hw/misc/bcm2835_property.c

   1 /*
   2  * Raspberry Pi emulation (c) 2012 Gregory Estrade
   3  *
   4  * This work is licensed under the terms of the GNU GPL, version 2 or later.
   5  * See the COPYING file in the top-level directory.
   6  */
   7
   8 #include "qemu/osdep.h"
   9 #include "qapi/error.h"
  10 #include "hw/misc/bcm2835_property.h"
  11 #include "hw/qdev-properties.h"
  12 #include "migration/vmstate.h"
  13 #include "hw/irq.h"
  14 #include "hw/misc/bcm2835_mbox_defs.h"
  15 #include "hw/arm/raspberrypi-fw-defs.h"
  16 #include "sysemu/dma.h"
  17 #include "qemu/log.h"
  18 #include "qemu/module.h"
  19 #include "trace.h"
  20 #include "hw/arm/raspi_platform.h"
  21
  22 /* https://github.com/raspberrypi/firmware/wiki/Mailbox-property-interface */
  23
  24 static void bcm2835_property_mbox_push(BCM2835PropertyState *s, uint32_t value)
  25 {
  26     uint32_t tag;
  27     uint32_t bufsize;
  28     uint32_t tot_len;
  29     size_t resplen;
  30     uint32_t tmp;
  31     int n;
  32     uint32_t offset, length, color;
  33
  34     /*
  35      * Copy the current state of the framebuffer config; we will update
  36      * this copy as we process tags and then ask the framebuffer to use
  37      * it at the end.
  38      */
  39     BCM2835FBConfig fbconfig = s->fbdev->config;
  40     bool fbconfig_updated = false;
  41
  42     value &= ~0xf;
  43
  44     s->addr = value;
  45
  46     tot_len = ldl_le_phys(&s->dma_as, value);
  47
  48     /* @(addr + 4) : Buffer response code */
  49     value = s->addr + 8;
  50     while (value + 8 <= s->addr + tot_len) {
  51         tag = ldl_le_phys(&s->dma_as, value);
  52         bufsize = ldl_le_phys(&s->dma_as, value + 4);
  53         /* @(value + 8) : Request/response indicator */
  54         resplen = 0;
  55         switch (tag) {
  56         case RPI_FWREQ_PROPERTY_END:
  57             break;
  58         case RPI_FWREQ_GET_FIRMWARE_REVISION:
  59             stl_le_phys(&s->dma_as, value + 12, 346337);
  60             resplen = 4;
  61             break;
  62         case RPI_FWREQ_GET_BOARD_MODEL:
  63             qemu_log_mask(LOG_UNIMP,
  64                           "bcm2835_property: 0x%08x get board model NYI\n",
  65                           tag);
  66             resplen = 4;
  67             break;
  68         case RPI_FWREQ_GET_BOARD_REVISION:
  69             stl_le_phys(&s->dma_as, value + 12, s->board_rev);
  70             resplen = 4;
  71             break;
  72         case RPI_FWREQ_GET_BOARD_MAC_ADDRESS:
  73             resplen = sizeof(s->macaddr.a);
  74             dma_memory_write(&s->dma_as, value + 12, s->macaddr.a, resplen,
  75                              MEMTXATTRS_UNSPECIFIED);
  76             break;
  77         case RPI_FWREQ_GET_BOARD_SERIAL:
  78             qemu_log_mask(LOG_UNIMP,
  79                           "bcm2835_property: 0x%08x get board serial NYI\n",
  80                           tag);
  81             resplen = 8;
  82             break;
  83         case RPI_FWREQ_GET_ARM_MEMORY:
  84             /* base */
  85             stl_le_phys(&s->dma_as, value + 12, 0);
  86             /* size */
  87             stl_le_phys(&s->dma_as, value + 16, s->fbdev->vcram_base);
  88             resplen = 8;
  89             break;
  90         case RPI_FWREQ_GET_VC_MEMORY:
  91             /* base */
  92             stl_le_phys(&s->dma_as, value + 12, s->fbdev->vcram_base);
  93             /* size */
  94             stl_le_phys(&s->dma_as, value + 16, s->fbdev->vcram_size);
  95             resplen = 8;
  96             break;
