qemu/hw/net/imx_fec.c
<<
>>
Prefs
   1/*
   2 * i.MX Fast Ethernet Controller emulation.
   3 *
   4 * Copyright (c) 2013 Jean-Christophe Dubois. <jcd@tribudubois.net>
   5 *
   6 * Based on Coldfire Fast Ethernet Controller emulation.
   7 *
   8 * Copyright (c) 2007 CodeSourcery.
   9 *
  10 *  This program is free software; you can redistribute it and/or modify it
  11 *  under the terms of the GNU General Public License as published by the
  12 *  Free Software Foundation; either version 2 of the License, or
  13 *  (at your option) any later version.
  14 *
  15 *  This program is distributed in the hope that it will be useful, but WITHOUT
  16 *  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  17 *  FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
  18 *  for more details.
  19 *
  20 *  You should have received a copy of the GNU General Public License along
  21 *  with this program; if not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24#include "qemu/osdep.h"
  25#include "hw/net/imx_fec.h"
  26#include "sysemu/dma.h"
  27#include "qemu/log.h"
  28#include "net/checksum.h"
  29#include "net/eth.h"
  30
  31/* For crc32 */
  32#include <zlib.h>
  33
  34#ifndef DEBUG_IMX_FEC
  35#define DEBUG_IMX_FEC 0
  36#endif
  37
  38#define FEC_PRINTF(fmt, args...) \
  39    do { \
  40        if (DEBUG_IMX_FEC) { \
  41            fprintf(stderr, "[%s]%s: " fmt , TYPE_IMX_FEC, \
  42                                             __func__, ##args); \
  43        } \
  44    } while (0)
  45
  46#ifndef DEBUG_IMX_PHY
  47#define DEBUG_IMX_PHY 0
  48#endif
  49
  50#define PHY_PRINTF(fmt, args...) \
  51    do { \
  52        if (DEBUG_IMX_PHY) { \
  53            fprintf(stderr, "[%s.phy]%s: " fmt , TYPE_IMX_FEC, \
  54                                                 __func__, ##args); \
  55        } \
  56    } while (0)
  57
  58#define IMX_MAX_DESC    1024
  59
  60static const char *imx_default_reg_name(IMXFECState *s, uint32_t index)
  61{
  62    static char tmp[20];
  63    sprintf(tmp, "index %d", index);
  64    return tmp;
  65}
  66
  67static const char *imx_fec_reg_name(IMXFECState *s, uint32_t index)
  68{
  69    switch (index) {
  70    case ENET_FRBR:
  71        return "FRBR";
  72    case ENET_FRSR:
  73        return "FRSR";
  74    case ENET_MIIGSK_CFGR:
  75        return "MIIGSK_CFGR";
  76    case ENET_MIIGSK_ENR:
  77        return "MIIGSK_ENR";
  78    default:
  79        return imx_default_reg_name(s, index);
  80    }
  81}
  82
  83static const char *imx_enet_reg_name(IMXFECState *s, uint32_t index)
  84{
  85    switch (index) {
  86    case ENET_RSFL:
  87        return "RSFL";
  88    case ENET_RSEM:
  89        return "RSEM";
  90    case ENET_RAEM:
  91        return "RAEM";
  92    case ENET_RAFL:
  93        return "RAFL";
  94    case ENET_TSEM:
  95        return "TSEM";
  96    case ENET_TAEM:
  97        return "TAEM";
  98    case ENET_TAFL:
  99        return "TAFL";
 100    case ENET_TIPG:
 101        return "TIPG";
 102    case ENET_FTRL:
 103        return "FTRL";
 104    case ENET_TACC:
 105        return "TACC";
 106    case ENET_RACC:
 107        return "RACC";
 108    case ENET_ATCR:
 109        return "ATCR";
 110    case ENET_ATVR:
 111        return "ATVR";
 112    case ENET_ATOFF:
 113        return "ATOFF";
 114    case ENET_ATPER:
 115        return "ATPER";
 116    case ENET_ATCOR:
 117        return "ATCOR";
 118    case ENET_ATINC:
 119        return "ATINC";
 120    case ENET_ATSTMP:
 121        return "ATSTMP";
 122    case ENET_TGSR:
 123        return "TGSR";
 124    case ENET_TCSR0:
 125        return "TCSR0";
 126    case ENET_TCCR0:
 127        return "TCCR0";
 128    case ENET_TCSR1:
 129        return "TCSR1";
 130    case ENET_TCCR1:
 131        return "TCCR1";
 132    case ENET_TCSR2:
 133        return "TCSR2";
 134    case ENET_TCCR2:
 135        return "TCCR2";
 136    case ENET_TCSR3:
 137        return "TCSR3";
 138    case ENET_TCCR3:
 139        return "TCCR3";
 140    default:
 141        return imx_default_reg_name(s, index);
 142    }
 143}
 144
 145static const char *imx_eth_reg_name(IMXFECState *s, uint32_t index)
 146{
 147    switch (index) {
 148    case ENET_EIR:
 149        return "EIR";
 150    case ENET_EIMR:
 151        return "EIMR";
 152    case ENET_RDAR:
 153        return "RDAR";
 154    case ENET_TDAR:
 155        return "TDAR";
 156    case ENET_ECR:
 157        return "ECR";
 158    case ENET_MMFR:
 159        return "MMFR";
 160    case ENET_MSCR:
 161        return "MSCR";
 162    case ENET_MIBC:
 163        return "MIBC";
 164    case ENET_RCR:
 165        return "RCR";
 166    case ENET_TCR:
 167        return "TCR";
 168    case ENET_PALR:
 169        return "PALR";
 170    case ENET_PAUR:
