2 * i.MX Fast Ethernet Controller emulation.
4 * Copyright (c) 2013 Jean-Christophe Dubois. <jcd@tribudubois.net>
6 * Based on Coldfire Fast Ethernet Controller emulation.
8 * Copyright (c) 2007 CodeSourcery.
10 * This program is free software; you can redistribute it and/or modify it
11 * under the terms of the GNU General Public License as published by the
12 * Free Software Foundation; either version 2 of the License, or
13 * (at your option) any later version.
15 * This program is distributed in the hope that it will be useful, but WITHOUT
16 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
17 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
20 * You should have received a copy of the GNU General Public License along
21 * with this program; if not, see <http://www.gnu.org/licenses/>.
24 #include "qemu/osdep.h"
25 #include "hw/net/imx_fec.h"
26 #include "sysemu/dma.h"
33 #define DEBUG_IMX_FEC 0
36 #define FEC_PRINTF(fmt, args...) \
38 if (DEBUG_IMX_FEC) { \
39 fprintf(stderr, "[%s]%s: " fmt , TYPE_IMX_FEC, \
45 #define DEBUG_IMX_PHY 0
48 #define PHY_PRINTF(fmt, args...) \
50 if (DEBUG_IMX_PHY) { \
51 fprintf(stderr, "[%s.phy]%s: " fmt , TYPE_IMX_FEC, \
56 static const VMStateDescription vmstate_imx_fec
= {
59 .minimum_version_id
= 1,
60 .fields
= (VMStateField
[]) {
61 VMSTATE_UINT32(irq_state
, IMXFECState
),
62 VMSTATE_UINT32(eir
, IMXFECState
),
63 VMSTATE_UINT32(eimr
, IMXFECState
),
64 VMSTATE_UINT32(rx_enabled
, IMXFECState
),
65 VMSTATE_UINT32(rx_descriptor
, IMXFECState
),
66 VMSTATE_UINT32(tx_descriptor
, IMXFECState
),
67 VMSTATE_UINT32(ecr
, IMXFECState
),
68 VMSTATE_UINT32(mmfr
, IMXFECState
),
69 VMSTATE_UINT32(mscr
, IMXFECState
),
70 VMSTATE_UINT32(mibc
, IMXFECState
),
71 VMSTATE_UINT32(rcr
, IMXFECState
),
72 VMSTATE_UINT32(tcr
, IMXFECState
),
73 VMSTATE_UINT32(tfwr
, IMXFECState
),
74 VMSTATE_UINT32(frsr
, IMXFECState
),
75 VMSTATE_UINT32(erdsr
, IMXFECState
),
76 VMSTATE_UINT32(etdsr
, IMXFECState
),
77 VMSTATE_UINT32(emrbr
, IMXFECState
),
78 VMSTATE_UINT32(miigsk_cfgr
, IMXFECState
),
79 VMSTATE_UINT32(miigsk_enr
, IMXFECState
),
81 VMSTATE_UINT32(phy_status
, IMXFECState
),
82 VMSTATE_UINT32(phy_control
, IMXFECState
),
83 VMSTATE_UINT32(phy_advertise
, IMXFECState
),
84 VMSTATE_UINT32(phy_int
, IMXFECState
),
85 VMSTATE_UINT32(phy_int_mask
, IMXFECState
),
90 #define PHY_INT_ENERGYON (1 << 7)
91 #define PHY_INT_AUTONEG_COMPLETE (1 << 6)
92 #define PHY_INT_FAULT (1 << 5)
93 #define PHY_INT_DOWN (1 << 4)
94 #define PHY_INT_AUTONEG_LP (1 << 3)
95 #define PHY_INT_PARFAULT (1 << 2)
96 #define PHY_INT_AUTONEG_PAGE (1 << 1)
98 static void imx_fec_update(IMXFECState
*s
);
101 * The MII phy could raise a GPIO to the processor which in turn
102 * could be handled as an interrpt by the OS.
103 * For now we don't handle any GPIO/interrupt line, so the OS will
104 * have to poll for the PHY status.