  97         case RPI_FWREQ_SET_POWER_STATE:
  98             /* Assume that whatever device they asked for exists,
  99              * and we'll just claim we set it to the desired state
 100              */
 101             tmp = ldl_le_phys(&s->dma_as, value + 16);
 102             stl_le_phys(&s->dma_as, value + 16, (tmp & 1));
 103             resplen = 8;
 104             break;
 105
 106         /* Clocks */
 107
 108         case RPI_FWREQ_GET_CLOCK_STATE:
 109             stl_le_phys(&s->dma_as, value + 16, 0x1);
 110             resplen = 8;
 111             break;
 112
 113         case RPI_FWREQ_SET_CLOCK_STATE:
 114             qemu_log_mask(LOG_UNIMP,
 115                           "bcm2835_property: 0x%08x set clock state NYI\n",
 116                           tag);
 117             resplen = 8;
 118             break;
 119
 120         case RPI_FWREQ_GET_CLOCK_RATE:
 121         case RPI_FWREQ_GET_MAX_CLOCK_RATE:
 122         case RPI_FWREQ_GET_MIN_CLOCK_RATE:
 123             switch (ldl_le_phys(&s->dma_as, value + 12)) {
 124             case RPI_FIRMWARE_EMMC_CLK_ID:
 125                 stl_le_phys(&s->dma_as, value + 16, RPI_FIRMWARE_EMMC_CLK_RATE);
 126                 break;
 127             case RPI_FIRMWARE_UART_CLK_ID:
 128                 stl_le_phys(&s->dma_as, value + 16, RPI_FIRMWARE_UART_CLK_RATE);
 129                 break;
 130             case RPI_FIRMWARE_CORE_CLK_ID:
 131                 stl_le_phys(&s->dma_as, value + 16, RPI_FIRMWARE_CORE_CLK_RATE);
 132                 break;
 133             default:
 134                 stl_le_phys(&s->dma_as, value + 16,
 135                             RPI_FIRMWARE_DEFAULT_CLK_RATE);
 136                 break;
 137             }
 138             resplen = 8;
 139             break;
 140
 141         case RPI_FWREQ_SET_CLOCK_RATE:
 142         case RPI_FWREQ_SET_MAX_CLOCK_RATE:
 143         case RPI_FWREQ_SET_MIN_CLOCK_RATE:
 144             qemu_log_mask(LOG_UNIMP,
 145                           "bcm2835_property: 0x%08x set clock rate NYI\n",
 146                           tag);
 147             resplen = 8;
 148             break;
 149
 150         /* Temperature */
 151
 152         case RPI_FWREQ_GET_TEMPERATURE:
 153             stl_le_phys(&s->dma_as, value + 16, 25000);
 154             resplen = 8;
 155             break;
 156
 157         case RPI_FWREQ_GET_MAX_TEMPERATURE:
 158             stl_le_phys(&s->dma_as, value + 16, 99000);
 159             resplen = 8;
 160             break;
 161
 162         /* Frame buffer */
 163
 164         case RPI_FWREQ_FRAMEBUFFER_ALLOCATE:
 165             stl_le_phys(&s->dma_as, value + 12, fbconfig.base);
 166             stl_le_phys(&s->dma_as, value + 16,
 167                         bcm2835_fb_get_size(&fbconfig));
 168             resplen = 8;
 169             break;
 170         case RPI_FWREQ_FRAMEBUFFER_RELEASE:
 171             resplen = 0;
 172             break;
 173         case RPI_FWREQ_FRAMEBUFFER_BLANK:
 174             resplen = 4;
 175             break;
 176         case RPI_FWREQ_FRAMEBUFFER_TEST_PHYSICAL_WIDTH_HEIGHT:
 177         case RPI_FWREQ_FRAMEBUFFER_TEST_VIRTUAL_WIDTH_HEIGHT:
 178             resplen = 8;
 179             break;
 180         case RPI_FWREQ_FRAMEBUFFER_SET_PHYSICAL_WIDTH_HEIGHT:
 181             fbconfig.xres = ldl_le_phys(&s->dma_as, value + 12);
 182             fbconfig.yres = ldl_le_phys(&s->dma_as, value + 16);
 183             bcm2835_fb_validate_config(&fbconfig);
 184             fbconfig_updated = true;
 185             /* fall through */
 186         case RPI_FWREQ_FRAMEBUFFER_GET_PHYSICAL_WIDTH_HEIGHT:
 187             stl_le_phys(&s->dma_as, value + 12, fbconfig.xres);
 188             stl_le_phys(&s->dma_as, value + 16, fbconfig.yres);
 189             resplen = 8;
 190             break;
 191         case RPI_FWREQ_FRAMEBUFFER_SET_VIRTUAL_WIDTH_HEIGHT:
 192             fbconfig.xres_virtual = ldl_le_phys(&s->dma_as, value + 12);
 193             fbconfig.yres_virtual = ldl_le_phys(&s->dma_as, value + 16);
 194             bcm2835_fb_validate_config(&fbconfig);
 195             fbconfig_updated = true;
 196             /* fall through */
 197         case RPI_FWREQ_FRAMEBUFFER_GET_VIRTUAL_WIDTH_HEIGHT:
 198             stl_le_phys(&s->dma_as, value + 12, fbconfig.xres_virtual);
 199             stl_le_phys(&s->dma_as, value + 16, fbconfig.yres_virtual);
 200             resplen = 8;
 201             break;
 202         case RPI_FWREQ_FRAMEBUFFER_TEST_DEPTH:
 203             resplen = 4;
 204             break;
 205         case RPI_FWREQ_FRAMEBUFFER_SET_DEPTH:
 206             fbconfig.bpp = ldl_le_phys(&s->dma_as, value + 12);
 207             bcm2835_fb_validate_config(&fbconfig);
 208             fbconfig_updated = true;
 209             /* fall through */
 210         case RPI_FWREQ_FRAMEBUFFER_GET_DEPTH:
 211             stl_le_phys(&s->dma_as, value + 12, fbconfig.bpp);
 212             resplen = 4;
 213             break;
 214         case RPI_FWREQ_FRAMEBUFFER_TEST_PIXEL_ORDER:
 215             resplen = 4;
 216             break;
 217         case RPI_FWREQ_FRAMEBUFFER_SET_PIXEL_ORDER:
 218             fbconfig.pixo = ldl_le_phys(&s->dma_as, value + 12);
 219             bcm2835_fb_validate_config(&fbconfig);
 220             fbconfig_updated = true;
 221             /* fall through */
 222         case RPI_FWREQ_FRAMEBUFFER_GET_PIXEL_ORDER:
 223             stl_le_phys(&s->dma_as, value + 12, fbconfig.pixo);
 224             resplen = 4;
 225             break;
 226         case RPI_FWREQ_FRAMEBUFFER_TEST_ALPHA_MODE:
 227             resplen = 4;
 228             break;
 229         case RPI_FWREQ_FRAMEBUFFER_SET_ALPHA_MODE:
 230             fbconfig.alpha = ldl_le_phys(&s->dma_as, value + 12);
 231             bcm2835_fb_validate_config(&fbconfig);
 232             fbconfig_updated = true;
 233             /* fall through */
 234         case RPI_FWREQ_FRAMEBUFFER_GET_ALPHA_MODE:
 235             stl_le_phys(&s->dma_as, value + 12, fbconfig.alpha);
 236             resplen = 4;
 237             break;
 238         case RPI_FWREQ_FRAMEBUFFER_GET_PITCH:
 239             stl_le_phys(&s->dma_as, value + 12,
 240                         bcm2835_fb_get_pitch(&fbconfig));
 241             resplen = 4;
 242             break;
 243         case RPI_FWREQ_FRAMEBUFFER_TEST_VIRTUAL_OFFSET:
 244             resplen = 8;
 245             break;
 246         case RPI_FWREQ_FRAMEBUFFER_SET_VIRTUAL_OFFSET:
 247             fbconfig.xoffset = ldl_le_phys(&s->dma_as, value + 12);
 248             fbconfig.yoffset = ldl_le_phys(&s->dma_as, value + 16);
 249             bcm2835_fb_validate_config(&fbconfig);
 250             fbconfig_updated = true;
 251             /* fall through */
 252         case RPI_FWREQ_FRAMEBUFFER_GET_VIRTUAL_OFFSET:
 253             stl_le_phys(&s->dma_as, value + 12, fbconfig.xoffset);
 254             stl_le_phys(&s->dma_as, value + 16, fbconfig.yoffset);
 255             resplen = 8;
 256             break;
 257         case RPI_FWREQ_FRAMEBUFFER_GET_OVERSCAN:
 258         case RPI_FWREQ_FRAMEBUFFER_TEST_OVERSCAN:
 259         case RPI_FWREQ_FRAMEBUFFER_SET_OVERSCAN:
 260             stl_le_phys(&s->dma_as, value + 12, 0);
