xref: /qemu/hw/net/spapr_llan.c (revision d1cb5eda)
1 /*
2  * QEMU PowerPC pSeries Logical Partition (aka sPAPR) hardware System Emulator
3  *
4  * PAPR Inter-VM Logical Lan, aka ibmveth
5  *
6  * Copyright (c) 2010,2011 David Gibson, IBM Corporation.
7  *
8  * Permission is hereby granted, free of charge, to any person obtaining a copy
9  * of this software and associated documentation files (the "Software"), to deal
10  * in the Software without restriction, including without limitation the rights
11  * to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
12  * copies of the Software, and to permit persons to whom the Software is
13  * furnished to do so, subject to the following conditions:
14  *
15  * The above copyright notice and this permission notice shall be included in
16  * all copies or substantial portions of the Software.
17  *
18  * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
19  * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
20  * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL
21  * THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
22  * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
23  * OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
24  * THE SOFTWARE.
25  *
26  */
27 
28 #include "qemu/osdep.h"
29 #include "cpu.h"
30 #include "qemu/log.h"
31 #include "qemu/module.h"
32 #include "net/net.h"
33 #include "migration/vmstate.h"
34 #include "hw/ppc/spapr.h"
35 #include "hw/ppc/spapr_vio.h"
36 #include "hw/qdev-properties.h"
37 #include "sysemu/sysemu.h"
38 #include "trace.h"
39 
40 #include <libfdt.h>
41 #include "qom/object.h"
42 
43 #define ETH_ALEN        6
44 #define MAX_PACKET_SIZE 65536
45 
46 /* Compatibility flags for migration */
47 #define SPAPRVLAN_FLAG_RX_BUF_POOLS_BIT  0
48 #define SPAPRVLAN_FLAG_RX_BUF_POOLS      (1 << SPAPRVLAN_FLAG_RX_BUF_POOLS_BIT)
49 
50 /*
51  * Virtual LAN device
52  */
53 
54 typedef uint64_t vlan_bd_t;
55 
56 #define VLAN_BD_VALID        0x8000000000000000ULL
57 #define VLAN_BD_TOGGLE       0x4000000000000000ULL
58 #define VLAN_BD_NO_CSUM      0x0200000000000000ULL
59 #define VLAN_BD_CSUM_GOOD    0x0100000000000000ULL
60 #define VLAN_BD_LEN_MASK     0x00ffffff00000000ULL
61 #define VLAN_BD_LEN(bd)      (((bd) & VLAN_BD_LEN_MASK) >> 32)
62 #define VLAN_BD_ADDR_MASK    0x00000000ffffffffULL
63 #define VLAN_BD_ADDR(bd)     ((bd) & VLAN_BD_ADDR_MASK)
64 
65 #define VLAN_VALID_BD(addr, len) (VLAN_BD_VALID | \
66                                   (((len) << 32) & VLAN_BD_LEN_MASK) |  \
67                                   (addr & VLAN_BD_ADDR_MASK))
68 
69 #define VLAN_RXQC_TOGGLE     0x80
70 #define VLAN_RXQC_VALID      0x40
71 #define VLAN_RXQC_NO_CSUM    0x02
72 #define VLAN_RXQC_CSUM_GOOD  0x01
73 
74 #define VLAN_RQ_ALIGNMENT    16
75 #define VLAN_RXQ_BD_OFF      0
76 #define VLAN_FILTER_BD_OFF   8
77 #define VLAN_RX_BDS_OFF      16
78 /*
79  * The final 8 bytes of the buffer list is a counter of frames dropped
80  * because there was not a buffer in the buffer list capable of holding
81  * the frame. We must avoid it, or the operating system will report garbage
82  * for this statistic.
83  */
84 #define VLAN_RX_BDS_LEN      (SPAPR_TCE_PAGE_SIZE - VLAN_RX_BDS_OFF - 8)
85 #define VLAN_MAX_BUFS        (VLAN_RX_BDS_LEN / 8)
86 
87 #define TYPE_VIO_SPAPR_VLAN_DEVICE "spapr-vlan"
88 typedef struct SpaprVioVlan SpaprVioVlan;
89 DECLARE_INSTANCE_CHECKER(SpaprVioVlan, VIO_SPAPR_VLAN_DEVICE,
90                          TYPE_VIO_SPAPR_VLAN_DEVICE)
91 
92 #define RX_POOL_MAX_BDS 4096
93 #define RX_MAX_POOLS 5
94 
95 typedef struct {
96     int32_t bufsize;
97     int32_t count;
98     vlan_bd_t bds[RX_POOL_MAX_BDS];
99 } RxBufPool;
100 
101 struct SpaprVioVlan {
102     SpaprVioDevice sdev;
103     NICConf nicconf;
104     NICState *nic;
105     MACAddr perm_mac;
106     bool isopen;
107     hwaddr buf_list;
108     uint32_t add_buf_ptr, use_buf_ptr, rx_bufs;
109     hwaddr rxq_ptr;
110     QEMUTimer *rxp_timer;
111     uint32_t compat_flags;             /* Compatibility flags for migration */
112     RxBufPool *rx_pool[RX_MAX_POOLS];  /* Receive buffer descriptor pools */
113 };
114 
115 static bool spapr_vlan_can_receive(NetClientState *nc)
116 {
117     SpaprVioVlan *dev = qemu_get_nic_opaque(nc);
118 
119     return dev->isopen && dev->rx_bufs > 0;
120 }
121 
122 /**
123  * The last 8 bytes of the receive buffer list page (that has been
124  * supplied by the guest with the H_REGISTER_LOGICAL_LAN call) contain
125  * a counter for frames that have been dropped because there was no
126  * suitable receive buffer available. This function is used to increase
127  * this counter by one.
