?  search:
summary | log | graphiclog1 | graphiclog2 | commit | commitdiff | tree | refs | edit | fork
blame | history | raw | HEAD
e1000: bounds packet size against buffer size
[qemu.git] / hw / e1000.c
blobe164d79b8773efc92199ef2986c348579bf15f1d
1 /*
2 * QEMU e1000 emulation
3 *
4 * Software developer's manual:
5 * http://download.intel.com/design/network/manuals/8254x_GBe_SDM.pdf
6 *
7 * Nir Peleg, Tutis Systems Ltd. for Qumranet Inc.
8 * Copyright (c) 2008 Qumranet
9 * Based on work done by:
10 * Copyright (c) 2007 Dan Aloni
11 * Copyright (c) 2004 Antony T Curtis
12 *
13 * This library is free software; you can redistribute it and/or
14 * modify it under the terms of the GNU Lesser General Public
15 * License as published by the Free Software Foundation; either
16 * version 2 of the License, or (at your option) any later version.
17 *
18 * This library is distributed in the hope that it will be useful,
19 * but WITHOUT ANY WARRANTY; without even the implied warranty of
20 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
21 * Lesser General Public License for more details.
22 *
23 * You should have received a copy of the GNU Lesser General Public
24 * License along with this library; if not, see <http://www.gnu.org/licenses/>.
25 */
26
27
28 #include "hw.h"
29 #include "pci.h"
30 #include "net.h"
31 #include "net/checksum.h"
32 #include "loader.h"
33 #include "sysemu.h"
34 #include "dma.h"
35
36 #include "e1000_hw.h"
37
38 #define E1000_DEBUG
39
40 #ifdef E1000_DEBUG
41 enum {
42 DEBUG_GENERAL, DEBUG_IO, DEBUG_MMIO, DEBUG_INTERRUPT,
43 DEBUG_RX, DEBUG_TX, DEBUG_MDIC, DEBUG_EEPROM,
44 DEBUG_UNKNOWN, DEBUG_TXSUM, DEBUG_TXERR, DEBUG_RXERR,
45 DEBUG_RXFILTER, DEBUG_NOTYET,
46 };
47 #define DBGBIT(x) (1<<DEBUG_##x)
48 static int debugflags = DBGBIT(TXERR) | DBGBIT(GENERAL);
49
50 #define DBGOUT(what, fmt, ...) do { \
51 if (debugflags & DBGBIT(what)) \
52 fprintf(stderr, "e1000: " fmt, ## __VA_ARGS__); \
53 } while (0)
54 #else
55 #define DBGOUT(what, fmt, ...) do {} while (0)
56 #endif
57
58 #define IOPORT_SIZE 0x40
59 #define PNPMMIO_SIZE 0x20000
60 #define MIN_BUF_SIZE 60 /* Min. octets in an ethernet frame sans FCS */
61
62 /*
63 * HW models:
64 * E1000_DEV_ID_82540EM works with Windows and Linux
65 * E1000_DEV_ID_82573L OK with windoze and Linux 2.6.22,
66 * appears to perform better than 82540EM, but breaks with Linux 2.6.18
67 * E1000_DEV_ID_82544GC_COPPER appears to work; not well tested
68 * Others never tested
69 */
70 enum { E1000_DEVID = E1000_DEV_ID_82540EM };
71
72 /*
73 * May need to specify additional MAC-to-PHY entries --
74 * Intel's Windows driver refuses to initialize unless they match
75 */
76 enum {
77 PHY_ID2_INIT = E1000_DEVID == E1000_DEV_ID_82573L ? 0xcc2 :
78 E1000_DEVID == E1000_DEV_ID_82544GC_COPPER ? 0xc30 :
79 /* default to E1000_DEV_ID_82540EM */ 0xc20
80 };
81
82 typedef struct E1000State_st {
83 PCIDevice dev;
84 NICState *nic;
85 NICConf conf;
86 MemoryRegion mmio;
87 MemoryRegion io;
88
89 uint32_t mac_reg[0x8000];
90 uint16_t phy_reg[0x20];
91 uint16_t eeprom_data[64];
92
93 uint32_t rxbuf_size;
94 uint32_t rxbuf_min_shift;
95 int check_rxov;
96 struct e1000_tx {
97 unsigned char header[256];
98 unsigned char vlan_header[4];
99 /* Fields vlan and data must not be reordered or separated. */
100 unsigned char vlan[4];
101 unsigned char data[0x10000];
102 uint16_t size;
103 unsigned char sum_needed;
104 unsigned char vlan_needed;
105 uint8_t ipcss;
106 uint8_t ipcso;
107 uint16_t ipcse;
108 uint8_t tucss;
109 uint8_t tucso;
110 uint16_t tucse;
111 uint8_t hdr_len;
112 uint16_t mss;
113 uint32_t paylen;
114 uint16_t tso_frames;
115 char tse;
116 int8_t ip;
117 int8_t tcp;
118 char cptse; // current packet tse bit
119 } tx;
120
121 struct {
122 uint32_t val_in; // shifted in from guest driver
123 uint16_t bitnum_in;
124 uint16_t bitnum_out;
125 uint16_t reading;
126 uint32_t old_eecd;
127 } eecd_state;
128 } E1000State;
129
130 #define defreg(x) x = (E1000_##x>>2)
131 enum {
132 defreg(CTRL), defreg(EECD), defreg(EERD), defreg(GPRC),
133 defreg(GPTC), defreg(ICR), defreg(ICS), defreg(IMC),
134 defreg(IMS), defreg(LEDCTL), defreg(MANC), defreg(MDIC),
135 defreg(MPC), defreg(PBA), defreg(RCTL), defreg(RDBAH),
136 defreg(RDBAL), defreg(RDH), defreg(RDLEN), defreg(RDT),
137 defreg(STATUS), defreg(SWSM), defreg(TCTL), defreg(TDBAH),
138 defreg(TDBAL), defreg(TDH), defreg(TDLEN), defreg(TDT),
139 defreg(TORH), defreg(TORL), defreg(TOTH), defreg(TOTL),
140 defreg(TPR), defreg(TPT), defreg(TXDCTL), defreg(WUFC),
141 defreg(RA), defreg(MTA), defreg(CRCERRS),defreg(VFTA),
142 defreg(VET),
143 };
144
145 enum { PHY_R = 1, PHY_W = 2, PHY_RW = PHY_R | PHY_W };
146 static const char phy_regcap[0x20] = {
147 [PHY_STATUS] = PHY_R, [M88E1000_EXT_PHY_SPEC_CTRL] = PHY_RW,
148 [PHY_ID1] = PHY_R, [M88E1000_PHY_SPEC_CTRL] = PHY_RW,
