hw/misc/bcm2835_mbox.c

   1 /*
   2  * Raspberry Pi emulation (c) 2012 Gregory Estrade
   3  * This code is licensed under the GNU GPLv2 and later.
   4  *
   5  * This file models the system mailboxes, which are used for
   6  * communication with low-bandwidth GPU peripherals. Refs:
   7  *   https://github.com/raspberrypi/firmware/wiki/Mailboxes
   8  *   https://github.com/raspberrypi/firmware/wiki/Accessing-mailboxes
   9  */
  10
  11 #include "hw/misc/bcm2835_mbox.h"
  12
  13 /* Mailbox status register (...0x98) */
  14 #define ARM_MS_FULL       0x80000000
  15 #define ARM_MS_EMPTY      0x40000000
  16 #define ARM_MS_LEVEL      0x400000FF /* Max. value depends on mailbox depth */
  17
  18 /* MAILBOX config/status register (...0x9C) */
  19 /* ANY write to this register clears the error bits! */
  20 #define ARM_MC_IHAVEDATAIRQEN    0x00000001 /* mbox irq enable:  has data */
  21 #define ARM_MC_IHAVESPACEIRQEN   0x00000002 /* mbox irq enable:  has space */
  22 #define ARM_MC_OPPISEMPTYIRQEN   0x00000004 /* mbox irq enable: Opp is empty */
  23 #define ARM_MC_MAIL_CLEAR        0x00000008 /* mbox clear write 1, then  0 */
  24 #define ARM_MC_IHAVEDATAIRQPEND  0x00000010 /* mbox irq pending:  has space */
  25 #define ARM_MC_IHAVESPACEIRQPEND 0x00000020 /* mbox irq pending: Opp is empty */
  26 #define ARM_MC_OPPISEMPTYIRQPEND 0x00000040 /* mbox irq pending */
  27 /* Bit 7 is unused */
  28 #define ARM_MC_ERRNOOWN   0x00000100 /* error : none owner read from mailbox */
  29 #define ARM_MC_ERROVERFLW 0x00000200 /* error : write to fill mailbox */
  30 #define ARM_MC_ERRUNDRFLW 0x00000400 /* error : read from empty mailbox */
  31
  32 static void mbox_update_status(BCM2835Mbox *mb)
  33 {
  34     mb->status &= ~(ARM_MS_EMPTY | ARM_MS_FULL);
  35     if (mb->count == 0) {
  36         mb->status |= ARM_MS_EMPTY;
  37     } else if (mb->count == MBOX_SIZE) {
  38         mb->status |= ARM_MS_FULL;
  39     }
  40 }
  41
  42 static void mbox_init(BCM2835Mbox *mb)
  43 {
  44     int n;
  45
  46     mb->count = 0;
  47     mb->config = 0;
  48     for (n = 0; n < MBOX_SIZE; n++) {
  49         mb->reg[n] = MBOX_INVALID_DATA;
  50     }
  51     mbox_update_status(mb);
  52 }
  53
  54 static uint32_t mbox_pull(BCM2835Mbox *mb, int index)
  55 {
  56     int n;
  57     uint32_t val;
  58
  59     assert(mb->count > 0);
  60     assert(index < mb->count);
  61
  62     val = mb->reg[index];
  63     for (n = index + 1; n < mb->count; n++) {
  64         mb->reg[n - 1] = mb->reg[n];
  65     }
  66     mb->count--;
  67     mb->reg[mb->count] = MBOX_INVALID_DATA;
  68
  69     mbox_update_status(mb);
  70
  71     return val;
  72 }
  73
  74 static void mbox_push(BCM2835Mbox *mb, uint32_t val)
  75 {
  76     assert(mb->count < MBOX_SIZE);
  77     mb->reg[mb->count++] = val;
  78     mbox_update_status(mb);
  79 }
  80
  81 static void bcm2835_mbox_update(BCM2835MboxState *s)
  82 {
  83     uint32_t value;
  84     bool set;
  85     int n;
  86
  87     /* Avoid unwanted recursive calls */
  88     s->mbox_irq_disabled = true;
  89
  90     /* Get pending responses and put them in the vc->arm mbox,
  91      * as long as it's not full */
  92     for (n = 0; n < MBOX_CHAN_COUNT; n++) {
  93         while (s->available[n] && !(s->mbox[0].status & ARM_MS_FULL)) {
  94             value = ldl_phys(&s->mbox_as, n << MBOX_AS_CHAN_SHIFT);
  95             if (value == MBOX_INVALID_DATA) {
  96                 /* Interrupt pending, but there's no data. Hmmm... */
  97                 hw_error("%s: spurious interrupt on channel %d", __func__, n);
  98             }
  99             mbox_push(&s->mbox[0], value);
 100         }
 101     }
