[mirror_qemu.git] / hw / net / xgmac.c

/*
 * QEMU model of XGMAC Ethernet.
 *
 * derived from the Xilinx AXI-Ethernet by Edgar E. Iglesias.
 *
 * Copyright (c) 2011 Calxeda, Inc.
 *
 * Permission is hereby granted, free of charge, to any person obtaining a copy
 * of this software and associated documentation files (the "Software"), to deal
 * in the Software without restriction, including without limitation the rights
 * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
 * copies of the Software, and to permit persons to whom the Software is
 * furnished to do so, subject to the following conditions:
 *
 * The above copyright notice and this permission notice shall be included in
 * all copies or substantial portions of the Software.
 *
 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
 * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
 * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
 * THE SOFTWARE.
 */

#include "qemu/osdep.h"
#include "hw/irq.h"
#include "hw/qdev-properties.h"
#include "hw/sysbus.h"
#include "migration/vmstate.h"
#include "qemu/module.h"
#include "net/net.h"
#include "qom/object.h"

#ifdef DEBUG_XGMAC
#define DEBUGF_BRK(message, args...) do { \
                                         fprintf(stderr, (message), ## args); \
                                     } while (0)
#else
#define DEBUGF_BRK(message, args...) do { } while (0)
#endif

#define XGMAC_CONTROL           0x00000000   /* MAC Configuration */
#define XGMAC_FRAME_FILTER      0x00000001   /* MAC Frame Filter */
#define XGMAC_FLOW_CTRL         0x00000006   /* MAC Flow Control */
#define XGMAC_VLAN_TAG          0x00000007   /* VLAN Tags */
#define XGMAC_VERSION           0x00000008   /* Version */
/* VLAN tag for insertion or replacement into tx frames */
#define XGMAC_VLAN_INCL         0x00000009
#define XGMAC_LPI_CTRL          0x0000000a   /* LPI Control and Status */
#define XGMAC_LPI_TIMER         0x0000000b   /* LPI Timers Control */
#define XGMAC_TX_PACE           0x0000000c   /* Transmit Pace and Stretch */
#define XGMAC_VLAN_HASH         0x0000000d   /* VLAN Hash Table */
#define XGMAC_DEBUG             0x0000000e   /* Debug */
#define XGMAC_INT_STATUS        0x0000000f   /* Interrupt and Control */
/* HASH table registers */
#define XGMAC_HASH(n)           ((0x00000300/4) + (n))
#define XGMAC_NUM_HASH          16
/* Operation Mode */
#define XGMAC_OPMODE            (0x00000400/4)
/* Remote Wake-Up Frame Filter */
#define XGMAC_REMOTE_WAKE       (0x00000700/4)
/* PMT Control and Status */
#define XGMAC_PMT               (0x00000704/4)

#define XGMAC_ADDR_HIGH(reg)    (0x00000010+((reg) * 2))
#define XGMAC_ADDR_LOW(reg)     (0x00000011+((reg) * 2))

#define DMA_BUS_MODE            0x000003c0   /* Bus Mode */
#define DMA_XMT_POLL_DEMAND     0x000003c1   /* Transmit Poll Demand */
#define DMA_RCV_POLL_DEMAND     0x000003c2   /* Received Poll Demand */
#define DMA_RCV_BASE_ADDR       0x000003c3   /* Receive List Base */
#define DMA_TX_BASE_ADDR        0x000003c4   /* Transmit List Base */
#define DMA_STATUS              0x000003c5   /* Status Register */
#define DMA_CONTROL             0x000003c6   /* Ctrl (Operational Mode) */
#define DMA_INTR_ENA            0x000003c7   /* Interrupt Enable */
#define DMA_MISSED_FRAME_CTR    0x000003c8   /* Missed Frame Counter */
/* Receive Interrupt Watchdog Timer */
#define DMA_RI_WATCHDOG_TIMER   0x000003c9
#define DMA_AXI_BUS             0x000003ca   /* AXI Bus Mode */
#define DMA_AXI_STATUS          0x000003cb   /* AXI Status */
#define DMA_CUR_TX_DESC_ADDR    0x000003d2   /* Current Host Tx Descriptor */
#define DMA_CUR_RX_DESC_ADDR    0x000003d3   /* Current Host Rx Descriptor */
#define DMA_CUR_TX_BUF_ADDR     0x000003d4   /* Current Host Tx Buffer */
#define DMA_CUR_RX_BUF_ADDR     0x000003d5   /* Current Host Rx Buffer */
#define DMA_HW_FEATURE          0x000003d6   /* Enabled Hardware Features */