149 [PHY_CTRL] = PHY_RW, [PHY_1000T_CTRL] = PHY_RW,
150 [PHY_LP_ABILITY] = PHY_R, [PHY_1000T_STATUS] = PHY_R,
151 [PHY_AUTONEG_ADV] = PHY_RW, [M88E1000_RX_ERR_CNTR] = PHY_R,
152 [PHY_ID2] = PHY_R, [M88E1000_PHY_SPEC_STATUS] = PHY_R
153 };
154
155 static void
156 set_interrupt_cause(E1000State *s, int index, uint32_t val)
157 {
158 if (val)
159 val |= E1000_ICR_INT_ASSERTED;
160 s->mac_reg[ICR] = val;
161 s->mac_reg[ICS] = val;
162 qemu_set_irq(s->dev.irq[0], (s->mac_reg[IMS] & s->mac_reg[ICR]) != 0);
163 }
164
165 static void
166 set_ics(E1000State *s, int index, uint32_t val)
167 {
168 DBGOUT(INTERRUPT, "set_ics %x, ICR %x, IMR %x\n", val, s->mac_reg[ICR],
169 s->mac_reg[IMS]);
170 set_interrupt_cause(s, 0, val | s->mac_reg[ICR]);
171 }
172
173 static int
174 rxbufsize(uint32_t v)
175 {
176 v &= E1000_RCTL_BSEX | E1000_RCTL_SZ_16384 | E1000_RCTL_SZ_8192 |
177 E1000_RCTL_SZ_4096 | E1000_RCTL_SZ_2048 | E1000_RCTL_SZ_1024 |
178 E1000_RCTL_SZ_512 | E1000_RCTL_SZ_256;
179 switch (v) {
180 case E1000_RCTL_BSEX | E1000_RCTL_SZ_16384:
181 return 16384;
182 case E1000_RCTL_BSEX | E1000_RCTL_SZ_8192:
183 return 8192;
184 case E1000_RCTL_BSEX | E1000_RCTL_SZ_4096:
185 return 4096;
186 case E1000_RCTL_SZ_1024:
187 return 1024;
188 case E1000_RCTL_SZ_512:
189 return 512;
190 case E1000_RCTL_SZ_256:
191 return 256;
192 }
193 return 2048;
194 }
195
196 static void
197 set_ctrl(E1000State *s, int index, uint32_t val)
198 {
199 /* RST is self clearing */
200 s->mac_reg[CTRL] = val & ~E1000_CTRL_RST;
201 }
202
203 static void
204 set_rx_control(E1000State *s, int index, uint32_t val)
205 {
206 s->mac_reg[RCTL] = val;
207 s->rxbuf_size = rxbufsize(val);
208 s->rxbuf_min_shift = ((val / E1000_RCTL_RDMTS_QUAT) & 3) + 1;
209 DBGOUT(RX, "RCTL: %d, mac_reg[RCTL] = 0x%x\n", s->mac_reg[RDT],
210 s->mac_reg[RCTL]);
211 }
212
213 static void
214 set_mdic(E1000State *s, int index, uint32_t val)
215 {
216 uint32_t data = val & E1000_MDIC_DATA_MASK;
217 uint32_t addr = ((val & E1000_MDIC_REG_MASK) >> E1000_MDIC_REG_SHIFT);
218
219 if ((val & E1000_MDIC_PHY_MASK) >> E1000_MDIC_PHY_SHIFT != 1) // phy #
220 val = s->mac_reg[MDIC] | E1000_MDIC_ERROR;
221 else if (val & E1000_MDIC_OP_READ) {
222 DBGOUT(MDIC, "MDIC read reg 0x%x\n", addr);
223 if (!(phy_regcap[addr] & PHY_R)) {
224 DBGOUT(MDIC, "MDIC read reg %x unhandled\n", addr);
225 val |= E1000_MDIC_ERROR;
226 } else
227 val = (val ^ data) | s->phy_reg[addr];
228 } else if (val & E1000_MDIC_OP_WRITE) {
229 DBGOUT(MDIC, "MDIC write reg 0x%x, value 0x%x\n", addr, data);
230 if (!(phy_regcap[addr] & PHY_W)) {
231 DBGOUT(MDIC, "MDIC write reg %x unhandled\n", addr);
232 val |= E1000_MDIC_ERROR;
233 } else
234 s->phy_reg[addr] = data;
235 }
236 s->mac_reg[MDIC] = val | E1000_MDIC_READY;
237 set_ics(s, 0, E1000_ICR_MDAC);
238 }
239
240 static uint32_t
241 get_eecd(E1000State *s, int index)
242 {
243 uint32_t ret = E1000_EECD_PRES|E1000_EECD_GNT | s->eecd_state.old_eecd;
244
245 DBGOUT(EEPROM, "reading eeprom bit %d (reading %d)\n",
246 s->eecd_state.bitnum_out, s->eecd_state.reading);
247 if (!s->eecd_state.reading ||
248 ((s->eeprom_data[(s->eecd_state.bitnum_out >> 4) & 0x3f] >>
249 ((s->eecd_state.bitnum_out & 0xf) ^ 0xf))) & 1)
250 ret |= E1000_EECD_DO;
251 return ret;
252 }
253
254 static void
255 set_eecd(E1000State *s, int index, uint32_t val)
256 {
257 uint32_t oldval = s->eecd_state.old_eecd;
258
259 s->eecd_state.old_eecd = val & (E1000_EECD_SK | E1000_EECD_CS |
260 E1000_EECD_DI|E1000_EECD_FWE_MASK|E1000_EECD_REQ);
261 if (!(E1000_EECD_CS & val)) // CS inactive; nothing to do
262 return;
263 if (E1000_EECD_CS & (val ^ oldval)) { // CS rise edge; reset state
264 s->eecd_state.val_in = 0;
265 s->eecd_state.bitnum_in = 0;
266 s->eecd_state.bitnum_out = 0;
267 s->eecd_state.reading = 0;
268 }
269 if (!(E1000_EECD_SK & (val ^ oldval))) // no clock edge
270 return;
271 if (!(E1000_EECD_SK & val)) { // falling edge
272 s->eecd_state.bitnum_out++;
273 return;
274 }
275 s->eecd_state.val_in <<= 1;
276 if (val & E1000_EECD_DI)
277 s->eecd_state.val_in |= 1;
278 if (++s->eecd_state.bitnum_in == 9 && !s->eecd_state.reading) {
279 s->eecd_state.bitnum_out = ((s->eecd_state.val_in & 0x3f)<<4)-1;
280 s->eecd_state.reading = (((s->eecd_state.val_in >> 6) & 7) ==
281 EEPROM_READ_OPCODE_MICROWIRE);
282 }
283 DBGOUT(EEPROM, "eeprom bitnum in %d out %d, reading %d\n",
284 s->eecd_state.bitnum_in, s->eecd_state.bitnum_out,
285 s->eecd_state.reading);
286 }
287
288 static uint32_t
289 flash_eerd_read(E1000State *s, int x)
290 {
291 unsigned int index, r = s->mac_reg[EERD] & ~E1000_EEPROM_RW_REG_START;
292
293 if ((s->mac_reg[EERD] & E1000_EEPROM_RW_REG_START) == 0)
294 return (s->mac_reg[EERD]);
295
296 if ((index = r >> E1000_EEPROM_RW_ADDR_SHIFT) > EEPROM_CHECKSUM_REG)
297 return (E1000_EEPROM_RW_REG_DONE | r);
298
299 return ((s->eeprom_data[index] << E1000_EEPROM_RW_REG_DATA) |