128  */
129 static void spapr_vlan_record_dropped_rx_frame(SpaprVioVlan *dev)
130 {
131     uint64_t cnt;
132 
133     cnt = vio_ldq(&dev->sdev, dev->buf_list + 4096 - 8);
134     vio_stq(&dev->sdev, dev->buf_list + 4096 - 8, cnt + 1);
135 }
136 
137 /**
138  * Get buffer descriptor from one of our receive buffer pools
139  */
140 static vlan_bd_t spapr_vlan_get_rx_bd_from_pool(SpaprVioVlan *dev,
141                                                 size_t size)
142 {
143     vlan_bd_t bd;
144     int pool;
145 
146     for (pool = 0; pool < RX_MAX_POOLS; pool++) {
147         if (dev->rx_pool[pool]->count > 0 &&
148             dev->rx_pool[pool]->bufsize >= size + 8) {
149             break;
150         }
151     }
152     if (pool == RX_MAX_POOLS) {
153         /* Failed to find a suitable buffer */
154         return 0;
155     }
156 
157 
158     trace_spapr_vlan_get_rx_bd_from_pool_found(pool,
159                                                dev->rx_pool[pool]->count,
160                                                dev->rx_bufs);
161 
162     /* Remove the buffer from the pool */
163     dev->rx_pool[pool]->count--;
164     bd = dev->rx_pool[pool]->bds[dev->rx_pool[pool]->count];
165     dev->rx_pool[pool]->bds[dev->rx_pool[pool]->count] = 0;
166 
167     return bd;
168 }
169 
170 /**
171  * Get buffer descriptor from the receive buffer list page that has been
172  * supplied by the guest with the H_REGISTER_LOGICAL_LAN call
173  */
174 static vlan_bd_t spapr_vlan_get_rx_bd_from_page(SpaprVioVlan *dev,
175                                                 size_t size)
176 {
177     int buf_ptr = dev->use_buf_ptr;
178     vlan_bd_t bd;
179 
180     do {
181         buf_ptr += 8;
182         if (buf_ptr >= VLAN_RX_BDS_LEN + VLAN_RX_BDS_OFF) {
183             buf_ptr = VLAN_RX_BDS_OFF;
184         }
185 
186         bd = vio_ldq(&dev->sdev, dev->buf_list + buf_ptr);
187 
188         trace_spapr_vlan_get_rx_bd_from_page(buf_ptr, (uint64_t)bd);
189     } while ((!(bd & VLAN_BD_VALID) || VLAN_BD_LEN(bd) < size + 8)
190              && buf_ptr != dev->use_buf_ptr);
191 
192     if (!(bd & VLAN_BD_VALID) || VLAN_BD_LEN(bd) < size + 8) {
193         /* Failed to find a suitable buffer */
194         return 0;
195     }
196 
197     /* Remove the buffer from the pool */
198     dev->use_buf_ptr = buf_ptr;
199     vio_stq(&dev->sdev, dev->buf_list + dev->use_buf_ptr, 0);
200 
201     trace_spapr_vlan_get_rx_bd_from_page_found(dev->use_buf_ptr, dev->rx_bufs);
202 
203     return bd;
204 }
205 
206 static ssize_t spapr_vlan_receive(NetClientState *nc, const uint8_t *buf,
207                                   size_t size)
208 {
209     SpaprVioVlan *dev = qemu_get_nic_opaque(nc);
210     SpaprVioDevice *sdev = VIO_SPAPR_DEVICE(dev);
