hw/misc/bcm2835_mbox.c - qemu-android - Git at Google

 /*
  * Raspberry Pi emulation (c) 2012 Gregory Estrade
  * This code is licensed under the GNU GPLv2 and later.
  *
  * This file models the system mailboxes, which are used for
  * communication with low-bandwidth GPU peripherals. Refs:
  *   https://github.com/raspberrypi/firmware/wiki/Mailboxes
  *   https://github.com/raspberrypi/firmware/wiki/Accessing-mailboxes
  */

 #include "qemu/osdep.h"
 #include "qapi/error.h"
 #include "hw/misc/bcm2835_mbox.h"
 #include "qemu/log.h"

 #define MAIL0_PEEK   0x90
 #define MAIL0_SENDER 0x94
 #define MAIL1_STATUS 0xb8

 /* Mailbox status register */
 #define MAIL0_STATUS 0x98
 #define ARM_MS_FULL       0x80000000
 #define ARM_MS_EMPTY      0x40000000
 #define ARM_MS_LEVEL      0x400000FF /* Max. value depends on mailbox depth */

 /* MAILBOX config/status register */
 #define MAIL0_CONFIG 0x9c
 /* ANY write to this register clears the error bits! */
 #define ARM_MC_IHAVEDATAIRQEN    0x00000001 /* mbox irq enable:  has data */
 #define ARM_MC_IHAVESPACEIRQEN   0x00000002 /* mbox irq enable:  has space */
 #define ARM_MC_OPPISEMPTYIRQEN   0x00000004 /* mbox irq enable: Opp is empty */
 #define ARM_MC_MAIL_CLEAR        0x00000008 /* mbox clear write 1, then  0 */
 #define ARM_MC_IHAVEDATAIRQPEND  0x00000010 /* mbox irq pending:  has space */
 #define ARM_MC_IHAVESPACEIRQPEND 0x00000020 /* mbox irq pending: Opp is empty */
 #define ARM_MC_OPPISEMPTYIRQPEND 0x00000040 /* mbox irq pending */
 /* Bit 7 is unused */
 #define ARM_MC_ERRNOOWN   0x00000100 /* error : none owner read from mailbox */
 #define ARM_MC_ERROVERFLW 0x00000200 /* error : write to fill mailbox */
 #define ARM_MC_ERRUNDRFLW 0x00000400 /* error : read from empty mailbox */

 static void mbox_update_status(BCM2835Mbox *mb)
 {
     mb->status &= ~(ARM_MS_EMPTY | ARM_MS_FULL);
     if (mb->count == 0) {
         mb->status |= ARM_MS_EMPTY;
     } else if (mb->count == MBOX_SIZE) {
         mb->status |= ARM_MS_FULL;
     }
 }

 static void mbox_reset(BCM2835Mbox *mb)
 {
     int n;

     mb->count = 0;
     mb->config = 0;
     for (n = 0; n < MBOX_SIZE; n++) {
         mb->reg[n] = MBOX_INVALID_DATA;
     }
     mbox_update_status(mb);
 }

 static uint32_t mbox_pull(BCM2835Mbox *mb, int index)
 {
     int n;
     uint32_t val;

     assert(mb->count > 0);
     assert(index < mb->count);

     val = mb->reg[index];
     for (n = index + 1; n < mb->count; n++) {
         mb->reg[n - 1] = mb->reg[n];
     }
     mb->count--;
     mb->reg[mb->count] = MBOX_INVALID_DATA;

     mbox_update_status(mb);

     return val;
 }

 static void mbox_push(BCM2835Mbox *mb, uint32_t val)
 {
     assert(mb->count < MBOX_SIZE);
     mb->reg[mb->count++] = val;
     mbox_update_status(mb);
 }

 static void bcm2835_mbox_update(BCM2835MboxState *s)
 {
     uint32_t value;
     bool set;
     int n;

     s->mbox_irq_disabled = true;