/* DMA Status register defines */
#define DMA_STATUS_GMI          0x08000000   /* MMC interrupt */
#define DMA_STATUS_GLI          0x04000000   /* GMAC Line interface int */
#define DMA_STATUS_EB_MASK      0x00380000   /* Error Bits Mask */
#define DMA_STATUS_EB_TX_ABORT  0x00080000   /* Error Bits - TX Abort */
#define DMA_STATUS_EB_RX_ABORT  0x00100000   /* Error Bits - RX Abort */
#define DMA_STATUS_TS_MASK      0x00700000   /* Transmit Process State */
#define DMA_STATUS_TS_SHIFT     20
#define DMA_STATUS_RS_MASK      0x000e0000   /* Receive Process State */
#define DMA_STATUS_RS_SHIFT     17
#define DMA_STATUS_NIS          0x00010000   /* Normal Interrupt Summary */
#define DMA_STATUS_AIS          0x00008000   /* Abnormal Interrupt Summary */
#define DMA_STATUS_ERI          0x00004000   /* Early Receive Interrupt */
#define DMA_STATUS_FBI          0x00002000   /* Fatal Bus Error Interrupt */
#define DMA_STATUS_ETI          0x00000400   /* Early Transmit Interrupt */
#define DMA_STATUS_RWT          0x00000200   /* Receive Watchdog Timeout */
#define DMA_STATUS_RPS          0x00000100   /* Receive Process Stopped */
#define DMA_STATUS_RU           0x00000080   /* Receive Buffer Unavailable */
#define DMA_STATUS_RI           0x00000040   /* Receive Interrupt */
#define DMA_STATUS_UNF          0x00000020   /* Transmit Underflow */
#define DMA_STATUS_OVF          0x00000010   /* Receive Overflow */
#define DMA_STATUS_TJT          0x00000008   /* Transmit Jabber Timeout */
#define DMA_STATUS_TU           0x00000004   /* Transmit Buffer Unavailable */
#define DMA_STATUS_TPS          0x00000002   /* Transmit Process Stopped */
#define DMA_STATUS_TI           0x00000001   /* Transmit Interrupt */

/* DMA Control register defines */
#define DMA_CONTROL_ST          0x00002000   /* Start/Stop Transmission */
#define DMA_CONTROL_SR          0x00000002   /* Start/Stop Receive */
#define DMA_CONTROL_DFF         0x01000000   /* Disable flush of rx frames */

struct desc {
    uint32_t ctl_stat;
    uint16_t buffer1_size;
    uint16_t buffer2_size;
    uint32_t buffer1_addr;
    uint32_t buffer2_addr;
    uint32_t ext_stat;
    uint32_t res[3];
};

#define R_MAX 0x400

typedef struct RxTxStats {
    uint64_t rx_bytes;
    uint64_t tx_bytes;

    uint64_t rx;
    uint64_t rx_bcast;
    uint64_t rx_mcast;
} RxTxStats;

#define TYPE_XGMAC "xgmac"
OBJECT_DECLARE_SIMPLE_TYPE(XgmacState, XGMAC)

struct XgmacState {
    SysBusDevice parent_obj;

    MemoryRegion iomem;
    qemu_irq sbd_irq;
    qemu_irq pmt_irq;
    qemu_irq mci_irq;
    NICState *nic;
    NICConf conf;

    struct RxTxStats stats;
    uint32_t regs[R_MAX];
};

static const VMStateDescription vmstate_rxtx_stats = {
    .name = "xgmac_stats",
    .version_id = 1,
    .minimum_version_id = 1,
    .fields = (VMStateField[]) {
        VMSTATE_UINT64(rx_bytes, RxTxStats),
        VMSTATE_UINT64(tx_bytes, RxTxStats),
        VMSTATE_UINT64(rx, RxTxStats),
        VMSTATE_UINT64(rx_bcast, RxTxStats),
        VMSTATE_UINT64(rx_mcast, RxTxStats),
        VMSTATE_END_OF_LIST()
    }
};

static const VMStateDescription vmstate_xgmac = {
    .name = "xgmac",
    .version_id = 1,
    .minimum_version_id = 1,
    .fields = (VMStateField[]) {
        VMSTATE_STRUCT(stats, XgmacState, 0, vmstate_rxtx_stats, RxTxStats),
        VMSTATE_UINT32_ARRAY(regs, XgmacState, R_MAX),
        VMSTATE_END_OF_LIST()
    }
};

static void xgmac_read_desc(XgmacState *s, struct desc *d, int rx)
{
    uint32_t addr = rx ? s->regs[DMA_CUR_RX_DESC_ADDR] :
        s->regs[DMA_CUR_TX_DESC_ADDR];
    cpu_physical_memory_read(addr, d, sizeof(*d));
}

static void xgmac_write_desc(XgmacState *s, struct desc *d, int rx)
{
    int reg = rx ? DMA_CUR_RX_DESC_ADDR : DMA_CUR_TX_DESC_ADDR;
    uint32_t addr = s->regs[reg];

    if (!rx && (d->ctl_stat & 0x00200000)) {
        s->regs[reg] = s->regs[DMA_TX_BASE_ADDR];
    } else if (rx && (d->buffer1_size & 0x8000)) {
        s->regs[reg] = s->regs[DMA_RCV_BASE_ADDR];
    } else {
        s->regs[reg] += sizeof(*d);
    }
    cpu_physical_memory_write(addr, d, sizeof(*d));
}

static void xgmac_enet_send(XgmacState *s)
{
    struct desc bd;
    int frame_size;
    int len;
    uint8_t frame[8192];
    uint8_t *ptr;

    ptr = frame;
    frame_size = 0;
    while (1) {
        xgmac_read_desc(s, &bd, 0);
        if ((bd.ctl_stat & 0x80000000) == 0) {
            /* Run out of descriptors to transmit.  */
            break;
        }
        len = (bd.buffer1_size & 0xfff) + (bd.buffer2_size & 0xfff);

