[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Qemu-devel] [PATCH] net: Add SunGEM device emulation as found on Apple
|
From: |
Benjamin Herrenschmidt |
|
Subject: |
[Qemu-devel] [PATCH] net: Add SunGEM device emulation as found on Apple UniNorth |
|
Date: |
Mon, 15 Aug 2016 08:48:51 +1000 |
This adds a simplistic emulation of the Sun GEM ethernet controller
found in Apple ASICs.
Currently we only support the Apple UniNorth 1.x variant, but the
other Apple or Sun variants should mostly be a matter of adding
PCI IDs options.
It doesn't (yet) support state saving, but neither does the Mac models
at least not without additional patches. I will add it separately.
We have a very primitive emulation of a single Broadcom 5201 PHY
which is supported by the MacOS driver.
This model brings out-of-the-box networking to MacOS 9, and all
versions of OS X I tried with the mac99 platform.
Signed-off-by: Benjamin Herrenschmidt <address@hidden>
---
hw/net/Makefile.objs | 2 +
hw/net/sungem.c | 1036 ++++++++++++++++++++++++++++++++++++++++++++++
hw/net/sungem.h | 885 +++++++++++++++++++++++++++++++++++++++
hw/pci/pci.c | 2 +
include/hw/pci/pci_ids.h | 1 +
5 files changed, 1926 insertions(+)
create mode 100644 hw/net/sungem.c
create mode 100644 hw/net/sungem.h
diff --git a/hw/net/Makefile.objs b/hw/net/Makefile.objs
index 610ed3e..7cded99 100644
--- a/hw/net/Makefile.objs
+++ b/hw/net/Makefile.objs
@@ -27,6 +27,8 @@ common-obj-$(CONFIG_CADENCE) += cadence_gem.o
common-obj-$(CONFIG_STELLARIS_ENET) += stellaris_enet.o
common-obj-$(CONFIG_LANCE) += lance.o
+common-obj-$(CONFIG_SUNGEM) += sungem.o
+
obj-$(CONFIG_ETRAXFS) += etraxfs_eth.o
obj-$(CONFIG_COLDFIRE) += mcf_fec.o
obj-$(CONFIG_MILKYMIST) += milkymist-minimac2.o
diff --git a/hw/net/sungem.c b/hw/net/sungem.c
new file mode 100644
index 0000000..2081bda
--- /dev/null
+++ b/hw/net/sungem.c
@@ -0,0 +1,1036 @@
+/*
+ * QEMU model of SUN GEM ethernet controller
+ *
+ * As found in Apple ASICs among others
+ *
+ * Copyright 2016 Ben Herrenschmidt
+ */
+#include "qemu/osdep.h"
+#include "hw/pci/pci.h"
+#include "qemu/log.h"
+#include "net/net.h"
+#include "net/checksum.h"
+#include "hw/net/mii.h"
+/* For crc32 */
+#include <zlib.h>
+
+#include "sungem.h"
+
+#define SUNGEM_DEBUG
+
+#ifdef SUNGEM_DEBUG
+enum {
+ DEBUG_ERR, DEBUG_GEN, DEBUG_MII, DEBUG_MMIO, DEBUG_INTERRUPT,
+ DEBUG_RX, DEBUG_TX,
+};
+#define DBGBIT(x) (1<<DEBUG_##x)
+static int debugflags = DBGBIT(ERR);
+//static int debugflags = DBGBIT(ERR) | DBGBIT(INTERRUPT) | DBGBIT(RX) |
DBGBIT(TX);
+
+#define DBGOUT(what, fmt, ...) do { \
+ if (debugflags & DBGBIT(what)) \
+ fprintf(stderr, "sungem: " fmt, ## __VA_ARGS__); \
+ } while (0)
+#else
+#define DBGOUT(what, fmt, ...) do {} while (0)
+#endif
+
+#define TYPE_SUNGEM "sungem"
+
+#define SUNGEM(obj) OBJECT_CHECK(SunGEMState, (obj), TYPE_SUNGEM)
+
+#define MAX_PACKET_SIZE 9016
+
+typedef struct {
+ PCIDevice pdev;
+ MemoryRegion mmio;
+ NICState *nic;
+ NICConf conf;
+ uint32_t nregsblocks;
+ uint32_t **regs;
+ uint32_t phy_addr;
+
+ /* Cache some useful things */
+ uint32_t rx_mask;
+ uint32_t tx_mask;
+
+ /* Current tx packet */
+ uint8_t tx_data[MAX_PACKET_SIZE];
+ uint32_t tx_size;
+ uint64_t tx_first_ctl;
+} SunGEMState;
+
+static const struct RegBlock {
+ uint32_t base; /* Base offset */
+ uint32_t count; /* Number of registers */
+} RegBlocks[] = {
+ { 0x0000, 0x0006 }, /* 0x0000..0x001c : GREG bank 0 */
+ { 0x1000, 0x0005 }, /* 0x1000..0x1010 : GREG bank 1 */
+ { 0x2000, 0x000e }, /* 0x2000..0x2034 : TX DMA bank 0 */
+ { 0x2100, 0x0007 }, /* 0x2100..0x2118 : TX DMA bank 1 */
+ { 0x3000, 0x0005 }, /* 0x3000..0x3010 : WakeOnLan */
+ { 0x4000, 0x000b }, /* 0x4000..0c4028 : RX DMA bank 0 */
+ { 0x4100, 0x0009 }, /* 0x4100..0x4120 : RX DMA bank 1 */
+ { 0x6000, 0x004e }, /* 0x6000..0x6134 : MAC */
+ { 0x6200, 0x0008 }, /* 0x6200..0x621c : MIF */
+ { 0x9000, 0x0007 }, /* 0x9000..0x9018 : PCS */
+ { 0x9050, 0x0004 }, /* 0x9050..0x905c : PCS */
+};
+
+/* Fast access, hopefully optimized out by the compiler */
+static uint32_t *sungem_get_reg(SunGEMState *s, uint32_t reg)
+{
+ uint32_t idx = (reg & 0xff) >> 2;
+ if (reg <= 0x1c)
+ return &s->regs[0][idx];
+ else if (reg >= 0x1000 && reg <= 0x1010)
+ return &s->regs[1][idx];
+ else if (reg >= 0x2000 && reg <= 0x2034)
+ return &s->regs[2][idx];
+ else if (reg >= 0x2100 && reg <= 0x2118)
+ return &s->regs[3][idx];
+ else if (reg >= 0x3000 && reg <= 0x3010)
+ return &s->regs[4][idx];
+ else if (reg >= 0x4000 && reg <= 0x4028)
+ return &s->regs[5][idx];
+ else if (reg >= 0x4100 && reg <= 0x4120)
+ return &s->regs[6][idx];
+ else if (reg >= 0x6000 && reg <= 0x6134)
+ return &s->regs[7][idx];
+ else if (reg >= 0x6200 && reg <= 0x621c)
+ return &s->regs[8][idx];
+ else if (reg >= 0x9000 && reg <= 0x9018)
+ return &s->regs[9][idx];
+ else if (reg >= 0x9050 && reg <= 0x905c)
+ return &s->regs[10][idx];
+ return NULL;
+}
+
+#define SET_REG(s, reg, val) \
+ do { \
+ uint32_t *regp = sungem_get_reg(s, reg); \
+ assert(regp); \
+ *regp = val; \
+ } while(0)
+
+#define GET_REG(s, reg) \
+ ({ \
+ uint32_t *regp = sungem_get_reg(s, reg); \
+ assert(regp); \
+ *regp; \
+ })
+
+static void sungem_eval_irq(SunGEMState *s)
+{
+ uint32_t stat, mask;
+
+ mask = GET_REG(s, GREG_IMASK);
+ stat = GET_REG(s, GREG_STAT) & ~GREG_STAT_TXNR;
+ if (stat & ~mask) {
+ pci_set_irq(PCI_DEVICE(s), 1);
+ } else {
+ pci_set_irq(PCI_DEVICE(s), 0);
+ }
+}
+
+static void sungem_update_status(SunGEMState *s, uint32_t bits, bool val)
+{
+ uint32_t stat;
+
+ stat = GET_REG(s, GREG_STAT);
+ if (val) {
+ stat |= bits;
+ } else {
+ stat &= ~bits;
+ }
+ SET_REG(s, GREG_STAT, stat);
+ sungem_eval_irq(s);
+}
+
+static void sungem_eval_cascade_irq(SunGEMState *s)
+{
+ uint32_t stat, mask;
+
+ mask = GET_REG(s, MAC_TXSTAT);
+ stat = GET_REG(s, MAC_TXMASK);
+ if (stat & ~mask) {
+ sungem_update_status(s, GREG_STAT_TXMAC, true);
+ } else {
+ sungem_update_status(s, GREG_STAT_TXMAC, false);
+ }
+
+ mask = GET_REG(s, MAC_RXSTAT);
+ stat = GET_REG(s, MAC_RXMASK);
+ if (stat & ~mask) {
+ sungem_update_status(s, GREG_STAT_RXMAC, true);
+ } else {
+ sungem_update_status(s, GREG_STAT_RXMAC, false);
+ }
+
+ mask = GET_REG(s, MAC_CSTAT);
+ stat = GET_REG(s, MAC_MCMASK) & ~MAC_CSTAT_PTR;
+ if (stat & ~mask) {
+ sungem_update_status(s, GREG_STAT_MAC, true);
+ } else {
+ sungem_update_status(s, GREG_STAT_MAC, false);
+ }
+}
+
+static void sungem_do_tx_csum(SunGEMState *s)
+{
+ uint16_t start, off;
+ uint32_t csum;
+
+ start = (s->tx_first_ctl & TXDCTRL_CSTART) >> 15;
+ off = (s->tx_first_ctl & TXDCTRL_COFF) >> 21;
+
+ DBGOUT(TX, "TX checksumming from byte %d, inserting at %d\n",
+ start, off);
+
+ if (start > (s->tx_size - 2) || off > (s->tx_size - 2)) {
+ DBGOUT(ERR, "TX checksum out of packet bounds\n");
+ return;
+ }
+
+ csum = net_raw_checksum(s->tx_data + start, s->tx_size - start);
+ stw_be_p(s->tx_data + off, csum);
+}
+
+static void sungem_send_packet(SunGEMState *s, const uint8_t *buf,
+ int size)
+{
+ NetClientState *nc = qemu_get_queue(s->nic);
+
+ if (GET_REG(s, MAC_XIFCFG) & MAC_XIFCFG_LBCK) {
+ nc->info->receive(nc, buf, size);
+ } else {
+ qemu_send_packet(nc, buf, size);
+ }
+}
+
+static void sungem_process_tx_desc(SunGEMState *s, struct gem_txd *desc)
+{
+ PCIDevice *d = PCI_DEVICE(s);
+ uint32_t len;
+
+ /* If it's a start of frame, discard anything we had in the
+ * buffer and start again. This should be an error condition
+ * if we had something ... for now we ignore it
+ */
+ if (desc->control_word & TXDCTRL_SOF) {
+ if (s->tx_first_ctl) {
+ DBGOUT(ERR, "TX packet started without finishing"
+ " the previous one !\n");
+ }
+ s->tx_size = 0;
+ s->tx_first_ctl = desc->control_word;
+ }
+
+ /* Grab data size */
+ len = desc->control_word & TXDCTRL_BUFSZ;
+
+ /* Clamp it to our max size */
+ if ((s->tx_size + len) > MAX_PACKET_SIZE) {
+ DBGOUT(ERR, "TX packet queue overflow !\n");
+ len = MAX_PACKET_SIZE - s->tx_size;
+ }
+
+ /* Read the data */
+ pci_dma_read(d, desc->buffer, &s->tx_data[s->tx_size], len);
+ s->tx_size += len;
+
+ /* If end of frame, send packet */
+ if (desc->control_word & TXDCTRL_EOF) {
+ DBGOUT(TX, "TX completing %d bytes packet\n", s->tx_size);
+
+ /* Handle csum */
+ if (s->tx_first_ctl & TXDCTRL_CENAB) {
+ sungem_do_tx_csum(s);
+ }
+
+ /* Send it */
+ sungem_send_packet(s, s->tx_data, s->tx_size);
+
+ /* No more pending packet */
+ s->tx_size = 0;
+ s->tx_first_ctl = 0;
+ }
+}
+
+static void sungem_tx_kick(SunGEMState *s)
+{
+ PCIDevice *d = PCI_DEVICE(s);
+ uint32_t comp, kick;
+ uint32_t txdma_cfg, txmac_cfg, ints;
+ uint64_t dbase;
+
+ DBGOUT(TX, "TX Kick !...\n");
+
+ /* Check that both TX MAC and TX DMA are enabled. We don't
+ * handle DMA-less direct FIFO operations (we don't emulate
+ * the FIFO at all).
