hw/misc/bcm2835_mbox.c

   1 /*
   2  * Raspberry Pi emulation (c) 2012 Gregory Estrade
   3  * This code is licensed under the GNU GPLv2 and later.
   4  *
   5  * This file models the system mailboxes, which are used for
   6  * communication with low-bandwidth GPU peripherals. Refs:
   7  *   https://github.com/raspberrypi/firmware/wiki/Mailboxes
   8  *   https://github.com/raspberrypi/firmware/wiki/Accessing-mailboxes
   9  */
  10
  11 #include "qemu/osdep.h"
  12 #include "qapi/error.h"
  13 #include "hw/irq.h"
  14 #include "hw/misc/bcm2835_mbox.h"
  15 #include "migration/vmstate.h"
  16 #include "qemu/log.h"
  17 #include "qemu/module.h"
  18 #include "trace.h"
  19
  20 #define MAIL0_PEEK   0x90
  21 #define MAIL0_SENDER 0x94
  22 #define MAIL1_STATUS 0xb8
  23
  24 /* Mailbox status register */
  25 #define MAIL0_STATUS 0x98
  26 #define ARM_MS_FULL       0x80000000
  27 #define ARM_MS_EMPTY      0x40000000
  28 #define ARM_MS_LEVEL      0x400000FF /* Max. value depends on mailbox depth */
  29
  30 /* MAILBOX config/status register */
  31 #define MAIL0_CONFIG 0x9c
  32 /* ANY write to this register clears the error bits! */
  33 #define ARM_MC_IHAVEDATAIRQEN    0x00000001 /* mbox irq enable:  has data */
  34 #define ARM_MC_IHAVESPACEIRQEN   0x00000002 /* mbox irq enable:  has space */
  35 #define ARM_MC_OPPISEMPTYIRQEN   0x00000004 /* mbox irq enable: Opp is empty */
  36 #define ARM_MC_MAIL_CLEAR        0x00000008 /* mbox clear write 1, then  0 */
  37 #define ARM_MC_IHAVEDATAIRQPEND  0x00000010 /* mbox irq pending:  has space */
  38 #define ARM_MC_IHAVESPACEIRQPEND 0x00000020 /* mbox irq pending: Opp is empty */
  39 #define ARM_MC_OPPISEMPTYIRQPEND 0x00000040 /* mbox irq pending */
  40 /* Bit 7 is unused */
  41 #define ARM_MC_ERRNOOWN   0x00000100 /* error : none owner read from mailbox */
  42 #define ARM_MC_ERROVERFLW 0x00000200 /* error : write to fill mailbox */
  43 #define ARM_MC_ERRUNDRFLW 0x00000400 /* error : read from empty mailbox */
  44
  45 static void mbox_update_status(BCM2835Mbox *mb)
  46 {
  47     mb->status &= ~(ARM_MS_EMPTY | ARM_MS_FULL);
  48     if (mb->count == 0) {
  49         mb->status |= ARM_MS_EMPTY;
  50     } else if (mb->count == MBOX_SIZE) {
  51         mb->status |= ARM_MS_FULL;
  52     }
  53 }
  54
  55 static void mbox_reset(BCM2835Mbox *mb)
  56 {
  57     int n;
  58
  59     mb->count = 0;
  60     mb->config = 0;
  61     for (n = 0; n < MBOX_SIZE; n++) {
  62         mb->reg[n] = MBOX_INVALID_DATA;
  63     }
  64     mbox_update_status(mb);
  65 }
  66
  67 static uint32_t mbox_pull(BCM2835Mbox *mb, int index)
  68 {
  69     int n;
  70     uint32_t val;
  71
  72     assert(mb->count > 0);
  73     assert(index < mb->count);
  74
  75     val = mb->reg[index];
  76     for (n = index + 1; n < mb->count; n++) {
  77         mb->reg[n - 1] = mb->reg[n];
  78     }
  79     mb->count--;
  80     mb->reg[mb->count] = MBOX_INVALID_DATA;
  81
  82     mbox_update_status(mb);
  83
  84     return val;
  85 }
  86
  87 static void mbox_push(BCM2835Mbox *mb, uint32_t val)
  88 {
  89     assert(mb->count < MBOX_SIZE);
  90     mb->reg[mb->count++] = val;
  91     mbox_update_status(mb);
  92 }
  93
  94 static void bcm2835_mbox_update(BCM2835MboxState *s)
  95 {
  96     uint32_t value;
  97     bool set;
  98     int n;
  99
 100     s->mbox_irq_disabled = true;
 101
 102     /* Get pending responses and put them in the vc->arm mbox,
 103      * as long as it's not full
 104      */
 105     for (n = 0; n < MBOX_CHAN_COUNT; n++) {
 106         while (s->available[n] && !(s->mbox[0].status & ARM_MS_FULL)) {
 107             value = ldl_le_phys(&s->mbox_as, n << MBOX_AS_CHAN_SHIFT);
 108             assert(value != MBOX_INVALID_DATA); /* Pending interrupt but no data */
 109             mbox_push(&s->mbox[0], value);
 110         }
