1 /* 2 * Raspberry Pi emulation (c) 2012 Gregory Estrade 3 * This code is licensed under the GNU GPLv2 and later. 4 * 5 * This file models the system mailboxes, which are used for 6 * communication with low-bandwidth GPU peripherals. Refs: 7 * https://github.com/raspberrypi/firmware/wiki/Mailboxes 8 * https://github.com/raspberrypi/firmware/wiki/Accessing-mailboxes 9 */ 10 11 #include "hw/misc/bcm2835_mbox.h" 12 13 #define MAIL0_PEEK 0x90 14 #define MAIL0_SENDER 0x94 15 #define MAIL1_STATUS 0xb8 16 17 /* Mailbox status register */ 18 #define MAIL0_STATUS 0x98 19 #define ARM_MS_FULL 0x80000000 20 #define ARM_MS_EMPTY 0x40000000 21 #define ARM_MS_LEVEL 0x400000FF /* Max. value depends on mailbox depth */ 22 23 /* MAILBOX config/status register */ 24 #define MAIL0_CONFIG 0x9c 25 /* ANY write to this register clears the error bits! */ 26 #define ARM_MC_IHAVEDATAIRQEN 0x00000001 /* mbox irq enable: has data */ 27 #define ARM_MC_IHAVESPACEIRQEN 0x00000002 /* mbox irq enable: has space */ 28 #define ARM_MC_OPPISEMPTYIRQEN 0x00000004 /* mbox irq enable: Opp is empty */ 29 #define ARM_MC_MAIL_CLEAR 0x00000008 /* mbox clear write 1, then 0 */ 30 #define ARM_MC_IHAVEDATAIRQPEND 0x00000010 /* mbox irq pending: has space */ 31 #define ARM_MC_IHAVESPACEIRQPEND 0x00000020 /* mbox irq pending: Opp is empty */ 32 #define ARM_MC_OPPISEMPTYIRQPEND 0x00000040 /* mbox irq pending */ 33 /* Bit 7 is unused */ 34 #define ARM_MC_ERRNOOWN 0x00000100 /* error : none owner read from mailbox */ 35 #define ARM_MC_ERROVERFLW 0x00000200 /* error : write to fill mailbox */ 36 #define ARM_MC_ERRUNDRFLW 0x00000400 /* error : read from empty mailbox */ 37 38 static void mbox_update_status(BCM2835Mbox *mb) 39 { 40 mb->status &= ~(ARM_MS_EMPTY | ARM_MS_FULL); 41 if (mb->count == 0) { 42 mb->status |= ARM_MS_EMPTY; 43 } else if (mb->count == MBOX_SIZE) { 44 mb->status |= ARM_MS_FULL; 45 } 46 } 47 48 static void mbox_reset(BCM2835Mbox *mb) 49 { 50 int n; 51 52 mb->count = 0; 53 mb->config = 0; 54 for (n = 0; n < MBOX_SIZE; n++) { 55 mb->reg[n] = MBOX_INVALID_DATA; 56 } 57 mbox_update_status(mb); 58 } 59 60 static uint32_t mbox_pull(BCM2835Mbox *mb, int index) 61 { 62 int n; 63 uint32_t val; 64 65 assert(mb->count > 0); 66 assert(index < mb->count); 67 68 val = mb->reg[index]; 69 for (n = index + 1; n < mb->count; n++) { 70 mb->reg[n - 1] = mb->reg[n]; 71 } 72 mb->count--; 73 mb->reg[mb->count] = MBOX_INVALID_DATA; 74 75 mbox_update_status(mb); 76 77 return val; 78 } 79 80 static void mbox_push(BCM2835Mbox *mb, uint32_t val) 81 { 82 assert(mb->count < MBOX_SIZE); 83 mb->reg[mb->count++] = val; 84 mbox_update_status(mb); 85 } 86 87 static void bcm2835_mbox_update(BCM2835MboxState *s) 88 { 89 uint32_t value; 90 bool set; 91 int n; 92 93 s->mbox_irq_disabled = true; 94 95 /* Get pending responses and put them in the vc->arm mbox, 96 * as long as it's not full 97 */ 98 for (n = 0; n < MBOX_CHAN_COUNT; n++) { 99 while (s->available[n] && !