/* * QEMU Intel i82596 (Apricot) emulation * * Copyright (c) 2019 Helge Deller * This work is licensed under the GNU GPL license version 2 or later. * * This software was written to be compatible with the specification: * https://www.intel.com/assets/pdf/general/82596ca.pdf */ #include "qemu/osdep.h" #include "qemu/timer.h" #include "net/net.h" #include "net/eth.h" #include "sysemu/sysemu.h" #include "hw/irq.h" #include "hw/qdev-properties.h" #include "migration/vmstate.h" #include "qemu/module.h" #include "trace.h" #include "i82596.h" #include /* For crc32 */ #if defined(ENABLE_DEBUG) #define DBG(x) x #else #define DBG(x) do { } while (0) #endif #define USE_TIMER 0 #define BITS(n, m) (((0xffffffffU << (31 - n)) >> (31 - n + m)) << m) #define PKT_BUF_SZ 1536 #define MAX_MC_CNT 64 #define ISCP_BUSY 0x0001 #define I596_NULL ((uint32_t)0xffffffff) #define SCB_STATUS_CX 0x8000 /* CU finished command with I bit */ #define SCB_STATUS_FR 0x4000 /* RU finished receiving a frame */ #define SCB_STATUS_CNA 0x2000 /* CU left active state */ #define SCB_STATUS_RNR 0x1000 /* RU left active state */ #define SCB_COMMAND_ACK_MASK \ (SCB_STATUS_CX | SCB_STATUS_FR | SCB_STATUS_CNA | SCB_STATUS_RNR) #define CU_IDLE 0 #define CU_SUSPENDED 1 #define CU_ACTIVE 2 #define RX_IDLE 0 #define RX_SUSPENDED 1 #define RX_READY 4 #define CMD_EOL 0x8000 /* The last command of the list, stop. */ #define CMD_SUSP 0x4000 /* Suspend after doing cmd. */ #define CMD_INTR 0x2000 /* Interrupt after doing cmd. */ #define CMD_FLEX 0x0008 /* Enable flexible memory model */ enum commands { CmdNOp = 0, CmdSASetup = 1, CmdConfigure = 2, CmdMulticastList = 3, CmdTx = 4, CmdTDR = 5, CmdDump = 6, CmdDiagnose = 7 }; #define STAT_C 0x8000 /* Set to 0 after execution */ #define STAT_B 0x4000 /* Command being executed */ #define STAT_OK 0x2000 /* Command executed ok */ #define STAT_A 0x1000 /* Command aborted */ #define I596_EOF 0x8000 #define SIZE_MASK 0x3fff #define ETHER_TYPE_LEN 2 #define VLAN_TCI_LEN 2 #define VLAN_HLEN (ETHER_TYPE_LEN + VLAN_TCI_LEN) /* various flags in the chip config registers */ #define I596_PREFETCH (s->config[0] & 0x80) #define I596_PROMISC (s->config[8] & 0x01) #define I596_BC_DISABLE (s->config[8] & 0x02) /* broadcast disable */ #define I596_NOCRC_INS (s->config[8] & 0x08) #define I596_CRCINM (s->config[11] & 0x04) /* CRC appended */ #define I596_MC_ALL (s->config[11] & 0x20) #define I596_MULTIIA (s->config[13] & 0x40) static uint8_t get_byte(uint32_t addr) { return ldub_phys(&address_space_memory, addr); } static void set_byte(uint32_t addr, uint8_t c) { return stb_phys(&address_space_memory, addr, c); } static uint16_t get_uint16(uint32_t addr) { return lduw_be_phys(&address_space_memory, addr); } static void set_uint16(uint32_t addr, uint16_t w) { return stw_be_phys(&address_space_memory, addr, w); } static uint32_t get_uint32(uint32_t addr) { uint32_t lo = lduw_be_phys(&address_space_memory, addr); uint32_t hi = lduw_be_phys(&address_space_memory, addr + 2); return (hi << 16) | lo; } static void set_uint32(uint32_t addr, uint32_t val) { set_uint16(addr, (uint16_t) val); set_uint16(addr + 2, val >> 16); } struct qemu_ether_header { uint8_t ether_dhost[6]; uint8_t ether_shost[6]; uint16_t ether_type; }; #define PRINT_PKTHDR(txt, BUF) do { \ struct qemu_ether_header *hdr = (void *)(BUF); \ printf(txt ": packet dhost=" MAC_FMT ", shost=" MAC_FMT ", type=0x%04x\n",\ MAC_ARG(hdr->ether_dhost), MAC_ARG(hdr->ether_shost), \ be16_to_cpu(hdr->ether_type)); \ } while (0) static void i82596_transmit(I82596State *s, uint32_t addr) { uint32_t tdb_p; /* Transmit Buffer Descriptor */ /* TODO: Check flexible mode */ tdb_p = get_uint32(addr + 8); while (tdb_p != I596_NULL) { uint16_t size, len; uint32_t tba; size = get_uint16(tdb_p); len = size & SIZE_MASK; tba = get_uint32(tdb_p + 8); trace_i82596_transmit(len, tba); if (s->nic && len) { assert(len <= sizeof(s->tx_buffer)); address_space_read(&address_space_memory, tba, MEMTXATTRS_UNSPECIFIED, s->tx_buffer, len); DBG(PRINT_PKTHDR("Send", &s->tx_buffer)); DBG(printf("Sending %d bytes\n", len)); qemu_send_packet(qemu_get_queue(s->nic), s->tx_buffer, len); } /* was this the last package? */ if (size & I596_EOF) { break; } /* get next buffer pointer */ tdb_p = get_uint32(tdb_p + 4); } } static void set_individual_address(I82596State *s, uint32_t addr) { NetClientState *nc; uint8_t *m; nc = qemu_get_queue(s->nic); m = s->conf.macaddr.a; address_space_read(&address_space_memory, addr + 8, MEMTXATTRS_UNSPECIFIED, m, ETH_ALEN); qemu_format_nic_info_str(nc, m); trace_i82596_new_mac(nc->info_str); } static void set_multicast_list(I82596State *s, uint32_t addr) { uint16_t mc_count, i; memset(&s->mult[0], 0, sizeof(s->mult)); mc_count = get_uint16(addr + 8) / ETH_ALEN; addr += 10; if (mc_count > MAX_MC_CNT) { mc_count = MAX_MC_CNT; } for (i = 0; i < mc_count; i++) { uint8_t multicast_addr[ETH_ALEN]; address_space_read(&address_space_memory, addr + i * ETH_ALEN, MEMTXATTRS_UNSPECIFIED, multicast_addr, ETH_ALEN); DBG(printf("Add multicast entry " MAC_FMT "\n", MAC_ARG(multicast_addr))); unsigned mcast_idx = (net_crc32(multicast_addr, ETH_ALEN) & BITS(7, 2)) >> 2; assert(mcast_idx < 8 * sizeof(s->mult)); s->mult[mcast_idx >> 3] |= (1 << (mcast_idx & 7)); } trace_i82596_set_multicast(mc_count); } void i82596_set_link_status(NetClientState *nc) { I82596State *d = qemu_get_nic_opaque(nc); d->lnkst = nc->link_down ? 0 : 0x8000; } static void update_scb_status(I82596State *s) { s->scb_status = (s->scb_status & 0xf000) | (s->cu_status << 8) | (s->rx_status << 4); set_uint16(s->scb, s->scb_status); } static void i82596_s_reset(I82596State *s) { trace_i82596_s_reset(s); s->scp = 0; s->scb_status = 0; s->cu_status = CU_IDLE; s->rx_status = RX_SUSPENDED; s->cmd_p = I596_NULL; s->lnkst = 0x8000; /* initial link state: up */ s->ca = s->ca_active = 0; s->send_irq = 0; } static void command_loop(I82596State *s) { uint16_t cmd; uint16_t status; uint8_t byte_cnt; DBG(printf("STARTING COMMAND LOOP cmd_p=%08x\n", s->cmd_p)); while (s->cmd_p != I596_NULL) { /* set status */ status = STAT_B; set_uint16(s->cmd_p, status); status = STAT_C | STAT_OK; /* update, but write later */ cmd = get_uint16(s->cmd_p + 2); DBG(printf("Running command %04x at %08x\n", cmd, s->cmd_p)); switch (cmd & 0x07) { case CmdNOp: break; case CmdSASetup: set_individual_address(s, s->cmd_p); break; case CmdConfigure: byte_cnt = get_byte(s->cmd_p + 8) & 0x0f; byte_cnt = MAX(byte_cnt, 4); byte_cnt = MIN(byte_cnt, sizeof(s->config)); /* copy byte_cnt max. */ address_space_read(&address_space_memory, s->cmd_p + 8, MEMTXATTRS_UNSPECIFIED, s->config, byte_cnt); /* config byte according to page 35ff */ s->config[2] &= 0x82; /* mask valid bits */ s->config[2] |= 0x40; s->config[7] &= 0xf7; /* clear zero bit */ assert(I596_NOCRC_INS == 0); /* do CRC insertion */ s->config[10] = MAX(s->config[10], 5); /* min frame length */ s->config[12] &= 0x40; /* only full duplex field valid */ s->config[13] |= 0x3f; /* set ones in byte 13 */ break; case CmdTDR: /* get signal LINK */ set_uint32(s->cmd_p + 8, s->lnkst); break; case CmdTx: i82596_transmit(s, s->cmd_p); break; case CmdMulticastList: set_multicast_list(s, s->cmd_p); break; case CmdDump: case CmdDiagnose: printf("FIXME Command %d !!