qemu/hw/net/imx_fec.c
<<
>>
Prefs
   1/*
   2 * i.MX Fast Ethernet Controller emulation.
   3 *
   4 * Copyright (c) 2013 Jean-Christophe Dubois. <jcd@tribudubois.net>
   5 *
   6 * Based on Coldfire Fast Ethernet Controller emulation.
   7 *
   8 * Copyright (c) 2007 CodeSourcery.
   9 *
  10 *  This program is free software; you can redistribute it and/or modify it
  11 *  under the terms of the GNU General Public License as published by the
  12 *  Free Software Foundation; either version 2 of the License, or
  13 *  (at your option) any later version.
  14 *
  15 *  This program is distributed in the hope that it will be useful, but WITHOUT
  16 *  ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
  17 *  FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
  18 *  for more details.
  19 *
  20 *  You should have received a copy of the GNU General Public License along
  21 *  with this program; if not, see <http://www.gnu.org/licenses/>.
  22 */
  23
  24#include "qemu/osdep.h"
  25#include "hw/net/imx_fec.h"
  26#include "sysemu/dma.h"
  27#include "qemu/log.h"
  28#include "net/checksum.h"
  29#include "net/eth.h"
  30
  31/* For crc32 */
  32#include <zlib.h>
  33
  34#ifndef DEBUG_IMX_FEC
  35#define DEBUG_IMX_FEC 0
  36#endif
  37
  38#define FEC_PRINTF(fmt, args...) \
  39    do { \
  40        if (DEBUG_IMX_FEC) { \
  41            fprintf(stderr, "[%s]%s: " fmt , TYPE_IMX_FEC, \
  42                                             __func__, ##args); \
  43        } \
  44    } while (0)
  45
  46#ifndef DEBUG_IMX_PHY
  47#define DEBUG_IMX_PHY 0
  48#endif
  49
  50#define PHY_PRINTF(fmt, args...) \
  51    do { \
  52        if (DEBUG_IMX_PHY) { \
  53            fprintf(stderr, "[%s.phy]%s: " fmt , TYPE_IMX_FEC, \
  54                                                 __func__, ##args); \
  55        } \
  56    } while (0)
  57
  58static const char *imx_default_reg_name(IMXFECState *s, uint32_t index)
  59{
  60    static char tmp[20];
  61    sprintf(tmp, "index %d", index);
  62    return tmp;
  63}
  64
  65static const char *imx_fec_reg_name(IMXFECState *s, uint32_t index)
  66{
  67    switch (index) {
  68    case ENET_FRBR:
  69        return "FRBR";
  70    case ENET_FRSR:
  71        return "FRSR";
  72    case ENET_MIIGSK_CFGR:
  73        return "MIIGSK_CFGR";
  74    case ENET_MIIGSK_ENR:
  75        return "MIIGSK_ENR";
  76    default:
  77        return imx_default_reg_name(s, index);
  78    }
  79}
  80
  81static const char *imx_enet_reg_name(IMXFECState *s, uint32_t index)
  82{
  83    switch (index) {
  84    case ENET_RSFL:
  85        return "RSFL";
  86    case ENET_RSEM:
  87        return "RSEM";
  88    case ENET_RAEM:
  89        return "RAEM";
  90    case ENET_RAFL:
  91        return "RAFL";
  92    case ENET_TSEM:
  93        return "TSEM";
  94    case ENET_TAEM:
  95        return "TAEM";
  96    case ENET_TAFL:
  97        return "TAFL";
  98    case ENET_TIPG:
  99        return "TIPG";
 100    case ENET_FTRL:
 101        return "FTRL";
 102    case ENET_TACC:
 103        return "TACC";
 104    case ENET_RACC:
 105        return "RACC";
 106    case ENET_ATCR:
 107        return "ATCR";
 108    case ENET_ATVR:
 109        return "ATVR";
 110    case ENET_ATOFF:
 111        return "ATOFF";
 112    case ENET_ATPER:
 113        return "ATPER";
 114    case ENET_ATCOR:
 115        return "ATCOR";
 116    case ENET_ATINC:
 117        return "ATINC";
 118    case ENET_ATSTMP:
 119        return "ATSTMP";
 120    case ENET_TGSR:
 121        return "TGSR";
 122    case ENET_TCSR0:
 123        return "TCSR0";
 124    case ENET_TCCR0:
 125        return "TCCR0";
 126    case ENET_TCSR1:
 127        return "TCSR1";
 128    case ENET_TCCR1:
 129        return "TCCR1";
 130    case ENET_TCSR2:
 131        return "TCSR2";
 132    case ENET_TCCR2:
 133        return "TCCR2";
 134    case ENET_TCSR3:
 135        return "TCSR3";
 136    case ENET_TCCR3:
 137        return "TCCR3";
 138    default:
 139        return imx_default_reg_name(s, index);
 140    }
 141}
 142
 143static const char *imx_eth_reg_name(IMXFECState *s, uint32_t index)
 144{
 145    switch (index) {
 146    case ENET_EIR:
 147        return "EIR";
 148    case ENET_EIMR:
 149        return "EIMR";
 150    case ENET_RDAR:
 151        return "RDAR";
 152    case ENET_TDAR:
 153        return "TDAR";
 154    case ENET_ECR:
 155        return "ECR";
 156    case ENET_MMFR:
 157        return "MMFR";
 158    case ENET_MSCR:
 159        return "MSCR";
 160    case ENET_MIBC:
 161        return "MIBC";
 162    case ENET_RCR:
 163        return "RCR";
 164    case ENET_TCR:
 165        return "TCR";
 166    case ENET_PALR:
 167        return "PALR";
 168    case ENET_PAUR:
 169        return "PAUR";