300 E1000_EEPROM_RW_REG_DONE | r);
301 }
302
303 static void
304 putsum(uint8_t *data, uint32_t n, uint32_t sloc, uint32_t css, uint32_t cse)
305 {
306 uint32_t sum;
307
308 if (cse && cse < n)
309 n = cse + 1;
310 if (sloc < n-1) {
311 sum = net_checksum_add(n-css, data+css);
312 cpu_to_be16wu((uint16_t *)(data + sloc),
313 net_checksum_finish(sum));
314 }
315 }
316
317 static inline int
318 vlan_enabled(E1000State *s)
319 {
320 return ((s->mac_reg[CTRL] & E1000_CTRL_VME) != 0);
321 }
322
323 static inline int
324 vlan_rx_filter_enabled(E1000State *s)
325 {
326 return ((s->mac_reg[RCTL] & E1000_RCTL_VFE) != 0);
327 }
328
329 static inline int
330 is_vlan_packet(E1000State *s, const uint8_t *buf)
331 {
332 return (be16_to_cpup((uint16_t *)(buf + 12)) ==
333 le16_to_cpup((uint16_t *)(s->mac_reg + VET)));
334 }
335
336 static inline int
337 is_vlan_txd(uint32_t txd_lower)
338 {
339 return ((txd_lower & E1000_TXD_CMD_VLE) != 0);
340 }
341
342 /* FCS aka Ethernet CRC-32. We don't get it from backends and can't
343 * fill it in, just pad descriptor length by 4 bytes unless guest
344 * told us to strip it off the packet. */
345 static inline int
346 fcs_len(E1000State *s)
347 {
348 return (s->mac_reg[RCTL] & E1000_RCTL_SECRC) ? 0 : 4;
349 }
350
351 static void
352 xmit_seg(E1000State *s)
353 {
354 uint16_t len, *sp;
355 unsigned int frames = s->tx.tso_frames, css, sofar, n;
356 struct e1000_tx *tp = &s->tx;
357
358 if (tp->tse && tp->cptse) {
359 css = tp->ipcss;
360 DBGOUT(TXSUM, "frames %d size %d ipcss %d\n",
361 frames, tp->size, css);
362 if (tp->ip) { // IPv4
363 cpu_to_be16wu((uint16_t *)(tp->data+css+2),
364 tp->size - css);
365 cpu_to_be16wu((uint16_t *)(tp->data+css+4),
366 be16_to_cpup((uint16_t *)(tp->data+css+4))+frames);
367 } else // IPv6
368 cpu_to_be16wu((uint16_t *)(tp->data+css+4),
369 tp->size - css);
370 css = tp->tucss;
371 len = tp->size - css;
372 DBGOUT(TXSUM, "tcp %d tucss %d len %d\n", tp->tcp, css, len);
373 if (tp->tcp) {
374 sofar = frames * tp->mss;
375 cpu_to_be32wu((uint32_t *)(tp->data+css+4), // seq
376 be32_to_cpupu((uint32_t *)(tp->data+css+4))+sofar);
377 if (tp->paylen - sofar > tp->mss)
378 tp->data[css + 13] &= ~9; // PSH, FIN
379 } else // UDP
380 cpu_to_be16wu((uint16_t *)(tp->data+css+4), len);
381 if (tp->sum_needed & E1000_TXD_POPTS_TXSM) {
382 unsigned int phsum;
383 // add pseudo-header length before checksum calculation
384 sp = (uint16_t *)(tp->data + tp->tucso);
385 phsum = be16_to_cpup(sp) + len;
386 phsum = (phsum >> 16) + (phsum & 0xffff);
387 cpu_to_be16wu(sp, phsum);
388 }
389 tp->tso_frames++;
390 }
391
392 if (tp->sum_needed & E1000_TXD_POPTS_TXSM)
393 putsum(tp->data, tp->size, tp->tucso, tp->tucss, tp->tucse);
394 if (tp->sum_needed & E1000_TXD_POPTS_IXSM)
395 putsum(tp->data, tp->size, tp->ipcso, tp->ipcss, tp->ipcse);
396 if (tp->vlan_needed) {
397 memmove(tp->vlan, tp->data, 4);
398 memmove(tp->data, tp->data + 4, 8);
399 memcpy(tp->data + 8, tp->vlan_header, 4);
400 qemu_send_packet(&s->nic->nc, tp->vlan, tp->size + 4);
401 } else
402 qemu_send_packet(&s->nic->nc, tp->data, tp->size);
403 s->mac_reg[TPT]++;
404 s->mac_reg[GPTC]++;
405 n = s->mac_reg[TOTL];
406 if ((s->mac_reg[TOTL] += s->tx.size) < n)
407 s->mac_reg[TOTH]++;
408 }
409
410 static void
411 process_tx_desc(E1000State *s, struct e1000_tx_desc *dp)
412 {
413 uint32_t txd_lower = le32_to_cpu(dp->lower.data);
414 uint32_t dtype = txd_lower & (E1000_TXD_CMD_DEXT | E1000_TXD_DTYP_D);
415 unsigned int split_size = txd_lower & 0xffff, bytes, sz, op;
416 unsigned int msh = 0xfffff, hdr = 0;
417 uint64_t addr;
418 struct e1000_context_desc *xp = (struct e1000_context_desc *)dp;
419 struct e1000_tx *tp = &s->tx;
420
421 if (dtype == E1000_TXD_CMD_DEXT) { // context descriptor
422 op = le32_to_cpu(xp->cmd_and_length);
423 tp->ipcss = xp->lower_setup.ip_fields.ipcss;
424 tp->ipcso = xp->lower_setup.ip_fields.ipcso;
425 tp->ipcse = le16_to_cpu(xp->lower_setup.ip_fields.ipcse);
426 tp->tucss = xp->upper_setup.tcp_fields.tucss;
427 tp->tucso = xp->upper_setup.tcp_fields.tucso;
428 tp->tucse = le16_to_cpu(xp->upper_setup.tcp_fields.tucse);
429 tp->paylen = op & 0xfffff;
430 tp->hdr_len = xp->tcp_seg_setup.fields.hdr_len;
431 tp->mss = le16_to_cpu(xp->tcp_seg_setup.fields.mss);
432 tp->ip = (op & E1000_TXD_CMD_IP) ? 1 : 0;
433 tp->tcp = (op & E1000_TXD_CMD_TCP) ? 1 : 0;
434 tp->tse = (op & E1000_TXD_CMD_TSE) ? 1 : 0;
435 tp->tso_frames = 0;
436 if (tp->tucso == 0) { // this is probably wrong
437 DBGOUT(TXSUM, "TCP/UDP: cso 0!\n");
438 tp->tucso = tp->tucss + (tp->tcp ? 16 : 6);
439 }
440 return;
441 } else if (dtype == (E1000_TXD_CMD_DEXT | E1000_TXD_DTYP_D)) {
442 // data descriptor
443 if (tp->size == 0) {
444 tp->sum_needed = le32_to_cpu(dp->upper.data) >> 8;
445 }
446 tp->cptse = ( txd_lower & E1000_TXD_CMD_TSE ) ? 1 : 0;
447 } else {
448 // legacy descriptor
449 tp->cptse = 0;
