2 * i.MX Fast Ethernet Controller emulation.
6 * Based on Coldfire Fast Ethernet Controller emulation.
8 * Copyright (c) 2007 CodeSourcery.
10 * This program is free software; you can redistribute it and/or modify it
11 * under the terms of the GNU General Public License as published by the
12 * Free Software Foundation; either version 2 of the License, or
13 * (at your option) any later version.
15 * This program is distributed in the hope that it will be useful, but WITHOUT
16 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
17 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License
20 * You should have received a copy of the GNU General Public License along
21 * with this program; if not, see <http://www.gnu.org/licenses/>.
24 #include "qemu/osdep.h"
25 #include "hw/net/imx_fec.h"
26 #include "sysemu/dma.h"
28 #include "net/checksum.h"
35 #define DEBUG_IMX_FEC 0
38 #define FEC_PRINTF(fmt, args...) \
40 if (DEBUG_IMX_FEC) { \
41 fprintf(stderr, "[%s]%s: " fmt , TYPE_IMX_FEC, \
47 #define DEBUG_IMX_PHY 0
50 #define PHY_PRINTF(fmt, args...) \
52 if (DEBUG_IMX_PHY) { \
53 fprintf(stderr, "[%s.phy]%s: " fmt , TYPE_IMX_FEC, \
58 #define IMX_MAX_DESC 1024
60 static const char *imx_default_reg_name(IMXFECState *s, uint32_t index)
63 sprintf(tmp, "index %d", index);
67 static const char *imx_fec_reg_name(IMXFECState *s, uint32_t index)
74 case ENET_MIIGSK_CFGR:
79 return imx_default_reg_name(s, index);
83 static const char *imx_enet_reg_name(IMXFECState *s, uint32_t index)
141 return imx_default_reg_name(s, index);
145 static const char *imx_eth_reg_name(IMXFECState *s, uint32_t index)
192 return imx_fec_reg_name(s, index);
194 return imx_enet_reg_name(s, index);
200 * Versions of this device with more than one TX descriptor save the
201 * 2nd and 3rd descriptors in a subsection, to maintain migration
202 * compatibility with previous versions of the device that only
203 * supported a single descriptor.
205 static bool imx_eth_is_multi_tx_ring(void *opaque)
207 IMXFECState *s = IMX_FEC(opaque);
209 return s->tx_ring_num > 1;
212 static const VMStateDescription vmstate_imx_eth_txdescs = {
213 .name = "imx.fec/txdescs",
215 .minimum_version_id = 1,
216 .needed = imx_eth_is_multi_tx_ring,
217 .fields = (VMStateField[]) {
218 VMSTATE_UINT32(tx_descriptor[1], IMXFECState),
219 VMSTATE_UINT32(tx_descriptor[2], IMXFECState),
220 VMSTATE_END_OF_LIST()
224 static const VMStateDescription vmstate_imx_eth = {
225 .name = TYPE_IMX_FEC,
227 .minimum_version_id = 2,
228 .fields = (VMStateField[]) {
229 VMSTATE_UINT32_ARRAY(regs, IMXFECState, ENET_MAX),
230 VMSTATE_UINT32(rx_descriptor, IMXFECState),
231 VMSTATE_UINT32(tx_descriptor[0], IMXFECState),
232 VMSTATE_UINT32(phy_status, IMXFECState),
233 VMSTATE_UINT32(phy_control, IMXFECState),
234 VMSTATE_UINT32(phy_advertise, IMXFECState),
235 VMSTATE_UINT32(phy_int, IMXFECState),
236 VMSTATE_UINT32(phy_int_mask, IMXFECState),
237 VMSTATE_END_OF_LIST()
239 .subsections = (const VMStateDescription * []) {
240 &vmstate_imx_eth_txdescs,
245 #define PHY_INT_ENERGYON (1 << 7)
246 #define PHY_INT_AUTONEG_COMPLETE (1 << 6)
247 #define PHY_INT_FAULT (1 << 5)
248 #define PHY_INT_DOWN (1 << 4)
249 #define PHY_INT_AUTONEG_LP (1 << 3)
250 #define PHY_INT_PARFAULT (1 << 2)
251 #define PHY_INT_AUTONEG_PAGE (1 << 1)
253 static void imx_eth_update(IMXFECState *s);
256 * The MII phy could raise a GPIO to the processor which in turn
257 * could be handled as an interrpt by the OS.