+ *
+ * A write to TXDMA_KICK while DMA isn't enabled can happen
+ * when the driver is resetting the pointer.
+ */
+ txdma_cfg = GET_REG(s, TXDMA_CFG);
+ txmac_cfg = GET_REG(s, MAC_TXCFG);
+ if (!(txdma_cfg & TXDMA_CFG_ENABLE) ||
+ !(txmac_cfg & MAC_TXCFG_ENAB)) {
+ DBGOUT(TX, "TX not enabled !\n");
+ return;
+ }
+
+ /* XXX Test min frame size register ? */
+ /* XXX Test max frame size register ? */
+
+ dbase = GET_REG(s, TXDMA_DBHI);
+ dbase = (dbase << 32) | GET_REG(s, TXDMA_DBLOW);
+
+ comp = GET_REG(s, TXDMA_TXDONE) & s->tx_mask;
+ kick = GET_REG(s, TXDMA_KICK) & s->tx_mask;
+
+ DBGOUT(TX, "TX processing comp=%d, kick=%d out of %d\n",
+ comp, kick, s->tx_mask + 1);
+
+ /* This is rather primitive for now, we just send everything we
+ * can in one go, like e1000. Ideally we should do the sending
+ * from some kind of background task
+ */
+ while (comp != kick) {
+ struct gem_txd desc;
+
+ /* Read the next descriptor */
+ pci_dma_read(d, dbase + comp * sizeof(desc), &desc, sizeof(desc));
+
+ /* Byteswap descriptor */
+ desc.control_word = le64_to_cpu(desc.control_word);
+ desc.buffer = le64_to_cpu(desc.buffer);
+ DBGOUT(TX, "TX desc %d: %016llx %016llx\n", comp,
+ (unsigned long long)desc.control_word,
+ (unsigned long long)desc.buffer);
+
+ /* Send it for processing */
+ sungem_process_tx_desc(s, &desc);
+
+ /* Interrupt */
+ ints = GREG_STAT_TXDONE;
+ if (desc.control_word & TXDCTRL_INTME) {
+ ints |= GREG_STAT_TXINTME;
+ }
+ sungem_update_status(s, ints, true);
+
+ /* Next ! */
+ comp = (comp + 1) & s->tx_mask;
+ SET_REG(s, TXDMA_TXDONE, comp);
+ }
+
+ /* We sent everything, set status/irq bit */
+ sungem_update_status(s, GREG_STAT_TXALL, true);
+}
+
+static bool sungem_rx_full(SunGEMState *s, uint32_t kick, uint32_t done)
+{
+ return kick == ((done + 1) & s->rx_mask);
+}
+
+static int sungem_can_receive(NetClientState *nc)
+{
+ SunGEMState *s = qemu_get_nic_opaque(nc);
+ uint32_t kick, done, rxdma_cfg, rxmac_cfg;
+ bool full;
+
+ rxmac_cfg = GET_REG(s, MAC_RXCFG);
+ rxdma_cfg = GET_REG(s, RXDMA_CFG);
+
+ /* If MAC disabled, can't receive */
+ if ((rxmac_cfg & MAC_RXCFG_ENAB) == 0) {
+ DBGOUT(RX, "Check RX MAC disabled\n");
+ return 0;
+ }
+ if ((rxdma_cfg & RXDMA_CFG_ENABLE) == 0) {
+ DBGOUT(RX, "Check RX TXDMA disabled\n");
+ return 0;
+ }
+
+ /* Check RX availability */
+ kick = GET_REG(s, RXDMA_KICK);
+ done = GET_REG(s, RXDMA_DONE);
+ full = sungem_rx_full(s, kick, done);
+
+ DBGOUT(RX, "Check RX %d (kick=%d, done=%d)\n",
+ !full, kick, done);
+
+ return !full;
+}
+
+enum {
+ rx_no_match,
+ rx_match_promisc,
+ rx_match_bcast,
+ rx_match_allmcast,
+ rx_match_mcast,
+ rx_match_mac,
+ rx_match_altmac,
+};
+
+static int sungem_check_rx_mac(SunGEMState *s, const uint8_t *mac, uint32_t
crc)
+{
+ uint32_t rxcfg = GET_REG(s, MAC_RXCFG);
+ uint32_t mac0, mac1, mac2;
+
+ /* Promisc enabled ? */
+ if (rxcfg & MAC_RXCFG_PROM) {
+ return rx_match_promisc;
+ }
+
+ /* Format MAC address into dwords */
+ mac0 = (mac[4] << 8) | mac[5];
+ mac1 = (mac[2] << 8) | mac[3];
+ mac2 = (mac[0] << 8) | mac[1];
+
+ DBGOUT(RX, "Word MAC: %04x %04x %04x\n", mac0, mac1, mac2);
+
+ /* Is this a broadcast frame ? */
+ if (mac0 == 0xffff && mac1 == 0xffff && mac2 == 0xffff) {
+ return rx_match_bcast;
+ }
+
+ /* TODO: Implement address filter registers (or we don't care ?) */
+
+ /* Is this a multicast frame ? */
+ if (mac[0] & 1) {
+ DBGOUT(RX, "Multicast !\n");
+
+ /* Promisc group enabled ? */
+ if (rxcfg & MAC_RXCFG_PGRP) {
+ return rx_match_allmcast;
+ }
+
+ /* TODO: Check MAC control frames (or we don't care) ? */
+
+ /* Check hash filter (somebody check that's correct ?) */
+ if (rxcfg & MAC_RXCFG_HFE) {
+ uint32_t hash, idx;
+
+ crc >>= 24;
+ idx = (crc >> 2) & 0x3c;
+ hash = GET_REG(s, MAC_HASH0 + idx);
+ if (hash & (1 << (15 - (crc & 0xf)))) {
+ return rx_match_mcast;
+ }
+ }
+ return rx_no_match;
+ }
+
+ /* Main MAC check */
+ DBGOUT(RX, "Compare MAC to %04x %04x %04x..\n",
+ GET_REG(s, MAC_ADDR0),
+ GET_REG(s, MAC_ADDR1),
+ GET_REG(s, MAC_ADDR2));
+ if (mac0 == GET_REG(s, MAC_ADDR0) &&
+ mac1 == GET_REG(s, MAC_ADDR1) &&
+ mac2 == GET_REG(s, MAC_ADDR2)) {
+ return rx_match_mac;
+ }
+
+ /* Alt MAC check */
+ if (mac0 == GET_REG(s, MAC_ADDR3) &&
+ mac1 == GET_REG(s, MAC_ADDR4) &&
+ mac2 == GET_REG(s, MAC_ADDR5)) {
+ return rx_match_altmac;
+ }
+
+ return rx_no_match;
+}
+
+static ssize_t sungem_receive(NetClientState *nc, const uint8_t *buf,
+ size_t size)
+{
+ SunGEMState *s = qemu_get_nic_opaque(nc);
+ PCIDevice *d = PCI_DEVICE(s);
+ uint32_t mac_crc, done, kick, max_fsize;
+ uint32_t fcs_size, ints, rxdma_cfg, rxmac_cfg, csum, coff;
+ uint8_t smallbuf[60];
+ struct gem_rxd desc;
+ uint64_t dbase, baddr;
+ unsigned int rx_cond;
+
+ DBGOUT(RX, "RX got %ld bytes packet\n", size);
+
+ rxmac_cfg = GET_REG(s, MAC_RXCFG);
+ rxdma_cfg = GET_REG(s, RXDMA_CFG);
+ max_fsize = GET_REG(s, MAC_MAXFSZ) & 0x7fff;
+
+ /* If MAC or DMA disabled, can't receive */
+ if (!(rxdma_cfg & RXDMA_CFG_ENABLE) ||
+ !(rxmac_cfg & MAC_RXCFG_ENAB)) {
+ DBGOUT(RX, "RX not enabled !\n");
+ return 0;
+ }
+
+ /* Size adjustment for FCS */
+ if (rxmac_cfg & MAC_RXCFG_SFCS) {
+ fcs_size = 0;
+ } else {
+ fcs_size = 4;
+ }
+
+ /* Discard frame smaller than a MAC or larger than max frame size
+ * (when accounting for FCS)
+ */
+ if (size < 6 || (size + 4) > max_fsize) {
+ DBGOUT(ERR, "RX bad frame size %ld, dropped !\n", size);
+ /* XXX Increment error statistics ? */
+ return size;
+ }
+
+ /* We don't drop too small frames since we get them in qemu, we pad
+ * them instead. We should probably use the min frame size register
+ * but I don't want to use a variable size staging buffer and I
+ * know both MacOS and Linux use the default 64 anyway. We use 60
+ * here to account for the non-existent FCS.
+ */
+ if (size < 60) {
+ memcpy(smallbuf, buf, size);
+ memset(&smallbuf[size], 0, 60 - size);
+ buf = smallbuf;
+ size = 60;
+ }
+
+ /* Get MAC crc */
+ mac_crc = crc32(~0, buf, 6);
+
+ /* Packet isn't for me ? */
+ rx_cond = sungem_check_rx_mac(s, buf, mac_crc);
+ if (rx_cond == rx_no_match) {
+ /* Just drop it */
+ DBGOUT(RX, "No match, dropped !\n");
+ return size;
+ }
+
+ /* Get ring pointers */
+ kick = GET_REG(s, RXDMA_KICK) & s->rx_mask;
+ done = GET_REG(s, RXDMA_DONE) & s->rx_mask;
+
+ DBGOUT(RX, "RX processing done=%d, kick=%d out of %d\n",
+ done, kick, s->rx_mask + 1);
+
+ /* Ring full ? Can't receive */
+ if (sungem_rx_full(s, kick, done)) {
+ DBGOUT(RX, "RX ring full !\n");
+ return 0;
+ }
+
+ /* Note: The real GEM will fetch descriptors in blocks of 4,
+ * for now we handle them one at a time, I think the driver will
+ * cope
+ */
+
+ dbase = GET_REG(s, RXDMA_DBHI);
+ dbase = (dbase << 32) | GET_REG(s, RXDMA_DBLOW);
+
+ /* Read the next descriptor */
+ pci_dma_read(d, dbase + done * sizeof(desc), &desc, sizeof(desc));
+
+ DBGOUT(RX, "RX desc: %016llx %016llx\n",
+ (unsigned long long)le64_to_cpu(desc.status_word),
+ (unsigned long long)le64_to_cpu(desc.buffer));
+
+ /* Effective buffer address */
+ baddr = le64_to_cpu(desc.buffer) & ~7ull;
+ baddr |= (rxdma_cfg & RXDMA_CFG_FBOFF) >> 10;
+
+ /* Write buffer out */
+ pci_dma_write(d, baddr, buf, size);
+
+ if (fcs_size) {
+ /* Should we add an FCS ? Linux doesn't ask us to strip it,
+ * however I believe nothing checks it... For now we just
+ * do nothing. It's faster this way.
