[mirror_qemu.git] / hw / misc / bcm2835_property.c

/*
 * Raspberry Pi emulation (c) 2012 Gregory Estrade
 * This code is licensed under the GNU GPLv2 and later.
 */

#include "qemu/osdep.h"
#include "qapi/error.h"
#include "hw/misc/bcm2835_property.h"
#include "hw/misc/bcm2835_mbox_defs.h"
#include "sysemu/dma.h"
#include "qemu/log.h"

/* https://github.com/raspberrypi/firmware/wiki/Mailbox-property-interface */

static void bcm2835_property_mbox_push(BCM2835PropertyState *s, uint32_t value)
{
    uint32_t tag;
    uint32_t bufsize;
    uint32_t tot_len;
    size_t resplen;
    uint32_t tmp;
    int n;
    uint32_t offset, length, color;

    /*
     * Copy the current state of the framebuffer config; we will update
     * this copy as we process tags and then ask the framebuffer to use
     * it at the end.
     */
    BCM2835FBConfig fbconfig = s->fbdev->config;
    bool fbconfig_updated = false;

    value &= ~0xf;

    s->addr = value;

    tot_len = ldl_le_phys(&s->dma_as, value);

    /* @(addr + 4) : Buffer response code */
    value = s->addr + 8;
    while (value + 8 <= s->addr + tot_len) {
        tag = ldl_le_phys(&s->dma_as, value);
        bufsize = ldl_le_phys(&s->dma_as, value + 4);
        /* @(value + 8) : Request/response indicator */
        resplen = 0;
        switch (tag) {
        case 0x00000000: /* End tag */
            break;
        case 0x00000001: /* Get firmware revision */
            stl_le_phys(&s->dma_as, value + 12, 346337);
            resplen = 4;
            break;
        case 0x00010001: /* Get board model */
            qemu_log_mask(LOG_UNIMP,
                          "bcm2835_property: %x get board model NYI\n", tag);
            resplen = 4;
            break;
        case 0x00010002: /* Get board revision */
            stl_le_phys(&s->dma_as, value + 12, s->board_rev);
            resplen = 4;
            break;
        case 0x00010003: /* Get board MAC address */
            resplen = sizeof(s->macaddr.a);
            dma_memory_write(&s->dma_as, value + 12, s->macaddr.a, resplen);
            break;
        case 0x00010004: /* Get board serial */
            qemu_log_mask(LOG_UNIMP,
                          "bcm2835_property: %x get board serial NYI\n", tag);
            resplen = 8;
            break;
        case 0x00010005: /* Get ARM memory */
            /* base */
            stl_le_phys(&s->dma_as, value + 12, 0);
            /* size */
            stl_le_phys(&s->dma_as, value + 16, s->fbdev->vcram_base);
            resplen = 8;
            break;
        case 0x00010006: /* Get VC memory */
            /* base */
            stl_le_phys(&s->dma_as, value + 12, s->fbdev->vcram_base);
            /* size */
            stl_le_phys(&s->dma_as, value + 16, s->fbdev->vcram_size);
            resplen = 8;
            break;
        case 0x00028001: /* Set power state */
            /* Assume that whatever device they asked for exists,
             * and we'll just claim we set it to the desired state
             */
            tmp = ldl_le_phys(&s->dma_as, value + 16);
            stl_le_phys(&s->dma_as, value + 16, (tmp & 1));
            resplen = 8;
            break;

        /* Clocks */

        case 0x00030001: /* Get clock state */
            stl_le_phys(&s->dma_as, value + 16, 0x1);
            resplen = 8;
            break;

        case 0x00038001: /* Set clock state */
            qemu_log_mask(LOG_UNIMP,
                          "bcm2835_property: %x set clock state NYI\n", tag);
            resplen = 8;
            break;

        case 0x00030002: /* Get clock rate */
        case 0x00030004: /* Get max clock rate */
        case 0x00030007: /* Get min clock rate */
            switch (ldl_le_phys(&s->dma_as, value + 12)) {
            case 1: /* EMMC */
                stl_le_phys(&s->dma_as, value + 16, 50000000);
                break;
            case 2: /* UART */
                stl_le_phys(&s->dma_as, value + 16, 3000000);
                break;
            default:
                stl_le_phys(&s->dma_as, value + 16, 700000000);
                break;
            }
            resplen = 8;
            break;

        case 0x00038002: /* Set clock rate */
        case 0x00038004: /* Set max clock rate */
        case 0x00038007: /* Set min clock rate */
            qemu_log_mask(LOG_UNIMP,
                          "bcm2835_property: %x set clock rates NYI\n", tag);
            resplen = 8;
            break;