258 * For now we don't handle any GPIO/interrupt line, so the OS will
259 * have to poll for the PHY status.
261 static void phy_update_irq(IMXFECState *s)
266 static void phy_update_link(IMXFECState *s)
268 /* Autonegotiation status mirrors link status. */
269 if (qemu_get_queue(s->nic)->link_down) {
270 PHY_PRINTF("link is down\n");
271 s->phy_status &= ~0x0024;
272 s->phy_int |= PHY_INT_DOWN;
274 PHY_PRINTF("link is up\n");
275 s->phy_status |= 0x0024;
276 s->phy_int |= PHY_INT_ENERGYON;
277 s->phy_int |= PHY_INT_AUTONEG_COMPLETE;
282 static void imx_eth_set_link(NetClientState *nc)
284 phy_update_link(IMX_FEC(qemu_get_nic_opaque(nc)));
287 static void phy_reset(IMXFECState *s)
289 s->phy_status = 0x7809;
290 s->phy_control = 0x3000;
291 s->phy_advertise = 0x01e1;
297 static uint32_t do_phy_read(IMXFECState *s, int reg)
302 /* we only advertise one phy */
307 case 0: /* Basic Control */
308 val = s->phy_control;
310 case 1: /* Basic Status */
319 case 4: /* Auto-neg advertisement */
320 val = s->phy_advertise;
322 case 5: /* Auto-neg Link Partner Ability */
325 case 6: /* Auto-neg Expansion */
328 case 29: /* Interrupt source. */
333 case 30: /* Interrupt mask */
334 val = s->phy_int_mask;
340 qemu_log_mask(LOG_UNIMP, "[%s.phy]%s: reg %d not implemented\n",
341 TYPE_IMX_FEC, __func__, reg);
345 qemu_log_mask(LOG_GUEST_ERROR, "[%s.phy]%s: Bad address at offset %d\n",
346 TYPE_IMX_FEC, __func__, reg);
351 PHY_PRINTF("read 0x%04x @ %d\n", val, reg);
356 static void do_phy_write(IMXFECState *s, int reg, uint32_t val)
358 PHY_PRINTF("write 0x%04x @ %d\n", val, reg);
361 /* we only advertise one phy */
366 case 0: /* Basic Control */
370 s->phy_control = val & 0x7980;
371 /* Complete autonegotiation immediately. */
373 s->phy_status |= 0x0020;
377 case 4: /* Auto-neg advertisement */
378 s->phy_advertise = (val & 0x2d7f) | 0x80;
380 case 30: /* Interrupt mask */
381 s->phy_int_mask = val & 0xff;
388 qemu_log_mask(LOG_UNIMP, "[%s.phy)%s: reg %d not implemented\n",
389 TYPE_IMX_FEC, __func__, reg);
392 qemu_log_mask(LOG_GUEST_ERROR, "[%s.phy]%s: Bad address at offset %d\n",
393 TYPE_IMX_FEC, __func__, reg);
398 static void imx_fec_read_bd(IMXFECBufDesc *bd, dma_addr_t addr)
400 dma_memory_read(&address_space_memory, addr, bd, sizeof(*bd));
403 static void imx_fec_write_bd(IMXFECBufDesc *bd, dma_addr_t addr)
405 dma_memory_write(&address_space_memory, addr, bd, sizeof(*bd));
408 static void imx_enet_read_bd(IMXENETBufDesc *bd, dma_addr_t addr)
410 dma_memory_read(&address_space_memory, addr, bd, sizeof(*bd));
413 static void imx_enet_write_bd(IMXENETBufDesc *bd, dma_addr_t addr)
415 dma_memory_write(&address_space_memory, addr, bd, sizeof(*bd));
418 static void imx_eth_update(IMXFECState *s)
420 if (s->regs[ENET_EIR] & s->regs[ENET_EIMR] & ENET_INT_TS_TIMER) {
421 qemu_set_irq(s->irq[1], 1);