 171        return "PAUR";
 172    case ENET_OPD:
 173        return "OPD";
 174    case ENET_IAUR:
 175        return "IAUR";
 176    case ENET_IALR:
 177        return "IALR";
 178    case ENET_GAUR:
 179        return "GAUR";
 180    case ENET_GALR:
 181        return "GALR";
 182    case ENET_TFWR:
 183        return "TFWR";
 184    case ENET_RDSR:
 185        return "RDSR";
 186    case ENET_TDSR:
 187        return "TDSR";
 188    case ENET_MRBR:
 189        return "MRBR";
 190    default:
 191        if (s->is_fec) {
 192            return imx_fec_reg_name(s, index);
 193        } else {
 194            return imx_enet_reg_name(s, index);
 195        }
 196    }
 197}
 198
 199static const VMStateDescription vmstate_imx_eth = {
 200    .name = TYPE_IMX_FEC,
 201    .version_id = 2,
 202    .minimum_version_id = 2,
 203    .fields = (VMStateField[]) {
 204        VMSTATE_UINT32_ARRAY(regs, IMXFECState, ENET_MAX),
 205        VMSTATE_UINT32(rx_descriptor, IMXFECState),
 206        VMSTATE_UINT32(tx_descriptor, IMXFECState),
 207
 208        VMSTATE_UINT32(phy_status, IMXFECState),
 209        VMSTATE_UINT32(phy_control, IMXFECState),
 210        VMSTATE_UINT32(phy_advertise, IMXFECState),
 211        VMSTATE_UINT32(phy_int, IMXFECState),
 212        VMSTATE_UINT32(phy_int_mask, IMXFECState),
 213        VMSTATE_END_OF_LIST()
 214    }
 215};
 216
 217#define PHY_INT_ENERGYON            (1 << 7)
 218#define PHY_INT_AUTONEG_COMPLETE    (1 << 6)
 219#define PHY_INT_FAULT               (1 << 5)
 220#define PHY_INT_DOWN                (1 << 4)
 221#define PHY_INT_AUTONEG_LP          (1 << 3)
 222#define PHY_INT_PARFAULT            (1 << 2)
 223#define PHY_INT_AUTONEG_PAGE        (1 << 1)
 224
 225static void imx_eth_update(IMXFECState *s);
 226
 227/*
 228 * The MII phy could raise a GPIO to the processor which in turn
 229 * could be handled as an interrpt by the OS.
 230 * For now we don't handle any GPIO/interrupt line, so the OS will
 231 * have to poll for the PHY status.
 232 */
 233static void phy_update_irq(IMXFECState *s)
 234{
 235    imx_eth_update(s);
 236}
 237
 238static void phy_update_link(IMXFECState *s)
 239{
 240    /* Autonegotiation status mirrors link status.  */
 241    if (qemu_get_queue(s->nic)->link_down) {
 242        PHY_PRINTF("link is down\n");
 243        s->phy_status &= ~0x0024;
 244        s->phy_int |= PHY_INT_DOWN;
 245    } else {
 246        PHY_PRINTF("link is up\n");
 247        s->phy_status |= 0x0024;
 248        s->phy_int |= PHY_INT_ENERGYON;
 249        s->phy_int |= PHY_INT_AUTONEG_COMPLETE;
 250    }
 251    phy_update_irq(s);
 252}
 253
 254static void imx_eth_set_link(NetClientState *nc)
 255{
 256    phy_update_link(IMX_FEC(qemu_get_nic_opaque(nc)));
 257}
 258
 259static void phy_reset(IMXFECState *s)
 260{
 261    s->phy_status = 0x7809;
 262    s->phy_control = 0x3000;
 263    s->phy_advertise = 0x01e1;
 264    s->phy_int_mask = 0;
 265    s->phy_int = 0;
 266    phy_update_link(s);
 267}
 268
 269static uint32_t do_phy_read(IMXFECState *s, int reg)
 270{
 271    uint32_t val;
 272
 273    if (reg > 31) {
 274        /* we only advertise one phy */
 275        return 0;
 276    }
 277
 278    switch (reg) {
 279    case 0:     /* Basic Control */
 280        val = s->phy_control;
 281        break;
 282    case 1:     /* Basic Status */
 283        val = s->phy_status;
 284        break;
 285    case 2:     /* ID1 */
 286        val = 0x0007;
 287        break;
 288    case 3:     /* ID2 */
 289        val = 0xc0d1;
 290        break;
 291    case 4:     /* Auto-neg advertisement */
 292        val = s->phy_advertise;
 293        break;
 294    case 5:     /* Auto-neg Link Partner Ability */
 295        val = 0x0f71;
 296        break;
 297    case 6:     /* Auto-neg Expansion */
 298        val = 1;
 299        break;
 300    case 29:    /* Interrupt source.  */
 301        val = s->phy_int;
 302        s->phy_int = 0;
 303        phy_update_irq(s);
 304        break;
 305    case 30:    /* Interrupt mask */
 306        val = s->phy_int_mask;
 307        break;
 308    case 17:
 309    case 18:
 310    case 27:
 311    case 31:
 312        qemu_log_mask(LOG_UNIMP, "[%s.phy]%s: reg %d not implemented\n",
 313                      TYPE_IMX_FEC, __func__, reg);
 314        val = 0;
 315        break;
 316    default:
 317        qemu_log_mask(LOG_GUEST_ERROR, "[%s.phy]%s: Bad address at offset %d\n",
 318                      TYPE_IMX_FEC, __func__, reg);
 319        val = 0;
 320        break;
 321    }
 322
 323    PHY_PRINTF("read 0x%04x @ %d\n", val, reg);
 324
 325    return val;
 326}
 327
 328static void do_phy_write(IMXFECState *s, int reg, uint32_t val)
 329{
 330    PHY_PRINTF("write 0x%04x @ %d\n", val, reg);
 331
 332    if (reg > 31) {
