feat: add GENET v5 Ethernet driver

docs/raspberry-pi.md

@@ -103,6 +103,7 @@ PL011 on GPIO 14/15: header pins 8 (TX) and 10 (RX), ground on pin 6, 115200
 | Bluetooth (CYW43455 on the 4B, CYW43456 on the 400) | `BCM2EA6` (`\_SB.GDV0.BTH0`) on the mini UART (`BCM2836`) | `Drivers/Bluetooth/Broadcom.cpp`, `Drivers/Serial/BtUart.cpp` |
 | VideoCore firmware mailbox (radio power, clocks, board MAC) | `BCM2849` (`RPIQ`) | `Drivers/Platform/RpiFirmware.cpp` |
 | GPIO pin functions | `BCM2845` (`GPI0`) | `Drivers/Platform/RpiGpio.cpp` |
+| Ethernet (GENET v5 MAC, BCM54213PE PHY) | `BCM6E4E` (`\_SB.ETH0`) | `Drivers/Net/Genet.cpp` |
 
 The VL805 sits behind the BCM2711's PCIe, whose config space is not ECAM
 (the root bridge's `_DSD` says `linux-ecam-quirk-id = "bcm2711"`), so the
@@ -157,9 +158,36 @@ The CYW43456 reports a chip-wide default address (`43:45:C5:00:1F:AC`);
 the driver replaces it with the board's Ethernet MAC from the firmware.
 `0:/config/bluetooth.toml` still overrides both (Broadcom `0xFC01`).
 
+## Ethernet
+
+The BCM2711's own Gigabit MAC, GENET v5 (a UniMAC behind a DMA engine),
+talks RGMII to a BCM54213PE PHY at MDIO address 1. The firmware describes
+it as `BCM6E4E`: a 64 KiB register block, two interrupts (the driver uses
+the first, which carries the default queue), `_CCA = 0`, and a `_DSD` with
+`phy-mode` (`rgmii-rxid`: the PHY delays the receive clock, the MAC the
+transmit clock) and `brcm,max-dma-burst-size`.
+
+The driver uses only the default queue (ring 16), with all 256 descriptors
+of each direction. The descriptors live in the MAC's own SRAM, so only the
+2 KiB packet buffers need cache maintenance. Received frames start two
+bytes into their buffer (`RBUF_ALIGN_2B`); neither direction uses the
+64-byte status blocks, so there is no checksum offload. The UniMAC accepts
+broadcast and its own address only (the MDF filter).
+
+The interrupt only acknowledges and masks; frames are dispatched from the
+idle bottom half, which also checks the ring itself, so receive works if
+the interrupt never arrives. The PHY is polled once a second (its interrupt
+pin is not described); a link change reprograms the RGMII block and the
+UniMAC's speed and duplex. A link the firmware already negotiated is kept,
+otherwise the PHY is reset and advertises 10/100 and 1000 full duplex.
+
+The MAC address is the board's, read from OTP through the firmware mailbox
+(the one the Bluetooth driver uses too); the address the firmware's own
+driver programmed is the fallback. `dhcp.elf` waits up to 10 s for a wired
+link, since autonegotiation takes about 3 s after the PHY reset.
+
 ## Not supported yet
 
-- Ethernet (BCM54213 via GENET v5, `BCM6E4E`).
 - SD high-speed mode: the driver transfers by polled PIO at 25 MHz on a
   4-bit bus (multi-block CMD18/CMD25 with Auto CMD12), at most 12.5 MB/s;
   switching the card to 50 MHz (CMD6) would double that.
@@ -168,8 +196,9 @@ the driver replaces it with the board's Ethernet MAC from the firmware.
 
 ## Status
 
-Bluetooth has not run yet: QEMU has no model of the radio, so it is
-untested on any machine.
+Bluetooth works on a Pi 400 (CYW43456), including A2DP music to
+headphones. Ethernet has not run yet: QEMU has no GENET model. It is untested on a Pi 4B (CYW43455), and QEMU has no model of
+the radio.
 
 Everything else above is verified on QEMU only, including the Pi-specific path:
 the firmware's own XHC0 table, retargeted at QEMU's xHCI and loaded with the