 102
 103     /* Try to push pending requests from the arm->vc mbox */
 104     /* TODO (?) */
 105
 106     /* Re-enable calls from the IRQ routine */
 107     s->mbox_irq_disabled = false;
 108
 109     /* Update ARM IRQ status */
 110     set = false;
 111     s->mbox[0].config &= ~ARM_MC_IHAVEDATAIRQPEND;
 112     if (!(s->mbox[0].status & ARM_MS_EMPTY)) {
 113         s->mbox[0].config |= ARM_MC_IHAVEDATAIRQPEND;
 114         if (s->mbox[0].config & ARM_MC_IHAVEDATAIRQEN) {
 115             set = true;
 116         }
 117     }
 118     qemu_set_irq(s->arm_irq, set);
 119 }
 120
 121 static void bcm2835_mbox_set_irq(void *opaque, int irq, int level)
 122 {
 123     BCM2835MboxState *s = opaque;
 124
 125     s->available[irq] = level;
 126
 127     /* avoid recursively calling bcm2835_mbox_update when the interrupt
 128      * status changes due to the ldl_phys call within that function */
 129     if (!s->mbox_irq_disabled) {
 130         bcm2835_mbox_update(s);
 131     }
 132 }
 133
 134 static uint64_t bcm2835_mbox_read(void *opaque, hwaddr offset, unsigned size)
 135 {
 136     BCM2835MboxState *s = opaque;
 137     uint32_t res = 0;
 138
 139     offset &= 0xff;
 140
 141     switch (offset) {
 142     case 0x80 ... 0x8c:  /* MAIL0_READ */
 143         if (s->mbox[0].status & ARM_MS_EMPTY) {
 144             res = MBOX_INVALID_DATA;
 145         } else {
 146             res = mbox_pull(&s->mbox[0], 0);
 147         }
 148         break;
 149     case 0x90:  /* MAIL0_PEEK */
 150         res = s->mbox[0].reg[0];
 151         break;
 152     case 0x94:  /* MAIL0_SENDER */
 153         break;
 154     case 0x98:  /* MAIL0_STATUS */
 155         res = s->mbox[0].status;
 156         break;
 157     case 0x9c:  /* MAIL0_CONFIG */
 158         res = s->mbox[0].config;
 159         break;
 160     case 0xb8:  /* MAIL1_STATUS */
 161         res = s->mbox[1].status;
 162         break;
 163     default:
 164         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
 165                       __func__, offset);
 166         return 0;
 167     }
 168
 169     bcm2835_mbox_update(s);
 170
 171     return res;
 172 }
 173
 174 static void bcm2835_mbox_write(void *opaque, hwaddr offset,
 175                                uint64_t value, unsigned size)
 176 {
 177     BCM2835MboxState *s = opaque;
 178     hwaddr childaddr;
 179     uint8_t ch;
 180
 181     offset &= 0xff;
 182
 183     switch (offset) {
 184     case 0x94:  /* MAIL0_SENDER */
 185         break;
 186
 187     case 0x9c:  /* MAIL0_CONFIG */
 188         s->mbox[0].config &= ~ARM_MC_IHAVEDATAIRQEN;
 189         s->mbox[0].config |= value & ARM_MC_IHAVEDATAIRQEN;
 190         break;
 191
 192     case 0xa0 ... 0xac:
 193         if (s->mbox[1].status & ARM_MS_FULL) {
 194             /* Mailbox full */
 195             qemu_log_mask(LOG_GUEST_ERROR, "%s: mailbox full\n", __func__);
 196         } else {
 197             ch = value & 0xf;
 198             if (ch < MBOX_CHAN_COUNT) {
 199                 childaddr = ch << MBOX_AS_CHAN_SHIFT;
 200                 if (ldl_phys(&s->mbox_as, childaddr + MBOX_AS_PENDING)) {
 201                     /* Child busy, push delayed. Push it in the arm->vc mbox */
 202                     mbox_push(&s->mbox[1], value);
 203                 } else {
 204                     /* Push it directly to the child device */
 205                     stl_phys(&s->mbox_as, childaddr, value);
 206                 }
 207             } else {
 208                 /* Invalid channel number */
 209                 qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid channel %u\n",
 210                               __func__, ch);
 211             }