 170    case ENET_OPD:
 171        return "OPD";
 172    case ENET_IAUR:
 173        return "IAUR";
 174    case ENET_IALR:
 175        return "IALR";
 176    case ENET_GAUR:
 177        return "GAUR";
 178    case ENET_GALR:
 179        return "GALR";
 180    case ENET_TFWR:
 181        return "TFWR";
 182    case ENET_RDSR:
 183        return "RDSR";
 184    case ENET_TDSR:
 185        return "TDSR";
 186    case ENET_MRBR:
 187        return "MRBR";
 188    default:
 189        if (s->is_fec) {
 190            return imx_fec_reg_name(s, index);
 191        } else {
 192            return imx_enet_reg_name(s, index);
 193        }
 194    }
 195}
 196
 197static const VMStateDescription vmstate_imx_eth = {
 198    .name = TYPE_IMX_FEC,
 199    .version_id = 2,
 200    .minimum_version_id = 2,
 201    .fields = (VMStateField[]) {
 202        VMSTATE_UINT32_ARRAY(regs, IMXFECState, ENET_MAX),
 203        VMSTATE_UINT32(rx_descriptor, IMXFECState),
 204        VMSTATE_UINT32(tx_descriptor, IMXFECState),
 205
 206        VMSTATE_UINT32(phy_status, IMXFECState),
 207        VMSTATE_UINT32(phy_control, IMXFECState),
 208        VMSTATE_UINT32(phy_advertise, IMXFECState),
 209        VMSTATE_UINT32(phy_int, IMXFECState),
 210        VMSTATE_UINT32(phy_int_mask, IMXFECState),
 211        VMSTATE_END_OF_LIST()
 212    }
 213};
 214
 215#define PHY_INT_ENERGYON            (1 << 7)
 216#define PHY_INT_AUTONEG_COMPLETE    (1 << 6)
 217#define PHY_INT_FAULT               (1 << 5)
 218#define PHY_INT_DOWN                (1 << 4)
 219#define PHY_INT_AUTONEG_LP          (1 << 3)
 220#define PHY_INT_PARFAULT            (1 << 2)
 221#define PHY_INT_AUTONEG_PAGE        (1 << 1)
 222
 223static void imx_eth_update(IMXFECState *s);
 224
 225/*
 226 * The MII phy could raise a GPIO to the processor which in turn
 227 * could be handled as an interrpt by the OS.
 228 * For now we don't handle any GPIO/interrupt line, so the OS will
 229 * have to poll for the PHY status.
 230 */
 231static void phy_update_irq(IMXFECState *s)
 232{
 233    imx_eth_update(s);
 234}
 235
 236static void phy_update_link(IMXFECState *s)
 237{
 238    /* Autonegotiation status mirrors link status.  */
 239    if (qemu_get_queue(s->nic)->link_down) {
 240        PHY_PRINTF("link is down\n");
 241        s->phy_status &= ~0x0024;
 242        s->phy_int |= PHY_INT_DOWN;
 243    } else {
 244        PHY_PRINTF("link is up\n");
 245        s->phy_status |= 0x0024;
 246        s->phy_int |= PHY_INT_ENERGYON;
 247        s->phy_int |= PHY_INT_AUTONEG_COMPLETE;
 248    }
 249    phy_update_irq(s);
 250}
 251
 252static void imx_eth_set_link(NetClientState *nc)
 253{
 254    phy_update_link(IMX_FEC(qemu_get_nic_opaque(nc)));
 255}
 256
 257static void phy_reset(IMXFECState *s)
 258{
 259    s->phy_status = 0x7809;
 260    s->phy_control = 0x3000;
 261    s->phy_advertise = 0x01e1;
 262    s->phy_int_mask = 0;
 263    s->phy_int = 0;
 264    phy_update_link(s);
 265}
 266
 267static uint32_t do_phy_read(IMXFECState *s, int reg)
 268{
 269    uint32_t val;
 270
 271    if (reg > 31) {
 272        /* we only advertise one phy */
 273        return 0;
 274    }
 275
 276    switch (reg) {
 277    case 0:     /* Basic Control */
 278        val = s->phy_control;
 279        break;
 280    case 1:     /* Basic Status */
 281        val = s->phy_status;
 282        break;
 283    case 2:     /* ID1 */
 284        val = 0x0007;
 285        break;
 286    case 3:     /* ID2 */
 287        val = 0xc0d1;
 288        break;
 289    case 4:     /* Auto-neg advertisement */
 290        val = s->phy_advertise;
 291        break;
 292    case 5:     /* Auto-neg Link Partner Ability */
 293        val = 0x0f71;
 294        break;
 295    case 6:     /* Auto-neg Expansion */
 296        val = 1;
 297        break;
 298    case 29:    /* Interrupt source.  */
 299        val = s->phy_int;
 300        s->phy_int = 0;
 301        phy_update_irq(s);
 302        break;
 303    case 30:    /* Interrupt mask */
 304        val = s->phy_int_mask;
 305        break;
 306    case 17:
 307    case 18:
 308    case 27:
 309    case 31:
 310        qemu_log_mask(LOG_UNIMP, "[%s.phy]%s: reg %d not implemented\n",
 311                      TYPE_IMX_FEC, __func__, reg);
 312        val = 0;
 313        break;
 314    default:
 315        qemu_log_mask(LOG_GUEST_ERROR, "[%s.phy]%s: Bad address at offset %d\n",
 316                      TYPE_IMX_FEC, __func__, reg);
 317        val = 0;
 318        break;
 319    }
 320
 321    PHY_PRINTF("read 0x%04x @ %d\n", val, reg);
 322
 323    return val;
 324}
 325
 326static void do_phy_write(IMXFECState *s, int reg, uint32_t val)
 327{
 328    PHY_PRINTF("write 0x%04x @ %d\n", val, reg);
 329
 330    if (reg > 31) {