450 }
451
452 if (vlan_enabled(s) && is_vlan_txd(txd_lower) &&
453 (tp->cptse || txd_lower & E1000_TXD_CMD_EOP)) {
454 tp->vlan_needed = 1;
455 cpu_to_be16wu((uint16_t *)(tp->vlan_header),
456 le16_to_cpup((uint16_t *)(s->mac_reg + VET)));
457 cpu_to_be16wu((uint16_t *)(tp->vlan_header + 2),
458 le16_to_cpu(dp->upper.fields.special));
459 }
460
461 addr = le64_to_cpu(dp->buffer_addr);
462 if (tp->tse && tp->cptse) {
463 hdr = tp->hdr_len;
464 msh = hdr + tp->mss;
465 do {
466 bytes = split_size;
467 if (tp->size + bytes > msh)
468 bytes = msh - tp->size;
469
470 bytes = MIN(sizeof(tp->data) - tp->size, bytes);
471 pci_dma_read(&s->dev, addr, tp->data + tp->size, bytes);
472 if ((sz = tp->size + bytes) >= hdr && tp->size < hdr)
473 memmove(tp->header, tp->data, hdr);
474 tp->size = sz;
475 addr += bytes;
476 if (sz == msh) {
477 xmit_seg(s);
478 memmove(tp->data, tp->header, hdr);
479 tp->size = hdr;
480 }
481 } while (split_size -= bytes);
482 } else if (!tp->tse && tp->cptse) {
483 // context descriptor TSE is not set, while data descriptor TSE is set
484 DBGOUT(TXERR, "TCP segmentaion Error\n");
485 } else {
486 split_size = MIN(sizeof(tp->data) - tp->size, split_size);
487 pci_dma_read(&s->dev, addr, tp->data + tp->size, split_size);
488 tp->size += split_size;
489 }
490
491 if (!(txd_lower & E1000_TXD_CMD_EOP))
492 return;
493 if (!(tp->tse && tp->cptse && tp->size < hdr))
494 xmit_seg(s);
495 tp->tso_frames = 0;
496 tp->sum_needed = 0;
497 tp->vlan_needed = 0;
498 tp->size = 0;
499 tp->cptse = 0;
500 }
501
502 static uint32_t
503 txdesc_writeback(E1000State *s, dma_addr_t base, struct e1000_tx_desc *dp)
504 {
505 uint32_t txd_upper, txd_lower = le32_to_cpu(dp->lower.data);
506
507 if (!(txd_lower & (E1000_TXD_CMD_RS|E1000_TXD_CMD_RPS)))
508 return 0;
509 txd_upper = (le32_to_cpu(dp->upper.data) | E1000_TXD_STAT_DD) &
510 ~(E1000_TXD_STAT_EC | E1000_TXD_STAT_LC | E1000_TXD_STAT_TU);
511 dp->upper.data = cpu_to_le32(txd_upper);
512 pci_dma_write(&s->dev, base + ((char *)&dp->upper - (char *)dp),
513 (void *)&dp->upper, sizeof(dp->upper));
514 return E1000_ICR_TXDW;
515 }
516
517 static uint64_t tx_desc_base(E1000State *s)
518 {
519 uint64_t bah = s->mac_reg[TDBAH];
520 uint64_t bal = s->mac_reg[TDBAL] & ~0xf;
521
522 return (bah << 32) + bal;
523 }
524
525 static void
526 start_xmit(E1000State *s)
527 {
528 dma_addr_t base;
529 struct e1000_tx_desc desc;
530 uint32_t tdh_start = s->mac_reg[TDH], cause = E1000_ICS_TXQE;
531
532 if (!(s->mac_reg[TCTL] & E1000_TCTL_EN)) {
533 DBGOUT(TX, "tx disabled\n");
534 return;
535 }
536
537 while (s->mac_reg[TDH] != s->mac_reg[TDT]) {
538 base = tx_desc_base(s) +
539 sizeof(struct e1000_tx_desc) * s->mac_reg[TDH];
540 pci_dma_read(&s->dev, base, (void *)&desc, sizeof(desc));
541
542 DBGOUT(TX, "index %d: %p : %x %x\n", s->mac_reg[TDH],
543 (void *)(intptr_t)desc.buffer_addr, desc.lower.data,
544 desc.upper.data);
545
546 process_tx_desc(s, &desc);
547 cause |= txdesc_writeback(s, base, &desc);
548
549 if (++s->mac_reg[TDH] * sizeof(desc) >= s->mac_reg[TDLEN])
550 s->mac_reg[TDH] = 0;
551 /*
552 * the following could happen only if guest sw assigns
553 * bogus values to TDT/TDLEN.
554 * there's nothing too intelligent we could do about this.
555 */
556 if (s->mac_reg[TDH] == tdh_start) {
557 DBGOUT(TXERR, "TDH wraparound @%x, TDT %x, TDLEN %x\n",
558 tdh_start, s->mac_reg[TDT], s->mac_reg[TDLEN]);
559 break;
560 }
561 }
562 set_ics(s, 0, cause);
563 }
564
565 static int
566 receive_filter(E1000State *s, const uint8_t *buf, int size)
567 {
568 static const uint8_t bcast[] = {0xff, 0xff, 0xff, 0xff, 0xff, 0xff};
569 static const int mta_shift[] = {4, 3, 2, 0};
570 uint32_t f, rctl = s->mac_reg[RCTL], ra[2], *rp;
571
572 if (is_vlan_packet(s, buf) && vlan_rx_filter_enabled(s)) {
573 uint16_t vid = be16_to_cpup((uint16_t *)(buf + 14));
574 uint32_t vfta = le32_to_cpup((uint32_t *)(s->mac_reg + VFTA) +
575 ((vid >> 5) & 0x7f));
576 if ((vfta & (1 << (vid & 0x1f))) == 0)
577 return 0;
578 }
579
580 if (rctl & E1000_RCTL_UPE) // promiscuous
581 return 1;
582
583 if ((buf[0] & 1) && (rctl & E1000_RCTL_MPE)) // promiscuous mcast
584 return 1;
585
586 if ((rctl & E1000_RCTL_BAM) && !memcmp(buf, bcast, sizeof bcast))
587 return 1;
588
589 for (rp = s->mac_reg + RA; rp < s->mac_reg + RA + 32; rp += 2) {
590 if (!(rp[1] & E1000_RAH_AV))
591 continue;
592 ra[0] = cpu_to_le32(rp[0]);
593 ra[1] = cpu_to_le32(rp[1]);
594 if (!memcmp(buf, (uint8_t *)ra, 6)) {
595 DBGOUT(RXFILTER,
596 "unicast match[%d]: %02x:%02x:%02x:%02x:%02x:%02x\n",
597 (int)(rp - s->mac_reg - RA)/2,
598 buf[0], buf[1], buf[2], buf[3], buf[4], buf[5]);
599 return 1;
600 }
601 }
602 DBGOUT(RXFILTER, "unicast mismatch: %02x:%02x:%02x:%02x:%02x:%02x\n",
603 buf[0], buf[1], buf[2], buf[3], buf[4], buf[5]);
604
605 f = mta_shift[(rctl >> E1000_RCTL_MO_SHIFT) & 3];
