2 * i.MX Fast Ethernet Controller emulation.
4 * Copyright (c) 2013 Jean-Christophe Dubois. <jcd@tribudubois.net>
6 * Based on Coldfire Fast Ethernet Controller emulation.
8 * Copyright (c) 2007 CodeSourcery.
10 * This program is free software; you can redistribute it and/or modify it
11 * under the terms of the GNU General Public License as published by the
12 * Free Software Foundation; either version 2 of the License, or
13 * (at your option) any later version.
15 * This program is distributed in the hope that it will be useful, but WITHOUT
16 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
17 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
20 * You should have received a copy of the GNU General Public License along
21 * with this program; if not, see <http://www.gnu.org/licenses/>.
24 #include "qemu/osdep.h"
25 #include "hw/net/imx_fec.h"
26 #include "sysemu/dma.h"
32 #define DEBUG_IMX_FEC 0
35 #define FEC_PRINTF(fmt, args...) \
37 if (DEBUG_IMX_FEC) { \
38 fprintf(stderr, "[%s]%s: " fmt , TYPE_IMX_FEC, \
44 #define DEBUG_IMX_PHY 0
47 #define PHY_PRINTF(fmt, args...) \
49 if (DEBUG_IMX_PHY) { \
50 fprintf(stderr, "[%s.phy]%s: " fmt , TYPE_IMX_FEC, \
55 static const VMStateDescription vmstate_imx_fec
= {
58 .minimum_version_id
= 1,
59 .fields
= (VMStateField
[]) {
60 VMSTATE_UINT32(irq_state
, IMXFECState
),
61 VMSTATE_UINT32(eir
, IMXFECState
),
62 VMSTATE_UINT32(eimr
, IMXFECState
),
63 VMSTATE_UINT32(rx_enabled
, IMXFECState
),
64 VMSTATE_UINT32(rx_descriptor
, IMXFECState
),
65 VMSTATE_UINT32(tx_descriptor
, IMXFECState
),
66 VMSTATE_UINT32(ecr
, IMXFECState
),
67 VMSTATE_UINT32(mmfr
, IMXFECState
),
68 VMSTATE_UINT32(mscr
, IMXFECState
),
69 VMSTATE_UINT32(mibc
, IMXFECState
),
70 VMSTATE_UINT32(rcr
, IMXFECState
),
71 VMSTATE_UINT32(tcr
, IMXFECState
),
72 VMSTATE_UINT32(tfwr
, IMXFECState
),
73 VMSTATE_UINT32(frsr
, IMXFECState
),
74 VMSTATE_UINT32(erdsr
, IMXFECState
),
75 VMSTATE_UINT32(etdsr
, IMXFECState
),
76 VMSTATE_UINT32(emrbr
, IMXFECState
),
77 VMSTATE_UINT32(miigsk_cfgr
, IMXFECState
),
78 VMSTATE_UINT32(miigsk_enr
, IMXFECState
),
80 VMSTATE_UINT32(phy_status
, IMXFECState
),
81 VMSTATE_UINT32(phy_control
, IMXFECState
),
82 VMSTATE_UINT32(phy_advertise
, IMXFECState
),
83 VMSTATE_UINT32(phy_int
, IMXFECState
),
84 VMSTATE_UINT32(phy_int_mask
, IMXFECState
),
89 #define PHY_INT_ENERGYON (1 << 7)
90 #define PHY_INT_AUTONEG_COMPLETE (1 << 6)
91 #define PHY_INT_FAULT (1 << 5)
92 #define PHY_INT_DOWN (1 << 4)
93 #define PHY_INT_AUTONEG_LP (1 << 3)
94 #define PHY_INT_PARFAULT (1 << 2)
95 #define PHY_INT_AUTONEG_PAGE (1 << 1)
97 static void imx_fec_update(IMXFECState
*s
);
100 * The MII phy could raise a GPIO to the processor which in turn
101 * could be handled as an interrpt by the OS.
102 * For now we don't handle any GPIO/interrupt line, so the OS will
103 * have to poll for the PHY status.
