1 /* 2 * Raspberry Pi emulation (c) 2012 Gregory Estrade 3 * This code is licensed under the GNU GPLv2 and later. 4 * 5 * This file models the system mailboxes, which are used for 6 * communication with low-bandwidth GPU peripherals. Refs: 7 * https://github.com/raspberrypi/firmware/wiki/Mailboxes 8 * https://github.com/raspberrypi/firmware/wiki/Accessing-mailboxes 9 */ 10 11 #include "qemu/osdep.h" 12 #include "qapi/error.h" 13 #include "hw/misc/bcm2835_mbox.h" 14 #include "qemu/log.h" 15 16 #define MAIL0_PEEK 0x90 17 #define MAIL0_SENDER 0x94 18 #define MAIL1_STATUS 0xb8 19 20 /* Mailbox status register */ 21 #define MAIL0_STATUS 0x98 22 #define ARM_MS_FULL 0x80000000 23 #define ARM_MS_EMPTY 0x40000000 24 #define ARM_MS_LEVEL 0x400000FF /* Max. value depends on mailbox depth */ 25 26 /* MAILBOX config/status register */ 27 #define MAIL0_CONFIG 0x9c 28 /* ANY write to this register clears the error bits! */ 29 #define ARM_MC_IHAVEDATAIRQEN 0x00000001 /* mbox irq enable: has data */ 30 #define ARM_MC_IHAVESPACEIRQEN 0x00000002 /* mbox irq enable: has space */ 31 #define ARM_MC_OPPISEMPTYIRQEN 0x00000004 /* mbox irq enable: Opp is empty */ 32 #define ARM_MC_MAIL_CLEAR 0x00000008 /* mbox clear write 1, then 0 */ 33 #define ARM_MC_IHAVEDATAIRQPEND 0x00000010 /* mbox irq pending: has space */ 34 #define ARM_MC_IHAVESPACEIRQPEND 0x00000020 /* mbox irq pending: Opp is empty */ 35 #define ARM_MC_OPPISEMPTYIRQPEND 0x00000040 /* mbox irq pending */ 36 /* Bit 7 is unused */ 37 #define ARM_MC_ERRNOOWN 0x00000100 /* error : none owner read from mailbox */ 38 #define ARM_MC_ERROVERFLW 0x00000200 /* error : write to fill mailbox */ 39 #define ARM_MC_ERRUNDRFLW 0x00000400 /* error : read from empty mailbox */ 40 41 static void mbox_update_status(BCM2835Mbox *mb) 42 { 43 mb->status &= ~(ARM_MS_EMPTY | ARM_MS_FULL); 44 if (mb->count == 0) { 45 mb->status |= ARM_MS_EMPTY; 46 } else if (mb->count == MBOX_SIZE) { 47 mb->status |= ARM_MS_FULL; 48 } 49 } 50 51 static void mbox_reset(BCM2835Mbox *mb) 52 { 53 int n; 54 55 mb->count = 0; 56 mb->config = 0; 57 for (n = 0; n < MBOX_SIZE; n++) { 58 mb->reg[n] = MBOX_INVALID_DATA; 59 } 60 mbox_update_status(mb); 61 } 62 63 static uint32_t mbox_pull(BCM2835Mbox *mb, int index) 64 { 65 int n; 66 uint32_t val; 67 68 assert(mb->count > 0); 69 assert(index < mb->count); 70 71 val = mb->reg[index]; 72 for (n = index + 1; n < mb->count; n++) { 73 mb->reg[n - 1] = mb->reg[n]; 74 } 75 mb->count--; 76 mb->reg[mb->count] = MBOX_INVALID_DATA; 77 78 mbox_update_status(mb); 79 80 return val; 81 } 82 83 static void mbox_push(BCM2835Mbox *mb, uint32_t val) 84 { 85 assert(mb->count < MBOX_SIZE); 86 mb->reg[mb->count++] = val; 87 mbox_update_status(mb); 88 } 89 90 static void bcm2835_mbox_update(BCM2835MboxState *s) 91 { 92 uint32_t value; 93 bool set; 94 int n; 95 96 s->mbox_irq_disabled = true; 97 98 /* Get pending responses and put them in the vc->arm mbox, 99 * as long as it's not full 100 */ 101 for (n = 0; n < MBOX_CHAN_COUNT; n++) { 102 while (s->available[n] && !