 333        /* we only advertise one phy */
 334        return;
 335    }
 336
 337    switch (reg) {
 338    case 0:     /* Basic Control */
 339        if (val & 0x8000) {
 340            phy_reset(s);
 341        } else {
 342            s->phy_control = val & 0x7980;
 343            /* Complete autonegotiation immediately.  */
 344            if (val & 0x1000) {
 345                s->phy_status |= 0x0020;
 346            }
 347        }
 348        break;
 349    case 4:     /* Auto-neg advertisement */
 350        s->phy_advertise = (val & 0x2d7f) | 0x80;
 351        break;
 352    case 30:    /* Interrupt mask */
 353        s->phy_int_mask = val & 0xff;
 354        phy_update_irq(s);
 355        break;
 356    case 17:
 357    case 18:
 358    case 27:
 359    case 31:
 360        qemu_log_mask(LOG_UNIMP, "[%s.phy)%s: reg %d not implemented\n",
 361                      TYPE_IMX_FEC, __func__, reg);
 362        break;
 363    default:
 364        qemu_log_mask(LOG_GUEST_ERROR, "[%s.phy]%s: Bad address at offset %d\n",
 365                      TYPE_IMX_FEC, __func__, reg);
 366        break;
 367    }
 368}
 369
 370static void imx_fec_read_bd(IMXFECBufDesc *bd, dma_addr_t addr)
 371{
 372    dma_memory_read(&address_space_memory, addr, bd, sizeof(*bd));
 373}
 374
 375static void imx_fec_write_bd(IMXFECBufDesc *bd, dma_addr_t addr)
 376{
 377    dma_memory_write(&address_space_memory, addr, bd, sizeof(*bd));
 378}
 379
 380static void imx_enet_read_bd(IMXENETBufDesc *bd, dma_addr_t addr)
 381{
 382    dma_memory_read(&address_space_memory, addr, bd, sizeof(*bd));
 383}
 384
 385static void imx_enet_write_bd(IMXENETBufDesc *bd, dma_addr_t addr)
 386{
 387    dma_memory_write(&address_space_memory, addr, bd, sizeof(*bd));
 388}
 389
 390static void imx_eth_update(IMXFECState *s)
 391{
 392    if (s->regs[ENET_EIR] & s->regs[ENET_EIMR] & ENET_INT_TS_TIMER) {
 393        qemu_set_irq(s->irq[1], 1);
 394    } else {
 395        qemu_set_irq(s->irq[1], 0);
 396    }
 397
 398    if (s->regs[ENET_EIR] & s->regs[ENET_EIMR] & ENET_INT_MAC) {
 399        qemu_set_irq(s->irq[0], 1);
 400    } else {
 401        qemu_set_irq(s->irq[0], 0);
 402    }
 403}
 404
 405static void imx_fec_do_tx(IMXFECState *s)
 406{
 407    int frame_size = 0, descnt = 0;
 408    uint8_t frame[ENET_MAX_FRAME_SIZE];
 409    uint8_t *ptr = frame;
 410    uint32_t addr = s->tx_descriptor;
 411
 412    while (descnt++ < IMX_MAX_DESC) {
 413        IMXFECBufDesc bd;
 414        int len;
 415
 416        imx_fec_read_bd(&bd, addr);
 417        FEC_PRINTF("tx_bd %x flags %04x len %d data %08x\n",
 418                   addr, bd.flags, bd.length, bd.data);
 419        if ((bd.flags & ENET_BD_R) == 0) {
 420            /* Run out of descriptors to transmit.  */
 421            FEC_PRINTF("tx_bd ran out of descriptors to transmit\n");
 422            break;
 423        }
 424        len = bd.length;
 425        if (frame_size + len > ENET_MAX_FRAME_SIZE) {
 426            len = ENET_MAX_FRAME_SIZE - frame_size;
 427            s->regs[ENET_EIR] |= ENET_INT_BABT;
 428        }
 429        dma_memory_read(&address_space_memory, bd.data, ptr, len);
 430        ptr += len;
 431        frame_size += len;
 432        if (bd.flags & ENET_BD_L) {
 433            /* Last buffer in frame.  */
 434            qemu_send_packet(qemu_get_queue(s->nic), frame, frame_size);
 435            ptr = frame;
 436            frame_size = 0;
 437            s->regs[ENET_EIR] |= ENET_INT_TXF;
 438        }
 439        s->regs[ENET_EIR] |= ENET_INT_TXB;
 440        bd.flags &= ~ENET_BD_R;
 441        /* Write back the modified descriptor.  */
 442        imx_fec_write_bd(&bd, addr);
 443        /* Advance to the next descriptor.  */
 444        if ((bd.flags & ENET_BD_W) != 0) {
 445            addr = s->regs[ENET_TDSR];
 446        } else {
 447            addr += sizeof(bd);
 448        }
 449    }
 450
 451    s->tx_descriptor = addr;
 452
 453    imx_eth_update(s);
 454}
 455
 456static void imx_enet_do_tx(IMXFECState *s)
 457{
 458    int frame_size = 0, descnt = 0;
 459    uint8_t frame[ENET_MAX_FRAME_SIZE];
 460    uint8_t *ptr = frame;
 461    uint32_t addr = s->tx_descriptor;
 462
 463    while (descnt++ < IMX_MAX_DESC) {
 464        IMXENETBufDesc bd;
 465        int len;
 466
 467        imx_enet_read_bd(&bd, addr);
 468        FEC_PRINTF("tx_bd %x flags %04x len %d data %08x option %04x "
 469                   "status %04x\n", addr, bd.flags, bd.length, bd.data,
 470                   bd.option, bd.status);
 471        if ((bd.flags & ENET_BD_R) == 0) {
 472            /* Run out of descriptors to transmit.  */
 473            break;
 474        }
 475        len = bd.length;
 476        if (frame_size + len > ENET_MAX_FRAME_SIZE) {