211     vlan_bd_t rxq_bd = vio_ldq(sdev, dev->buf_list + VLAN_RXQ_BD_OFF);
212     vlan_bd_t bd;
213     uint64_t handle;
214     uint8_t control;
215 
216     trace_spapr_vlan_receive(sdev->qdev.id, dev->rx_bufs);
217 
218     if (!dev->isopen) {
219         return -1;
220     }
221 
222     if (!dev->rx_bufs) {
223         spapr_vlan_record_dropped_rx_frame(dev);
224         return 0;
225     }
226 
227     if (dev->compat_flags & SPAPRVLAN_FLAG_RX_BUF_POOLS) {
228         bd = spapr_vlan_get_rx_bd_from_pool(dev, size);
229     } else {
230         bd = spapr_vlan_get_rx_bd_from_page(dev, size);
231     }
232     if (!bd) {
233         spapr_vlan_record_dropped_rx_frame(dev);
234         return 0;
235     }
236 
237     dev->rx_bufs--;
238 
239     /* Transfer the packet data */
240     if (spapr_vio_dma_write(sdev, VLAN_BD_ADDR(bd) + 8, buf, size) < 0) {
241         return -1;
242     }
243 
244     trace_spapr_vlan_receive_dma_completed();
245 
246     /* Update the receive queue */
247     control = VLAN_RXQC_TOGGLE | VLAN_RXQC_VALID;
248     if (rxq_bd & VLAN_BD_TOGGLE) {
249         control ^= VLAN_RXQC_TOGGLE;
250     }
251 
252     handle = vio_ldq(sdev, VLAN_BD_ADDR(bd));
253     vio_stq(sdev, VLAN_BD_ADDR(rxq_bd) + dev->rxq_ptr + 8, handle);
254     vio_stl(sdev, VLAN_BD_ADDR(rxq_bd) + dev->rxq_ptr + 4, size);
255     vio_sth(sdev, VLAN_BD_ADDR(rxq_bd) + dev->rxq_ptr + 2, 8);
256     vio_stb(sdev, VLAN_BD_ADDR(rxq_bd) + dev->rxq_ptr, control);
257 
258     trace_spapr_vlan_receive_wrote(dev->rxq_ptr,
259                                    vio_ldq(sdev, VLAN_BD_ADDR(rxq_bd) +
260                                                  dev->rxq_ptr),
261                                    vio_ldq(sdev, VLAN_BD_ADDR(rxq_bd) +
262                                                  dev->rxq_ptr + 8));
263 
264     dev->rxq_ptr += 16;
265     if (dev->rxq_ptr >= VLAN_BD_LEN(rxq_bd)) {
266         dev->rxq_ptr = 0;
267         vio_stq(sdev, dev->buf_list + VLAN_RXQ_BD_OFF, rxq_bd ^ VLAN_BD_TOGGLE);
268     }
269 
270     if (sdev->signal_state & 1) {
271         spapr_vio_irq_pulse(sdev);
272     }
273 
274     return size;
275 }
276 
277 static NetClientInfo net_spapr_vlan_info = {
278     .type = NET_CLIENT_DRIVER_NIC,
279     .size = sizeof(NICState),
280     .can_receive = spapr_vlan_can_receive,
281     .receive = spapr_vlan_receive,
282 };
283 
284 static void spapr_vlan_flush_rx_queue(void *opaque)
285 {
286     SpaprVioVlan *dev = opaque;
287 
288     qemu_flush_queued_packets(qemu_get_queue(dev->nic));
289 }
290 
291 static void spapr_vlan_reset_rx_pool(RxBufPool *rxp)
292 {
293     /*
294      * Use INT_MAX as bufsize so that unused buffers are moved to the end
295      * of the list during the qsort in spapr_vlan_add_rxbuf_to_pool() later.