 212         }
 213         break;
 214
 215     default:
 216         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
 217                       __func__, offset);
 218         return;
 219     }
 220
 221     bcm2835_mbox_update(s);
 222 }
 223
 224 static const MemoryRegionOps bcm2835_mbox_ops = {
 225     .read = bcm2835_mbox_read,
 226     .write = bcm2835_mbox_write,
 227     .endianness = DEVICE_NATIVE_ENDIAN,
 228     .valid.min_access_size = 4,
 229     .valid.max_access_size = 4,
 230 };
 231
 232 /* vmstate of a single mailbox */
 233 static const VMStateDescription vmstate_bcm2835_mbox_box = {
 234     .name = TYPE_BCM2835_MBOX "_box",
 235     .version_id = 1,
 236     .minimum_version_id = 1,
 237     .fields = (VMStateField[]) {
 238         VMSTATE_UINT32_ARRAY(reg, BCM2835Mbox, MBOX_SIZE),
 239         VMSTATE_UINT32(count, BCM2835Mbox),
 240         VMSTATE_UINT32(status, BCM2835Mbox),
 241         VMSTATE_UINT32(config, BCM2835Mbox),
 242         VMSTATE_END_OF_LIST()
 243     }
 244 };
 245
 246 /* vmstate of the entire device */
 247 static const VMStateDescription vmstate_bcm2835_mbox = {
 248     .name = TYPE_BCM2835_MBOX,
 249     .version_id = 1,
 250     .minimum_version_id = 1,
 251     .minimum_version_id_old = 1,
 252     .fields      = (VMStateField[]) {
 253         VMSTATE_BOOL_ARRAY(available, BCM2835MboxState, MBOX_CHAN_COUNT),
 254         VMSTATE_STRUCT_ARRAY(mbox, BCM2835MboxState, 2, 1,
 255                              vmstate_bcm2835_mbox_box, BCM2835Mbox),
 256         VMSTATE_END_OF_LIST()
 257     }
 258 };
 259
 260 static void bcm2835_mbox_init(Object *obj)
 261 {
 262     BCM2835MboxState *s = BCM2835_MBOX(obj);
 263     memory_region_init_io(&s->iomem, obj, &bcm2835_mbox_ops, s,
 264                           TYPE_BCM2835_MBOX, 0x400);
 265     sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
 266     sysbus_init_irq(SYS_BUS_DEVICE(s), &s->arm_irq);
 267     qdev_init_gpio_in(DEVICE(s), bcm2835_mbox_set_irq, MBOX_CHAN_COUNT);
 268 }
 269
 270 static void bcm2835_mbox_reset(DeviceState *dev)
 271 {
 272     BCM2835MboxState *s = BCM2835_MBOX(dev);
 273     int n;
 274
 275     mbox_init(&s->mbox[0]);
 276     mbox_init(&s->mbox[1]);
 277     s->mbox_irq_disabled = false;
 278     for (n = 0; n < MBOX_CHAN_COUNT; n++) {
 279         s->available[n] = false;
 280     }
 281 }
 282
 283 static void bcm2835_mbox_realize(DeviceState *dev, Error **errp)
 284 {
 285     BCM2835MboxState *s = BCM2835_MBOX(dev);
 286     Object *obj;
 287     Error *err = NULL;
 288
 289     obj = object_property_get_link(OBJECT(dev), "mbox_mr", &err);
 290     if (obj == NULL) {
 291         error_setg(errp, "%s: required mbox_mr link not found: %s",
 292                    __func__, error_get_pretty(err));
 293         return;
 294     }
 295
 296     s->mbox_mr = MEMORY_REGION(obj);
 297     address_space_init(&s->mbox_as, s->mbox_mr, NULL);
 298     bcm2835_mbox_reset(dev);
 299 }
 300
 301 static void bcm2835_mbox_class_init(ObjectClass *klass, void *data)
 302 {
 303     DeviceClass *dc = DEVICE_CLASS(klass);
 304
 305     dc->realize = bcm2835_mbox_realize;
 306     dc->reset = bcm2835_mbox_reset;
 307     dc->vmsd = &vmstate_bcm2835_mbox;
 308 }
 309
 310 static TypeInfo bcm2835_mbox_info = {
 311     .name          = TYPE_BCM2835_MBOX,
 312     .parent        = TYPE_SYS_BUS_DEVICE,
 313     .instance_size = sizeof(BCM2835MboxState),
 314     .class_init    = bcm2835_mbox_class_init,
 315     .instance_init = bcm2835_mbox_init,
 316 };
 317
 318 static void bcm2835_mbox_register_types(void)
 319 {
 320     type_register_static(&bcm2835_mbox_info);
 321 }
 322
 323 type_init(bcm2835_mbox_register_types)