\n", cmd & 7); assert(0); } /* update status */ set_uint16(s->cmd_p, status); s->cmd_p = get_uint32(s->cmd_p + 4); /* get link address */ DBG(printf("NEXT addr would be %08x\n", s->cmd_p)); if (s->cmd_p == 0) { s->cmd_p = I596_NULL; } /* Stop when last command of the list. */ if (cmd & CMD_EOL) { s->cmd_p = I596_NULL; } /* Suspend after doing cmd? */ if (cmd & CMD_SUSP) { s->cu_status = CU_SUSPENDED; printf("FIXME SUSPEND !!\n"); } /* Interrupt after doing cmd? */ if (cmd & CMD_INTR) { s->scb_status |= SCB_STATUS_CX; } else { s->scb_status &= ~SCB_STATUS_CX; } update_scb_status(s); /* Interrupt after doing cmd? */ if (cmd & CMD_INTR) { s->send_irq = 1; } if (s->cu_status != CU_ACTIVE) { break; } } DBG(printf("FINISHED COMMAND LOOP\n")); qemu_flush_queued_packets(qemu_get_queue(s->nic)); } static void i82596_flush_queue_timer(void *opaque) { I82596State *s = opaque; if (0) { timer_del(s->flush_queue_timer); qemu_flush_queued_packets(qemu_get_queue(s->nic)); timer_mod(s->flush_queue_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + 1000); } } static void examine_scb(I82596State *s) { uint16_t command, cuc, ruc; /* get the scb command word */ command = get_uint16(s->scb + 2); cuc = (command >> 8) & 0x7; ruc = (command >> 4) & 0x7; DBG(printf("MAIN COMMAND %04x cuc %02x ruc %02x\n", command, cuc, ruc)); /* and clear the scb command word */ set_uint16(s->scb + 2, 0); s->scb_status &= ~(command & SCB_COMMAND_ACK_MASK); switch (cuc) { case 0: /* no change */ break; case 1: /* CUC_START */ s->cu_status = CU_ACTIVE; break; case 4: /* CUC_ABORT */ s->cu_status = CU_SUSPENDED; s->scb_status |= SCB_STATUS_CNA; /* CU left active state */ break; default: printf("WARNING: Unknown CUC %d!\n", cuc); } switch (ruc) { case 0: /* no change */ break; case 1: /* RX_START */ case 2: /* RX_RESUME */ s->rx_status = RX_IDLE; if (USE_TIMER) { timer_mod(s->flush_queue_timer, qemu_clock_get_ms( QEMU_CLOCK_VIRTUAL) + 1000); } break; case 3: /* RX_SUSPEND */ case 4: /* RX_ABORT */ s->rx_status = RX_SUSPENDED; s->scb_status |= SCB_STATUS_RNR; /* RU left active state */ break; default: printf("WARNING: Unknown RUC %d!\n", ruc); } if (command & 0x80) { /* reset bit set? */ i82596_s_reset(s); } /* execute commands from SCBL */ if (s->cu_status != CU_SUSPENDED) { if (s->cmd_p == I596_NULL) { s->cmd_p = get_uint32(s->scb + 4); } } /* update scb status */ update_scb_status(s); command_loop(s); } static void signal_ca(I82596State *s) { uint32_t iscp = 0; /* trace_i82596_channel_attention(s); */ if (s->scp) { /* CA after reset -> do init with new scp. */ s->sysbus = get_byte(s->scp + 3); /* big endian */ DBG(printf("SYSBUS = %08x\n", s->sysbus)); if (((s->sysbus >> 1) & 0x03) != 2) { printf("WARNING: NO LINEAR MODE !!\n"); } if ((s->sysbus >> 7)) { printf("WARNING: 32BIT LINMODE IN B-STEPPING NOT SUPPORTED !!