        /*
         * FIXME: these cases of malformed tx descriptors (bad sizes)
         * should probably be reported back to the guest somehow
         * rather than simply silently stopping processing, but we
         * don't know what the hardware does in this situation.
         * This will only happen for buggy guests anyway.
         */
        if ((bd.buffer1_size & 0xfff) > 2048) {
            DEBUGF_BRK("qemu:%s:ERROR...ERROR...ERROR... -- "
                        "xgmac buffer 1 len on send > 2048 (0x%x)\n",
                         __func__, bd.buffer1_size & 0xfff);
            break;
        }
        if ((bd.buffer2_size & 0xfff) != 0) {
            DEBUGF_BRK("qemu:%s:ERROR...ERROR...ERROR... -- "
                        "xgmac buffer 2 len on send != 0 (0x%x)\n",
                        __func__, bd.buffer2_size & 0xfff);
            break;
        }
        if (frame_size + len >= sizeof(frame)) {
            DEBUGF_BRK("qemu:%s: buffer overflow %d read into %zu "
                        "buffer\n" , __func__, frame_size + len, sizeof(frame));
            DEBUGF_BRK("qemu:%s: buffer1.size=%d; buffer2.size=%d\n",
                        __func__, bd.buffer1_size, bd.buffer2_size);
            break;
        }

        cpu_physical_memory_read(bd.buffer1_addr, ptr, len);
        ptr += len;
        frame_size += len;
        if (bd.ctl_stat & 0x20000000) {
            /* Last buffer in frame.  */
            qemu_send_packet(qemu_get_queue(s->nic), frame, len);
            ptr = frame;
            frame_size = 0;
            s->regs[DMA_STATUS] |= DMA_STATUS_TI | DMA_STATUS_NIS;
        }
        bd.ctl_stat &= ~0x80000000;
        /* Write back the modified descriptor.  */
        xgmac_write_desc(s, &bd, 0);
    }
}

static void enet_update_irq(XgmacState *s)
{
    int stat = s->regs[DMA_STATUS] & s->regs[DMA_INTR_ENA];
    qemu_set_irq(s->sbd_irq, !!stat);
}

static uint64_t enet_read(void *opaque, hwaddr addr, unsigned size)
{
    XgmacState *s = opaque;
    uint64_t r = 0;
    addr >>= 2;

    switch (addr) {
    case XGMAC_VERSION:
        r = 0x1012;
        break;
    default:
        if (addr < ARRAY_SIZE(s->regs)) {
            r = s->regs[addr];
        }
        break;
    }
    return r;
}

static void enet_write(void *opaque, hwaddr addr,
                       uint64_t value, unsigned size)
{
    XgmacState *s = opaque;

    addr >>= 2;
    switch (addr) {
    case DMA_BUS_MODE:
        s->regs[DMA_BUS_MODE] = value & ~0x1;
        break;
    case DMA_XMT_POLL_DEMAND:
        xgmac_enet_send(s);
        break;
    case DMA_STATUS:
        s->regs[DMA_STATUS] = s->regs[DMA_STATUS] & ~value;
        break;
    case DMA_RCV_BASE_ADDR:
        s->regs[DMA_RCV_BASE_ADDR] = s->regs[DMA_CUR_RX_DESC_ADDR] = value;
        break;
    case DMA_TX_BASE_ADDR:
        s->regs[DMA_TX_BASE_ADDR] = s->regs[DMA_CUR_TX_DESC_ADDR] = value;
        break;
    default:
        if (addr < ARRAY_SIZE(s->regs)) {
            s->regs[addr] = value;
        }
        break;
    }
    enet_update_irq(s);
}

static const MemoryRegionOps enet_mem_ops = {
    .read = enet_read,
    .write = enet_write,
    .endianness = DEVICE_LITTLE_ENDIAN,
};

static int eth_can_rx(XgmacState *s)
{
    /* RX enabled?  */
    return s->regs[DMA_CONTROL] & DMA_CONTROL_SR;
}

static ssize_t eth_rx(NetClientState *nc, const uint8_t *buf, size_t size)
{
    XgmacState *s = qemu_get_nic_opaque(nc);
    static const unsigned char sa_bcast[6] = {0xff, 0xff, 0xff,
                                              0xff, 0xff, 0xff};
    int unicast, broadcast, multicast;
    struct desc bd;
    ssize_t ret;

    if (!eth_can_rx(s)) {
        return -1;
    }
    unicast = ~buf[0] & 0x1;
    broadcast = memcmp(buf, sa_bcast, 6) == 0;
    multicast = !unicast && !broadcast;
    if (size < 12) {
        s->regs[DMA_STATUS] |= DMA_STATUS_RI | DMA_STATUS_NIS;
        ret = -1;
        goto out;
    }

    xgmac_read_desc(s, &bd, 1);
    if ((bd.ctl_stat & 0x80000000) == 0) {
        s->regs[DMA_STATUS] |= DMA_STATUS_RU | DMA_STATUS_AIS;
        ret = size;
        goto out;
    }

    cpu_physical_memory_write(bd.buffer1_addr, buf, size);