(s->mbox[0].status & ARM_MS_FULL)) { 103 value = ldl_le_phys(&s->mbox_as, n << MBOX_AS_CHAN_SHIFT); 104 assert(value != MBOX_INVALID_DATA); /* Pending interrupt but no data */ 105 mbox_push(&s->mbox[0], value); 106 } 107 } 108 109 /* TODO (?): Try to push pending requests from the arm->vc mbox */ 110 111 /* Re-enable calls from the IRQ routine */ 112 s->mbox_irq_disabled = false; 113 114 /* Update ARM IRQ status */ 115 set = false; 116 s->mbox[0].config &= ~ARM_MC_IHAVEDATAIRQPEND; 117 if (!(s->mbox[0].status & ARM_MS_EMPTY)) { 118 s->mbox[0].config |= ARM_MC_IHAVEDATAIRQPEND; 119 if (s->mbox[0].config & ARM_MC_IHAVEDATAIRQEN) { 120 set = true; 121 } 122 } 123 qemu_set_irq(s->arm_irq, set); 124 } 125 126 static void bcm2835_mbox_set_irq(void *opaque, int irq, int level) 127 { 128 BCM2835MboxState *s = opaque; 129 130 s->available[irq] = level; 131 132 /* avoid recursively calling bcm2835_mbox_update when the interrupt 133 * status changes due to the ldl_phys call within that function 134 */ 135 if (!s->mbox_irq_disabled) { 136 bcm2835_mbox_update(s); 137 } 138 } 139 140 static uint64_t bcm2835_mbox_read(void *opaque, hwaddr offset, unsigned size) 141 { 142 BCM2835MboxState *s = opaque; 143 uint32_t res = 0; 144 145 offset &= 0xff; 146 147 switch (offset) { 148 case 0x80 ... 0x8c: /* MAIL0_READ */ 149 if (s->mbox[0].status & ARM_MS_EMPTY) { 150 res = MBOX_INVALID_DATA; 151 } else { 152 res = mbox_pull(&s->mbox[0], 0); 153 } 154 break; 155 156 case MAIL0_PEEK: 157 res = s->mbox[0].reg[0]; 158 break; 159 160 case MAIL0_SENDER: 161 break; 162 163 case MAIL0_STATUS: 164 res = s->mbox[0].status; 165 break; 166 167 case MAIL0_CONFIG: 168 res = s->mbox[0].config; 169 break; 170 171 case MAIL1_STATUS: 172 res = s->mbox[1].status; 173 break; 174 175 default: 176 qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n", 177 __func__, offset); 178 return 0; 179 } 180 181 bcm2835_mbox_update(s); 182 183 return res; 184 } 185 186 static void bcm2835_mbox_write(void *opaque, hwaddr offset, 187 uint64_t value, unsigned size) 188 { 189 BCM2835MboxState *s = opaque; 190 hwaddr childaddr; 191 uint8_t ch; 192 193 offset &= 0xff; 194 195 switch (offset) { 196 case MAIL0_SENDER: 197 break; 198 199 case MAIL0_CONFIG: 200 s->mbox[0].config &= ~ARM_MC_IHAVEDATAIRQEN; 201 s->mbox[0].config |= value & ARM_MC_IHAVEDATAIRQEN; 202 break; 203 204 case 0xa0 ... 0xac: /* MAIL1_WRITE */ 205 if (s->mbox[1].status & ARM_MS_FULL) { 206 /* Mailbox full */ 207 qemu_log_mask(LOG_GUEST_ERROR, "%s: mailbox full\n", __func__); 208 } else { 209 ch = value & 0xf; 210 if (ch < MBOX_CHAN_COUNT) { 211 childaddr = ch << MBOX_AS_CHAN_SHIFT; 212 if (ldl_le_phys(&s->mbox_as, childaddr + MBOX_AS_PENDING)) { 213 /* Child busy, push delayed. Push it in the arm->vc mbox */ 214 mbox_push(&s->mbox[1], value); 215 } else { 216 /* Push it directly to the child device */ 217 stl_le_phys(&s->mbox_as, childaddr, value); 218 } 219 } else { 220 /* Invalid channel number */ 221 qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid channel %u\n", 222 __func__, ch); 223 } 224 } 225 break; 226 227 default: 228 qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n", 