        /* Temperature */

        case 0x00030006: /* Get temperature */
            stl_le_phys(&s->dma_as, value + 16, 25000);
            resplen = 8;
            break;

        case 0x0003000A: /* Get max temperature */
            stl_le_phys(&s->dma_as, value + 16, 99000);
            resplen = 8;
            break;

        /* Frame buffer */

        case 0x00040001: /* Allocate buffer */
            stl_le_phys(&s->dma_as, value + 12, fbconfig.base);
            stl_le_phys(&s->dma_as, value + 16,
                        bcm2835_fb_get_size(&fbconfig));
            resplen = 8;
            break;
        case 0x00048001: /* Release buffer */
            resplen = 0;
            break;
        case 0x00040002: /* Blank screen */
            resplen = 4;
            break;
        case 0x00044003: /* Test physical display width/height */
        case 0x00044004: /* Test virtual display width/height */
            resplen = 8;
            break;
        case 0x00048003: /* Set physical display width/height */
            fbconfig.xres = ldl_le_phys(&s->dma_as, value + 12);
            fbconfig.yres = ldl_le_phys(&s->dma_as, value + 16);
            bcm2835_fb_validate_config(&fbconfig);
            fbconfig_updated = true;
            /* fall through */
        case 0x00040003: /* Get physical display width/height */
            stl_le_phys(&s->dma_as, value + 12, fbconfig.xres);
            stl_le_phys(&s->dma_as, value + 16, fbconfig.yres);
            resplen = 8;
            break;
        case 0x00048004: /* Set virtual display width/height */
            fbconfig.xres_virtual = ldl_le_phys(&s->dma_as, value + 12);
            fbconfig.yres_virtual = ldl_le_phys(&s->dma_as, value + 16);
            bcm2835_fb_validate_config(&fbconfig);
            fbconfig_updated = true;
            /* fall through */
        case 0x00040004: /* Get virtual display width/height */
            stl_le_phys(&s->dma_as, value + 12, fbconfig.xres_virtual);
            stl_le_phys(&s->dma_as, value + 16, fbconfig.yres_virtual);
            resplen = 8;
            break;
        case 0x00044005: /* Test depth */
            resplen = 4;
            break;
        case 0x00048005: /* Set depth */
            fbconfig.bpp = ldl_le_phys(&s->dma_as, value + 12);
            bcm2835_fb_validate_config(&fbconfig);
            fbconfig_updated = true;
            /* fall through */
        case 0x00040005: /* Get depth */
            stl_le_phys(&s->dma_as, value + 12, fbconfig.bpp);
            resplen = 4;
            break;
        case 0x00044006: /* Test pixel order */
            resplen = 4;
            break;
        case 0x00048006: /* Set pixel order */
            fbconfig.pixo = ldl_le_phys(&s->dma_as, value + 12);
            bcm2835_fb_validate_config(&fbconfig);
            fbconfig_updated = true;
            /* fall through */
        case 0x00040006: /* Get pixel order */
            stl_le_phys(&s->dma_as, value + 12, fbconfig.pixo);
            resplen = 4;
            break;
        case 0x00044007: /* Test pixel alpha */
            resplen = 4;
            break;
        case 0x00048007: /* Set alpha */
            fbconfig.alpha = ldl_le_phys(&s->dma_as, value + 12);
            bcm2835_fb_validate_config(&fbconfig);
            fbconfig_updated = true;
            /* fall through */
        case 0x00040007: /* Get alpha */
            stl_le_phys(&s->dma_as, value + 12, fbconfig.alpha);
            resplen = 4;
            break;
        case 0x00040008: /* Get pitch */
            stl_le_phys(&s->dma_as, value + 12,
                        bcm2835_fb_get_pitch(&fbconfig));
            resplen = 4;
            break;
        case 0x00044009: /* Test virtual offset */
            resplen = 8;
            break;
        case 0x00048009: /* Set virtual offset */
            fbconfig.xoffset = ldl_le_phys(&s->dma_as, value + 12);
            fbconfig.yoffset = ldl_le_phys(&s->dma_as, value + 16);
            bcm2835_fb_validate_config(&fbconfig);
            fbconfig_updated = true;
            /* fall through */
        case 0x00040009: /* Get virtual offset */
            stl_le_phys(&s->dma_as, value + 12, fbconfig.xoffset);
            stl_le_phys(&s->dma_as, value + 16, fbconfig.yoffset);
            resplen = 8;
            break;
        case 0x0004000a: /* Get/Test/Set overscan */
        case 0x0004400a:
        case 0x0004800a:
            stl_le_phys(&s->dma_as, value + 12, 0);
            stl_le_phys(&s->dma_as, value + 16, 0);
            stl_le_phys(&s->dma_as, value + 20, 0);
            stl_le_phys(&s->dma_as, value + 24, 0);
            resplen = 16;
            break;
        case 0x0004800b: /* Set palette */
            offset = ldl_le_phys(&s->dma_as, value + 12);
            length = ldl_le_phys(&s->dma_as, value + 16);
            n = 0;
            while (n < length - offset) {
                color = ldl_le_phys(&s->dma_as, value + 20 + (n << 2));
                stl_le_phys(&s->dma_as,
                            s->fbdev->vcram_base + ((offset + n) << 2), color);
                n++;
            }
            stl_le_phys(&s->dma_as, value + 12, 0);
            resplen = 4;
            break;