    /* Add in the 4 bytes for crc (the real hw returns length incl crc) */
    size += 4;
    bd.ctl_stat = (size << 16) | 0x300;
    xgmac_write_desc(s, &bd, 1);

    s->stats.rx_bytes += size;
    s->stats.rx++;
    if (multicast) {
        s->stats.rx_mcast++;
    } else if (broadcast) {
        s->stats.rx_bcast++;
    }

    s->regs[DMA_STATUS] |= DMA_STATUS_RI | DMA_STATUS_NIS;
    ret = size;

out:
    enet_update_irq(s);
    return ret;
}

static NetClientInfo net_xgmac_enet_info = {
    .type = NET_CLIENT_DRIVER_NIC,
    .size = sizeof(NICState),
    .receive = eth_rx,
};

static void xgmac_enet_realize(DeviceState *dev, Error **errp)
{
    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
    XgmacState *s = XGMAC(dev);

    memory_region_init_io(&s->iomem, OBJECT(s), &enet_mem_ops, s,
                          "xgmac", 0x1000);
    sysbus_init_mmio(sbd, &s->iomem);
    sysbus_init_irq(sbd, &s->sbd_irq);
    sysbus_init_irq(sbd, &s->pmt_irq);
    sysbus_init_irq(sbd, &s->mci_irq);

    qemu_macaddr_default_if_unset(&s->conf.macaddr);
    s->nic = qemu_new_nic(&net_xgmac_enet_info, &s->conf,
                          object_get_typename(OBJECT(dev)), dev->id,
                          &dev->mem_reentrancy_guard, s);
    qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);

    s->regs[XGMAC_ADDR_HIGH(0)] = (s->conf.macaddr.a[5] << 8) |
                                   s->conf.macaddr.a[4];
    s->regs[XGMAC_ADDR_LOW(0)] = (s->conf.macaddr.a[3] << 24) |
                                 (s->conf.macaddr.a[2] << 16) |
                                 (s->conf.macaddr.a[1] << 8) |
                                  s->conf.macaddr.a[0];
}

static Property xgmac_properties[] = {
    DEFINE_NIC_PROPERTIES(XgmacState, conf),
    DEFINE_PROP_END_OF_LIST(),
};

static void xgmac_enet_class_init(ObjectClass *klass, void *data)
{
    DeviceClass *dc = DEVICE_CLASS(klass);

    dc->realize = xgmac_enet_realize;
    dc->vmsd = &vmstate_xgmac;
    device_class_set_props(dc, xgmac_properties);
}

static const TypeInfo xgmac_enet_info = {
    .name          = TYPE_XGMAC,
    .parent        = TYPE_SYS_BUS_DEVICE,
    .instance_size = sizeof(XgmacState),
    .class_init    = xgmac_enet_class_init,
};

static void xgmac_enet_register_types(void)
{
    type_register_static(&xgmac_enet_info);
}

