2 * Raspberry Pi emulation (c) 2012 Gregory Estrade
4 * This work is licensed under the terms of the GNU GPL, version 2 or later.
5 * See the COPYING file in the top-level directory.
8 #include "qemu/osdep.h"
9 #include "qapi/error.h"
10 #include "hw/misc/bcm2835_property.h"
11 #include "hw/qdev-properties.h"
12 #include "migration/vmstate.h"
14 #include "hw/misc/bcm2835_mbox_defs.h"
15 #include "hw/misc/raspberrypi-fw-defs.h"
16 #include "sysemu/dma.h"
18 #include "qemu/module.h"
20 #include "hw/arm/raspi_platform.h"
22 /* https://github.com/raspberrypi/firmware/wiki/Mailbox-property-interface */
24 static void bcm2835_property_mbox_push(BCM2835PropertyState *s, uint32_t value)
32 uint32_t offset, length, color;
35 * Copy the current state of the framebuffer config; we will update
36 * this copy as we process tags and then ask the framebuffer to use
39 BCM2835FBConfig fbconfig = s->fbdev->config;
40 bool fbconfig_updated = false;
46 tot_len = ldl_le_phys(&s->dma_as, value);
48 /* @(addr + 4) : Buffer response code */
50 while (value + 8 <= s->addr + tot_len) {
51 tag = ldl_le_phys(&s->dma_as, value);
52 bufsize = ldl_le_phys(&s->dma_as, value + 4);
53 /* @(value + 8) : Request/response indicator */
56 case RPI_FWREQ_PROPERTY_END:
58 case RPI_FWREQ_GET_FIRMWARE_REVISION:
59 stl_le_phys(&s->dma_as, value + 12, 346337);
62 case RPI_FWREQ_GET_BOARD_MODEL:
63 qemu_log_mask(LOG_UNIMP,
64 "bcm2835_property: 0x%08x get board model NYI\n",
68 case RPI_FWREQ_GET_BOARD_REVISION:
69 stl_le_phys(&s->dma_as, value + 12, s->board_rev);
72 case RPI_FWREQ_GET_BOARD_MAC_ADDRESS:
73 resplen = sizeof(s->macaddr.a);
74 dma_memory_write(&s->dma_as, value + 12, s->macaddr.a, resplen,
75 MEMTXATTRS_UNSPECIFIED);
77 case RPI_FWREQ_GET_BOARD_SERIAL:
78 qemu_log_mask(LOG_UNIMP,
79 "bcm2835_property: 0x%08x get board serial NYI\n",
83 case RPI_FWREQ_GET_ARM_MEMORY:
85 stl_le_phys(&s->dma_as, value + 12, 0);
87 stl_le_phys(&s->dma_as, value + 16, s->fbdev->vcram_base);
90 case RPI_FWREQ_GET_VC_MEMORY:
92 stl_le_phys(&s->dma_as, value + 12, s->fbdev->vcram_base);
94 stl_le_phys(&s->dma_as, value + 16, s->fbdev->vcram_size);
97 case RPI_FWREQ_SET_POWER_STATE:
98 /* Assume that whatever device they asked for exists,
99 * and we'll just claim we set it to the desired state
101 tmp = ldl_le_phys(&s->dma_as, value + 16);
102 stl_le_phys(&s->dma_as, value + 16, (tmp & 1));
108 case RPI_FWREQ_GET_CLOCK_STATE:
109 stl_le_phys(&s->dma_as, value + 16, 0x1);