105 static void phy_update_irq(IMXFECState
*s
)
110 static void phy_update_link(IMXFECState
*s
)
112 /* Autonegotiation status mirrors link status. */
113 if (qemu_get_queue(s
->nic
)->link_down
) {
114 PHY_PRINTF("link is down\n");
115 s
->phy_status
&= ~0x0024;
116 s
->phy_int
|= PHY_INT_DOWN
;
118 PHY_PRINTF("link is up\n");
119 s
->phy_status
|= 0x0024;
120 s
->phy_int
|= PHY_INT_ENERGYON
;
121 s
->phy_int
|= PHY_INT_AUTONEG_COMPLETE
;
126 static void imx_fec_set_link(NetClientState
*nc
)
128 phy_update_link(IMX_FEC(qemu_get_nic_opaque(nc
)));
131 static void phy_reset(IMXFECState
*s
)
133 s
->phy_status
= 0x7809;
134 s
->phy_control
= 0x3000;
135 s
->phy_advertise
= 0x01e1;
141 static uint32_t do_phy_read(IMXFECState
*s
, int reg
)
146 /* we only advertise one phy */
151 case 0: /* Basic Control */
152 val
= s
->phy_control
;
154 case 1: /* Basic Status */
163 case 4: /* Auto-neg advertisement */
164 val
= s
->phy_advertise
;
166 case 5: /* Auto-neg Link Partner Ability */
169 case 6: /* Auto-neg Expansion */
172 case 29: /* Interrupt source. */
177 case 30: /* Interrupt mask */
178 val
= s
->phy_int_mask
;
184 qemu_log_mask(LOG_UNIMP
, "[%s.phy]%s: reg %d not implemented\n",
185 TYPE_IMX_FEC
, __func__
, reg
);
189 qemu_log_mask(LOG_GUEST_ERROR
, "[%s.phy]%s: Bad address at offset %d\n",
190 TYPE_IMX_FEC
, __func__
, reg
);
195 PHY_PRINTF("read 0x%04x @ %d\n", val
, reg
);
200 static void do_phy_write(IMXFECState
*s
, int reg
, uint32_t val
)
202 PHY_PRINTF("write 0x%04x @ %d\n", val
, reg
);
205 /* we only advertise one phy */
210 case 0: /* Basic Control */
214 s
->phy_control
= val
& 0x7980;
215 /* Complete autonegotiation immediately. */
217 s
->phy_status
|= 0x0020;
221 case 4: /* Auto-neg advertisement */
222 s
->phy_advertise
= (val
& 0x2d7f) | 0x80;
224 case 30: /* Interrupt mask */
225 s
->phy_int_mask
= val
& 0xff;
232 qemu_log_mask(LOG_UNIMP
, "[%s.phy)%s: reg %d not implemented\n",
233 TYPE_IMX_FEC
, __func__
, reg
);
236 qemu_log_mask(LOG_GUEST_ERROR
, "[%s.phy]%s: Bad address at offset %d\n",
237 TYPE_IMX_FEC
, __func__
, reg
);
242 static void imx_fec_read_bd(IMXFECBufDesc
*bd
, dma_addr_t addr
)
244 dma_memory_read(&address_space_memory
, addr
, bd
, sizeof(*bd
));
247 static void imx_fec_write_bd(IMXFECBufDesc
*bd
, dma_addr_t addr
)
249 dma_memory_write(&address_space_memory
, addr
, bd
, sizeof(*bd
));
252 static void imx_fec_update(IMXFECState
*s
)
257 active
= s
->eir
& s
->eimr
;
258 changed
= active
^ s
->irq_state
;
260 qemu_set_irq(s
->irq
, active
);
262 s
->irq_state
= active
;
265 static void imx_fec_do_tx(IMXFECState
*s
)
268 uint8_t frame
[FEC_MAX_FRAME_SIZE
];
269 uint8_t *ptr
= frame
;
270 uint32_t addr
= s
->tx_descriptor
;
276 imx_fec_read_bd(&bd
, addr
);