type_init(xgmac_enet_register_types)
Commit	Line	Data
4c0e167c RH	1	/*
	2	* QEMU model of XGMAC Ethernet.
	3	*
	4	* derived from the Xilinx AXI-Ethernet by Edgar E. Iglesias.
	5	*
	6	* Copyright (c) 2011 Calxeda, Inc.
	7	*
	8	* Permission is hereby granted, free of charge, to any person obtaining a copy
	9	* of this software and associated documentation files (the "Software"), to deal
	10	* in the Software without restriction, including without limitation the rights
	11	* to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
	12	* copies of the Software, and to permit persons to whom the Software is
	13	* furnished to do so, subject to the following conditions:
	14	*
	15	* The above copyright notice and this permission notice shall be included in
	16	* all copies or substantial portions of the Software.
	17	*
	18	* THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
	19	* IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
	20	* FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
	21	* THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
	22	* LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
	23	* OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
	24	* THE SOFTWARE.
	25	*/
	26
8ef94f0b	27	#include "qemu/osdep.h"
64552b6b	28	#include "hw/irq.h"
a27bd6c7	29	#include "hw/qdev-properties.h"
83c9f4ca	30	#include "hw/sysbus.h"
d6454270	31	#include "migration/vmstate.h"
0b8fa32f	32	#include "qemu/module.h"
1422e32d	33	#include "net/net.h"
db1015e9	34	#include "qom/object.h"
4c0e167c RH	35
	36	#ifdef DEBUG_XGMAC
	37	#define DEBUGF_BRK(message, args...) do { \
	38	fprintf(stderr, (message), ## args); \
	39	} while (0)
	40	#else
	41	#define DEBUGF_BRK(message, args...) do { } while (0)
	42	#endif
	43
	44	#define XGMAC_CONTROL 0x00000000 /* MAC Configuration */
	45	#define XGMAC_FRAME_FILTER 0x00000001 /* MAC Frame Filter */
	46	#define XGMAC_FLOW_CTRL 0x00000006 /* MAC Flow Control */
	47	#define XGMAC_VLAN_TAG 0x00000007 /* VLAN Tags */
	48	#define XGMAC_VERSION 0x00000008 /* Version */
	49	/* VLAN tag for insertion or replacement into tx frames */
	50	#define XGMAC_VLAN_INCL 0x00000009
	51	#define XGMAC_LPI_CTRL 0x0000000a /* LPI Control and Status */
	52	#define XGMAC_LPI_TIMER 0x0000000b /* LPI Timers Control */
	53	#define XGMAC_TX_PACE 0x0000000c /* Transmit Pace and Stretch */
	54	#define XGMAC_VLAN_HASH 0x0000000d /* VLAN Hash Table */
	55	#define XGMAC_DEBUG 0x0000000e /* Debug */
	56	#define XGMAC_INT_STATUS 0x0000000f /* Interrupt and Control */
	57	/* HASH table registers */
	58	#define XGMAC_HASH(n) ((0x00000300/4) + (n))
	59	#define XGMAC_NUM_HASH 16
	60	/* Operation Mode */
	61	#define XGMAC_OPMODE (0x00000400/4)
	62	/* Remote Wake-Up Frame Filter */
	63	#define XGMAC_REMOTE_WAKE (0x00000700/4)
	64	/* PMT Control and Status */
	65	#define XGMAC_PMT (0x00000704/4)
	66
	67	#define XGMAC_ADDR_HIGH(reg) (0x00000010+((reg) * 2))
	68	#define XGMAC_ADDR_LOW(reg) (0x00000011+((reg) * 2))
	69
	70	#define DMA_BUS_MODE 0x000003c0 /* Bus Mode */
	71	#define DMA_XMT_POLL_DEMAND 0x000003c1 /* Transmit Poll Demand */
	72	#define DMA_RCV_POLL_DEMAND 0x000003c2 /* Received Poll Demand */
	73	#define DMA_RCV_BASE_ADDR 0x000003c3 /* Receive List Base */
	74	#define DMA_TX_BASE_ADDR 0x000003c4 /* Transmit List Base */
	75	#define DMA_STATUS 0x000003c5 /* Status Register */
	76	#define DMA_CONTROL 0x000003c6 /* Ctrl (Operational Mode) */
	77	#define DMA_INTR_ENA 0x000003c7 /* Interrupt Enable */
	78	#define DMA_MISSED_FRAME_CTR 0x000003c8 /* Missed Frame Counter */
	79	/* Receive Interrupt Watchdog Timer */
	80	#define DMA_RI_WATCHDOG_TIMER 0x000003c9
	81	#define DMA_AXI_BUS 0x000003ca /* AXI Bus Mode */
	82	#define DMA_AXI_STATUS 0x000003cb /* AXI Status */
	83	#define DMA_CUR_TX_DESC_ADDR 0x000003d2 /* Current Host Tx Descriptor */
	84	#define DMA_CUR_RX_DESC_ADDR 0x000003d3 /* Current Host Rx Descriptor */
	85	#define DMA_CUR_TX_BUF_ADDR 0x000003d4 /* Current Host Tx Buffer */