 477            len = ENET_MAX_FRAME_SIZE - frame_size;
 478            s->regs[ENET_EIR] |= ENET_INT_BABT;
 479        }
 480        dma_memory_read(&address_space_memory, bd.data, ptr, len);
 481        ptr += len;
 482        frame_size += len;
 483        if (bd.flags & ENET_BD_L) {
 484            if (bd.option & ENET_BD_PINS) {
 485                struct ip_header *ip_hd = PKT_GET_IP_HDR(frame);
 486                if (IP_HEADER_VERSION(ip_hd) == 4) {
 487                    net_checksum_calculate(frame, frame_size);
 488                }
 489            }
 490            if (bd.option & ENET_BD_IINS) {
 491                struct ip_header *ip_hd = PKT_GET_IP_HDR(frame);
 492                /* We compute checksum only for IPv4 frames */
 493                if (IP_HEADER_VERSION(ip_hd) == 4) {
 494                    uint16_t csum;
 495                    ip_hd->ip_sum = 0;
 496                    csum = net_raw_checksum((uint8_t *)ip_hd, sizeof(*ip_hd));
 497                    ip_hd->ip_sum = cpu_to_be16(csum);
 498                }
 499            }
 500            /* Last buffer in frame.  */
 501            qemu_send_packet(qemu_get_queue(s->nic), frame, len);
 502            ptr = frame;
 503            frame_size = 0;
 504            if (bd.option & ENET_BD_TX_INT) {
 505                s->regs[ENET_EIR] |= ENET_INT_TXF;
 506            }
 507        }
 508        if (bd.option & ENET_BD_TX_INT) {
 509            s->regs[ENET_EIR] |= ENET_INT_TXB;
 510        }
 511        bd.flags &= ~ENET_BD_R;
 512        /* Write back the modified descriptor.  */
 513        imx_enet_write_bd(&bd, addr);
 514        /* Advance to the next descriptor.  */
 515        if ((bd.flags & ENET_BD_W) != 0) {
 516            addr = s->regs[ENET_TDSR];
 517        } else {
 518            addr += sizeof(bd);
 519        }
 520    }
 521
 522    s->tx_descriptor = addr;
 523
 524    imx_eth_update(s);
 525}
 526
 527static void imx_eth_do_tx(IMXFECState *s)
 528{
 529    if (!s->is_fec && (s->regs[ENET_ECR] & ENET_ECR_EN1588)) {
 530        imx_enet_do_tx(s);
 531    } else {
 532        imx_fec_do_tx(s);
 533    }
 534}
 535
 536static void imx_eth_enable_rx(IMXFECState *s)
 537{
 538    IMXFECBufDesc bd;
 539    bool tmp;
 540
 541    imx_fec_read_bd(&bd, s->rx_descriptor);
 542
 543    tmp = ((bd.flags & ENET_BD_E) != 0);
 544
 545    if (!tmp) {
 546        FEC_PRINTF("RX buffer full\n");
 547    } else if (!s->regs[ENET_RDAR]) {
 548        qemu_flush_queued_packets(qemu_get_queue(s->nic));
 549    }
 550
 551    s->regs[ENET_RDAR] = tmp ? ENET_RDAR_RDAR : 0;
 552}
 553
 554static void imx_eth_reset(DeviceState *d)
 555{
 556    IMXFECState *s = IMX_FEC(d);
 557
 558    /* Reset the Device */
 559    memset(s->regs, 0, sizeof(s->regs));
 560    s->regs[ENET_ECR]   = 0xf0000000;
 561    s->regs[ENET_MIBC]  = 0xc0000000;
 562    s->regs[ENET_RCR]   = 0x05ee0001;
 563    s->regs[ENET_OPD]   = 0x00010000;
 564
 565    s->regs[ENET_PALR]  = (s->conf.macaddr.a[0] << 24)
 566                          | (s->conf.macaddr.a[1] << 16)
 567                          | (s->conf.macaddr.a[2] << 8)
 568                          | s->conf.macaddr.a[3];
 569    s->regs[ENET_PAUR]  = (s->conf.macaddr.a[4] << 24)
 570                          | (s->conf.macaddr.a[5] << 16)
 571                          | 0x8808;
 572
 573    if (s->is_fec) {
 574        s->regs[ENET_FRBR]  = 0x00000600;
 575        s->regs[ENET_FRSR]  = 0x00000500;
 576        s->regs[ENET_MIIGSK_ENR]  = 0x00000006;
 577    } else {
 578        s->regs[ENET_RAEM]  = 0x00000004;
 579        s->regs[ENET_RAFL]  = 0x00000004;
 580        s->regs[ENET_TAEM]  = 0x00000004;
 581        s->regs[ENET_TAFL]  = 0x00000008;
 582        s->regs[ENET_TIPG]  = 0x0000000c;
 583        s->regs[ENET_FTRL]  = 0x000007ff;
 584        s->regs[ENET_ATPER] = 0x3b9aca00;
 585    }
 586
 587    s->rx_descriptor = 0;
 588    s->tx_descriptor = 0;
 589
 590    /* We also reset the PHY */
 591    phy_reset(s);
 592}
 593
 594static uint32_t imx_default_read(IMXFECState *s, uint32_t index)
 595{
 596    qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Bad register at offset 0x%"
 597                  PRIx32 "\n", TYPE_IMX_FEC, __func__, index * 4);
 598    return 0;
 599}
 600
 601static uint32_t imx_fec_read(IMXFECState *s, uint32_t index)
 602{
 603    switch (index) {
 604    case ENET_FRBR:
 605    case ENET_FRSR:
 606    case ENET_MIIGSK_CFGR:
 607    case ENET_MIIGSK_ENR:
 608        return s->regs[index];
 609    default:
 610        return imx_default_read(s, index);
 611    }
 612}
 613
 614static uint32_t imx_enet_read(IMXFECState *s, uint32_t index)
 615{
 616    switch (index) {
 617    case ENET_RSFL:
 618    case ENET_RSEM:
 619    case ENET_RAEM:
 620    case ENET_RAFL:
 621    case ENET_TSEM:
