[Qemu-devel] [PATCH v5 18/24] hw/arm: add Faraday FTGMAC100 1Gbps ethernet support

[Kuo-Jung Su]

From: Kuo-Jung Su <address@hidden>

The FTGMAC100 Ethernet controller has a DMA engine which handles
all data transfers between the system memory and on-chip memories.
Its DMA engine supports both 16-bits and 32-bits alignment,
and thus make it possible to support zero-copy transfer at both
Linux and WINCE.

It also has 802.1Q VLAN tagging support for both insertion and removal.

Signed-off-by: Kuo-Jung Su <address@hidden>
---
 hw/arm/Makefile.objs      |    1 +
 hw/arm/faraday.h          |    3 +
 hw/arm/faraday_a369_soc.c |   10 +
 hw/arm/ftgmac100.c        |  698 +++++++++++++++++++++++++++++++++++++++++++++
 hw/arm/ftgmac100.h        |  237 +++++++++++++++
 5 files changed, 949 insertions(+)
 create mode 100644 hw/arm/ftgmac100.c
 create mode 100644 hw/arm/ftgmac100.h

diff --git a/hw/arm/Makefile.objs b/hw/arm/Makefile.objs
index b27ae4a..154e2ea 100644
--- a/hw/arm/Makefile.objs
+++ b/hw/arm/Makefile.objs
@@ -48,3 +48,4 @@ obj-y += ftapbbrg020.o
 obj-y += ftnandc021.o
 obj-y += fti2c010.o
 obj-y += ftssp010.o
+obj-y += ftgmac100.o
diff --git a/hw/arm/faraday.h b/hw/arm/faraday.h
index fb61297..a77a5c5 100644
--- a/hw/arm/faraday.h
+++ b/hw/arm/faraday.h
@@ -68,4 +68,7 @@ qemu_irq *ftintc020_init(hwaddr base, ARMCPU *cpu);
 /* ftssp010.c */
 void ftssp010_i2s_data_req(void *opaque, int tx, int rx);
 
+/* ftgmac100.c */
+void ftgmac100_init(NICInfo *nd, uint32_t base, qemu_irq irq);
+
 #endif
diff --git a/hw/arm/faraday_a369_soc.c b/hw/arm/faraday_a369_soc.c
index fd0c98c..d31049e 100644
--- a/hw/arm/faraday_a369_soc.c
+++ b/hw/arm/faraday_a369_soc.c
@@ -94,6 +94,7 @@ a369soc_device_init(FaradaySoCState *s)
     DeviceState *ds;
     qemu_irq *pic;
     qemu_irq ack, req;
+    int i, done_nic = 0;
 
     s->as = get_system_memory();
     s->ram = g_new(MemoryRegion, 1);
@@ -242,6 +243,15 @@ a369soc_device_init(FaradaySoCState *s)
     req = qdev_get_gpio_in(s->pdma[0], 8);
     qdev_connect_gpio_out(s->pdma[0], 8, ack);
     qdev_connect_gpio_out(ds, 1, req);
+
+    /* ftgmac100 */
+    for (i = 0; i < nb_nics; i++) {
+        NICInfo *nd = &nd_table[i];
+        if (!done_nic && (!nd->model || strcmp(nd->model, "ftgmac100") == 0)) {
+            ftgmac100_init(nd, 0x90c00000, pic[32]);
+            done_nic = 1;
+        }
+    }
 }
 
 static int a369soc_init(SysBusDevice *busdev)
diff --git a/hw/arm/ftgmac100.c b/hw/arm/ftgmac100.c
new file mode 100644
index 0000000..8d3a48e
--- /dev/null
+++ b/hw/arm/ftgmac100.c
@@ -0,0 +1,698 @@
+/*
+ * QEMU model of the FTGMAC100 Controller
+ *
+ * Copyright (C) 2012 Faraday Technology
+ * Written by Dante Su <address@hidden>
+ *
+ * This file is licensed under GNU GPL v2+.