 261             stl_le_phys(&s->dma_as, value + 16, 0);
 262             stl_le_phys(&s->dma_as, value + 20, 0);
 263             stl_le_phys(&s->dma_as, value + 24, 0);
 264             resplen = 16;
 265             break;
 266         case RPI_FWREQ_FRAMEBUFFER_SET_PALETTE:
 267             offset = ldl_le_phys(&s->dma_as, value + 12);
 268             length = ldl_le_phys(&s->dma_as, value + 16);
 269             n = 0;
 270             while (n < length - offset) {
 271                 color = ldl_le_phys(&s->dma_as, value + 20 + (n << 2));
 272                 stl_le_phys(&s->dma_as,
 273                             s->fbdev->vcram_base + ((offset + n) << 2), color);
 274                 n++;
 275             }
 276             stl_le_phys(&s->dma_as, value + 12, 0);
 277             resplen = 4;
 278             break;
 279         case RPI_FWREQ_FRAMEBUFFER_GET_NUM_DISPLAYS:
 280             stl_le_phys(&s->dma_as, value + 12, 1);
 281             resplen = 4;
 282             break;
 283
 284         case RPI_FWREQ_GET_DMA_CHANNELS:
 285             /* channels 2-5 */
 286             stl_le_phys(&s->dma_as, value + 12, 0x003C);
 287             resplen = 4;
 288             break;
 289
 290         case RPI_FWREQ_GET_COMMAND_LINE:
 291             /*
 292              * We follow the firmware behaviour: no NUL terminator is
 293              * written to the buffer, and if the buffer is too short
 294              * we report the required length in the response header
 295              * and copy nothing to the buffer.
 296              */
 297             resplen = strlen(s->command_line);
 298             if (bufsize >= resplen)
 299                 address_space_write(&s->dma_as, value + 12,
 300                                     MEMTXATTRS_UNSPECIFIED, s->command_line,
 301                                     resplen);
 302             break;
 303
 304         default:
 305             qemu_log_mask(LOG_UNIMP,
 306                           "bcm2835_property: unhandled tag 0x%08x\n", tag);
 307             break;
 308         }
 309
 310         trace_bcm2835_mbox_property(tag, bufsize, resplen);
 311         if (tag == 0) {
 312             break;
 313         }
 314
 315         stl_le_phys(&s->dma_as, value + 8, (1 << 31) | resplen);
 316         value += bufsize + 12;
 317     }
 318
 319     /* Reconfigure framebuffer if required */
 320     if (fbconfig_updated) {
 321         bcm2835_fb_reconfigure(s->fbdev, &fbconfig);
 322     }
 323
 324     /* Buffer response code */
 325     stl_le_phys(&s->dma_as, s->addr + 4, (1 << 31));
 326 }
 327
 328 static uint64_t bcm2835_property_read(void *opaque, hwaddr offset,
 329                                       unsigned size)
 330 {
 331     BCM2835PropertyState *s = opaque;
 332     uint32_t res = 0;
 333
 334     switch (offset) {
 335     case MBOX_AS_DATA:
 336         res = MBOX_CHAN_PROPERTY | s->addr;
 337         s->pending = false;
 338         qemu_set_irq(s->mbox_irq, 0);
 339         break;
 340
 341     case MBOX_AS_PENDING:
 342         res = s->pending;
 343         break;
 344
 345     default:
 346         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
 347                       __func__, offset);
 348         return 0;
 349     }
 350
 351     return res;
 352 }
 353
 354 static void bcm2835_property_write(void *opaque, hwaddr offset,
 355                                    uint64_t value, unsigned size)
 356 {
 357     BCM2835PropertyState *s = opaque;
 358
 359     switch (offset) {
 360     case MBOX_AS_DATA:
 361         /* bcm2835_mbox should check our pending status before pushing */