 622    case ENET_TAEM:
 623    case ENET_TAFL:
 624    case ENET_TIPG:
 625    case ENET_FTRL:
 626    case ENET_TACC:
 627    case ENET_RACC:
 628    case ENET_ATCR:
 629    case ENET_ATVR:
 630    case ENET_ATOFF:
 631    case ENET_ATPER:
 632    case ENET_ATCOR:
 633    case ENET_ATINC:
 634    case ENET_ATSTMP:
 635    case ENET_TGSR:
 636    case ENET_TCSR0:
 637    case ENET_TCCR0:
 638    case ENET_TCSR1:
 639    case ENET_TCCR1:
 640    case ENET_TCSR2:
 641    case ENET_TCCR2:
 642    case ENET_TCSR3:
 643    case ENET_TCCR3:
 644        return s->regs[index];
 645    default:
 646        return imx_default_read(s, index);
 647    }
 648}
 649
 650static uint64_t imx_eth_read(void *opaque, hwaddr offset, unsigned size)
 651{
 652    uint32_t value = 0;
 653    IMXFECState *s = IMX_FEC(opaque);
 654    uint32_t index = offset >> 2;
 655
 656    switch (index) {
 657    case ENET_EIR:
 658    case ENET_EIMR:
 659    case ENET_RDAR:
 660    case ENET_TDAR:
 661    case ENET_ECR:
 662    case ENET_MMFR:
 663    case ENET_MSCR:
 664    case ENET_MIBC:
 665    case ENET_RCR:
 666    case ENET_TCR:
 667    case ENET_PALR:
 668    case ENET_PAUR:
 669    case ENET_OPD:
 670    case ENET_IAUR:
 671    case ENET_IALR:
 672    case ENET_GAUR:
 673    case ENET_GALR:
 674    case ENET_TFWR:
 675    case ENET_RDSR:
 676    case ENET_TDSR:
 677    case ENET_MRBR:
 678        value = s->regs[index];
 679        break;
 680    default:
 681        if (s->is_fec) {
 682            value = imx_fec_read(s, index);
 683        } else {
 684            value = imx_enet_read(s, index);
 685        }
 686        break;
 687    }
 688
 689    FEC_PRINTF("reg[%s] => 0x%" PRIx32 "\n", imx_eth_reg_name(s, index),
 690                                              value);
 691
 692    return value;
 693}
 694
 695static void imx_default_write(IMXFECState *s, uint32_t index, uint32_t value)
 696{
 697    qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Bad address at offset 0x%"
 698                  PRIx32 "\n", TYPE_IMX_FEC, __func__, index * 4);
 699    return;
 700}
 701
 702static void imx_fec_write(IMXFECState *s, uint32_t index, uint32_t value)
 703{
 704    switch (index) {
 705    case ENET_FRBR:
 706        /* FRBR is read only */
 707        qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Register FRBR is read only\n",
 708                      TYPE_IMX_FEC, __func__);
 709        break;
 710    case ENET_FRSR:
 711        s->regs[index] = (value & 0x000003fc) | 0x00000400;
 712        break;
 713    case ENET_MIIGSK_CFGR:
 714        s->regs[index] = value & 0x00000053;
 715        break;
 716    case ENET_MIIGSK_ENR:
 717        s->regs[index] = (value & 0x00000002) ? 0x00000006 : 0;
 718        break;
 719    default:
 720        imx_default_write(s, index, value);
 721        break;
 722    }
 723}
 724
 725static void imx_enet_write(IMXFECState *s, uint32_t index, uint32_t value)
 726{
 727    switch (index) {
 728    case ENET_RSFL:
 729    case ENET_RSEM:
 730    case ENET_RAEM:
 731    case ENET_RAFL:
 732    case ENET_TSEM:
 733    case ENET_TAEM:
 734    case ENET_TAFL:
 735        s->regs[index] = value & 0x000001ff;
 736        break;
 737    case ENET_TIPG:
 738        s->regs[index] = value & 0x0000001f;
 739        break;
 740    case ENET_FTRL:
 741        s->regs[index] = value & 0x00003fff;
 742        break;
 743    case ENET_TACC:
 744        s->regs[index] = value & 0x00000019;
 745        break;
 746    case ENET_RACC:
 747        s->regs[index] = value & 0x000000C7;
 748        break;
 749    case ENET_ATCR:
 750        s->regs[index] = value & 0x00002a9d;
 751        break;
 752    case ENET_ATVR:
 753    case ENET_ATOFF:
 754    case ENET_ATPER:
 755        s->regs[index] = value;
 756        break;
 757    case ENET_ATSTMP:
 758        /* ATSTMP is read only */
 759        qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Register ATSTMP is read only\n",
 760                      TYPE_IMX_FEC, __func__);
 761        break;
 762    case ENET_ATCOR:
 763        s->regs[index] = value & 0x7fffffff;
 764        break;
 765    case ENET_ATINC:
 766        s->regs[index] = value & 0x00007f7f;
 767        break;
 768    case ENET_TGSR:
 769        /* implement clear timer flag */
 770        value = value & 0x0000000f;
 771        break;
 772    case ENET_TCSR0:
 773    case ENET_TCSR1:
 774    case ENET_TCSR2:
 775    case ENET_TCSR3:
 776        value = value & 0x000000fd;
 777        break;
 778    case ENET_TCCR0:
 779    case ENET_TCCR1:
 780    case ENET_TCCR2:
 781    case ENET_TCCR3:
 782        s->regs[index] = value;
 783        break;
 784    default:
 785        imx_default_write(s, index, value);
 786        break;
 787    }
 788}
 789