+ */
+
+#include "hw/sysbus.h"
+#include "qemu/bitrev.h"
+#include "qemu/timer.h"
+#include "sysemu/sysemu.h"
+#include "sysemu/dma.h"
+#include "net/net.h"
+
+#include "faraday.h"
+#include "ftgmac100.h"
+
+#define TYPE_FTGMAC100  "ftgmac100"
+
+#define CFG_MAXFRMLEN   9220    /* Max. frame length */
+#define CFG_REGSIZE     (0x100 / 4)
+
+typedef struct Ftgmac100State {
+    SysBusDevice busdev;
+    MemoryRegion mmio;
+
+    QEMUBH *bh;
+    qemu_irq irq;
+    NICState *nic;
+    NICConf conf;
+    DMAContext *dma;
+    QEMUTimer *qtimer;
+
+    bool phycr_rd;
+
+    struct {
+        uint8_t  buf[CFG_MAXFRMLEN];
+        uint32_t len;
+    } txbuff;
+
+    uint32_t hptx_idx;
+    uint32_t tx_idx;
+    uint32_t rx_idx;
+
+    /* HW register cache */
+    uint32_t regs[CFG_REGSIZE];
+} Ftgmac100State;
+
+#define FTGMAC100(obj) \
+    OBJECT_CHECK(Ftgmac100State, obj, TYPE_FTGMAC100)
+
+#define MAC_REG32(s, off) \
+    *(uint32_t *)((uint8_t *)(s)->regs + (off))
+
+static int ftgmac100_mcast_hash(Ftgmac100State *s, const uint8_t *data)
+{
+#define CRCPOLY_BE    0x04c11db7
+    int i, len;
+    uint32_t crc = 0xFFFFFFFF;
+
+    len = (MAC_REG32(s, REG_MACCR) & MACCR_GMODE) ? 5 : 6;
+
+    while (len--) {
+        uint32_t c = *(data++);
+        for (i = 0; i < 8; ++i) {
+            crc = (crc << 1) ^ ((((crc >> 31) ^ c) & 0x01) ? CRCPOLY_BE : 0);
+            c >>= 1;
+        }
+    }
+    crc = ~crc;
+
+    /* Reverse CRC32 and return MSB 6 bits only */
+    return bitrev8(crc >> 24) >> 2;
+}
+
+static void
+ftgmac100_read_txdesc(Ftgmac100State *s, hwaddr addr, Ftgmac100TXD *desc)
+{
+    int i;
+    uint32_t *p = (uint32_t *)desc;
+
+    if (addr & 0x0f) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                 "ftgmac100: Tx desc is not 16-byte aligned!\n"
+                 "It's fine in QEMU but the real HW would panic.\n");
+    }
+
+    dma_memory_read(s->dma, addr, desc, sizeof(*desc));
+
+    for (i = 0; i < sizeof(*desc); i += 4) {
+        *p = le32_to_cpu(*p);
+    }
+
+    if (desc->buf & 0x01) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                 "ftgmac100: tx buffer is not 16-bit aligned!\n");
+    }
+}
+
+static void
+ftgmac100_write_txdesc(Ftgmac100State *s, hwaddr addr, Ftgmac100TXD *desc)
+{
+    int i;
+    uint32_t *p = (uint32_t *)desc;
+
+    for (i = 0; i < sizeof(*desc); i += 4) {
+        *p = cpu_to_le32(*p);
+    }
+
+    dma_memory_write(s->dma, addr, desc, sizeof(*desc));
+}
+
+static void
+ftgmac100_read_rxdesc(Ftgmac100State *s, hwaddr addr, Ftgmac100RXD *desc)
+{
+    int i;
+    uint32_t *p = (uint32_t *)desc;
+
+    if (addr & 0x0f) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                 "ftgmac100: Rx desc is not 16-byte aligned!\n"
+                 "It's fine in QEMU but the real HW would panic.\n");
+    }
+
+    dma_memory_read(s->dma, addr, desc, sizeof(*desc));
+
+    for (i = 0; i < sizeof(*desc); i += 4) {
+        *p = le32_to_cpu(*p);
+    }
+
+    if (desc->buf & 0x01) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                 "ftgmac100: rx buffer is not 16-bit aligned!\n");
+    }
+}
+
+static void
+ftgmac100_write_rxdesc(Ftgmac100State *s, hwaddr addr, Ftgmac100RXD *desc)
+{
+    int i;
+    uint32_t *p = (uint32_t *)desc;
+
+    for (i = 0; i < sizeof(*desc); i += 4) {
+        *p = cpu_to_le32(*p);
+    }
+
+    dma_memory_write(s->dma, addr, desc, sizeof(*desc));
+}
+
+static void ftgmac100_update_irq(Ftgmac100State *s)
+{
+    qemu_set_irq(s->irq, !!(MAC_REG32(s, REG_ISR) & MAC_REG32(s, REG_IMR)));
+}
+
+static int ftgmac100_can_receive(NetClientState *nc)
+{
+    int ret = 0;
+    uint32_t val;
+    Ftgmac100State *s = qemu_get_nic_opaque(nc);
+    Ftgmac100RXD rxd;
+    hwaddr off = MAC_REG32(s, REG_RXBAR) + s->rx_idx * sizeof(rxd);
+
+    val = MAC_REG32(s, REG_MACCR);
+    if ((val & MACCR_RCV_EN) && (val & MACCR_RDMA_EN)) {
+        ftgmac100_read_rxdesc(s, off, &rxd);
+        ret = !rxd.owner;
+        if (!ret) {
+            qemu_mod_timer(s->qtimer, qemu_get_clock_ms(rt_clock) + 10);
+        }
+    }
+
+    return ret;
+}
+