106 static void phy_update_irq(IMXFECState
*s
)
111 static void phy_update_link(IMXFECState
*s
)
113 /* Autonegotiation status mirrors link status. */
114 if (qemu_get_queue(s
->nic
)->link_down
) {
115 PHY_PRINTF("link is down\n");
116 s
->phy_status
&= ~0x0024;
117 s
->phy_int
|= PHY_INT_DOWN
;
119 PHY_PRINTF("link is up\n");
120 s
->phy_status
|= 0x0024;
121 s
->phy_int
|= PHY_INT_ENERGYON
;
122 s
->phy_int
|= PHY_INT_AUTONEG_COMPLETE
;
127 static void imx_fec_set_link(NetClientState
*nc
)
129 phy_update_link(IMX_FEC(qemu_get_nic_opaque(nc
)));
132 static void phy_reset(IMXFECState
*s
)
134 s
->phy_status
= 0x7809;
135 s
->phy_control
= 0x3000;
136 s
->phy_advertise
= 0x01e1;
142 static uint32_t do_phy_read(IMXFECState
*s
, int reg
)
147 /* we only advertise one phy */
152 case 0: /* Basic Control */
153 val
= s
->phy_control
;
155 case 1: /* Basic Status */
164 case 4: /* Auto-neg advertisement */
165 val
= s
->phy_advertise
;
167 case 5: /* Auto-neg Link Partner Ability */
170 case 6: /* Auto-neg Expansion */
173 case 29: /* Interrupt source. */
178 case 30: /* Interrupt mask */
179 val
= s
->phy_int_mask
;
185 qemu_log_mask(LOG_UNIMP
, "[%s.phy]%s: reg %d not implemented\n",
186 TYPE_IMX_FEC
, __func__
, reg
);
190 qemu_log_mask(LOG_GUEST_ERROR
, "[%s.phy]%s: Bad address at offset %d\n",
191 TYPE_IMX_FEC
, __func__
, reg
);
196 PHY_PRINTF("read 0x%04x @ %d\n", val
, reg
);
201 static void do_phy_write(IMXFECState
*s
, int reg
, uint32_t val
)
203 PHY_PRINTF("write 0x%04x @ %d\n", val
, reg
);
206 /* we only advertise one phy */
211 case 0: /* Basic Control */
215 s
->phy_control
= val
& 0x7980;
216 /* Complete autonegotiation immediately. */
218 s
->phy_status
|= 0x0020;
222 case 4: /* Auto-neg advertisement */
223 s
->phy_advertise
= (val
& 0x2d7f) | 0x80;
225 case 30: /* Interrupt mask */
226 s
->phy_int_mask
= val
& 0xff;
233 qemu_log_mask(LOG_UNIMP
, "[%s.phy)%s: reg %d not implemented\n",
234 TYPE_IMX_FEC
, __func__
, reg
);
237 qemu_log_mask(LOG_GUEST_ERROR
, "[%s.phy]%s: Bad address at offset %d\n",
238 TYPE_IMX_FEC
, __func__
, reg
);
243 static void imx_fec_read_bd(IMXFECBufDesc
*bd
, dma_addr_t addr
)
245 dma_memory_read(&address_space_memory
, addr
, bd
, sizeof(*bd
));
248 static void imx_fec_write_bd(IMXFECBufDesc
*bd
, dma_addr_t addr
)
250 dma_memory_write(&address_space_memory
, addr
, bd
, sizeof(*bd
));
253 static void imx_fec_update(IMXFECState
*s
)
258 active
= s
->eir
& s
->eimr
;
259 changed
= active
^ s
->irq_state
;
261 qemu_set_irq(s
->irq
, active
);
263 s
->irq_state
= active
;
266 static void imx_fec_do_tx(IMXFECState
*s
)
269 uint8_t frame
[FEC_MAX_FRAME_SIZE
];
270 uint8_t *ptr
= frame
;
271 uint32_t addr
= s
->tx_descriptor
;
277 imx_fec_read_bd(&bd
, addr
);