423 qemu_set_irq(s->irq[1], 0);
426 if (s->regs[ENET_EIR] & s->regs[ENET_EIMR] & ENET_INT_MAC) {
427 qemu_set_irq(s->irq[0], 1);
429 qemu_set_irq(s->irq[0], 0);
433 static void imx_fec_do_tx(IMXFECState *s)
435 int frame_size = 0, descnt = 0;
436 uint8_t *ptr = s->frame;
437 uint32_t addr = s->tx_descriptor[0];
439 while (descnt++ < IMX_MAX_DESC) {
443 imx_fec_read_bd(&bd, addr);
444 FEC_PRINTF("tx_bd %x flags %04x len %d data %08x\n",
445 addr, bd.flags, bd.length, bd.data);
446 if ((bd.flags & ENET_BD_R) == 0) {
447 /* Run out of descriptors to transmit. */
448 FEC_PRINTF("tx_bd ran out of descriptors to transmit\n");
452 if (frame_size + len > ENET_MAX_FRAME_SIZE) {
453 len = ENET_MAX_FRAME_SIZE - frame_size;
454 s->regs[ENET_EIR] |= ENET_INT_BABT;
456 dma_memory_read(&address_space_memory, bd.data, ptr, len);
459 if (bd.flags & ENET_BD_L) {
460 /* Last buffer in frame. */
461 qemu_send_packet(qemu_get_queue(s->nic), s->frame, frame_size);
464 s->regs[ENET_EIR] |= ENET_INT_TXF;
466 s->regs[ENET_EIR] |= ENET_INT_TXB;
467 bd.flags &= ~ENET_BD_R;
468 /* Write back the modified descriptor. */
469 imx_fec_write_bd(&bd, addr);
470 /* Advance to the next descriptor. */
471 if ((bd.flags & ENET_BD_W) != 0) {
472 addr = s->regs[ENET_TDSR];
478 s->tx_descriptor[0] = addr;
483 static void imx_enet_do_tx(IMXFECState *s, uint32_t index)
485 int frame_size = 0, descnt = 0;
487 uint8_t *ptr = s->frame;
488 uint32_t addr, int_txb, int_txf, tdsr;
494 int_txb = ENET_INT_TXB;
495 int_txf = ENET_INT_TXF;
500 int_txb = ENET_INT_TXB1;
501 int_txf = ENET_INT_TXF1;
506 int_txb = ENET_INT_TXB2;
507 int_txf = ENET_INT_TXF2;
511 qemu_log_mask(LOG_GUEST_ERROR,
512 "%s: bogus value for index %x\n",
518 addr = s->tx_descriptor[ring];
520 while (descnt++ < IMX_MAX_DESC) {
524 imx_enet_read_bd(&bd, addr);
525 FEC_PRINTF("tx_bd %x flags %04x len %d data %08x option %04x "
526 "status %04x\n", addr, bd.flags, bd.length, bd.data,
527 bd.option, bd.status);
528 if ((bd.flags & ENET_BD_R) == 0) {
529 /* Run out of descriptors to transmit. */
533 if (frame_size + len > ENET_MAX_FRAME_SIZE) {
534 len = ENET_MAX_FRAME_SIZE - frame_size;
535 s->regs[ENET_EIR] |= ENET_INT_BABT;
537 dma_memory_read(&address_space_memory, bd.data, ptr, len);
540 if (bd.flags & ENET_BD_L) {
541 if (bd.option & ENET_BD_PINS) {
542 struct ip_header *ip_hd = PKT_GET_IP_HDR(s->frame);
543 if (IP_HEADER_VERSION(ip_hd) == 4) {
544 net_checksum_calculate(s->frame, frame_size);
547 if (bd.option & ENET_BD_IINS) {
548 struct ip_header *ip_hd = PKT_GET_IP_HDR(s->frame);
549 /* We compute checksum only for IPv4 frames */
550 if (IP_HEADER_VERSION(ip_hd) == 4) {
553 csum = net_raw_checksum((uint8_t *)ip_hd, sizeof(*ip_hd));
554 ip_hd->ip_sum = cpu_to_be16(csum);
557 /* Last buffer in frame. */
559 qemu_send_packet(qemu_get_queue(s->nic), s->frame, frame_size);
563 if (bd.option & ENET_BD_TX_INT) {