 790static void imx_eth_write(void *opaque, hwaddr offset, uint64_t value,
 791                           unsigned size)
 792{
 793    IMXFECState *s = IMX_FEC(opaque);
 794    uint32_t index = offset >> 2;
 795
 796    FEC_PRINTF("reg[%s] <= 0x%" PRIx32 "\n", imx_eth_reg_name(s, index),
 797                (uint32_t)value);
 798
 799    switch (index) {
 800    case ENET_EIR:
 801        s->regs[index] &= ~value;
 802        break;
 803    case ENET_EIMR:
 804        s->regs[index] = value;
 805        break;
 806    case ENET_RDAR:
 807        if (s->regs[ENET_ECR] & ENET_ECR_ETHEREN) {
 808            if (!s->regs[index]) {
 809                s->regs[index] = ENET_RDAR_RDAR;
 810                imx_eth_enable_rx(s);
 811            }
 812        } else {
 813            s->regs[index] = 0;
 814        }
 815        break;
 816    case ENET_TDAR:
 817        if (s->regs[ENET_ECR] & ENET_ECR_ETHEREN) {
 818            s->regs[index] = ENET_TDAR_TDAR;
 819            imx_eth_do_tx(s);
 820        }
 821        s->regs[index] = 0;
 822        break;
 823    case ENET_ECR:
 824        if (value & ENET_ECR_RESET) {
 825            return imx_eth_reset(DEVICE(s));
 826        }
 827        s->regs[index] = value;
 828        if ((s->regs[index] & ENET_ECR_ETHEREN) == 0) {
 829            s->regs[ENET_RDAR] = 0;
 830            s->rx_descriptor = s->regs[ENET_RDSR];
 831            s->regs[ENET_TDAR] = 0;
 832            s->tx_descriptor = s->regs[ENET_TDSR];
 833        }
 834        break;
 835    case ENET_MMFR:
 836        s->regs[index] = value;
 837        if (extract32(value, 29, 1)) {
 838            /* This is a read operation */
 839            s->regs[ENET_MMFR] = deposit32(s->regs[ENET_MMFR], 0, 16,
 840                                           do_phy_read(s,
 841                                                       extract32(value,
 842                                                                 18, 10)));
 843        } else {
 844            /* This a write operation */
 845            do_phy_write(s, extract32(value, 18, 10), extract32(value, 0, 16));
 846        }
 847        /* raise the interrupt as the PHY operation is done */
 848        s->regs[ENET_EIR] |= ENET_INT_MII;
 849        break;
 850    case ENET_MSCR:
 851        s->regs[index] = value & 0xfe;
 852        break;
 853    case ENET_MIBC:
 854        /* TODO: Implement MIB.  */
 855        s->regs[index] = (value & 0x80000000) ? 0xc0000000 : 0;
 856        break;
 857    case ENET_RCR:
 858        s->regs[index] = value & 0x07ff003f;
 859        /* TODO: Implement LOOP mode.  */
 860        break;
 861    case ENET_TCR:
 862        /* We transmit immediately, so raise GRA immediately.  */
 863        s->regs[index] = value;
 864        if (value & 1) {
 865            s->regs[ENET_EIR] |= ENET_INT_GRA;
 866        }
 867        break;
 868    case ENET_PALR:
 869        s->regs[index] = value;
 870        s->conf.macaddr.a[0] = value >> 24;
 871        s->conf.macaddr.a[1] = value >> 16;
 872        s->conf.macaddr.a[2] = value >> 8;
 873        s->conf.macaddr.a[3] = value;
 874        break;
 875    case ENET_PAUR:
 876        s->regs[index] = (value | 0x0000ffff) & 0xffff8808;
 877        s->conf.macaddr.a[4] = value >> 24;
 878        s->conf.macaddr.a[5] = value >> 16;
 879        break;
 880    case ENET_OPD:
 881        s->regs[index] = (value & 0x0000ffff) | 0x00010000;
 882        break;
 883    case ENET_IAUR:
 884    case ENET_IALR:
 885    case ENET_GAUR:
 886    case ENET_GALR:
 887        /* TODO: implement MAC hash filtering.  */
 888        break;
 889    case ENET_TFWR:
 890        if (s->is_fec) {
 891            s->regs[index] = value & 0x3;
 892        } else {
 893            s->regs[index] = value & 0x13f;
 894        }
 895        break;
 896    case ENET_RDSR:
 897        if (s->is_fec) {
 898            s->regs[index] = value & ~3;
 899        } else {
 900            s->regs[index] = value & ~7;
 901        }
 902        s->rx_descriptor = s->regs[index];
 903        break;
 904    case ENET_TDSR:
 905        if (s->is_fec) {
 906            s->regs[index] = value & ~3;
 907        } else {
 908            s->regs[index] = value & ~7;
 909        }
 910        s->tx_descriptor = s->regs[index];
 911        break;
 912    case ENET_MRBR:
 913        s->regs[index] = value & 0x00003ff0;
 914        break;
 915    default:
 916        if (s->is_fec) {
 917            imx_fec_write(s, index, value);
 918        } else {
 919            imx_enet_write(s, index, value);
 920        }
 921        return;
 922    }
 923
 924    imx_eth_update(s);
 925}
 926
 927static int imx_eth_can_receive(NetClientState *nc)
 928{
 929    IMXFECState *s = IMX_FEC(qemu_get_nic_opaque(nc));
 930
 931    FEC_PRINTF("\n");
 932
 933    return s->regs[ENET_RDAR] ? 1 : 0;