 331        /* we only advertise one phy */
 332        return;
 333    }
 334
 335    switch (reg) {
 336    case 0:     /* Basic Control */
 337        if (val & 0x8000) {
 338            phy_reset(s);
 339        } else {
 340            s->phy_control = val & 0x7980;
 341            /* Complete autonegotiation immediately.  */
 342            if (val & 0x1000) {
 343                s->phy_status |= 0x0020;
 344            }
 345        }
 346        break;
 347    case 4:     /* Auto-neg advertisement */
 348        s->phy_advertise = (val & 0x2d7f) | 0x80;
 349        break;
 350    case 30:    /* Interrupt mask */
 351        s->phy_int_mask = val & 0xff;
 352        phy_update_irq(s);
 353        break;
 354    case 17:
 355    case 18:
 356    case 27:
 357    case 31:
 358        qemu_log_mask(LOG_UNIMP, "[%s.phy)%s: reg %d not implemented\n",
 359                      TYPE_IMX_FEC, __func__, reg);
 360        break;
 361    default:
 362        qemu_log_mask(LOG_GUEST_ERROR, "[%s.phy]%s: Bad address at offset %d\n",
 363                      TYPE_IMX_FEC, __func__, reg);
 364        break;
 365    }
 366}
 367
 368static void imx_fec_read_bd(IMXFECBufDesc *bd, dma_addr_t addr)
 369{
 370    dma_memory_read(&address_space_memory, addr, bd, sizeof(*bd));
 371}
 372
 373static void imx_fec_write_bd(IMXFECBufDesc *bd, dma_addr_t addr)
 374{
 375    dma_memory_write(&address_space_memory, addr, bd, sizeof(*bd));
 376}
 377
 378static void imx_enet_read_bd(IMXENETBufDesc *bd, dma_addr_t addr)
 379{
 380    dma_memory_read(&address_space_memory, addr, bd, sizeof(*bd));
 381}
 382
 383static void imx_enet_write_bd(IMXENETBufDesc *bd, dma_addr_t addr)
 384{
 385    dma_memory_write(&address_space_memory, addr, bd, sizeof(*bd));
 386}
 387
 388static void imx_eth_update(IMXFECState *s)
 389{
 390    if (s->regs[ENET_EIR] & s->regs[ENET_EIMR] & ENET_INT_TS_TIMER) {
 391        qemu_set_irq(s->irq[1], 1);
 392    } else {
 393        qemu_set_irq(s->irq[1], 0);
 394    }
 395
 396    if (s->regs[ENET_EIR] & s->regs[ENET_EIMR] & ENET_INT_MAC) {
 397        qemu_set_irq(s->irq[0], 1);
 398    } else {
 399        qemu_set_irq(s->irq[0], 0);
 400    }
 401}
 402
 403static void imx_fec_do_tx(IMXFECState *s)
 404{
 405    int frame_size = 0;
 406    uint8_t frame[ENET_MAX_FRAME_SIZE];
 407    uint8_t *ptr = frame;
 408    uint32_t addr = s->tx_descriptor;
 409
 410    while (1) {
 411        IMXFECBufDesc bd;
 412        int len;
 413
 414        imx_fec_read_bd(&bd, addr);
 415        FEC_PRINTF("tx_bd %x flags %04x len %d data %08x\n",
 416                   addr, bd.flags, bd.length, bd.data);
 417        if ((bd.flags & ENET_BD_R) == 0) {
 418            /* Run out of descriptors to transmit.  */
 419            FEC_PRINTF("tx_bd ran out of descriptors to transmit\n");
 420            break;
 421        }
 422        len = bd.length;
 423        if (frame_size + len > ENET_MAX_FRAME_SIZE) {
 424            len = ENET_MAX_FRAME_SIZE - frame_size;
 425            s->regs[ENET_EIR] |= ENET_INT_BABT;
 426        }
 427        dma_memory_read(&address_space_memory, bd.data, ptr, len);
 428        ptr += len;
 429        frame_size += len;
 430        if (bd.flags & ENET_BD_L) {
 431            /* Last buffer in frame.  */
 432            qemu_send_packet(qemu_get_queue(s->nic), frame, frame_size);
 433            ptr = frame;
 434            frame_size = 0;
 435            s->regs[ENET_EIR] |= ENET_INT_TXF;
 436        }
 437        s->regs[ENET_EIR] |= ENET_INT_TXB;
 438        bd.flags &= ~ENET_BD_R;
 439        /* Write back the modified descriptor.  */
 440        imx_fec_write_bd(&bd, addr);
 441        /* Advance to the next descriptor.  */
 442        if ((bd.flags & ENET_BD_W) != 0) {
 443            addr = s->regs[ENET_TDSR];
 444        } else {
 445            addr += sizeof(bd);
 446        }
 447    }
 448
 449    s->tx_descriptor = addr;
 450
 451    imx_eth_update(s);
 452}
 453
 454static void imx_enet_do_tx(IMXFECState *s)
 455{
 456    int frame_size = 0;
 457    uint8_t frame[ENET_MAX_FRAME_SIZE];
 458    uint8_t *ptr = frame;
 459    uint32_t addr = s->tx_descriptor;
 460
 461    while (1) {
 462        IMXENETBufDesc bd;
 463        int len;
 464
 465        imx_enet_read_bd(&bd, addr);
 466        FEC_PRINTF("tx_bd %x flags %04x len %d data %08x option %04x "
 467                   "status %04x\n", addr, bd.flags, bd.length, bd.data,
 468                   bd.option, bd.status);
 469        if ((bd.flags & ENET_BD_R) == 0) {
 470            /* Run out of descriptors to transmit.  */
 471            break;
 472        }
 473        len = bd.length;
 474        if (frame_size + len > ENET_MAX_FRAME_SIZE) {
 475            len = ENET_MAX_FRAME_SIZE - frame_size;
 476            s->regs[ENET_EIR] |= ENET_INT_BABT;