606 f = (((buf[5] << 8) | buf[4]) >> f) & 0xfff;
607 if (s->mac_reg[MTA + (f >> 5)] & (1 << (f & 0x1f)))
608 return 1;
609 DBGOUT(RXFILTER,
610 "dropping, inexact filter mismatch: %02x:%02x:%02x:%02x:%02x:%02x MO %d MTA[%d] %x\n",
611 buf[0], buf[1], buf[2], buf[3], buf[4], buf[5],
612 (rctl >> E1000_RCTL_MO_SHIFT) & 3, f >> 5,
613 s->mac_reg[MTA + (f >> 5)]);
614
615 return 0;
616 }
617
618 static void
619 e1000_set_link_status(VLANClientState *nc)
620 {
621 E1000State *s = DO_UPCAST(NICState, nc, nc)->opaque;
622 uint32_t old_status = s->mac_reg[STATUS];
623
624 if (nc->link_down) {
625 s->mac_reg[STATUS] &= ~E1000_STATUS_LU;
626 s->phy_reg[PHY_STATUS] &= ~MII_SR_LINK_STATUS;
627 } else {
628 s->mac_reg[STATUS] |= E1000_STATUS_LU;
629 s->phy_reg[PHY_STATUS] |= MII_SR_LINK_STATUS;
630 }
631
632 if (s->mac_reg[STATUS] != old_status)
633 set_ics(s, 0, E1000_ICR_LSC);
634 }
635
636 static bool e1000_has_rxbufs(E1000State *s, size_t total_size)
637 {
638 int bufs;
639 /* Fast-path short packets */
640 if (total_size <= s->rxbuf_size) {
641 return s->mac_reg[RDH] != s->mac_reg[RDT] || !s->check_rxov;
642 }
643 if (s->mac_reg[RDH] < s->mac_reg[RDT]) {
644 bufs = s->mac_reg[RDT] - s->mac_reg[RDH];
645 } else if (s->mac_reg[RDH] > s->mac_reg[RDT] || !s->check_rxov) {
646 bufs = s->mac_reg[RDLEN] / sizeof(struct e1000_rx_desc) +
647 s->mac_reg[RDT] - s->mac_reg[RDH];
648 } else {
649 return false;
650 }
651 return total_size <= bufs * s->rxbuf_size;
652 }
653
654 static int
655 e1000_can_receive(VLANClientState *nc)
656 {
657 E1000State *s = DO_UPCAST(NICState, nc, nc)->opaque;
658
659 return (s->mac_reg[RCTL] & E1000_RCTL_EN) && e1000_has_rxbufs(s, 1);
660 }
661
662 static uint64_t rx_desc_base(E1000State *s)
663 {
664 uint64_t bah = s->mac_reg[RDBAH];
665 uint64_t bal = s->mac_reg[RDBAL] & ~0xf;
666
667 return (bah << 32) + bal;
668 }
669
670 static ssize_t
671 e1000_receive(VLANClientState *nc, const uint8_t *buf, size_t size)
672 {
673 E1000State *s = DO_UPCAST(NICState, nc, nc)->opaque;
674 struct e1000_rx_desc desc;
675 dma_addr_t base;
676 unsigned int n, rdt;
677 uint32_t rdh_start;
678 uint16_t vlan_special = 0;
679 uint8_t vlan_status = 0, vlan_offset = 0;
680 uint8_t min_buf[MIN_BUF_SIZE];
681 size_t desc_offset;
682 size_t desc_size;
683 size_t total_size;
684
685 if (!(s->mac_reg[RCTL] & E1000_RCTL_EN))
686 return -1;
687
688 /* Pad to minimum Ethernet frame length */
689 if (size < sizeof(min_buf)) {
690 memcpy(min_buf, buf, size);
691 memset(&min_buf[size], 0, sizeof(min_buf) - size);
692 buf = min_buf;
693 size = sizeof(min_buf);
694 }
695
696 if (!receive_filter(s, buf, size))
697 return size;
698
699 if (vlan_enabled(s) && is_vlan_packet(s, buf)) {
700 vlan_special = cpu_to_le16(be16_to_cpup((uint16_t *)(buf + 14)));
701 memmove((uint8_t *)buf + 4, buf, 12);
702 vlan_status = E1000_RXD_STAT_VP;
703 vlan_offset = 4;
704 size -= 4;
705 }
706
707 rdh_start = s->mac_reg[RDH];
708 desc_offset = 0;
709 total_size = size + fcs_len(s);
710 if (!e1000_has_rxbufs(s, total_size)) {
711 set_ics(s, 0, E1000_ICS_RXO);
712 return -1;
713 }
714 do {
715 desc_size = total_size - desc_offset;
716 if (desc_size > s->rxbuf_size) {
717 desc_size = s->rxbuf_size;
718 }
719 base = rx_desc_base(s) + sizeof(desc) * s->mac_reg[RDH];
720 pci_dma_read(&s->dev, base, (void *)&desc, sizeof(desc));
721 desc.special = vlan_special;
722 desc.status |= (vlan_status | E1000_RXD_STAT_DD);
723 if (desc.buffer_addr) {
724 if (desc_offset < size) {
725 size_t copy_size = size - desc_offset;
726 if (copy_size > s->rxbuf_size) {
727 copy_size = s->rxbuf_size;
728 }
729 pci_dma_write(&s->dev, le64_to_cpu(desc.buffer_addr),
730 (void *)(buf + desc_offset + vlan_offset),
731 copy_size);
732 }
733 desc_offset += desc_size;
734 desc.length = cpu_to_le16(desc_size);
735 if (desc_offset >= total_size) {
736 desc.status |= E1000_RXD_STAT_EOP | E1000_RXD_STAT_IXSM;
737 } else {
738 /* Guest zeroing out status is not a hardware requirement.
739 Clear EOP in case guest didn't do it. */
740 desc.status &= ~E1000_RXD_STAT_EOP;
741 }
742 } else { // as per intel docs; skip descriptors with null buf addr
743 DBGOUT(RX, "Null RX descriptor!!\n");
744 }
745 pci_dma_write(&s->dev, base, (void *)&desc, sizeof(desc));
746
747 if (++s->mac_reg[RDH] * sizeof(desc) >= s->mac_reg[RDLEN])
748 s->mac_reg[RDH] = 0;
749 s->check_rxov = 1;
750 /* see comment in start_xmit; same here */
751 if (s->mac_reg[RDH] == rdh_start) {
752 DBGOUT(RXERR, "RDH wraparound @%x, RDT %x, RDLEN %x\n",
753 rdh_start, s->mac_reg[RDT], s->mac_reg[RDLEN]);
754 set_ics(s, 0, E1000_ICS_RXO);
755 return -1;
756 }
757 } while (desc_offset < total_size);
758
759 s->mac_reg[GPRC]++;
760 s->mac_reg[TPR]++;
761 /* TOR - Total Octets Received:
762 * This register includes bytes received in a packet from the <Destination
763 * Address> field through the <CRC> field, inclusively.