 934}
 935
 936static ssize_t imx_fec_receive(NetClientState *nc, const uint8_t *buf,
 937                               size_t len)
 938{
 939    IMXFECState *s = IMX_FEC(qemu_get_nic_opaque(nc));
 940    IMXFECBufDesc bd;
 941    uint32_t flags = 0;
 942    uint32_t addr;
 943    uint32_t crc;
 944    uint32_t buf_addr;
 945    uint8_t *crc_ptr;
 946    unsigned int buf_len;
 947    size_t size = len;
 948
 949    FEC_PRINTF("len %d\n", (int)size);
 950
 951    if (!s->regs[ENET_RDAR]) {
 952        qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Unexpected packet\n",
 953                      TYPE_IMX_FEC, __func__);
 954        return 0;
 955    }
 956
 957    /* 4 bytes for the CRC.  */
 958    size += 4;
 959    crc = cpu_to_be32(crc32(~0, buf, size));
 960    crc_ptr = (uint8_t *) &crc;
 961
 962    /* Huge frames are truncated.  */
 963    if (size > ENET_MAX_FRAME_SIZE) {
 964        size = ENET_MAX_FRAME_SIZE;
 965        flags |= ENET_BD_TR | ENET_BD_LG;
 966    }
 967
 968    /* Frames larger than the user limit just set error flags.  */
 969    if (size > (s->regs[ENET_RCR] >> 16)) {
 970        flags |= ENET_BD_LG;
 971    }
 972
 973    addr = s->rx_descriptor;
 974    while (size > 0) {
 975        imx_fec_read_bd(&bd, addr);
 976        if ((bd.flags & ENET_BD_E) == 0) {
 977            /* No descriptors available.  Bail out.  */
 978            /*
 979             * FIXME: This is wrong. We should probably either
 980             * save the remainder for when more RX buffers are
 981             * available, or flag an error.
 982             */
 983            qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Lost end of frame\n",
 984                          TYPE_IMX_FEC, __func__);
 985            break;
 986        }
 987        buf_len = (size <= s->regs[ENET_MRBR]) ? size : s->regs[ENET_MRBR];
 988        bd.length = buf_len;
 989        size -= buf_len;
 990
 991        FEC_PRINTF("rx_bd 0x%x length %d\n", addr, bd.length);
 992
 993        /* The last 4 bytes are the CRC.  */
 994        if (size < 4) {
 995            buf_len += size - 4;
 996        }
 997        buf_addr = bd.data;
 998        dma_memory_write(&address_space_memory, buf_addr, buf, buf_len);
 999        buf += buf_len;
1000        if (size < 4) {
1001            dma_memory_write(&address_space_memory, buf_addr + buf_len,
1002                             crc_ptr, 4 - size);
1003            crc_ptr += 4 - size;
1004        }
1005        bd.flags &= ~ENET_BD_E;
1006        if (size == 0) {
1007            /* Last buffer in frame.  */
1008            bd.flags |= flags | ENET_BD_L;
1009            FEC_PRINTF("rx frame flags %04x\n", bd.flags);
1010            s->regs[ENET_EIR] |= ENET_INT_RXF;
1011        } else {
1012            s->regs[ENET_EIR] |= ENET_INT_RXB;
1013        }
1014        imx_fec_write_bd(&bd, addr);
1015        /* Advance to the next descriptor.  */
1016        if ((bd.flags & ENET_BD_W) != 0) {
1017            addr = s->regs[ENET_RDSR];
1018        } else {
1019            addr += sizeof(bd);
1020        }
1021    }
1022    s->rx_descriptor = addr;
1023    imx_eth_enable_rx(s);
1024    imx_eth_update(s);
1025    return len;
1026}
1027
1028static ssize_t imx_enet_receive(NetClientState *nc, const uint8_t *buf,
1029                                size_t len)
1030{
1031    IMXFECState *s = IMX_FEC(qemu_get_nic_opaque(nc));
1032    IMXENETBufDesc bd;
1033    uint32_t flags = 0;
1034    uint32_t addr;
1035    uint32_t crc;
1036    uint32_t buf_addr;
1037    uint8_t *crc_ptr;
1038    unsigned int buf_len;
1039    size_t size = len;
1040
1041    FEC_PRINTF("len %d\n", (int)size);
1042
1043    if (!s->regs[ENET_RDAR]) {
1044        qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Unexpected packet\n",
1045                      TYPE_IMX_FEC, __func__);
1046        return 0;
1047    }
1048
1049    /* 4 bytes for the CRC.  */
1050    size += 4;
1051    crc = cpu_to_be32(crc32(~0, buf, size));
1052    crc_ptr = (uint8_t *) &crc;
1053
1054    /* Huge frames are truncted.  */
1055    if (size > ENET_MAX_FRAME_SIZE) {
1056        size = ENET_MAX_FRAME_SIZE;
1057        flags |= ENET_BD_TR | ENET_BD_LG;
1058    }
1059
1060    /* Frames larger than the user limit just set error flags.  */
1061    if (size > (s->regs[ENET_RCR] >> 16)) {
1062        flags |= ENET_BD_LG;
1063    }
1064
1065    addr = s->rx_descriptor;
1066    while (size > 0) {
1067        imx_enet_read_bd(&bd, addr);
1068        if ((bd.flags & ENET_BD_E) == 0) {
1069            /* No descriptors available.  Bail out.  */
1070            /*
1071             * FIXME: This is wrong. We should probably either
1072             * save the remainder for when more RX buffers are
1073             * available, or flag an error.
