qemu-devel.nongnu.org archive mirror
 help / color / mirror / Atom feed
* [Qemu-devel] [PATCH] net: Add SunGEM device emulation as found on Apple UniNorth
@ 2016-08-14 22:48 Benjamin Herrenschmidt
  2016-08-14 22:54 ` no-reply
  0 siblings, 1 reply; 9+ messages in thread
From: Benjamin Herrenschmidt @ 2016-08-14 22:48 UTC (permalink / raw)
  To: qemu-ppc; +Cc: qemu-devel

This adds a simplistic emulation of the Sun GEM ethernet controller
found in Apple ASICs.

Currently we only support the Apple UniNorth 1.x variant, but the
other Apple or Sun variants should mostly be a matter of adding
PCI IDs options.

It doesn't (yet) support state saving, but neither does the Mac models
at least not without additional patches. I will add it separately.


We have a very primitive emulation of a single Broadcom 5201 PHY
which is supported by the MacOS driver.

This model brings out-of-the-box networking to MacOS 9, and all
versions of OS X I tried with the mac99 platform.

Signed-off-by: Benjamin Herrenschmidt <benh@kernel.crashing.org>
---
 hw/net/Makefile.objs     |    2 +
 hw/net/sungem.c          | 1036 ++++++++++++++++++++++++++++++++++++++++++++++
 hw/net/sungem.h          |  885 +++++++++++++++++++++++++++++++++++++++
 hw/pci/pci.c             |    2 +
 include/hw/pci/pci_ids.h |    1 +
 5 files changed, 1926 insertions(+)
 create mode 100644 hw/net/sungem.c
 create mode 100644 hw/net/sungem.h

diff --git a/hw/net/Makefile.objs b/hw/net/Makefile.objs
index 610ed3e..7cded99 100644
--- a/hw/net/Makefile.objs
+++ b/hw/net/Makefile.objs
@@ -27,6 +27,8 @@ common-obj-$(CONFIG_CADENCE) += cadence_gem.o
 common-obj-$(CONFIG_STELLARIS_ENET) += stellaris_enet.o
 common-obj-$(CONFIG_LANCE) += lance.o
 