764 */
765 n = s->mac_reg[TORL] + size + /* Always include FCS length. */ 4;
766 if (n < s->mac_reg[TORL])
767 s->mac_reg[TORH]++;
768 s->mac_reg[TORL] = n;
769
770 n = E1000_ICS_RXT0;
771 if ((rdt = s->mac_reg[RDT]) < s->mac_reg[RDH])
772 rdt += s->mac_reg[RDLEN] / sizeof(desc);
773 if (((rdt - s->mac_reg[RDH]) * sizeof(desc)) <= s->mac_reg[RDLEN] >>
774 s->rxbuf_min_shift)
775 n |= E1000_ICS_RXDMT0;
776
777 set_ics(s, 0, n);
778
779 return size;
780 }
781
782 static uint32_t
783 mac_readreg(E1000State *s, int index)
784 {
785 return s->mac_reg[index];
786 }
787
788 static uint32_t
789 mac_icr_read(E1000State *s, int index)
790 {
791 uint32_t ret = s->mac_reg[ICR];
792
793 DBGOUT(INTERRUPT, "ICR read: %x\n", ret);
794 set_interrupt_cause(s, 0, 0);
795 return ret;
796 }
797
798 static uint32_t
799 mac_read_clr4(E1000State *s, int index)
800 {
801 uint32_t ret = s->mac_reg[index];
802
803 s->mac_reg[index] = 0;
804 return ret;
805 }
806
807 static uint32_t
808 mac_read_clr8(E1000State *s, int index)
809 {
810 uint32_t ret = s->mac_reg[index];
811
812 s->mac_reg[index] = 0;
813 s->mac_reg[index-1] = 0;
814 return ret;
815 }
816
817 static void
818 mac_writereg(E1000State *s, int index, uint32_t val)
819 {
820 s->mac_reg[index] = val;
821 }
822
823 static void
824 set_rdt(E1000State *s, int index, uint32_t val)
825 {
826 s->check_rxov = 0;
827 s->mac_reg[index] = val & 0xffff;
828 }
829
830 static void
831 set_16bit(E1000State *s, int index, uint32_t val)
832 {
833 s->mac_reg[index] = val & 0xffff;
834 }
835
836 static void
837 set_dlen(E1000State *s, int index, uint32_t val)
838 {
839 s->mac_reg[index] = val & 0xfff80;
840 }
841
842 static void
843 set_tctl(E1000State *s, int index, uint32_t val)
844 {
845 s->mac_reg[index] = val;
846 s->mac_reg[TDT] &= 0xffff;
847 start_xmit(s);
848 }
849
850 static void
851 set_icr(E1000State *s, int index, uint32_t val)
852 {
853 DBGOUT(INTERRUPT, "set_icr %x\n", val);
854 set_interrupt_cause(s, 0, s->mac_reg[ICR] & ~val);
855 }
856
857 static void
858 set_imc(E1000State *s, int index, uint32_t val)
859 {
860 s->mac_reg[IMS] &= ~val;
861 set_ics(s, 0, 0);
862 }
863
864 static void
865 set_ims(E1000State *s, int index, uint32_t val)
866 {
867 s->mac_reg[IMS] |= val;
868 set_ics(s, 0, 0);
869 }
870
871 #define getreg(x) [x] = mac_readreg
872 static uint32_t (*macreg_readops[])(E1000State *, int) = {
873 getreg(PBA), getreg(RCTL), getreg(TDH), getreg(TXDCTL),
874 getreg(WUFC), getreg(TDT), getreg(CTRL), getreg(LEDCTL),
875 getreg(MANC), getreg(MDIC), getreg(SWSM), getreg(STATUS),
876 getreg(TORL), getreg(TOTL), getreg(IMS), getreg(TCTL),
877 getreg(RDH), getreg(RDT), getreg(VET), getreg(ICS),
878 getreg(TDBAL), getreg(TDBAH), getreg(RDBAH), getreg(RDBAL),
879 getreg(TDLEN), getreg(RDLEN),
880
881 [TOTH] = mac_read_clr8, [TORH] = mac_read_clr8, [GPRC] = mac_read_clr4,
882 [GPTC] = mac_read_clr4, [TPR] = mac_read_clr4, [TPT] = mac_read_clr4,
883 [ICR] = mac_icr_read, [EECD] = get_eecd, [EERD] = flash_eerd_read,
884 [CRCERRS ... MPC] = &mac_readreg,
885 [RA ... RA+31] = &mac_readreg,
886 [MTA ... MTA+127] = &mac_readreg,
887 [VFTA ... VFTA+127] = &mac_readreg,
888 };
889 enum { NREADOPS = ARRAY_SIZE(macreg_readops) };
890
891 #define putreg(x) [x] = mac_writereg
892 static void (*macreg_writeops[])(E1000State *, int, uint32_t) = {
893 putreg(PBA), putreg(EERD), putreg(SWSM), putreg(WUFC),
894 putreg(TDBAL), putreg(TDBAH), putreg(TXDCTL), putreg(RDBAH),
895 putreg(RDBAL), putreg(LEDCTL), putreg(VET),
896 [TDLEN] = set_dlen, [RDLEN] = set_dlen, [TCTL] = set_tctl,
897 [TDT] = set_tctl, [MDIC] = set_mdic, [ICS] = set_ics,
898 [TDH] = set_16bit, [RDH] = set_16bit, [RDT] = set_rdt,
899 [IMC] = set_imc, [IMS] = set_ims, [ICR] = set_icr,
900 [EECD] = set_eecd, [RCTL] = set_rx_control, [CTRL] = set_ctrl,
901 [RA ... RA+31] = &mac_writereg,
902 [MTA ... MTA+127] = &mac_writereg,
903 [VFTA ... VFTA+127] = &mac_writereg,
904 };
905 enum { NWRITEOPS = ARRAY_SIZE(macreg_writeops) };
906
907 static void
908 e1000_mmio_write(void *opaque, target_phys_addr_t addr, uint64_t val,
909 unsigned size)
910 {
911 E1000State *s = opaque;
912 unsigned int index = (addr & 0x1ffff) >> 2;
913
914 if (index < NWRITEOPS && macreg_writeops[index]) {
915 macreg_writeops[index](s, index, val);
916 } else if (index < NREADOPS && macreg_readops[index]) {
917 DBGOUT(MMIO, "e1000_mmio_writel RO %x: 0x%04"PRIx64"\n", index<<2, val);
918 } else {
919 DBGOUT(UNKNOWN, "MMIO unknown write addr=0x%08x,val=0x%08"PRIx64"\n",
920 index<<2, val);
921 }
922 }
923
924 static uint64_t
925 e1000_mmio_read(void *opaque, target_phys_addr_t addr, unsigned size)
926 {
927 E1000State *s = opaque;
928 unsigned int index = (addr & 0x1ffff) >> 2;
929
930 if (index < NREADOPS && macreg_readops[index])
931 {
932 return macreg_readops[index](s, index);
933 }
934 DBGOUT(UNKNOWN, "MMIO unknown read addr=0x%08x\n", index<<2);
935 return 0;
936 }
937