	86	#define DMA_CUR_RX_BUF_ADDR 0x000003d5 /* Current Host Rx Buffer */
	87	#define DMA_HW_FEATURE 0x000003d6 /* Enabled Hardware Features */
	88
	89	/* DMA Status register defines */
	90	#define DMA_STATUS_GMI 0x08000000 /* MMC interrupt */
	91	#define DMA_STATUS_GLI 0x04000000 /* GMAC Line interface int */
	92	#define DMA_STATUS_EB_MASK 0x00380000 /* Error Bits Mask */
	93	#define DMA_STATUS_EB_TX_ABORT 0x00080000 /* Error Bits - TX Abort */
	94	#define DMA_STATUS_EB_RX_ABORT 0x00100000 /* Error Bits - RX Abort */
	95	#define DMA_STATUS_TS_MASK 0x00700000 /* Transmit Process State */
	96	#define DMA_STATUS_TS_SHIFT 20
	97	#define DMA_STATUS_RS_MASK 0x000e0000 /* Receive Process State */
	98	#define DMA_STATUS_RS_SHIFT 17
99	#define DMA_STATUS_NIS 0x00010000 /* Normal Interrupt Summary */
100	#define DMA_STATUS_AIS 0x00008000 /* Abnormal Interrupt Summary */
101	#define DMA_STATUS_ERI 0x00004000 /* Early Receive Interrupt */
102	#define DMA_STATUS_FBI 0x00002000 /* Fatal Bus Error Interrupt */
103	#define DMA_STATUS_ETI 0x00000400 /* Early Transmit Interrupt */
104	#define DMA_STATUS_RWT 0x00000200 /* Receive Watchdog Timeout */
105	#define DMA_STATUS_RPS 0x00000100 /* Receive Process Stopped */
106	#define DMA_STATUS_RU 0x00000080 /* Receive Buffer Unavailable */
107	#define DMA_STATUS_RI 0x00000040 /* Receive Interrupt */
108	#define DMA_STATUS_UNF 0x00000020 /* Transmit Underflow */
109	#define DMA_STATUS_OVF 0x00000010 /* Receive Overflow */
110	#define DMA_STATUS_TJT 0x00000008 /* Transmit Jabber Timeout */
111	#define DMA_STATUS_TU 0x00000004 /* Transmit Buffer Unavailable */
112	#define DMA_STATUS_TPS 0x00000002 /* Transmit Process Stopped */
113	#define DMA_STATUS_TI 0x00000001 /* Transmit Interrupt */
114
115	/* DMA Control register defines */
116	#define DMA_CONTROL_ST 0x00002000 /* Start/Stop Transmission */
117	#define DMA_CONTROL_SR 0x00000002 /* Start/Stop Receive */
118	#define DMA_CONTROL_DFF 0x01000000 /* Disable flush of rx frames */
119
120	struct desc {
121	uint32_t ctl_stat;
122	uint16_t buffer1_size;
123	uint16_t buffer2_size;
124	uint32_t buffer1_addr;
125	uint32_t buffer2_addr;
126	uint32_t ext_stat;
127	uint32_t res[3];
128	};
129
130	#define R_MAX 0x400
131
132	typedef struct RxTxStats {
133	uint64_t rx_bytes;
134	uint64_t tx_bytes;
135
136	uint64_t rx;
137	uint64_t rx_bcast;
138	uint64_t rx_mcast;
139	} RxTxStats;
140
546921ea	141	#define TYPE_XGMAC "xgmac"
8063396b	142	OBJECT_DECLARE_SIMPLE_TYPE(XgmacState, XGMAC)
546921ea	143
db1015e9	144	struct XgmacState {
546921ea AF	145	SysBusDevice parent_obj;
546921ea AF	146
4c0e167c RH	147	MemoryRegion iomem;
	148	qemu_irq sbd_irq;
	149	qemu_irq pmt_irq;
	150	qemu_irq mci_irq;
	151	NICState *nic;
	152	NICConf conf;
	153
	154	struct RxTxStats stats;
	155	uint32_t regs[R_MAX];
db1015e9	156	};
4c0e167c	157
6a0a70b0	158	static const VMStateDescription vmstate_rxtx_stats = {
4c0e167c RH	159	.name = "xgmac_stats",
	160	.version_id = 1,
	161	.minimum_version_id = 1,
8f1e884b	162	.fields = (VMStateField[]) {
4c0e167c RH	163	VMSTATE_UINT64(rx_bytes, RxTxStats),
	164	VMSTATE_UINT64(tx_bytes, RxTxStats),
	165	VMSTATE_UINT64(rx, RxTxStats),
	166	VMSTATE_UINT64(rx_bcast, RxTxStats),
	167	VMSTATE_UINT64(rx_mcast, RxTxStats),
	168	VMSTATE_END_OF_LIST()
	169	}
	170	};
	171
	172	static const VMStateDescription vmstate_xgmac = {
	173	.name = "xgmac",
	174	.version_id = 1,
	175	.minimum_version_id = 1,
	176	.fields = (VMStateField[]) {
	177	VMSTATE_STRUCT(stats, XgmacState, 0, vmstate_rxtx_stats, RxTxStats),
	178	VMSTATE_UINT32_ARRAY(regs, XgmacState, R_MAX),
	179	VMSTATE_END_OF_LIST()
	180	}
	181	};
	182
546921ea	183	static void xgmac_read_desc(XgmacState s, struct desc d, int rx)
4c0e167c RH	184	{
	185	uint32_t addr = rx ? s->regs[DMA_CUR_RX_DESC_ADDR] :
	186	s->regs[DMA_CUR_TX_DESC_ADDR];
	187	cpu_physical_memory_read(addr, d, sizeof(*d));
	188	}
	189
546921ea	190	static void xgmac_write_desc(XgmacState s, struct desc d, int rx)
4c0e167c RH	191	{