 111     }
 112
 113     /* TODO (?): Try to push pending requests from the arm->vc mbox */
 114
 115     /* Re-enable calls from the IRQ routine */
 116     s->mbox_irq_disabled = false;
 117
 118     /* Update ARM IRQ status */
 119     set = false;
 120     s->mbox[0].config &= ~ARM_MC_IHAVEDATAIRQPEND;
 121     if (!(s->mbox[0].status & ARM_MS_EMPTY)) {
 122         s->mbox[0].config |= ARM_MC_IHAVEDATAIRQPEND;
 123         if (s->mbox[0].config & ARM_MC_IHAVEDATAIRQEN) {
 124             set = true;
 125         }
 126     }
 127     trace_bcm2835_mbox_irq(set);
 128     qemu_set_irq(s->arm_irq, set);
 129 }
 130
 131 static void bcm2835_mbox_set_irq(void *opaque, int irq, int level)
 132 {
 133     BCM2835MboxState *s = opaque;
 134
 135     s->available[irq] = level;
 136
 137     /* avoid recursively calling bcm2835_mbox_update when the interrupt
 138      * status changes due to the ldl_phys call within that function
 139      */
 140     if (!s->mbox_irq_disabled) {
 141         bcm2835_mbox_update(s);
 142     }
 143 }
 144
 145 static uint64_t bcm2835_mbox_read(void *opaque, hwaddr offset, unsigned size)
 146 {
 147     BCM2835MboxState *s = opaque;
 148     uint32_t res = 0;
 149
 150     offset &= 0xff;
 151
 152     switch (offset) {
 153     case 0x80 ... 0x8c: /* MAIL0_READ */
 154         if (s->mbox[0].status & ARM_MS_EMPTY) {
 155             res = MBOX_INVALID_DATA;
 156         } else {
 157             res = mbox_pull(&s->mbox[0], 0);
 158         }
 159         break;
 160
 161     case MAIL0_PEEK:
 162         res = s->mbox[0].reg[0];
 163         break;
 164
 165     case MAIL0_SENDER:
 166         break;
 167
 168     case MAIL0_STATUS:
 169         res = s->mbox[0].status;
 170         break;
 171
 172     case MAIL0_CONFIG:
 173         res = s->mbox[0].config;
 174         break;
 175
 176     case MAIL1_STATUS:
 177         res = s->mbox[1].status;
 178         break;
 179
 180     default:
 181         qemu_log_mask(LOG_UNIMP, "%s: Unsupported offset 0x%"HWADDR_PRIx"\n",
 182                       __func__, offset);
 183         trace_bcm2835_mbox_read(size, offset, res);
 184         return 0;
 185     }
 186     trace_bcm2835_mbox_read(size, offset, res);
 187
 188     bcm2835_mbox_update(s);
 189
 190     return res;
 191 }
 192
 193 static void bcm2835_mbox_write(void *opaque, hwaddr offset,
 194                                uint64_t value, unsigned size)
 195 {
 196     BCM2835MboxState *s = opaque;
 197     hwaddr childaddr;
 198     uint8_t ch;
 199
 200     offset &= 0xff;
 201
 202     trace_bcm2835_mbox_write(size, offset, value);
 203     switch (offset) {
 204     case MAIL0_SENDER:
 205         break;
 206
 207     case MAIL0_CONFIG:
 208         s->mbox[0].config &= ~ARM_MC_IHAVEDATAIRQEN;
 209         s->mbox[0].config |= value & ARM_MC_IHAVEDATAIRQEN;
 210         break;
 211
 212     case 0xa0 ... 0xac: /* MAIL1_WRITE */
 213         if (s->mbox[1].status & ARM_MS_FULL) {
 214             /* Mailbox full */
 215             qemu_log_mask(LOG_GUEST_ERROR, "%s: mailbox full\n", __func__);
 216         } else {
 217             ch = value & 0xf;
 218             if (ch < MBOX_CHAN_COUNT) {
 219                 childaddr = ch << MBOX_AS_CHAN_SHIFT;
 220                 if (ldl_le_phys(&s->mbox_as, childaddr + MBOX_AS_PENDING)) {
 221                     /* Child busy, push delayed. Push it in the arm->vc mbox */
 222                     mbox_push(&s->mbox[1], value);
 223                 } else {
 224                     /* Push it directly to the child device */
 225                     stl_le_phys(&s->mbox_as, childaddr, value);
 226                 }
 227             } else {
 228                 /* Invalid channel number */
 229                 qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid channel %u\n",
 230                               __func__, ch);