+common-obj-$(CONFIG_SUNGEM) += sungem.o
+
 obj-$(CONFIG_ETRAXFS) += etraxfs_eth.o
 obj-$(CONFIG_COLDFIRE) += mcf_fec.o
 obj-$(CONFIG_MILKYMIST) += milkymist-minimac2.o
diff --git a/hw/net/sungem.c b/hw/net/sungem.c
new file mode 100644
index 0000000..2081bda
--- /dev/null
+++ b/hw/net/sungem.c
@@ -0,0 +1,1036 @@
+/*
+ * QEMU model of SUN GEM ethernet controller
+ *
+ * As found in Apple ASICs among others
+ *
+ * Copyright 2016 Ben Herrenschmidt
+ */
+#include "qemu/osdep.h"
+#include "hw/pci/pci.h"
+#include "qemu/log.h"
+#include "net/net.h"
+#include "net/checksum.h"
+#include "hw/net/mii.h"
+/* For crc32 */
+#include <zlib.h>
+
+#include "sungem.h"
+
+#define SUNGEM_DEBUG
+
+#ifdef SUNGEM_DEBUG
+enum {
+        DEBUG_ERR, DEBUG_GEN, DEBUG_MII, DEBUG_MMIO, DEBUG_INTERRUPT,
+        DEBUG_RX, DEBUG_TX,
+};
+#define DBGBIT(x)    (1<<DEBUG_##x)
+static int debugflags = DBGBIT(ERR);
+//static int debugflags = DBGBIT(ERR) | DBGBIT(INTERRUPT) | DBGBIT(RX) | DBGBIT(TX);
+
+#define DBGOUT(what, fmt, ...) do { \
+    if (debugflags & DBGBIT(what)) \
+        fprintf(stderr, "sungem: " fmt, ## __VA_ARGS__); \
+    } while (0)
+#else
+#define DBGOUT(what, fmt, ...) do {} while (0)
+#endif
+
+#define TYPE_SUNGEM "sungem"
+
+#define SUNGEM(obj) OBJECT_CHECK(SunGEMState, (obj), TYPE_SUNGEM)
+
+#define MAX_PACKET_SIZE 9016
+
+typedef struct {
+    PCIDevice pdev;
+    MemoryRegion mmio;
+    NICState *nic;
+    NICConf conf;
+    uint32_t nregsblocks;
+    uint32_t **regs;
+    uint32_t phy_addr;
+
+    /* Cache some useful things */
+    uint32_t rx_mask;
+    uint32_t tx_mask;
+
+    /* Current tx packet */
+    uint8_t tx_data[MAX_PACKET_SIZE];
+    uint32_t tx_size;
+    uint64_t tx_first_ctl;
+} SunGEMState;
+
+static const struct RegBlock {
+    uint32_t base;      /* Base offset */
+    uint32_t count;     /* Number of registers */
+} RegBlocks[] = {
+    { 0x0000, 0x0006 },      /* 0x0000..0x001c : GREG bank 0 */
+    { 0x1000, 0x0005 },      /* 0x1000..0x1010 : GREG bank 1 */
+    { 0x2000, 0x000e },      /* 0x2000..0x2034 : TX DMA bank 0 */
+    { 0x2100, 0x0007 },      /* 0x2100..0x2118 : TX DMA bank 1 */
+    { 0x3000, 0x0005 },      /* 0x3000..0x3010 : WakeOnLan */
+    { 0x4000, 0x000b },      /* 0x4000..0c4028 : RX DMA bank 0 */
+    { 0x4100, 0x0009 },      /* 0x4100..0x4120 : RX DMA bank 1 */
+    { 0x6000, 0x004e },      /* 0x6000..0x6134 : MAC */
+    { 0x6200, 0x0008 },      /* 0x6200..0x621c : MIF */
+    { 0x9000, 0x0007 },      /* 0x9000..0x9018 : PCS */
+    { 0x9050, 0x0004 },      /* 0x9050..0x905c : PCS */
+};
+
+/* Fast access, hopefully optimized out by the compiler */
+static uint32_t *sungem_get_reg(SunGEMState *s, uint32_t reg)
+{
+        uint32_t idx = (reg & 0xff) >> 2;
+        if (reg <= 0x1c)
+                return &s->regs[0][idx];
+        else if (reg >= 0x1000 && reg <= 0x1010)
+                return &s->regs[1][idx];
+        else if (reg >= 0x2000 && reg <= 0x2034)
+                return &s->regs[2][idx];
+        else if (reg >= 0x2100 && reg <= 0x2118)
+                return &s->regs[3][idx];
+        else if (reg >= 0x3000 && reg <= 0x3010)
+                return &s->regs[4][idx];
+        else if (reg >= 0x4000 && reg <= 0x4028)
+                return &s->regs[5][idx];
+        else if (reg >= 0x4100 && reg <= 0x4120)
+                return &s->regs[6][idx];
+        else if (reg >= 0x6000 && reg <= 0x6134)
+                return &s->regs[7][idx];
+        else if (reg >= 0x6200 && reg <= 0x621c)
+                return &s->regs[8][idx];
+        else if (reg >= 0x9000 && reg <= 0x9018)
+                return &s->regs[9][idx];
+        else if (reg >= 0x9050 && reg <= 0x905c)
+                return &s->regs[10][idx];
+        return NULL;
+}
+
+#define SET_REG(s, reg, val)                                    \
+    do {                                                        \
+        uint32_t *regp = sungem_get_reg(s, reg);                \
+        assert(regp);                                           \
+        *regp = val;                                            \
+    } while(0)
+
+#define GET_REG(s, reg)                                         \
+    ({                                                      \
+        uint32_t *regp = sungem_get_reg(s, reg);                \
+        assert(regp);                                           \
+        *regp;                                                  \
+    })
+
+static void sungem_eval_irq(SunGEMState *s)
+{
+    uint32_t stat, mask;
+
+    mask = GET_REG(s, GREG_IMASK);
+    stat = GET_REG(s, GREG_STAT) & ~GREG_STAT_TXNR;
+    if (stat & ~mask) {
+        pci_set_irq(PCI_DEVICE(s), 1);
+    } else {
+        pci_set_irq(PCI_DEVICE(s), 0);
+    }
+}
+
+static void sungem_update_status(SunGEMState *s, uint32_t bits, bool val)
+{
+    uint32_t stat;
+
+    stat = GET_REG(s, GREG_STAT);
+    if (val) {
+        stat |= bits;
+    } else {
+        stat &= ~bits;
+    }
+    SET_REG(s, GREG_STAT, stat);
+    sungem_eval_irq(s);
+}
+
+static void sungem_eval_cascade_irq(SunGEMState *s)
+{
+    uint32_t stat, mask;
+
+    mask = GET_REG(s, MAC_TXSTAT);
+    stat = GET_REG(s, MAC_TXMASK);
+    if (stat & ~mask) {
+        sungem_update_status(s, GREG_STAT_TXMAC, true);
+    } else {
+        sungem_update_status(s, GREG_STAT_TXMAC, false);
+    }
+
+    mask = GET_REG(s, MAC_RXSTAT);
+    stat = GET_REG(s, MAC_RXMASK);
+    if (stat & ~mask) {
+        sungem_update_status(s, GREG_STAT_RXMAC, true);
+    } else {
+        sungem_update_status(s, GREG_STAT_RXMAC, false);
+    }
+
+    mask = GET_REG(s, MAC_CSTAT);
+    stat = GET_REG(s, MAC_MCMASK) & ~MAC_CSTAT_PTR;
+    if (stat & ~mask) {
+        sungem_update_status(s, GREG_STAT_MAC, true);
+    } else {
+        sungem_update_status(s, GREG_STAT_MAC, false);
+    }
+}
+
+static void sungem_do_tx_csum(SunGEMState *s)
+{
+    uint16_t start, off;
+    uint32_t csum;
+
+    start = (s->tx_first_ctl & TXDCTRL_CSTART) >> 15;
+    off = (s->tx_first_ctl & TXDCTRL_COFF) >> 21;
+
+    DBGOUT(TX, "TX checksumming from byte %d, inserting at %d\n",
+           start, off);
+
+    if (start > (s->tx_size - 2) || off > (s->tx_size - 2)) {
+        DBGOUT(ERR, "TX checksum out of packet bounds\n");
+        return;
+    }
+
+    csum = net_raw_checksum(s->tx_data + start, s->tx_size - start);
+    stw_be_p(s->tx_data + off, csum);
+}
+
+static void sungem_send_packet(SunGEMState *s, const uint8_t *buf,
+                               int size)
+{
+    NetClientState *nc = qemu_get_queue(s->nic);
+
+    if (GET_REG(s, MAC_XIFCFG) & MAC_XIFCFG_LBCK) {
+        nc->info->receive(nc, buf, size);
+    } else {
+        qemu_send_packet(nc, buf, size);
+    }
+}
+
+static void sungem_process_tx_desc(SunGEMState *s, struct gem_txd *desc)
+{
+    PCIDevice *d = PCI_DEVICE(s);
+    uint32_t len;
+
+    /* If it's a start of frame, discard anything we had in the
+     * buffer and start again. This should be an error condition
+     * if we had something ... for now we ignore it
+     */
+    if (desc->control_word & TXDCTRL_SOF) {
+        if (s->tx_first_ctl) {
+            DBGOUT(ERR, "TX packet started without finishing"
+                   " the previous one !\n");
+        }
+        s->tx_size = 0;
+        s->tx_first_ctl = desc->control_word;
+    }
+
+    /* Grab data size */
+    len = desc->control_word & TXDCTRL_BUFSZ;
+
+    /* Clamp it to our max size */
+    if ((s->tx_size + len) > MAX_PACKET_SIZE) {
+        DBGOUT(ERR, "TX packet queue overflow !\n");
+        len = MAX_PACKET_SIZE - s->tx_size;
+    }
+
+    /* Read the data */
+    pci_dma_read(d, desc->buffer, &s->tx_data[s->tx_size], len);
+    s->tx_size += len;
+
+    /* If end of frame, send packet */
+    if (desc->control_word & TXDCTRL_EOF) {
+        DBGOUT(TX, "TX completing %d bytes packet\n", s->tx_size);
+
+        /* Handle csum */
+        if (s->tx_first_ctl & TXDCTRL_CENAB) {
+            sungem_do_tx_csum(s);
+        }
+
+        /* Send it */
+        sungem_send_packet(s, s->tx_data, s->tx_size);
+
+        /* No more pending packet */
+        s->tx_size = 0;
+        s->tx_first_ctl = 0;
+    }
+}
+
+static void sungem_tx_kick(SunGEMState *s)
+{
+    PCIDevice *d = PCI_DEVICE(s);
+    uint32_t comp, kick;
+    uint32_t txdma_cfg, txmac_cfg, ints;
+    uint64_t dbase;
+
+    DBGOUT(TX, "TX Kick !...\n");
+
+    /* Check that both TX MAC and TX DMA are enabled. We don't
+     * handle DMA-less direct FIFO operations (we don't emulate
+     * the FIFO at all).
+     *
+     * A write to TXDMA_KICK while DMA isn't enabled can happen
+     * when the driver is resetting the pointer.
+     */
+    txdma_cfg = GET_REG(s, TXDMA_CFG);
+    txmac_cfg = GET_REG(s, MAC_TXCFG);
+    if (!(txdma_cfg & TXDMA_CFG_ENABLE) ||
+        !(txmac_cfg & MAC_TXCFG_ENAB)) {
+        DBGOUT(TX, "TX not enabled !\n");
+        return;
+    }
+
+    /* XXX Test min frame size register ? */
+    /* XXX Test max frame size register ? */
+
+    dbase = GET_REG(s, TXDMA_DBHI);
+    dbase = (dbase << 32) | GET_REG(s, TXDMA_DBLOW);
+
+    comp = GET_REG(s, TXDMA_TXDONE) & s->tx_mask;
+    kick = GET_REG(s, TXDMA_KICK) & s->tx_mask;
+
+    DBGOUT(TX, "TX processing comp=%d, kick=%d out of %d\n",
+           comp, kick, s->tx_mask + 1);
+
+    /* This is rather primitive for now, we just send everything we
+     * can in one go, like e1000. Ideally we should do the sending
+     * from some kind of background task
+     */
+    while (comp != kick) {
+        struct gem_txd desc;
+
+        /* Read the next descriptor */
+        pci_dma_read(d, dbase + comp * sizeof(desc), &desc, sizeof(desc));
+
+        /* Byteswap descriptor */
+        desc.control_word = le64_to_cpu(desc.control_word);
+        desc.buffer = le64_to_cpu(desc.buffer);
+        DBGOUT(TX, "TX desc %d: %016llx %016llx\n", comp,
+               (unsigned long long)desc.control_word,
+               (unsigned long long)desc.buffer);
+
+        /* Send it for processing */
+        sungem_process_tx_desc(s, &desc);
+
+        /* Interrupt */
+        ints = GREG_STAT_TXDONE;
+        if (desc.control_word & TXDCTRL_INTME) {
+            ints |= GREG_STAT_TXINTME;
+        }
+        sungem_update_status(s, ints, true);
+
+        /* Next ! */
+        comp = (comp + 1) & s->tx_mask;
+        SET_REG(s, TXDMA_TXDONE, comp);
+    }
+
+    /* We sent everything, set status/irq bit */
+    sungem_update_status(s, GREG_STAT_TXALL, true);
+}
+
+static bool sungem_rx_full(SunGEMState *s, uint32_t kick, uint32_t done)
+{
+    return kick == ((done + 1) & s->rx_mask);
+}
+
+static int sungem_can_receive(NetClientState *nc)
+{
+    SunGEMState *s = qemu_get_nic_opaque(nc);
+    uint32_t kick, done, rxdma_cfg, rxmac_cfg;
+    bool full;
+
+    rxmac_cfg = GET_REG(s, MAC_RXCFG);
+    rxdma_cfg = GET_REG(s, RXDMA_CFG);
+
+    /* If MAC disabled, can't receive */
+    if ((rxmac_cfg & MAC_RXCFG_ENAB) == 0) {
+        DBGOUT(RX, "Check RX MAC disabled\n");
+        return 0;
+    }
+    if ((rxdma_cfg & RXDMA_CFG_ENABLE) == 0) {
+        DBGOUT(RX, "Check RX TXDMA disabled\n");
+        return 0;
+    }
+
+    /* Check RX availability */
+    kick = GET_REG(s, RXDMA_KICK);
+    done = GET_REG(s, RXDMA_DONE);
+    full = sungem_rx_full(s, kick, done);
+
+    DBGOUT(RX, "Check RX %d (kick=%d, done=%d)\n",
+           !full, kick, done);
+
+    return !full;
+}
+
+enum {
+        rx_no_match,
+        rx_match_promisc,
+        rx_match_bcast,
+        rx_match_allmcast,
+        rx_match_mcast,
+        rx_match_mac,
+        rx_match_altmac,
+};
+
+static int sungem_check_rx_mac(SunGEMState *s, const uint8_t *mac, uint32_t crc)
+{
+    uint32_t rxcfg = GET_REG(s, MAC_RXCFG);
+    uint32_t mac0, mac1, mac2;
+
+    /* Promisc enabled ? */