 477        }
 478        dma_memory_read(&address_space_memory, bd.data, ptr, len);
 479        ptr += len;
 480        frame_size += len;
 481        if (bd.flags & ENET_BD_L) {
 482            if (bd.option & ENET_BD_PINS) {
 483                struct ip_header *ip_hd = PKT_GET_IP_HDR(frame);
 484                if (IP_HEADER_VERSION(ip_hd) == 4) {
 485                    net_checksum_calculate(frame, frame_size);
 486                }
 487            }
 488            if (bd.option & ENET_BD_IINS) {
 489                struct ip_header *ip_hd = PKT_GET_IP_HDR(frame);
 490                /* We compute checksum only for IPv4 frames */
 491                if (IP_HEADER_VERSION(ip_hd) == 4) {
 492                    uint16_t csum;
 493                    ip_hd->ip_sum = 0;
 494                    csum = net_raw_checksum((uint8_t *)ip_hd, sizeof(*ip_hd));
 495                    ip_hd->ip_sum = cpu_to_be16(csum);
 496                }
 497            }
 498            /* Last buffer in frame.  */
 499            qemu_send_packet(qemu_get_queue(s->nic), frame, len);
 500            ptr = frame;
 501            frame_size = 0;
 502            if (bd.option & ENET_BD_TX_INT) {
 503                s->regs[ENET_EIR] |= ENET_INT_TXF;
 504            }
 505        }
 506        if (bd.option & ENET_BD_TX_INT) {
 507            s->regs[ENET_EIR] |= ENET_INT_TXB;
 508        }
 509        bd.flags &= ~ENET_BD_R;
 510        /* Write back the modified descriptor.  */
 511        imx_enet_write_bd(&bd, addr);
 512        /* Advance to the next descriptor.  */
 513        if ((bd.flags & ENET_BD_W) != 0) {
 514            addr = s->regs[ENET_TDSR];
 515        } else {
 516            addr += sizeof(bd);
 517        }
 518    }
 519
 520    s->tx_descriptor = addr;
 521
 522    imx_eth_update(s);
 523}
 524
 525static void imx_eth_do_tx(IMXFECState *s)
 526{
 527    if (!s->is_fec && (s->regs[ENET_ECR] & ENET_ECR_EN1588)) {
 528        imx_enet_do_tx(s);
 529    } else {
 530        imx_fec_do_tx(s);
 531    }
 532}
 533
 534static void imx_eth_enable_rx(IMXFECState *s)
 535{
 536    IMXFECBufDesc bd;
 537    bool tmp;
 538
 539    imx_fec_read_bd(&bd, s->rx_descriptor);
 540
 541    tmp = ((bd.flags & ENET_BD_E) != 0);
 542
 543    if (!tmp) {
 544        FEC_PRINTF("RX buffer full\n");
 545    } else if (!s->regs[ENET_RDAR]) {
 546        qemu_flush_queued_packets(qemu_get_queue(s->nic));
 547    }
 548
 549    s->regs[ENET_RDAR] = tmp ? ENET_RDAR_RDAR : 0;
 550}
 551
 552static void imx_eth_reset(DeviceState *d)
 553{
 554    IMXFECState *s = IMX_FEC(d);
 555
 556    /* Reset the Device */
 557    memset(s->regs, 0, sizeof(s->regs));
 558    s->regs[ENET_ECR]   = 0xf0000000;
 559    s->regs[ENET_MIBC]  = 0xc0000000;
 560    s->regs[ENET_RCR]   = 0x05ee0001;
 561    s->regs[ENET_OPD]   = 0x00010000;
 562
 563    s->regs[ENET_PALR]  = (s->conf.macaddr.a[0] << 24)
 564                          | (s->conf.macaddr.a[1] << 16)
 565                          | (s->conf.macaddr.a[2] << 8)
 566                          | s->conf.macaddr.a[3];
 567    s->regs[ENET_PAUR]  = (s->conf.macaddr.a[4] << 24)
 568                          | (s->conf.macaddr.a[5] << 16)
 569                          | 0x8808;
 570
 571    if (s->is_fec) {
 572        s->regs[ENET_FRBR]  = 0x00000600;
 573        s->regs[ENET_FRSR]  = 0x00000500;
 574        s->regs[ENET_MIIGSK_ENR]  = 0x00000006;
 575    } else {
 576        s->regs[ENET_RAEM]  = 0x00000004;
 577        s->regs[ENET_RAFL]  = 0x00000004;
 578        s->regs[ENET_TAEM]  = 0x00000004;
 579        s->regs[ENET_TAFL]  = 0x00000008;
 580        s->regs[ENET_TIPG]  = 0x0000000c;
 581        s->regs[ENET_FTRL]  = 0x000007ff;
 582        s->regs[ENET_ATPER] = 0x3b9aca00;
 583    }
 584
 585    s->rx_descriptor = 0;
 586    s->tx_descriptor = 0;
 587
 588    /* We also reset the PHY */
 589    phy_reset(s);
 590}
 591
 592static uint32_t imx_default_read(IMXFECState *s, uint32_t index)
 593{
 594    qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Bad register at offset 0x%"
 595                  PRIx32 "\n", TYPE_IMX_FEC, __func__, index * 4);
 596    return 0;
 597}
 598
 599static uint32_t imx_fec_read(IMXFECState *s, uint32_t index)
 600{
 601    switch (index) {
 602    case ENET_FRBR:
 603    case ENET_FRSR:
 604    case ENET_MIIGSK_CFGR:
 605    case ENET_MIIGSK_ENR:
 606        return s->regs[index];
 607    default:
 608        return imx_default_read(s, index);
 609    }
 610}
 611
 612static uint32_t imx_enet_read(IMXFECState *s, uint32_t index)
 613{
 614    switch (index) {
 615    case ENET_RSFL:
 616    case ENET_RSEM:
 617    case ENET_RAEM:
 618    case ENET_RAFL:
 619    case ENET_TSEM:
 620    case ENET_TAEM:
 621    case ENET_TAFL:
 622    case ENET_TIPG:
 623    case ENET_FTRL:
 624    case ENET_TACC:
 625    case ENET_RACC:
 626    case ENET_ATCR:
 627    case ENET_ATVR:
 628    case ENET_ATOFF:
 629    case ENET_ATPER:
 630    case ENET_ATCOR:
 631    case ENET_ATINC:
 632    case ENET_ATSTMP:
 633    case ENET_TGSR:
 634    case ENET_TCSR0:
 635    case ENET_TCCR0:
 636    case ENET_TCSR1:
 637    case ENET_TCCR1:
 638    case ENET_TCSR2:
 639    case ENET_TCCR2:
 640    case ENET_TCSR3:
 641    case ENET_TCCR3:
 642        return s->regs[index];
 643    default:
 644        return imx_default_read(s, index);
 645    }
 646}
 647
 648static uint64_t imx_eth_read(void *opaque, hwaddr offset, unsigned size)
 649{
 650    uint32_t value = 0;
 651    IMXFECState *s = IMX_FEC(opaque);
 652    uint32_t index = offset >> 2;
 653
 654    switch (index) {
 655    case ENET_EIR:
 656    case ENET_EIMR:
 657    case ENET_RDAR:
 658    case ENET_TDAR:
 659    case ENET_ECR:
 660    case ENET_MMFR:
 661    case ENET_MSCR:
 662    case ENET_MIBC:
 663    case ENET_RCR:
 664    case ENET_TCR:
 665    case ENET_PALR:
 666    case ENET_PAUR:
 667    case ENET_OPD:
 668    case ENET_IAUR:
 669    case ENET_IALR:
 670    case ENET_GAUR:
 671    case ENET_GALR:
 672    case ENET_TFWR:
 673    case ENET_RDSR:
 674    case ENET_TDSR:
 675    case ENET_MRBR:
 676        value = s->regs[index];
 677        break;
 678    default:
 679        if (s->is_fec) {
 680            value = imx_fec_read(s, index);
 681        } else {
 682            value = imx_enet_read(s, index);
 683        }
 684        break;
 685    }
 686
 687    FEC_PRINTF("reg[%s] => 0x%" PRIx32 "\n", imx_eth_reg_name(s, index),
 688                                              value);
 689
 690    return value;
 691}
 692
 693static void imx_default_write(IMXFECState *s, uint32_t index, uint32_t value)
 694{
 695    qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Bad address at offset 0x%"
 696                  PRIx32 "\n", TYPE_IMX_FEC, __func__, index * 4);
 697    return;
 698}
 699
 700static void imx_fec_write(IMXFECState *s, uint32_t index, uint32_t value)
 701{
 702    switch (index) {
 703    case ENET_FRBR:
 704        /* FRBR is read only */
 705        qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Register FRBR is read only\n",
 706                      TYPE_IMX_FEC, __func__);
 707        break;
 708    case ENET_FRSR:
 709        s->regs[index] = (value & 0x000003fc) | 0x00000400;
 710        break;
 711    case ENET_MIIGSK_CFGR:
 712        s->regs[index] = value & 0x00000053;
 713        break;
 714    case ENET_MIIGSK_ENR:
 715        s->regs[index] = (value & 0x00000002) ? 0x00000006 : 0;
 716        break;
 717    default:
 718        imx_default_write(s, index, value);
 719        break;
 720    }
 721}
 722
 723static void imx_enet_write(IMXFECState *s, uint32_t index, uint32_t value)
 724{
 725    switch (index) {
 726    case ENET_RSFL:
 727    case ENET_RSEM:
 728    case ENET_RAEM:
 729    case ENET_RAFL:
 730    case ENET_TSEM:
 731    case ENET_TAEM:
 732    case ENET_TAFL:
 733        s->regs[index] = value & 0x000001ff;
 734        break;
 735    case ENET_TIPG:
 736        s->regs[index] = value & 0x0000001f;
 737        break;
 738    case ENET_FTRL:
 739        s->regs[index] = value & 0x00003fff;
 740        break;
 741    case ENET_TACC:
 742        s->regs[index] = value & 0x00000019;
 743        break;
 744    case ENET_RACC:
 745        s->regs[index] = value & 0x000000C7;
 746        break;
 747    case ENET_ATCR:
 748        s->regs[index] = value & 0x00002a9d;
 749        break;
 750    case ENET_ATVR:
 751    case ENET_ATOFF:
 752    case ENET_ATPER:
 753        s->regs[index] = value;
 754        break;
 755    case ENET_ATSTMP:
 756        /* ATSTMP is read only */
 757        qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Register ATSTMP is read only\n",
 758                      TYPE_IMX_FEC, __func__);
 759        break;
 760    case ENET_ATCOR:
 761        s->regs[index] = value & 0x7fffffff;
 762        break;
 763    case ENET_ATINC:
 764        s->regs[index] = value & 0x00007f7f;
 765        break;
 766    case ENET_TGSR:
 767        /* implement clear timer flag */
 768        value = value & 0x0000000f;
 769        break;
 770    case ENET_TCSR0:
 771    case ENET_TCSR1:
 772    case ENET_TCSR2:
 773    case ENET_TCSR3:
 774        value = value & 0x000000fd;
 775        break;
 776    case ENET_TCCR0:
 777    case ENET_TCCR1:
 778    case ENET_TCCR2:
 779    case ENET_TCCR3:
 780        s->regs[index] = value;
 781        break;
 782    default:
 783        imx_default_write(s, index, value);
 784        break;
 785    }
 786}
 787
 788static void imx_eth_write(void *opaque, hwaddr offset, uint64_t value,