938 static const MemoryRegionOps e1000_mmio_ops = {
939 .read = e1000_mmio_read,
940 .write = e1000_mmio_write,
941 .endianness = DEVICE_LITTLE_ENDIAN,
942 .impl = {
943 .min_access_size = 4,
944 .max_access_size = 4,
945 },
946 };
947
948 static uint64_t e1000_io_read(void *opaque, target_phys_addr_t addr,
949 unsigned size)
950 {
951 E1000State *s = opaque;
952
953 (void)s;
954 return 0;
955 }
956
957 static void e1000_io_write(void *opaque, target_phys_addr_t addr,
958 uint64_t val, unsigned size)
959 {
960 E1000State *s = opaque;
961
962 (void)s;
963 }
964
965 static const MemoryRegionOps e1000_io_ops = {
966 .read = e1000_io_read,
967 .write = e1000_io_write,
968 .endianness = DEVICE_LITTLE_ENDIAN,
969 };
970
971 static bool is_version_1(void *opaque, int version_id)
972 {
973 return version_id == 1;
974 }
975
976 static const VMStateDescription vmstate_e1000 = {
977 .name = "e1000",
978 .version_id = 2,
979 .minimum_version_id = 1,
980 .minimum_version_id_old = 1,
981 .fields = (VMStateField []) {
982 VMSTATE_PCI_DEVICE(dev, E1000State),
983 VMSTATE_UNUSED_TEST(is_version_1, 4), /* was instance id */
984 VMSTATE_UNUSED(4), /* Was mmio_base. */
985 VMSTATE_UINT32(rxbuf_size, E1000State),
986 VMSTATE_UINT32(rxbuf_min_shift, E1000State),
987 VMSTATE_UINT32(eecd_state.val_in, E1000State),
988 VMSTATE_UINT16(eecd_state.bitnum_in, E1000State),
989 VMSTATE_UINT16(eecd_state.bitnum_out, E1000State),
990 VMSTATE_UINT16(eecd_state.reading, E1000State),
991 VMSTATE_UINT32(eecd_state.old_eecd, E1000State),
992 VMSTATE_UINT8(tx.ipcss, E1000State),
993 VMSTATE_UINT8(tx.ipcso, E1000State),
994 VMSTATE_UINT16(tx.ipcse, E1000State),
995 VMSTATE_UINT8(tx.tucss, E1000State),
996 VMSTATE_UINT8(tx.tucso, E1000State),
997 VMSTATE_UINT16(tx.tucse, E1000State),
998 VMSTATE_UINT32(tx.paylen, E1000State),
999 VMSTATE_UINT8(tx.hdr_len, E1000State),
1000 VMSTATE_UINT16(tx.mss, E1000State),
1001 VMSTATE_UINT16(tx.size, E1000State),
1002 VMSTATE_UINT16(tx.tso_frames, E1000State),
1003 VMSTATE_UINT8(tx.sum_needed, E1000State),
1004 VMSTATE_INT8(tx.ip, E1000State),
1005 VMSTATE_INT8(tx.tcp, E1000State),
1006 VMSTATE_BUFFER(tx.header, E1000State),
1007 VMSTATE_BUFFER(tx.data, E1000State),
1008 VMSTATE_UINT16_ARRAY(eeprom_data, E1000State, 64),
1009 VMSTATE_UINT16_ARRAY(phy_reg, E1000State, 0x20),
1010 VMSTATE_UINT32(mac_reg[CTRL], E1000State),
1011 VMSTATE_UINT32(mac_reg[EECD], E1000State),
1012 VMSTATE_UINT32(mac_reg[EERD], E1000State),
1013 VMSTATE_UINT32(mac_reg[GPRC], E1000State),
1014 VMSTATE_UINT32(mac_reg[GPTC], E1000State),
1015 VMSTATE_UINT32(mac_reg[ICR], E1000State),
1016 VMSTATE_UINT32(mac_reg[ICS], E1000State),
1017 VMSTATE_UINT32(mac_reg[IMC], E1000State),
1018 VMSTATE_UINT32(mac_reg[IMS], E1000State),
1019 VMSTATE_UINT32(mac_reg[LEDCTL], E1000State),
1020 VMSTATE_UINT32(mac_reg[MANC], E1000State),
1021 VMSTATE_UINT32(mac_reg[MDIC], E1000State),
1022 VMSTATE_UINT32(mac_reg[MPC], E1000State),
1023 VMSTATE_UINT32(mac_reg[PBA], E1000State),
1024 VMSTATE_UINT32(mac_reg[RCTL], E1000State),
1025 VMSTATE_UINT32(mac_reg[RDBAH], E1000State),
1026 VMSTATE_UINT32(mac_reg[RDBAL], E1000State),
1027 VMSTATE_UINT32(mac_reg[RDH], E1000State),
1028 VMSTATE_UINT32(mac_reg[RDLEN], E1000State),
1029 VMSTATE_UINT32(mac_reg[RDT], E1000State),
1030 VMSTATE_UINT32(mac_reg[STATUS], E1000State),
1031 VMSTATE_UINT32(mac_reg[SWSM], E1000State),
1032 VMSTATE_UINT32(mac_reg[TCTL], E1000State),
1033 VMSTATE_UINT32(mac_reg[TDBAH], E1000State),
1034 VMSTATE_UINT32(mac_reg[TDBAL], E1000State),
1035 VMSTATE_UINT32(mac_reg[TDH], E1000State),
1036 VMSTATE_UINT32(mac_reg[TDLEN], E1000State),
1037 VMSTATE_UINT32(mac_reg[TDT], E1000State),
1038 VMSTATE_UINT32(mac_reg[TORH], E1000State),
1039 VMSTATE_UINT32(mac_reg[TORL], E1000State),
1040 VMSTATE_UINT32(mac_reg[TOTH], E1000State),
1041 VMSTATE_UINT32(mac_reg[TOTL], E1000State),
1042 VMSTATE_UINT32(mac_reg[TPR], E1000State),
1043 VMSTATE_UINT32(mac_reg[TPT], E1000State),
1044 VMSTATE_UINT32(mac_reg[TXDCTL], E1000State),
1045 VMSTATE_UINT32(mac_reg[WUFC], E1000State),
1046 VMSTATE_UINT32(mac_reg[VET], E1000State),
1047 VMSTATE_UINT32_SUB_ARRAY(mac_reg, E1000State, RA, 32),
1048 VMSTATE_UINT32_SUB_ARRAY(mac_reg, E1000State, MTA, 128),
1049 VMSTATE_UINT32_SUB_ARRAY(mac_reg, E1000State, VFTA, 128),
1050 VMSTATE_END_OF_LIST()
1051 }
1052 };
1053
1054 static const uint16_t e1000_eeprom_template[64] = {
1055 0x0000, 0x0000, 0x0000, 0x0000, 0xffff, 0x0000, 0x0000, 0x0000,
1056 0x3000, 0x1000, 0x6403, E1000_DEVID, 0x8086, E1000_DEVID, 0x8086, 0x3040,
1057 0x0008, 0x2000, 0x7e14, 0x0048, 0x1000, 0x00d8, 0x0000, 0x2700,
1058 0x6cc9, 0x3150, 0x0722, 0x040b, 0x0984, 0x0000, 0xc000, 0x0706,
1059 0x1008, 0x0000, 0x0f04, 0x7fff, 0x4d01, 0xffff, 0xffff, 0xffff,
1060 0xffff, 0xffff, 0xffff, 0xffff, 0xffff, 0xffff, 0xffff, 0xffff,
1061 0x0100, 0x4000, 0x121c, 0xffff, 0xffff, 0xffff, 0xffff, 0xffff,
1062 0xffff, 0xffff, 0xffff, 0xffff, 0xffff, 0xffff, 0xffff, 0x0000,
1063 };
1064