296      */
297     rxp->bufsize = INT_MAX;
298     rxp->count = 0;
299     memset(rxp->bds, 0, sizeof(rxp->bds));
300 }
301 
302 static void spapr_vlan_reset(SpaprVioDevice *sdev)
303 {
304     SpaprVioVlan *dev = VIO_SPAPR_VLAN_DEVICE(sdev);
305     int i;
306 
307     dev->buf_list = 0;
308     dev->rx_bufs = 0;
309     dev->isopen = 0;
310 
311     if (dev->compat_flags & SPAPRVLAN_FLAG_RX_BUF_POOLS) {
312         for (i = 0; i < RX_MAX_POOLS; i++) {
313             spapr_vlan_reset_rx_pool(dev->rx_pool[i]);
314         }
315     }
316 
317     memcpy(&dev->nicconf.macaddr.a, &dev->perm_mac.a,
318            sizeof(dev->nicconf.macaddr.a));
319     qemu_format_nic_info_str(qemu_get_queue(dev->nic), dev->nicconf.macaddr.a);
320 }
321 
322 static void spapr_vlan_realize(SpaprVioDevice *sdev, Error **errp)
323 {
324     SpaprVioVlan *dev = VIO_SPAPR_VLAN_DEVICE(sdev);
325 
326     qemu_macaddr_default_if_unset(&dev->nicconf.macaddr);
327 
328     memcpy(&dev->perm_mac.a, &dev->nicconf.macaddr.a, sizeof(dev->perm_mac.a));
329 
330     dev->nic = qemu_new_nic(&net_spapr_vlan_info, &dev->nicconf,
331                             object_get_typename(OBJECT(sdev)), sdev->qdev.id, dev);
332     qemu_format_nic_info_str(qemu_get_queue(dev->nic), dev->nicconf.macaddr.a);
333 
334     dev->rxp_timer = timer_new_us(QEMU_CLOCK_VIRTUAL, spapr_vlan_flush_rx_queue,
335                                   dev);
336 }
337 
338 static void spapr_vlan_instance_init(Object *obj)
339 {
340     SpaprVioVlan *dev = VIO_SPAPR_VLAN_DEVICE(obj);
341     int i;
342 
343     device_add_bootindex_property(obj, &dev->nicconf.bootindex,
344                                   "bootindex", "",
345                                   DEVICE(dev));
346 
347     if (dev->compat_flags & SPAPRVLAN_FLAG_RX_BUF_POOLS) {
348         for (i = 0; i < RX_MAX_POOLS; i++) {
349             dev->rx_pool[i] = g_new(RxBufPool, 1);
350             spapr_vlan_reset_rx_pool(dev->rx_pool[i]);
351         }
352     }
353 }
354 
355 static void spapr_vlan_instance_finalize(Object *obj)
356 {
357     SpaprVioVlan *dev = VIO_SPAPR_VLAN_DEVICE(obj);
358     int i;
359 
360     if (dev->compat_flags & SPAPRVLAN_FLAG_RX_BUF_POOLS) {
361         for (i = 0; i < RX_MAX_POOLS; i++) {
362             g_free(dev->rx_pool[i]);
363             dev->rx_pool[i] = NULL;
364         }
365     }
366 
367     if (dev->rxp_timer) {
368         timer_del(dev->rxp_timer);
369         timer_free(dev->rxp_timer);
370     }
371 }
372 
373 void spapr_vlan_create(SpaprVioBus *bus, NICInfo *nd)
374 {
375     DeviceState *dev;
376 
377     dev = qdev_new("spapr-vlan");
378 
379     qdev_set_nic_properties(dev, nd);
380 
381     qdev_realize_and_unref(dev, &bus->bus, &error_fatal);
382 }
383 
384 static int spapr_vlan_devnode(SpaprVioDevice *dev, void *fdt, int node_off)
385 {
386     SpaprVioVlan *vdev = VIO_SPAPR_VLAN_DEVICE(dev);
387     uint8_t padded_mac[8] = {0, 0};
388     int ret;
389 
390     /* Some old phyp versions give the mac address in an 8-byte
391      * property.  The kernel driver (before 3.10) has an insane workaround;
392      * rather than doing the obvious thing and checking the property
393      * length, it checks whether the first byte has 0b10 in the low
394      * bits.  If a correct 6-byte property has a different first byte
395      * the kernel will get the wrong mac address, overrunning its
396      * buffer in the process (read only, thank goodness).
397      *
398      * Here we return a 6-byte address unless that would break a pre-3.10
399      * driver.  In that case we return a padded 8-byte address to allow the old
400      * workaround to succeed. */
401     if ((vdev->nicconf.macaddr.a[0] & 0x3) == 0x2) {
402         ret = fdt_setprop(fdt, node_off, "local-mac-address",
403                           &vdev->nicconf.macaddr, ETH_ALEN);
404     } else {
405         memcpy(&padded_mac[2], &vdev->nicconf.macaddr, ETH_ALEN);
406         ret = fdt_setprop(fdt, node_off, "local-mac-address",
407                           padded_mac, sizeof(padded_mac));
408     }
409     if (ret < 0) {
410         return ret;
411     }
412 
413     ret = fdt_setprop_cell(fdt, node_off, "ibm,mac-address-filters", 0);
414     if (ret < 0) {
415         return ret;
416     }