+static ssize_t ftgmac100_receive(NetClientState *nc,
+                                 const uint8_t  *buf,
+                                 size_t          size)
+{
+    const uint8_t *ptr = buf;
+    hwaddr off;
+    size_t len;
+    Ftgmac100RXD rxd;
+    Ftgmac100State *s = qemu_get_nic_opaque(nc);
+    int bcst, mcst, ftl, proto;
+
+    MAC_REG32(s, REG_RXPKT) += 1;
+
+    /*
+     * Check if it's a long frame. (CRC32 is excluded)
+     */
+    ftl = 0;
+    proto = (buf[12] << 8) | buf[13];
+    if (MAC_REG32(s, REG_MACCR) & MACCR_JUMBO_LF) {
+        if (proto == 0x8100) {  /* 802.1Q VLAN */
+            ftl = (size > 9216) ? 1 : 0;
+        } else {
+            ftl = (size > 9212) ? 1 : 0;
+        }
+    } else {
+        if (proto == 0x8100) {  /* 802.1Q VLAN */
+            ftl = (size > 1518) ? 1 : 0;
+        } else {
+            ftl = (size > 1514) ? 1 : 0;
+        }
+    }
+    if (ftl) {
+        MAC_REG32(s, REG_RXCRCFTL) = (MAC_REG32(s, REG_RXCRCFTL) + 1) & 0xffff;
+        DPRINTF("ftgmac100_receive: frame too long, drop it\n");
+        return -1;
+    }
+
+    /* if it's a broadcast */
+    if ((buf[0] == 0xff) && (buf[1] == 0xff) && (buf[2] == 0xff)
+            && (buf[3] == 0xff) && (buf[4] == 0xff) && (buf[5] == 0xff)) {
+        bcst = 1;
+        MAC_REG32(s, REG_RXBCST) += 1;
+        if (!(MAC_REG32(s, REG_MACCR) & MACCR_RCV_ALL)
+            && !(MAC_REG32(s, REG_MACCR) & MACCR_RX_BROADPKT)) {
+            DPRINTF("ftgmac100_receive: bcst filtered\n");
+            return -1;
+        }
+    } else {
+        bcst = 0;
+    }
+
+    /* if it's a multicast */
+    if ((buf[0] == 0x01) && (buf[1] == 0x00) && (buf[2] == 0x5e)
+        && (buf[3] <= 0x7f)) {
+        mcst = 1;
+        MAC_REG32(s, REG_RXMCST) += 1;
+        if (!(MAC_REG32(s, REG_MACCR) & MACCR_RCV_ALL)
+            && !(MAC_REG32(s, REG_MACCR) & MACCR_RX_MULTIPKT)) {
+            int hash, id;
+            if (!(MAC_REG32(s, REG_MACCR) & MACCR_HT_MULTI_EN)) {
+                DPRINTF("ftgmac100_receive: mcst filtered\n");
+                return -1;
+            }
+            hash = ftgmac100_mcast_hash(s, buf);
+            id = (hash >= 32) ? 1 : 0;
+            if (!(MAC_REG32(s, REG_MHASH0 + id * 4) & BIT(hash % 32))) {
+                DPRINTF("ftgmac100_receive: mcst filtered\n");
+                return -1;
+            }
+        }
+    } else {
+        mcst = 0;
+    }
+
+    /* check if the destination matches NIC mac address */
+    if (!(MAC_REG32(s, REG_MACCR) & MACCR_RCV_ALL) && !bcst && !mcst) {
+        if (memcmp(s->conf.macaddr.a, buf, 6)) {
+            return -1;
+        }
+    }
+
+    while (size > 0) {
+        off = MAC_REG32(s, REG_RXBAR) + s->rx_idx * sizeof(rxd);
+        ftgmac100_read_rxdesc(s, off, &rxd);
+        if (rxd.owner) {
+            MAC_REG32(s, REG_ISR) |= ISR_NORXBUF;
+            DPRINTF("ftgmac100: out of rxd!?\n");
+            return -1;
+        }
+        len = size > rxd.len ? rxd.len : size;
+        rxd.frs = (ptr == buf) ? 1 : 0;
+
+        if (rxd.frs && proto == 0x8100 && len >= 18) {
+            rxd.vlan = 1;
+            rxd.vlantag = (buf[14] << 8) | buf[15];
+            if (MAC_REG32(s, REG_MACCR) & MACCR_VLAN_RM) {
+                /* copy src/dst mac address */
+                dma_memory_write(s->dma, rxd.buf, ptr, 12);
+                /* copy proto + payload, the VLAN tag is ignored */
+                dma_memory_write(s->dma, rxd.buf + 12, ptr + 16, len - 16);
+            } else {
+                dma_memory_write(s->dma, rxd.buf, ptr, len);
+            }
+        } else {
+            rxd.vlan = 0;
+            rxd.vlantag = 0;
+            dma_memory_write(s->dma, rxd.buf, ptr, len);
+        }
+        ptr  += len;
+        size -= len;
+
+        rxd.lrs = (size <= 0) ? 1 : 0;
+        rxd.len = len;
+        rxd.bcast = bcst;
+        rxd.mcast = mcst;
+        rxd.owner = 1;
+
+        /* write-back the rx descriptor */
+        ftgmac100_write_rxdesc(s, off, &rxd);
+
+        if (rxd.end) {
+            s->rx_idx = 0;
+        } else {
+            s->rx_idx += 1;
+        }
+    }
+
+    /* update interrupt signal */
