[PATCH v6 00/17] hw/arm/raspi4b: working PCIe and GENET (real networking)

[Marcelo Manzo <marcelomanzo@gmail.com>]

This series gets raspi4b's PCIe root complex and GENET Ethernet
controller working end to end: the PCIe link comes up and devices on
it enumerate, and GENET passes real network traffic (DHCP, SSH, bulk
downloads) under both older (Debian 11, 5.15) and newer (Debian 13,
6.18) guest kernels. Most of the GENET code is Sergey Kambalin's
2024 series (patchwork series 829638), carried forward with his
authorship and Signed-off-by kept.

v6: thanks to Peter for the review of v5.

  - Patch 14 (v4's migration patch, which v5 had dropped): add a
    VMStateDescription for the GENET device, as Peter asked. The MAC
    and PHY register blocks contain only uint32_t or uint16_t fields,
    so each is overlaid with an array of that element type in an
    anonymous union (the rest of the code keeps its s->regs.foo
    accesses) and is migrated with VMSTATE_UINT32_ARRAY() or
    VMSTATE_UINT16_ARRAY(), which is correct across hosts of
    different endianness. There is no post_load function: the
    interrupt outputs are derived from the registers and the device
    at the other end of each line migrates its own state.
  - Patch 10: add the trailing comma to the .size initializer of
    bcm2838_genet_client_info, so that the RX patch does not have to
    edit that line.
  - Added Peter's Reviewed-by to patches 1, 2 and 13.

v5: thanks to Peter for the review of v4.

  - Patch 1: the vmstate describes the PCI device and the AER log in
    the same way as the other PCIe root port models that add state
    of their own (gen_pcie_root_port.c, ioh3420.c,
    xio3130_downstream.c): through the PCIESlot that the root port
    embeds.
  - Patch 2: pass accesses to the EXT_CFG_DATA window to
    pci_host_config_read_common()/pci_host_config_write_common() for
    the function that EXT_CFG_INDEX selects, instead of calling the
    ECAM region's read/write ops; this also means that
    pcie_host_mmcfg_init() is no longer needed, so the call is gone
    and the commit message no longer lists it as a fixed defect (it
    also said "four" for a list of three). Set .impl.max_access_size
    to 8, and replace the comment on the unassigned-address windows,
    which had been copied from gpex.c, with one that only says what
    the code does. On map_irq: only slot 0 exists behind the root
    port, so there is nothing to swizzle; I added a comment saying
    so.
  - Patch 10: return early on an out-of-range access in the write
    handler, and assert that the register offset is a multiple of 4
    in bcm2838_genet_reg().
  - Patch 13: clamp the length of each copy so that it cannot exceed
    what is left of rx_packet[] after the status block, rather than
    relying on the caller's size check.
  - Dropped v4 patch 14 (GENET migration state); restored in v6.
  - Added Peter's Reviewed-by to patches 10, 11 and 12 (patch 10 now
    includes the two changes he asked for).

v4: thanks to Peter for the review of v3.