417 
418     return 0;
419 }
420 
421 static int check_bd(SpaprVioVlan *dev, vlan_bd_t bd,
422                     target_ulong alignment)
423 {
424     if ((VLAN_BD_ADDR(bd) % alignment)
425         || (VLAN_BD_LEN(bd) % alignment)) {
426         return -1;
427     }
428 
429     if (!spapr_vio_dma_valid(&dev->sdev, VLAN_BD_ADDR(bd),
430                              VLAN_BD_LEN(bd), DMA_DIRECTION_FROM_DEVICE)
431         || !spapr_vio_dma_valid(&dev->sdev, VLAN_BD_ADDR(bd),
432                                 VLAN_BD_LEN(bd), DMA_DIRECTION_TO_DEVICE)) {
433         return -1;
434     }
435 
436     return 0;
437 }
438 
439 static target_ulong h_register_logical_lan(PowerPCCPU *cpu,
440                                            SpaprMachineState *spapr,
441                                            target_ulong opcode,
442                                            target_ulong *args)
443 {
444     target_ulong reg = args[0];
445     target_ulong buf_list = args[1];
446     target_ulong rec_queue = args[2];
447     target_ulong filter_list = args[3];
448     SpaprVioDevice *sdev = spapr_vio_find_by_reg(spapr->vio_bus, reg);
449     SpaprVioVlan *dev = VIO_SPAPR_VLAN_DEVICE(sdev);
450     vlan_bd_t filter_list_bd;
451 
452     if (!dev) {
453         return H_PARAMETER;
454     }
455 
456     if (dev->isopen) {
457         hcall_dprintf("H_REGISTER_LOGICAL_LAN called twice without "
458                       "H_FREE_LOGICAL_LAN\n");
459         return H_RESOURCE;
460     }
461 
462     if (check_bd(dev, VLAN_VALID_BD(buf_list, SPAPR_TCE_PAGE_SIZE),
463                  SPAPR_TCE_PAGE_SIZE) < 0) {
464         hcall_dprintf("Bad buf_list 0x" TARGET_FMT_lx "\n", buf_list);
465         return H_PARAMETER;
466     }
467 
468     filter_list_bd = VLAN_VALID_BD(filter_list, SPAPR_TCE_PAGE_SIZE);
469     if (check_bd(dev, filter_list_bd, SPAPR_TCE_PAGE_SIZE) < 0) {
470         hcall_dprintf("Bad filter_list 0x" TARGET_FMT_lx "\n", filter_list);
471         return H_PARAMETER;
472     }
473 
474     if (!(rec_queue & VLAN_BD_VALID)
475         || (check_bd(dev, rec_queue, VLAN_RQ_ALIGNMENT) < 0)) {
476         hcall_dprintf("Bad receive queue\n");
477         return H_PARAMETER;
478     }
479 
480     dev->buf_list = buf_list;
481     sdev->signal_state = 0;
482 
483     rec_queue &= ~VLAN_BD_TOGGLE;
484 
485     /* Initialize the buffer list */
486     vio_stq(sdev, buf_list, rec_queue);
487     vio_stq(sdev, buf_list + 8, filter_list_bd);
488     spapr_vio_dma_set(sdev, buf_list + VLAN_RX_BDS_OFF, 0,
489                       SPAPR_TCE_PAGE_SIZE - VLAN_RX_BDS_OFF);
490     dev->add_buf_ptr = VLAN_RX_BDS_OFF - 8;
491     dev->use_buf_ptr = VLAN_RX_BDS_OFF - 8;
492     dev->rx_bufs = 0;
493     dev->rxq_ptr = 0;
494 
495     /* Initialize the receive queue */
496     spapr_vio_dma_set(sdev, VLAN_BD_ADDR(rec_queue), 0, VLAN_BD_LEN(rec_queue));
497 
498     dev->isopen = 1;
499     qemu_flush_queued_packets(qemu_get_queue(dev->nic));
500 
501     return H_SUCCESS;
502 }
503 
504 
505 static target_ulong h_free_logical_lan(PowerPCCPU *cpu,
506                                        SpaprMachineState *spapr,
507                                        target_ulong opcode, target_ulong *args)
508 {
509     target_ulong reg = args[0];
510     SpaprVioDevice *sdev = spapr_vio_find_by_reg(spapr->vio_bus, reg);
511     SpaprVioVlan *dev = VIO_SPAPR_VLAN_DEVICE(sdev);
512 
513     if (!dev) {
514         return H_PARAMETER;
515     }
516 
517     if (!dev->isopen) {
518         hcall_dprintf("H_FREE_LOGICAL_LAN called without "
519                       "H_REGISTER_LOGICAL_LAN\n");
520         return H_RESOURCE;
521     }
522 
523     spapr_vlan_reset(sdev);
524     return H_SUCCESS;
525 }
526 
527 /**
528  * Used for qsort, this function compares two RxBufPools by size.
529  */
530 static int rx_pool_size_compare(const void *p1, const void *p2)
531 {
532     const RxBufPool *pool1 = *(RxBufPool **)p1;
533     const RxBufPool *pool2 = *(RxBufPool **)p2;
534 
535     if (pool1->bufsize < pool2->bufsize) {
536         return -1;
537     }
538     return pool1->bufsize > pool2->bufsize;
539 }
540 
541 /**
542  * Search for a matching buffer pool with exact matching size,
543  * or return -1 if no matching pool has been found.