     /* Get pending responses and put them in the vc->arm mbox,
      * as long as it's not full
      */
     for (n = 0; n < MBOX_CHAN_COUNT; n++) {
         while (s->available[n] && !(s->mbox[0].status & ARM_MS_FULL)) {
             value = ldl_le_phys(&s->mbox_as, n << MBOX_AS_CHAN_SHIFT);
             assert(value != MBOX_INVALID_DATA); /* Pending interrupt but no data */
             mbox_push(&s->mbox[0], value);
         }
     }

     /* TODO (?): Try to push pending requests from the arm->vc mbox */

     /* Re-enable calls from the IRQ routine */
     s->mbox_irq_disabled = false;

     /* Update ARM IRQ status */
     set = false;
     s->mbox[0].config &= ~ARM_MC_IHAVEDATAIRQPEND;
     if (!(s->mbox[0].status & ARM_MS_EMPTY)) {
         s->mbox[0].config |= ARM_MC_IHAVEDATAIRQPEND;
         if (s->mbox[0].config & ARM_MC_IHAVEDATAIRQEN) {
             set = true;
         }
     }
     qemu_set_irq(s->arm_irq, set);
 }

 static void bcm2835_mbox_set_irq(void *opaque, int irq, int level)
 {
     BCM2835MboxState *s = opaque;

     s->available[irq] = level;

     /* avoid recursively calling bcm2835_mbox_update when the interrupt
      * status changes due to the ldl_phys call within that function
      */
     if (!s->mbox_irq_disabled) {
         bcm2835_mbox_update(s);
     }
 }

 static uint64_t bcm2835_mbox_read(void *opaque, hwaddr offset, unsigned size)
 {
     BCM2835MboxState *s = opaque;
     uint32_t res = 0;

     offset &= 0xff;

     switch (offset) {
     case 0x80 ... 0x8c: /* MAIL0_READ */
         if (s->mbox[0].status & ARM_MS_EMPTY) {
             res = MBOX_INVALID_DATA;
         } else {
             res = mbox_pull(&s->mbox[0], 0);
         }
         break;

     case MAIL0_PEEK:
         res = s->mbox[0].reg[0];
         break;

     case MAIL0_SENDER:
         break;

     case MAIL0_STATUS:
         res = s->mbox[0].status;
         break;

     case MAIL0_CONFIG:
         res = s->mbox[0].config;
         break;

     case MAIL1_STATUS:
         res = s->mbox[1].status;
         break;

     default:
         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
                       __func__, offset);
         return 0;
     }

     bcm2835_mbox_update(s);

     return res;
 }

 static void bcm2835_mbox_write(void *opaque, hwaddr offset,
                                uint64_t value, unsigned size)
 {
     BCM2835MboxState *s = opaque;
     hwaddr childaddr;
     uint8_t ch;

     offset &= 0xff;

     switch (offset) {
     case MAIL0_SENDER:
         break;

     case MAIL0_CONFIG:
         s->mbox[0].config &= ~ARM_MC_IHAVEDATAIRQEN;
         s->mbox[0].config |= value & ARM_MC_IHAVEDATAIRQEN;
         break;

     case 0xa0 ... 0xac: /* MAIL1_WRITE */
         if (s->mbox[1].status & ARM_MS_FULL) {
             /* Mailbox full */
             qemu_log_mask(LOG_GUEST_ERROR, "%s: mailbox full\n", __func__);
         } else {
             ch = value & 0xf;
             if (ch < MBOX_CHAN_COUNT) {
                 childaddr = ch << MBOX_AS_CHAN_SHIFT;
                 if (ldl_le_phys(&s->mbox_as, childaddr + MBOX_AS_PENDING)) {
                     /* Child busy, push delayed. Push it in the arm->vc mbox */
                     mbox_push(&s->mbox[1], value);
                 } else {
                     /* Push it directly to the child device */
                     stl_le_phys(&s->mbox_as, childaddr, value);
                 }
             } else {
                 /* Invalid channel number */
                 qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid channel %u\n",
                               __func__, ch);
             }
         }
         break;

     default:
         qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
                       __func__, offset);
         return;
     }

     bcm2835_mbox_update(s);
 }

 static const MemoryRegionOps bcm2835_mbox_ops = {
     .read = bcm2835_mbox_read,
     .write = bcm2835_mbox_write,
     .endianness = DEVICE_NATIVE_ENDIAN,
     .valid.min_access_size = 4,
     .valid.max_access_size = 4,
 };

