summaryrefslogtreecommitdiffstats
path: root/hw/net/cadence_gem.c
Commit message (Collapse)AuthorAgeFilesLines
...
* cadence_gem: Avoid infinite loops with a misconfigured bufferAlistair Francis2016-06-271-0/+7
| | | | | | | | | | | | | | | A guest can write zero to the DMACFG resulting in an infinite loop when it reaches the while(bytes_to_copy) loop. To avoid this issue enforce a minimum size for the RX buffer. Hardware does not have this enforcement and relies on the guest to set a non-zero value. Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reported-by: Li Qiang <liqiang6-s@360.cn> Reported-by: P J P <ppandit@redhat.com> Message-id: 84bb1c391b833275da3f573d4972920cea34c188.1466539342.git.alistair.francis@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* cadence_gem: fix buffer overflowMichael S. Tsirkin2016-02-041-0/+8
| | | | | | | | | | | | gem_transmit copies a packet from guest into an tx_packet[2048] array on stack, with size limited by descriptor length set by guest. If guest is malicious and specifies a descriptor length that is too large, and should packet size exceed array size, this results in a buffer overflow. Reported-by: 刘令 <liuling-it@360.cn> Signed-off-by: Michael S. Tsirkin <mst@redhat.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
* net: cadence_gem: check packet size in gem_recievePrasad J Pandit2016-02-041-0/+4
| | | | | | | | | | | While receiving packets in 'gem_receive' routine, if Frame Check Sequence(FCS) is enabled, it copies the packet into a local buffer without checking its size. Add check to validate packet length against the buffer size to avoid buffer overflow. Reported-by: Ling Liu <liuling-it@360.cn> Signed-off-by: Prasad J Pandit <pjp@fedoraproject.org> Signed-off-by: Jason Wang <jasowang@redhat.com>
* arm: Clean up includesPeter Maydell2016-01-291-0/+1
| | | | | | | | | | Clean up includes so that osdep.h is included first and headers which it implies are not included manually. This commit was created with scripts/clean-includes. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 1453832250-766-13-git-send-email-peter.maydell@linaro.org
* net: cadence_gem: Set initial MAC addressSebastian Huber2015-10-271-0/+6
| | | | | | | | | Set initial MAC address to the one specified by the command line. Signed-off-by: Sebastian Huber <sebastian.huber@embedded-brains.de> Reviewed-by: Jason Wang <jasowang@redhat.com> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Jason Wang <jasowang@redhat.com>
* cadence_gem: Correct Marvell PHY SPCFC reset valueAlistair Francis2015-09-081-1/+1
| | | | | | | | | | | Bit 15 of the PHY Specific Status Register is reserved and should remain 0. Fix the reset value to ensure that the 15th bit is not set. Signed-off-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Message-id: c795069e49040ff770fe2ece19dfe1791b729e22.1441316450.git.alistair.francis@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* cadence_gem: Fix Rx buffer size field maskSai Pavan Boddu2015-06-031-1/+1
| | | | | | | | | | This patch corrects the Rx buffer size field mask to mask bits 23 to 16 to match Xilinx UG585 documentation. Signed-off-by: Sai Pavan Boddu <saipava@xilinx.com> Reviewed-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
* net: cadence_gem: Split state struct and type into headerPeter Crosthwaite2015-05-181-42/+1Star
| | | | | | | | | | | | | | Create a new header for Cadence GEM to allow using the device with modern SoC programming conventions. The state struct needs to be visible to embed the device in SoC containers. Reviewed-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Tested-by: Alistair Francis <alistair.francis@xilinx.com> Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Message-id: a98b5df6440c5bff8f813a26bb53ce1cfefb4c4c.1431381507.git.peter.crosthwaite@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* net: cadence_gem: Clean up variable namesPeter Crosthwaite2015-05-181-35/+35