544  */
545 static int spapr_vlan_get_rx_pool_id(SpaprVioVlan *dev, int size)
546 {
547     int pool;
548 
549     for (pool = 0; pool < RX_MAX_POOLS; pool++) {
550         if (dev->rx_pool[pool]->bufsize == size) {
551             return pool;
552         }
553     }
554 
555     return -1;
556 }
557 
558 /**
559  * Enqueuing receive buffer by adding it to one of our receive buffer pools
560  */
561 static target_long spapr_vlan_add_rxbuf_to_pool(SpaprVioVlan *dev,
562                                                 target_ulong buf)
563 {
564     int size = VLAN_BD_LEN(buf);
565     int pool;
566 
567     pool = spapr_vlan_get_rx_pool_id(dev, size);
568     if (pool < 0) {
569         /*
570          * No matching pool found? Try to use a new one. If the guest used all
571          * pools before, but changed the size of one pool in the meantime, we might
572          * need to recycle that pool here (if it's empty already). Thus scan
573          * all buffer pools now, starting with the last (likely empty) one.
574          */
575         for (pool = RX_MAX_POOLS - 1; pool >= 0 ; pool--) {
576             if (dev->rx_pool[pool]->count == 0) {
577                 dev->rx_pool[pool]->bufsize = size;
578                 /*
579                  * Sort pools by size so that spapr_vlan_receive()
580                  * can later find the smallest buffer pool easily.
581                  */
582                 qsort(dev->rx_pool, RX_MAX_POOLS, sizeof(dev->rx_pool[0]),
583                       rx_pool_size_compare);
584                 pool = spapr_vlan_get_rx_pool_id(dev, size);
585                 trace_spapr_vlan_add_rxbuf_to_pool_create(pool,
586                                                           VLAN_BD_LEN(buf));
587                 break;
588             }
589         }
590     }
591     /* Still no usable pool? Give up */
592     if (pool < 0 || dev->rx_pool[pool]->count >= RX_POOL_MAX_BDS) {
593         return H_RESOURCE;
594     }
595 
596     trace_spapr_vlan_add_rxbuf_to_pool(pool, VLAN_BD_LEN(buf),
597                                        dev->rx_pool[pool]->count);
598 
599     dev->rx_pool[pool]->bds[dev->rx_pool[pool]->count++] = buf;
600 
601     return 0;
602 }
603 
604 /**
605  * This is the old way of enqueuing receive buffers: Add it to the rx queue
606  * page that has been supplied by the guest (which is quite limited in size).
607  */
608 static target_long spapr_vlan_add_rxbuf_to_page(SpaprVioVlan *dev,
609                                                 target_ulong buf)
610 {
611     vlan_bd_t bd;
612 
613     if (dev->rx_bufs >= VLAN_MAX_BUFS) {
614         return H_RESOURCE;
615     }
616 
617     do {
618         dev->add_buf_ptr += 8;
619         if (dev->add_buf_ptr >= VLAN_RX_BDS_LEN + VLAN_RX_BDS_OFF) {
620             dev->add_buf_ptr = VLAN_RX_BDS_OFF;
621         }
622 
623         bd = vio_ldq(&dev->sdev, dev->buf_list + dev->add_buf_ptr);
624     } while (bd & VLAN_BD_VALID);
625 
626     vio_stq(&dev->sdev, dev->buf_list + dev->add_buf_ptr, buf);
627 
628     trace_spapr_vlan_add_rxbuf_to_page(dev->add_buf_ptr, dev->rx_bufs, buf);
629 
630     return 0;
631 }
632 
633 static target_ulong h_add_logical_lan_buffer(PowerPCCPU *cpu,
634                                              SpaprMachineState *spapr,
635                                              target_ulong opcode,
636                                              target_ulong *args)
637 {
638     target_ulong reg = args[0];
639     target_ulong buf = args[1];
640     SpaprVioDevice *sdev = spapr_vio_find_by_reg(spapr->vio_bus, reg);
641     SpaprVioVlan *dev = VIO_SPAPR_VLAN_DEVICE(sdev);
642     target_long ret;
643 
644     trace_spapr_vlan_h_add_logical_lan_buffer(reg, buf);
645 
646     if (!sdev) {
647         hcall_dprintf("Bad device\n");
648         return H_PARAMETER;
649     }
650 
651     if ((check_bd(dev, buf, 4) < 0)
652         || (VLAN_BD_LEN(buf) < 16)) {
653         hcall_dprintf("Bad buffer enqueued\n");
654         return H_PARAMETER;
655     }
656 
657     if (!dev->isopen) {
658         return H_RESOURCE;
659     }
660 
661     if (dev->compat_flags & SPAPRVLAN_FLAG_RX_BUF_POOLS) {
662         ret = spapr_vlan_add_rxbuf_to_pool(dev, buf);
663     } else {
664         ret = spapr_vlan_add_rxbuf_to_page(dev, buf);
665     }
666     if (ret) {
667         return ret;
668     }
669 
670     dev->rx_bufs++;
671 
672     /*
673      * Give guest some more time to add additional RX buffers before we
674      * flush the receive queue, so that e.g. fragmented IP packets can
675      * be passed to the guest in one go later (instead of passing single
676      * fragments if there is only one receive buffer available).