+ */
+ }
+
+ /* Calculate the checksum */
+ coff = (rxdma_cfg & RXDMA_CFG_CSUMOFF) >> 13;
+ csum = net_raw_checksum(buf + coff, size - coff);
+
+ /* Build the updated descriptor */
+ desc.status_word = (size + fcs_size) << 16;
+ desc.status_word |= ((uint64_t)(mac_crc >> 16)) << 44;
+ desc.status_word |= csum;
+ if (rx_cond == rx_match_mcast) {
+ desc.status_word |= RXDCTRL_HPASS;
+ }
+ if (rx_cond == rx_match_altmac) {
+ desc.status_word |= RXDCTRL_ALTMAC;
+ }
+ desc.status_word = cpu_to_le64(desc.status_word);
+
+ pci_dma_write(d, dbase + done * sizeof(desc), &desc, sizeof(desc));
+
+ done = (done + 1) & s->rx_mask;
+ SET_REG(s, RXDMA_DONE, done);
+
+ /* XXX Unconditionally set RX interrupt for now. The interrupt
+ * mitigation timer might well end up adding more overhead than
+ * helping here...
+ */
+ ints = GREG_STAT_RXDONE;
+ if (sungem_rx_full(s, kick, done)) {
+ ints |= GREG_STAT_RXNOBUF;
+ }
+ sungem_update_status(s, ints, true);
+
+ return size;
+}
+
+static void sungem_set_link_status(NetClientState *nc)
+{
+ /* We don't do anything for now as I believe none of the OSes
+ * drivers use the MIF autopoll feature nor the PHY interrupt
+ */
+}
+
+static void sungem_update_masks(SunGEMState *s)
+{
+ uint32_t sz;
+
+ sz = 1 << (((GET_REG(s, RXDMA_CFG) & RXDMA_CFG_RINGSZ) >> 1) + 5);
+ s->rx_mask = sz - 1;
+
+ sz = 1 << (((GET_REG(s, TXDMA_CFG) & TXDMA_CFG_RINGSZ) >> 1) + 5);
+ s->tx_mask = sz - 1;
+}
+
+static void sungem_reset_rx(SunGEMState *s)
+{
+ DBGOUT(GEN, "RX reset\n");
+
+ /* XXX Do RXCFG */
+ /* XXX Check value */
+ SET_REG(s, RXDMA_FSZ, 0x140);
+ SET_REG(s, RXDMA_DONE, 0);
+ SET_REG(s, RXDMA_KICK, 0);
+ SET_REG(s, RXDMA_CFG, 0x1000010);
+ SET_REG(s, RXDMA_PTHRESH, 0xf8);
+ SET_REG(s, RXDMA_BLANK, 0);
+
+ sungem_update_masks(s);
+}
+
+static void sungem_reset_tx(SunGEMState *s)
+{
+ DBGOUT(GEN, "TX reset\n");
+
+ /* XXX Do TXCFG */
+ /* XXX Check value */
+ SET_REG(s, TXDMA_FSZ, 0x90);
+ SET_REG(s, TXDMA_TXDONE, 0);
+ SET_REG(s, TXDMA_KICK, 0);
+ SET_REG(s, TXDMA_CFG, 0x118010);
+
+ sungem_update_masks(s);
+
+ s->tx_size = 0;
+ s->tx_first_ctl = 0;
+}
+
+static void sungem_reset_all(SunGEMState *s, bool pci_reset)
+{
+ DBGOUT(GEN, "Full reset (PCI:%d)\n", pci_reset);
+
+ sungem_reset_rx(s);
+ sungem_reset_tx(s);
+
+ SET_REG(s, GREG_IMASK, 0xFFFFFFF);
+ SET_REG(s, GREG_STAT, 0);
+ if (pci_reset) {
+ uint8_t *ma = s->conf.macaddr.a;
+
+ SET_REG(s, GREG_SWRST, 0);
+ SET_REG(s, MAC_ADDR0, (ma[4] << 8) | ma[5]);
+ SET_REG(s, MAC_ADDR1, (ma[2] << 8) | ma[3]);
+ SET_REG(s, MAC_ADDR2, (ma[0] << 8) | ma[1]);
+ } else {
+ SET_REG(s, GREG_SWRST, GET_REG(s, GREG_SWRST) & GREG_SWRST_RSTOUT);
+ }
+ SET_REG(s, MIF_CFG, MIF_CFG_MDI0);
+}
+
+static void sungem_mii_write(SunGEMState *s, uint8_t phy_addr,
+ uint8_t reg_addr, uint16_t val)
+{
+ DBGOUT(MII, "MII write addr %x reg %02x val %04x\n",
+ phy_addr, reg_addr, val);
+
+ /* XXX TODO */
+}
+
+static uint16_t __sungem_mii_read(SunGEMState *s, uint8_t phy_addr,
+ uint8_t reg_addr)
+{
+ if (phy_addr != s->phy_addr) {
+ return 0xffff;
+ }
+ /* Primitive emulation of a BCM5201 to please the driver,
+ * ID is 0x00406210. TODO: Do a gigabit PHY like BCM5400
+ */
+ switch(reg_addr) {
+ case MII_BMCR:
+ return 0;
+ case MII_PHYID1:
+ return 0x0040;
+ case MII_PHYID2:
+ return 0x6210;
+ case MII_BMSR:
+ if (qemu_get_queue(s->nic)->link_down) {
+ return MII_BMSR_100TX_FD | MII_BMSR_AUTONEG;
+ } else {
+ return MII_BMSR_100TX_FD | MII_BMSR_AN_COMP |
+ MII_BMSR_AUTONEG | MII_BMSR_LINK_ST;
+ }
+ case MII_ANLPAR:
+ case MII_ANAR:
+ return MII_ANLPAR_TXFD;
+ case 0x18: /* 5201 AUX status */
+ return 3; /* 100FD */
+ default:
+ return 0;
+ };
+}
+static uint16_t sungem_mii_read(SunGEMState *s, uint8_t phy_addr,
+ uint8_t reg_addr)
+{
+ uint16_t val;
+
+ val = __sungem_mii_read(s, phy_addr, reg_addr);
+
+ DBGOUT(MII, "MII read addr %x reg %02x val %04x\n",
+ phy_addr, reg_addr, val);
+
+ return val;
+}
+
+static uint32_t sungem_mii_op(SunGEMState *s, uint32_t val)
+{
+ uint8_t phy_addr, reg_addr, op;
+
+ /* Ignore not start of frame */
+ if ((val >> 30) != 1) {
+ DBGOUT(ERR, "MII op, invalid SOF field %x\n", val >> 30);
+ return 0xffff;
+ }
+ phy_addr = (val & MIF_FRAME_PHYAD) >> 23;
+ reg_addr = (val & MIF_FRAME_REGAD) >> 18;
+ op = (val & MIF_FRAME_OP) >> 28;
+ switch (op) {
+ case 1:
+ sungem_mii_write(s, phy_addr, reg_addr, val & MIF_FRAME_DATA);
+ return val | MIF_FRAME_TALSB;
+ case 2:
+ return sungem_mii_read(s, phy_addr, reg_addr) | MIF_FRAME_TALSB;
+ default:
+ DBGOUT(ERR, "MII op, invalid op field %x\n", op);
+ }
+ return 0xffff | MIF_FRAME_TALSB;
+}
+
+static void sungem_mmio_write(void *opaque, hwaddr addr, uint64_t val,
+ unsigned size)
+{
+ SunGEMState *s = opaque;
+ uint32_t *regp;
+
+ /* Drop writes to PROM image */
+ if (addr > PROM_START) {
+ return;
+ }
+
+ regp = sungem_get_reg(s, addr);
+ if (!regp) {
+ DBGOUT(ERR, "MMIO write to unknown register 0x%04x\n",
+ (unsigned int)addr);
+ return;
+ }
+
+ DBGOUT(MMIO, "MMIO write to %04x val=%08x\n",
+ (uint32_t)addr, (uint32_t)val);
+
+ /* Pre-write filter */
+ switch(addr) {
+ /* Read only registers */
+ case GREG_SEBSTATE:
+ case GREG_STAT:
+ case GREG_STAT2:
+ case GREG_PCIESTAT:
+ case TXDMA_TXDONE:
+ case TXDMA_PCNT:
+ case TXDMA_SMACHINE:
+ case TXDMA_DPLOW:
+ case TXDMA_DPHI:
+ case TXDMA_FSZ:
+ case TXDMA_FTAG:
+ case RXDMA_DONE:
+ case RXDMA_PCNT:
+ case RXDMA_SMACHINE:
+ case RXDMA_DPLOW:
+ case RXDMA_DPHI:
+ case RXDMA_FSZ:
+ case RXDMA_FTAG:
+ case MAC_TXRST: /* Not technically read-only but will do for now */
+ case MAC_RXRST: /* Not technically read-only but will do for now */
+ case MAC_TXSTAT:
+ case MAC_RXSTAT:
+ case MAC_CSTAT:
+ case MAC_PATMPS:
+ case MAC_SMACHINE:
+ case MIF_STATUS:
+ case MIF_SMACHINE:
+ case PCS_MIISTAT:
+ case PCS_ISTAT:
+ case PCS_SSTATE:
+ return; /* No actual write */
+ case GREG_IACK:
+ val &= GREG_STAT_LATCH;
+ SET_REG(s, GREG_STAT, GET_REG(s, GREG_STAT) & ~val);
+ sungem_eval_irq(s);
+ return; /* No actual write */
+ case GREG_PCIEMASK:
+ val &= 0x7;
+ break;
+ case MIF_CFG:
+ /* Maintain the RO MDI bits to advertize an MDIO PHY on MDI0 */
+ val &= ~MIF_CFG_MDI1;
+ val |= MIF_CFG_MDI0;
+ break;
+ case MAC_MINFSZ:
+ /* 10-bits implemented */
+ val &= 0x3ff;
+ break;
+ }
+
+ *regp = val;
+
+ /* Post write action */
+ switch(addr) {
+ case GREG_IMASK:
+ /* Re-evaluate interrupt */
+ sungem_eval_irq(s);
+ break;
+ case MAC_TXMASK:
+ case MAC_RXMASK:
+ case MAC_MCMASK:
+ sungem_eval_cascade_irq(s);
+ break;
+ case GREG_SWRST:
+ switch(val & (GREG_SWRST_TXRST | GREG_SWRST_RXRST)) {
+ case GREG_SWRST_RXRST:
+ sungem_reset_rx(s);
+ break;
+ case GREG_SWRST_TXRST:
+ sungem_reset_tx(s);
+ break;
+ case GREG_SWRST_RXRST | GREG_SWRST_TXRST:
+ sungem_reset_all(s, false);
+ }
+ break;
+ case TXDMA_KICK:
+ sungem_tx_kick(s);
+ break;
+ case MIF_FRAME:
+ *regp = sungem_mii_op(s, val);
+ break;
+ case RXDMA_KICK:
+ DBGOUT(TX, "RXDMA_KICK written to %d\n", (int)val);
+ /* Through */
+ case MAC_RXCFG:
+ case RXDMA_CFG:
+ sungem_update_masks(s);
+ if ((GET_REG(s, MAC_RXCFG) & MAC_RXCFG_ENAB) != 0 &&
+ (GET_REG(s, RXDMA_CFG) & RXDMA_CFG_ENABLE) != 0) {
+ qemu_flush_queued_packets(qemu_get_queue(s->nic));
+ }
+ break;
+ case TXDMA_CFG:
+ sungem_update_masks(s);
+ }
+}
+
+static uint64_t sungem_mmio_read(void *opaque, hwaddr addr, unsigned size)
+{
+ SunGEMState *s = opaque;
+ uint32_t val, *regp;
+
+ /* No PROM image to read for now... */
+ if (addr > PROM_START) {
+ return 0xffffffff;
+ }
+
+ regp = sungem_get_reg(s, addr);
+ if (!regp) {
+ qemu_log_mask(LOG_GUEST_ERROR,"%s: read from unknown register
0x%04x\n",
+ __func__, (unsigned int)addr);
+ return 0;
+ }
+ val = *regp;
+
+ DBGOUT(MMIO, "MMIO read from %04x val=%08x\n", (uint32_t)addr, val);
+
+ switch(addr) {
+ case GREG_STAT:
+ /* Side effect, clear bottom 7 bits */
+ *regp = val & ~GREG_STAT_LATCH;
+ sungem_eval_irq(s);
+
+ /* Inject TX completion in returned value */