        case 0x00060001: /* Get DMA channels */
            /* channels 2-5 */
            stl_le_phys(&s->dma_as, value + 12, 0x003C);
            resplen = 4;
            break;

        case 0x00050001: /* Get command line */
            resplen = 0;
            break;

        default:
            qemu_log_mask(LOG_GUEST_ERROR,
                          "bcm2835_property: unhandled tag %08x\n", tag);
            break;
        }

        if (tag == 0) {
            break;
        }

        stl_le_phys(&s->dma_as, value + 8, (1 << 31) | resplen);
        value += bufsize + 12;
    }

    /* Reconfigure framebuffer if required */
    if (fbconfig_updated) {
        bcm2835_fb_reconfigure(s->fbdev, &fbconfig);
    }

    /* Buffer response code */
    stl_le_phys(&s->dma_as, s->addr + 4, (1 << 31));
}

static uint64_t bcm2835_property_read(void *opaque, hwaddr offset,
                                      unsigned size)
{
    BCM2835PropertyState *s = opaque;
    uint32_t res = 0;

    switch (offset) {
    case MBOX_AS_DATA:
        res = MBOX_CHAN_PROPERTY | s->addr;
        s->pending = false;
        qemu_set_irq(s->mbox_irq, 0);
        break;

    case MBOX_AS_PENDING:
        res = s->pending;
        break;

    default:
        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
                      __func__, offset);
        return 0;
    }

    return res;
}

static void bcm2835_property_write(void *opaque, hwaddr offset,
                                   uint64_t value, unsigned size)
{
    BCM2835PropertyState *s = opaque;

    switch (offset) {
    case MBOX_AS_DATA:
        /* bcm2835_mbox should check our pending status before pushing */
        assert(!s->pending);
        s->pending = true;
        bcm2835_property_mbox_push(s, value);
        qemu_set_irq(s->mbox_irq, 1);
        break;

    default:
        qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
                      __func__, offset);
        return;
    }
}

static const MemoryRegionOps bcm2835_property_ops = {
    .read = bcm2835_property_read,
    .write = bcm2835_property_write,
    .endianness = DEVICE_NATIVE_ENDIAN,
    .valid.min_access_size = 4,
    .valid.max_access_size = 4,
};