| | | | | | | | | | | | | | | | | | Cleanup some variable names in preparation for migrating the state struct and type cast macro to a public header. The acronym "GEM" on its own is not specific enough to be used in a more global namespace so preface with "cadence". Fix the capitalisation of "gem" in the state type while touching the typename. Also preface the GEM_MAXREG macro as this will need to migrate to public header. Reviewed-by: Alistair Francis <alistair.francis@xilinx.com> Reviewed-by: Alex Bennée <alex.bennee@linaro.org> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Tested-by: Alistair Francis <alistair.francis@xilinx.com> Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Message-id: 8e2b0687b3a7b7a3fde5ba2f3bee6f3b911e84ef.1431381507.git.peter.crosthwaite@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* net: remove all cleanup methods from NIC NetClientInfosPaolo Bonzini2015-01-121-9/+0Star
| | | | | | | | | | | | | | | | | All NICs have a cleanup function that, in most cases, zeroes the pointer to the NICState. In some cases, it frees data belonging to the NIC. However, this function is never called except when exiting from QEMU. It is not necessary to NULL pointers and free data here; the right place to do that would be in the device's unrealize function, after calling qemu_del_nic. Zeroing the NIC multiple times is also wrong for multiqueue devices. This cleanup function gets in the way of making the NetClientStates for the NIC hold an object_ref reference to the object, so get rid of it. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com> Signed-off-by: Stefan Hajnoczi <stefanha@redhat.com>
* net: cadence_gem: Remove &desc[0] usagesPeter Crosthwaite2014-06-101-2/+2
| | | | | | | Just use desc instead. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
* net: cadence_gem: Comment spelling sweepPeter Crosthwaite2014-06-101-6/+6
| | | | | | | Fix some typos in comments. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
* net: cadence_gem: Add Tx descriptor fetch printfPeter Crosthwaite2014-06-101-0/+3
| | | | | | | | | Add a debug printf for TX descriptor fetching. This is helpful to anyone needing to debug TX ring buffer traversal. It is also now consistent with the RX code which has a similar printf. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
* net: cadence_gem: Fix Tx descriptor updatePeter Crosthwaite2014-06-101-5/+7
| | | | | | | | | | | The local variable "desc" was being used to read-modify-write the first descriptor (of a multi-desc packet) upon packet completion. desc however continues to be used by the code as the current descriptor. Give this first desc RMW it's own local variable to avoid trampling. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
* net: cadence_gem: Fix top commentPeter Crosthwaite2014-05-261-1/+1
| | | | | | | To indicate Cadence GEM not Xilinx. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
* hw/net/cadence_gem: Remove dead codePeter Maydell2014-05-131-7/+1Star
| | | | | | | | | | | Commit 191946c moved the code to handle padding to minimum length from after the handling of the CRC to before it. This means that the CRC code doesn't need to cope with the possibility that the size is less than 60; remove this dead code. Signed-off-by: Peter Maydell <peter.maydell@linaro.org> Reviewed-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com>
* savevm: Remove all the unneeded version_minimum_id_old (arm)Juan Quintela2014-05-131-2/+1Star
| | | | | | | | | | | | | | | | | | | | | After commit 767adce2d, they are redundant. This way we don't assign them except when needed. Once there, there were lots of cases where the ".fields" indentation was wrong: .fields = (VMStateField []) { and .fields = (VMStateField []) { Change all the combinations to: .fields = (VMStateField[]){ The biggest problem (apart from aesthetics) was that checkpatch complained when we copy&pasted the code from one place to another. Signed-off-by: Juan Quintela <quintela@redhat.com> [PMM: fixed minor conflict, corrected commit message typos] Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* hw: Add missing 'static' attributesStefan Weil2014-05-071-1/+1
| | | | | | | This fixes warnings from the static code analysis (smatch). Signed-off-by: Stefan Weil <sw@weilnetz.de> Signed-off-by: Michael Tokarev <mjt@tls.msk.ru>