 789                           unsigned size)
 790{
 791    IMXFECState *s = IMX_FEC(opaque);
 792    uint32_t index = offset >> 2;
 793
 794    FEC_PRINTF("reg[%s] <= 0x%" PRIx32 "\n", imx_eth_reg_name(s, index),
 795                (uint32_t)value);
 796
 797    switch (index) {
 798    case ENET_EIR:
 799        s->regs[index] &= ~value;
 800        break;
 801    case ENET_EIMR:
 802        s->regs[index] = value;
 803        break;
 804    case ENET_RDAR:
 805        if (s->regs[ENET_ECR] & ENET_ECR_ETHEREN) {
 806            if (!s->regs[index]) {
 807                s->regs[index] = ENET_RDAR_RDAR;
 808                imx_eth_enable_rx(s);
 809            }
 810        } else {
 811            s->regs[index] = 0;
 812        }
 813        break;
 814    case ENET_TDAR:
 815        if (s->regs[ENET_ECR] & ENET_ECR_ETHEREN) {
 816            s->regs[index] = ENET_TDAR_TDAR;
 817            imx_eth_do_tx(s);
 818        }
 819        s->regs[index] = 0;
 820        break;
 821    case ENET_ECR:
 822        if (value & ENET_ECR_RESET) {
 823            return imx_eth_reset(DEVICE(s));
 824        }
 825        s->regs[index] = value;
 826        if ((s->regs[index] & ENET_ECR_ETHEREN) == 0) {
 827            s->regs[ENET_RDAR] = 0;
 828            s->rx_descriptor = s->regs[ENET_RDSR];
 829            s->regs[ENET_TDAR] = 0;
 830            s->tx_descriptor = s->regs[ENET_TDSR];
 831        }
 832        break;
 833    case ENET_MMFR:
 834        s->regs[index] = value;
 835        if (extract32(value, 29, 1)) {
 836            /* This is a read operation */
 837            s->regs[ENET_MMFR] = deposit32(s->regs[ENET_MMFR], 0, 16,
 838                                           do_phy_read(s,
 839                                                       extract32(value,
 840                                                                 18, 10)));
 841        } else {
 842            /* This a write operation */
 843            do_phy_write(s, extract32(value, 18, 10), extract32(value, 0, 16));
 844        }
 845        /* raise the interrupt as the PHY operation is done */
 846        s->regs[ENET_EIR] |= ENET_INT_MII;
 847        break;
 848    case ENET_MSCR:
 849        s->regs[index] = value & 0xfe;
 850        break;
 851    case ENET_MIBC:
 852        /* TODO: Implement MIB.  */
 853        s->regs[index] = (value & 0x80000000) ? 0xc0000000 : 0;
 854        break;
 855    case ENET_RCR:
 856        s->regs[index] = value & 0x07ff003f;
 857        /* TODO: Implement LOOP mode.  */
 858        break;
 859    case ENET_TCR:
 860        /* We transmit immediately, so raise GRA immediately.  */
 861        s->regs[index] = value;
 862        if (value & 1) {
 863            s->regs[ENET_EIR] |= ENET_INT_GRA;
 864        }
 865        break;
 866    case ENET_PALR:
 867        s->regs[index] = value;
 868        s->conf.macaddr.a[0] = value >> 24;
 869        s->conf.macaddr.a[1] = value >> 16;
 870        s->conf.macaddr.a[2] = value >> 8;
 871        s->conf.macaddr.a[3] = value;
 872        break;
 873    case ENET_PAUR:
 874        s->regs[index] = (value | 0x0000ffff) & 0xffff8808;
 875        s->conf.macaddr.a[4] = value >> 24;
 876        s->conf.macaddr.a[5] = value >> 16;
 877        break;
 878    case ENET_OPD:
 879        s->regs[index] = (value & 0x0000ffff) | 0x00010000;
 880        break;
 881    case ENET_IAUR:
 882    case ENET_IALR:
 883    case ENET_GAUR:
 884    case ENET_GALR:
 885        /* TODO: implement MAC hash filtering.  */
 886        break;
 887    case ENET_TFWR:
 888        if (s->is_fec) {
 889            s->regs[index] = value & 0x3;
 890        } else {
 891            s->regs[index] = value & 0x13f;
 892        }
 893        break;
 894    case ENET_RDSR:
 895        if (s->is_fec) {
 896            s->regs[index] = value & ~3;
 897        } else {
 898            s->regs[index] = value & ~7;
 899        }
 900        s->rx_descriptor = s->regs[index];
 901        break;
 902    case ENET_TDSR:
 903        if (s->is_fec) {
 904            s->regs[index] = value & ~3;
 905        } else {
 906            s->regs[index] = value & ~7;
 907        }
 908        s->tx_descriptor = s->regs[index];
 909        break;
 910    case ENET_MRBR:
 911        s->regs[index] = value & 0x00003ff0;
 912        break;
 913    default:
 914        if (s->is_fec) {
 915            imx_fec_write(s, index, value);
 916        } else {
 917            imx_enet_write(s, index, value);
 918        }
 919        return;
 920    }
 921
 922    imx_eth_update(s);
 923}
 924
 925static int imx_eth_can_receive(NetClientState *nc)
 926{
 927    IMXFECState *s = IMX_FEC(qemu_get_nic_opaque(nc));
 928
 929    FEC_PRINTF("\n");
 930
 931    return s->regs[ENET_RDAR] ? 1 : 0;