 231             }
 232         }
 233         break;
 234
 235     default:
 236         qemu_log_mask(LOG_UNIMP, "%s: Unsupported offset 0x%"HWADDR_PRIx
 237                                  " value 0x%"PRIx64"\n",
 238                       __func__, offset, value);
 239         return;
 240     }
 241
 242     bcm2835_mbox_update(s);
 243 }
 244
 245 static const MemoryRegionOps bcm2835_mbox_ops = {
 246     .read = bcm2835_mbox_read,
 247     .write = bcm2835_mbox_write,
 248     .endianness = DEVICE_NATIVE_ENDIAN,
 249     .valid.min_access_size = 4,
 250     .valid.max_access_size = 4,
 251 };
 252
 253 /* vmstate of a single mailbox */
 254 static const VMStateDescription vmstate_bcm2835_mbox_box = {
 255     .name = TYPE_BCM2835_MBOX "_box",
 256     .version_id = 1,
 257     .minimum_version_id = 1,
 258     .fields = (VMStateField[]) {
 259         VMSTATE_UINT32_ARRAY(reg, BCM2835Mbox, MBOX_SIZE),
 260         VMSTATE_UINT32(count, BCM2835Mbox),
 261         VMSTATE_UINT32(status, BCM2835Mbox),
 262         VMSTATE_UINT32(config, BCM2835Mbox),
 263         VMSTATE_END_OF_LIST()
 264     }
 265 };
 266
 267 /* vmstate of the entire device */
 268 static const VMStateDescription vmstate_bcm2835_mbox = {
 269     .name = TYPE_BCM2835_MBOX,
 270     .version_id = 1,
 271     .minimum_version_id = 1,
 272     .minimum_version_id_old = 1,
 273     .fields      = (VMStateField[]) {
 274         VMSTATE_BOOL_ARRAY(available, BCM2835MboxState, MBOX_CHAN_COUNT),
 275         VMSTATE_STRUCT_ARRAY(mbox, BCM2835MboxState, 2, 1,
 276                              vmstate_bcm2835_mbox_box, BCM2835Mbox),
 277         VMSTATE_END_OF_LIST()
 278     }
 279 };
 280
 281 static void bcm2835_mbox_init(Object *obj)
 282 {
 283     BCM2835MboxState *s = BCM2835_MBOX(obj);
 284
 285     memory_region_init_io(&s->iomem, obj, &bcm2835_mbox_ops, s,
 286                           TYPE_BCM2835_MBOX, 0x400);
 287     sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
 288     sysbus_init_irq(SYS_BUS_DEVICE(s), &s->arm_irq);
 289     qdev_init_gpio_in(DEVICE(s), bcm2835_mbox_set_irq, MBOX_CHAN_COUNT);
 290 }
 291
 292 static void bcm2835_mbox_reset(DeviceState *dev)
 293 {
 294     BCM2835MboxState *s = BCM2835_MBOX(dev);
 295     int n;
 296
 297     mbox_reset(&s->mbox[0]);
 298     mbox_reset(&s->mbox[1]);
 299     s->mbox_irq_disabled = false;
 300     for (n = 0; n < MBOX_CHAN_COUNT; n++) {
 301         s->available[n] = false;
 302     }
 303 }
 304
 305 static void bcm2835_mbox_realize(DeviceState *dev, Error **errp)
 306 {
 307     BCM2835MboxState *s = BCM2835_MBOX(dev);
 308     Object *obj;
 309     Error *err = NULL;
 310
 311     obj = object_property_get_link(OBJECT(dev), "mbox-mr", &err);
 312     if (obj == NULL) {
 313         error_setg(errp, "%s: required mbox-mr link not found: %s",
 314                    __func__, error_get_pretty(err));
 315         return;
 316     }
 317
 318     s->mbox_mr = MEMORY_REGION(obj);
 319     address_space_init(&s->mbox_as, s->mbox_mr, TYPE_BCM2835_MBOX "-memory");
 320     bcm2835_mbox_reset(dev);
 321 }
 322
 323 static void bcm2835_mbox_class_init(ObjectClass *klass, void *data)
 324 {
 325     DeviceClass *dc = DEVICE_CLASS(klass);
 326
 327     dc->realize = bcm2835_mbox_realize;
 328     dc->reset = bcm2835_mbox_reset;
 329     dc->vmsd = &vmstate_bcm2835_mbox;
 330 }
 331
 332 static TypeInfo bcm2835_mbox_info = {
 333     .name          = TYPE_BCM2835_MBOX,
 334     .parent        = TYPE_SYS_BUS_DEVICE,
 335     .instance_size = sizeof(BCM2835MboxState),
 336     .class_init    = bcm2835_mbox_class_init,
 337     .instance_init = bcm2835_mbox_init,
 338 };
 339
 340 static void bcm2835_mbox_register_types(void)
 341 {
 342     type_register_static(&bcm2835_mbox_info);
 343 }
 344
 345 type_init(bcm2835_mbox_register_types)