 /* vmstate of a single mailbox */
 static const VMStateDescription vmstate_bcm2835_mbox_box = {
     .name = TYPE_BCM2835_MBOX "_box",
     .version_id = 1,
     .minimum_version_id = 1,
     .fields = (VMStateField[]) {
         VMSTATE_UINT32_ARRAY(reg, BCM2835Mbox, MBOX_SIZE),
         VMSTATE_UINT32(count, BCM2835Mbox),
         VMSTATE_UINT32(status, BCM2835Mbox),
         VMSTATE_UINT32(config, BCM2835Mbox),
         VMSTATE_END_OF_LIST()
     }
 };

 /* vmstate of the entire device */
 static const VMStateDescription vmstate_bcm2835_mbox = {
     .name = TYPE_BCM2835_MBOX,
     .version_id = 1,
     .minimum_version_id = 1,
     .minimum_version_id_old = 1,
     .fields      = (VMStateField[]) {
         VMSTATE_BOOL_ARRAY(available, BCM2835MboxState, MBOX_CHAN_COUNT),
         VMSTATE_STRUCT_ARRAY(mbox, BCM2835MboxState, 2, 1,
                              vmstate_bcm2835_mbox_box, BCM2835Mbox),
         VMSTATE_END_OF_LIST()
     }
 };

 static void bcm2835_mbox_init(Object *obj)
 {
     BCM2835MboxState *s = BCM2835_MBOX(obj);

     memory_region_init_io(&s->iomem, obj, &bcm2835_mbox_ops, s,
                           TYPE_BCM2835_MBOX, 0x400);
     sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
     sysbus_init_irq(SYS_BUS_DEVICE(s), &s->arm_irq);
     qdev_init_gpio_in(DEVICE(s), bcm2835_mbox_set_irq, MBOX_CHAN_COUNT);
 }

 static void bcm2835_mbox_reset(DeviceState *dev)
 {
     BCM2835MboxState *s = BCM2835_MBOX(dev);
     int n;

     mbox_reset(&s->mbox[0]);
     mbox_reset(&s->mbox[1]);
     s->mbox_irq_disabled = false;
     for (n = 0; n < MBOX_CHAN_COUNT; n++) {
         s->available[n] = false;
     }
 }

 static void bcm2835_mbox_realize(DeviceState *dev, Error **errp)
 {
     BCM2835MboxState *s = BCM2835_MBOX(dev);
     Object *obj;
     Error *err = NULL;

     obj = object_property_get_link(OBJECT(dev), "mbox-mr", &err);
     if (obj == NULL) {
         error_setg(errp, "%s: required mbox-mr link not found: %s",
                    __func__, error_get_pretty(err));
         return;
     }

     s->mbox_mr = MEMORY_REGION(obj);
     address_space_init(&s->mbox_as, s->mbox_mr, NULL);
     bcm2835_mbox_reset(dev);
 }

 static void bcm2835_mbox_class_init(ObjectClass *klass, void *data)
 {
     DeviceClass *dc = DEVICE_CLASS(klass);

     dc->realize = bcm2835_mbox_realize;
     dc->reset = bcm2835_mbox_reset;
     dc->vmsd = &vmstate_bcm2835_mbox;
 }

 static TypeInfo bcm2835_mbox_info = {
     .name          = TYPE_BCM2835_MBOX,
     .parent        = TYPE_SYS_BUS_DEVICE,
     .instance_size = sizeof(BCM2835MboxState),
     .class_init    = bcm2835_mbox_class_init,
     .instance_init = bcm2835_mbox_init,
 };

 static void bcm2835_mbox_register_types(void)
 {
     type_register_static(&bcm2835_mbox_info);
 }

 type_init(bcm2835_mbox_register_types)
	/*
	* Raspberry Pi emulation (c) 2012 Gregory Estrade
	* This code is licensed under the GNU GPLv2 and later.
	*
	* This file models the system mailboxes, which are used for
	* communication with low-bandwidth GPU peripherals. Refs:
	* https://github.com/raspberrypi/firmware/wiki/Mailboxes
	* https://github.com/raspberrypi/firmware/wiki/Accessing-mailboxes
	*/