+    MAC_REG32(s, REG_ISR) |= ISR_RPKT_OK | ISR_RPKT_FINISH;
+    ftgmac100_update_irq(s);
+
+    return (ssize_t)((uint32_t)ptr - (uint32_t)buf);
+}
+
+static void
+ftgmac100_transmit(Ftgmac100State *s, uint32_t bar, uint32_t *idx)
+{
+    hwaddr off;
+    uint8_t *buf;
+    int ftl, proto;
+    Ftgmac100TXD txd;
+
+    if ((MAC_REG32(s, REG_MACCR) & (MACCR_XMT_EN | MACCR_XDMA_EN))
+            != (MACCR_XMT_EN | MACCR_XDMA_EN)) {
+        return;
+    }
+
+    do {
+        off = bar + (*idx) * sizeof(txd);
+        ftgmac100_read_txdesc(s, off, &txd);
+        if (!txd.owner) {
+            MAC_REG32(s, REG_ISR) |= ISR_NOTXBUF;
+            break;
+        }
+        if (txd.fts) {
+            s->txbuff.len = 0;
+        }
+        if (txd.len + s->txbuff.len > sizeof(s->txbuff.buf)) {
+            hw_error("ftgmac100: tx buffer overflow!\n");
+            exit(1);
+        }
+        buf = s->txbuff.buf + s->txbuff.len;
+        dma_memory_read(s->dma, txd.buf, (uint8_t *)buf, txd.len);
+        s->txbuff.len += txd.len;
+        proto = (s->txbuff.buf[12] << 8) | s->txbuff.buf[13];
+        /* Insert VLAN Tag */
+        if (txd.fts && txd.vlan && proto != 0x8100) {
+            if (s->txbuff.len + 4 > sizeof(s->txbuff.buf)) {
+                hw_error("ftgmac100: tx buffer overflow!\n");
+                exit(1);
+            }
+            memmove(s->txbuff.buf + 16,
+                    s->txbuff.buf + 12,
+                    s->txbuff.len - 12);
+            s->txbuff.buf[12] = 0x81;
+            s->txbuff.buf[13] = 0x00;
+            s->txbuff.buf[14] = (uint8_t)(txd.vlantag >> 8);
+            s->txbuff.buf[15] = (uint8_t)(txd.vlantag >> 0);
+            s->txbuff.len += 4;
+            proto = 0x8100;
+        }
+        /* Check if it's a long frame. (CRC32 is excluded) */
+        if (MAC_REG32(s, REG_MACCR) & MACCR_JUMBO_LF) {
+            if (proto == 0x8100) {
+                ftl = (s->txbuff.len > 9216) ? 1 : 0;
+            } else {
+                ftl = (s->txbuff.len > 9212) ? 1 : 0;
+            }
+        } else {
+            if (proto == 0x8100) {
+                ftl = (s->txbuff.len > 1518) ? 1 : 0;
+            } else {
+                ftl = (s->txbuff.len > 1514) ? 1 : 0;
+            }
+        }
+        if (ftl) {
+            hw_error("ftgmac100_transmit: frame too long\n");
+            exit(1);
+        }
+        if (txd.lts) {
+            MAC_REG32(s, REG_TXPKT) += 1;
+            if (MAC_REG32(s, REG_MACCR) & MACCR_LOOP_EN) {
+                ftgmac100_receive(qemu_get_queue(s->nic),
+                                  s->txbuff.buf,
+                                  s->txbuff.len);
+            } else {
+                qemu_send_packet(qemu_get_queue(s->nic),
+                                 s->txbuff.buf,
+                                 s->txbuff.len);
+            }
+        }
+        if (txd.end) {
+            *idx = 0;
+        } else {
+            *idx += 1;
+        }
+        if (txd.tx2fic) {
+            MAC_REG32(s, REG_ISR) |= ISR_XPKT_OK;
+        }
+        if (txd.txic) {
+            MAC_REG32(s, REG_ISR) |= ISR_XPKT_FINISH;
+        }
+        txd.owner = 0;
+        ftgmac100_write_txdesc(s, off, &txd);
+    } while (1);
+}
+
+static void ftgmac100_bh(void *opaque)
+{
+    Ftgmac100State *s = FTGMAC100(opaque);
+
+    /* 1. process high priority tx ring */
+    if (MAC_REG32(s, REG_HPTXBAR)
+        && (MAC_REG32(s, REG_MACCR) & MACCR_HPTXR_EN)) {
+        ftgmac100_transmit(s, MAC_REG32(s, REG_HPTXBAR), &s->hptx_idx);
+    }
+
+    /* 2. process normal priority tx ring */
+    if (MAC_REG32(s, REG_TXBAR)) {
+        ftgmac100_transmit(s, MAC_REG32(s, REG_TXBAR), &s->tx_idx);
+    }
+
+    /* 3. update interrupt signal */
+    ftgmac100_update_irq(s);
+}
+
+static void ftgmac100_chip_reset(Ftgmac100State *s)
+{
+    s->phycr_rd = false;
+    s->txbuff.len = 0;
+    s->hptx_idx = 0;
+    s->tx_idx = 0;
+    s->rx_idx = 0;
+    memset(s->regs, 0, sizeof(s->regs));
+
+    MAC_REG32(s, REG_APTC) = 0x00000001; /* timing control */
+    MAC_REG32(s, REG_DBLAC) = 0x00022f72; /* dma burst, arbitration */