\n"); } iscp = get_uint32(s->scp + 8); s->scb = get_uint32(iscp + 4); set_byte(iscp + 1, 0); /* clear BUSY flag in iscp */ s->scp = 0; } s->ca++; /* count ca() */ if (!s->ca_active) { s->ca_active = 1; while (s->ca) { examine_scb(s); s->ca--; } s->ca_active = 0; } if (s->send_irq) { s->send_irq = 0; qemu_set_irq(s->irq, 1); } } void i82596_ioport_writew(void *opaque, uint32_t addr, uint32_t val) { I82596State *s = opaque; /* printf("i82596_ioport_writew addr=0x%08x val=0x%04x\n", addr, val); */ switch (addr) { case PORT_RESET: /* Reset */ i82596_s_reset(s); break; case PORT_ALTSCP: s->scp = val; break; case PORT_CA: signal_ca(s); break; } } uint32_t i82596_ioport_readw(void *opaque, uint32_t addr) { return -1; } void i82596_h_reset(void *opaque) { I82596State *s = opaque; i82596_s_reset(s); } bool i82596_can_receive(NetClientState *nc) { I82596State *s = qemu_get_nic_opaque(nc); if (s->rx_status == RX_SUSPENDED) { return false; } if (!s->lnkst) { return false; } if (USE_TIMER && !timer_pending(s->flush_queue_timer)) { return true; } return true; } #define MIN_BUF_SIZE 60 ssize_t i82596_receive(NetClientState *nc, const uint8_t *buf, size_t sz) { I82596State *s = qemu_get_nic_opaque(nc); uint32_t rfd_p; uint32_t rbd; uint16_t is_broadcast = 0; size_t len = sz; /* length of data for guest (including CRC) */ size_t bufsz = sz; /* length of data in buf */ uint32_t crc; uint8_t *crc_ptr; uint8_t buf1[MIN_BUF_SIZE + VLAN_HLEN]; static const uint8_t broadcast_macaddr[6] = { 0xff, 0xff, 0xff, 0xff, 0xff, 0xff }; DBG(printf("i82596_receive() start\n")); if (USE_TIMER && timer_pending(s->flush_queue_timer)) { return 0; } /* first check if receiver is enabled */ if (s->rx_status == RX_SUSPENDED) { trace_i82596_receive_analysis(">>> Receiving suspended"); return -1; } if (!s->lnkst) { trace_i82596_receive_analysis(">>> Link down"); return -1; } /* Received frame smaller than configured "min frame len"? */ if (sz < s->config[10]) { printf("Received frame too small, %zu vs. %u bytes\n", sz, s->config[10]); return -1; } DBG(printf("Received %lu bytes\n", sz)); if (I596_PROMISC) { /* promiscuous: receive all */ trace_i82596_receive_analysis( ">>> packet received in promiscuous mode"); } else { if (!memcmp(buf, broadcast_macaddr, 6)) { /* broadcast address */ if (I596_BC_DISABLE) { trace_i82596_receive_analysis(">>> broadcast packet rejected"); return len; } trace_i82596_receive_analysis(">>> broadcast packet received"); is_broadcast = 1; } else if (buf[0] & 0x01) { /* multicast */ if (!I596_MC_ALL) { trace_i82596_receive_analysis(">>> multicast packet rejected"); return len; } int mcast_idx = (net_crc32(buf, ETH_ALEN) & BITS(7, 2)) >> 2; assert(mcast_idx < 8 * sizeof(s->mult)); if (!(s->mult[mcast_idx >> 3] & (1 << (mcast_idx & 7)))) { trace_i82596_receive_analysis(">>> multicast address mismatch"); return len; } trace_i82596_receive_analysis(">>> multicast packet received"); is_broadcast = 1; } else if (!memcmp(s->conf.macaddr.a, buf, 6)) { /* match */ trace_i82596_receive_analysis( ">>> physical address matching packet received"); } else { trace_i82596_receive_analysis(">>> unknown packet"); return len; } } /* if too small buffer, then expand it */ if (len < MIN_BUF_SIZE + VLAN_HLEN) { memcpy(buf1, buf, len); memset(buf1 + len, 0, MIN_BUF_SIZE + VLAN_HLEN - len); buf = buf1; if (len < MIN_BUF_SIZE) { len = MIN_BUF_SIZE; } bufsz = len; } /* Calculate the ethernet checksum (4 bytes) */ len += 4; crc = cpu_to_be32(crc32(~0, buf, sz)); crc_ptr = (uint8_t *) &crc; rfd_p = get_uint32(s->scb + 8); /* get Receive Frame Descriptor */ assert(rfd_p && rfd_p != I596_NULL); /* get first Receive Buffer Descriptor Address */ rbd = get_uint32(rfd_p + 8); assert(rbd && rbd != I596_NULL); trace_i82596_receive_packet(len); /* PRINT_PKTHDR("Receive", buf); */ while (len) { uint16_t command, status; uint32_t next_rfd; command = get_uint16(rfd_p + 2); assert(command & CMD_FLEX); /* assert Flex Mode */ /* get first Receive Buffer Descriptor Address */ rbd = get_uint32(rfd_p + 8); assert(get_uint16(rfd_p + 14) == 0); /* printf("Receive: rfd is %08x\n", rfd_p); */ while (len) { uint16_t buffer_size, num; uint32_t rba; size_t bufcount, crccount; /* printf("Receive: rbd is %08x\n", rbd); */ buffer_size = get_uint16(rbd + 12); /* printf("buffer_size is 0x%x\n", buffer_size); */ assert(buffer_size != 0); num = buffer_size & SIZE_MASK; if (num > len) { num = len; } rba = get_uint32(rbd + 8); /* printf("rba is 0x%x\n", rba); */ /* * Calculate how many bytes we want from buf[] and how many * from the CRC. */ if ((len - num) >= 4) { /* The whole guest buffer, we haven't hit the CRC yet */ bufcount = num; } else { /* All that's left of buf[] */ bufcount = len - 4; } crccount = num - bufcount; if (bufcount > 0) { /* Still some of the actual data buffer to transfer */ assert(bufsz >= bufcount); bufsz -= bufcount; address_space_write(&address_space_memory, rba, MEMTXATTRS_UNSPECIFIED, buf, bufcount); rba += bufcount; buf += bufcount; len -= bufcount; } /* Write as much of the CRC as fits */ if (crccount > 0) { address_space_write(&address_space_memory, rba, MEMTXATTRS_UNSPECIFIED, crc_ptr, crccount); rba += crccount; crc_ptr += crccount; len -= crccount; } num |= 0x4000; /* set F BIT */ if (len == 0) { num |= I596_EOF; /* set EOF BIT */ } set_uint16(rbd + 0, num); /* write actual count with flags */ /* get next rbd */ rbd = get_uint32(rbd + 4); /* printf("Next Receive: rbd is %08x\n", rbd); */ if (buffer_size & I596_EOF) /* last entry */ break; } /* Housekeeping, see pg. 18 */ next_rfd = get_uint32(rfd_p + 4); set_uint32(next_rfd + 8, rbd); status = STAT_C | STAT_OK | is_broadcast; set_uint16(rfd_p, status); if (command & CMD_SUSP) { /* suspend after command? */ s->rx_status = RX_SUSPENDED; s->scb_status |= SCB_STATUS_RNR; /* RU left active state */ break; } if (command & CMD_EOL) /* was it last Frame Descriptor? */ break; assert(len == 0); } assert(len == 0); s->scb_status |= SCB_STATUS_FR; /* set "RU finished receiving frame" bit. */ update_scb_status(s); /* send IRQ that we received data */ qemu_set_irq(s->irq, 1); /* s->send_irq = 1; */ if (0) { DBG(printf("Checking:\n")); rfd_p = get_uint32(s->scb + 8); /* get Receive Frame Descriptor */ DBG(printf("Next Receive: rfd is %08x\n", rfd_p)); rfd_p = get_uint32(rfd_p + 4); /* get Next Receive Frame Descriptor */ DBG(printf("Next Receive: rfd is %08x\n", rfd_p)); /* get first Receive Buffer Descriptor Address */ rbd = get_uint32(rfd_p + 8); DBG(printf("Next Receive: rbd is %08x\n", rbd)); } return sz; } const VMStateDescription vmstate_i82596 = { .name = "i82596", .version_id = 1, .minimum_version_id = 1, .fields = (VMStateField[]) { VMSTATE_UINT16(lnkst, I82596State), VMSTATE_TIMER_PTR(flush_queue_timer, I82596State), VMSTATE_END_OF_LIST() } }; void i82596_common_init(DeviceState *dev, I82596State *s, NetClientInfo *info) { if (s->conf.macaddr.a[0] == 0) { qemu_macaddr_default_if_unset(&s->conf.macaddr); } s->nic = qemu_new_nic(info, &s->conf, object_get_typename(OBJECT(dev)), dev->id, s); qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a); if (USE_TIMER) { s->flush_queue_timer = timer_new_ns(QEMU_CLOCK_VIRTUAL, i82596_flush_queue_timer, s); } s->lnkst = 0x8000; /* initial link state: up */ }