	#include "qemu/osdep.h"
	#include "qapi/error.h"
	#include "hw/misc/bcm2835_mbox.h"
	#include "qemu/log.h"

	#define MAIL0_PEEK 0x90
	#define MAIL0_SENDER 0x94
	#define MAIL1_STATUS 0xb8

	/* Mailbox status register */
	#define MAIL0_STATUS 0x98
	#define ARM_MS_FULL 0x80000000
	#define ARM_MS_EMPTY 0x40000000
	#define ARM_MS_LEVEL 0x400000FF /* Max. value depends on mailbox depth */

	/* MAILBOX config/status register */
	#define MAIL0_CONFIG 0x9c
	/* ANY write to this register clears the error bits! */
	#define ARM_MC_IHAVEDATAIRQEN 0x00000001 /* mbox irq enable: has data */
	#define ARM_MC_IHAVESPACEIRQEN 0x00000002 /* mbox irq enable: has space */
	#define ARM_MC_OPPISEMPTYIRQEN 0x00000004 /* mbox irq enable: Opp is empty */
	#define ARM_MC_MAIL_CLEAR 0x00000008 /* mbox clear write 1, then 0 */
	#define ARM_MC_IHAVEDATAIRQPEND 0x00000010 /* mbox irq pending: has space */
	#define ARM_MC_IHAVESPACEIRQPEND 0x00000020 /* mbox irq pending: Opp is empty */
	#define ARM_MC_OPPISEMPTYIRQPEND 0x00000040 /* mbox irq pending */
	/* Bit 7 is unused */
	#define ARM_MC_ERRNOOWN 0x00000100 /* error : none owner read from mailbox */
	#define ARM_MC_ERROVERFLW 0x00000200 /* error : write to fill mailbox */
	#define ARM_MC_ERRUNDRFLW 0x00000400 /* error : read from empty mailbox */

	static void mbox_update_status(BCM2835Mbox *mb)
	{
	mb->status &= ~(ARM_MS_EMPTY \| ARM_MS_FULL);
	if (mb->count == 0) {
	mb->status \|= ARM_MS_EMPTY;
	} else if (mb->count == MBOX_SIZE) {
	mb->status \|= ARM_MS_FULL;
	}
	}

	static void mbox_reset(BCM2835Mbox *mb)
	{
	int n;

	mb->count = 0;
	mb->config = 0;
	for (n = 0; n < MBOX_SIZE; n++) {
	mb->reg[n] = MBOX_INVALID_DATA;
	}
	mbox_update_status(mb);
	}

	static uint32_t mbox_pull(BCM2835Mbox *mb, int index)
	{
	int n;
	uint32_t val;

	assert(mb->count > 0);
	assert(index < mb->count);

	val = mb->reg[index];
	for (n = index + 1; n < mb->count; n++) {
	mb->reg[n - 1] = mb->reg[n];
	}
	mb->count--;
	mb->reg[mb->count] = MBOX_INVALID_DATA;

	mbox_update_status(mb);

	return val;
	}

	static void mbox_push(BCM2835Mbox *mb, uint32_t val)
	{
	assert(mb->count < MBOX_SIZE);
	mb->reg[mb->count++] = val;
	mbox_update_status(mb);
	}

	static void bcm2835_mbox_update(BCM2835MboxState *s)
	{
	uint32_t value;
	bool set;
	int n;

	s->mbox_irq_disabled = true;