113 case RPI_FWREQ_SET_CLOCK_STATE:
114 qemu_log_mask(LOG_UNIMP,
115 "bcm2835_property: 0x%08x set clock state NYI\n",
120 case RPI_FWREQ_GET_CLOCK_RATE:
121 case RPI_FWREQ_GET_MAX_CLOCK_RATE:
122 case RPI_FWREQ_GET_MIN_CLOCK_RATE:
123 switch (ldl_le_phys(&s->dma_as, value + 12)) {
124 case RPI_FIRMWARE_EMMC_CLK_ID:
125 stl_le_phys(&s->dma_as, value + 16, RPI_FIRMWARE_EMMC_CLK_RATE);
127 case RPI_FIRMWARE_UART_CLK_ID:
128 stl_le_phys(&s->dma_as, value + 16, RPI_FIRMWARE_UART_CLK_RATE);
130 case RPI_FIRMWARE_CORE_CLK_ID:
131 stl_le_phys(&s->dma_as, value + 16, RPI_FIRMWARE_CORE_CLK_RATE);
134 stl_le_phys(&s->dma_as, value + 16,
135 RPI_FIRMWARE_DEFAULT_CLK_RATE);
141 case RPI_FWREQ_SET_CLOCK_RATE:
142 case RPI_FWREQ_SET_MAX_CLOCK_RATE:
143 case RPI_FWREQ_SET_MIN_CLOCK_RATE:
144 qemu_log_mask(LOG_UNIMP,
145 "bcm2835_property: 0x%08x set clock rate NYI\n",
152 case RPI_FWREQ_GET_TEMPERATURE:
153 stl_le_phys(&s->dma_as, value + 16, 25000);
157 case RPI_FWREQ_GET_MAX_TEMPERATURE:
158 stl_le_phys(&s->dma_as, value + 16, 99000);
164 case RPI_FWREQ_FRAMEBUFFER_ALLOCATE:
165 stl_le_phys(&s->dma_as, value + 12, fbconfig.base);
166 stl_le_phys(&s->dma_as, value + 16,
167 bcm2835_fb_get_size(&fbconfig));
170 case RPI_FWREQ_FRAMEBUFFER_RELEASE:
173 case RPI_FWREQ_FRAMEBUFFER_BLANK:
176 case RPI_FWREQ_FRAMEBUFFER_TEST_PHYSICAL_WIDTH_HEIGHT:
177 case RPI_FWREQ_FRAMEBUFFER_TEST_VIRTUAL_WIDTH_HEIGHT:
180 case RPI_FWREQ_FRAMEBUFFER_SET_PHYSICAL_WIDTH_HEIGHT:
181 fbconfig.xres = ldl_le_phys(&s->dma_as, value + 12);
182 fbconfig.yres = ldl_le_phys(&s->dma_as, value + 16);
183 bcm2835_fb_validate_config(&fbconfig);
184 fbconfig_updated = true;
186 case RPI_FWREQ_FRAMEBUFFER_GET_PHYSICAL_WIDTH_HEIGHT:
187 stl_le_phys(&s->dma_as, value + 12, fbconfig.xres);
188 stl_le_phys(&s->dma_as, value + 16, fbconfig.yres);
191 case RPI_FWREQ_FRAMEBUFFER_SET_VIRTUAL_WIDTH_HEIGHT:
192 fbconfig.xres_virtual = ldl_le_phys(&s->dma_as, value + 12);
193 fbconfig.yres_virtual = ldl_le_phys(&s->dma_as, value + 16);
194 bcm2835_fb_validate_config(&fbconfig);
195 fbconfig_updated = true;
197 case RPI_FWREQ_FRAMEBUFFER_GET_VIRTUAL_WIDTH_HEIGHT:
198 stl_le_phys(&s->dma_as, value + 12, fbconfig.xres_virtual);
199 stl_le_phys(&s->dma_as, value + 16, fbconfig.yres_virtual);
202 case RPI_FWREQ_FRAMEBUFFER_TEST_DEPTH:
205 case RPI_FWREQ_FRAMEBUFFER_SET_DEPTH:
206 fbconfig.bpp = ldl_le_phys(&s->dma_as, value + 12);
207 bcm2835_fb_validate_config(&fbconfig);
208 fbconfig_updated = true;