+    MAC_REG32(s, REG_DMAFIFO) = 0x0c000000; /* tx/rx fifo empty */
+    MAC_REG32(s, REG_REVR) = 0x00000600; /* rev. = 0.6.0 */
+    MAC_REG32(s, REG_FEAR) = 0x0000001b; /* fifo = 16KB */
+    MAC_REG32(s, REG_TPAFCR) = 0x000000f1; /* tx priority, arbitration */
+    MAC_REG32(s, REG_RBSR) = 0x00000640; /* rx buffer size */
+
+    if (s->bh) {
+        qemu_bh_cancel(s->bh);
+    }
+
+    if (s->qtimer) {
+        qemu_del_timer(s->qtimer);
+    }
+
+    ftgmac100_update_irq(s);
+}
+
+static uint64_t
+ftgmac100_mem_read(void *opaque, hwaddr addr, unsigned size)
+{
+    Ftgmac100State *s = FTGMAC100(opaque);
+    uint32_t dev, reg, ret = 0;
+
+    if (addr > REG_RXNOBCOL) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "ftgmac100: undefined memory address@hidden", addr);
+        return ret;
+    }
+
+    switch (addr) {
+    case REG_HMAC:
+        ret = s->conf.macaddr.a[1] | (s->conf.macaddr.a[0] << 8);
+        break;
+    case REG_LMAC:
+        ret = s->conf.macaddr.a[5] | (s->conf.macaddr.a[4] << 8)
+            | (s->conf.macaddr.a[3] << 16) | (s->conf.macaddr.a[2] << 24);
+        break;
+    case REG_PHYDR:
+        dev = extract32(MAC_REG32(s, REG_PHYCR), 16, 5);
+        reg = extract32(MAC_REG32(s, REG_PHYCR), 21, 5);
+        /* Emulating a Marvell 88E1111 with 1Gbps link state */
+        if (!dev && s->phycr_rd) {
+            switch (reg) {
+            case 0:    /* PHY control register */
+                return 0x1140 << 16;
+            case 1:    /* PHY status register */
+                return 0x796d << 16;
+            case 2:    /* PHY ID 1 register */
+                return 0x0141 << 16;
+            case 3:    /* PHY ID 2 register */
+                return 0x0cc2 << 16;
+            case 4:    /* Autonegotiation advertisement register */
+                return 0x0de1 << 16;
+            case 5:    /* Autonegotiation partner abilities register */
+                return 0x45e1 << 16;
+            case 17:/* Marvell 88E1111 */
+                ret = (2 << 14) | (1 << 13) | (1 << 11) | (1 << 10);
+                return ret << 16;
+            }
+        }
+        break;
+    case REG_RXPTR:
+        ret = s->rx_idx;
+        break;
+    case REG_TXPTR:
+        ret = s->tx_idx;
+        break;
+    case REG_HPTXPTR:
+        ret = s->hptx_idx;
+        break;
+    default:
+        ret = s->regs[addr / 4];
+        break;
+    }
+
+    return ret;
+}
+
+static void
+ftgmac100_mem_write(void *opaque, hwaddr addr, uint64_t val, unsigned size)
+{
+    Ftgmac100State *s = FTGMAC100(opaque);
+
+    if (addr >= REG_TXPTR) {
+        qemu_log_mask(LOG_GUEST_ERROR,
+                      "ftgmac100: undefined memory address@hidden", addr);
+        return;
+    }
+
+    switch (addr) {
+    case REG_ISR:
+        MAC_REG32(s, REG_ISR) &= ~((uint32_t)val);
+        ftgmac100_update_irq(s);
+        break;
+    case REG_IMR:
+        MAC_REG32(s, REG_IMR) = (uint32_t)val;
+        ftgmac100_update_irq(s);
+        break;
+    case REG_HMAC:
+        s->conf.macaddr.a[1] = extract32((uint32_t)val, 0, 8);
+        s->conf.macaddr.a[0] = extract32((uint32_t)val, 8, 8);
+        break;
+    case REG_LMAC:
+        s->conf.macaddr.a[5] = extract32((uint32_t)val, 0, 8);
+        s->conf.macaddr.a[4] = extract32((uint32_t)val, 8, 8);
+        s->conf.macaddr.a[3] = extract32((uint32_t)val, 16, 8);
+        s->conf.macaddr.a[2] = extract32((uint32_t)val, 24, 8);
+        break;
+    case REG_MACCR:
+        MAC_REG32(s, REG_MACCR) = (uint32_t)val;
+        if (val & MACCR_SW_RST) {
+            ftgmac100_chip_reset(s);
+            MAC_REG32(s, REG_MACCR) &= ~MACCR_SW_RST;
+        }
+        if ((val & MACCR_RCV_EN) && (val & MACCR_RDMA_EN)) {
+            if (ftgmac100_can_receive(qemu_get_queue(s->nic))) {
+                qemu_flush_queued_packets(qemu_get_queue(s->nic));
+            }
+        } else {
+            qemu_del_timer(s->qtimer);
+        }
+        break;
+    case REG_MACSR:
+        MAC_REG32(s, REG_MACSR) &= ~((uint32_t)val);
+        break;
+    case REG_PHYCR:
+        s->phycr_rd = (val & PHYCR_MDIORD) ? true : false;