564 s->regs[ENET_EIR] |= int_txf;
567 if (bd.option & ENET_BD_TX_INT) {
568 s->regs[ENET_EIR] |= int_txb;
570 bd.flags &= ~ENET_BD_R;
571 /* Write back the modified descriptor. */
572 imx_enet_write_bd(&bd, addr);
573 /* Advance to the next descriptor. */
574 if ((bd.flags & ENET_BD_W) != 0) {
575 addr = s->regs[tdsr];
581 s->tx_descriptor[ring] = addr;
586 static void imx_eth_do_tx(IMXFECState *s, uint32_t index)
588 if (!s->is_fec && (s->regs[ENET_ECR] & ENET_ECR_EN1588)) {
589 imx_enet_do_tx(s, index);
595 static void imx_eth_enable_rx(IMXFECState *s, bool flush)
599 imx_fec_read_bd(&bd, s->rx_descriptor);
601 s->regs[ENET_RDAR] = (bd.flags & ENET_BD_E) ? ENET_RDAR_RDAR : 0;
603 if (!s->regs[ENET_RDAR]) {
604 FEC_PRINTF("RX buffer full\n");
606 qemu_flush_queued_packets(qemu_get_queue(s->nic));
610 static void imx_eth_reset(DeviceState *d)
612 IMXFECState *s = IMX_FEC(d);
614 /* Reset the Device */
615 memset(s->regs, 0, sizeof(s->regs));
616 s->regs[ENET_ECR] = 0xf0000000;
617 s->regs[ENET_MIBC] = 0xc0000000;
618 s->regs[ENET_RCR] = 0x05ee0001;
619 s->regs[ENET_OPD] = 0x00010000;
621 s->regs[ENET_PALR] = (s->conf.macaddr.a[0] << 24)
622 | (s->conf.macaddr.a[1] << 16)
623 | (s->conf.macaddr.a[2] << 8)
624 | s->conf.macaddr.a[3];
625 s->regs[ENET_PAUR] = (s->conf.macaddr.a[4] << 24)
626 | (s->conf.macaddr.a[5] << 16)
630 s->regs[ENET_FRBR] = 0x00000600;
631 s->regs[ENET_FRSR] = 0x00000500;
632 s->regs[ENET_MIIGSK_ENR] = 0x00000006;
634 s->regs[ENET_RAEM] = 0x00000004;
635 s->regs[ENET_RAFL] = 0x00000004;
636 s->regs[ENET_TAEM] = 0x00000004;
637 s->regs[ENET_TAFL] = 0x00000008;
638 s->regs[ENET_TIPG] = 0x0000000c;
639 s->regs[ENET_FTRL] = 0x000007ff;
640 s->regs[ENET_ATPER] = 0x3b9aca00;
643 s->rx_descriptor = 0;
644 memset(s->tx_descriptor, 0, sizeof(s->tx_descriptor));
646 /* We also reset the PHY */
650 static uint32_t imx_default_read(IMXFECState *s, uint32_t index)
652 qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Bad register at offset 0x%"
653 PRIx32 "\n", TYPE_IMX_FEC, __func__, index * 4);
657 static uint32_t imx_fec_read(IMXFECState *s, uint32_t index)
662 case ENET_MIIGSK_CFGR:
663 case ENET_MIIGSK_ENR:
664 return s->regs[index];
666 return imx_default_read(s, index);
670 static uint32_t imx_enet_read(IMXFECState *s, uint32_t index)
700 return s->regs[index];
702 return imx_default_read(s, index);
706 static uint64_t imx_eth_read(void *opaque, hwaddr offset, unsigned size)
709 IMXFECState *s = IMX_FEC(opaque);
710 uint32_t index = offset >> 2;
734 value = s->regs[index];
738 value = imx_fec_read(s, index);
740 value = imx_enet_read(s, index);
745 FEC_PRINTF("reg[%s] => 0x%" PRIx32 "\n", imx_eth_reg_name(s, index),
751 static void imx_default_write(IMXFECState *s, uint32_t index, uint32_t value)
753 qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Bad address at offset 0x%"