+    if (rxcfg & MAC_RXCFG_PROM) {
+        return rx_match_promisc;
+    }
+
+    /* Format MAC address into dwords */
+    mac0 = (mac[4] << 8) | mac[5];
+    mac1 = (mac[2] << 8) | mac[3];
+    mac2 = (mac[0] << 8) | mac[1];
+
+    DBGOUT(RX, "Word MAC: %04x %04x %04x\n", mac0, mac1, mac2);
+
+    /* Is this a broadcast frame ? */
+    if (mac0 == 0xffff && mac1 == 0xffff && mac2 == 0xffff) {
+        return rx_match_bcast;
+    }
+
+    /* TODO: Implement address filter registers (or we don't care ?) */
+
+    /* Is this a multicast frame ? */
+    if (mac[0] & 1) {
+        DBGOUT(RX, "Multicast !\n");
+
+        /* Promisc group enabled ? */
+        if (rxcfg & MAC_RXCFG_PGRP) {
+            return rx_match_allmcast;
+        }
+
+        /* TODO: Check MAC control frames (or we don't care) ? */
+
+        /* Check hash filter (somebody check that's correct ?) */
+        if (rxcfg & MAC_RXCFG_HFE) {
+            uint32_t hash, idx;
+
+            crc >>= 24;
+            idx = (crc >> 2) & 0x3c;
+            hash = GET_REG(s, MAC_HASH0 + idx);
+            if (hash & (1 << (15 - (crc & 0xf)))) {
+                return rx_match_mcast;
+            }
+        }
+        return rx_no_match;
+    }
+
+    /* Main MAC check */
+    DBGOUT(RX, "Compare MAC to %04x %04x %04x..\n",
+           GET_REG(s, MAC_ADDR0),
+           GET_REG(s, MAC_ADDR1),
+           GET_REG(s, MAC_ADDR2));
+    if (mac0 == GET_REG(s, MAC_ADDR0) &&
+        mac1 == GET_REG(s, MAC_ADDR1) &&
+        mac2 == GET_REG(s, MAC_ADDR2)) {
+        return rx_match_mac;
+    }
+
+    /* Alt MAC check */
+    if (mac0 == GET_REG(s, MAC_ADDR3) &&
+        mac1 == GET_REG(s, MAC_ADDR4) &&
+        mac2 == GET_REG(s, MAC_ADDR5)) {
+        return rx_match_altmac;
+    }
+
+    return rx_no_match;
+}
+
+static ssize_t sungem_receive(NetClientState *nc, const uint8_t *buf,
+                              size_t size)
+{
+    SunGEMState *s = qemu_get_nic_opaque(nc);
+    PCIDevice *d = PCI_DEVICE(s);
+    uint32_t mac_crc, done, kick, max_fsize;
+    uint32_t fcs_size, ints, rxdma_cfg, rxmac_cfg, csum, coff;
+    uint8_t smallbuf[60];
+    struct gem_rxd desc;
+    uint64_t dbase, baddr;
+    unsigned int rx_cond;
+
+    DBGOUT(RX, "RX got %ld bytes packet\n", size);
+
+    rxmac_cfg = GET_REG(s, MAC_RXCFG);
+    rxdma_cfg = GET_REG(s, RXDMA_CFG);
+    max_fsize = GET_REG(s, MAC_MAXFSZ) & 0x7fff;
+
+    /* If MAC or DMA disabled, can't receive */
+    if (!(rxdma_cfg & RXDMA_CFG_ENABLE) ||
+        !(rxmac_cfg & MAC_RXCFG_ENAB)) {
+        DBGOUT(RX, "RX not enabled !\n");
+        return 0;
+    }
+
+    /* Size adjustment for FCS */
+    if (rxmac_cfg & MAC_RXCFG_SFCS) {
+        fcs_size = 0;
+    } else {
+        fcs_size = 4;
+    }
+
+    /* Discard frame smaller than a MAC or larger than max frame size
+     * (when accounting for FCS)
+     */
+    if (size < 6 || (size + 4) > max_fsize) {
+        DBGOUT(ERR, "RX bad frame size %ld, dropped !\n", size);
+        /* XXX Increment error statistics ? */
+        return size;
+    }
+
+    /* We don't drop too small frames since we get them in qemu, we pad
+     * them instead. We should probably use the min frame size register
+     * but I don't want to use a variable size staging buffer and I
+     * know both MacOS and Linux use the default 64 anyway. We use 60
+     * here to account for the non-existent FCS.
+     */
+    if (size < 60) {
+        memcpy(smallbuf, buf, size);
+        memset(&smallbuf[size], 0, 60 - size);
+        buf = smallbuf;
+        size = 60;
+    }
+
+    /* Get MAC crc */
+    mac_crc = crc32(~0, buf, 6);
+
+    /* Packet isn't for me ? */
+    rx_cond = sungem_check_rx_mac(s, buf, mac_crc);
+    if (rx_cond == rx_no_match) {
+        /* Just drop it */
+        DBGOUT(RX, "No match, dropped !\n");
+        return size;
+    }
+
+    /* Get ring pointers */
+    kick = GET_REG(s, RXDMA_KICK) & s->rx_mask;
+    done = GET_REG(s, RXDMA_DONE) & s->rx_mask;
+
+    DBGOUT(RX, "RX processing done=%d, kick=%d out of %d\n",
+           done, kick, s->rx_mask + 1);
+
+    /* Ring full ? Can't receive */
+    if (sungem_rx_full(s, kick, done)) {
+        DBGOUT(RX, "RX ring full !\n");
+        return 0;
+    }
+
+    /* Note: The real GEM will fetch descriptors in blocks of 4,
+     * for now we handle them one at a time, I think the driver will
+     * cope
+     */
+
+    dbase = GET_REG(s, RXDMA_DBHI);
+    dbase = (dbase << 32) | GET_REG(s, RXDMA_DBLOW);
+
+    /* Read the next descriptor */
+    pci_dma_read(d, dbase + done * sizeof(desc), &desc, sizeof(desc));
+
+    DBGOUT(RX, "RX desc: %016llx %016llx\n",
+           (unsigned long long)le64_to_cpu(desc.status_word),
+           (unsigned long long)le64_to_cpu(desc.buffer));
+
+    /* Effective buffer address */
+    baddr = le64_to_cpu(desc.buffer) & ~7ull;
+    baddr |= (rxdma_cfg & RXDMA_CFG_FBOFF) >> 10;
+
+    /* Write buffer out */
+    pci_dma_write(d, baddr, buf, size);
+
+    if (fcs_size) {
+        /* Should we add an FCS ? Linux doesn't ask us to strip it,
+         * however I believe nothing checks it... For now we just
+         * do nothing. It's faster this way.
+         */
+    }
+
+    /* Calculate the checksum */
+    coff = (rxdma_cfg & RXDMA_CFG_CSUMOFF) >> 13;
+    csum = net_raw_checksum(buf + coff, size - coff);
+
+    /* Build the updated descriptor */
+    desc.status_word = (size + fcs_size) << 16;
+    desc.status_word |= ((uint64_t)(mac_crc >> 16)) << 44;
+    desc.status_word |= csum;
+    if (rx_cond == rx_match_mcast) {
+        desc.status_word |= RXDCTRL_HPASS;
+    }
+    if (rx_cond == rx_match_altmac) {
+        desc.status_word |= RXDCTRL_ALTMAC;
+    }
+    desc.status_word = cpu_to_le64(desc.status_word);
+
+    pci_dma_write(d, dbase + done * sizeof(desc), &desc, sizeof(desc));
+
+    done = (done + 1) & s->rx_mask;
+    SET_REG(s, RXDMA_DONE, done);
+
+    /* XXX Unconditionally set RX interrupt for now. The interrupt
+     * mitigation timer might well end up adding more overhead than
+     * helping here...
+     */
+    ints = GREG_STAT_RXDONE;
+    if (sungem_rx_full(s, kick, done)) {
+        ints |= GREG_STAT_RXNOBUF;
+    }
+    sungem_update_status(s, ints, true);
+
+    return size;
+}
+
+static void sungem_set_link_status(NetClientState *nc)
+{
+    /* We don't do anything for now as I believe none of the OSes
+     * drivers use the MIF autopoll feature nor the PHY interrupt
+     */
+}
+
+static void sungem_update_masks(SunGEMState *s)
+{
+    uint32_t sz;
+
+    sz = 1 << (((GET_REG(s, RXDMA_CFG) & RXDMA_CFG_RINGSZ) >> 1) + 5);
+    s->rx_mask = sz - 1;
+
+    sz = 1 << (((GET_REG(s, TXDMA_CFG) & TXDMA_CFG_RINGSZ) >> 1) + 5);
+    s->tx_mask = sz - 1;
+}
+
+static void sungem_reset_rx(SunGEMState *s)
+{
+    DBGOUT(GEN, "RX reset\n");
+
+    /* XXX Do RXCFG */
+    /* XXX Check value */
+    SET_REG(s, RXDMA_FSZ, 0x140);
+    SET_REG(s, RXDMA_DONE, 0);
+    SET_REG(s, RXDMA_KICK, 0);
+    SET_REG(s, RXDMA_CFG, 0x1000010);
+    SET_REG(s, RXDMA_PTHRESH, 0xf8);
+    SET_REG(s, RXDMA_BLANK, 0);
+
+    sungem_update_masks(s);
+}
+
+static void sungem_reset_tx(SunGEMState *s)
+{
+    DBGOUT(GEN, "TX reset\n");
+
+    /* XXX Do TXCFG */
+    /* XXX Check value */
+    SET_REG(s, TXDMA_FSZ, 0x90);
+    SET_REG(s, TXDMA_TXDONE, 0);
+    SET_REG(s, TXDMA_KICK, 0);
+    SET_REG(s, TXDMA_CFG, 0x118010);
+
+    sungem_update_masks(s);
+
+    s->tx_size = 0;
+    s->tx_first_ctl = 0;
+}
+
+static void sungem_reset_all(SunGEMState *s, bool pci_reset)
+{
+    DBGOUT(GEN, "Full reset (PCI:%d)\n", pci_reset);
+
+    sungem_reset_rx(s);
+    sungem_reset_tx(s);
+
+    SET_REG(s, GREG_IMASK, 0xFFFFFFF);
+    SET_REG(s, GREG_STAT, 0);
+    if (pci_reset) {
+        uint8_t *ma = s->conf.macaddr.a;
+
+        SET_REG(s, GREG_SWRST, 0);
+        SET_REG(s, MAC_ADDR0, (ma[4] << 8) | ma[5]);
+        SET_REG(s, MAC_ADDR1, (ma[2] << 8) | ma[3]);
+        SET_REG(s, MAC_ADDR2, (ma[0] << 8) | ma[1]);
+    } else {
+        SET_REG(s, GREG_SWRST, GET_REG(s, GREG_SWRST) & GREG_SWRST_RSTOUT);
+    }
+    SET_REG(s, MIF_CFG, MIF_CFG_MDI0);
+}
+
+static void sungem_mii_write(SunGEMState *s, uint8_t phy_addr,
+                             uint8_t reg_addr, uint16_t val)
+{
+    DBGOUT(MII, "MII write addr %x reg %02x val %04x\n",
+           phy_addr, reg_addr, val);
+
+    /* XXX TODO */
+}
+
+static uint16_t __sungem_mii_read(SunGEMState *s, uint8_t phy_addr,
+                                uint8_t reg_addr)
+{
+    if (phy_addr != s->phy_addr) {
+        return 0xffff;
+    }
+    /* Primitive emulation of a BCM5201 to please the driver,
+     * ID is 0x00406210. TODO: Do a gigabit PHY like BCM5400
+     */
+    switch(reg_addr) {
+    case MII_BMCR:
+        return 0;
+    case MII_PHYID1:
+        return 0x0040;
+    case MII_PHYID2:
+        return 0x6210;
+    case MII_BMSR:
+        if (qemu_get_queue(s->nic)->link_down) {
+            return MII_BMSR_100TX_FD  | MII_BMSR_AUTONEG;
+        } else {
+            return MII_BMSR_100TX_FD | MII_BMSR_AN_COMP |
+                    MII_BMSR_AUTONEG | MII_BMSR_LINK_ST;
+        }
+    case MII_ANLPAR:
+    case MII_ANAR:
+        return MII_ANLPAR_TXFD;
+    case 0x18: /* 5201 AUX status */
+        return 3; /* 100FD */
+    default:
+        return 0;
+    };
+}
+static uint16_t sungem_mii_read(SunGEMState *s, uint8_t phy_addr,
+                                uint8_t reg_addr)
+{
+    uint16_t val;
+
+    val = __sungem_mii_read(s, phy_addr, reg_addr);
+
+    DBGOUT(MII, "MII read addr %x reg %02x val %04x\n",
+           phy_addr, reg_addr, val);
+
+    return val;
+}
+
+static uint32_t sungem_mii_op(SunGEMState *s, uint32_t val)
+{
+    uint8_t phy_addr, reg_addr, op;
+
+    /* Ignore not start of frame */
+    if ((val >> 30) != 1) {
+        DBGOUT(ERR, "MII op, invalid SOF field %x\n", val >> 30);
+        return 0xffff;
+    }
+    phy_addr = (val & MIF_FRAME_PHYAD) >> 23;
+    reg_addr = (val & MIF_FRAME_REGAD) >> 18;
+    op = (val & MIF_FRAME_OP) >> 28;
+    switch (op) {
+    case 1:
+        sungem_mii_write(s, phy_addr, reg_addr, val & MIF_FRAME_DATA);
+        return val | MIF_FRAME_TALSB;
+    case 2:
+        return sungem_mii_read(s, phy_addr, reg_addr) | MIF_FRAME_TALSB;
+    default:
+        DBGOUT(ERR, "MII op, invalid op field %x\n", op);
+    }
+    return 0xffff | MIF_FRAME_TALSB;
+}
+
+static void sungem_mmio_write(void *opaque, hwaddr addr, uint64_t val,
+                              unsigned size)
+{
+    SunGEMState *s = opaque;
+    uint32_t *regp;
+
+    /* Drop writes to PROM image */
+    if (addr > PROM_START) {
+        return;
+    }
+
+    regp = sungem_get_reg(s, addr);
+    if (!regp) {
+        DBGOUT(ERR, "MMIO write to unknown register 0x%04x\n",
+               (unsigned int)addr);
+        return;
+    }
+
+    DBGOUT(MMIO, "MMIO write to %04x val=%08x\n",
+           (uint32_t)addr, (uint32_t)val);
+
+    /* Pre-write filter */
+    switch(addr) {
+    /* Read only registers */
+    case GREG_SEBSTATE:
+    case GREG_STAT:
+    case GREG_STAT2:
+    case GREG_PCIESTAT:
+    case TXDMA_TXDONE:
+    case TXDMA_PCNT:
+    case TXDMA_SMACHINE:
+    case TXDMA_DPLOW:
+    case TXDMA_DPHI:
+    case TXDMA_FSZ:
+    case TXDMA_FTAG:
+    case RXDMA_DONE:
+    case RXDMA_PCNT:
+    case RXDMA_SMACHINE:
+    case RXDMA_DPLOW:
+    case RXDMA_DPHI:
+    case RXDMA_FSZ:
+    case RXDMA_FTAG:
+    case MAC_TXRST: /* Not technically read-only but will do for now */
+    case MAC_RXRST: /* Not technically read-only but will do for now */
+    case MAC_TXSTAT:
+    case MAC_RXSTAT:
+    case MAC_CSTAT:
+    case MAC_PATMPS:
+    case MAC_SMACHINE:
+    case MIF_STATUS:
+    case MIF_SMACHINE:
+    case PCS_MIISTAT:
+    case PCS_ISTAT:
+    case PCS_SSTATE:
+        return; /* No actual write */
+    case GREG_IACK:
+        val &= GREG_STAT_LATCH;
+        SET_REG(s, GREG_STAT, GET_REG(s, GREG_STAT) & ~val);
+        sungem_eval_irq(s);
+        return; /* No actual write */
+    case GREG_PCIEMASK:
+        val &= 0x7;
+        break;
+    case MIF_CFG:
+        /* Maintain the RO MDI bits to advertize an MDIO PHY on MDI0 */
+        val &= ~MIF_CFG_MDI1;
+        val |= MIF_CFG_MDI0;
+        break;
+    case MAC_MINFSZ:
+        /* 10-bits implemented */
+        val &= 0x3ff;
+        break;
+    }
+
+    *regp = val;
+
+    /* Post write action */
+    switch(addr) {
+    case GREG_IMASK:
+        /* Re-evaluate interrupt */
+        sungem_eval_irq(s);
+        break;
+    case MAC_TXMASK:
+    case MAC_RXMASK:
+    case MAC_MCMASK:
+        sungem_eval_cascade_irq(s);
+        break;
+    case GREG_SWRST:
+        switch(val & (GREG_SWRST_TXRST | GREG_SWRST_RXRST)) {
+        case GREG_SWRST_RXRST:
+            sungem_reset_rx(s);
+            break;
+        case GREG_SWRST_TXRST:
+            sungem_reset_tx(s);
+            break;
+        case GREG_SWRST_RXRST | GREG_SWRST_TXRST:
+            sungem_reset_all(s, false);
+        }
+        break;
+    case TXDMA_KICK:
+        sungem_tx_kick(s);
+        break;
+    case MIF_FRAME:
+        *regp = sungem_mii_op(s, val);
+        break;
+    case RXDMA_KICK:
+            DBGOUT(TX, "RXDMA_KICK written to %d\n", (int)val);
+         /* Through */
+    case MAC_RXCFG:
+    case RXDMA_CFG:
+        sungem_update_masks(s);
+        if ((GET_REG(s, MAC_RXCFG) & MAC_RXCFG_ENAB) != 0 &&
+            (GET_REG(s, RXDMA_CFG) & RXDMA_CFG_ENABLE) != 0) {
+            qemu_flush_queued_packets(qemu_get_queue(s->nic));
+        }
+        break;
+    case TXDMA_CFG:
+        sungem_update_masks(s);
+    }
+}
+
+static uint64_t sungem_mmio_read(void *opaque, hwaddr addr, unsigned size)
+{
+    SunGEMState *s = opaque;
+    uint32_t val, *regp;
+
+    /* No PROM image to read for now... */
+    if (addr > PROM_START) {
+        return 0xffffffff;
+    }
+
+    regp = sungem_get_reg(s, addr);
+    if (!regp) {
+        qemu_log_mask(LOG_GUEST_ERROR,"%s: read from unknown register 0x%04x\n",
+                      __func__, (unsigned int)addr);
+        return 0;
+    }
+    val = *regp;
+
+    DBGOUT(MMIO, "MMIO read from %04x val=%08x\n", (uint32_t)addr, val);
+
+    switch(addr) {
+    case GREG_STAT:
+        /* Side effect, clear bottom 7 bits */
+        *regp = val & ~GREG_STAT_LATCH;
+        sungem_eval_irq(s);
+
+        /* Inject TX completion in returned value */
+        val = (val & ~GREG_STAT_TXNR) |
+                (GET_REG(s, TXDMA_TXDONE) << GREG_STAT_TXNR_SHIFT);
+        break;
+    case GREG_STAT2:
+        /* Return the status reg without side effect
+         * (and inject TX completion in returned value)
+         */
+        return (GET_REG(s, GREG_STAT) & ~GREG_STAT_TXNR) |
+                (GET_REG(s, TXDMA_TXDONE) << GREG_STAT_TXNR_SHIFT);
+    case MAC_TXSTAT:
+        *regp = 0; /* Side effect, clear all */
+        sungem_update_status(s, GREG_STAT_TXMAC, false);
+        break;
+    case MAC_RXSTAT:
+        *regp = 0; /* Side effect, clear all */
+        sungem_update_status(s, GREG_STAT_RXMAC, false);
+        break;
+    case MAC_CSTAT:
+        *regp &= MAC_CSTAT_PTR; /* Side effect, interrupt bits */
+        sungem_update_status(s, GREG_STAT_MAC, false);
+        break;
+    }
+
+    return val;
+}
+
+static void sungem_init_regs(SunGEMState *s)
+{
+    uint32_t i;
+
+    s->nregsblocks = ARRAY_SIZE(RegBlocks);
+    s->regs = g_malloc0(sizeof(uint32_t *) * s->nregsblocks);
+    for (i = 0; i < s->nregsblocks; i++) {
+        s->regs[i] = g_malloc0(sizeof(uint32_t) * RegBlocks[i].count);
+    }
+    sungem_reset_all(s, true);
+}
+
+/* PCI interface */
+
+static const MemoryRegionOps sungem_mmio_ops = {
+    .read = sungem_mmio_read,
+    .write = sungem_mmio_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .impl = {
+        .min_access_size = 4,
+        .max_access_size = 4,
+    },
+};
+
+static void sungem_uninit(PCIDevice *dev)
+{
+    SunGEMState *s = SUNGEM(dev);
+
+    qemu_del_nic(s->nic);
+}
+
+static NetClientInfo net_sungem_info = {
+    .type = NET_CLIENT_DRIVER_NIC,
+    .size = sizeof(NICState),
+    .can_receive = sungem_can_receive,
+    .receive = sungem_receive,
+    .link_status_changed = sungem_set_link_status,
+};
+
+static void sungem_realize(PCIDevice *pci_dev, Error **errp)
+{
+    DeviceState *dev = DEVICE(pci_dev);
+    SunGEMState *s = SUNGEM(pci_dev);
+    uint8_t *pci_conf;
+
+    pci_conf = pci_dev->config;
+
+    pci_set_word(pci_conf + PCI_STATUS,
+                 PCI_STATUS_FAST_BACK |
+                 PCI_STATUS_DEVSEL_MEDIUM |
+                 PCI_STATUS_66MHZ);
+
+    pci_set_word(pci_conf + PCI_SUBSYSTEM_VENDOR_ID, 0x0);
+    pci_set_word(pci_conf + PCI_SUBSYSTEM_ID, 0x0);
+
+    pci_conf[PCI_INTERRUPT_PIN] = 1; /* interrupt pin A */
+    pci_conf[PCI_MIN_GNT] = 0x40;
+    pci_conf[PCI_MAX_LAT] = 0x40;
+
+    sungem_init_regs(s);
+    memory_region_init_io(&s->mmio, OBJECT(s), &sungem_mmio_ops, s,
+                          "sungem-mmio", SUNGEM_MMIO_SIZE);
+    pci_register_bar(pci_dev, 0, 0, &s->mmio);
+
+    qemu_macaddr_default_if_unset(&s->conf.macaddr);
+    s->nic = qemu_new_nic(&net_sungem_info, &s->conf,
+                          object_get_typename(OBJECT(dev)),
+                          dev->id, s);
+    qemu_format_nic_info_str(qemu_get_queue(s->nic),
+                             s->conf.macaddr.a);
+}
+
+static void sungem_reset(DeviceState *dev)
+{
+    SunGEMState *s = SUNGEM(dev);
+
+    sungem_reset_all(s, true);
+}
+
+static void sungem_instance_init(Object *obj)
+{
+    /* XXX bootindex stuff */
+}
+
+static Property sungem_properties[] = {
+    DEFINE_NIC_PROPERTIES(SunGEMState, conf),
+    /* Phy address should be 0 for most Apple machines except
+     * for K2 in which case it's 1. Will be set by a machine
+     * override.
+     */
+    DEFINE_PROP_UINT32("phy_addr", SunGEMState, phy_addr, 0),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void sungem_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    PCIDeviceClass *k = PCI_DEVICE_CLASS(klass);
+
+    k->realize = sungem_realize;
+    k->exit = sungem_uninit;
+    k->vendor_id = PCI_VENDOR_ID_APPLE;
+    k->device_id = PCI_DEVICE_ID_APPLE_UNI_N_GMAC;
+    k->revision = 0x01;
+    k->class_id = PCI_CLASS_NETWORK_ETHERNET;
+    dc->reset = sungem_reset;
+    dc->props = sungem_properties;
+    set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
+}
+
+static const TypeInfo sungem_info = {
+    .name          = TYPE_SUNGEM,
+    .parent        = TYPE_PCI_DEVICE,
+    .instance_size = sizeof(SunGEMState),
+    .class_init    = sungem_class_init,
+    .instance_init = sungem_instance_init,
+};
+
+static void sungem_register_types(void)
+{
+    type_register_static(&sungem_info);
+}
+
+type_init(sungem_register_types)
diff --git a/hw/net/sungem.h b/hw/net/sungem.h
new file mode 100644
index 0000000..0421a4a
--- /dev/null
+++ b/hw/net/sungem.h
@@ -0,0 +1,885 @@
+/*
+ * sungem.h: Definitions for Sun GEM ethernet model
+ *
+ * Taken from Linux sungem driver
+ *
+ * Copyright (C) 2000 David S. Miller (davem@redhat.com)
+ */
+
+#ifndef _SUNGEM_H
+#define _SUNGEM_H
+
+/* Total MMIO size */
+#define SUNGEM_MMIO_SIZE        0x200000
+
+/* Global Registers */
+#define GREG_SEBSTATE	0x0000UL	/* SEB State Register		*/
+#define GREG_CFG	0x0004UL	/* Configuration Register	*/
+#define GREG_STAT	0x000CUL	/* Status Register		*/
+#define GREG_IMASK	0x0010UL	/* Interrupt Mask Register	*/
+#define GREG_IACK	0x0014UL	/* Interrupt ACK Register	*/
+#define GREG_STAT2	0x001CUL	/* Alias of GREG_STAT		*/
+#define GREG_PCIESTAT	0x1000UL	/* PCI Error Status Register	*/
+#define GREG_PCIEMASK	0x1004UL	/* PCI Error Mask Register	*/
+#define GREG_BIFCFG	0x1008UL	/* BIF Configuration Register	*/
+#define GREG_BIFDIAG	0x100CUL	/* BIF Diagnostics Register	*/
+#define GREG_SWRST	0x1010UL	/* Software Reset Register	*/
+
+/* Global SEB State Register */
+#define GREG_SEBSTATE_ARB	0x00000003	/* State of Arbiter		*/
+#define GREG_SEBSTATE_RXWON	0x00000004	/* RX won internal arbitration	*/
+
+/* Global Configuration Register */
+#define GREG_CFG_IBURST		0x00000001	/* Infinite Burst		*/
+#define GREG_CFG_TXDMALIM	0x0000003e	/* TX DMA grant limit		*/
+#define GREG_CFG_RXDMALIM	0x000007c0	/* RX DMA grant limit		*/
+#define GREG_CFG_RONPAULBIT	0x00000800	/* Use mem read multiple for PCI read
+						 * after infinite burst (Apple) */
+#define GREG_CFG_ENBUG2FIX	0x00001000	/* Fix Rx hang after overflow */
+
+/* Global Interrupt Status Register.
+ *
+ * Reading this register automatically clears bits 0 through 6.
+ * This auto-clearing does not occur when the alias at GREG_STAT2
+ * is read instead.  The rest of the interrupt bits only clear when
+ * the secondary interrupt status register corresponding to that
+ * bit is read (ie. if GREG_STAT_PCS is set, it will be cleared by
+ * reading PCS_ISTAT).
+ */
+#define GREG_STAT_TXINTME	0x00000001	/* TX INTME frame transferred	*/
+#define GREG_STAT_TXALL		0x00000002	/* All TX frames transferred	*/
+#define GREG_STAT_TXDONE	0x00000004	/* One TX frame transferred	*/
+#define GREG_STAT_RXDONE	0x00000010	/* One RX frame arrived		*/
+#define GREG_STAT_RXNOBUF	0x00000020	/* No free RX buffers available	*/
+#define GREG_STAT_RXTAGERR	0x00000040	/* RX tag framing is corrupt	*/
+#define GREG_STAT_PCS		0x00002000	/* PCS signalled interrupt	*/
+#define GREG_STAT_TXMAC		0x00004000	/* TX MAC signalled interrupt	*/
+#define GREG_STAT_RXMAC		0x00008000	/* RX MAC signalled interrupt	*/
+#define GREG_STAT_MAC		0x00010000	/* MAC Control signalled irq	*/
+#define GREG_STAT_MIF		0x00020000	/* MIF signalled interrupt	*/
+#define GREG_STAT_PCIERR	0x00040000	/* PCI Error interrupt		*/
+#define GREG_STAT_TXNR		0xfff80000	/* == TXDMA_TXDONE reg val	*/
+#define GREG_STAT_TXNR_SHIFT	19
+
+/* These interrupts are edge latches in the status register,
+ * reading it (or writing the corresponding bit in IACK) will
+ * clear them
+ */
+#define GREG_STAT_LATCH	       (GREG_STAT_TXALL  | GREG_STAT_TXINTME | \
+                                GREG_STAT_RXDONE | GREG_STAT_RXDONE |  \
+                                GREG_STAT_RXNOBUF | GREG_STAT_RXTAGERR)
+
+/* The layout of GREG_IMASK and GREG_IACK is identical to GREG_STAT.
+ * Bits set in GREG_IMASK will prevent that interrupt type from being
+ * signalled to the cpu.  GREG_IACK can be used to clear specific top-level
+ * interrupt conditions in GREG_STAT, ie. it only works for bits 0 through 6.
+ * Setting the bit will clear that interrupt, clear bits will have no effect
+ * on GREG_STAT.
+ */
+
+/* Global PCI Error Status Register */
+#define GREG_PCIESTAT_BADACK	0x00000001	/* No ACK64# during ABS64 cycle	*/
+#define GREG_PCIESTAT_DTRTO	0x00000002	/* Delayed transaction timeout	*/
+#define GREG_PCIESTAT_OTHER	0x00000004	/* Other PCI error, check cfg space */
+
+/* The layout of the GREG_PCIEMASK is identical to that of GREG_PCIESTAT.
+ * Bits set in GREG_PCIEMASK will prevent that interrupt type from being
+ * signalled to the cpu.
+ */
+
+/* Global BIF Configuration Register */
+#define GREG_BIFCFG_SLOWCLK	0x00000001	/* Set if PCI runs < 25Mhz	*/
+#define GREG_BIFCFG_B64DIS	0x00000002	/* Disable 64bit wide data cycle*/
+#define GREG_BIFCFG_M66EN	0x00000004	/* Set if on 66Mhz PCI segment	*/
+
+/* Global BIF Diagnostics Register */
+#define GREG_BIFDIAG_BURSTSM	0x007f0000	/* PCI Burst state machine	*/
+#define GREG_BIFDIAG_BIFSM	0xff000000	/* BIF state machine		*/
+
+/* Global Software Reset Register.
+ *
+ * This register is used to perform a global reset of the RX and TX portions