1074             */
1075            qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Lost end of frame\n",
1076                          TYPE_IMX_FEC, __func__);
1077            break;
1078        }
1079        buf_len = (size <= s->regs[ENET_MRBR]) ? size : s->regs[ENET_MRBR];
1080        bd.length = buf_len;
1081        size -= buf_len;
1082
1083        FEC_PRINTF("rx_bd 0x%x length %d\n", addr, bd.length);
1084
1085        /* The last 4 bytes are the CRC.  */
1086        if (size < 4) {
1087            buf_len += size - 4;
1088        }
1089        buf_addr = bd.data;
1090        dma_memory_write(&address_space_memory, buf_addr, buf, buf_len);
1091        buf += buf_len;
1092        if (size < 4) {
1093            dma_memory_write(&address_space_memory, buf_addr + buf_len,
1094                             crc_ptr, 4 - size);
1095            crc_ptr += 4 - size;
1096        }
1097        bd.flags &= ~ENET_BD_E;
1098        if (size == 0) {
1099            /* Last buffer in frame.  */
1100            bd.flags |= flags | ENET_BD_L;
1101            FEC_PRINTF("rx frame flags %04x\n", bd.flags);
1102            if (bd.option & ENET_BD_RX_INT) {
1103                s->regs[ENET_EIR] |= ENET_INT_RXF;
1104            }
1105        } else {
1106            if (bd.option & ENET_BD_RX_INT) {
1107                s->regs[ENET_EIR] |= ENET_INT_RXB;
1108            }
1109        }
1110        imx_enet_write_bd(&bd, addr);
1111        /* Advance to the next descriptor.  */
1112        if ((bd.flags & ENET_BD_W) != 0) {
1113            addr = s->regs[ENET_RDSR];
1114        } else {
1115            addr += sizeof(bd);
1116        }
1117    }
1118    s->rx_descriptor = addr;
1119    imx_eth_enable_rx(s);
1120    imx_eth_update(s);
1121    return len;
1122}
1123
1124static ssize_t imx_eth_receive(NetClientState *nc, const uint8_t *buf,
1125                                size_t len)
1126{
1127    IMXFECState *s = IMX_FEC(qemu_get_nic_opaque(nc));
1128
1129    if (!s->is_fec && (s->regs[ENET_ECR] & ENET_ECR_EN1588)) {
1130        return imx_enet_receive(nc, buf, len);
1131    } else {
1132        return imx_fec_receive(nc, buf, len);
1133    }
1134}
1135
1136static const MemoryRegionOps imx_eth_ops = {
1137    .read                  = imx_eth_read,
1138    .write                 = imx_eth_write,
1139    .valid.min_access_size = 4,
1140    .valid.max_access_size = 4,
1141    .endianness            = DEVICE_NATIVE_ENDIAN,
1142};
1143
1144static void imx_eth_cleanup(NetClientState *nc)
1145{
1146    IMXFECState *s = IMX_FEC(qemu_get_nic_opaque(nc));
1147
1148    s->nic = NULL;
1149}
1150
1151static NetClientInfo imx_eth_net_info = {
1152    .type                = NET_CLIENT_DRIVER_NIC,
1153    .size                = sizeof(NICState),
1154    .can_receive         = imx_eth_can_receive,
1155    .receive             = imx_eth_receive,
1156    .cleanup             = imx_eth_cleanup,
1157    .link_status_changed = imx_eth_set_link,
1158};
1159
1160
1161static void imx_eth_realize(DeviceState *dev, Error **errp)
1162{
1163    IMXFECState *s = IMX_FEC(dev);
1164    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1165
1166    memory_region_init_io(&s->iomem, OBJECT(dev), &imx_eth_ops, s,
1167                          TYPE_IMX_FEC, 0x400);
1168    sysbus_init_mmio(sbd, &s->iomem);
1169    sysbus_init_irq(sbd, &s->irq[0]);
1170    sysbus_init_irq(sbd, &s->irq[1]);
1171
1172    qemu_macaddr_default_if_unset(&s->conf.macaddr);
1173
1174    s->conf.peers.ncs[0] = nd_table[0].netdev;
1175
1176    s->nic = qemu_new_nic(&imx_eth_net_info, &s->conf,
1177                          object_get_typename(OBJECT(dev)),
1178                          DEVICE(dev)->id, s);
1179
1180    qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
1181}
1182
1183static Property imx_eth_properties[] = {
1184    DEFINE_NIC_PROPERTIES(IMXFECState, conf),
1185    DEFINE_PROP_END_OF_LIST(),
1186};
1187
1188static void imx_eth_class_init(ObjectClass *klass, void *data)
1189{
1190    DeviceClass *dc = DEVICE_CLASS(klass);
1191
1192    dc->vmsd    = &vmstate_imx_eth;
1193    dc->reset   = imx_eth_reset;
1194    dc->props   = imx_eth_properties;
1195    dc->realize = imx_eth_realize;
1196    dc->desc    = "i.MX FEC/ENET Ethernet Controller";
1197}
1198
1199static void imx_fec_init(Object *obj)
1200{
1201    IMXFECState *s = IMX_FEC(obj);
1202
1203    s->is_fec = true;
1204}
1205
1206static void imx_enet_init(Object *obj)
1207{
1208    IMXFECState *s = IMX_FEC(obj);
1209
1210    s->is_fec = false;
1211}
1212
1213static const TypeInfo imx_fec_info = {
1214    .name          = TYPE_IMX_FEC,
1215    .parent        = TYPE_SYS_BUS_DEVICE,
1216    .instance_size = sizeof(IMXFECState),
1217    .instance_init = imx_fec_init,
1218    .class_init    = imx_eth_class_init,
1219};
1220
1221static const TypeInfo imx_enet_info = {
1222    .name          = TYPE_IMX_ENET,
1223    .parent        = TYPE_IMX_FEC,
1224    .instance_init = imx_enet_init,
1225};
1226
1227static void imx_eth_register_types(void)
1228{
1229    type_register_static(&imx_fec_info);
1230    type_register_static(&imx_enet_info);
1231}
1232
1233type_init(imx_eth_register_types)
1234