754 PRIx32 "\n", TYPE_IMX_FEC, __func__, index * 4);
758 static void imx_fec_write(IMXFECState *s, uint32_t index, uint32_t value)
762 /* FRBR is read only */
763 qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Register FRBR is read only\n",
764 TYPE_IMX_FEC, __func__);
767 s->regs[index] = (value & 0x000003fc) | 0x00000400;
769 case ENET_MIIGSK_CFGR:
770 s->regs[index] = value & 0x00000053;
772 case ENET_MIIGSK_ENR:
773 s->regs[index] = (value & 0x00000002) ? 0x00000006 : 0;
776 imx_default_write(s, index, value);
781 static void imx_enet_write(IMXFECState *s, uint32_t index, uint32_t value)
791 s->regs[index] = value & 0x000001ff;
794 s->regs[index] = value & 0x0000001f;
797 s->regs[index] = value & 0x00003fff;
800 s->regs[index] = value & 0x00000019;
803 s->regs[index] = value & 0x000000C7;
806 s->regs[index] = value & 0x00002a9d;
811 s->regs[index] = value;
814 /* ATSTMP is read only */
815 qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Register ATSTMP is read only\n",
816 TYPE_IMX_FEC, __func__);
819 s->regs[index] = value & 0x7fffffff;
822 s->regs[index] = value & 0x00007f7f;
825 /* implement clear timer flag */
826 value = value & 0x0000000f;
832 value = value & 0x000000fd;
838 s->regs[index] = value;
841 imx_default_write(s, index, value);
846 static void imx_eth_write(void *opaque, hwaddr offset, uint64_t value,
849 IMXFECState *s = IMX_FEC(opaque);
850 const bool single_tx_ring = !imx_eth_is_multi_tx_ring(s);
851 uint32_t index = offset >> 2;
853 FEC_PRINTF("reg[%s] <= 0x%" PRIx32 "\n", imx_eth_reg_name(s, index),
858 s->regs[index] &= ~value;
861 s->regs[index] = value;
864 if (s->regs[ENET_ECR] & ENET_ECR_ETHEREN) {
865 if (!s->regs[index]) {
866 imx_eth_enable_rx(s, true);
872 case ENET_TDAR1: /* FALLTHROUGH */
873 case ENET_TDAR2: /* FALLTHROUGH */
874 if (unlikely(single_tx_ring)) {
875 qemu_log_mask(LOG_GUEST_ERROR,
876 "[%s]%s: trying to access TDAR2 or TDAR1\n",
877 TYPE_IMX_FEC, __func__);
880 case ENET_TDAR: /* FALLTHROUGH */
881 if (s->regs[ENET_ECR] & ENET_ECR_ETHEREN) {
882 s->regs[index] = ENET_TDAR_TDAR;
883 imx_eth_do_tx(s, index);
888 if (value & ENET_ECR_RESET) {
889 return imx_eth_reset(DEVICE(s));
891 s->regs[index] = value;
892 if ((s->regs[index] & ENET_ECR_ETHEREN) == 0) {
893 s->regs[ENET_RDAR] = 0;
894 s->rx_descriptor = s->regs[ENET_RDSR];
895 s->regs[ENET_TDAR] = 0;
896 s->regs[ENET_TDAR1] = 0;
897 s->regs[ENET_TDAR2] = 0;
898 s->tx_descriptor[0] = s->regs[ENET_TDSR];
899 s->tx_descriptor[1] = s->regs[ENET_TDSR1];
900 s->tx_descriptor[2] = s->regs[ENET_TDSR2];
904 s->regs[index] = value;
905 if (extract32(value, 29, 1)) {
906 /* This is a read operation */
907 s->regs[ENET_MMFR] = deposit32(s->regs[ENET_MMFR], 0, 16,
912 /* This a write operation */
913 do_phy_write(s, extract32(value, 18, 10), extract32(value, 0, 16));