+ val = (val & ~GREG_STAT_TXNR) |
+ (GET_REG(s, TXDMA_TXDONE) << GREG_STAT_TXNR_SHIFT);
+ break;
+ case GREG_STAT2:
+ /* Return the status reg without side effect
+ * (and inject TX completion in returned value)
+ */
+ return (GET_REG(s, GREG_STAT) & ~GREG_STAT_TXNR) |
+ (GET_REG(s, TXDMA_TXDONE) << GREG_STAT_TXNR_SHIFT);
+ case MAC_TXSTAT:
+ *regp = 0; /* Side effect, clear all */
+ sungem_update_status(s, GREG_STAT_TXMAC, false);
+ break;
+ case MAC_RXSTAT:
+ *regp = 0; /* Side effect, clear all */
+ sungem_update_status(s, GREG_STAT_RXMAC, false);
+ break;
+ case MAC_CSTAT:
+ *regp &= MAC_CSTAT_PTR; /* Side effect, interrupt bits */
+ sungem_update_status(s, GREG_STAT_MAC, false);
+ break;
+ }
+
+ return val;
+}
+
+static void sungem_init_regs(SunGEMState *s)
+{
+ uint32_t i;
+
+ s->nregsblocks = ARRAY_SIZE(RegBlocks);
+ s->regs = g_malloc0(sizeof(uint32_t *) * s->nregsblocks);
+ for (i = 0; i < s->nregsblocks; i++) {
+ s->regs[i] = g_malloc0(sizeof(uint32_t) * RegBlocks[i].count);
+ }
+ sungem_reset_all(s, true);
+}
+
+/* PCI interface */
+
+static const MemoryRegionOps sungem_mmio_ops = {
+ .read = sungem_mmio_read,
+ .write = sungem_mmio_write,
+ .endianness = DEVICE_LITTLE_ENDIAN,
+ .impl = {
+ .min_access_size = 4,
+ .max_access_size = 4,
+ },
+};
+
+static void sungem_uninit(PCIDevice *dev)
+{
+ SunGEMState *s = SUNGEM(dev);
+
+ qemu_del_nic(s->nic);
+}
+
+static NetClientInfo net_sungem_info = {
+ .type = NET_CLIENT_DRIVER_NIC,
+ .size = sizeof(NICState),
+ .can_receive = sungem_can_receive,
+ .receive = sungem_receive,
+ .link_status_changed = sungem_set_link_status,
+};
+
+static void sungem_realize(PCIDevice *pci_dev, Error **errp)
+{
+ DeviceState *dev = DEVICE(pci_dev);
+ SunGEMState *s = SUNGEM(pci_dev);
+ uint8_t *pci_conf;
+
+ pci_conf = pci_dev->config;
+
+ pci_set_word(pci_conf + PCI_STATUS,
+ PCI_STATUS_FAST_BACK |
+ PCI_STATUS_DEVSEL_MEDIUM |
+ PCI_STATUS_66MHZ);
+
+ pci_set_word(pci_conf + PCI_SUBSYSTEM_VENDOR_ID, 0x0);
+ pci_set_word(pci_conf + PCI_SUBSYSTEM_ID, 0x0);
+
+ pci_conf[PCI_INTERRUPT_PIN] = 1; /* interrupt pin A */
+ pci_conf[PCI_MIN_GNT] = 0x40;
+ pci_conf[PCI_MAX_LAT] = 0x40;
+
+ sungem_init_regs(s);
+ memory_region_init_io(&s->mmio, OBJECT(s), &sungem_mmio_ops, s,
+ "sungem-mmio", SUNGEM_MMIO_SIZE);
+ pci_register_bar(pci_dev, 0, 0, &s->mmio);
+
+ qemu_macaddr_default_if_unset(&s->conf.macaddr);
+ s->nic = qemu_new_nic(&net_sungem_info, &s->conf,
+ object_get_typename(OBJECT(dev)),
+ dev->id, s);
+ qemu_format_nic_info_str(qemu_get_queue(s->nic),
+ s->conf.macaddr.a);
+}
+
+static void sungem_reset(DeviceState *dev)
+{
+ SunGEMState *s = SUNGEM(dev);
+
+ sungem_reset_all(s, true);
+}
+
+static void sungem_instance_init(Object *obj)
+{
+ /* XXX bootindex stuff */
+}
+
+static Property sungem_properties[] = {
+ DEFINE_NIC_PROPERTIES(SunGEMState, conf),
+ /* Phy address should be 0 for most Apple machines except
+ * for K2 in which case it's 1. Will be set by a machine
+ * override.
+ */
+ DEFINE_PROP_UINT32("phy_addr", SunGEMState, phy_addr, 0),
+ DEFINE_PROP_END_OF_LIST(),
+};
+
+static void sungem_class_init(ObjectClass *klass, void *data)
+{
+ DeviceClass *dc = DEVICE_CLASS(klass);
+ PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+
+ k->realize = sungem_realize;
+ k->exit = sungem_uninit;
+ k->vendor_id = PCI_VENDOR_ID_APPLE;
+ k->device_id = PCI_DEVICE_ID_APPLE_UNI_N_GMAC;
+ k->revision = 0x01;
+ k->class_id = PCI_CLASS_NETWORK_ETHERNET;
+ dc->reset = sungem_reset;
+ dc->props = sungem_properties;
+ set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
+}
+
+static const TypeInfo sungem_info = {
+ .name = TYPE_SUNGEM,
+ .parent = TYPE_PCI_DEVICE,
+ .instance_size = sizeof(SunGEMState),
+ .class_init = sungem_class_init,
+ .instance_init = sungem_instance_init,
+};
+
+static void sungem_register_types(void)
+{
+ type_register_static(&sungem_info);
+}
+
+type_init(sungem_register_types)
diff --git a/hw/net/sungem.h b/hw/net/sungem.h
new file mode 100644
index 0000000..0421a4a
--- /dev/null
+++ b/hw/net/sungem.h
@@ -0,0 +1,885 @@
+/*
+ * sungem.h: Definitions for Sun GEM ethernet model
+ *
+ * Taken from Linux sungem driver
+ *
+ * Copyright (C) 2000 David S. Miller (address@hidden)
+ */
+
+#ifndef _SUNGEM_H
+#define _SUNGEM_H
+
+/* Total MMIO size */
+#define SUNGEM_MMIO_SIZE 0x200000
+
+/* Global Registers */
+#define GREG_SEBSTATE 0x0000UL /* SEB State Register */
+#define GREG_CFG 0x0004UL /* Configuration Register */
+#define GREG_STAT 0x000CUL /* Status Register */
+#define GREG_IMASK 0x0010UL /* Interrupt Mask Register */
+#define GREG_IACK 0x0014UL /* Interrupt ACK Register */
+#define GREG_STAT2 0x001CUL /* Alias of GREG_STAT */
+#define GREG_PCIESTAT 0x1000UL /* PCI Error Status Register */
+#define GREG_PCIEMASK 0x1004UL /* PCI Error Mask Register */
+#define GREG_BIFCFG 0x1008UL /* BIF Configuration Register */
+#define GREG_BIFDIAG 0x100CUL /* BIF Diagnostics Register */
+#define GREG_SWRST 0x1010UL /* Software Reset Register */
+
+/* Global SEB State Register */
+#define GREG_SEBSTATE_ARB 0x00000003 /* State of Arbiter
*/
+#define GREG_SEBSTATE_RXWON 0x00000004 /* RX won internal arbitration
*/
+
+/* Global Configuration Register */
+#define GREG_CFG_IBURST 0x00000001 /* Infinite Burst
*/
+#define GREG_CFG_TXDMALIM 0x0000003e /* TX DMA grant limit
*/
+#define GREG_CFG_RXDMALIM 0x000007c0 /* RX DMA grant limit
*/
+#define GREG_CFG_RONPAULBIT 0x00000800 /* Use mem read multiple for
PCI read
+ * after infinite burst (Apple)
*/
+#define GREG_CFG_ENBUG2FIX 0x00001000 /* Fix Rx hang after overflow */
+
+/* Global Interrupt Status Register.
+ *
+ * Reading this register automatically clears bits 0 through 6.
+ * This auto-clearing does not occur when the alias at GREG_STAT2
+ * is read instead. The rest of the interrupt bits only clear when
+ * the secondary interrupt status register corresponding to that
+ * bit is read (ie. if GREG_STAT_PCS is set, it will be cleared by
+ * reading PCS_ISTAT).
+ */
+#define GREG_STAT_TXINTME 0x00000001 /* TX INTME frame transferred
*/
+#define GREG_STAT_TXALL 0x00000002 /* All TX frames
transferred */
+#define GREG_STAT_TXDONE 0x00000004 /* One TX frame transferred
*/
+#define GREG_STAT_RXDONE 0x00000010 /* One RX frame arrived
*/
+#define GREG_STAT_RXNOBUF 0x00000020 /* No free RX buffers available
*/
+#define GREG_STAT_RXTAGERR 0x00000040 /* RX tag framing is corrupt
*/
+#define GREG_STAT_PCS 0x00002000 /* PCS signalled interrupt
*/
+#define GREG_STAT_TXMAC 0x00004000 /* TX MAC signalled
interrupt */
+#define GREG_STAT_RXMAC 0x00008000 /* RX MAC signalled
interrupt */
+#define GREG_STAT_MAC 0x00010000 /* MAC Control signalled irq
*/
+#define GREG_STAT_MIF 0x00020000 /* MIF signalled interrupt
*/
+#define GREG_STAT_PCIERR 0x00040000 /* PCI Error interrupt
*/
+#define GREG_STAT_TXNR 0xfff80000 /* == TXDMA_TXDONE reg val
*/
+#define GREG_STAT_TXNR_SHIFT 19
+
+/* These interrupts are edge latches in the status register,
+ * reading it (or writing the corresponding bit in IACK) will
+ * clear them
+ */
+#define GREG_STAT_LATCH (GREG_STAT_TXALL | GREG_STAT_TXINTME | \
+ GREG_STAT_RXDONE | GREG_STAT_RXDONE | \
+ GREG_STAT_RXNOBUF | GREG_STAT_RXTAGERR)
+
+/* The layout of GREG_IMASK and GREG_IACK is identical to GREG_STAT.
+ * Bits set in GREG_IMASK will prevent that interrupt type from being
+ * signalled to the cpu. GREG_IACK can be used to clear specific top-level
+ * interrupt conditions in GREG_STAT, ie. it only works for bits 0 through 6.
+ * Setting the bit will clear that interrupt, clear bits will have no effect
+ * on GREG_STAT.
+ */
+
+/* Global PCI Error Status Register */
+#define GREG_PCIESTAT_BADACK 0x00000001 /* No ACK64# during ABS64 cycle
*/
+#define GREG_PCIESTAT_DTRTO 0x00000002 /* Delayed transaction timeout
*/
+#define GREG_PCIESTAT_OTHER 0x00000004 /* Other PCI error, check cfg
space */
+
+/* The layout of the GREG_PCIEMASK is identical to that of GREG_PCIESTAT.