+        MAC_REG32(s, REG_PHYCR) = (uint32_t)val
+                                & (~(PHYCR_MDIOWR | PHYCR_MDIORD));
+        break;
+    case REG_TXPD:
+    case REG_HPTXPD:
+        qemu_bh_schedule(s->bh);
+        break;
+    case REG_RXPD:
+    case REG_DMAFIFO:
+    case REG_REVR:
+    case REG_FEAR:
+        break;
+    default:
+        s->regs[addr / 4] = (uint32_t)val;
+        break;
+    }
+}
+
+static const MemoryRegionOps mmio_ops = {
+    .read  = ftgmac100_mem_read,
+    .write = ftgmac100_mem_write,
+    .endianness = DEVICE_LITTLE_ENDIAN,
+    .valid = {
+        .min_access_size = 4,
+        .max_access_size = 4
+    }
+};
+
+static void ftgmac100_cleanup(NetClientState *nc)
+{
+    Ftgmac100State *s = qemu_get_nic_opaque(nc);
+
+    s->nic = NULL;
+}
+
+static NetClientInfo net_ftgmac100_info = {
+    .type = NET_CLIENT_OPTIONS_KIND_NIC,
+    .size = sizeof(NICState),
+    .can_receive = ftgmac100_can_receive,
+    .receive = ftgmac100_receive,
+    .cleanup = ftgmac100_cleanup,
+};
+
+static void ftgmac100_reset(DeviceState *ds)
+{
+    SysBusDevice *busdev = SYS_BUS_DEVICE(ds);
+    Ftgmac100State *s = FTGMAC100(FROM_SYSBUS(Ftgmac100State, busdev));
+
+    ftgmac100_chip_reset(s);
+}
+
+static void ftgmac100_watchdog(void *opaque)
+{
+    Ftgmac100State *s = FTGMAC100(opaque);
+
+    if (ftgmac100_can_receive(qemu_get_queue(s->nic))) {
+        qemu_flush_queued_packets(qemu_get_queue(s->nic));
+    }
+}
+
+static int ftgmac100_init1(SysBusDevice *dev)
+{
+    Ftgmac100State *s = FTGMAC100(FROM_SYSBUS(Ftgmac100State, dev));
+
+    memory_region_init_io(&s->mmio, &mmio_ops, s, TYPE_FTGMAC100, 0x1000);
+    sysbus_init_mmio(dev, &s->mmio);
+    sysbus_init_irq(dev, &s->irq);
+
+    qemu_macaddr_default_if_unset(&s->conf.macaddr);
+    s->nic = qemu_new_nic(&net_ftgmac100_info, &s->conf,
+                          object_get_typename(OBJECT(dev)), dev->qdev.id, s);
+    qemu_format_nic_info_str(qemu_get_queue(s->nic), s->conf.macaddr.a);
+
+    s->qtimer = qemu_new_timer_ms(rt_clock, ftgmac100_watchdog, s);
+    s->dma = &dma_context_memory;
+    s->bh = qemu_bh_new(ftgmac100_bh, s);
+
+    ftgmac100_chip_reset(s);
+
+    return 0;
+}
+
+static const VMStateDescription vmstate_ftgmac100 = {
+    .name = TYPE_FTGMAC100,
+    .version_id = 1,
+    .minimum_version_id = 1,
+    .minimum_version_id_old = 1,
+    .fields = (VMStateField[]) {
+        VMSTATE_UINT32_ARRAY(regs, Ftgmac100State, CFG_REGSIZE),
+        VMSTATE_END_OF_LIST()
+    }
+};
+
+static Property ftgmac100_properties[] = {
+    DEFINE_NIC_PROPERTIES(Ftgmac100State, conf),
+    DEFINE_PROP_END_OF_LIST(),
+};
+
+static void ftgmac100_class_init(ObjectClass *klass, void *data)
+{
+    DeviceClass *dc = DEVICE_CLASS(klass);
+    SysBusDeviceClass *k = SYS_BUS_DEVICE_CLASS(klass);
+
+    k->init   = ftgmac100_init1;
+    dc->reset = ftgmac100_reset;
+    dc->vmsd  = &vmstate_ftgmac100;
+    dc->props = ftgmac100_properties;
+}
+
+static const TypeInfo ftgmac100_info = {
+    .name           = TYPE_FTGMAC100,
+    .parent         = TYPE_SYS_BUS_DEVICE,
+    .instance_size  = sizeof(Ftgmac100State),
+    .class_init     = ftgmac100_class_init,
+};
+
+static void ftgmac100_register_types(void)
+{
+    type_register_static(&ftgmac100_info);
+}
+
+/* Legacy helper function.  Should go away when machine config files are
+   implemented.  */
+void ftgmac100_init(NICInfo *nd, uint32_t base, qemu_irq irq)
+{
+    DeviceState *dev;
+    SysBusDevice *s;
+
+    qemu_check_nic_model(nd, TYPE_FTGMAC100);
+    dev = qdev_create(NULL, TYPE_FTGMAC100);
+    qdev_set_nic_properties(dev, nd);
+    qdev_init_nofail(dev);
+    s = SYS_BUS_DEVICE(dev);
+    sysbus_mmio_map(s, 0, base);
+    sysbus_connect_irq(s, 0, irq);
+}
+
+type_init(ftgmac100_register_types)
diff --git a/hw/arm/ftgmac100.h b/hw/arm/ftgmac100.h
new file mode 100644
index 0000000..4030017
--- /dev/null
+++ b/hw/arm/ftgmac100.h
@@ -0,0 +1,237 @@
+/*
+ * QEMU model of the FTGMAC100 Controller
+ *
+ * Copyright (C) 2012 Faraday Technology
+ * Written by Dante Su <address@hidden>
+ *
+ * This file is licensed under GNU GPL v2+.