  - Patch 1: move the dc->user_creatable rationale comment next to
    the line it explains; add a VMStateDescription for the root port
    (PCI device, AER log and the regs[] array).
  - Patch 2: treat root_port.regs[] as little-endian bytes and access
    it with ldn_le_p()/stn_le_p()/ldl_le_p() instead of memcpy() and
    a uint32_t * overlay. Drop pci_bus_set_route_irq_fn(), its
    callback and the irq_num[] storage that only fed it: INTx routing
    queries come only from VFIO (with KVM irqfds), some x86 code and
    hw/remote, none of which applies to raspi4b.
  - Patch 3: drop the call to the removed set_irq_num() helper.
  - Patch 4: set both min and max access size on impl and valid.
  - Patch 8: BCM2838GenetPhyAuxShdRegs becomes an array of uint16_t
    rather than a struct, as suggested on patch 11.
  - Patch 10: access the register block as host-order uint32_t at the
    register's offset instead of memcpy() of an arbitrary size (the
    HFB filter array becomes uint32_t too, so every register in the
    block is one); do not call qemu_macaddr_default_if_unset() when
    the guest programs a MAC address, just update the NIC info
    string; accept an access that ends exactly at the end of the
    register block.
  - Patch 11: do not call bcm2838_genet_phy_update_link() from the
    MDIO patch; it is only defined by the RX patch, so the series did
    not build at this point. The prototype and the call move to the
    RX patch. Reword the "8 bits" comment and assert that the
    expansion shadow register indexes are in range.
  - Patch 12: check that a TX frame is at least a status block plus
    an Ethernet header, and that a frame's descriptors fit in
    tx_packet[]; check that reading the frame from guest memory
    succeeded; use lduw_be_p()/stw_be_p(); lower-case local names; add
    a helper for building 64-bit values from register halves; drop
    redundant "!= 0" on bools; split the producer-index handling out
    of bcm2838_genet_tdma() to reduce nesting.
  - Patch 13: the same clean-ups as the TX path where they apply;
    replace the comment that described an old bug with one noting
    that we do not implement the hardware's partial RX checksum and
    rely on the guest checking in software.
  - Patch 16: call require_netdev('user') so the test is skipped on
    builds without the user-mode network backend.

Based on master (7e8d3c7fc4). It conflicts trivially (raspi4b.c and
bcm2838_peripherals.[ch]) with the RNG200/thermal series, which is in
target-arm.next; I will rebase once that lands.

Tested: checkpatch.pl reports no errors; every patch builds on its
own; tests/functional/aarch64/test_raspi4.py passes; and unmodified
Raspberry Pi OS Bullseye and Trixie images boot under raspi4b with a
working network (DHCP, ping) and SSH login; and a booted Debian 13
guest keeps its state and its network across savevm/loadvm.


Marcelo Manzo (8):
  hw/arm/bcm2838_pcie: add BCM2838 PCIe Root Complex
  hw/arm/bcm2838_pcie: add BCM2838 PCIe host
  hw/arm/bcm2838: enable BCM2838 PCIe host bridge
  hw/net/bcm2838_genet: add GENET stub device
  hw/net/bcm2838_genet: add migration state
  hw/arm/bcm2838: enable BCM2838 GENET controller
  docs/system/arm/raspi: move PCIe/GENET from missing to implemented
  tests/functional/aarch64: add raspi4b GENET networking test

Sergey Kambalin (9):
  hw/net/bcm2838_genet: add GENET register structs, part 1/4
  hw/net/bcm2838_genet: add GENET register structs, part 2/4
  hw/net/bcm2838_genet: add GENET register structs, part 3/4
  hw/net/bcm2838_genet: add GENET register structs, part 4/4
  hw/net/bcm2838_genet: add GENET register access macros
  hw/net/bcm2838_genet: implement GENET register ops
  hw/net/bcm2838_genet: implement GENET MDIO
  hw/net/bcm2838_genet: implement GENET TX path
  hw/net/bcm2838_genet: implement GENET RX path

 docs/system/arm/raspi.rst               |    6 +-
 hw/arm/bcm2838.c                        |   13 +
 hw/arm/bcm2838_pcie.c                   |  313 ++++++
 hw/arm/bcm2838_peripherals.c            |   46 +
 hw/arm/meson.build                      |    4 +-
 hw/arm/raspi4b.c                        |    2 -
 hw/arm/trace-events                     |    4 +
 hw/net/bcm2838_genet.c                  | 1185 +++++++++++++++++++++++
 hw/net/meson.build                      |    2 +
 hw/net/trace-events                     |   16 +
 include/hw/arm/bcm2838_pcie.h           |   73 ++
 include/hw/arm/bcm2838_peripherals.h    |    7 +
 include/hw/net/bcm2838_genet.h          |  455 +++++++++
 tests/functional/aarch64/test_raspi4.py |   31 +
 14 files changed, 2152 insertions(+), 5 deletions(-)
 create mode 100644 hw/arm/bcm2838_pcie.c
 create mode 100644 hw/net/bcm2838_genet.c
 create mode 100644 include/hw/arm/bcm2838_pcie.h
 create mode 100644 include/hw/net/bcm2838_genet.h

-- 
2.55.0