* net: cadence_gem: Make phy respond to broadcastPeter Crosthwaite2014-04-171-2/+2
| | | | | | | | | | Phys must respond to address 0 by specification. Implement. Signed-off-by: Nathan Rossi <nathan.rossi@xilinx.com> Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Message-id: 6f4d53b04ddbfb19895bfb61a595e69f1c08859a.1396594056.git.peter.crosthwaite@xilinx.com Reviewed-by: Beniamino Galvani <b.galvani@gmail.com> Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* net/cadence_gem: Don't rx packets when no rx buffer availablePeter Crosthwaite2013-12-101-1/+10
| | | | | | | | | Return false from can_receive() when no valid buffer descriptor is available. Ensures against mass packet droppage in some applications. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Message-id: cde00ef774e84e2586bf10fd37b542f75bf36cfb.1386136219.git.peter.crosthwaite@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* net/cadence_gem: Improve can_receive debug printferyPeter Crosthwaite2013-12-101-2/+10
| | | | | | | | | | | | Currently this just floods indicating that can_receive has been called by the net framework. Instead, save the result of the most recent can_receive callback as state and only print a message if the result changes (indicating some sort of actual state change in GEM). Make said debug message more meaningful as well. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Message-id: 2eb74ca6a5756aea242d9f525961db95d6cfcf2c.1386136219.git.peter.crosthwaite@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* net/cadence_gem: Fix register w1c logicPeter Crosthwaite2013-12-101-7/+6Star
| | | | | | | | | | | This write-1-clear logic was incorrect. It was always clearing w1c bits regardless of whether the written value was 1 or not. i.e. it was implementing a write-anything-to-clear strategy. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: ed905b04d3343966ded425f06aa2224bc7a35b59.1386136219.git.peter.crosthwaite@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* net/cadence_gem: Fix small packet FCS strippingPeter Crosthwaite2013-12-101-5/+8
| | | | | | | | | | The minimum packet size is 64, however this is before FCS stripping occurs. So when FCS stripping the minimum packet size is 60. Fix. Reported-by: Deepika Dhamija <deepika@xilinx.com> Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Message-id: 8aac5bd737f9cf48b87f32943d7eb5939061e546.1386136219.git.peter.crosthwaite@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* net/cadence_gem: Fix rx multi-fragment packetsPeter Crosthwaite2013-12-101-1/+1
| | | | | | | | | | | | | Bytes_to_copy was being updated before its final use where it advances the rx buffer pointer. This was causing total mayhem, where packet data for any subsequent fragments was being fetched from the wrong place. Reported-by: Deepika Dhamija <deepika@xilinx.com> Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: c2a1c65c1fd06eb274442a0fa4a6839d940e145e.1386136219.git.peter.crosthwaite@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* net/cadence_gem: Add missing VMSTATE_END_OF_LISTPeter Crosthwaite2013-12-101-0/+1
| | | | | | Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Message-id: 8f8c2bfb15f40fb5f0d5766aa4cd3d54c596de6a.1386136219.git.peter.crosthwaite@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* net/cadence_gem: Implement SAR (de)activationPeter Crosthwaite2013-12-101-4/+23
| | | | | | | | | | | | The Specific address registers can be enabled or disabled by software. QEMU was assuming they were always enabled. Implement the disable/enable feature. SARs are disabled by writing to the lower half register. They are re-enabled by then writing the upper half. Reported-by: Deepika Dhamija <deepika@xilinx.com> Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Message-id: 49efd1f7450af8f980b967d3054245bae137866c.1386136219.git.peter.crosthwaite@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* net/cadence_gem: Implement SAR match bit in rx descPeter Crosthwaite2013-12-101-0/+2