 932}
 933
 934static ssize_t imx_fec_receive(NetClientState *nc, const uint8_t *buf,
 935                               size_t len)
 936{
 937    IMXFECState *s = IMX_FEC(qemu_get_nic_opaque(nc));
 938    IMXFECBufDesc bd;
 939    uint32_t flags = 0;
 940    uint32_t addr;
 941    uint32_t crc;
 942    uint32_t buf_addr;
 943    uint8_t *crc_ptr;
 944    unsigned int buf_len;
 945    size_t size = len;
 946
 947    FEC_PRINTF("len %d\n", (int)size);
 948
 949    if (!s->regs[ENET_RDAR]) {
 950        qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Unexpected packet\n",
 951                      TYPE_IMX_FEC, __func__);
 952        return 0;
 953    }
 954
 955    /* 4 bytes for the CRC.  */
 956    size += 4;
 957    crc = cpu_to_be32(crc32(~0, buf, size));
 958    crc_ptr = (uint8_t *) &crc;
 959
 960    /* Huge frames are truncated.  */
 961    if (size > ENET_MAX_FRAME_SIZE) {
 962        size = ENET_MAX_FRAME_SIZE;
 963        flags |= ENET_BD_TR | ENET_BD_LG;
 964    }
 965
 966    /* Frames larger than the user limit just set error flags.  */
 967    if (size > (s->regs[ENET_RCR] >> 16)) {
 968        flags |= ENET_BD_LG;
 969    }
 970
 971    addr = s->rx_descriptor;
 972    while (size > 0) {
 973        imx_fec_read_bd(&bd, addr);
 974        if ((bd.flags & ENET_BD_E) == 0) {
 975            /* No descriptors available.  Bail out.  */
 976            /*
 977             * FIXME: This is wrong. We should probably either
 978             * save the remainder for when more RX buffers are
 979             * available, or flag an error.
 980             */
 981            qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Lost end of frame\n",
 982                          TYPE_IMX_FEC, __func__);
 983            break;
 984        }
 985        buf_len = (size <= s->regs[ENET_MRBR]) ? size : s->regs[ENET_MRBR];
 986        bd.length = buf_len;
 987        size -= buf_len;
 988
 989        FEC_PRINTF("rx_bd 0x%x length %d\n", addr, bd.length);
 990
 991        /* The last 4 bytes are the CRC.  */
 992        if (size < 4) {
 993            buf_len += size - 4;
 994        }
 995        buf_addr = bd.data;
 996        dma_memory_write(&address_space_memory, buf_addr, buf, buf_len);
 997        buf += buf_len;
 998        if (size < 4) {
 999            dma_memory_write(&address_space_memory, buf_addr + buf_len,
1000                             crc_ptr, 4 - size);
1001            crc_ptr += 4 - size;
1002        }
1003        bd.flags &= ~ENET_BD_E;
1004        if (size == 0) {
1005            /* Last buffer in frame.  */
1006            bd.flags |= flags | ENET_BD_L;
1007            FEC_PRINTF("rx frame flags %04x\n", bd.flags);
1008            s->regs[ENET_EIR] |= ENET_INT_RXF;
1009        } else {
1010            s->regs[ENET_EIR] |= ENET_INT_RXB;
1011        }
1012        imx_fec_write_bd(&bd, addr);
1013        /* Advance to the next descriptor.  */
1014        if ((bd.flags & ENET_BD_W) != 0) {
1015            addr = s->regs[ENET_RDSR];
1016        } else {
1017            addr += sizeof(bd);
1018        }
1019    }
1020    s->rx_descriptor = addr;
1021    imx_eth_enable_rx(s);
1022    imx_eth_update(s);
1023    return len;
1024}
1025
1026static ssize_t imx_enet_receive(NetClientState *nc, const uint8_t *buf,
1027                                size_t len)
1028{
1029    IMXFECState *s = IMX_FEC(qemu_get_nic_opaque(nc));
1030    IMXENETBufDesc bd;
1031    uint32_t flags = 0;
1032    uint32_t addr;
1033    uint32_t crc;
1034    uint32_t buf_addr;
1035    uint8_t *crc_ptr;
1036    unsigned int buf_len;
1037    size_t size = len;
1038
1039    FEC_PRINTF("len %d\n", (int)size);
1040
1041    if (!s->regs[ENET_RDAR]) {
1042        qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Unexpected packet\n",
1043                      TYPE_IMX_FEC, __func__);
1044        return 0;
1045    }
1046
1047    /* 4 bytes for the CRC.  */
1048    size += 4;
1049    crc = cpu_to_be32(crc32(~0, buf, size));
1050    crc_ptr = (uint8_t *) &crc;
1051
1052    /* Huge frames are truncted.  */
1053    if (size > ENET_MAX_FRAME_SIZE) {
1054        size = ENET_MAX_FRAME_SIZE;
1055        flags |= ENET_BD_TR | ENET_BD_LG;
1056    }
1057
1058    /* Frames larger than the user limit just set error flags.  */
1059    if (size > (s->regs[ENET_RCR] >> 16)) {
1060        flags |= ENET_BD_LG;
1061    }
1062
1063    addr = s->rx_descriptor;
1064    while (size > 0) {
1065        imx_enet_read_bd(&bd, addr);
1066        if ((bd.flags & ENET_BD_E) == 0) {
1067            /* No descriptors available.  Bail out.  */
1068            /*
1069             * FIXME: This is wrong. We should probably either
1070             * save the remainder for when more RX buffers are
1071             * available, or flag an error.