915 /* raise the interrupt as the PHY operation is done */
916 s->regs[ENET_EIR] |= ENET_INT_MII;
919 s->regs[index] = value & 0xfe;
922 /* TODO: Implement MIB. */
923 s->regs[index] = (value & 0x80000000) ? 0xc0000000 : 0;
926 s->regs[index] = value & 0x07ff003f;
927 /* TODO: Implement LOOP mode. */
930 /* We transmit immediately, so raise GRA immediately. */
931 s->regs[index] = value;
933 s->regs[ENET_EIR] |= ENET_INT_GRA;
937 s->regs[index] = value;
938 s->conf.macaddr.a[0] = value >> 24;
939 s->conf.macaddr.a[1] = value >> 16;
940 s->conf.macaddr.a[2] = value >> 8;
941 s->conf.macaddr.a[3] = value;
944 s->regs[index] = (value | 0x0000ffff) & 0xffff8808;
945 s->conf.macaddr.a[4] = value >> 24;
946 s->conf.macaddr.a[5] = value >> 16;
949 s->regs[index] = (value & 0x0000ffff) | 0x00010000;
955 /* TODO: implement MAC hash filtering. */
959 s->regs[index] = value & 0x3;
961 s->regs[index] = value & 0x13f;
966 s->regs[index] = value & ~3;
968 s->regs[index] = value & ~7;
970 s->rx_descriptor = s->regs[index];
974 s->regs[index] = value & ~3;
976 s->regs[index] = value & ~7;
978 s->tx_descriptor[0] = s->regs[index];
981 if (unlikely(single_tx_ring)) {
982 qemu_log_mask(LOG_GUEST_ERROR,
983 "[%s]%s: trying to access TDSR1\n",
984 TYPE_IMX_FEC, __func__);
988 s->regs[index] = value & ~7;
989 s->tx_descriptor[1] = s->regs[index];
992 if (unlikely(single_tx_ring)) {
993 qemu_log_mask(LOG_GUEST_ERROR,
994 "[%s]%s: trying to access TDSR2\n",
995 TYPE_IMX_FEC, __func__);
999 s->regs[index] = value & ~7;
1000 s->tx_descriptor[2] = s->regs[index];
1003 s->regs[index] = value & 0x00003ff0;
1007 imx_fec_write(s, index, value);
1009 imx_enet_write(s, index, value);
1017 static int imx_eth_can_receive(NetClientState *nc)
1019 IMXFECState *s = IMX_FEC(qemu_get_nic_opaque(nc));
1023 return !!s->regs[ENET_RDAR];
1026 static ssize_t imx_fec_receive(NetClientState *nc, const uint8_t *buf,
1029 IMXFECState *s = IMX_FEC(qemu_get_nic_opaque(nc));
1036 unsigned int buf_len;
1039 FEC_PRINTF("len %d\n", (int)size);
1041 if (!s->regs[ENET_RDAR]) {
1042 qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Unexpected packet\n",
1043 TYPE_IMX_FEC, __func__);
1047 /* 4 bytes for the CRC. */
1049 crc = cpu_to_be32(crc32(~0, buf, size));
1050 crc_ptr = (uint8_t *) &crc;
1052 /* Huge frames are truncated. */
1053 if (size > ENET_MAX_FRAME_SIZE) {
1054 size = ENET_MAX_FRAME_SIZE;
1055 flags |= ENET_BD_TR | ENET_BD_LG;
1058 /* Frames larger than the user limit just set error flags. */
1059 if (size > (s->regs[ENET_RCR] >> 16)) {
1060 flags |= ENET_BD_LG;
1063 addr = s->rx_descriptor;
1065 imx_fec_read_bd(&bd, addr);
1066 if ((bd.flags & ENET_BD_E) == 0) {
1067 /* No descriptors available. Bail out. */
1069 * FIXME: This is wrong. We should probably either
1070 * save the remainder for when more RX buffers are
1071 * available, or flag an error.