| | | | | | | | | | | | | | Bit 27 of the RX buffer desc word 1 should be set when the packet was accepted due to specific address register match. Implement. This feature is absent from the Xilinx documentation (UG585) but the behaviour is tested as accurate on real hardware. Reported-by: Deepika Dhamija <deepika@xilinx.com> Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 7e3f26fc4ab244e8123efc12723e7164730abdcb.1386136219.git.peter.crosthwaite@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* net/cadence_gem: Implement RX descriptor match mode flagsPeter Crosthwaite2013-12-101-13/+69
| | | | | | | | | | The various Rx packet address matching mode flags were not being set in the rx descriptor. Implement. Reported-by: Deepika Dhamija <deepika@xilinx.com> Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Message-id: 6002a24a6a8ceaa11d3009ab5392840d1c084b28.1386136219.git.peter.crosthwaite@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* net/cadence_gem: Prefetch rx descriptors ASAPPeter Crosthwaite2013-12-101-27/+35
| | | | | | | | | | | The real hardware prefetches rx buffer descriptors ASAP and potentially throws relevant interrupts following the fetch even in the absence of a received packet. Reported-by: Deepika Dhamija <deepika@xilinx.com> Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Message-id: 41629e35edfdb1f02f1e401f2c3d0e2e4c9e44b3.1386136219.git.peter.crosthwaite@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* net/cadence_gem: simplify rx buf descriptor walkingPeter Crosthwaite2013-12-101-28/+9Star
| | | | | | | | | | There was a replication of the rx descriptor address walking logic. Reorder the flow control to remove. This refactoring also obsoletes the local variables packet_desc_addr and last_desc_addr. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Message-id: 2a425b457ff0b57274bf206ad2236690cd7f5909.1386136219.git.peter.crosthwaite@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* net/cadence_gem: Don't assert against 0 buffer addressPeter Crosthwaite2013-12-101-9/+0Star
| | | | | | | | | This has no real hardware analog and asserting correctness of DMA addresses is not a perhiperal level problem. Delete. Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Message-id: fc02417eb1874cb05e4f20531c6203c5a00110f1.1386136219.git.peter.crosthwaite@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* net/cadence_gem: Update DMA rx descriptors as we process themEdgar E. Iglesias2013-12-101-17/+16Star
| | | | | | | | | | | We were updating the ownership bit of all descriptors if packets get split and written through several descriptors. Signed-off-by: Edgar E. Iglesias <edgar.iglesias@xilinx.com> Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: d61b7847b51487118783c93765a485bc5c66d272.1386136219.git.peter.crosthwaite@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* net/cadence_gem: Implement mac level loopback modePeter Crosthwaite2013-12-101-1/+1
| | | | | | | | | | | Cadence GEM has a MAC level loopback mode. Implement. Use the same basic operation as the already implemented PHY loopback. Reported-by: Deepika Dhamija <deepika@xilinx.com> Signed-off-by: Peter Crosthwaite <peter.crosthwaite@xilinx.com> Reviewed-by: Peter Maydell <peter.maydell@linaro.org> Message-id: 3a0baf1b6b2fc1be638bdf1a37408ec38988e970.1386136219.git.peter.crosthwaite@xilinx.com Signed-off-by: Peter Maydell <peter.maydell@linaro.org>
* cadence_gem: QOM cast cleanupAndreas Färber2013-07-291-11/+15
| | | | Signed-off-by: Andreas Färber <afaerber@suse.de>
* hw/n*: pass owner to memory_region_init* functionsPaolo Bonzini2013-07-041-1/+2
| | | | Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* memory: add owner argument to initialization functionsPaolo Bonzini2013-07-041-1/+1
| | | | Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
* hw: move target-independent files to subdirectoriesPaolo Bonzini2013-04-081-0/+1219
This patch tackles all files that are compiled once, moving them to subdirectories of hw/. Signed-off-by: Paolo Bonzini <pbonzini@redhat.com>
generated by cgit v1.2.3-55-g7522 (git 2.39.0) at 2025-01-16 00:57:11 +0100