1
2
3
4
5
6
7
8
9
10
11#include "qemu/osdep.h"
12#include "qapi/error.h"
13#include "hw/misc/bcm2835_mbox.h"
14#include "qemu/log.h"
15
16#define MAIL0_PEEK 0x90
17#define MAIL0_SENDER 0x94
18#define MAIL1_STATUS 0xb8
19
20
21#define MAIL0_STATUS 0x98
22#define ARM_MS_FULL 0x80000000
23#define ARM_MS_EMPTY 0x40000000
24#define ARM_MS_LEVEL 0x400000FF
25
26
27#define MAIL0_CONFIG 0x9c
28
29#define ARM_MC_IHAVEDATAIRQEN 0x00000001
30#define ARM_MC_IHAVESPACEIRQEN 0x00000002
31#define ARM_MC_OPPISEMPTYIRQEN 0x00000004
32#define ARM_MC_MAIL_CLEAR 0x00000008
33#define ARM_MC_IHAVEDATAIRQPEND 0x00000010
34#define ARM_MC_IHAVESPACEIRQPEND 0x00000020
35#define ARM_MC_OPPISEMPTYIRQPEND 0x00000040
36
37#define ARM_MC_ERRNOOWN 0x00000100
38#define ARM_MC_ERROVERFLW 0x00000200
39#define ARM_MC_ERRUNDRFLW 0x00000400
40
41static void mbox_update_status(BCM2835Mbox *mb)
42{
43 mb->status &= ~(ARM_MS_EMPTY | ARM_MS_FULL);
44 if (mb->count == 0) {
45 mb->status |= ARM_MS_EMPTY;
46 } else if (mb->count == MBOX_SIZE) {
47 mb->status |= ARM_MS_FULL;
48 }
49}
50
51static void mbox_reset(BCM2835Mbox *mb)
52{
53 int n;
54
55 mb->count = 0;
56 mb->config = 0;
57 for (n = 0; n < MBOX_SIZE; n++) {
58 mb->reg[n] = MBOX_INVALID_DATA;
59 }
60 mbox_update_status(mb);
61}
62
63static uint32_t mbox_pull(BCM2835Mbox *mb, int index)
64{
65 int n;
66 uint32_t val;
67
68 assert(mb->count > 0);
69 assert(index < mb->count);
70
71 val = mb->reg[index];
72 for (n = index + 1; n < mb->count; n++) {
73 mb->reg[n - 1] = mb->reg[n];
74 }
75 mb->count--;
76 mb->reg[mb->count] = MBOX_INVALID_DATA;
77
78 mbox_update_status(mb);
79
80 return val;
81}
82
83static void mbox_push(BCM2835Mbox *mb, uint32_t val)
84{
85 assert(mb->count < MBOX_SIZE);
86 mb->reg[mb->count++] = val;
87 mbox_update_status(mb);
88}
89
90static void bcm2835_mbox_update(BCM2835MboxState *s)
91{
92 uint32_t value;
93 bool set;
94 int n;
95
96 s->mbox_irq_disabled = true;
97
98
99
100
101 for (n = 0; n < MBOX_CHAN_COUNT; n++) {
102 while (s->available[n] && !(s->mbox[0].status & ARM_MS_FULL)) {
103 value = ldl_le_phys(&s->mbox_as, n << MBOX_AS_CHAN_SHIFT);
104 assert(value != MBOX_INVALID_DATA);
105 mbox_push(&s->mbox[0], value);
106 }
107 }
108
109
110
111
112 s->mbox_irq_disabled = false;
113
114
115 set = false;
116 s->mbox[0].config &= ~ARM_MC_IHAVEDATAIRQPEND;
117 if (!(s->mbox[0].status & ARM_MS_EMPTY)) {
118 s->mbox[0].config |= ARM_MC_IHAVEDATAIRQPEND;
119 if (s->mbox[0].config & ARM_MC_IHAVEDATAIRQEN) {
120 set = true;
121 }
122 }
123 qemu_set_irq(s->arm_irq, set);
124}
125
126static void bcm2835_mbox_set_irq(void *opaque, int irq, int level)
127{
128 BCM2835MboxState *s = opaque;
129
130 s->available[irq] = level;
131
132
133
134
135 if (!s->mbox_irq_disabled) {
136 bcm2835_mbox_update(s);
137 }
138}
139
140static uint64_t bcm2835_mbox_read(void *opaque, hwaddr offset, unsigned size)
141{
142 BCM2835MboxState *s = opaque;
143 uint32_t res = 0;
144
145 offset &= 0xff;
146
147 switch (offset) {
148 case 0x80 ... 0x8c:
149 if (s->mbox[0].status & ARM_MS_EMPTY) {
150 res = MBOX_INVALID_DATA;
151 } else {
152 res = mbox_pull(&s->mbox[0], 0);
153 }
154 break;
155
156 case MAIL0_PEEK:
157 res = s->mbox[0].reg[0];
158 break;
159
160 case MAIL0_SENDER:
161 break;
162
163 case MAIL0_STATUS:
164 res = s->mbox[0].status;
165 break;
166
167 case MAIL0_CONFIG:
168 res = s->mbox[0].config;
169 break;
170
171 case MAIL1_STATUS:
172 res = s->mbox[1].status;
173 break;
174
175 default:
176 qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
177 __func__, offset);
178 return 0;
179 }
180
181 bcm2835_mbox_update(s);
182
183 return res;
184}
185
186static void bcm2835_mbox_write(void *opaque, hwaddr offset,
187 uint64_t value, unsigned size)
188{
189 BCM2835MboxState *s = opaque;
190 hwaddr childaddr;
191 uint8_t ch;
192
193 offset &= 0xff;