677      */
678     timer_mod(dev->rxp_timer, qemu_clock_get_us(QEMU_CLOCK_VIRTUAL) + 500);
679 
680     return H_SUCCESS;
681 }
682 
683 static target_ulong h_send_logical_lan(PowerPCCPU *cpu,
684                                        SpaprMachineState *spapr,
685                                        target_ulong opcode, target_ulong *args)
686 {
687     target_ulong reg = args[0];
688     target_ulong *bufs = args + 1;
689     target_ulong continue_token = args[7];
690     SpaprVioDevice *sdev = spapr_vio_find_by_reg(spapr->vio_bus, reg);
691     SpaprVioVlan *dev = VIO_SPAPR_VLAN_DEVICE(sdev);
692     unsigned total_len;
693     uint8_t *lbuf, *p;
694     int i, nbufs;
695     int ret;
696 
697     trace_spapr_vlan_h_send_logical_lan(reg, continue_token);
698 
699     if (!sdev) {
700         return H_PARAMETER;
701     }
702 
703     trace_spapr_vlan_h_send_logical_lan_rxbufs(dev->rx_bufs);
704 
705     if (!dev->isopen) {
706         return H_DROPPED;
707     }
708 
709     if (continue_token) {
710         return H_HARDWARE; /* FIXME actually handle this */
711     }
712 
713     total_len = 0;
714     for (i = 0; i < 6; i++) {
715         trace_spapr_vlan_h_send_logical_lan_buf_desc(bufs[i]);
716         if (!(bufs[i] & VLAN_BD_VALID)) {
717             break;
718         }
719         total_len += VLAN_BD_LEN(bufs[i]);
720     }
721 
722     nbufs = i;
723     trace_spapr_vlan_h_send_logical_lan_total(nbufs, total_len);
724 
725     if (total_len == 0) {
726         return H_SUCCESS;
727     }
728 
729     if (total_len > MAX_PACKET_SIZE) {
730         /* Don't let the guest force too large an allocation */
731         return H_RESOURCE;
732     }
733 
734     lbuf = alloca(total_len);
735     p = lbuf;
736     for (i = 0; i < nbufs; i++) {
737         ret = spapr_vio_dma_read(sdev, VLAN_BD_ADDR(bufs[i]),
738                                  p, VLAN_BD_LEN(bufs[i]));
739         if (ret < 0) {
740             return ret;
741         }
742 
743         p += VLAN_BD_LEN(bufs[i]);
744     }
745 
746     qemu_send_packet(qemu_get_queue(dev->nic), lbuf, total_len);
747 
748     return H_SUCCESS;
749 }
750 
751 static target_ulong h_multicast_ctrl(PowerPCCPU *cpu, SpaprMachineState *spapr,
752                                      target_ulong opcode, target_ulong *args)
753 {
754     target_ulong reg = args[0];
755     SpaprVioDevice *dev = spapr_vio_find_by_reg(spapr->vio_bus, reg);
756 
757     if (!dev) {
758         return H_PARAMETER;
759     }
760 
761     return H_SUCCESS;
762 }
763 
764 static target_ulong h_change_logical_lan_mac(PowerPCCPU *cpu,
765                                              SpaprMachineState *spapr,
766                                              target_ulong opcode,
767                                              target_ulong *args)
768 {
769     target_ulong reg = args[0];
770     target_ulong macaddr = args[1];
771     SpaprVioDevice *sdev = spapr_vio_find_by_reg(spapr->vio_bus, reg);
772     SpaprVioVlan *dev = VIO_SPAPR_VLAN_DEVICE(sdev);
773     int i;
774 
775     for (i = 0; i < ETH_ALEN; i++) {
776         dev->nicconf.macaddr.a[ETH_ALEN - i - 1] = macaddr & 0xff;
777         macaddr >>= 8;
778     }
779 
780     qemu_format_nic_info_str(qemu_get_queue(dev->nic), dev->nicconf.macaddr.a);
781 
782     return H_SUCCESS;
783 }
784 
785 static Property spapr_vlan_properties[] = {
786     DEFINE_SPAPR_PROPERTIES(SpaprVioVlan, sdev),
787     DEFINE_NIC_PROPERTIES(SpaprVioVlan, nicconf),
788     DEFINE_PROP_BIT("use-rx-buffer-pools", SpaprVioVlan,
789                     compat_flags, SPAPRVLAN_FLAG_RX_BUF_POOLS_BIT, true),
790     DEFINE_PROP_END_OF_LIST(),