+ * of the GEM asic.  Setting the RX or TX reset bit will start the reset.
+ * The driver _MUST_ poll these bits until they clear.  One may not attempt
+ * to program any other part of GEM until the bits clear.
+ */
+#define GREG_SWRST_TXRST	0x00000001	/* TX Software Reset		*/
+#define GREG_SWRST_RXRST	0x00000002	/* RX Software Reset		*/
+#define GREG_SWRST_RSTOUT	0x00000004	/* Force RST# pin active	*/
+#define GREG_SWRST_CACHESIZE	0x00ff0000	/* RIO only: cache line size	*/
+#define GREG_SWRST_CACHE_SHIFT	16
+
+/* TX DMA Registers */
+#define TXDMA_KICK	0x2000UL	/* TX Kick Register		*/
+#define TXDMA_CFG	0x2004UL	/* TX Configuration Register	*/
+#define TXDMA_DBLOW	0x2008UL	/* TX Desc. Base Low		*/
+#define TXDMA_DBHI	0x200CUL	/* TX Desc. Base High		*/
+#define TXDMA_FWPTR	0x2014UL	/* TX FIFO Write Pointer	*/
+#define TXDMA_FSWPTR	0x2018UL	/* TX FIFO Shadow Write Pointer	*/
+#define TXDMA_FRPTR	0x201CUL	/* TX FIFO Read Pointer		*/
+#define TXDMA_FSRPTR	0x2020UL	/* TX FIFO Shadow Read Pointer	*/
+#define TXDMA_PCNT	0x2024UL	/* TX FIFO Packet Counter	*/
+#define TXDMA_SMACHINE	0x2028UL	/* TX State Machine Register	*/
+#define TXDMA_DPLOW	0x2030UL	/* TX Data Pointer Low		*/
+#define TXDMA_DPHI	0x2034UL	/* TX Data Pointer High		*/
+#define TXDMA_TXDONE	0x2100UL	/* TX Completion Register	*/
+#define TXDMA_FADDR	0x2104UL	/* TX FIFO Address		*/
+#define TXDMA_FTAG	0x2108UL	/* TX FIFO Tag			*/
+#define TXDMA_DLOW	0x210CUL	/* TX FIFO Data Low		*/
+#define TXDMA_DHIT1	0x2110UL	/* TX FIFO Data HighT1		*/
+#define TXDMA_DHIT0	0x2114UL	/* TX FIFO Data HighT0		*/
+#define TXDMA_FSZ	0x2118UL	/* TX FIFO Size			*/
+
+/* TX Kick Register.
+ *
+ * This 13-bit register is programmed by the driver to hold the descriptor
+ * entry index which follows the last valid transmit descriptor.
+ */
+
+/* TX Completion Register.
+ *
+ * This 13-bit register is updated by GEM to hold to descriptor entry index
+ * which follows the last descriptor already processed by GEM.  Note that
+ * this value is mirrored in GREG_STAT which eliminates the need to even
+ * access this register in the driver during interrupt processing.
+ */
+
+/* TX Configuration Register.
+ *
+ * Note that TXDMA_CFG_FTHRESH, the TX FIFO Threshold, is an obsolete feature
+ * that was meant to be used with jumbo packets.  It should be set to the
+ * maximum value of 0x4ff, else one risks getting TX MAC Underrun errors.
+ */
+#define TXDMA_CFG_ENABLE	0x00000001	/* Enable TX DMA channel	*/
+#define TXDMA_CFG_RINGSZ	0x0000001e	/* TX descriptor ring size	*/
+#define TXDMA_CFG_RINGSZ_32	0x00000000	/* 32 TX descriptors		*/
+#define TXDMA_CFG_RINGSZ_64	0x00000002	/* 64 TX descriptors		*/
+#define TXDMA_CFG_RINGSZ_128	0x00000004	/* 128 TX descriptors		*/
+#define TXDMA_CFG_RINGSZ_256	0x00000006	/* 256 TX descriptors		*/
+#define TXDMA_CFG_RINGSZ_512	0x00000008	/* 512 TX descriptors		*/
+#define TXDMA_CFG_RINGSZ_1K	0x0000000a	/* 1024 TX descriptors		*/
+#define TXDMA_CFG_RINGSZ_2K	0x0000000c	/* 2048 TX descriptors		*/
+#define TXDMA_CFG_RINGSZ_4K	0x0000000e	/* 4096 TX descriptors		*/
+#define TXDMA_CFG_RINGSZ_8K	0x00000010	/* 8192 TX descriptors		*/
+#define TXDMA_CFG_PIOSEL	0x00000020	/* Enable TX FIFO PIO from cpu	*/
+#define TXDMA_CFG_FTHRESH	0x001ffc00	/* TX FIFO Threshold, obsolete	*/
+#define TXDMA_CFG_PMODE		0x00200000	/* TXALL irq means TX FIFO empty*/
+
+/* TX Descriptor Base Low/High.
+ *
+ * These two registers store the 53 most significant bits of the base address
+ * of the TX descriptor table.  The 11 least significant bits are always
+ * zero.  As a result, the TX descriptor table must be 2K aligned.
+ */
+
+/* The rest of the TXDMA_* registers are for diagnostics and debug, I will document
+ * them later. -DaveM
+ */
+
+/* WakeOnLan Registers	*/
+#define WOL_MATCH0	0x3000UL
+#define WOL_MATCH1	0x3004UL
+#define WOL_MATCH2	0x3008UL
+#define WOL_MCOUNT	0x300CUL
+#define WOL_WAKECSR	0x3010UL
+
+/* WOL Match count register
+ */
+#define WOL_MCOUNT_N		0x00000010
+#define WOL_MCOUNT_M		0x00000000 /* 0 << 8 */
+
+#define WOL_WAKECSR_ENABLE	0x00000001
+#define WOL_WAKECSR_MII		0x00000002
+#define WOL_WAKECSR_SEEN	0x00000004
+#define WOL_WAKECSR_FILT_UCAST	0x00000008
+#define WOL_WAKECSR_FILT_MCAST	0x00000010
+#define WOL_WAKECSR_FILT_BCAST	0x00000020
+#define WOL_WAKECSR_FILT_SEEN	0x00000040
+
+
+/* Receive DMA Registers */
+#define RXDMA_CFG	0x4000UL	/* RX Configuration Register	*/
+#define RXDMA_DBLOW	0x4004UL	/* RX Descriptor Base Low	*/
+#define RXDMA_DBHI	0x4008UL	/* RX Descriptor Base High	*/
+#define RXDMA_FWPTR	0x400CUL	/* RX FIFO Write Pointer	*/
+#define RXDMA_FSWPTR	0x4010UL	/* RX FIFO Shadow Write Pointer	*/
+#define RXDMA_FRPTR	0x4014UL	/* RX FIFO Read Pointer		*/
+#define RXDMA_PCNT	0x4018UL	/* RX FIFO Packet Counter	*/
+#define RXDMA_SMACHINE	0x401CUL	/* RX State Machine Register	*/
+#define RXDMA_PTHRESH	0x4020UL	/* Pause Thresholds		*/
+#define RXDMA_DPLOW	0x4024UL	/* RX Data Pointer Low		*/
+#define RXDMA_DPHI	0x4028UL	/* RX Data Pointer High		*/
+#define RXDMA_KICK	0x4100UL	/* RX Kick Register		*/
+#define RXDMA_DONE	0x4104UL	/* RX Completion Register	*/
+#define RXDMA_BLANK	0x4108UL	/* RX Blanking Register		*/
+#define RXDMA_FADDR	0x410CUL	/* RX FIFO Address		*/
+#define RXDMA_FTAG	0x4110UL	/* RX FIFO Tag			*/
+#define RXDMA_DLOW	0x4114UL	/* RX FIFO Data Low		*/
+#define RXDMA_DHIT1	0x4118UL	/* RX FIFO Data HighT0		*/
+#define RXDMA_DHIT0	0x411CUL	/* RX FIFO Data HighT1		*/
+#define RXDMA_FSZ	0x4120UL	/* RX FIFO Size			*/
+
+/* RX Configuration Register. */
+#define RXDMA_CFG_ENABLE	0x00000001	/* Enable RX DMA channel	*/
+#define RXDMA_CFG_RINGSZ	0x0000001e	/* RX descriptor ring size	*/
+#define RXDMA_CFG_RINGSZ_32	0x00000000	/* - 32   entries		*/
+#define RXDMA_CFG_RINGSZ_64	0x00000002	/* - 64   entries		*/
+#define RXDMA_CFG_RINGSZ_128	0x00000004	/* - 128  entries		*/
+#define RXDMA_CFG_RINGSZ_256	0x00000006	/* - 256  entries		*/
+#define RXDMA_CFG_RINGSZ_512	0x00000008	/* - 512  entries		*/
+#define RXDMA_CFG_RINGSZ_1K	0x0000000a	/* - 1024 entries		*/
+#define RXDMA_CFG_RINGSZ_2K	0x0000000c	/* - 2048 entries		*/
+#define RXDMA_CFG_RINGSZ_4K	0x0000000e	/* - 4096 entries		*/
+#define RXDMA_CFG_RINGSZ_8K	0x00000010	/* - 8192 entries		*/
+#define RXDMA_CFG_RINGSZ_BDISAB	0x00000020	/* Disable RX desc batching	*/
+#define RXDMA_CFG_FBOFF		0x00001c00	/* Offset of first data byte	*/
+#define RXDMA_CFG_CSUMOFF	0x000fe000	/* Skip bytes before csum calc	*/
+#define RXDMA_CFG_FTHRESH	0x07000000	/* RX FIFO dma start threshold	*/
+#define RXDMA_CFG_FTHRESH_64	0x00000000	/* - 64   bytes			*/
+#define RXDMA_CFG_FTHRESH_128	0x01000000	/* - 128  bytes			*/
+#define RXDMA_CFG_FTHRESH_256	0x02000000	/* - 256  bytes			*/
+#define RXDMA_CFG_FTHRESH_512	0x03000000	/* - 512  bytes			*/
+#define RXDMA_CFG_FTHRESH_1K	0x04000000	/* - 1024 bytes			*/
+#define RXDMA_CFG_FTHRESH_2K	0x05000000	/* - 2048 bytes			*/
+
+/* RX Descriptor Base Low/High.
+ *
+ * These two registers store the 53 most significant bits of the base address
+ * of the RX descriptor table.  The 11 least significant bits are always
+ * zero.  As a result, the RX descriptor table must be 2K aligned.
+ */
+
+/* RX PAUSE Thresholds.
+ *
+ * These values determine when XOFF and XON PAUSE frames are emitted by
+ * GEM.  The thresholds measure RX FIFO occupancy in units of 64 bytes.
+ */
+#define RXDMA_PTHRESH_OFF	0x000001ff	/* XOFF emitted w/FIFO > this	*/
+#define RXDMA_PTHRESH_ON	0x001ff000	/* XON emitted w/FIFO < this	*/
+
+/* RX Kick Register.
+ *
+ * This 13-bit register is written by the host CPU and holds the last
+ * valid RX descriptor number plus one.  This is, if 'N' is written to
+ * this register, it means that all RX descriptors up to but excluding
+ * 'N' are valid.
+ *
+ * The hardware requires that RX descriptors are posted in increments
+ * of 4.  This means 'N' must be a multiple of four.  For the best
+ * performance, the first new descriptor being posted should be (PCI)
+ * cache line aligned.
+ */
+
+/* RX Completion Register.
+ *
+ * This 13-bit register is updated by GEM to indicate which RX descriptors
+ * have already been used for receive frames.  All descriptors up to but
+ * excluding the value in this register are ready to be processed.  GEM
+ * updates this register value after the RX FIFO empties completely into
+ * the RX descriptor's buffer, but before the RX_DONE bit is set in the
+ * interrupt status register.
+ */
+
+/* RX Blanking Register. */
+#define RXDMA_BLANK_IPKTS	0x000001ff	/* RX_DONE asserted after this
+						 * many packets received since
+						 * previous RX_DONE.
+						 */
+#define RXDMA_BLANK_ITIME	0x000ff000	/* RX_DONE asserted after this
+						 * many clocks (measured in 2048
+						 * PCI clocks) were counted since
+						 * the previous RX_DONE.
+						 */
+
+/* RX FIFO Size.
+ *
+ * This 11-bit read-only register indicates how large, in units of 64-bytes,
+ * the RX FIFO is.  The driver uses this to properly configure the RX PAUSE
+ * thresholds.
+ */
+
+/* The rest of the RXDMA_* registers are for diagnostics and debug, I will document
+ * them later. -DaveM
+ */
+
+/* MAC Registers */
+#define MAC_TXRST	0x6000UL	/* TX MAC Software Reset Command*/
+#define MAC_RXRST	0x6004UL	/* RX MAC Software Reset Command*/
+#define MAC_SNDPAUSE	0x6008UL	/* Send Pause Command Register	*/
+#define MAC_TXSTAT	0x6010UL	/* TX MAC Status Register	*/
+#define MAC_RXSTAT	0x6014UL	/* RX MAC Status Register	*/
+#define MAC_CSTAT	0x6018UL	/* MAC Control Status Register	*/
+#define MAC_TXMASK	0x6020UL	/* TX MAC Mask Register		*/
+#define MAC_RXMASK	0x6024UL	/* RX MAC Mask Register		*/
+#define MAC_MCMASK	0x6028UL	/* MAC Control Mask Register	*/
+#define MAC_TXCFG	0x6030UL	/* TX MAC Configuration Register*/
+#define MAC_RXCFG	0x6034UL	/* RX MAC Configuration Register*/
+#define MAC_MCCFG	0x6038UL	/* MAC Control Config Register	*/
+#define MAC_XIFCFG	0x603CUL	/* XIF Configuration Register	*/
+#define MAC_IPG0	0x6040UL	/* InterPacketGap0 Register	*/
+#define MAC_IPG1	0x6044UL	/* InterPacketGap1 Register	*/
+#define MAC_IPG2	0x6048UL	/* InterPacketGap2 Register	*/
+#define MAC_STIME	0x604CUL	/* SlotTime Register		*/
+#define MAC_MINFSZ	0x6050UL	/* MinFrameSize Register	*/
+#define MAC_MAXFSZ	0x6054UL	/* MaxFrameSize Register	*/
+#define MAC_PASIZE	0x6058UL	/* PA Size Register		*/
+#define MAC_JAMSIZE	0x605CUL	/* JamSize Register		*/
+#define MAC_ATTLIM	0x6060UL	/* Attempt Limit Register	*/
+#define MAC_MCTYPE	0x6064UL	/* MAC Control Type Register	*/
+#define MAC_ADDR0	0x6080UL	/* MAC Address 0 Register	*/
+#define MAC_ADDR1	0x6084UL	/* MAC Address 1 Register	*/
+#define MAC_ADDR2	0x6088UL	/* MAC Address 2 Register	*/
+#define MAC_ADDR3	0x608CUL	/* MAC Address 3 Register	*/
+#define MAC_ADDR4	0x6090UL	/* MAC Address 4 Register	*/
+#define MAC_ADDR5	0x6094UL	/* MAC Address 5 Register	*/
+#define MAC_ADDR6	0x6098UL	/* MAC Address 6 Register	*/
+#define MAC_ADDR7	0x609CUL	/* MAC Address 7 Register	*/
+#define MAC_ADDR8	0x60A0UL	/* MAC Address 8 Register	*/
+#define MAC_AFILT0	0x60A4UL	/* Address Filter 0 Register	*/
+#define MAC_AFILT1	0x60A8UL	/* Address Filter 1 Register	*/
+#define MAC_AFILT2	0x60ACUL	/* Address Filter 2 Register	*/
+#define MAC_AF21MSK	0x60B0UL	/* Address Filter 2&1 Mask Reg	*/
+#define MAC_AF0MSK	0x60B4UL	/* Address Filter 0 Mask Reg	*/
+#define MAC_HASH0	0x60C0UL	/* Hash Table 0 Register	*/
+#define MAC_HASH1	0x60C4UL	/* Hash Table 1 Register	*/
+#define MAC_HASH2	0x60C8UL	/* Hash Table 2 Register	*/
+#define MAC_HASH3	0x60CCUL	/* Hash Table 3 Register	*/
+#define MAC_HASH4	0x60D0UL	/* Hash Table 4 Register	*/
+#define MAC_HASH5	0x60D4UL	/* Hash Table 5 Register	*/
+#define MAC_HASH6	0x60D8UL	/* Hash Table 6 Register	*/
+#define MAC_HASH7	0x60DCUL	/* Hash Table 7 Register	*/
+#define MAC_HASH8	0x60E0UL	/* Hash Table 8 Register	*/
+#define MAC_HASH9	0x60E4UL	/* Hash Table 9 Register	*/