278 FEC_PRINTF("tx_bd %x flags %04x len %d data %08x\n",
279 addr
, bd
.flags
, bd
.length
, bd
.data
);
280 if ((bd
.flags
& FEC_BD_R
) == 0) {
281 /* Run out of descriptors to transmit. */
285 if (frame_size
+ len
> FEC_MAX_FRAME_SIZE
) {
286 len
= FEC_MAX_FRAME_SIZE
- frame_size
;
287 s
->eir
|= FEC_INT_BABT
;
289 dma_memory_read(&address_space_memory
, bd
.data
, ptr
, len
);
292 if (bd
.flags
& FEC_BD_L
) {
293 /* Last buffer in frame. */
294 qemu_send_packet(qemu_get_queue(s
->nic
), frame
, len
);
297 s
->eir
|= FEC_INT_TXF
;
299 s
->eir
|= FEC_INT_TXB
;
300 bd
.flags
&= ~FEC_BD_R
;
301 /* Write back the modified descriptor. */
302 imx_fec_write_bd(&bd
, addr
);
303 /* Advance to the next descriptor. */
304 if ((bd
.flags
& FEC_BD_W
) != 0) {
311 s
->tx_descriptor
= addr
;
316 static void imx_fec_enable_rx(IMXFECState
*s
)
321 imx_fec_read_bd(&bd
, s
->rx_descriptor
);
323 tmp
= ((bd
.flags
& FEC_BD_E
) != 0);
326 FEC_PRINTF("RX buffer full\n");
327 } else if (!s
->rx_enabled
) {
328 qemu_flush_queued_packets(qemu_get_queue(s
->nic
));
334 static void imx_fec_reset(DeviceState
*d
)
336 IMXFECState
*s
= IMX_FEC(d
);
344 s
->mibc
= 0xc0000000;
352 /* We also reset the PHY */
356 static uint64_t imx_fec_read(void *opaque
, hwaddr addr
, unsigned size
)
358 IMXFECState
*s
= IMX_FEC(opaque
);
360 FEC_PRINTF("reading from @ 0x%" HWADDR_PRIx
"\n", addr
);
362 switch (addr
& 0x3ff) {
368 return s
->rx_enabled
? (1 << 24) : 0; /* RDAR */
378 return s
->mibc
; /* MIBC */
383 case 0x0e4: /* PALR */
384 return (s
->conf
.macaddr
.a
[0] << 24)
385 | (s
->conf
.macaddr
.a
[1] << 16)
386 | (s
->conf
.macaddr
.a
[2] << 8)
387 | s
->conf
.macaddr
.a
[3];
389 case 0x0e8: /* PAUR */
390 return (s
->conf
.macaddr
.a
[4] << 24)
391 | (s
->conf
.macaddr
.a
[5] << 16)
394 return 0x10000; /* OPD */
416 return s
->miigsk_cfgr
;
418 return s
->miigsk_enr
;
420 qemu_log_mask(LOG_GUEST_ERROR
, "[%s]%s: Bad address at offset 0x%"
421 HWADDR_PRIx
"\n", TYPE_IMX_FEC
, __func__
, addr
);
426 static void imx_fec_write(void *opaque
, hwaddr addr
,
427 uint64_t value
, unsigned size
)
429 IMXFECState
*s
= IMX_FEC(opaque
);
431 FEC_PRINTF("writing 0x%08x @ 0x%" HWADDR_PRIx
"\n", (int)value
, addr
);
433 switch (addr
& 0x3ff) {
434 case 0x004: /* EIR */
437 case 0x008: /* EIMR */
440 case 0x010: /* RDAR */
441 if ((s
->ecr
& FEC_EN
) && !s
->rx_enabled
) {
442 imx_fec_enable_rx(s
);
445 case 0x014: /* TDAR */
446 if (s
->ecr
& FEC_EN
) {
450 case 0x024: /* ECR */
452 if (value
& FEC_RESET
) {
453 imx_fec_reset(DEVICE(s
));
455 if ((s
->ecr
& FEC_EN
) == 0) {
459 case 0x040: /* MMFR */
460 /* store the value */
462 if (extract32(value
, 29, 1)) {
463 s
->mmfr
= do_phy_read(s
, extract32(value
, 18, 10));
465 do_phy_write(s
, extract32(value
, 18, 10), extract32(value