	/* Get pending responses and put them in the vc->arm mbox,
	* as long as it's not full
	*/
	for (n = 0; n < MBOX_CHAN_COUNT; n++) {
	while (s->available[n] && !(s->mbox[0].status & ARM_MS_FULL)) {
	value = ldl_le_phys(&s->mbox_as, n << MBOX_AS_CHAN_SHIFT);
	assert(value != MBOX_INVALID_DATA); /* Pending interrupt but no data */
	mbox_push(&s->mbox[0], value);
	}
	}

	/* TODO (?): Try to push pending requests from the arm->vc mbox */

	/* Re-enable calls from the IRQ routine */
	s->mbox_irq_disabled = false;

	/* Update ARM IRQ status */
	set = false;
	s->mbox[0].config &= ~ARM_MC_IHAVEDATAIRQPEND;
	if (!(s->mbox[0].status & ARM_MS_EMPTY)) {
	s->mbox[0].config \|= ARM_MC_IHAVEDATAIRQPEND;
	if (s->mbox[0].config & ARM_MC_IHAVEDATAIRQEN) {
	set = true;
	}
	}
	qemu_set_irq(s->arm_irq, set);
	}

	static void bcm2835_mbox_set_irq(void *opaque, int irq, int level)
	{
	BCM2835MboxState *s = opaque;

	s->available[irq] = level;

	/* avoid recursively calling bcm2835_mbox_update when the interrupt
	* status changes due to the ldl_phys call within that function
	*/
	if (!s->mbox_irq_disabled) {
	bcm2835_mbox_update(s);
	}
	}

	static uint64_t bcm2835_mbox_read(void *opaque, hwaddr offset, unsigned size)
	{
	BCM2835MboxState *s = opaque;
	uint32_t res = 0;

	offset &= 0xff;

	switch (offset) {
	case 0x80 ... 0x8c: /* MAIL0_READ */
	if (s->mbox[0].status & ARM_MS_EMPTY) {
	res = MBOX_INVALID_DATA;
	} else {
	res = mbox_pull(&s->mbox[0], 0);
	}
	break;

	case MAIL0_PEEK:
	res = s->mbox[0].reg[0];
	break;

	case MAIL0_SENDER:
	break;

	case MAIL0_STATUS:
	res = s->mbox[0].status;
	break;

	case MAIL0_CONFIG:
	res = s->mbox[0].config;
	break;

	case MAIL1_STATUS:
	res = s->mbox[1].status;
	break;

	default:
	qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
	__func__, offset);
	return 0;
	}

	bcm2835_mbox_update(s);

	return res;
	}

	static void bcm2835_mbox_write(void *opaque, hwaddr offset,
	uint64_t value, unsigned size)
	{
	BCM2835MboxState *s = opaque;
	hwaddr childaddr;
	uint8_t ch;

	offset &= 0xff;

	switch (offset) {
	case MAIL0_SENDER:
	break;

	case MAIL0_CONFIG:
	s->mbox[0].config &= ~ARM_MC_IHAVEDATAIRQEN;
	s->mbox[0].config \|= value & ARM_MC_IHAVEDATAIRQEN;
	break;

	case 0xa0 ... 0xac: /* MAIL1_WRITE */
	if (s->mbox[1].status & ARM_MS_FULL) {
	/* Mailbox full */
	qemu_log_mask(LOG_GUEST_ERROR, "%s: mailbox full\n", __func__);
	} else {
	ch = value & 0xf;
	if (ch < MBOX_CHAN_COUNT) {
	childaddr = ch << MBOX_AS_CHAN_SHIFT;
	if (ldl_le_phys(&s->mbox_as, childaddr + MBOX_AS_PENDING)) {
	/* Child busy, push delayed. Push it in the arm->vc mbox */
	mbox_push(&s->mbox[1], value);
	} else {
	/* Push it directly to the child device */
	stl_le_phys(&s->mbox_as, childaddr, value);
	}
	} else {
	/* Invalid channel number */
	qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid channel %u\n",
	__func__, ch);
	}
	}
	break;

	default:
	qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
	__func__, offset);
	return;
	}

	bcm2835_mbox_update(s);
	}

	static const MemoryRegionOps bcm2835_mbox_ops = {
	.read = bcm2835_mbox_read,
	.write = bcm2835_mbox_write,
	.endianness = DEVICE_NATIVE_ENDIAN,
	.valid.min_access_size = 4,
	.valid.max_access_size = 4,
	};