229 __func__, offset); 230 return; 231 } 232 233 bcm2835_mbox_update(s); 234 } 235 236 static const MemoryRegionOps bcm2835_mbox_ops = { 237 .read = bcm2835_mbox_read, 238 .write = bcm2835_mbox_write, 239 .endianness = DEVICE_NATIVE_ENDIAN, 240 .valid.min_access_size = 4, 241 .valid.max_access_size = 4, 242 }; 243 244 /* vmstate of a single mailbox */ 245 static const VMStateDescription vmstate_bcm2835_mbox_box = { 246 .name = TYPE_BCM2835_MBOX "_box", 247 .version_id = 1, 248 .minimum_version_id = 1, 249 .fields = (VMStateField[]) { 250 VMSTATE_UINT32_ARRAY(reg, BCM2835Mbox, MBOX_SIZE), 251 VMSTATE_UINT32(count, BCM2835Mbox), 252 VMSTATE_UINT32(status, BCM2835Mbox), 253 VMSTATE_UINT32(config, BCM2835Mbox), 254 VMSTATE_END_OF_LIST() 255 } 256 }; 257 258 /* vmstate of the entire device */ 259 static const VMStateDescription vmstate_bcm2835_mbox = { 260 .name = TYPE_BCM2835_MBOX, 261 .version_id = 1, 262 .minimum_version_id = 1, 263 .minimum_version_id_old = 1, 264 .fields = (VMStateField[]) { 265 VMSTATE_BOOL_ARRAY(available, BCM2835MboxState, MBOX_CHAN_COUNT), 266 VMSTATE_STRUCT_ARRAY(mbox, BCM2835MboxState, 2, 1, 267 vmstate_bcm2835_mbox_box, BCM2835Mbox), 268 VMSTATE_END_OF_LIST() 269 } 270 }; 271 272 static void bcm2835_mbox_init(Object *obj) 273 { 274 BCM2835MboxState *s = BCM2835_MBOX(obj); 275 276 memory_region_init_io(&s->iomem, obj, &bcm2835_mbox_ops, s, 277 TYPE_BCM2835_MBOX, 0x400); 278 sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem); 279 sysbus_init_irq(SYS_BUS_DEVICE(s), &s->arm_irq); 280 qdev_init_gpio_in(DEVICE(s), bcm2835_mbox_set_irq, MBOX_CHAN_COUNT); 281 } 282 283 static void bcm2835_mbox_reset(DeviceState *dev) 284 { 285 BCM2835MboxState *s = BCM2835_MBOX(dev); 286 int n; 287 288 mbox_reset(&s->mbox[0]); 289 mbox_reset(&s->mbox[1]); 290 s->mbox_irq_disabled = false; 291 for (n = 0; n < MBOX_CHAN_COUNT; n++) { 292 s->available[n] = false; 293 } 294 } 295 296 static void bcm2835_mbox_realize(DeviceState *dev, Error **errp) 297 { 298 BCM2835MboxState *s = BCM2835_MBOX(dev); 299 Object *obj; 300 Error *err = NULL; 301 302 obj = object_property_get_link(OBJECT(dev), "mbox-mr", &err); 303 if (obj == NULL) { 304 error_setg(errp, "%s: required mbox-mr link not found: %s", 305 __func__, error_get_pretty(err)); 306 return; 307 } 308 309 s->mbox_mr = MEMORY_REGION(obj); 310 address_space_init(&s->mbox_as, s->mbox_mr, NULL); 311 bcm2835_mbox_reset(dev); 312 } 313 314 static void bcm2835_mbox_class_init(ObjectClass *klass, void *data) 315 { 316 DeviceClass *dc = DEVICE_CLASS(klass); 317 318 dc->realize = bcm2835_mbox_realize; 319 dc->reset = bcm2835_mbox_reset; 320 dc->vmsd = &vmstate_bcm2835_mbox; 321 } 322 323 static TypeInfo bcm2835_mbox_info = { 324 .name = TYPE_BCM2835_MBOX, 325 .parent = TYPE_SYS_BUS_DEVICE, 326 .instance_size = sizeof(BCM2835MboxState), 327 .class_init = bcm2835_mbox_class_init, 328 .instance_init = bcm2835_mbox_init, 329 }; 330 331 static void bcm2835_mbox_register_types(void) 332 { 333 type_register_static(&bcm2835_mbox_info); 334 } 335 336 type_init(bcm2835_mbox_register_types) 337