1072             */
1073            qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Lost end of frame\n",
1074                          TYPE_IMX_FEC, __func__);
1075            break;
1076        }
1077        buf_len = (size <= s->regs[ENET_MRBR]) ? size : s->regs[ENET_MRBR];
1078        bd.length = buf_len;
1079        size -= buf_len;
1080
1081        FEC_PRINTF("rx_bd 0x%x length %d\n", addr, bd.length);
1082
1083        /* The last 4 bytes are the CRC.  */
1084        if (size < 4) {
1085            buf_len += size - 4;
1086        }
1087        buf_addr = bd.data;
1088        dma_memory_write(&address_space_memory, buf_addr, buf, buf_len);
1089        buf += buf_len;
1090        if (size < 4) {
1091            dma_memory_write(&address_space_memory, buf_addr + buf_len,
1092                             crc_ptr, 4 - size);
1093            crc_ptr += 4 - size;
1094        }
1095        bd.flags &= ~ENET_BD_E;
1096        if (size == 0) {
1097            /* Last buffer in frame.  */
1098            bd.flags |= flags | ENET_BD_L;
1099            FEC_PRINTF("rx frame flags %04x\n", bd.flags);
1100            if (bd.option & ENET_BD_RX_INT) {
1101                s->regs[ENET_EIR] |= ENET_INT_RXF;
1102            }
1103        } else {
1104            if (bd.option & ENET_BD_RX_INT) {
1105                s->regs[ENET_EIR] |= ENET_INT_RXB;
1106            }
1107        }
1108        imx_enet_write_bd(&bd, addr);
1109        /* Advance to the next descriptor.  */
1110        if ((bd.flags & ENET_BD_W) != 0) {
1111            addr = s->regs[ENET_RDSR];
1112        } else {
1113            addr += sizeof(bd);
1114        }
1115    }
1116    s->rx_descriptor = addr;
1117    imx_eth_enable_rx(s);
1118    imx_eth_update(s);
1119    return len;
1120}
1121
1122static ssize_t imx_eth_receive(NetClientState *nc, const uint8_t *buf,
1123                                size_t len)
1124{
1125    IMXFECState *s = IMX_FEC(qemu_get_nic_opaque(nc));
1126
1127    if (!s->is_fec && (s->regs[ENET_ECR] & ENET_ECR_EN1588)) {
1128        return imx_enet_receive(nc, buf, len);
1129    } else {
1130        return imx_fec_receive(nc, buf, len);
1131    }
1132}
1133
1134static const MemoryRegionOps imx_eth_ops = {
1135    .read                  = imx_eth_read,
1136    .write                 = imx_eth_write,
1137    .valid.min_access_size = 4,
1138    .valid.max_access_size = 4,
1139    .endianness            = DEVICE_NATIVE_ENDIAN,
1140};
1141
1142static void imx_eth_cleanup(NetClientState *nc)
1143{
1144    IMXFECState *s = IMX_FEC(qemu_get_nic_opaque(nc));
1145
1146    s->nic = NULL;
1147}
1148
1149static NetClientInfo imx_eth_net_info = {
1150    .type                = NET_CLIENT_DRIVER_NIC,
1151    .size                = sizeof(NICState),
1152    .can_receive         = imx_eth_can_receive,
1153    .receive             = imx_eth_receive,
1154    .cleanup             = imx_eth_cleanup,
1155    .link_status_changed = imx_eth_set_link,
1156};
1157
1158
1159static void imx_eth_realize(DeviceState *dev, Error **errp)
1160{
1161    IMXFECState *s = IMX_FEC(dev);
1162    SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1163
1164    memory_region_init_io(&s->iomem, OBJECT(dev), &imx_eth_ops, s,
1165                          TYPE_IMX_FEC, 0x400);
1166    sysbus_init_mmio(sbd, &s->iomem);
1167    sysbus_init_irq(sbd, &s->irq[0]);
1168    sysbus_init_irq(sbd, &s->irq[1]);
1169
1170    qemu_macaddr_default_if_unset(&s->conf.macaddr);
1171
1172    s->conf.peers.ncs[0] = nd_table[0].netdev;
1173
1174    s->nic = qemu_new_nic(&imx_eth_net_info, &s->conf,
1175                          object_get_typename(OBJECT(dev)),
1176                          DEVICE(dev)->id, s);
1177
1178    qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
1179}
1180
1181static Property imx_eth_properties[] = {
1182    DEFINE_NIC_PROPERTIES(IMXFECState, conf),
1183    DEFINE_PROP_END_OF_LIST(),
1184};
1185
1186static void imx_eth_class_init(ObjectClass *klass, void *data)
1187{
1188    DeviceClass *dc = DEVICE_CLASS(klass);
1189
1190    dc->vmsd    = &vmstate_imx_eth;
1191    dc->reset   = imx_eth_reset;
1192    dc->props   = imx_eth_properties;
1193    dc->realize = imx_eth_realize;
1194    dc->desc    = "i.MX FEC/ENET Ethernet Controller";
1195}
1196
1197static void imx_fec_init(Object *obj)
1198{
1199    IMXFECState *s = IMX_FEC(obj);
1200
1201    s->is_fec = true;
1202}
1203
1204static void imx_enet_init(Object *obj)
1205{
1206    IMXFECState *s = IMX_FEC(obj);
1207
1208    s->is_fec = false;
1209}
1210
1211static const TypeInfo imx_fec_info = {
1212    .name          = TYPE_IMX_FEC,
1213    .parent        = TYPE_SYS_BUS_DEVICE,
1214    .instance_size = sizeof(IMXFECState),
1215    .instance_init = imx_fec_init,
1216    .class_init    = imx_eth_class_init,
1217};
1218
1219static const TypeInfo imx_enet_info = {
1220    .name          = TYPE_IMX_ENET,
1221    .parent        = TYPE_IMX_FEC,
1222    .instance_init = imx_enet_init,
1223};
1224
1225static void imx_eth_register_types(void)
1226{
1227    type_register_static(&imx_fec_info);
1228    type_register_static(&imx_enet_info);
1229}
1230
1231type_init(imx_eth_register_types)
1232