+ * Bits set in GREG_PCIEMASK will prevent that interrupt type from being
+ * signalled to the cpu.
+ */
+
+/* Global BIF Configuration Register */
+#define GREG_BIFCFG_SLOWCLK 0x00000001 /* Set if PCI runs < 25Mhz
*/
+#define GREG_BIFCFG_B64DIS 0x00000002 /* Disable 64bit wide data
cycle*/
+#define GREG_BIFCFG_M66EN 0x00000004 /* Set if on 66Mhz PCI segment
*/
+
+/* Global BIF Diagnostics Register */
+#define GREG_BIFDIAG_BURSTSM 0x007f0000 /* PCI Burst state machine
*/
+#define GREG_BIFDIAG_BIFSM 0xff000000 /* BIF state machine
*/
+
+/* Global Software Reset Register.
+ *
+ * This register is used to perform a global reset of the RX and TX portions
+ * of the GEM asic. Setting the RX or TX reset bit will start the reset.
+ * The driver _MUST_ poll these bits until they clear. One may not attempt
+ * to program any other part of GEM until the bits clear.
+ */
+#define GREG_SWRST_TXRST 0x00000001 /* TX Software Reset
*/
+#define GREG_SWRST_RXRST 0x00000002 /* RX Software Reset
*/
+#define GREG_SWRST_RSTOUT 0x00000004 /* Force RST# pin active
*/
+#define GREG_SWRST_CACHESIZE 0x00ff0000 /* RIO only: cache line size
*/
+#define GREG_SWRST_CACHE_SHIFT 16
+
+/* TX DMA Registers */
+#define TXDMA_KICK 0x2000UL /* TX Kick Register */
+#define TXDMA_CFG 0x2004UL /* TX Configuration Register */
+#define TXDMA_DBLOW 0x2008UL /* TX Desc. Base Low */
+#define TXDMA_DBHI 0x200CUL /* TX Desc. Base High */
+#define TXDMA_FWPTR 0x2014UL /* TX FIFO Write Pointer */
+#define TXDMA_FSWPTR 0x2018UL /* TX FIFO Shadow Write Pointer */
+#define TXDMA_FRPTR 0x201CUL /* TX FIFO Read Pointer */
+#define TXDMA_FSRPTR 0x2020UL /* TX FIFO Shadow Read Pointer */
+#define TXDMA_PCNT 0x2024UL /* TX FIFO Packet Counter */
+#define TXDMA_SMACHINE 0x2028UL /* TX State Machine Register */
+#define TXDMA_DPLOW 0x2030UL /* TX Data Pointer Low */
+#define TXDMA_DPHI 0x2034UL /* TX Data Pointer High */
+#define TXDMA_TXDONE 0x2100UL /* TX Completion Register */
+#define TXDMA_FADDR 0x2104UL /* TX FIFO Address */
+#define TXDMA_FTAG 0x2108UL /* TX FIFO Tag */
+#define TXDMA_DLOW 0x210CUL /* TX FIFO Data Low */
+#define TXDMA_DHIT1 0x2110UL /* TX FIFO Data HighT1 */
+#define TXDMA_DHIT0 0x2114UL /* TX FIFO Data HighT0 */
+#define TXDMA_FSZ 0x2118UL /* TX FIFO Size */
+
+/* TX Kick Register.
+ *
+ * This 13-bit register is programmed by the driver to hold the descriptor
+ * entry index which follows the last valid transmit descriptor.
+ */
+
+/* TX Completion Register.
+ *
+ * This 13-bit register is updated by GEM to hold to descriptor entry index
+ * which follows the last descriptor already processed by GEM. Note that
+ * this value is mirrored in GREG_STAT which eliminates the need to even
+ * access this register in the driver during interrupt processing.
+ */
+
+/* TX Configuration Register.
+ *
+ * Note that TXDMA_CFG_FTHRESH, the TX FIFO Threshold, is an obsolete feature
+ * that was meant to be used with jumbo packets. It should be set to the
+ * maximum value of 0x4ff, else one risks getting TX MAC Underrun errors.
+ */
+#define TXDMA_CFG_ENABLE 0x00000001 /* Enable TX DMA channel
*/
+#define TXDMA_CFG_RINGSZ 0x0000001e /* TX descriptor ring size
*/
+#define TXDMA_CFG_RINGSZ_32 0x00000000 /* 32 TX descriptors
*/
+#define TXDMA_CFG_RINGSZ_64 0x00000002 /* 64 TX descriptors
*/
+#define TXDMA_CFG_RINGSZ_128 0x00000004 /* 128 TX descriptors
*/
+#define TXDMA_CFG_RINGSZ_256 0x00000006 /* 256 TX descriptors
*/
+#define TXDMA_CFG_RINGSZ_512 0x00000008 /* 512 TX descriptors
*/
+#define TXDMA_CFG_RINGSZ_1K 0x0000000a /* 1024 TX descriptors
*/
+#define TXDMA_CFG_RINGSZ_2K 0x0000000c /* 2048 TX descriptors
*/
+#define TXDMA_CFG_RINGSZ_4K 0x0000000e /* 4096 TX descriptors
*/
+#define TXDMA_CFG_RINGSZ_8K 0x00000010 /* 8192 TX descriptors
*/
+#define TXDMA_CFG_PIOSEL 0x00000020 /* Enable TX FIFO PIO from cpu
*/
+#define TXDMA_CFG_FTHRESH 0x001ffc00 /* TX FIFO Threshold, obsolete
*/
+#define TXDMA_CFG_PMODE 0x00200000 /* TXALL irq means TX
FIFO empty*/
+
+/* TX Descriptor Base Low/High.
+ *
+ * These two registers store the 53 most significant bits of the base address
+ * of the TX descriptor table. The 11 least significant bits are always
+ * zero. As a result, the TX descriptor table must be 2K aligned.
+ */
+
+/* The rest of the TXDMA_* registers are for diagnostics and debug, I will
document
+ * them later. -DaveM
+ */
+
+/* WakeOnLan Registers */
+#define WOL_MATCH0 0x3000UL
+#define WOL_MATCH1 0x3004UL
+#define WOL_MATCH2 0x3008UL
+#define WOL_MCOUNT 0x300CUL
+#define WOL_WAKECSR 0x3010UL
+
+/* WOL Match count register
+ */
+#define WOL_MCOUNT_N 0x00000010
+#define WOL_MCOUNT_M 0x00000000 /* 0 << 8 */
+
+#define WOL_WAKECSR_ENABLE 0x00000001
+#define WOL_WAKECSR_MII 0x00000002
+#define WOL_WAKECSR_SEEN 0x00000004
+#define WOL_WAKECSR_FILT_UCAST 0x00000008
+#define WOL_WAKECSR_FILT_MCAST 0x00000010
+#define WOL_WAKECSR_FILT_BCAST 0x00000020
+#define WOL_WAKECSR_FILT_SEEN 0x00000040
+
+
+/* Receive DMA Registers */
+#define RXDMA_CFG 0x4000UL /* RX Configuration Register */
+#define RXDMA_DBLOW 0x4004UL /* RX Descriptor Base Low */
+#define RXDMA_DBHI 0x4008UL /* RX Descriptor Base High */
+#define RXDMA_FWPTR 0x400CUL /* RX FIFO Write Pointer */
+#define RXDMA_FSWPTR 0x4010UL /* RX FIFO Shadow Write Pointer */
+#define RXDMA_FRPTR 0x4014UL /* RX FIFO Read Pointer */
+#define RXDMA_PCNT 0x4018UL /* RX FIFO Packet Counter */
+#define RXDMA_SMACHINE 0x401CUL /* RX State Machine Register */
+#define RXDMA_PTHRESH 0x4020UL /* Pause Thresholds */
+#define RXDMA_DPLOW 0x4024UL /* RX Data Pointer Low */
+#define RXDMA_DPHI 0x4028UL /* RX Data Pointer High */
+#define RXDMA_KICK 0x4100UL /* RX Kick Register */
+#define RXDMA_DONE 0x4104UL /* RX Completion Register */
+#define RXDMA_BLANK 0x4108UL /* RX Blanking Register */
+#define RXDMA_FADDR 0x410CUL /* RX FIFO Address */
+#define RXDMA_FTAG 0x4110UL /* RX FIFO Tag */
+#define RXDMA_DLOW 0x4114UL /* RX FIFO Data Low */
+#define RXDMA_DHIT1 0x4118UL /* RX FIFO Data HighT0 */
+#define RXDMA_DHIT0 0x411CUL /* RX FIFO Data HighT1 */
+#define RXDMA_FSZ 0x4120UL /* RX FIFO Size */
+
+/* RX Configuration Register. */
+#define RXDMA_CFG_ENABLE 0x00000001 /* Enable RX DMA channel
*/
+#define RXDMA_CFG_RINGSZ 0x0000001e /* RX descriptor ring size
*/
+#define RXDMA_CFG_RINGSZ_32 0x00000000 /* - 32 entries
*/
+#define RXDMA_CFG_RINGSZ_64 0x00000002 /* - 64 entries
*/
+#define RXDMA_CFG_RINGSZ_128 0x00000004 /* - 128 entries
*/
+#define RXDMA_CFG_RINGSZ_256 0x00000006 /* - 256 entries
*/
+#define RXDMA_CFG_RINGSZ_512 0x00000008 /* - 512 entries
*/
+#define RXDMA_CFG_RINGSZ_1K 0x0000000a /* - 1024 entries
*/
+#define RXDMA_CFG_RINGSZ_2K 0x0000000c /* - 2048 entries
*/
+#define RXDMA_CFG_RINGSZ_4K 0x0000000e /* - 4096 entries
*/
+#define RXDMA_CFG_RINGSZ_8K 0x00000010 /* - 8192 entries
*/
+#define RXDMA_CFG_RINGSZ_BDISAB 0x00000020 /* Disable RX desc
batching */
+#define RXDMA_CFG_FBOFF 0x00001c00 /* Offset of first data
byte */
+#define RXDMA_CFG_CSUMOFF 0x000fe000 /* Skip bytes before csum calc
*/
+#define RXDMA_CFG_FTHRESH 0x07000000 /* RX FIFO dma start threshold
*/
+#define RXDMA_CFG_FTHRESH_64 0x00000000 /* - 64 bytes
*/
+#define RXDMA_CFG_FTHRESH_128 0x01000000 /* - 128 bytes
*/
+#define RXDMA_CFG_FTHRESH_256 0x02000000 /* - 256 bytes
*/
+#define RXDMA_CFG_FTHRESH_512 0x03000000 /* - 512 bytes
*/
+#define RXDMA_CFG_FTHRESH_1K 0x04000000 /* - 1024 bytes
*/
+#define RXDMA_CFG_FTHRESH_2K 0x05000000 /* - 2048 bytes
*/
+
+/* RX Descriptor Base Low/High.
+ *
+ * These two registers store the 53 most significant bits of the base address
+ * of the RX descriptor table. The 11 least significant bits are always
+ * zero. As a result, the RX descriptor table must be 2K aligned.
+ */
+
+/* RX PAUSE Thresholds.
+ *
+ * These values determine when XOFF and XON PAUSE frames are emitted by
+ * GEM. The thresholds measure RX FIFO occupancy in units of 64 bytes.
+ */
+#define RXDMA_PTHRESH_OFF 0x000001ff /* XOFF emitted w/FIFO > this
*/
+#define RXDMA_PTHRESH_ON 0x001ff000 /* XON emitted w/FIFO < this
*/
+
+/* RX Kick Register.
+ *
+ * This 13-bit register is written by the host CPU and holds the last
+ * valid RX descriptor number plus one. This is, if 'N' is written to
+ * this register, it means that all RX descriptors up to but excluding
+ * 'N' are valid.
