_id = info->device_id;
1594 k->revision = info->revision;
1595 e->phy_id2 = info->phy_id2;
40021f08 1596 k->class_id = PCI_CLASS_NETWORK_ETHERNET;
125ee0ed 1597 set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
39bffca2
AL		 1598 dc->desc = "Intel Gigabit Ethernet";
1599 dc->reset = qdev_e1000_reset;
1600 dc->vmsd = &vmstate_e1000;
1601 dc->props = e1000_properties;
40021f08
AL		 1602}
1603
8597f2e1
GS		 1604static const TypeInfo e1000_base_info = {
1605 .name = TYPE_E1000_BASE,
39bffca2
AL		 1606 .parent = TYPE_PCI_DEVICE,
1607 .instance_size = sizeof(E1000State),
8597f2e1
GS		 1608 .class_size = sizeof(E1000BaseClass),
1609 .abstract = true,
1610};
1611
1612static const E1000Info e1000_devices[] = {
1613 {
1614 .name = "e1000-82540em",
1615 .device_id = E1000_DEV_ID_82540EM,
1616 .revision = 0x03,
1617 .phy_id2 = E1000_PHY_ID2_8254xx_DEFAULT,
1618 },
1619 {
1620 .name = "e1000-82544gc",
1621 .device_id = E1000_DEV_ID_82544GC_COPPER,
1622 .revision = 0x03,
1623 .phy_id2 = E1000_PHY_ID2_82544x,
1624 },
1625 {
1626 .name = "e1000-82545em",
1627 .device_id = E1000_DEV_ID_82545EM_COPPER,
1628 .revision = 0x03,
1629 .phy_id2 = E1000_PHY_ID2_8254xx_DEFAULT,
1630 },
8597f2e1
GS		 1631};
1632
1633static const TypeInfo e1000_default_info = {
1634 .name = "e1000",
1635 .parent = "e1000-82540em",
0aab0d3a
GH		 1636};
1637
83f7d43a 1638static void e1000_register_types(void)
9d07d757 1639{
8597f2e1
GS		 1640 int i;
1641
1642 type_register_static(&e1000_base_info);
1643 for (i = 0; i < ARRAY_SIZE(e1000_devices); i++) {
1644 const E1000Info *info = &e1000_devices[i];
1645 TypeInfo type_info = {};
1646
1647 type_info.name = info->name;
1648 type_info.parent = TYPE_E1000_BASE;
1649 type_info.class_data = (void *)info;
1650 type_info.class_init = e1000_class_init;
1651
1652 type_register(&type_info);
1653 }
1654 type_register_static(&e1000_default_info);
7c23b892 1655}
9d07d757 1656
83f7d43a 1657type_init(e1000_register_types)
QEMU mirror