 362         assert(!s->pending);
 363         s->pending = true;
 364         bcm2835_property_mbox_push(s, value);
 365         qemu_set_irq(s->mbox_irq, 1);
 366         break;
 367
 368     default:
 369         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
 370                       __func__, offset);
 371         return;
 372     }
 373 }
 374
 375 static const MemoryRegionOps bcm2835_property_ops = {
 376     .read = bcm2835_property_read,
 377     .write = bcm2835_property_write,
 378     .endianness = DEVICE_NATIVE_ENDIAN,
 379     .valid.min_access_size = 4,
 380     .valid.max_access_size = 4,
 381 };
 382
 383 static const VMStateDescription vmstate_bcm2835_property = {
 384     .name = TYPE_BCM2835_PROPERTY,
 385     .version_id = 1,
 386     .minimum_version_id = 1,
 387     .fields      = (VMStateField[]) {
 388         VMSTATE_MACADDR(macaddr, BCM2835PropertyState),
 389         VMSTATE_UINT32(addr, BCM2835PropertyState),
 390         VMSTATE_BOOL(pending, BCM2835PropertyState),
 391         VMSTATE_END_OF_LIST()
 392     }
 393 };
 394
 395 static void bcm2835_property_init(Object *obj)
 396 {
 397     BCM2835PropertyState *s = BCM2835_PROPERTY(obj);
 398
 399     memory_region_init_io(&s->iomem, OBJECT(s), &bcm2835_property_ops, s,
 400                           TYPE_BCM2835_PROPERTY, 0x10);
 401
 402     /*
 403      * bcm2835_property_ops call into bcm2835_mbox, which in-turn reads from
 404      * iomem. As such, mark iomem as re-entracy safe.
 405      */
 406     s->iomem.disable_reentrancy_guard = true;
 407
 408     sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
 409     sysbus_init_irq(SYS_BUS_DEVICE(s), &s->mbox_irq);
 410 }
 411
 412 static void bcm2835_property_reset(DeviceState *dev)
 413 {
 414     BCM2835PropertyState *s = BCM2835_PROPERTY(dev);
 415
 416     s->pending = false;
 417 }
 418
 419 static void bcm2835_property_realize(DeviceState *dev, Error **errp)
 420 {
 421     BCM2835PropertyState *s = BCM2835_PROPERTY(dev);
 422     Object *obj;
 423
 424     obj = object_property_get_link(OBJECT(dev), "fb", &error_abort);
 425     s->fbdev = BCM2835_FB(obj);
 426
 427     obj = object_property_get_link(OBJECT(dev), "dma-mr", &error_abort);
 428     s->dma_mr = MEMORY_REGION(obj);
 429     address_space_init(&s->dma_as, s->dma_mr, TYPE_BCM2835_PROPERTY "-memory");
 430
 431     /* TODO: connect to MAC address of USB NIC device, once we emulate it */
 432     qemu_macaddr_default_if_unset(&s->macaddr);
 433
 434     bcm2835_property_reset(dev);
 435 }
 436
 437 static Property bcm2835_property_props[] = {
 438     DEFINE_PROP_UINT32("board-rev", BCM2835PropertyState, board_rev, 0),
 439     DEFINE_PROP_STRING("command-line", BCM2835PropertyState, command_line),
 440     DEFINE_PROP_END_OF_LIST()
 441 };
 442
 443 static void bcm2835_property_class_init(ObjectClass *klass, void *data)
 444 {
 445     DeviceClass *dc = DEVICE_CLASS(klass);
 446
 447     device_class_set_props(dc, bcm2835_property_props);
 448     dc->realize = bcm2835_property_realize;
 449     dc->vmsd = &vmstate_bcm2835_property;
 450 }
 451
 452 static const TypeInfo bcm2835_property_info = {
 453     .name          = TYPE_BCM2835_PROPERTY,
 454     .parent        = TYPE_SYS_BUS_DEVICE,
 455     .instance_size = sizeof(BCM2835PropertyState),
 456     .class_init    = bcm2835_property_class_init,
 457     .instance_init = bcm2835_property_init,
 458 };
 459
 460 static void bcm2835_property_register_types(void)
 461 {
 462     type_register_static(&bcm2835_property_info);
 463 }
 464
 465 type_init(bcm2835_property_register_types)