210 case RPI_FWREQ_FRAMEBUFFER_GET_DEPTH:
211 stl_le_phys(&s->dma_as, value + 12, fbconfig.bpp);
214 case RPI_FWREQ_FRAMEBUFFER_TEST_PIXEL_ORDER:
217 case RPI_FWREQ_FRAMEBUFFER_SET_PIXEL_ORDER:
218 fbconfig.pixo = ldl_le_phys(&s->dma_as, value + 12);
219 bcm2835_fb_validate_config(&fbconfig);
220 fbconfig_updated = true;
222 case RPI_FWREQ_FRAMEBUFFER_GET_PIXEL_ORDER:
223 stl_le_phys(&s->dma_as, value + 12, fbconfig.pixo);
226 case RPI_FWREQ_FRAMEBUFFER_TEST_ALPHA_MODE:
229 case RPI_FWREQ_FRAMEBUFFER_SET_ALPHA_MODE:
230 fbconfig.alpha = ldl_le_phys(&s->dma_as, value + 12);
231 bcm2835_fb_validate_config(&fbconfig);
232 fbconfig_updated = true;
234 case RPI_FWREQ_FRAMEBUFFER_GET_ALPHA_MODE:
235 stl_le_phys(&s->dma_as, value + 12, fbconfig.alpha);
238 case RPI_FWREQ_FRAMEBUFFER_GET_PITCH:
239 stl_le_phys(&s->dma_as, value + 12,
240 bcm2835_fb_get_pitch(&fbconfig));
243 case RPI_FWREQ_FRAMEBUFFER_TEST_VIRTUAL_OFFSET:
246 case RPI_FWREQ_FRAMEBUFFER_SET_VIRTUAL_OFFSET:
247 fbconfig.xoffset = ldl_le_phys(&s->dma_as, value + 12);
248 fbconfig.yoffset = ldl_le_phys(&s->dma_as, value + 16);
249 bcm2835_fb_validate_config(&fbconfig);
250 fbconfig_updated = true;
252 case RPI_FWREQ_FRAMEBUFFER_GET_VIRTUAL_OFFSET:
253 stl_le_phys(&s->dma_as, value + 12, fbconfig.xoffset);
254 stl_le_phys(&s->dma_as, value + 16, fbconfig.yoffset);
257 case RPI_FWREQ_FRAMEBUFFER_GET_OVERSCAN:
258 case RPI_FWREQ_FRAMEBUFFER_TEST_OVERSCAN:
259 case RPI_FWREQ_FRAMEBUFFER_SET_OVERSCAN:
260 stl_le_phys(&s->dma_as, value + 12, 0);
261 stl_le_phys(&s->dma_as, value + 16, 0);
262 stl_le_phys(&s->dma_as, value + 20, 0);
263 stl_le_phys(&s->dma_as, value + 24, 0);
266 case RPI_FWREQ_FRAMEBUFFER_SET_PALETTE:
267 offset = ldl_le_phys(&s->dma_as, value + 12);
268 length = ldl_le_phys(&s->dma_as, value + 16);
270 while (n < length - offset) {
271 color = ldl_le_phys(&s->dma_as, value + 20 + (n << 2));
272 stl_le_phys(&s->dma_as,
273 s->fbdev->vcram_base + ((offset + n) << 2), color);
276 stl_le_phys(&s->dma_as, value + 12, 0);
279 case RPI_FWREQ_FRAMEBUFFER_GET_NUM_DISPLAYS:
280 stl_le_phys(&s->dma_as, value + 12, 1);
284 case RPI_FWREQ_GET_DMA_CHANNELS:
286 stl_le_phys(&s->dma_as, value + 12, 0x003C);
290 case RPI_FWREQ_GET_COMMAND_LINE:
292 * We follow the firmware behaviour: no NUL terminator is
293 * written to the buffer, and if the buffer is too short
294 * we report the required length in the response header
295 * and copy nothing to the buffer.