1073 qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Lost end of frame\n",
1074 TYPE_IMX_FEC, __func__);
1077 buf_len = (size <= s->regs[ENET_MRBR]) ? size : s->regs[ENET_MRBR];
1078 bd.length = buf_len;
1081 FEC_PRINTF("rx_bd 0x%x length %d\n", addr, bd.length);
1083 /* The last 4 bytes are the CRC. */
1085 buf_len += size - 4;
1088 dma_memory_write(&address_space_memory, buf_addr, buf, buf_len);
1091 dma_memory_write(&address_space_memory, buf_addr + buf_len,
1093 crc_ptr += 4 - size;
1095 bd.flags &= ~ENET_BD_E;
1097 /* Last buffer in frame. */
1098 bd.flags |= flags | ENET_BD_L;
1099 FEC_PRINTF("rx frame flags %04x\n", bd.flags);
1100 s->regs[ENET_EIR] |= ENET_INT_RXF;
1102 s->regs[ENET_EIR] |= ENET_INT_RXB;
1104 imx_fec_write_bd(&bd, addr);
1105 /* Advance to the next descriptor. */
1106 if ((bd.flags & ENET_BD_W) != 0) {
1107 addr = s->regs[ENET_RDSR];
1112 s->rx_descriptor = addr;
1113 imx_eth_enable_rx(s, false);
1118 static ssize_t imx_enet_receive(NetClientState *nc, const uint8_t *buf,
1121 IMXFECState *s = IMX_FEC(qemu_get_nic_opaque(nc));
1128 unsigned int buf_len;
1130 bool shift16 = s->regs[ENET_RACC] & ENET_RACC_SHIFT16;
1132 FEC_PRINTF("len %d\n", (int)size);
1134 if (!s->regs[ENET_RDAR]) {
1135 qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Unexpected packet\n",
1136 TYPE_IMX_FEC, __func__);
1140 /* 4 bytes for the CRC. */
1142 crc = cpu_to_be32(crc32(~0, buf, size));
1143 crc_ptr = (uint8_t *) &crc;
1149 /* Huge frames are truncated. */
1150 if (size > s->regs[ENET_FTRL]) {
1151 size = s->regs[ENET_FTRL];
1152 flags |= ENET_BD_TR | ENET_BD_LG;
1155 /* Frames larger than the user limit just set error flags. */
1156 if (size > (s->regs[ENET_RCR] >> 16)) {
1157 flags |= ENET_BD_LG;
1160 addr = s->rx_descriptor;
1162 imx_enet_read_bd(&bd, addr);
1163 if ((bd.flags & ENET_BD_E) == 0) {
1164 /* No descriptors available. Bail out. */
1166 * FIXME: This is wrong. We should probably either
1167 * save the remainder for when more RX buffers are
1168 * available, or flag an error.
1170 qemu_log_mask(LOG_GUEST_ERROR, "[%s]%s: Lost end of frame\n",
1171 TYPE_IMX_FEC, __func__);
1174 buf_len = MIN(size, s->regs[ENET_MRBR]);
1175 bd.length = buf_len;
1178 FEC_PRINTF("rx_bd 0x%x length %d\n", addr, bd.length);
1180 /* The last 4 bytes are the CRC. */
1182 buf_len += size - 4;
1188 * If SHIFT16 bit of ENETx_RACC register is set we need to
1189 * align the payload to 4-byte boundary.