(s->mbox[0].status & ARM_MS_FULL)) { 100 value = ldl_phys(&s->mbox_as, n << MBOX_AS_CHAN_SHIFT); 101 assert(value != MBOX_INVALID_DATA); /* Pending interrupt but no data */ 102 mbox_push(&s->mbox[0], value); 103 } 104 } 105 106 /* TODO (?): Try to push pending requests from the arm->vc mbox */ 107 108 /* Re-enable calls from the IRQ routine */ 109 s->mbox_irq_disabled = false; 110 111 /* Update ARM IRQ status */ 112 set = false; 113 s->mbox[0].config &= ~ARM_MC_IHAVEDATAIRQPEND; 114 if (!(s->mbox[0].status & ARM_MS_EMPTY)) { 115 s->mbox[0].config |= ARM_MC_IHAVEDATAIRQPEND; 116 if (s->mbox[0].config & ARM_MC_IHAVEDATAIRQEN) { 117 set = true; 118 } 119 } 120 qemu_set_irq(s->arm_irq, set); 121 } 122 123 static void bcm2835_mbox_set_irq(void *opaque, int irq, int level) 124 { 125 BCM2835MboxState *s = opaque; 126 127 s->available[irq] = level; 128 129 /* avoid recursively calling bcm2835_mbox_update when the interrupt 130 * status changes due to the ldl_phys call within that function 131 */ 132 if (!s->mbox_irq_disabled) { 133 bcm2835_mbox_update(s); 134 } 135 } 136 137 static uint64_t bcm2835_mbox_read(void *opaque, hwaddr offset, unsigned size) 138 { 139 BCM2835MboxState *s = opaque; 140 uint32_t res = 0; 141 142 offset &= 0xff; 143 144 switch (offset) { 145 case 0x80 ... 0x8c: /* MAIL0_READ */ 146 if (s->mbox[0].status & ARM_MS_EMPTY) { 147 res = MBOX_INVALID_DATA; 148 } else { 149 res = mbox_pull(&s->mbox[0], 0); 150 } 151 break; 152 153 case MAIL0_PEEK: 154 res = s->mbox[0].reg[0]; 155 break; 156 157 case MAIL0_SENDER: 158 break; 159 160 case MAIL0_STATUS: 161 res = s->mbox[0].status; 162 break; 163 164 case MAIL0_CONFIG: 165 res = s->mbox[0].config; 166 break; 167 168 case MAIL1_STATUS: 169 res = s->mbox[1].status; 170 break; 171 172 default: 173 qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n", 174 __func__, offset); 175 return 0; 176 } 177 178 bcm2835_mbox_update(s); 179 180 return res; 181 } 182 183 static void bcm2835_mbox_write(void *opaque, hwaddr offset, 184 uint64_t value, unsigned size) 185 { 186 BCM2835MboxState *s = opaque; 187 hwaddr childaddr; 188 uint8_t ch; 189 190 offset &= 0xff; 191 192 switch (offset) { 193 case MAIL0_SENDER: 194 break; 195 196 case MAIL0_CONFIG: 197 s->mbox[0].config &= ~ARM_MC_IHAVEDATAIRQEN; 198 s->mbox[0].config |= value & ARM_MC_IHAVEDATAIRQEN; 199 break; 200 201 case 0xa0 ... 0xac: /* MAIL1_WRITE */ 202 if (s->mbox[1].status & ARM_MS_FULL) { 203 /* Mailbox full */ 204 qemu_log_mask(LOG_GUEST_ERROR, "%s: mailbox full\n", __func__); 205 } else { 206 ch = value & 0xf; 207 if (ch < MBOX_CHAN_COUNT) { 208 childaddr = ch << MBOX_AS_CHAN_SHIFT; 209 if (ldl_phys(&s->mbox_as, childaddr + MBOX_AS_PENDING)) { 210 /* Child busy, push delayed. Push it in the arm->vc mbox */ 211 mbox_push(&s->mbox[1], value); 212 } else { 213 /* Push it directly to the child device */ 214 stl_phys(&s->mbox_as, childaddr, value); 215 } 216 } else { 217 /* Invalid channel number */ 218 qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid channel %u\n", 219 __func__, ch); 220 } 221 } 222 break; 223 224 default: 225 qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n", 226 __func__, offset); 