297 resplen = strlen(s->command_line);
298 if (bufsize >= resplen)
299 address_space_write(&s->dma_as, value + 12,
300 MEMTXATTRS_UNSPECIFIED, s->command_line,
305 qemu_log_mask(LOG_UNIMP,
306 "bcm2835_property: unhandled tag 0x%08x\n", tag);
310 trace_bcm2835_mbox_property(tag, bufsize, resplen);
315 stl_le_phys(&s->dma_as, value + 8, (1 << 31) | resplen);
316 value += bufsize + 12;
319 /* Reconfigure framebuffer if required */
320 if (fbconfig_updated) {
321 bcm2835_fb_reconfigure(s->fbdev, &fbconfig);
324 /* Buffer response code */
325 stl_le_phys(&s->dma_as, s->addr + 4, (1 << 31));
328 static uint64_t bcm2835_property_read(void *opaque, hwaddr offset,
331 BCM2835PropertyState *s = opaque;
336 res = MBOX_CHAN_PROPERTY | s->addr;
338 qemu_set_irq(s->mbox_irq, 0);
341 case MBOX_AS_PENDING:
346 qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
354 static void bcm2835_property_write(void *opaque, hwaddr offset,
355 uint64_t value, unsigned size)
357 BCM2835PropertyState *s = opaque;
361 /* bcm2835_mbox should check our pending status before pushing */
364 bcm2835_property_mbox_push(s, value);
365 qemu_set_irq(s->mbox_irq, 1);
369 qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
375 static const MemoryRegionOps bcm2835_property_ops = {
376 .read = bcm2835_property_read,
377 .write = bcm2835_property_write,
378 .endianness = DEVICE_NATIVE_ENDIAN,
379 .valid.min_access_size = 4,
380 .valid.max_access_size = 4,
383 static const VMStateDescription vmstate_bcm2835_property = {
384 .name = TYPE_BCM2835_PROPERTY,
386 .minimum_version_id = 1,
387 .fields = (VMStateField[]) {
388 VMSTATE_MACADDR(macaddr, BCM2835PropertyState),
389 VMSTATE_UINT32(addr, BCM2835PropertyState),
390 VMSTATE_BOOL(pending, BCM2835PropertyState),
391 VMSTATE_END_OF_LIST()
395 static void bcm2835_property_init(Object *obj)
397 BCM2835PropertyState *s = BCM2835_PROPERTY(obj);
399 memory_region_init_io(&s->iomem, OBJECT(s), &bcm2835_property_ops, s,
400 TYPE_BCM2835_PROPERTY, 0x10);
403 * bcm2835_property_ops call into bcm2835_mbox, which in-turn reads from
404 * iomem. As such, mark iomem as re-entracy safe.
406 s->iomem.disable_reentrancy_guard = true;
408 sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
409 sysbus_init_irq(SYS_BUS_DEVICE(s), &s->mbox_irq);
412 static void bcm2835_property_reset(DeviceState *dev)
414 BCM2835PropertyState *s = BCM2835_PROPERTY(dev);
419 static void bcm2835_property_realize(DeviceState *dev, Error **errp)
421 BCM2835PropertyState *s = BCM2835_PROPERTY(dev);
424 obj = object_property_get_link(OBJECT(dev), "fb", &error_abort);
425 s->fbdev = BCM2835_FB(obj);
427 obj = object_property_get_link(OBJECT(dev), "dma-mr", &error_abort);
428 s->dma_mr = MEMORY_REGION(obj);
429 address_space_init(&s->dma_as, s->dma_mr, TYPE_BCM2835_PROPERTY "-memory");
431 /* TODO: connect to MAC address of USB NIC device, once we emulate it */
432 qemu_macaddr_default_if_unset(&s->macaddr);
434 bcm2835_property_reset(dev);
437 static Property bcm2835_property_props[] = {
438 DEFINE_PROP_UINT32("board-rev", BCM2835PropertyState, board_rev, 0),
439 DEFINE_PROP_STRING("command-line", BCM2835PropertyState, command_line),
440 DEFINE_PROP_END_OF_LIST()
443 static void bcm2835_property_class_init(ObjectClass *klass, void *data)
445 DeviceClass *dc = DEVICE_CLASS(klass);
447 device_class_set_props(dc, bcm2835_property_props);
448 dc->realize = bcm2835_property_realize;
449 dc->vmsd = &vmstate_bcm2835_property;
452 static const TypeInfo bcm2835_property_info = {
453 .name = TYPE_BCM2835_PROPERTY,
454 .parent = TYPE_SYS_BUS_DEVICE,
455 .instance_size = sizeof(BCM2835PropertyState),
456 .class_init = bcm2835_property_class_init,
457 .instance_init = bcm2835_property_init,
460 static void bcm2835_property_register_types(void)
462 type_register_static(&bcm2835_property_info);
465 type_init(bcm2835_property_register_types)