+#define MAC_HASH10	0x60E8UL	/* Hash Table 10 Register	*/
+#define MAC_HASH11	0x60ECUL	/* Hash Table 11 Register	*/
+#define MAC_HASH12	0x60F0UL	/* Hash Table 12 Register	*/
+#define MAC_HASH13	0x60F4UL	/* Hash Table 13 Register	*/
+#define MAC_HASH14	0x60F8UL	/* Hash Table 14 Register	*/
+#define MAC_HASH15	0x60FCUL	/* Hash Table 15 Register	*/
+#define MAC_NCOLL	0x6100UL	/* Normal Collision Counter	*/
+#define MAC_FASUCC	0x6104UL	/* First Attmpt. Succ Coll Ctr.	*/
+#define MAC_ECOLL	0x6108UL	/* Excessive Collision Counter	*/
+#define MAC_LCOLL	0x610CUL	/* Late Collision Counter	*/
+#define MAC_DTIMER	0x6110UL	/* Defer Timer			*/
+#define MAC_PATMPS	0x6114UL	/* Peak Attempts Register	*/
+#define MAC_RFCTR	0x6118UL	/* Receive Frame Counter	*/
+#define MAC_LERR	0x611CUL	/* Length Error Counter		*/
+#define MAC_AERR	0x6120UL	/* Alignment Error Counter	*/
+#define MAC_FCSERR	0x6124UL	/* FCS Error Counter		*/
+#define MAC_RXCVERR	0x6128UL	/* RX code Violation Error Ctr	*/
+#define MAC_RANDSEED	0x6130UL	/* Random Number Seed Register	*/
+#define MAC_SMACHINE	0x6134UL	/* State Machine Register	*/
+
+/* TX MAC Software Reset Command. */
+#define MAC_TXRST_CMD	0x00000001	/* Start sw reset, self-clears	*/
+
+/* RX MAC Software Reset Command. */
+#define MAC_RXRST_CMD	0x00000001	/* Start sw reset, self-clears	*/
+
+/* Send Pause Command. */
+#define MAC_SNDPAUSE_TS	0x0000ffff	/* The pause_time operand used in
+					 * Send_Pause and flow-control
+					 * handshakes.
+					 */
+#define MAC_SNDPAUSE_SP	0x00010000	/* Setting this bit instructs the MAC
+					 * to send a Pause Flow Control
+					 * frame onto the network.
+					 */
+
+/* TX MAC Status Register. */
+#define MAC_TXSTAT_XMIT	0x00000001	/* Frame Transmitted		*/
+#define MAC_TXSTAT_URUN	0x00000002	/* TX Underrun			*/
+#define MAC_TXSTAT_MPE	0x00000004	/* Max Packet Size Error	*/
+#define MAC_TXSTAT_NCE	0x00000008	/* Normal Collision Cntr Expire	*/
+#define MAC_TXSTAT_ECE	0x00000010	/* Excess Collision Cntr Expire	*/
+#define MAC_TXSTAT_LCE	0x00000020	/* Late Collision Cntr Expire	*/
+#define MAC_TXSTAT_FCE	0x00000040	/* First Collision Cntr Expire	*/
+#define MAC_TXSTAT_DTE	0x00000080	/* Defer Timer Expire		*/
+#define MAC_TXSTAT_PCE	0x00000100	/* Peak Attempts Cntr Expire	*/
+
+/* RX MAC Status Register. */
+#define MAC_RXSTAT_RCV	0x00000001	/* Frame Received		*/
+#define MAC_RXSTAT_OFLW	0x00000002	/* Receive Overflow		*/
+#define MAC_RXSTAT_FCE	0x00000004	/* Frame Cntr Expire		*/
+#define MAC_RXSTAT_ACE	0x00000008	/* Align Error Cntr Expire	*/
+#define MAC_RXSTAT_CCE	0x00000010	/* CRC Error Cntr Expire	*/
+#define MAC_RXSTAT_LCE	0x00000020	/* Length Error Cntr Expire	*/
+#define MAC_RXSTAT_VCE	0x00000040	/* Code Violation Cntr Expire	*/
+
+/* MAC Control Status Register. */
+#define MAC_CSTAT_PRCV	0x00000001	/* Pause Received		*/
+#define MAC_CSTAT_PS	0x00000002	/* Paused State			*/
+#define MAC_CSTAT_NPS	0x00000004	/* Not Paused State		*/
+#define MAC_CSTAT_PTR	0xffff0000	/* Pause Time Received		*/
+
+/* The layout of the MAC_{TX,RX,C}MASK registers is identical to that
+ * of MAC_{TX,RX,C}STAT.  Bits set in MAC_{TX,RX,C}MASK will prevent
+ * that interrupt type from being signalled to front end of GEM.  For
+ * the interrupt to actually get sent to the cpu, it is necessary to
+ * properly set the appropriate GREG_IMASK_{TX,RX,}MAC bits as well.
+ */
+
+/* TX MAC Configuration Register.
+ *
+ * NOTE: The TX MAC Enable bit must be cleared and polled until
+ *	 zero before any other bits in this register are changed.
+ *
+ *	 Also, enabling the Carrier Extension feature of GEM is
+ *	 a 3 step process 1) Set TX Carrier Extension 2) Set
+ *	 RX Carrier Extension 3) Set Slot Time to 0x200.  This
+ *	 mode must be enabled when in half-duplex at 1Gbps, else
+ *	 it must be disabled.
+ */
+#define MAC_TXCFG_ENAB	0x00000001	/* TX MAC Enable		*/
+#define MAC_TXCFG_ICS	0x00000002	/* Ignore Carrier Sense		*/
+#define MAC_TXCFG_ICOLL	0x00000004	/* Ignore Collisions		*/
+#define MAC_TXCFG_EIPG0	0x00000008	/* Enable IPG0			*/
+#define MAC_TXCFG_NGU	0x00000010	/* Never Give Up		*/
+#define MAC_TXCFG_NGUL	0x00000020	/* Never Give Up Limit		*/
+#define MAC_TXCFG_NBO	0x00000040	/* No Backoff			*/
+#define MAC_TXCFG_SD	0x00000080	/* Slow Down			*/
+#define MAC_TXCFG_NFCS	0x00000100	/* No FCS			*/
+#define MAC_TXCFG_TCE	0x00000200	/* TX Carrier Extension		*/
+
+/* RX MAC Configuration Register.
+ *
+ * NOTE: The RX MAC Enable bit must be cleared and polled until
+ *	 zero before any other bits in this register are changed.
+ *
+ *	 Similar rules apply to the Hash Filter Enable bit when
+ *	 programming the hash table registers, and the Address Filter
+ *	 Enable bit when programming the address filter registers.
+ */
+#define MAC_RXCFG_ENAB	0x00000001	/* RX MAC Enable		*/
+#define MAC_RXCFG_SPAD	0x00000002	/* Strip Pad			*/
+#define MAC_RXCFG_SFCS	0x00000004	/* Strip FCS			*/
+#define MAC_RXCFG_PROM	0x00000008	/* Promiscuous Mode		*/
+#define MAC_RXCFG_PGRP	0x00000010	/* Promiscuous Group		*/
+#define MAC_RXCFG_HFE	0x00000020	/* Hash Filter Enable		*/
+#define MAC_RXCFG_AFE	0x00000040	/* Address Filter Enable	*/
+#define MAC_RXCFG_DDE	0x00000080	/* Disable Discard on Error	*/
+#define MAC_RXCFG_RCE	0x00000100	/* RX Carrier Extension		*/
+
+/* MAC Control Config Register. */
+#define MAC_MCCFG_SPE	0x00000001	/* Send Pause Enable		*/
+#define MAC_MCCFG_RPE	0x00000002	/* Receive Pause Enable		*/
+#define MAC_MCCFG_PMC	0x00000004	/* Pass MAC Control		*/
+
+/* XIF Configuration Register.
+ *
+ * NOTE: When leaving or entering loopback mode, a global hardware
+ *       init of GEM should be performed.
+ */
+#define MAC_XIFCFG_OE	0x00000001	/* MII TX Output Driver Enable	*/
+#define MAC_XIFCFG_LBCK	0x00000002	/* Loopback TX to RX		*/
+#define MAC_XIFCFG_DISE	0x00000004	/* Disable RX path during TX	*/
+#define MAC_XIFCFG_GMII	0x00000008	/* Use GMII clocks + datapath	*/
+#define MAC_XIFCFG_MBOE	0x00000010	/* Controls MII_BUF_EN pin	*/
+#define MAC_XIFCFG_LLED	0x00000020	/* Force LINKLED# active (low)	*/
+#define MAC_XIFCFG_FLED	0x00000040	/* Force FDPLXLED# active (low)	*/
+
+/* InterPacketGap0 Register.  This 8-bit value is used as an extension
+ * to the InterPacketGap1 Register.  Specifically it contributes to the
+ * timing of the RX-to-TX IPG.  This value is ignored and presumed to
+ * be zero for TX-to-TX IPG calculations and/or when the Enable IPG0 bit
+ * is cleared in the TX MAC Configuration Register.
+ *
+ * This value in this register in terms of media byte time.
+ *
+ * Recommended value: 0x00
+ */
+
+/* InterPacketGap1 Register.  This 8-bit value defines the first 2/3
+ * portion of the Inter Packet Gap.
+ *
+ * This value in this register in terms of media byte time.
+ *
+ * Recommended value: 0x08
+ */
+
+/* InterPacketGap2 Register.  This 8-bit value defines the second 1/3
+ * portion of the Inter Packet Gap.
+ *
+ * This value in this register in terms of media byte time.
+ *
+ * Recommended value: 0x04
+ */
+
+/* Slot Time Register.  This 10-bit value specifies the slot time
+ * parameter in units of media byte time.  It determines the physical
+ * span of the network.
+ *
+ * Recommended value: 0x40
+ */
+
+/* Minimum Frame Size Register.  This 10-bit register specifies the
+ * smallest sized frame the TXMAC will send onto the medium, and the
+ * RXMAC will receive from the medium.
+ *
+ * Recommended value: 0x40
+ */
+
+/* Maximum Frame and Burst Size Register.
+ *
+ * This register specifies two things.  First it specifies the maximum
+ * sized frame the TXMAC will send and the RXMAC will recognize as
+ * valid.  Second, it specifies the maximum run length of a burst of
+ * packets sent in half-duplex gigabit modes.
+ *
+ * Recommended value: 0x200005ee
+ */
+#define MAC_MAXFSZ_MFS	0x00007fff	/* Max Frame Size		*/
+#define MAC_MAXFSZ_MBS	0x7fff0000	/* Max Burst Size		*/
+
+/* PA Size Register.  This 10-bit register specifies the number of preamble
+ * bytes which will be transmitted at the beginning of each frame.  A
+ * value of two or greater should be programmed here.
+ *
+ * Recommended value: 0x07
+ */
+
+/* Jam Size Register.  This 4-bit register specifies the duration of
+ * the jam in units of media byte time.
+ *
+ * Recommended value: 0x04
+ */
+
+/* Attempts Limit Register.  This 8-bit register specifies the number
+ * of attempts that the TXMAC will make to transmit a frame, before it
+ * resets its Attempts Counter.  After reaching the Attempts Limit the
+ * TXMAC may or may not drop the frame, as determined by the NGU
+ * (Never Give Up) and NGUL (Never Give Up Limit) bits in the TXMAC
+ * Configuration Register.
+ *
+ * Recommended value: 0x10
+ */
+
+/* MAX Control Type Register.  This 16-bit register specifies the
+ * "type" field of a MAC Control frame.  The TXMAC uses this field to
+ * encapsulate the MAC Control frame for transmission, and the RXMAC
+ * uses it for decoding valid MAC Control frames received from the
+ * network.
+ *
+ * Recommended value: 0x8808
+ */
+
+/* MAC Address Registers.  Each of these registers specify the
+ * ethernet MAC of the interface, 16-bits at a time.  Register
+ * 0 specifies bits [47:32], register 1 bits [31:16], and register
+ * 2 bits [15:0].
+ *
+ * Registers 3 through and including 5 specify an alternate
+ * MAC address for the interface.
+ *
+ * Registers 6 through and including 8 specify the MAC Control
+ * Address, which must be the reserved multicast address for MAC
+ * Control frames.
+ *
+ * Example: To program primary station address a:b:c:d:e:f into
+ *	    the chip.
+ *		MAC_Address_2 = (a << 8) | b
+ *		MAC_Address_1 = (c << 8) | d
+ *		MAC_Address_0 = (e << 8) | f
+ */
+
+/* Address Filter Registers.  Registers 0 through 2 specify bit
+ * fields [47:32] through [15:0], respectively, of the address
+ * filter.  The Address Filter 2&1 Mask Register denotes the 8-bit
+ * nibble mask for Address Filter Registers 2 and 1.  The Address
+ * Filter 0 Mask Register denotes the 16-bit mask for the Address
+ * Filter Register 0.
+ */
+
+/* Hash Table Registers.  Registers 0 through 15 specify bit fields
+ * [255:240] through [15:0], respectively, of the hash table.
+ */
+
+/* Statistics Registers.  All of these registers are 16-bits and
+ * track occurrences of a specific event.  GEM can be configured
+ * to interrupt the host cpu when any of these counters overflow.
+ * They should all be explicitly initialized to zero when the interface
+ * is brought up.
+ */
+
+/* Random Number Seed Register.  This 10-bit value is used as the
+ * RNG seed inside GEM for the CSMA/CD backoff algorithm.  It is
+ * recommended to program this register to the 10 LSB of the
+ * interfaces MAC address.
+ */
+
+/* Pause Timer, read-only.  This 16-bit timer is used to time the pause
+ * interval as indicated by a received pause flow control frame.
+ * A non-zero value in this timer indicates that the MAC is currently in
+ * the paused state.
+ */
+
+/* MIF Registers */
+#define MIF_BBCLK	0x6200UL	/* MIF Bit-Bang Clock		*/
+#define MIF_BBDATA	0x6204UL	/* MIF Bit-Band Data		*/
+#define MIF_BBOENAB	0x6208UL	/* MIF Bit-Bang Output Enable	*/
+#define MIF_FRAME	0x620CUL	/* MIF Frame/Output Register	*/
+#define MIF_CFG		0x6210UL	/* MIF Configuration Register	*/
+#define MIF_MASK	0x6214UL	/* MIF Mask Register		*/
+#define MIF_STATUS	0x6218UL	/* MIF Status Register		*/
+#define MIF_SMACHINE	0x621CUL	/* MIF State Machine Register	*/
+
+/* MIF Bit-Bang Clock.  This 1-bit register is used to generate the
+ * MDC clock waveform on the MII Management Interface when the MIF is
+ * programmed in the "Bit-Bang" mode.  Writing a '1' after a '0' into
+ * this register will create a rising edge on the MDC, while writing
+ * a '0' after a '1' will create a falling edge.  For every bit that