, 0, 16));
467 /* raise the interrupt as the PHY operation is done */
468 s
->eir
|= FEC_INT_MII
;
470 case 0x044: /* MSCR */
471 s
->mscr
= value
& 0xfe;
473 case 0x064: /* MIBC */
474 /* TODO: Implement MIB. */
475 s
->mibc
= (value
& 0x80000000) ? 0xc0000000 : 0;
477 case 0x084: /* RCR */
478 s
->rcr
= value
& 0x07ff003f;
479 /* TODO: Implement LOOP mode. */
481 case 0x0c4: /* TCR */
482 /* We transmit immediately, so raise GRA immediately. */
485 s
->eir
|= FEC_INT_GRA
;
488 case 0x0e4: /* PALR */
489 s
->conf
.macaddr
.a
[0] = value
>> 24;
490 s
->conf
.macaddr
.a
[1] = value
>> 16;
491 s
->conf
.macaddr
.a
[2] = value
>> 8;
492 s
->conf
.macaddr
.a
[3] = value
;
494 case 0x0e8: /* PAUR */
495 s
->conf
.macaddr
.a
[4] = value
>> 24;
496 s
->conf
.macaddr
.a
[5] = value
>> 16;
498 case 0x0ec: /* OPDR */
500 case 0x118: /* IAUR */
501 case 0x11c: /* IALR */
502 case 0x120: /* GAUR */
503 case 0x124: /* GALR */
504 /* TODO: implement MAC hash filtering. */
506 case 0x144: /* TFWR */
509 case 0x14c: /* FRBR */
510 /* FRBR writes ignored. */
512 case 0x150: /* FRSR */
513 s
->frsr
= (value
& 0x3fc) | 0x400;
515 case 0x180: /* ERDSR */
516 s
->erdsr
= value
& ~3;
517 s
->rx_descriptor
= s
->erdsr
;
519 case 0x184: /* ETDSR */
520 s
->etdsr
= value
& ~3;
521 s
->tx_descriptor
= s
->etdsr
;
523 case 0x188: /* EMRBR */
524 s
->emrbr
= value
& 0x7f0;
526 case 0x300: /* MIIGSK_CFGR */
527 s
->miigsk_cfgr
= value
& 0x53;
529 case 0x308: /* MIIGSK_ENR */
530 s
->miigsk_enr
= (value
& 0x2) ? 0x6 : 0;
533 qemu_log_mask(LOG_GUEST_ERROR
, "[%s]%s: Bad address at offset 0x%"
534 HWADDR_PRIx
"\n", TYPE_IMX_FEC
, __func__
, addr
);
541 static int imx_fec_can_receive(NetClientState
*nc
)
543 IMXFECState
*s
= IMX_FEC(qemu_get_nic_opaque(nc
));
545 return s
->rx_enabled
;
548 static ssize_t
imx_fec_receive(NetClientState
*nc
, const uint8_t *buf
,
551 IMXFECState
*s
= IMX_FEC(qemu_get_nic_opaque(nc
));
558 unsigned int buf_len
;
561 FEC_PRINTF("len %d\n", (int)size
);
563 if (!s
->rx_enabled
) {
564 qemu_log_mask(LOG_GUEST_ERROR
, "[%s]%s: Unexpected packet\n",
565 TYPE_IMX_FEC
, __func__
);
569 /* 4 bytes for the CRC. */
571 crc
= cpu_to_be32(crc32(~0, buf
, size
));
572 crc_ptr
= (uint8_t *) &crc
;
574 /* Huge frames are truncted. */
575 if (size
> FEC_MAX_FRAME_SIZE
) {
576 size
= FEC_MAX_FRAME_SIZE
;
577 flags
|= FEC_BD_TR
| FEC_BD_LG
;
580 /* Frames larger than the user limit just set error flags. */
581 if (size
> (s
->rcr
>> 16)) {
585 addr
= s
->rx_descriptor
;
587 imx_fec_read_bd(&bd
, addr
);
588 if ((bd
.flags
& FEC_BD_E
) == 0) {
589 /* No descriptors available. Bail out. */
591 * FIXME: This is wrong. We should probably either
592 * save the remainder for when more RX buffers are
593 * available, or flag an error.