277 FEC_PRINTF("tx_bd %x flags %04x len %d data %08x\n",
278 addr
, bd
.flags
, bd
.length
, bd
.data
);
279 if ((bd
.flags
& FEC_BD_R
) == 0) {
280 /* Run out of descriptors to transmit. */
284 if (frame_size
+ len
> FEC_MAX_FRAME_SIZE
) {
285 len
= FEC_MAX_FRAME_SIZE
- frame_size
;
286 s
->eir
|= FEC_INT_BABT
;
288 dma_memory_read(&address_space_memory
, bd
.data
, ptr
, len
);
291 if (bd
.flags
& FEC_BD_L
) {
292 /* Last buffer in frame. */
293 qemu_send_packet(qemu_get_queue(s
->nic
), frame
, len
);
296 s
->eir
|= FEC_INT_TXF
;
298 s
->eir
|= FEC_INT_TXB
;
299 bd
.flags
&= ~FEC_BD_R
;
300 /* Write back the modified descriptor. */
301 imx_fec_write_bd(&bd
, addr
);
302 /* Advance to the next descriptor. */
303 if ((bd
.flags
& FEC_BD_W
) != 0) {
310 s
->tx_descriptor
= addr
;
315 static void imx_fec_enable_rx(IMXFECState
*s
)
320 imx_fec_read_bd(&bd
, s
->rx_descriptor
);
322 tmp
= ((bd
.flags
& FEC_BD_E
) != 0);
325 FEC_PRINTF("RX buffer full\n");
326 } else if (!s
->rx_enabled
) {
327 qemu_flush_queued_packets(qemu_get_queue(s
->nic
));
333 static void imx_fec_reset(DeviceState
*d
)
335 IMXFECState
*s
= IMX_FEC(d
);
343 s
->mibc
= 0xc0000000;
351 /* We also reset the PHY */
355 static uint64_t imx_fec_read(void *opaque
, hwaddr addr
, unsigned size
)
357 IMXFECState
*s
= IMX_FEC(opaque
);
359 FEC_PRINTF("reading from @ 0x%" HWADDR_PRIx
"\n", addr
);
361 switch (addr
& 0x3ff) {
367 return s
->rx_enabled
? (1 << 24) : 0; /* RDAR */
377 return s
->mibc
; /* MIBC */
382 case 0x0e4: /* PALR */
383 return (s
->conf
.macaddr
.a
[0] << 24)
384 | (s
->conf
.macaddr
.a
[1] << 16)
385 | (s
->conf
.macaddr
.a
[2] << 8)
386 | s
->conf
.macaddr
.a
[3];
388 case 0x0e8: /* PAUR */
389 return (s
->conf
.macaddr
.a
[4] << 24)
390 | (s
->conf
.macaddr
.a
[5] << 16)
393 return 0x10000; /* OPD */
415 return s
->miigsk_cfgr
;
417 return s
->miigsk_enr
;
419 qemu_log_mask(LOG_GUEST_ERROR
, "[%s]%s: Bad address at offset 0x%"
420 HWADDR_PRIx
"\n", TYPE_IMX_FEC
, __func__
, addr
);
425 static void imx_fec_write(void *opaque
, hwaddr addr
,
426 uint64_t value
, unsigned size
)
428 IMXFECState
*s
= IMX_FEC(opaque
);
430 FEC_PRINTF("writing 0x%08x @ 0x%" HWADDR_PRIx
"\n", (int)value
, addr
);
432 switch (addr
& 0x3ff) {
433 case 0x004: /* EIR */
436 case 0x008: /* EIMR */
439 case 0x010: /* RDAR */
440 if ((s
->ecr
& FEC_EN
) && !s
->rx_enabled
) {
441 imx_fec_enable_rx(s
);
444 case 0x014: /* TDAR */
445 if (s
->ecr
& FEC_EN
) {
449 case 0x024: /* ECR */
451 if (value
& FEC_RESET
) {
452 imx_fec_reset(DEVICE(s
));
454 if ((s
->ecr
& FEC_EN
) == 0) {
458 case 0x040: /* MMFR */
459 /* store the value */
461 if (extract32(value
, 28, 1)) {
462 do_phy_write(s
, extract32(value
, 18, 9), extract32(value
, 0, 16));
464 s
->mmfr
= do_phy_read(s
, extract32(value