+ * is transferred on the management interface, both edges have to be
+ * generated.
+ */
+
+/* MIF Bit-Bang Data.  This 1-bit register is used to generate the
+ * outgoing data (MDO) on the MII Management Interface when the MIF
+ * is programmed in the "Bit-Bang" mode.  The daa will be steered to the
+ * appropriate MDIO based on the state of the PHY_Select bit in the MIF
+ * Configuration Register.
+ */
+
+/* MIF Big-Band Output Enable.  THis 1-bit register is used to enable
+ * ('1') or disable ('0') the I-directional driver on the MII when the
+ * MIF is programmed in the "Bit-Bang" mode.  The MDIO should be enabled
+ * when data bits are transferred from the MIF to the transceiver, and it
+ * should be disabled when the interface is idle or when data bits are
+ * transferred from the transceiver to the MIF (data portion of a read
+ * instruction).  Only one MDIO will be enabled at a given time, depending
+ * on the state of the PHY_Select bit in the MIF Configuration Register.
+ */
+
+/* MIF Configuration Register.  This 15-bit register controls the operation
+ * of the MIF.
+ */
+#define MIF_CFG_PSELECT	0x00000001	/* Xcvr slct: 0=mdio0 1=mdio1	*/
+#define MIF_CFG_POLL	0x00000002	/* Enable polling mechanism	*/
+#define MIF_CFG_BBMODE	0x00000004	/* 1=bit-bang 0=frame mode	*/
+#define MIF_CFG_PRADDR	0x000000f8	/* Xcvr poll register address	*/
+#define MIF_CFG_MDI0	0x00000100	/* MDIO_0 present or read-bit	*/
+#define MIF_CFG_MDI1	0x00000200	/* MDIO_1 present or read-bit	*/
+#define MIF_CFG_PPADDR	0x00007c00	/* Xcvr poll PHY address	*/
+
+/* MIF Frame/Output Register.  This 32-bit register allows the host to
+ * communicate with a transceiver in frame mode (as opposed to big-bang
+ * mode).  Writes by the host specify an instrution.  After being issued
+ * the host must poll this register for completion.  Also, after
+ * completion this register holds the data returned by the transceiver
+ * if applicable.
+ */
+#define MIF_FRAME_ST	0xc0000000	/* STart of frame		*/
+#define MIF_FRAME_OP	0x30000000	/* OPcode			*/
+#define MIF_FRAME_PHYAD	0x0f800000	/* PHY ADdress			*/
+#define MIF_FRAME_REGAD	0x007c0000	/* REGister ADdress		*/
+#define MIF_FRAME_TAMSB	0x00020000	/* Turn Around MSB		*/
+#define MIF_FRAME_TALSB	0x00010000	/* Turn Around LSB		*/
+#define MIF_FRAME_DATA	0x0000ffff	/* Instruction Payload		*/
+
+/* MIF Status Register.  This register reports status when the MIF is
+ * operating in the poll mode.  The poll status field is auto-clearing
+ * on read.
+ */
+#define MIF_STATUS_DATA	0xffff0000	/* Live image of XCVR reg	*/
+#define MIF_STATUS_STAT	0x0000ffff	/* Which bits have changed	*/
+
+/* MIF Mask Register.  This 16-bit register is used when in poll mode
+ * to say which bits of the polled register will cause an interrupt
+ * when changed.
+ */
+
+/* PCS/Serialink Registers */
+#define PCS_MIICTRL	0x9000UL	/* PCS MII Control Register	*/
+#define PCS_MIISTAT	0x9004UL	/* PCS MII Status Register	*/
+#define PCS_MIIADV	0x9008UL	/* PCS MII Advertisement Reg	*/
+#define PCS_MIILP	0x900CUL	/* PCS MII Link Partner Ability	*/
+#define PCS_CFG		0x9010UL	/* PCS Configuration Register	*/
+#define PCS_SMACHINE	0x9014UL	/* PCS State Machine Register	*/
+#define PCS_ISTAT	0x9018UL	/* PCS Interrupt Status Reg	*/
+#define PCS_DMODE	0x9050UL	/* Datapath Mode Register	*/
+#define PCS_SCTRL	0x9054UL	/* Serialink Control Register	*/
+#define PCS_SOS		0x9058UL	/* Shared Output Select Reg	*/
+#define PCS_SSTATE	0x905CUL	/* Serialink State Register	*/
+
+/* PCD MII Control Register. */
+#define PCS_MIICTRL_SPD	0x00000040	/* Read as one, writes ignored	*/
+#define PCS_MIICTRL_CT	0x00000080	/* Force COL signal active	*/
+#define PCS_MIICTRL_DM	0x00000100	/* Duplex mode, forced low	*/
+#define PCS_MIICTRL_RAN	0x00000200	/* Restart auto-neg, self clear	*/
+#define PCS_MIICTRL_ISO	0x00000400	/* Read as zero, writes ignored	*/
+#define PCS_MIICTRL_PD	0x00000800	/* Read as zero, writes ignored	*/
+#define PCS_MIICTRL_ANE	0x00001000	/* Auto-neg enable		*/
+#define PCS_MIICTRL_SS	0x00002000	/* Read as zero, writes ignored	*/
+#define PCS_MIICTRL_WB	0x00004000	/* Wrapback, loopback at 10-bit
+					 * input side of Serialink
+					 */
+#define PCS_MIICTRL_RST	0x00008000	/* Resets PCS, self clearing	*/
+
+/* PCS MII Status Register. */
+#define PCS_MIISTAT_EC	0x00000001	/* Ext Capability: Read as zero	*/
+#define PCS_MIISTAT_JD	0x00000002	/* Jabber Detect: Read as zero	*/
+#define PCS_MIISTAT_LS	0x00000004	/* Link Status: 1=up 0=down	*/
+#define PCS_MIISTAT_ANA	0x00000008	/* Auto-neg Ability, always 1	*/
+#define PCS_MIISTAT_RF	0x00000010	/* Remote Fault			*/
+#define PCS_MIISTAT_ANC	0x00000020	/* Auto-neg complete		*/
+#define PCS_MIISTAT_ES	0x00000100	/* Extended Status, always 1	*/
+
+/* PCS MII Advertisement Register. */
+#define PCS_MIIADV_FD	0x00000020	/* Advertise Full Duplex	*/
+#define PCS_MIIADV_HD	0x00000040	/* Advertise Half Duplex	*/
+#define PCS_MIIADV_SP	0x00000080	/* Advertise Symmetric Pause	*/
+#define PCS_MIIADV_AP	0x00000100	/* Advertise Asymmetric Pause	*/
+#define PCS_MIIADV_RF	0x00003000	/* Remote Fault			*/
+#define PCS_MIIADV_ACK	0x00004000	/* Read-only			*/
+#define PCS_MIIADV_NP	0x00008000	/* Next-page, forced low	*/
+
+/* PCS MII Link Partner Ability Register.   This register is equivalent
+ * to the Link Partnet Ability Register of the standard MII register set.
+ * It's layout corresponds to the PCS MII Advertisement Register.
+ */
+
+/* PCS Configuration Register. */
+#define PCS_CFG_ENABLE	0x00000001	/* Must be zero while changing
+					 * PCS MII advertisement reg.
+					 */
+#define PCS_CFG_SDO	0x00000002	/* Signal detect override	*/
+#define PCS_CFG_SDL	0x00000004	/* Signal detect active low	*/
+#define PCS_CFG_JS	0x00000018	/* Jitter-study:
+					 * 0 = normal operation
+					 * 1 = high-frequency test pattern
+					 * 2 = low-frequency test pattern
+					 * 3 = reserved
+					 */
+#define PCS_CFG_TO	0x00000020	/* 10ms auto-neg timer override	*/
+
+/* PCS Interrupt Status Register.  This register is self-clearing
+ * when read.
+ */
+#define PCS_ISTAT_LSC	0x00000004	/* Link Status Change		*/
+
+/* Datapath Mode Register. */
+#define PCS_DMODE_SM	0x00000001	/* 1 = use internal Serialink	*/
+#define PCS_DMODE_ESM	0x00000002	/* External SERDES mode		*/
+#define PCS_DMODE_MGM	0x00000004	/* MII/GMII mode		*/
+#define PCS_DMODE_GMOE	0x00000008	/* GMII Output Enable		*/
+
+/* Serialink Control Register.
+ *
+ * NOTE: When in SERDES mode, the loopback bit has inverse logic.
+ */
+#define PCS_SCTRL_LOOP	0x00000001	/* Loopback enable		*/
+#define PCS_SCTRL_ESCD	0x00000002	/* Enable sync char detection	*/
+#define PCS_SCTRL_LOCK	0x00000004	/* Lock to reference clock	*/
+#define PCS_SCTRL_EMP	0x00000018	/* Output driver emphasis	*/
+#define PCS_SCTRL_STEST	0x000001c0	/* Self test patterns		*/
+#define PCS_SCTRL_PDWN	0x00000200	/* Software power-down		*/
+#define PCS_SCTRL_RXZ	0x00000c00	/* PLL input to Serialink	*/
+#define PCS_SCTRL_RXP	0x00003000	/* PLL input to Serialink	*/
+#define PCS_SCTRL_TXZ	0x0000c000	/* PLL input to Serialink	*/
+#define PCS_SCTRL_TXP	0x00030000	/* PLL input to Serialink	*/
+
+/* Shared Output Select Register.  For test and debug, allows multiplexing
+ * test outputs into the PROM address pins.  Set to zero for normal
+ * operation.
+ */
+#define PCS_SOS_PADDR	0x00000003	/* PROM Address			*/
+
+/* PROM Image Space */
+#define PROM_START	0x100000UL	/* Expansion ROM run time access*/
+#define PROM_SIZE	0x0fffffUL	/* Size of ROM			*/
+#define PROM_END	0x200000UL	/* End of ROM			*/
+
+/* MII definitions missing from mii.h */
+
+#define BMCR_SPD2	0x0040		/* Gigabit enable? (bcm5411)	*/
+#define LPA_PAUSE	0x0400
+
+/* More PHY registers (specific to Broadcom models) */
+
+/* MII BCM5201 MULTIPHY interrupt register */
+#define MII_BCM5201_INTERRUPT			0x1A
+#define MII_BCM5201_INTERRUPT_INTENABLE		0x4000
+
+#define MII_BCM5201_AUXMODE2			0x1B
+#define MII_BCM5201_AUXMODE2_LOWPOWER		0x0008
+
+#define MII_BCM5201_MULTIPHY                    0x1E
+
+/* MII BCM5201 MULTIPHY register bits */
+#define MII_BCM5201_MULTIPHY_SERIALMODE         0x0002
+#define MII_BCM5201_MULTIPHY_SUPERISOLATE       0x0008
+
+/* MII BCM5400 1000-BASET Control register */
+#define MII_BCM5400_GB_CONTROL			0x09
+#define MII_BCM5400_GB_CONTROL_FULLDUPLEXCAP	0x0200
+
+/* MII BCM5400 AUXCONTROL register */
+#define MII_BCM5400_AUXCONTROL                  0x18
+#define MII_BCM5400_AUXCONTROL_PWR10BASET       0x0004
+
+/* MII BCM5400 AUXSTATUS register */
+#define MII_BCM5400_AUXSTATUS                   0x19
+#define MII_BCM5400_AUXSTATUS_LINKMODE_MASK     0x0700
+#define MII_BCM5400_AUXSTATUS_LINKMODE_SHIFT    8
+
+/* When it can, GEM internally caches 4 aligned TX descriptors
+ * at a time, so that it can use full cacheline DMA reads.
+ *
+ * Note that unlike HME, there is no ownership bit in the descriptor
+ * control word.  The same functionality is obtained via the TX-Kick
+ * and TX-Complete registers.  As a result, GEM need not write back
+ * updated values to the TX descriptor ring, it only performs reads.
+ *
+ * Since TX descriptors are never modified by GEM, the driver can
+ * use the buffer DMA address as a place to keep track of allocated
+ * DMA mappings for a transmitted packet.
+ */
+struct gem_txd {
+        uint64_t	control_word;
+        uint64_t	buffer;
+};
+
+#define TXDCTRL_BUFSZ	0x0000000000007fffULL	/* Buffer Size		*/
+#define TXDCTRL_CSTART	0x00000000001f8000ULL	/* CSUM Start Offset	*/
+#define TXDCTRL_COFF	0x000000001fe00000ULL	/* CSUM Stuff Offset	*/
+#define TXDCTRL_CENAB	0x0000000020000000ULL	/* CSUM Enable		*/
+#define TXDCTRL_EOF	0x0000000040000000ULL	/* End of Frame		*/
+#define TXDCTRL_SOF	0x0000000080000000ULL	/* Start of Frame	*/
+#define TXDCTRL_INTME	0x0000000100000000ULL	/* "Interrupt Me"	*/
+#define TXDCTRL_NOCRC	0x0000000200000000ULL	/* No CRC Present	*/
+
+/* GEM requires that RX descriptors are provided four at a time,
+ * aligned.  Also, the RX ring may not wrap around.  This means that
+ * there will be at least 4 unused descriptor entries in the middle
+ * of the RX ring at all times.
+ *
+ * Similar to HME, GEM assumes that it can write garbage bytes before
+ * the beginning of the buffer and right after the end in order to DMA
+ * whole cachelines.
+ *
+ * Unlike for TX, GEM does update the status word in the RX descriptors
+ * when packets arrive.  Therefore an ownership bit does exist in the
+ * RX descriptors.  It is advisory, GEM clears it but does not check
+ * it in any way.  So when buffers are posted to the RX ring (via the
+ * RX Kick register) by the driver it must make sure the buffers are
+ * truly ready and that the ownership bits are set properly.
+ *
+ * Even though GEM modifies the RX descriptors, it guarantees that the
+ * buffer DMA address field will stay the same when it performs these
+ * updates.  Therefore it can be used to keep track of DMA mappings
+ * by the host driver just as in the TX descriptor case above.
+ */
+struct gem_rxd {
+        uint64_t	status_word;
+        uint64_t	buffer;
+};
+
+#define RXDCTRL_TCPCSUM	0x000000000000ffffULL	/* TCP Pseudo-CSUM	*/
+#define RXDCTRL_BUFSZ	0x000000007fff0000ULL	/* Buffer Size		*/
+#define RXDCTRL_OWN	0x0000000080000000ULL	/* GEM owns this entry	*/
+#define RXDCTRL_HASHVAL	0x0ffff00000000000ULL	/* Hash Value		*/
+#define RXDCTRL_HPASS	0x1000000000000000ULL	/* Passed Hash Filter	*/
+#define RXDCTRL_ALTMAC	0x2000000000000000ULL	/* Matched ALT MAC	*/
+#define RXDCTRL_BAD	0x4000000000000000ULL	/* Frame has bad CRC	*/
+
+
+#endif /* _SUNGEM_H */
diff --git a/hw/pci/pci.c b/hw/pci/pci.c
index 24fae16..c2a8c0b 100644
--- a/hw/pci/pci.c
+++ b/hw/pci/pci.c
@@ -1758,6 +1758,7 @@ static const char * const pci_nic_models[] = {
     "e1000",
     "pcnet",
     "virtio",
+    "sungem",
     NULL
 };
 