595 qemu_log_mask(LOG_GUEST_ERROR
, "[%s]%s: Lost end of frame\n",
596 TYPE_IMX_FEC
, __func__
);
599 buf_len
= (size
<= s
->emrbr
) ? size
: s
->emrbr
;
603 FEC_PRINTF("rx_bd 0x%x length %d\n", addr
, bd
.length
);
605 /* The last 4 bytes are the CRC. */
610 dma_memory_write(&address_space_memory
, buf_addr
, buf
, buf_len
);
613 dma_memory_write(&address_space_memory
, buf_addr
+ buf_len
,
617 bd
.flags
&= ~FEC_BD_E
;
619 /* Last buffer in frame. */
620 bd
.flags
|= flags
| FEC_BD_L
;
621 FEC_PRINTF("rx frame flags %04x\n", bd
.flags
);
622 s
->eir
|= FEC_INT_RXF
;
624 s
->eir
|= FEC_INT_RXB
;
626 imx_fec_write_bd(&bd
, addr
);
627 /* Advance to the next descriptor. */
628 if ((bd
.flags
& FEC_BD_W
) != 0) {
634 s
->rx_descriptor
= addr
;
635 imx_fec_enable_rx(s
);
640 static const MemoryRegionOps imx_fec_ops
= {
641 .read
= imx_fec_read
,
642 .write
= imx_fec_write
,
643 .valid
.min_access_size
= 4,
644 .valid
.max_access_size
= 4,
645 .endianness
= DEVICE_NATIVE_ENDIAN
,
648 static void imx_fec_cleanup(NetClientState
*nc
)
650 IMXFECState
*s
= IMX_FEC(qemu_get_nic_opaque(nc
));
655 static NetClientInfo net_imx_fec_info
= {
656 .type
= NET_CLIENT_OPTIONS_KIND_NIC
,
657 .size
= sizeof(NICState
),
658 .can_receive
= imx_fec_can_receive
,
659 .receive
= imx_fec_receive
,
660 .cleanup
= imx_fec_cleanup
,
661 .link_status_changed
= imx_fec_set_link
,
665 static void imx_fec_realize(DeviceState
*dev
, Error
**errp
)
667 IMXFECState
*s
= IMX_FEC(dev
);
668 SysBusDevice
*sbd
= SYS_BUS_DEVICE(dev
);
670 memory_region_init_io(&s
->iomem
, OBJECT(dev
), &imx_fec_ops
, s
,
671 TYPE_IMX_FEC
, 0x400);
672 sysbus_init_mmio(sbd
, &s
->iomem
);
673 sysbus_init_irq(sbd
, &s
->irq
);
674 qemu_macaddr_default_if_unset(&s
->conf
.macaddr
);
676 s
->conf
.peers
.ncs
[0] = nd_table
[0].netdev
;
678 s
->nic
= qemu_new_nic(&net_imx_fec_info
, &s
->conf
,
679 object_get_typename(OBJECT(dev
)), DEVICE(dev
)->id
,
681 qemu_format_nic_info_str(qemu_get_queue(s
->nic
), s
->conf
.macaddr
.a
);
684 static Property imx_fec_properties
[] = {
685 DEFINE_NIC_PROPERTIES(IMXFECState
, conf
),
686 DEFINE_PROP_END_OF_LIST(),
689 static void imx_fec_class_init(ObjectClass
*klass
, void *data
)
691 DeviceClass
*dc
= DEVICE_CLASS(klass
);
693 dc
->vmsd
= &vmstate_imx_fec
;
694 dc
->reset
= imx_fec_reset
;
695 dc
->props
= imx_fec_properties
;
696 dc
->realize
= imx_fec_realize
;
697 dc
->desc
= "i.MX FEC Ethernet Controller";
700 static const TypeInfo imx_fec_info
= {
701 .name
= TYPE_IMX_FEC
,
702 .parent
= TYPE_SYS_BUS_DEVICE
,
703 .instance_size
= sizeof(IMXFECState
),
704 .class_init
= imx_fec_class_init
,
707 static void imx_fec_register_types(void)
709 type_register_static(&imx_fec_info
);
712 type_init(imx_fec_register_types
)