, 18, 9));
466 /* raise the interrupt as the PHY operation is done */
467 s
->eir
|= FEC_INT_MII
;
469 case 0x044: /* MSCR */
470 s
->mscr
= value
& 0xfe;
472 case 0x064: /* MIBC */
473 /* TODO: Implement MIB. */
474 s
->mibc
= (value
& 0x80000000) ? 0xc0000000 : 0;
476 case 0x084: /* RCR */
477 s
->rcr
= value
& 0x07ff003f;
478 /* TODO: Implement LOOP mode. */
480 case 0x0c4: /* TCR */
481 /* We transmit immediately, so raise GRA immediately. */
484 s
->eir
|= FEC_INT_GRA
;
487 case 0x0e4: /* PALR */
488 s
->conf
.macaddr
.a
[0] = value
>> 24;
489 s
->conf
.macaddr
.a
[1] = value
>> 16;
490 s
->conf
.macaddr
.a
[2] = value
>> 8;
491 s
->conf
.macaddr
.a
[3] = value
;
493 case 0x0e8: /* PAUR */
494 s
->conf
.macaddr
.a
[4] = value
>> 24;
495 s
->conf
.macaddr
.a
[5] = value
>> 16;
497 case 0x0ec: /* OPDR */
499 case 0x118: /* IAUR */
500 case 0x11c: /* IALR */
501 case 0x120: /* GAUR */
502 case 0x124: /* GALR */
503 /* TODO: implement MAC hash filtering. */
505 case 0x144: /* TFWR */
508 case 0x14c: /* FRBR */
509 /* FRBR writes ignored. */
511 case 0x150: /* FRSR */
512 s
->frsr
= (value
& 0x3fc) | 0x400;
514 case 0x180: /* ERDSR */
515 s
->erdsr
= value
& ~3;
516 s
->rx_descriptor
= s
->erdsr
;
518 case 0x184: /* ETDSR */
519 s
->etdsr
= value
& ~3;
520 s
->tx_descriptor
= s
->etdsr
;
522 case 0x188: /* EMRBR */
523 s
->emrbr
= value
& 0x7f0;
525 case 0x300: /* MIIGSK_CFGR */
526 s
->miigsk_cfgr
= value
& 0x53;
528 case 0x308: /* MIIGSK_ENR */
529 s
->miigsk_enr
= (value
& 0x2) ? 0x6 : 0;
532 qemu_log_mask(LOG_GUEST_ERROR
, "[%s]%s: Bad address at offset 0x%"
533 HWADDR_PRIx
"\n", TYPE_IMX_FEC
, __func__
, addr
);
540 static int imx_fec_can_receive(NetClientState
*nc
)
542 IMXFECState
*s
= IMX_FEC(qemu_get_nic_opaque(nc
));
544 return s
->rx_enabled
;
547 static ssize_t
imx_fec_receive(NetClientState
*nc
, const uint8_t *buf
,
550 IMXFECState
*s
= IMX_FEC(qemu_get_nic_opaque(nc
));
557 unsigned int buf_len
;
560 FEC_PRINTF("len %d\n", (int)size
);
562 if (!s
->rx_enabled
) {
563 qemu_log_mask(LOG_GUEST_ERROR
, "[%s]%s: Unexpected packet\n",
564 TYPE_IMX_FEC
, __func__
);
568 /* 4 bytes for the CRC. */
570 crc
= cpu_to_be32(crc32(~0, buf
, size
));
571 crc_ptr
= (uint8_t *) &crc
;
573 /* Huge frames are truncted. */
574 if (size
> FEC_MAX_FRAME_SIZE
) {
575 size
= FEC_MAX_FRAME_SIZE
;
576 flags
|= FEC_BD_TR
| FEC_BD_LG
;
579 /* Frames larger than the user limit just set error flags. */
580 if (size
> (s
->rcr
>> 16)) {
584 addr
= s
->rx_descriptor
;
586 imx_fec_read_bd(&bd
, addr
);
587 if ((bd
.flags
& FEC_BD_E
) == 0) {
588 /* No descriptors available. Bail out. */
590 * FIXME: This is wrong. We should probably either
591 * save the remainder for when more RX buffers are
592 * available, or flag an error.