@@ -1770,6 +1771,7 @@ static const char * const pci_nic_names[] = {
     "e1000",
     "pcnet",
     "virtio-net-pci",
+    "sungem",
     NULL
 };
 
diff --git a/include/hw/pci/pci_ids.h b/include/hw/pci/pci_ids.h
index d77ca60..d38dc73 100644
--- a/include/hw/pci/pci_ids.h
+++ b/include/hw/pci/pci_ids.h
@@ -89,6 +89,7 @@
 #define PCI_VENDOR_ID_APPLE              0x106b
 #define PCI_DEVICE_ID_APPLE_UNI_N_AGP    0x0020
 #define PCI_DEVICE_ID_APPLE_U3_AGP       0x004b
+#define PCI_DEVICE_ID_APPLE_UNI_N_GMAC   0x0021
 
 #define PCI_VENDOR_ID_SUN                0x108e
 #define PCI_DEVICE_ID_SUN_EBUS           0x1000

^ permalink raw reply related	[flat|nested] 9+ messages in thread

end of thread, other threads:[~2016-09-21 11:53 UTC | newest]

Thread overview: 9+ messages (download: mbox.gz follow: Atom feed
-- links below jump to the message on this page --
2016-08-14 22:48 [Qemu-devel] [PATCH] net: Add SunGEM device emulation as found on Apple UniNorth Benjamin Herrenschmidt
2016-08-14 22:54 ` no-reply
2016-08-14 23:59   ` Benjamin Herrenschmidt
2016-08-15  0:11     ` Benjamin Herrenschmidt
2016-09-21  3:18       ` [Qemu-devel] [Qemu-ppc] " David Gibson
2016-09-21  9:02         ` Benjamin Herrenschmidt
2016-09-21 10:16     ` [Qemu-devel] " Alex Bennée
2016-09-21 10:40       ` Benjamin Herrenschmidt
2016-09-21 11:52         ` Alex Bennée

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for NNTP newsgroup(s).