+ *
+ * The hardware requires that RX descriptors are posted in increments
+ * of 4. This means 'N' must be a multiple of four. For the best
+ * performance, the first new descriptor being posted should be (PCI)
+ * cache line aligned.
+ */
+
+/* RX Completion Register.
+ *
+ * This 13-bit register is updated by GEM to indicate which RX descriptors
+ * have already been used for receive frames. All descriptors up to but
+ * excluding the value in this register are ready to be processed. GEM
+ * updates this register value after the RX FIFO empties completely into
+ * the RX descriptor's buffer, but before the RX_DONE bit is set in the
+ * interrupt status register.
+ */
+
+/* RX Blanking Register. */
+#define RXDMA_BLANK_IPKTS 0x000001ff /* RX_DONE asserted after this
+ * many packets received since
+ * previous RX_DONE.
+ */
+#define RXDMA_BLANK_ITIME 0x000ff000 /* RX_DONE asserted after this
+ * many clocks (measured in 2048
+ * PCI clocks) were counted
since
+ * the previous RX_DONE.
+ */
+
+/* RX FIFO Size.
+ *
+ * This 11-bit read-only register indicates how large, in units of 64-bytes,
+ * the RX FIFO is. The driver uses this to properly configure the RX PAUSE
+ * thresholds.
+ */
+
+/* The rest of the RXDMA_* registers are for diagnostics and debug, I will
document
+ * them later. -DaveM
+ */
+
+/* MAC Registers */
+#define MAC_TXRST 0x6000UL /* TX MAC Software Reset Command*/
+#define MAC_RXRST 0x6004UL /* RX MAC Software Reset Command*/
+#define MAC_SNDPAUSE 0x6008UL /* Send Pause Command Register */
+#define MAC_TXSTAT 0x6010UL /* TX MAC Status Register */
+#define MAC_RXSTAT 0x6014UL /* RX MAC Status Register */
+#define MAC_CSTAT 0x6018UL /* MAC Control Status Register */
+#define MAC_TXMASK 0x6020UL /* TX MAC Mask Register */
+#define MAC_RXMASK 0x6024UL /* RX MAC Mask Register */
+#define MAC_MCMASK 0x6028UL /* MAC Control Mask Register */
+#define MAC_TXCFG 0x6030UL /* TX MAC Configuration Register*/
+#define MAC_RXCFG 0x6034UL /* RX MAC Configuration Register*/
+#define MAC_MCCFG 0x6038UL /* MAC Control Config Register */
+#define MAC_XIFCFG 0x603CUL /* XIF Configuration Register */
+#define MAC_IPG0 0x6040UL /* InterPacketGap0 Register */
+#define MAC_IPG1 0x6044UL /* InterPacketGap1 Register */
+#define MAC_IPG2 0x6048UL /* InterPacketGap2 Register */
+#define MAC_STIME 0x604CUL /* SlotTime Register */
+#define MAC_MINFSZ 0x6050UL /* MinFrameSize Register */
+#define MAC_MAXFSZ 0x6054UL /* MaxFrameSize Register */
+#define MAC_PASIZE 0x6058UL /* PA Size Register */
+#define MAC_JAMSIZE 0x605CUL /* JamSize Register */
+#define MAC_ATTLIM 0x6060UL /* Attempt Limit Register */
+#define MAC_MCTYPE 0x6064UL /* MAC Control Type Register */
+#define MAC_ADDR0 0x6080UL /* MAC Address 0 Register */
+#define MAC_ADDR1 0x6084UL /* MAC Address 1 Register */
+#define MAC_ADDR2 0x6088UL /* MAC Address 2 Register */
+#define MAC_ADDR3 0x608CUL /* MAC Address 3 Register */
+#define MAC_ADDR4 0x6090UL /* MAC Address 4 Register */
+#define MAC_ADDR5 0x6094UL /* MAC Address 5 Register */
+#define MAC_ADDR6 0x6098UL /* MAC Address 6 Register */
+#define MAC_ADDR7 0x609CUL /* MAC Address 7 Register */
+#define MAC_ADDR8 0x60A0UL /* MAC Address 8 Register */
+#define MAC_AFILT0 0x60A4UL /* Address Filter 0 Register */
+#define MAC_AFILT1 0x60A8UL /* Address Filter 1 Register */
+#define MAC_AFILT2 0x60ACUL /* Address Filter 2 Register */
+#define MAC_AF21MSK 0x60B0UL /* Address Filter 2&1 Mask Reg */
+#define MAC_AF0MSK 0x60B4UL /* Address Filter 0 Mask Reg */
+#define MAC_HASH0 0x60C0UL /* Hash Table 0 Register */
+#define MAC_HASH1 0x60C4UL /* Hash Table 1 Register */
+#define MAC_HASH2 0x60C8UL /* Hash Table 2 Register */
+#define MAC_HASH3 0x60CCUL /* Hash Table 3 Register */
+#define MAC_HASH4 0x60D0UL /* Hash Table 4 Register */
+#define MAC_HASH5 0x60D4UL /* Hash Table 5 Register */
+#define MAC_HASH6 0x60D8UL /* Hash Table 6 Register */
+#define MAC_HASH7 0x60DCUL /* Hash Table 7 Register */
+#define MAC_HASH8 0x60E0UL /* Hash Table 8 Register */
+#define MAC_HASH9 0x60E4UL /* Hash Table 9 Register */
+#define MAC_HASH10 0x60E8UL /* Hash Table 10 Register */
+#define MAC_HASH11 0x60ECUL /* Hash Table 11 Register */
+#define MAC_HASH12 0x60F0UL /* Hash Table 12 Register */
+#define MAC_HASH13 0x60F4UL /* Hash Table 13 Register */
+#define MAC_HASH14 0x60F8UL /* Hash Table 14 Register */
+#define MAC_HASH15 0x60FCUL /* Hash Table 15 Register */
+#define MAC_NCOLL 0x6100UL /* Normal Collision Counter */
+#define MAC_FASUCC 0x6104UL /* First Attmpt. Succ Coll Ctr. */
+#define MAC_ECOLL 0x6108UL /* Excessive Collision Counter */
+#define MAC_LCOLL 0x610CUL /* Late Collision Counter */
+#define MAC_DTIMER 0x6110UL /* Defer Timer */
+#define MAC_PATMPS 0x6114UL /* Peak Attempts Register */
+#define MAC_RFCTR 0x6118UL /* Receive Frame Counter */
+#define MAC_LERR 0x611CUL /* Length Error Counter */
+#define MAC_AERR 0x6120UL /* Alignment Error Counter */
+#define MAC_FCSERR 0x6124UL /* FCS Error Counter */
+#define MAC_RXCVERR 0x6128UL /* RX code Violation Error Ctr */
+#define MAC_RANDSEED 0x6130UL /* Random Number Seed Register */
+#define MAC_SMACHINE 0x6134UL /* State Machine Register */
+
+/* TX MAC Software Reset Command. */
+#define MAC_TXRST_CMD 0x00000001 /* Start sw reset, self-clears */
+
+/* RX MAC Software Reset Command. */
+#define MAC_RXRST_CMD 0x00000001 /* Start sw reset, self-clears */
+
+/* Send Pause Command. */
+#define MAC_SNDPAUSE_TS 0x0000ffff /* The pause_time operand used
in
+ * Send_Pause and flow-control
+ * handshakes.
+ */
+#define MAC_SNDPAUSE_SP 0x00010000 /* Setting this bit instructs
the MAC
+ * to send a Pause Flow Control
+ * frame onto the network.
+ */
+
+/* TX MAC Status Register. */
+#define MAC_TXSTAT_XMIT 0x00000001 /* Frame Transmitted
*/
+#define MAC_TXSTAT_URUN 0x00000002 /* TX Underrun
*/
+#define MAC_TXSTAT_MPE 0x00000004 /* Max Packet Size Error */
+#define MAC_TXSTAT_NCE 0x00000008 /* Normal Collision Cntr Expire */
+#define MAC_TXSTAT_ECE 0x00000010 /* Excess Collision Cntr Expire */
+#define MAC_TXSTAT_LCE 0x00000020 /* Late Collision Cntr Expire */
+#define MAC_TXSTAT_FCE 0x00000040 /* First Collision Cntr Expire */
+#define MAC_TXSTAT_DTE 0x00000080 /* Defer Timer Expire */
+#define MAC_TXSTAT_PCE 0x00000100 /* Peak Attempts Cntr Expire */
+
+/* RX MAC Status Register. */
+#define MAC_RXSTAT_RCV 0x00000001 /* Frame Received */
+#define MAC_RXSTAT_OFLW 0x00000002 /* Receive Overflow
*/
+#define MAC_RXSTAT_FCE 0x00000004 /* Frame Cntr Expire */
+#define MAC_RXSTAT_ACE 0x00000008 /* Align Error Cntr Expire */
+#define MAC_RXSTAT_CCE 0x00000010 /* CRC Error Cntr Expire */
+#define MAC_RXSTAT_LCE 0x00000020 /* Length Error Cntr Expire */
+#define MAC_RXSTAT_VCE 0x00000040 /* Code Violation Cntr Expire */
+
+/* MAC Control Status Register. */
+#define MAC_CSTAT_PRCV 0x00000001 /* Pause Received */
+#define MAC_CSTAT_PS 0x00000002 /* Paused State */
+#define MAC_CSTAT_NPS 0x00000004 /* Not Paused State */
+#define MAC_CSTAT_PTR 0xffff0000 /* Pause Time Received */
+
+/* The layout of the MAC_{TX,RX,C}MASK registers is identical to that
+ * of MAC_{TX,RX,C}STAT. Bits set in MAC_{TX,RX,C}MASK will prevent
+ * that interrupt type from being signalled to front end of GEM. For
+ * the interrupt to actually get sent to the cpu, it is necessary to
+ * properly set the appropriate GREG_IMASK_{TX,RX,}MAC bits as well.
+ */
+
+/* TX MAC Configuration Register.
+ *
+ * NOTE: The TX MAC Enable bit must be cleared and polled until
+ * zero before any other bits in this register are changed.
+ *
+ * Also, enabling the Carrier Extension feature of GEM is
+ * a 3 step process 1) Set TX Carrier Extension 2) Set
+ * RX Carrier Extension 3) Set Slot Time to 0x200. This
+ * mode must be enabled when in half-duplex at 1Gbps, else
+ * it must be disabled.
+ */
+#define MAC_TXCFG_ENAB 0x00000001 /* TX MAC Enable */
+#define MAC_TXCFG_ICS 0x00000002 /* Ignore Carrier Sense */
+#define MAC_TXCFG_ICOLL 0x00000004 /* Ignore Collisions
*/
+#define MAC_TXCFG_EIPG0 0x00000008 /* Enable IPG0
*/
+#define MAC_TXCFG_NGU 0x00000010 /* Never Give Up */
+#define MAC_TXCFG_NGUL 0x00000020 /* Never Give Up Limit */
+#define MAC_TXCFG_NBO 0x00000040 /* No Backoff */
+#define MAC_TXCFG_SD 0x00000080 /* Slow Down */
+#define MAC_TXCFG_NFCS 0x00000100 /* No FCS */
+#define MAC_TXCFG_TCE 0x00000200 /* TX Carrier Extension */
+
+/* RX MAC Configuration Register.
+ *
+ * NOTE: The RX MAC Enable bit must be cleared and polled until
+ * zero before any other bits in this register are changed.
+ *
+ * Similar rules apply to the Hash Filter Enable bit when
+ * programming the hash table registers, and the Address Filter
+ * Enable bit when programming the address filter registers.