	192	int reg = rx ? DMA_CUR_RX_DESC_ADDR : DMA_CUR_TX_DESC_ADDR;
	193	uint32_t addr = s->regs[reg];
	194
	195	if (!rx && (d->ctl_stat & 0x00200000)) {
	196	s->regs[reg] = s->regs[DMA_TX_BASE_ADDR];
	197	} else if (rx && (d->buffer1_size & 0x8000)) {
	198	s->regs[reg] = s->regs[DMA_RCV_BASE_ADDR];
	199	} else {
	200	s->regs[reg] += sizeof(*d);
	201	}
	202	cpu_physical_memory_write(addr, d, sizeof(*d));
	203	}
	204
546921ea	205	static void xgmac_enet_send(XgmacState *s)
4c0e167c RH	206	{
	207	struct desc bd;
	208	int frame_size;
	209	int len;
	210	uint8_t frame[8192];
	211	uint8_t *ptr;
	212
	213	ptr = frame;
	214	frame_size = 0;
	215	while (1) {
	216	xgmac_read_desc(s, &bd, 0);
	217	if ((bd.ctl_stat & 0x80000000) == 0) {
	218	/* Run out of descriptors to transmit. */
	219	break;
	220	}
	221	len = (bd.buffer1_size & 0xfff) + (bd.buffer2_size & 0xfff);
	222
5519724a MMC	223	/*
	224	* FIXME: these cases of malformed tx descriptors (bad sizes)
	225	* should probably be reported back to the guest somehow
	226	* rather than simply silently stopping processing, but we
	227	* don't know what the hardware does in this situation.
	228	* This will only happen for buggy guests anyway.
	229	*/
4c0e167c RH	230	if ((bd.buffer1_size & 0xfff) > 2048) {
	231	DEBUGF_BRK("qemu:%s:ERROR...ERROR...ERROR... -- "
	232	"xgmac buffer 1 len on send > 2048 (0x%x)\n",
	233	__func__, bd.buffer1_size & 0xfff);
5519724a	234	break;
4c0e167c RH	235	}
	236	if ((bd.buffer2_size & 0xfff) != 0) {
	237	DEBUGF_BRK("qemu:%s:ERROR...ERROR...ERROR... -- "
	238	"xgmac buffer 2 len on send != 0 (0x%x)\n",
	239	__func__, bd.buffer2_size & 0xfff);
5519724a	240	break;
4c0e167c	241	}
5519724a	242	if (frame_size + len >= sizeof(frame)) {
4c0e167c	243	DEBUGF_BRK("qemu:%s: buffer overflow %d read into %zu "
5519724a	244	"buffer\n" , __func__, frame_size + len, sizeof(frame));
4c0e167c RH	245	DEBUGF_BRK("qemu:%s: buffer1.size=%d; buffer2.size=%d\n",
4c0e167c RH	246	__func__, bd.buffer1_size, bd.buffer2_size);
5519724a	247	break;
4c0e167c RH	248	}
	249
	250	cpu_physical_memory_read(bd.buffer1_addr, ptr, len);
	251	ptr += len;
	252	frame_size += len;
	253	if (bd.ctl_stat & 0x20000000) {
	254	/* Last buffer in frame. */
b356f76d	255	qemu_send_packet(qemu_get_queue(s->nic), frame, len);
4c0e167c RH	256	ptr = frame;
	257	frame_size = 0;
	258	s->regs[DMA_STATUS] \|= DMA_STATUS_TI \| DMA_STATUS_NIS;
	259	}
	260	bd.ctl_stat &= ~0x80000000;
	261	/* Write back the modified descriptor. */
	262	xgmac_write_desc(s, &bd, 0);
	263	}
	264	}
	265
546921ea	266	static void enet_update_irq(XgmacState *s)
4c0e167c RH	267	{
	268	int stat = s->regs[DMA_STATUS] & s->regs[DMA_INTR_ENA];
	269	qemu_set_irq(s->sbd_irq, !!stat);
	270	}
	271
a8170e5e	272	static uint64_t enet_read(void *opaque, hwaddr addr, unsigned size)
4c0e167c	273	{
546921ea	274	XgmacState *s = opaque;
4c0e167c RH	275	uint64_t r = 0;
	276	addr >>= 2;
	277
	278	switch (addr) {
	279	case XGMAC_VERSION:
	280	r = 0x1012;
	281	break;
	282	default:
	283	if (addr < ARRAY_SIZE(s->regs)) {
	284	r = s->regs[addr];
	285	}
	286	break;
	287	}
	288	return r;
	289	}
	290
a8170e5e	291	static void enet_write(void *opaque, hwaddr addr,
4c0e167c RH	292	uint64_t value, unsigned size)
4c0e167c RH	293	{
546921ea	294	XgmacState *s = opaque;
4c0e167c RH	295
	296	addr >>= 2;
	297	switch (addr) {
	298	case DMA_BUS_MODE:
	299	s->regs[DMA_BUS_MODE] = value & ~0x1;
	300	break;
	301	case DMA_XMT_POLL_DEMAND:
	302	xgmac_enet_send(s);
	303	break;
	304	case DMA_STATUS:
	305	s->regs[DMA_STATUS] = s->regs[DMA_STATUS] & ~value;
	306	break;
	307	case DMA_RCV_BASE_ADDR:
	308	s->regs[DMA_RCV_BASE_ADDR] = s->regs[DMA_CUR_RX_DESC_ADDR] = value;
	309	break;
	310	case DMA_TX_BASE_ADDR:
	311	s->regs[DMA_TX_BASE_ADDR] = s->regs[DMA_CUR_TX_DESC_ADDR] = value;
	312	break;
	313	default:
	314	if (addr < ARRAY_SIZE(s->regs)) {
	315	s->regs[addr] = value;
	316	}
	317	break;
	318	}
	319	enet_update_irq(s);
	320	}
	321
	322	static const MemoryRegionOps enet_mem_ops = {