227 return; 228 } 229 230 bcm2835_mbox_update(s); 231 } 232 233 static const MemoryRegionOps bcm2835_mbox_ops = { 234 .read = bcm2835_mbox_read, 235 .write = bcm2835_mbox_write, 236 .endianness = DEVICE_NATIVE_ENDIAN, 237 .valid.min_access_size = 4, 238 .valid.max_access_size = 4, 239 }; 240 241 /* vmstate of a single mailbox */ 242 static const VMStateDescription vmstate_bcm2835_mbox_box = { 243 .name = TYPE_BCM2835_MBOX "_box", 244 .version_id = 1, 245 .minimum_version_id = 1, 246 .fields = (VMStateField[]) { 247 VMSTATE_UINT32_ARRAY(reg, BCM2835Mbox, MBOX_SIZE), 248 VMSTATE_UINT32(count, BCM2835Mbox), 249 VMSTATE_UINT32(status, BCM2835Mbox), 250 VMSTATE_UINT32(config, BCM2835Mbox), 251 VMSTATE_END_OF_LIST() 252 } 253 }; 254 255 /* vmstate of the entire device */ 256 static const VMStateDescription vmstate_bcm2835_mbox = { 257 .name = TYPE_BCM2835_MBOX, 258 .version_id = 1, 259 .minimum_version_id = 1, 260 .minimum_version_id_old = 1, 261 .fields = (VMStateField[]) { 262 VMSTATE_BOOL_ARRAY(available, BCM2835MboxState, MBOX_CHAN_COUNT), 263 VMSTATE_STRUCT_ARRAY(mbox, BCM2835MboxState, 2, 1, 264 vmstate_bcm2835_mbox_box, BCM2835Mbox), 265 VMSTATE_END_OF_LIST() 266 } 267 }; 268 269 static void bcm2835_mbox_init(Object *obj) 270 { 271 BCM2835MboxState *s = BCM2835_MBOX(obj); 272 273 memory_region_init_io(&s->iomem, obj, &bcm2835_mbox_ops, s, 274 TYPE_BCM2835_MBOX, 0x400); 275 sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem); 276 sysbus_init_irq(SYS_BUS_DEVICE(s), &s->arm_irq); 277 qdev_init_gpio_in(DEVICE(s), bcm2835_mbox_set_irq, MBOX_CHAN_COUNT); 278 } 279 280 static void bcm2835_mbox_reset(DeviceState *dev) 281 { 282 BCM2835MboxState *s = BCM2835_MBOX(dev); 283 int n; 284 285 mbox_reset(&s->mbox[0]); 286 mbox_reset(&s->mbox[1]); 287 s->mbox_irq_disabled = false; 288 for (n = 0; n < MBOX_CHAN_COUNT; n++) { 289 s->available[n] = false; 290 } 291 } 292 293 static void bcm2835_mbox_realize(DeviceState *dev, Error **errp) 294 { 295 BCM2835MboxState *s = BCM2835_MBOX(dev); 296 Object *obj; 297 Error *err = NULL; 298 299 obj = object_property_get_link(OBJECT(dev), "mbox-mr", &err); 300 if (obj == NULL) { 301 error_setg(errp, "%s: required mbox-mr link not found: %s", 302 __func__, error_get_pretty(err)); 303 return; 304 } 305 306 s->mbox_mr = MEMORY_REGION(obj); 307 address_space_init(&s->mbox_as, s->mbox_mr, NULL); 308 bcm2835_mbox_reset(dev); 309 } 310 311 static void bcm2835_mbox_class_init(ObjectClass *klass, void *data) 312 { 313 DeviceClass *dc = DEVICE_CLASS(klass); 314 315 dc->realize = bcm2835_mbox_realize; 316 dc->reset = bcm2835_mbox_reset; 317 dc->vmsd = &vmstate_bcm2835_mbox; 318 } 319 320 static TypeInfo bcm2835_mbox_info = { 321 .name = TYPE_BCM2835_MBOX, 322 .parent = TYPE_SYS_BUS_DEVICE, 323 .instance_size = sizeof(BCM2835MboxState), 324 .class_init = bcm2835_mbox_class_init, 325 .instance_init = bcm2835_mbox_init, 326 }; 327 328 static void bcm2835_mbox_register_types(void) 329 { 330 type_register_static(&bcm2835_mbox_info); 331 } 332 333 type_init(bcm2835_mbox_register_types) 334