791 };
792 
793 static bool spapr_vlan_rx_buffer_pools_needed(void *opaque)
794 {
795     SpaprVioVlan *dev = opaque;
796 
797     return (dev->compat_flags & SPAPRVLAN_FLAG_RX_BUF_POOLS) != 0;
798 }
799 
800 static const VMStateDescription vmstate_rx_buffer_pool = {
801     .name = "spapr_llan/rx_buffer_pool",
802     .version_id = 1,
803     .minimum_version_id = 1,
804     .needed = spapr_vlan_rx_buffer_pools_needed,
805     .fields = (VMStateField[]) {
806         VMSTATE_INT32(bufsize, RxBufPool),
807         VMSTATE_INT32(count, RxBufPool),
808         VMSTATE_UINT64_ARRAY(bds, RxBufPool, RX_POOL_MAX_BDS),
809         VMSTATE_END_OF_LIST()
810     }
811 };
812 
813 static const VMStateDescription vmstate_rx_pools = {
814     .name = "spapr_llan/rx_pools",
815     .version_id = 1,
816     .minimum_version_id = 1,
817     .needed = spapr_vlan_rx_buffer_pools_needed,
818     .fields = (VMStateField[]) {
819         VMSTATE_ARRAY_OF_POINTER_TO_STRUCT(rx_pool, SpaprVioVlan,
820                                            RX_MAX_POOLS, 1,
821                                            vmstate_rx_buffer_pool, RxBufPool),
822         VMSTATE_END_OF_LIST()
823     }
824 };
825 
826 static const VMStateDescription vmstate_spapr_llan = {
827     .name = "spapr_llan",
828     .version_id = 1,
829     .minimum_version_id = 1,
830     .fields = (VMStateField[]) {
831         VMSTATE_SPAPR_VIO(sdev, SpaprVioVlan),
832         /* LLAN state */
833         VMSTATE_BOOL(isopen, SpaprVioVlan),
834         VMSTATE_UINT64(buf_list, SpaprVioVlan),
835         VMSTATE_UINT32(add_buf_ptr, SpaprVioVlan),
836         VMSTATE_UINT32(use_buf_ptr, SpaprVioVlan),
837         VMSTATE_UINT32(rx_bufs, SpaprVioVlan),
838         VMSTATE_UINT64(rxq_ptr, SpaprVioVlan),
839 
840         VMSTATE_END_OF_LIST()
841     },
842     .subsections = (const VMStateDescription * []) {
843         &vmstate_rx_pools,
844         NULL
845     }
846 };
847 
848 static void spapr_vlan_class_init(ObjectClass *klass, void *data)
849 {
850     DeviceClass *dc = DEVICE_CLASS(klass);
851     SpaprVioDeviceClass *k = VIO_SPAPR_DEVICE_CLASS(klass);
852 
853     k->realize = spapr_vlan_realize;
854     k->reset = spapr_vlan_reset;
855     k->devnode = spapr_vlan_devnode;
856     k->dt_name = "l-lan";
857     k->dt_type = "network";
858     k->dt_compatible = "IBM,l-lan";
859     k->signal_mask = 0x1;
860     set_bit(DEVICE_CATEGORY_NETWORK, dc->categories);
861     device_class_set_props(dc, spapr_vlan_properties);
862     k->rtce_window_size = 0x10000000;
863     dc->vmsd = &vmstate_spapr_llan;
864 }
865 
866 static const TypeInfo spapr_vlan_info = {
867     .name          = TYPE_VIO_SPAPR_VLAN_DEVICE,
868     .parent        = TYPE_VIO_SPAPR_DEVICE,
869     .instance_size = sizeof(SpaprVioVlan),
870     .class_init    = spapr_vlan_class_init,
871     .instance_init = spapr_vlan_instance_init,
872     .instance_finalize = spapr_vlan_instance_finalize,
873 };
874 
875 static void spapr_vlan_register_types(void)
876 {
877     spapr_register_hypercall(H_REGISTER_LOGICAL_LAN, h_register_logical_lan);
878     spapr_register_hypercall(H_FREE_LOGICAL_LAN, h_free_logical_lan);
879     spapr_register_hypercall(H_SEND_LOGICAL_LAN, h_send_logical_lan);
880     spapr_register_hypercall(H_ADD_LOGICAL_LAN_BUFFER,
881                              h_add_logical_lan_buffer);
882     spapr_register_hypercall(H_MULTICAST_CTRL, h_multicast_ctrl);
883     spapr_register_hypercall(H_CHANGE_LOGICAL_LAN_MAC,
884                              h_change_logical_lan_mac);
885     type_register_static(&spapr_vlan_info);
886 }
887 
888 type_init(spapr_vlan_register_types)
889