	/* vmstate of a single mailbox */
	static const VMStateDescription vmstate_bcm2835_mbox_box = {
	.name = TYPE_BCM2835_MBOX "_box",
	.version_id = 1,
	.minimum_version_id = 1,
	.fields = (VMStateField[]) {
	VMSTATE_UINT32_ARRAY(reg, BCM2835Mbox, MBOX_SIZE),
	VMSTATE_UINT32(count, BCM2835Mbox),
	VMSTATE_UINT32(status, BCM2835Mbox),
	VMSTATE_UINT32(config, BCM2835Mbox),
	VMSTATE_END_OF_LIST()
	}
	};

	/* vmstate of the entire device */
	static const VMStateDescription vmstate_bcm2835_mbox = {
	.name = TYPE_BCM2835_MBOX,
	.version_id = 1,
	.minimum_version_id = 1,
	.minimum_version_id_old = 1,
	.fields = (VMStateField[]) {
	VMSTATE_BOOL_ARRAY(available, BCM2835MboxState, MBOX_CHAN_COUNT),
	VMSTATE_STRUCT_ARRAY(mbox, BCM2835MboxState, 2, 1,
	vmstate_bcm2835_mbox_box, BCM2835Mbox),
	VMSTATE_END_OF_LIST()
	}
	};

	static void bcm2835_mbox_init(Object *obj)
	{
	BCM2835MboxState *s = BCM2835_MBOX(obj);

	memory_region_init_io(&s->iomem, obj, &bcm2835_mbox_ops, s,
	TYPE_BCM2835_MBOX, 0x400);
	sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
	sysbus_init_irq(SYS_BUS_DEVICE(s), &s->arm_irq);
	qdev_init_gpio_in(DEVICE(s), bcm2835_mbox_set_irq, MBOX_CHAN_COUNT);
	}

	static void bcm2835_mbox_reset(DeviceState *dev)
	{
	BCM2835MboxState *s = BCM2835_MBOX(dev);
	int n;

	mbox_reset(&s->mbox[0]);
	mbox_reset(&s->mbox[1]);
	s->mbox_irq_disabled = false;
	for (n = 0; n < MBOX_CHAN_COUNT; n++) {
	s->available[n] = false;
	}
	}

	static void bcm2835_mbox_realize(DeviceState dev, Error *errp)
	{
	BCM2835MboxState *s = BCM2835_MBOX(dev);
	Object *obj;
	Error *err = NULL;

	obj = object_property_get_link(OBJECT(dev), "mbox-mr", &err);
	if (obj == NULL) {
	error_setg(errp, "%s: required mbox-mr link not found: %s",
	__func__, error_get_pretty(err));
	return;
	}

	s->mbox_mr = MEMORY_REGION(obj);
	address_space_init(&s->mbox_as, s->mbox_mr, NULL);
	bcm2835_mbox_reset(dev);
	}

	static void bcm2835_mbox_class_init(ObjectClass klass, void data)
	{
	DeviceClass *dc = DEVICE_CLASS(klass);

	dc->realize = bcm2835_mbox_realize;
	dc->reset = bcm2835_mbox_reset;
	dc->vmsd = &vmstate_bcm2835_mbox;
	}

	static TypeInfo bcm2835_mbox_info = {
	.name = TYPE_BCM2835_MBOX,
	.parent = TYPE_SYS_BUS_DEVICE,
	.instance_size = sizeof(BCM2835MboxState),
	.class_init = bcm2835_mbox_class_init,
	.instance_init = bcm2835_mbox_init,
	};

	static void bcm2835_mbox_register_types(void)
	{
	type_register_static(&bcm2835_mbox_info);
	}

	type_init(bcm2835_mbox_register_types)