+ */
+#define MAC_RXCFG_ENAB 0x00000001 /* RX MAC Enable */
+#define MAC_RXCFG_SPAD 0x00000002 /* Strip Pad */
+#define MAC_RXCFG_SFCS 0x00000004 /* Strip FCS */
+#define MAC_RXCFG_PROM 0x00000008 /* Promiscuous Mode */
+#define MAC_RXCFG_PGRP 0x00000010 /* Promiscuous Group */
+#define MAC_RXCFG_HFE 0x00000020 /* Hash Filter Enable */
+#define MAC_RXCFG_AFE 0x00000040 /* Address Filter Enable */
+#define MAC_RXCFG_DDE 0x00000080 /* Disable Discard on Error */
+#define MAC_RXCFG_RCE 0x00000100 /* RX Carrier Extension */
+
+/* MAC Control Config Register. */
+#define MAC_MCCFG_SPE 0x00000001 /* Send Pause Enable */
+#define MAC_MCCFG_RPE 0x00000002 /* Receive Pause Enable */
+#define MAC_MCCFG_PMC 0x00000004 /* Pass MAC Control */
+
+/* XIF Configuration Register.
+ *
+ * NOTE: When leaving or entering loopback mode, a global hardware
+ * init of GEM should be performed.
+ */
+#define MAC_XIFCFG_OE 0x00000001 /* MII TX Output Driver Enable */
+#define MAC_XIFCFG_LBCK 0x00000002 /* Loopback TX to RX
*/
+#define MAC_XIFCFG_DISE 0x00000004 /* Disable RX path during TX
*/
+#define MAC_XIFCFG_GMII 0x00000008 /* Use GMII clocks + datapath
*/
+#define MAC_XIFCFG_MBOE 0x00000010 /* Controls MII_BUF_EN pin
*/
+#define MAC_XIFCFG_LLED 0x00000020 /* Force LINKLED# active (low)
*/
+#define MAC_XIFCFG_FLED 0x00000040 /* Force FDPLXLED# active (low)
*/
+
+/* InterPacketGap0 Register. This 8-bit value is used as an extension
+ * to the InterPacketGap1 Register. Specifically it contributes to the
+ * timing of the RX-to-TX IPG. This value is ignored and presumed to
+ * be zero for TX-to-TX IPG calculations and/or when the Enable IPG0 bit
+ * is cleared in the TX MAC Configuration Register.
+ *
+ * This value in this register in terms of media byte time.
+ *
+ * Recommended value: 0x00
+ */
+
+/* InterPacketGap1 Register. This 8-bit value defines the first 2/3
+ * portion of the Inter Packet Gap.
+ *
+ * This value in this register in terms of media byte time.
+ *
+ * Recommended value: 0x08
+ */
+
+/* InterPacketGap2 Register. This 8-bit value defines the second 1/3
+ * portion of the Inter Packet Gap.
+ *
+ * This value in this register in terms of media byte time.
+ *
+ * Recommended value: 0x04
+ */
+
+/* Slot Time Register. This 10-bit value specifies the slot time
+ * parameter in units of media byte time. It determines the physical
+ * span of the network.
+ *
+ * Recommended value: 0x40
+ */
+
+/* Minimum Frame Size Register. This 10-bit register specifies the
+ * smallest sized frame the TXMAC will send onto the medium, and the
+ * RXMAC will receive from the medium.
+ *
+ * Recommended value: 0x40
+ */
+
+/* Maximum Frame and Burst Size Register.
+ *
+ * This register specifies two things. First it specifies the maximum
+ * sized frame the TXMAC will send and the RXMAC will recognize as
+ * valid. Second, it specifies the maximum run length of a burst of
+ * packets sent in half-duplex gigabit modes.
+ *
+ * Recommended value: 0x200005ee
+ */
+#define MAC_MAXFSZ_MFS 0x00007fff /* Max Frame Size */
+#define MAC_MAXFSZ_MBS 0x7fff0000 /* Max Burst Size */
+
+/* PA Size Register. This 10-bit register specifies the number of preamble
+ * bytes which will be transmitted at the beginning of each frame. A
+ * value of two or greater should be programmed here.
+ *
+ * Recommended value: 0x07
+ */
+
+/* Jam Size Register. This 4-bit register specifies the duration of
+ * the jam in units of media byte time.
+ *
+ * Recommended value: 0x04
+ */
+
+/* Attempts Limit Register. This 8-bit register specifies the number
+ * of attempts that the TXMAC will make to transmit a frame, before it
+ * resets its Attempts Counter. After reaching the Attempts Limit the
+ * TXMAC may or may not drop the frame, as determined by the NGU
+ * (Never Give Up) and NGUL (Never Give Up Limit) bits in the TXMAC
+ * Configuration Register.
+ *
+ * Recommended value: 0x10
+ */
+
+/* MAX Control Type Register. This 16-bit register specifies the
+ * "type" field of a MAC Control frame. The TXMAC uses this field to
+ * encapsulate the MAC Control frame for transmission, and the RXMAC
+ * uses it for decoding valid MAC Control frames received from the
+ * network.
+ *
+ * Recommended value: 0x8808
+ */
+
+/* MAC Address Registers. Each of these registers specify the
+ * ethernet MAC of the interface, 16-bits at a time. Register
+ * 0 specifies bits [47:32], register 1 bits [31:16], and register
+ * 2 bits [15:0].
+ *
+ * Registers 3 through and including 5 specify an alternate
+ * MAC address for the interface.
+ *
+ * Registers 6 through and including 8 specify the MAC Control
+ * Address, which must be the reserved multicast address for MAC
+ * Control frames.
+ *
+ * Example: To program primary station address a:b:c:d:e:f into
+ * the chip.
+ * MAC_Address_2 = (a << 8) | b
+ * MAC_Address_1 = (c << 8) | d
+ * MAC_Address_0 = (e << 8) | f
+ */
+
+/* Address Filter Registers. Registers 0 through 2 specify bit
+ * fields [47:32] through [15:0], respectively, of the address
+ * filter. The Address Filter 2&1 Mask Register denotes the 8-bit
+ * nibble mask for Address Filter Registers 2 and 1. The Address
+ * Filter 0 Mask Register denotes the 16-bit mask for the Address
+ * Filter Register 0.
+ */
+
+/* Hash Table Registers. Registers 0 through 15 specify bit fields
+ * [255:240] through [15:0], respectively, of the hash table.
+ */
+
+/* Statistics Registers. All of these registers are 16-bits and
+ * track occurrences of a specific event. GEM can be configured
+ * to interrupt the host cpu when any of these counters overflow.
+ * They should all be explicitly initialized to zero when the interface
+ * is brought up.
+ */
+
+/* Random Number Seed Register. This 10-bit value is used as the
+ * RNG seed inside GEM for the CSMA/CD backoff algorithm. It is
+ * recommended to program this register to the 10 LSB of the
+ * interfaces MAC address.
+ */
+
+/* Pause Timer, read-only. This 16-bit timer is used to time the pause
+ * interval as indicated by a received pause flow control frame.
+ * A non-zero value in this timer indicates that the MAC is currently in
+ * the paused state.
+ */
+
+/* MIF Registers */
+#define MIF_BBCLK 0x6200UL /* MIF Bit-Bang Clock */
+#define MIF_BBDATA 0x6204UL /* MIF Bit-Band Data */
+#define MIF_BBOENAB 0x6208UL /* MIF Bit-Bang Output Enable */
+#define MIF_FRAME 0x620CUL /* MIF Frame/Output Register */
+#define MIF_CFG 0x6210UL /* MIF Configuration Register
*/
+#define MIF_MASK 0x6214UL /* MIF Mask Register */
+#define MIF_STATUS 0x6218UL /* MIF Status Register */
+#define MIF_SMACHINE 0x621CUL /* MIF State Machine Register */
+
+/* MIF Bit-Bang Clock. This 1-bit register is used to generate the
+ * MDC clock waveform on the MII Management Interface when the MIF is
+ * programmed in the "Bit-Bang" mode. Writing a '1' after a '0' into
+ * this register will create a rising edge on the MDC, while writing
+ * a '0' after a '1' will create a falling edge. For every bit that
+ * is transferred on the management interface, both edges have to be
+ * generated.
+ */
+
+/* MIF Bit-Bang Data. This 1-bit register is used to generate the
+ * outgoing data (MDO) on the MII Management Interface when the MIF
+ * is programmed in the "Bit-Bang" mode. The daa will be steered to the
+ * appropriate MDIO based on the state of the PHY_Select bit in the MIF
+ * Configuration Register.
+ */
+
+/* MIF Big-Band Output Enable. THis 1-bit register is used to enable
+ * ('1') or disable ('0') the I-directional driver on the MII when the
+ * MIF is programmed in the "Bit-Bang" mode. The MDIO should be enabled
+ * when data bits are transferred from the MIF to the transceiver, and it
+ * should be disabled when the interface is idle or when data bits are
+ * transferred from the transceiver to the MIF (data portion of a read
+ * instruction). Only one MDIO will be enabled at a given time, depending
+ * on the state of the PHY_Select bit in the MIF Configuration Register.
+ */
+
+/* MIF Configuration Register. This 15-bit register controls the operation
+ * of the MIF.
+ */
+#define MIF_CFG_PSELECT 0x00000001 /* Xcvr slct: 0=mdio0 1=mdio1
*/
+#define MIF_CFG_POLL 0x00000002 /* Enable polling mechanism */
+#define MIF_CFG_BBMODE 0x00000004 /* 1=bit-bang 0=frame mode */
+#define MIF_CFG_PRADDR 0x000000f8 /* Xcvr poll register address */
+#define MIF_CFG_MDI0 0x00000100 /* MDIO_0 present or read-bit */
+#define MIF_CFG_MDI1 0x00000200 /* MDIO_1 present or read-bit */
+#define MIF_CFG_PPADDR 0x00007c00 /* Xcvr poll PHY address */
+
+/* MIF Frame/Output Register. This 32-bit register allows the host to
+ * communicate with a transceiver in frame mode (as opposed to big-bang
+ * mode). Writes by the host specify an instrution. After being issued
+ * the host must poll this register for completion. Also, after
+ * completion this register holds the data returned by the transceiver
+ * if applicable.
+ */
+#define MIF_FRAME_ST 0xc0000000 /* STart of frame */
+#define MIF_FRAME_OP 0x30000000 /* OPcode */
+#define MIF_FRAME_PHYAD 0x0f800000 /* PHY ADdress
*/
+#define MIF_FRAME_REGAD 0x007c0000 /* REGister ADdress
*/
+#define MIF_FRAME_TAMSB 0x00020000 /* Turn Around MSB
*/
+#define MIF_FRAME_TALSB 0x00010000 /* Turn Around LSB
*/
+#define MIF_FRAME_DATA 0x0000ffff /* Instruction Payload */
+
+/* MIF Status Register. This register reports status when the MIF is
+ * operating in the poll mode. The poll status field is auto-clearing
+ * on read.
+ */
+#define MIF_STATUS_DATA 0xffff0000 /* Live image of XCVR reg
*/
+#define MIF_STATUS_STAT 0x0000ffff /* Which bits have changed
*/
+
+/* MIF Mask Register. This 16-bit register is used when in poll mode
+ * to say which bits of the polled register will cause an interrupt
+ * when changed.