1065 static const uint16_t phy_reg_init[] = {
1066 [PHY_CTRL] = 0x1140, [PHY_STATUS] = 0x796d, // link initially up
1067 [PHY_ID1] = 0x141, [PHY_ID2] = PHY_ID2_INIT,
1068 [PHY_1000T_CTRL] = 0x0e00, [M88E1000_PHY_SPEC_CTRL] = 0x360,
1069 [M88E1000_EXT_PHY_SPEC_CTRL] = 0x0d60, [PHY_AUTONEG_ADV] = 0xde1,
1070 [PHY_LP_ABILITY] = 0x1e0, [PHY_1000T_STATUS] = 0x3c00,
1071 [M88E1000_PHY_SPEC_STATUS] = 0xac00,
1072 };
1073
1074 static const uint32_t mac_reg_init[] = {
1075 [PBA] = 0x00100030,
1076 [LEDCTL] = 0x602,
1077 [CTRL] = E1000_CTRL_SWDPIN2 | E1000_CTRL_SWDPIN0 |
1078 E1000_CTRL_SPD_1000 | E1000_CTRL_SLU,
1079 [STATUS] = 0x80000000 | E1000_STATUS_GIO_MASTER_ENABLE |
1080 E1000_STATUS_ASDV | E1000_STATUS_MTXCKOK |
1081 E1000_STATUS_SPEED_1000 | E1000_STATUS_FD |
1082 E1000_STATUS_LU,
1083 [MANC] = E1000_MANC_EN_MNG2HOST | E1000_MANC_RCV_TCO_EN |
1084 E1000_MANC_ARP_EN | E1000_MANC_0298_EN |
1085 E1000_MANC_RMCP_EN,
1086 };
1087
1088 /* PCI interface */
1089
1090 static void
1091 e1000_mmio_setup(E1000State *d)
1092 {
1093 int i;
1094 const uint32_t excluded_regs[] = {
1095 E1000_MDIC, E1000_ICR, E1000_ICS, E1000_IMS,
1096 E1000_IMC, E1000_TCTL, E1000_TDT, PNPMMIO_SIZE
1097 };
1098
1099 memory_region_init_io(&d->mmio, &e1000_mmio_ops, d, "e1000-mmio",
1100 PNPMMIO_SIZE);
1101 memory_region_add_coalescing(&d->mmio, 0, excluded_regs[0]);
1102 for (i = 0; excluded_regs[i] != PNPMMIO_SIZE; i++)
1103 memory_region_add_coalescing(&d->mmio, excluded_regs[i] + 4,
1104 excluded_regs[i+1] - excluded_regs[i] - 4);
1105 memory_region_init_io(&d->io, &e1000_io_ops, d, "e1000-io", IOPORT_SIZE);
1106 }
1107
1108 static void
1109 e1000_cleanup(VLANClientState *nc)
1110 {
1111 E1000State *s = DO_UPCAST(NICState, nc, nc)->opaque;
1112
1113 s->nic = NULL;
1114 }
1115
1116 static int
1117 pci_e1000_uninit(PCIDevice *dev)
1118 {
1119 E1000State *d = DO_UPCAST(E1000State, dev, dev);
1120
1121 memory_region_destroy(&d->mmio);
1122 memory_region_destroy(&d->io);
1123 qemu_del_vlan_client(&d->nic->nc);
1124 return 0;
1125 }
1126
1127 static void e1000_reset(void *opaque)
1128 {
1129 E1000State *d = opaque;
1130
1131 memset(d->phy_reg, 0, sizeof d->phy_reg);
1132 memmove(d->phy_reg, phy_reg_init, sizeof phy_reg_init);
1133 memset(d->mac_reg, 0, sizeof d->mac_reg);
1134 memmove(d->mac_reg, mac_reg_init, sizeof mac_reg_init);
1135 d->rxbuf_min_shift = 1;
1136 memset(&d->tx, 0, sizeof d->tx);
1137 }
1138
1139 static NetClientInfo net_e1000_info = {
1140 .type = NET_CLIENT_TYPE_NIC,
1141 .size = sizeof(NICState),
1142 .can_receive = e1000_can_receive,
1143 .receive = e1000_receive,
1144 .cleanup = e1000_cleanup,
1145 .link_status_changed = e1000_set_link_status,
1146 };
1147
1148 static int pci_e1000_init(PCIDevice *pci_dev)
1149 {
1150 E1000State *d = DO_UPCAST(E1000State, dev, pci_dev);
1151 uint8_t *pci_conf;
1152 uint16_t checksum = 0;
1153 int i;
1154 uint8_t *macaddr;
1155
1156 pci_conf = d->dev.config;
1157
1158 /* TODO: RST# value should be 0, PCI spec 6.2.4 */
1159 pci_conf[PCI_CACHE_LINE_SIZE] = 0x10;
1160
1161 pci_conf[PCI_INTERRUPT_PIN] = 1; /* interrupt pin A */
1162
1163 e1000_mmio_setup(d);
1164
1165 pci_register_bar(&d->dev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &d->mmio);
1166
1167 pci_register_bar(&d->dev, 1, PCI_BASE_ADDRESS_SPACE_IO, &d->io);
1168
1169 memmove(d->eeprom_data, e1000_eeprom_template,
1170 sizeof e1000_eeprom_template);
1171 qemu_macaddr_default_if_unset(&d->conf.macaddr);
1172 macaddr = d->conf.macaddr.a;
1173 for (i = 0; i < 3; i++)
1174 d->eeprom_data[i] = (macaddr[2*i+1]<<8) | macaddr[2*i];
1175 for (i = 0; i < EEPROM_CHECKSUM_REG; i++)
1176 checksum += d->eeprom_data[i];
1177 checksum = (uint16_t) EEPROM_SUM - checksum;
1178 d->eeprom_data[EEPROM_CHECKSUM_REG] = checksum;
1179
1180 d->nic = qemu_new_nic(&net_e1000_info, &d->conf,
1181 d->dev.qdev.info->name, d->dev.qdev.id, d);
1182
1183 qemu_format_nic_info_str(&d->nic->nc, macaddr);
1184
1185 add_boot_device_path(d->conf.bootindex, &pci_dev->qdev, "/ethernet-phy@0");
1186
1187 return 0;
1188 }
1189
1190 static void qdev_e1000_reset(DeviceState *dev)
1191 {
1192 E1000State *d = DO_UPCAST(E1000State, dev.qdev, dev);
1193 e1000_reset(d);
1194 }
1195
1196 static PCIDeviceInfo e1000_info = {
1197 .qdev.name = "e1000",
1198 .qdev.desc = "Intel Gigabit Ethernet",
1199 .qdev.size = sizeof(E1000State),
1200 .qdev.reset = qdev_e1000_reset,
1201 .qdev.vmsd = &vmstate_e1000,
1202 .init = pci_e1000_init,
1203 .exit = pci_e1000_uninit,
1204 .romfile = "pxe-e1000.rom",
1205 .vendor_id = PCI_VENDOR_ID_INTEL,
1206 .device_id = E1000_DEVID,
1207 .revision = 0x03,
1208 .class_id = PCI_CLASS_NETWORK_ETHERNET,
1209 .qdev.props = (Property[]) {
1210 DEFINE_NIC_PROPERTIES(E1000State, conf),
1211 DEFINE_PROP_END_OF_LIST(),
1212 }
1213 };
1214
1215 static void e1000_register_devices(void)
1216 {
1217 pci_qdev_register(&e1000_info);
1218 }
1219
1220 device_init(e1000_register_devices)
QEmu