+ */
+
+#ifndef HW_ARM_FTGMAC100_H
+#define HW_ARM_FTGMAC100_H
+
+#define REG_ISR             0x00    /* interrupt status */
+#define REG_IMR             0x04    /* interrupt mask */
+#define REG_HMAC            0x08    /* mac address */
+#define REG_LMAC            0x0c
+#define REG_MHASH0          0x10    /* multicast hash table */
+#define REG_MHASH1          0x14
+#define REG_TXPD            0x18    /* kick tx dma */
+#define REG_RXPD            0x1c    /* kick rx dma */
+#define REG_TXBAR           0x20    /* tx list/ring base address */
+#define REG_RXBAR           0x24    /* rx list/ring base address */
+#define REG_HPTXPD          0x28    /* kick high priority tx dma */
+#define REG_HPTXBAR         0x2C    /* high priority tx list/ring base */
+#define REG_ITC             0x30    /* interrupt timer control */
+#define REG_APTC            0x34    /* auto polling timer control */
+#define REG_DBLAC           0x38    /* dma burst length, arbitration control */
+#define REG_DMAFIFO         0x3C    /* dma fifo */
+#define REG_REVR            0x40    /* revision */
+#define REG_FEAR            0x44    /* feature */
+#define REG_TPAFCR          0x48    /* tx priority arbitration&fifo control */
+#define REG_RBSR            0x4C    /* rx buffer size register */
+#define REG_MACCR           0x50    /* mac control register */
+#define REG_MACSR           0x54    /* mac status register */
+#define REG_TSTMODE         0x58    /* test mode register */
+#define REG_PHYCR           0x60    /* phy control register */
+#define REG_PHYDR           0x64    /* phy data register */
+#define REG_FCR             0x68    /* flow control register */
+#define REG_BPR             0x6c    /* back pressure register */
+#define REG_WOLCR           0x70    /* wake-on-lan control */
+#define REG_WOLSR           0x74    /* wake-on-lan status */
+#define REG_WFCRC           0x78    /* wake frame crc */
+#define REG_WFBM1           0x80    /* wake frame byte mask */
+#define REG_WFBM2           0x84
+#define REG_WFBM3           0x88
+#define REG_WFBM4           0x8c
+#define REG_TXPTR           0x90    /* tx pointer */
+#define REG_HPTXPTR         0x94    /* high priority tx pointer */
+#define REG_RXPTR           0x98    /* rx pointer */
+#define REG_TXPKT           0xa0    /* tx counter */
+#define REG_TXERR0          0xa4    /* tx error */
+#define REG_TXERR1          0xa8
+#define REG_TXERR2          0xac
+#define REG_RXPKT           0xb0    /* rx counter */
+#define REG_RXBCST          0xb4    /* rx bcst counter */
+#define REG_RXMCST          0xb8    /* rx mcst counter */
+#define REG_RXRUNT          0xc0    /* rx err: runt */
+#define REG_RXCRCFTL        0xc4    /* rx err: BIT[31-16]#crc; BIT[15-0]#ftl */
+#define REG_RXNOBCOL        0xc8    /* rx err: BIT[31-16]#nob; BIT[15-0]#col */
+
+/* interrupt status register */
+#define ISR_NOHTXB          (1UL<<10)   /* out of high priority tx buffer */
+#define ISR_PHYSTS_CHG      (1UL<<9)    /* phy status change */
+#define ISR_AHB_ERR         (1UL<<8)    /* AHB error */
+#define ISR_XPKT_LOST       (1UL<<7)    /* tx packet lost */
+#define ISR_NOTXBUF         (1UL<<6)    /* out of tx buffer */
+#define ISR_XPKT_OK         (1UL<<5)    /* tx packet ok (fifo) */
+#define ISR_XPKT_FINISH     (1UL<<4)    /* tx packet finished (phy) */
+#define ISR_RPKT_LOST       (1UL<<3)    /* rx packet lost */
+#define ISR_NORXBUF         (1UL<<2)    /* out of rx buffer */
+#define ISR_RPKT_OK         (1UL<<1)    /* rx packet ok (fifo) */
+#define ISR_RPKT_FINISH     (1UL<<0)    /* rx packet finished (ram) */
+
+/* MAC control register */
+#define MACCR_SW_RST            (1UL<<31)   /* software reset */
+#define MACCR_100M              (1UL<<19)   /* 100Mbps */
+#define MACCR_CRC_DIS           (1UL<<18)   /* discard crc error */
+#define MACCR_RX_BROADPKT       (1UL<<17)   /* recv all broadcast packets */
+#define MACCR_RX_MULTIPKT       (1UL<<16)   /* recv all multicast packets */
+#define MACCR_HT_MULTI_EN       (1UL<<15)   /* recv multicast by hash */
+#define MACCR_RCV_ALL           (1UL<<14)   /* recv all packets */
+#define MACCR_JUMBO_LF          (1UL<<13)   /* support jumbo frame */
+#define MACCR_RX_RUNT           (1UL<<12)   /* recv runt packets */
+#define MACCR_CRC_APD           (1UL<<10)   /* crc append */
+#define MACCR_GMODE             (1UL<<9)    /* giga mode */
+#define MACCR_FULLDUP           (1UL<<8)    /* full duplex */
+#define MACCR_ENRX_IN_HALFTX    (1UL<<7)    /* rx while tx in half duplex */
+#define MACCR_LOOP_EN           (1UL<<6)    /* loopback */
+#define MACCR_HPTXR_EN          (1UL<<5)    /* high priority tx enabled */