1191 const uint8_t zeros[2] = { 0 };
1193 dma_memory_write(&address_space_memory, buf_addr,
1194 zeros, sizeof(zeros));
1196 buf_addr += sizeof(zeros);
1197 buf_len -= sizeof(zeros);
1199 /* We only do this once per Ethernet frame */
1203 dma_memory_write(&address_space_memory, buf_addr, buf, buf_len);
1206 dma_memory_write(&address_space_memory, buf_addr + buf_len,
1208 crc_ptr += 4 - size;
1210 bd.flags &= ~ENET_BD_E;
1212 /* Last buffer in frame. */
1213 bd.flags |= flags | ENET_BD_L;
1214 FEC_PRINTF("rx frame flags %04x\n", bd.flags);
1215 if (bd.option & ENET_BD_RX_INT) {
1216 s->regs[ENET_EIR] |= ENET_INT_RXF;
1219 if (bd.option & ENET_BD_RX_INT) {
1220 s->regs[ENET_EIR] |= ENET_INT_RXB;
1223 imx_enet_write_bd(&bd, addr);
1224 /* Advance to the next descriptor. */
1225 if ((bd.flags & ENET_BD_W) != 0) {
1226 addr = s->regs[ENET_RDSR];
1231 s->rx_descriptor = addr;
1232 imx_eth_enable_rx(s, false);
1237 static ssize_t imx_eth_receive(NetClientState *nc, const uint8_t *buf,
1240 IMXFECState *s = IMX_FEC(qemu_get_nic_opaque(nc));
1242 if (!s->is_fec && (s->regs[ENET_ECR] & ENET_ECR_EN1588)) {
1243 return imx_enet_receive(nc, buf, len);
1245 return imx_fec_receive(nc, buf, len);
1249 static const MemoryRegionOps imx_eth_ops = {
1250 .read = imx_eth_read,
1251 .write = imx_eth_write,
1252 .valid.min_access_size = 4,
1253 .valid.max_access_size = 4,
1254 .endianness = DEVICE_NATIVE_ENDIAN,
1257 static void imx_eth_cleanup(NetClientState *nc)
1259 IMXFECState *s = IMX_FEC(qemu_get_nic_opaque(nc));
1264 static NetClientInfo imx_eth_net_info = {
1265 .type = NET_CLIENT_DRIVER_NIC,
1266 .size = sizeof(NICState),
1267 .can_receive = imx_eth_can_receive,
1268 .receive = imx_eth_receive,
1269 .cleanup = imx_eth_cleanup,
1270 .link_status_changed = imx_eth_set_link,
1274 static void imx_eth_realize(DeviceState *dev, Error **errp)
1276 IMXFECState *s = IMX_FEC(dev);
1277 SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
1279 memory_region_init_io(&s->iomem, OBJECT(dev), &imx_eth_ops, s,
1280 TYPE_IMX_FEC, FSL_IMX25_FEC_SIZE);
1281 sysbus_init_mmio(sbd, &s->iomem);
1282 sysbus_init_irq(sbd, &s->irq[0]);
1283 sysbus_init_irq(sbd, &s->irq[1]);
1285 qemu_macaddr_default_if_unset(&s->conf.macaddr);
1287 s->nic = qemu_new_nic(&imx_eth_net_info, &s->conf,
1288 object_get_typename(OBJECT(dev)),
1289 DEVICE(dev)->id, s);
1291 qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
1294 static Property imx_eth_properties[] = {
1295 DEFINE_NIC_PROPERTIES(IMXFECState, conf),
1296 DEFINE_PROP_UINT32("tx-ring-num", IMXFECState, tx_ring_num, 1),
1297 DEFINE_PROP_END_OF_LIST(),
1300 static void imx_eth_class_init(ObjectClass *klass, void *data)
1302 DeviceClass *dc = DEVICE_CLASS(klass);
1304 dc->vmsd = &vmstate_imx_eth;
1305 dc->reset = imx_eth_reset;
1306 dc->props = imx_eth_properties;
1307 dc->realize = imx_eth_realize;
1308 dc->desc = "i.MX FEC/ENET Ethernet Controller";
1311 static void imx_fec_init(Object *obj)
1313 IMXFECState *s = IMX_FEC(obj);
1318 static void imx_enet_init(Object *obj)
1320 IMXFECState *s = IMX_FEC(obj);
1325 static const TypeInfo imx_fec_info = {
1326 .name = TYPE_IMX_FEC,
1327 .parent = TYPE_SYS_BUS_DEVICE,
1328 .instance_size = sizeof(IMXFECState),
1329 .instance_init = imx_fec_init,
1330 .class_init = imx_eth_class_init,
1333 static const TypeInfo imx_enet_info = {
1334 .name = TYPE_IMX_ENET,
1335 .parent = TYPE_IMX_FEC,
1336 .instance_init = imx_enet_init,
1339 static void imx_eth_register_types(void)
1341 type_register_static(&imx_fec_info);
1342 type_register_static(&imx_enet_info);
1345 type_init(imx_eth_register_types)