Re: [PATCH 0/5] dp8393x: fixes for MacOS toolbox ROM

[Mark Cave-Ayland <mark.cave-ayland@ilande.co.uk>]

On 25/06/2021 10:32, Finn Thain wrote:

>>>> Thanks for the link and the detailed testing information. I've been
>>>> trying to understand why you had to set the MAC address in the ARC
>>>> firmware so I had a bit of an experiment here.
>>>>
>>>> The reason that you need to do this is because of the NVRAM
>>>> configuration in your command line, in particular -global
>>>> ds1225y.size=8200.
> 
> That configuration also shows up here,
> https://virtuallyfun.com/wordpress/2013/08/30/restoring-the-mips-magnum-in-qemu-1-6-0/
> with the explanation, "you'll need the NVRam stuff to add extra space for
> the ethernet MAC address". So it seems that the 8200 figure was just a
> hack and does not reflect the size of the NVRAM in an actual Magnum.

Ah that makes sense! QEMU 1.6.0 was released in 2013 and Hervé's patches to add the 
PROM MAC address support were added in 2015 so this information is outdated.

>>>> What this does is extend the NVRAM over the top of the dp8393x-prom
>>>> area where QEMU places the NIC MAC address and checksum on startup,
>>>> so the NVRAM captures the MAC address reads/writes instead. The net
>>>> effect of this is that the empty NVRAM initially reads all zeros and
>>>> why an initial setup is required to set the MAC address.
>>>>
>>>> This can be seen quite clearly in the "info mtree" output:
>>>>
>>>>       0000000080009000-000000008000b007 (prio 0, i/o): nvram
>>>>       000000008000b000-000000008000bfff (prio 0, rom): dp8393x-prom
>>>>
>>>> However if you completely drop -global ds1225y.size=8200 from your
>>>> command line then the NVRAM doesn't overrun into the dp8393x-prom
>>>> area, and the ARC firmware picks up the MAC address from QEMU
>>>> correctly:
>>>>
>>>>       0000000080009000-000000008000afff (prio 0, i/o): nvram
>>>>       000000008000b000-000000008000bfff (prio 0, rom): dp8393x-prom
>>>>
>>>> I've also looked over the entire SONIC datasheet to see if the PROM
>>>> format is documented, and according to that there is no non-volatile
>>>> storage available on the chip itself.
>>>
>>> Yes, that's my understanding also. The relevant National Semicondutor
>>> Application Notes seem to include a separate PROM. And if you closely
>>> examine the Linux macsonic.c driver, you'll see that the PowerBook 5x0
>>> models get a random MAC address because no-one (outside of Apple)
>>> knows where the real MAC address is stored.
>>
>> Agreed. This means that the revised patchset should now be doing the
>> right thing here.
>>
>> FWIW I felt that it had changed too much in its latest form to include
>> your original Tested-by tag due to the extra PROM changes, so I'd be
>> grateful if you could give it a quick test.
>>
> 
> Sure.
> 
>>>> Testing shows that the checksum algorithm currently used for the
>>>> dp8393x device generates the same result as that generated by the
>>>> ARC firmware, which is known to be different than that used by the
>>>> Q800 machine.
>>>>
>>>>   From this I conclude that the PROM is provided by the board and not
>>>> the chipset, and therefore each machine should construct its own
>>>> PROM accordingly. I'll send a v2 patchset shortly with these changes
>>>> which shall also include the proposed endian patch.
>>>>
>>>
>>> If you potentially have both a ds1225y NVRAM and a dp8393x PROM (for
>>> the magnum machine) how do you avoid ending up with conflicting state?
>>> Would the two storage devices have to be mutually exclusive?
>>
>> The ds1225y NVRAM is located between 0x80009000-0x8000afff and running
>> the nvram file through hexdump shows only the first 0x1000 bytes contain
>> any data, so any other changes made to NVRAM via the ARC firmware setup
>> will be preserved.
>>
> 
> Perhaps '-global ds1225y.size=4096' could be used to test that assumption
> about ARC firmware behaviour. Anyway, the default for ds1225y.size seems
> to be 0x2000. And a glance at the DS1225Y datasheets agrees with that
> figure. (I'm going to assume that DS1225Y is the actual part found in
> Magnum machines even though MOS6522, for instance, was not used in
> Quadras.)
> 
>> The existing default behaviour (without -global ds1225y.size=8200) is
>> that only the last few bytes at 0x8000b000 are mapped to the dp8393x
>> PROM, and this area is marked read-only to ensure that the MAC address
>> obtained by the guest OS always matches the one provided by the QEMU
>> configuration.
>>
> 
> Well, I asked about conflicting state having assumed that the NVRAM in a
> real Magnum was used to store the MAC address. But that's probably not the
> case. There's probably some other chip involved and your PROM device seems
> like a good way to model that. (Unfortunately I don't have access to a
> Magnum machine so you should take what I say about that machine with a
> grain of salt.)

Certainly on real Magnum hardware the area of memory containing the MAC address is 
backed by NVRAM and QEMU can access it, as validated by increasing the NVRAM size.

However the current default behaviour seems correct to me, since NIC MAC addresses 
are specified on the QEMU command line and so if you make this area NVRAM you can end 
up with a mismatch between what QEMU thinks the MAC address is internally vs. the 
value in the PROM...


ATB,

Mark.