+#define MACCR_VLAN_RM           (1UL<<4)    /* vlan removal enabled */
+#define MACCR_RCV_EN            (1UL<<3)    /* rx enabled */
+#define MACCR_XMT_EN            (1UL<<2)    /* tx enabled */
+#define MACCR_RDMA_EN           (1UL<<1)    /* rx dma enabled */
+#define MACCR_XDMA_EN           (1UL<<0)    /* tx dma enabled */
+
+/*
+ * MDIO
+ */
+#define PHYCR_MDIOWR            (1 << 27)   /* mdio write */
+#define PHYCR_MDIORD            (1 << 26)   /* mdio read */
+
+/*
+ * Tx/Rx Descriptors
+ */
+typedef struct Ftgmac100RXD {
+    /* RXDES0 */
+#ifdef HOST_WORDS_BIGENDIAN
+    uint32_t owner:1;   /* BIT31: owner - 1:SW, 0: HW */
+    uint32_t rsvd3:1;
+    uint32_t frs:1;     /* first rx segment */
+    uint32_t lrs:1;     /* last rx segment */
+    uint32_t rsvd2:2;
+    uint32_t pausefrm:1;/* pause frame received */
+    uint32_t pauseopc:1;/* pause frame OP code */
+    uint32_t fifofull:1;/* packet dropped due to FIFO full */
+    uint32_t oddnb:1;   /* odd nibbles */
+    uint32_t runt:1;    /* runt packet (< 64 bytes) */
+    uint32_t ftl:1;     /* frame too long */
+    uint32_t crcerr:1;  /* crc error */
+    uint32_t rxerr:1;   /* rx error */
+    uint32_t bcast:1;   /* broadcast */
+    uint32_t mcast:1;   /* multicast */
+    uint32_t end:1;     /* end of descriptor list/ring */
+    uint32_t rsvd1:1;
+    uint32_t len:14;    /* max./received packet length */
+#else
+    uint32_t len:14;
+    uint32_t rsvd1:1;
+    uint32_t end:1;
+    uint32_t mcast:1;
+    uint32_t bcast:1;
+    uint32_t rxerr:1;
+    uint32_t crcerr:1;
+    uint32_t ftl:1;
+    uint32_t runt:1;
+    uint32_t oddnb:1;
+    uint32_t fifofull:1;
+    uint32_t pauseopc:1;
+    uint32_t pausefrm:1;
+    uint32_t rsvd2:2;
+    uint32_t lrs:1;
+    uint32_t frs:1;
+    uint32_t rsvd3:1;
+    uint32_t owner:1;
+#endif  /* #ifdef HOST_WORDS_BIGENDIAN */
+
+    /* RXDES1 */
+#ifdef HOST_WORDS_BIGENDIAN
+    uint32_t rsvd5:4;
+    uint32_t ipcs:1;    /* IPv4 checksum failed */
+    uint32_t udpcs:1;   /* IPv4 UDP checksum failed */
+    uint32_t tcpcs:1;   /* IPv4 TCP checksum failed */
+    uint32_t vlan:1;    /* VLAN tag detected */
+    uint32_t nofrag:1;  /* Not Fragmented */
+    uint32_t llc:1;     /* LLC packet detected */
+    uint32_t proto:2;   /* Protocol Type */
+    uint32_t rsvd4:4;
+    uint32_t vlantag:16;/* VLAN tag */
+#else
+    uint32_t vlantag:16;
+    uint32_t rsvd4:4;
+    uint32_t proto:2;
+    uint32_t llc:1;
+    uint32_t nofrag:1;
+    uint32_t vlan:1;
+    uint32_t tcpcs:1;
+    uint32_t udpcs:1;
+    uint32_t ipcs:1;
+    uint32_t rsvd5:4;
+#endif  /* #ifdef HOST_WORDS_BIGENDIAN */
+
+    /* RXDES2 */
+    void    *skb;
+
+    /* RXDES3 */
+    uint32_t buf;
+} __attribute__ ((aligned (16))) Ftgmac100RXD;
+
+typedef struct Ftgmac100TXD {
+    /* TXDES0 */
+#ifdef HOST_WORDS_BIGENDIAN
+    uint32_t owner:1;   /* BIT31: owner - 1:HW, 0: SW */
+    uint32_t rsvd4:1;
+    uint32_t fts:1;     /* first tx segment */
+    uint32_t lts:1;     /* last tx segment */
+    uint32_t rsvd3:8;
+    uint32_t crcerr:1;  /* crc error */
+    uint32_t rsvd2:3;
+    uint32_t end:1;     /* end of descriptor list/ring */
+    uint32_t rsvd1:1;
+    uint32_t len:14;    /* packet length */
+#else
+    uint32_t len:14;
+    uint32_t rsvd1:1;
+    uint32_t end:1;
+    uint32_t rsvd2:3;
+    uint32_t crcerr:1;
+    uint32_t rsvd3:8;
+    uint32_t lts:1;
+    uint32_t fts:1;
+    uint32_t rsvd4:1;
+    uint32_t owner:1;
+#endif  /* #ifdef HOST_WORDS_BIGENDIAN */
+
+    /* TXDES1 */
+#ifdef HOST_WORDS_BIGENDIAN
+    uint32_t txic:1;        /* interrupt when data has been copied to phy */
+    uint32_t tx2fic:1;      /* interrupt when data has been copied to fifo */
+    uint32_t rsvd6:7;
+    uint32_t llc:1;         /* is a LLC packet */
+    uint32_t rsvd5:2;
+    uint32_t ipcs:1;        /* Enable IPv4 checksum offload */
+    uint32_t udpcs:1;       /* Enable IPv4 UDP checksum offload */
+    uint32_t tcpcs:1;       /* Enable IPv4 TCP checksum offload */
+    uint32_t vlan:1;        /* Enable VLAN tag insertion */
+    uint32_t vlantag:16;    /* VLAN tag */
+#else
+    uint32_t vlantag:16;
+    uint32_t vlan:1;
+    uint32_t tcpcs:1;
+    uint32_t udpcs:1;
+    uint32_t ipcs:1;
+    uint32_t rsvd5:2;
+    uint32_t llc:1;
+    uint32_t rsvd6:7;
+    uint32_t tx2fic:1;
+    uint32_t txic:1;
+#endif  /* #ifdef HOST_WORDS_BIGENDIAN */
+
+    /* TXDES2 */
+    void    *skb;
+
+    /* TXDES3 */
+    uint32_t buf;
+} __attribute__ ((aligned (16))) Ftgmac100TXD;
+
+#endif    /* #ifndef HW_ARM_FTGMAC100_H */
-- 
1.7.9.5