194
195 switch (offset) {
196 case MAIL0_SENDER:
197 break;
198
199 case MAIL0_CONFIG:
200 s->mbox[0].config &= ~ARM_MC_IHAVEDATAIRQEN;
201 s->mbox[0].config |= value & ARM_MC_IHAVEDATAIRQEN;
202 break;
203
204 case 0xa0 ... 0xac:
205 if (s->mbox[1].status & ARM_MS_FULL) {
206
207 qemu_log_mask(LOG_GUEST_ERROR, "%s: mailbox full\n", __func__);
208 } else {
209 ch = value & 0xf;
210 if (ch < MBOX_CHAN_COUNT) {
211 childaddr = ch << MBOX_AS_CHAN_SHIFT;
212 if (ldl_le_phys(&s->mbox_as, childaddr + MBOX_AS_PENDING)) {
213
214 mbox_push(&s->mbox[1], value);
215 } else {
216
217 stl_le_phys(&s->mbox_as, childaddr, value);
218 }
219 } else {
220
221 qemu_log_mask(LOG_GUEST_ERROR, "%s: invalid channel %u\n",
222 __func__, ch);
223 }
224 }
225 break;
226
227 default:
228 qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
229 __func__, offset);
230 return;
231 }
232
233 bcm2835_mbox_update(s);
234}
235
236static const MemoryRegionOps bcm2835_mbox_ops = {
237 .read = bcm2835_mbox_read,
238 .write = bcm2835_mbox_write,
239 .endianness = DEVICE_NATIVE_ENDIAN,
240 .valid.min_access_size = 4,
241 .valid.max_access_size = 4,
242};
243
244
245static const VMStateDescription vmstate_bcm2835_mbox_box = {
246 .name = TYPE_BCM2835_MBOX "_box",
247 .version_id = 1,
248 .minimum_version_id = 1,
249 .fields = (VMStateField[]) {
250 VMSTATE_UINT32_ARRAY(reg, BCM2835Mbox, MBOX_SIZE),
251 VMSTATE_UINT32(count, BCM2835Mbox),
252 VMSTATE_UINT32(status, BCM2835Mbox),
253 VMSTATE_UINT32(config, BCM2835Mbox),
254 VMSTATE_END_OF_LIST()
255 }
256};
257
258
259static const VMStateDescription vmstate_bcm2835_mbox = {
260 .name = TYPE_BCM2835_MBOX,
261 .version_id = 1,
262 .minimum_version_id = 1,
263 .minimum_version_id_old = 1,
264 .fields = (VMStateField[]) {
265 VMSTATE_BOOL_ARRAY(available, BCM2835MboxState, MBOX_CHAN_COUNT),
266 VMSTATE_STRUCT_ARRAY(mbox, BCM2835MboxState, 2, 1,
267 vmstate_bcm2835_mbox_box, BCM2835Mbox),
268 VMSTATE_END_OF_LIST()
269 }
270};
271
272static void bcm2835_mbox_init(Object *obj)
273{
274 BCM2835MboxState *s = BCM2835_MBOX(obj);
275
276 memory_region_init_io(&s->iomem, obj, &bcm2835_mbox_ops, s,
277 TYPE_BCM2835_MBOX, 0x400);
278 sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
279 sysbus_init_irq(SYS_BUS_DEVICE(s), &s->arm_irq);
280 qdev_init_gpio_in(DEVICE(s), bcm2835_mbox_set_irq, MBOX_CHAN_COUNT);
281}
282
283static void bcm2835_mbox_reset(DeviceState *dev)
284{
285 BCM2835MboxState *s = BCM2835_MBOX(dev);
286 int n;
287
288 mbox_reset(&s->mbox[0]);
289 mbox_reset(&s->mbox[1]);
290 s->mbox_irq_disabled = false;
291 for (n = 0; n < MBOX_CHAN_COUNT; n++) {
292 s->available[n] = false;
293 }
294}
295
296static void bcm2835_mbox_realize(DeviceState *dev, Error **errp)
297{
298 BCM2835MboxState *s = BCM2835_MBOX(dev);
299 Object *obj;
300 Error *err = NULL;
301
302 obj = object_property_get_link(OBJECT(dev), "mbox-mr", &err);
303 if (obj == NULL) {
304 error_setg(errp, "%s: required mbox-mr link not found: %s",
305 __func__, error_get_pretty(err));
306 return;
307 }
308
309 s->mbox_mr = MEMORY_REGION(obj);
310 address_space_init(&s->mbox_as, s->mbox_mr, NULL);
311 bcm2835_mbox_reset(dev);
312}
313
314static void bcm2835_mbox_class_init(ObjectClass *klass, void *data)
315{
316 DeviceClass *dc = DEVICE_CLASS(klass);
317
318 dc->realize = bcm2835_mbox_realize;
319 dc->reset = bcm2835_mbox_reset;
320 dc->vmsd = &vmstate_bcm2835_mbox;
321}
322
323static TypeInfo bcm2835_mbox_info = {
324 .name = TYPE_BCM2835_MBOX,
325 .parent = TYPE_SYS_BUS_DEVICE,
326 .instance_size = sizeof(BCM2835MboxState),
327 .class_init = bcm2835_mbox_class_init,
328 .instance_init = bcm2835_mbox_init,
329};
330
331static void bcm2835_mbox_register_types(void)
332{
333 type_register_static(&bcm2835_mbox_info);
334}
335
336type_init(bcm2835_mbox_register_types)
337