594 qemu_log_mask(LOG_GUEST_ERROR
, "[%s]%s: Lost end of frame\n",
595 TYPE_IMX_FEC
, __func__
);
598 buf_len
= (size
<= s
->emrbr
) ? size
: s
->emrbr
;
602 FEC_PRINTF("rx_bd 0x%x length %d\n", addr
, bd
.length
);
604 /* The last 4 bytes are the CRC. */
609 dma_memory_write(&address_space_memory
, buf_addr
, buf
, buf_len
);
612 dma_memory_write(&address_space_memory
, buf_addr
+ buf_len
,
616 bd
.flags
&= ~FEC_BD_E
;
618 /* Last buffer in frame. */
619 bd
.flags
|= flags
| FEC_BD_L
;
620 FEC_PRINTF("rx frame flags %04x\n", bd
.flags
);
621 s
->eir
|= FEC_INT_RXF
;
623 s
->eir
|= FEC_INT_RXB
;
625 imx_fec_write_bd(&bd
, addr
);
626 /* Advance to the next descriptor. */
627 if ((bd
.flags
& FEC_BD_W
) != 0) {
633 s
->rx_descriptor
= addr
;
634 imx_fec_enable_rx(s
);
639 static const MemoryRegionOps imx_fec_ops
= {
640 .read
= imx_fec_read
,
641 .write
= imx_fec_write
,
642 .valid
.min_access_size
= 4,
643 .valid
.max_access_size
= 4,
644 .endianness
= DEVICE_NATIVE_ENDIAN
,
647 static void imx_fec_cleanup(NetClientState
*nc
)
649 IMXFECState
*s
= IMX_FEC(qemu_get_nic_opaque(nc
));
654 static NetClientInfo net_imx_fec_info
= {
655 .type
= NET_CLIENT_OPTIONS_KIND_NIC
,
656 .size
= sizeof(NICState
),
657 .can_receive
= imx_fec_can_receive
,
658 .receive
= imx_fec_receive
,
659 .cleanup
= imx_fec_cleanup
,
660 .link_status_changed
= imx_fec_set_link
,
664 static void imx_fec_realize(DeviceState
*dev
, Error
**errp
)
666 IMXFECState
*s
= IMX_FEC(dev
);
667 SysBusDevice
*sbd
= SYS_BUS_DEVICE(dev
);
669 memory_region_init_io(&s
->iomem
, OBJECT(dev
), &imx_fec_ops
, s
,
670 TYPE_IMX_FEC
, 0x400);
671 sysbus_init_mmio(sbd
, &s
->iomem
);
672 sysbus_init_irq(sbd
, &s
->irq
);
673 qemu_macaddr_default_if_unset(&s
->conf
.macaddr
);
675 s
->conf
.peers
.ncs
[0] = nd_table
[0].netdev
;
677 s
->nic
= qemu_new_nic(&net_imx_fec_info
, &s
->conf
,
678 object_get_typename(OBJECT(dev
)), DEVICE(dev
)->id
,
680 qemu_format_nic_info_str(qemu_get_queue(s
->nic
), s
->conf
.macaddr
.a
);
683 static Property imx_fec_properties
[] = {
684 DEFINE_NIC_PROPERTIES(IMXFECState
, conf
),
685 DEFINE_PROP_END_OF_LIST(),
688 static void imx_fec_class_init(ObjectClass
*klass
, void *data
)
690 DeviceClass
*dc
= DEVICE_CLASS(klass
);
692 dc
->vmsd
= &vmstate_imx_fec
;
693 dc
->reset
= imx_fec_reset
;
694 dc
->props
= imx_fec_properties
;
695 dc
->realize
= imx_fec_realize
;
696 dc
->desc
= "i.MX FEC Ethernet Controller";
699 static const TypeInfo imx_fec_info
= {
700 .name
= TYPE_IMX_FEC
,
701 .parent
= TYPE_SYS_BUS_DEVICE
,
702 .instance_size
= sizeof(IMXFECState
),
703 .class_init
= imx_fec_class_init
,
706 static void imx_fec_register_types(void)
708 type_register_static(&imx_fec_info
);
711 type_init(imx_fec_register_types
)