	323	.read = enet_read,
	324	.write = enet_write,
	325	.endianness = DEVICE_LITTLE_ENDIAN,
	326	};
	327
8c8c460c	328	static int eth_can_rx(XgmacState *s)
4c0e167c	329	{
4c0e167c RH	330	/* RX enabled? */
	331	return s->regs[DMA_CONTROL] & DMA_CONTROL_SR;
	332	}
	333
4e68f7a0	334	static ssize_t eth_rx(NetClientState nc, const uint8_t buf, size_t size)
4c0e167c	335	{
546921ea	336	XgmacState *s = qemu_get_nic_opaque(nc);
4c0e167c RH	337	static const unsigned char sa_bcast[6] = {0xff, 0xff, 0xff,
	338	0xff, 0xff, 0xff};
	339	int unicast, broadcast, multicast;
	340	struct desc bd;
	341	ssize_t ret;
	342
8c8c460c FZ	343	if (!eth_can_rx(s)) {
	344	return -1;
	345	}
4c0e167c RH	346	unicast = ~buf[0] & 0x1;
	347	broadcast = memcmp(buf, sa_bcast, 6) == 0;
	348	multicast = !unicast && !broadcast;
	349	if (size < 12) {
	350	s->regs[DMA_STATUS] \|= DMA_STATUS_RI \| DMA_STATUS_NIS;
	351	ret = -1;
	352	goto out;
	353	}
	354
	355	xgmac_read_desc(s, &bd, 1);
	356	if ((bd.ctl_stat & 0x80000000) == 0) {
	357	s->regs[DMA_STATUS] \|= DMA_STATUS_RU \| DMA_STATUS_AIS;
	358	ret = size;
	359	goto out;
	360	}
	361
	362	cpu_physical_memory_write(bd.buffer1_addr, buf, size);
	363
	364	/* Add in the 4 bytes for crc (the real hw returns length incl crc) */
	365	size += 4;
	366	bd.ctl_stat = (size << 16) \| 0x300;
	367	xgmac_write_desc(s, &bd, 1);
	368
	369	s->stats.rx_bytes += size;
	370	s->stats.rx++;
	371	if (multicast) {
	372	s->stats.rx_mcast++;
	373	} else if (broadcast) {
	374	s->stats.rx_bcast++;
	375	}
	376
	377	s->regs[DMA_STATUS] \|= DMA_STATUS_RI \| DMA_STATUS_NIS;
	378	ret = size;
	379
	380	out:
	381	enet_update_irq(s);
	382	return ret;
	383	}
	384
4c0e167c	385	static NetClientInfo net_xgmac_enet_info = {
f394b2e2	386	.type = NET_CLIENT_DRIVER_NIC,
4c0e167c	387	.size = sizeof(NICState),
4c0e167c	388	.receive = eth_rx,
4c0e167c RH	389	};
4c0e167c RH	390
8fa922c2	391	static void xgmac_enet_realize(DeviceState dev, Error *errp)
4c0e167c	392	{
8fa922c2	393	SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
546921ea	394	XgmacState *s = XGMAC(dev);
4c0e167c	395
eedfac6f PB	396	memory_region_init_io(&s->iomem, OBJECT(s), &enet_mem_ops, s,
eedfac6f PB	397	"xgmac", 0x1000);
546921ea AF	398	sysbus_init_mmio(sbd, &s->iomem);
	399	sysbus_init_irq(sbd, &s->sbd_irq);
	400	sysbus_init_irq(sbd, &s->pmt_irq);
	401	sysbus_init_irq(sbd, &s->mci_irq);
4c0e167c RH	402
	403	qemu_macaddr_default_if_unset(&s->conf.macaddr);
	404	s->nic = qemu_new_nic(&net_xgmac_enet_info, &s->conf,
7d0fefdf AO	405	object_get_typename(OBJECT(dev)), dev->id,
7d0fefdf AO	406	&dev->mem_reentrancy_guard, s);
b356f76d	407	qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
4c0e167c RH	408
	409	s->regs[XGMAC_ADDR_HIGH(0)] = (s->conf.macaddr.a[5] << 8) \|
	410	s->conf.macaddr.a[4];
	411	s->regs[XGMAC_ADDR_LOW(0)] = (s->conf.macaddr.a[3] << 24) \|
	412	(s->conf.macaddr.a[2] << 16) \|
	413	(s->conf.macaddr.a[1] << 8) \|
	414	s->conf.macaddr.a[0];
4c0e167c RH	415	}
4c0e167c RH	416
39bffca2	417	static Property xgmac_properties[] = {
546921ea	418	DEFINE_NIC_PROPERTIES(XgmacState, conf),
39bffca2 AL	419	DEFINE_PROP_END_OF_LIST(),
	420	};
	421
999e12bb AL	422	static void xgmac_enet_class_init(ObjectClass klass, void data)
999e12bb AL	423	{
39bffca2	424	DeviceClass *dc = DEVICE_CLASS(klass);
999e12bb	425
8fa922c2	426	dc->realize = xgmac_enet_realize;
39bffca2	427	dc->vmsd = &vmstate_xgmac;
4f67d30b	428	device_class_set_props(dc, xgmac_properties);
999e12bb AL	429	}
999e12bb AL	430
8c43a6f0	431	static const TypeInfo xgmac_enet_info = {
546921ea	432	.name = TYPE_XGMAC,
39bffca2	433	.parent = TYPE_SYS_BUS_DEVICE,
546921ea	434	.instance_size = sizeof(XgmacState),
39bffca2	435	.class_init = xgmac_enet_class_init,
4c0e167c	436	};
39bffca2	437
83f7d43a	438	static void xgmac_enet_register_types(void)
4c0e167c	439	{
39bffca2	440	type_register_static(&xgmac_enet_info);
4c0e167c RH	441	}
4c0e167c RH	442
83f7d43a	443	type_init(xgmac_enet_register_types)