+ */
+
+/* PCS/Serialink Registers */
+#define PCS_MIICTRL 0x9000UL /* PCS MII Control Register */
+#define PCS_MIISTAT 0x9004UL /* PCS MII Status Register */
+#define PCS_MIIADV 0x9008UL /* PCS MII Advertisement Reg */
+#define PCS_MIILP 0x900CUL /* PCS MII Link Partner Ability */
+#define PCS_CFG 0x9010UL /* PCS Configuration Register
*/
+#define PCS_SMACHINE 0x9014UL /* PCS State Machine Register */
+#define PCS_ISTAT 0x9018UL /* PCS Interrupt Status Reg */
+#define PCS_DMODE 0x9050UL /* Datapath Mode Register */
+#define PCS_SCTRL 0x9054UL /* Serialink Control Register */
+#define PCS_SOS 0x9058UL /* Shared Output Select Reg
*/
+#define PCS_SSTATE 0x905CUL /* Serialink State Register */
+
+/* PCD MII Control Register. */
+#define PCS_MIICTRL_SPD 0x00000040 /* Read as one, writes ignored
*/
+#define PCS_MIICTRL_CT 0x00000080 /* Force COL signal active */
+#define PCS_MIICTRL_DM 0x00000100 /* Duplex mode, forced low */
+#define PCS_MIICTRL_RAN 0x00000200 /* Restart auto-neg, self clear
*/
+#define PCS_MIICTRL_ISO 0x00000400 /* Read as zero, writes ignored
*/
+#define PCS_MIICTRL_PD 0x00000800 /* Read as zero, writes ignored */
+#define PCS_MIICTRL_ANE 0x00001000 /* Auto-neg enable
*/
+#define PCS_MIICTRL_SS 0x00002000 /* Read as zero, writes ignored */
+#define PCS_MIICTRL_WB 0x00004000 /* Wrapback, loopback at 10-bit
+ * input side of Serialink
+ */
+#define PCS_MIICTRL_RST 0x00008000 /* Resets PCS, self clearing
*/
+
+/* PCS MII Status Register. */
+#define PCS_MIISTAT_EC 0x00000001 /* Ext Capability: Read as zero */
+#define PCS_MIISTAT_JD 0x00000002 /* Jabber Detect: Read as zero */
+#define PCS_MIISTAT_LS 0x00000004 /* Link Status: 1=up 0=down */
+#define PCS_MIISTAT_ANA 0x00000008 /* Auto-neg Ability, always 1
*/
+#define PCS_MIISTAT_RF 0x00000010 /* Remote Fault */
+#define PCS_MIISTAT_ANC 0x00000020 /* Auto-neg complete
*/
+#define PCS_MIISTAT_ES 0x00000100 /* Extended Status, always 1 */
+
+/* PCS MII Advertisement Register. */
+#define PCS_MIIADV_FD 0x00000020 /* Advertise Full Duplex */
+#define PCS_MIIADV_HD 0x00000040 /* Advertise Half Duplex */
+#define PCS_MIIADV_SP 0x00000080 /* Advertise Symmetric Pause */
+#define PCS_MIIADV_AP 0x00000100 /* Advertise Asymmetric Pause */
+#define PCS_MIIADV_RF 0x00003000 /* Remote Fault */
+#define PCS_MIIADV_ACK 0x00004000 /* Read-only */
+#define PCS_MIIADV_NP 0x00008000 /* Next-page, forced low */
+
+/* PCS MII Link Partner Ability Register. This register is equivalent
+ * to the Link Partnet Ability Register of the standard MII register set.
+ * It's layout corresponds to the PCS MII Advertisement Register.
+ */
+
+/* PCS Configuration Register. */
+#define PCS_CFG_ENABLE 0x00000001 /* Must be zero while changing
+ * PCS MII advertisement reg.
+ */
+#define PCS_CFG_SDO 0x00000002 /* Signal detect override */
+#define PCS_CFG_SDL 0x00000004 /* Signal detect active low */
+#define PCS_CFG_JS 0x00000018 /* Jitter-study:
+ * 0 = normal operation
+ * 1 = high-frequency test pattern
+ * 2 = low-frequency test pattern
+ * 3 = reserved
+ */
+#define PCS_CFG_TO 0x00000020 /* 10ms auto-neg timer override */
+
+/* PCS Interrupt Status Register. This register is self-clearing
+ * when read.
+ */
+#define PCS_ISTAT_LSC 0x00000004 /* Link Status Change */
+
+/* Datapath Mode Register. */
+#define PCS_DMODE_SM 0x00000001 /* 1 = use internal Serialink */
+#define PCS_DMODE_ESM 0x00000002 /* External SERDES mode */
+#define PCS_DMODE_MGM 0x00000004 /* MII/GMII mode */
+#define PCS_DMODE_GMOE 0x00000008 /* GMII Output Enable */
+
+/* Serialink Control Register.
+ *
+ * NOTE: When in SERDES mode, the loopback bit has inverse logic.
+ */
+#define PCS_SCTRL_LOOP 0x00000001 /* Loopback enable */
+#define PCS_SCTRL_ESCD 0x00000002 /* Enable sync char detection */
+#define PCS_SCTRL_LOCK 0x00000004 /* Lock to reference clock */
+#define PCS_SCTRL_EMP 0x00000018 /* Output driver emphasis */
+#define PCS_SCTRL_STEST 0x000001c0 /* Self test patterns
*/
+#define PCS_SCTRL_PDWN 0x00000200 /* Software power-down */
+#define PCS_SCTRL_RXZ 0x00000c00 /* PLL input to Serialink */
+#define PCS_SCTRL_RXP 0x00003000 /* PLL input to Serialink */
+#define PCS_SCTRL_TXZ 0x0000c000 /* PLL input to Serialink */
+#define PCS_SCTRL_TXP 0x00030000 /* PLL input to Serialink */
+
+/* Shared Output Select Register. For test and debug, allows multiplexing
+ * test outputs into the PROM address pins. Set to zero for normal
+ * operation.
+ */
+#define PCS_SOS_PADDR 0x00000003 /* PROM Address */
+
+/* PROM Image Space */
+#define PROM_START 0x100000UL /* Expansion ROM run time access*/
+#define PROM_SIZE 0x0fffffUL /* Size of ROM */
+#define PROM_END 0x200000UL /* End of ROM */
+
+/* MII definitions missing from mii.h */
+
+#define BMCR_SPD2 0x0040 /* Gigabit enable? (bcm5411) */
+#define LPA_PAUSE 0x0400
+
+/* More PHY registers (specific to Broadcom models) */
+
+/* MII BCM5201 MULTIPHY interrupt register */
+#define MII_BCM5201_INTERRUPT 0x1A
+#define MII_BCM5201_INTERRUPT_INTENABLE 0x4000
+
+#define MII_BCM5201_AUXMODE2 0x1B
+#define MII_BCM5201_AUXMODE2_LOWPOWER 0x0008
+
+#define MII_BCM5201_MULTIPHY 0x1E
+
+/* MII BCM5201 MULTIPHY register bits */
+#define MII_BCM5201_MULTIPHY_SERIALMODE 0x0002
+#define MII_BCM5201_MULTIPHY_SUPERISOLATE 0x0008
+
+/* MII BCM5400 1000-BASET Control register */
+#define MII_BCM5400_GB_CONTROL 0x09
+#define MII_BCM5400_GB_CONTROL_FULLDUPLEXCAP 0x0200
+
+/* MII BCM5400 AUXCONTROL register */
+#define MII_BCM5400_AUXCONTROL 0x18
+#define MII_BCM5400_AUXCONTROL_PWR10BASET 0x0004
+
+/* MII BCM5400 AUXSTATUS register */
+#define MII_BCM5400_AUXSTATUS 0x19
+#define MII_BCM5400_AUXSTATUS_LINKMODE_MASK 0x0700
+#define MII_BCM5400_AUXSTATUS_LINKMODE_SHIFT 8
+
+/* When it can, GEM internally caches 4 aligned TX descriptors
+ * at a time, so that it can use full cacheline DMA reads.
+ *
+ * Note that unlike HME, there is no ownership bit in the descriptor
+ * control word. The same functionality is obtained via the TX-Kick
+ * and TX-Complete registers. As a result, GEM need not write back
+ * updated values to the TX descriptor ring, it only performs reads.
+ *
+ * Since TX descriptors are never modified by GEM, the driver can
+ * use the buffer DMA address as a place to keep track of allocated
+ * DMA mappings for a transmitted packet.
+ */
+struct gem_txd {
+ uint64_t control_word;
+ uint64_t buffer;
+};
+
+#define TXDCTRL_BUFSZ 0x0000000000007fffULL /* Buffer Size */
+#define TXDCTRL_CSTART 0x00000000001f8000ULL /* CSUM Start Offset */
+#define TXDCTRL_COFF 0x000000001fe00000ULL /* CSUM Stuff Offset */
+#define TXDCTRL_CENAB 0x0000000020000000ULL /* CSUM Enable */
+#define TXDCTRL_EOF 0x0000000040000000ULL /* End of Frame */
+#define TXDCTRL_SOF 0x0000000080000000ULL /* Start of Frame */
+#define TXDCTRL_INTME 0x0000000100000000ULL /* "Interrupt Me" */
+#define TXDCTRL_NOCRC 0x0000000200000000ULL /* No CRC Present */
+
+/* GEM requires that RX descriptors are provided four at a time,
+ * aligned. Also, the RX ring may not wrap around. This means that
+ * there will be at least 4 unused descriptor entries in the middle
+ * of the RX ring at all times.
+ *
+ * Similar to HME, GEM assumes that it can write garbage bytes before
+ * the beginning of the buffer and right after the end in order to DMA
+ * whole cachelines.
+ *
+ * Unlike for TX, GEM does update the status word in the RX descriptors
+ * when packets arrive. Therefore an ownership bit does exist in the
+ * RX descriptors. It is advisory, GEM clears it but does not check
+ * it in any way. So when buffers are posted to the RX ring (via the
+ * RX Kick register) by the driver it must make sure the buffers are
+ * truly ready and that the ownership bits are set properly.
+ *
+ * Even though GEM modifies the RX descriptors, it guarantees that the
+ * buffer DMA address field will stay the same when it performs these
+ * updates. Therefore it can be used to keep track of DMA mappings
+ * by the host driver just as in the TX descriptor case above.
+ */
+struct gem_rxd {
+ uint64_t status_word;
+ uint64_t buffer;
+};
+
+#define RXDCTRL_TCPCSUM 0x000000000000ffffULL /* TCP Pseudo-CSUM
*/
+#define RXDCTRL_BUFSZ 0x000000007fff0000ULL /* Buffer Size */
+#define RXDCTRL_OWN 0x0000000080000000ULL /* GEM owns this entry */
+#define RXDCTRL_HASHVAL 0x0ffff00000000000ULL /* Hash Value
*/
+#define RXDCTRL_HPASS 0x1000000000000000ULL /* Passed Hash Filter */
+#define RXDCTRL_ALTMAC 0x2000000000000000ULL /* Matched ALT MAC */
+#define RXDCTRL_BAD 0x4000000000000000ULL /* Frame has bad CRC */
+
+
+#endif /* _SUNGEM_H */
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index 24fae16..c2a8c0b 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -1758,6 +1758,7 @@ static const char * const pci_nic_models[] = {
"e1000",
"pcnet",
"virtio",
+ "sungem",
NULL
};
@@ -1770,6 +1771,7 @@ static const char * const pci_nic_names[] = {
"e1000",
"pcnet",
"virtio-net-pci",
+ "sungem",
NULL
};
diff --git a/include/hw/pci/pci_ids.h b/include/hw/pci/pci_ids.h
index d77ca60..d38dc73 100644
--- a/include/hw/pci/pci_ids.h
+++ b/include/hw/pci/pci_ids.h
@@ -89,6 +89,7 @@
#define PCI_VENDOR_ID_APPLE 0x106b
#define PCI_DEVICE_ID_APPLE_UNI_N_AGP 0x0020
#define PCI_DEVICE_ID_APPLE_U3_AGP 0x004b
+#define PCI_DEVICE_ID_APPLE_UNI_N_GMAC 0x0021
#define PCI_VENDOR_ID_SUN 0x108e
#define PCI_DEVICE_ID_SUN_EBUS 0x1000
- [Qemu-devel] [PATCH] net: Add SunGEM device emulation as found on Apple UniNorth,
Benjamin Herrenschmidt <=