static const VMStateDescription vmstate_bcm2835_property = {
    .name = TYPE_BCM2835_PROPERTY,
    .version_id = 1,
    .minimum_version_id = 1,
    .fields      = (VMStateField[]) {
        VMSTATE_MACADDR(macaddr, BCM2835PropertyState),
        VMSTATE_UINT32(addr, BCM2835PropertyState),
        VMSTATE_BOOL(pending, BCM2835PropertyState),
        VMSTATE_END_OF_LIST()
    }
};

static void bcm2835_property_init(Object *obj)
{
    BCM2835PropertyState *s = BCM2835_PROPERTY(obj);

    memory_region_init_io(&s->iomem, OBJECT(s), &bcm2835_property_ops, s,
                          TYPE_BCM2835_PROPERTY, 0x10);
    sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
    sysbus_init_irq(SYS_BUS_DEVICE(s), &s->mbox_irq);
}

static void bcm2835_property_reset(DeviceState *dev)
{
    BCM2835PropertyState *s = BCM2835_PROPERTY(dev);

    s->pending = false;
}

static void bcm2835_property_realize(DeviceState *dev, Error **errp)
{
    BCM2835PropertyState *s = BCM2835_PROPERTY(dev);
    Object *obj;
    Error *err = NULL;

    obj = object_property_get_link(OBJECT(dev), "fb", &err);
    if (obj == NULL) {
        error_setg(errp, "%s: required fb link not found: %s",
                   __func__, error_get_pretty(err));
        return;
    }

    s->fbdev = BCM2835_FB(obj);

    obj = object_property_get_link(OBJECT(dev), "dma-mr", &err);
    if (obj == NULL) {
        error_setg(errp, "%s: required dma-mr link not found: %s",
                   __func__, error_get_pretty(err));
        return;
    }

    s->dma_mr = MEMORY_REGION(obj);
    address_space_init(&s->dma_as, s->dma_mr, NULL);

    /* TODO: connect to MAC address of USB NIC device, once we emulate it */
    qemu_macaddr_default_if_unset(&s->macaddr);

    bcm2835_property_reset(dev);
}

static Property bcm2835_property_props[] = {
    DEFINE_PROP_UINT32("board-rev", BCM2835PropertyState, board_rev, 0),
    DEFINE_PROP_END_OF_LIST()
};

static void bcm2835_property_class_init(ObjectClass *klass, void *data)
{
    DeviceClass *dc = DEVICE_CLASS(klass);

    dc->props = bcm2835_property_props;
    dc->realize = bcm2835_property_realize;
    dc->vmsd = &vmstate_bcm2835_property;
}

static TypeInfo bcm2835_property_info = {
    .name          = TYPE_BCM2835_PROPERTY,
    .parent        = TYPE_SYS_BUS_DEVICE,
    .instance_size = sizeof(BCM2835PropertyState),
    .class_init    = bcm2835_property_class_init,
    .instance_init = bcm2835_property_init,
};

static void bcm2835_property_register_types(void)
{
    type_register_static(&bcm2835_property_info);
}

type_init(bcm2835_property_register_types)
Commit	Line	Data
04f1ab15 AB	1	/*
	2	* Raspberry Pi emulation (c) 2012 Gregory Estrade
	3	* This code is licensed under the GNU GPLv2 and later.
	4	*/
	5
c964b660	6	#include "qemu/osdep.h"
da34e65c	7	#include "qapi/error.h"
04f1ab15 AB	8	#include "hw/misc/bcm2835_property.h"
	9	#include "hw/misc/bcm2835_mbox_defs.h"
	10	#include "sysemu/dma.h"
03dd024f	11	#include "qemu/log.h"
04f1ab15 AB	12
	13	/* https://github.com/raspberrypi/firmware/wiki/Mailbox-property-interface */
	14
	15	static void bcm2835_property_mbox_push(BCM2835PropertyState *s, uint32_t value)
	16	{
	17	uint32_t tag;
	18	uint32_t bufsize;
	19	uint32_t tot_len;
	20	size_t resplen;
	21	uint32_t tmp;
355a8ccc GE	22	int n;
355a8ccc GE	23	uint32_t offset, length, color;
193100b5 PM	24
	25	/*
	26	* Copy the current state of the framebuffer config; we will update
	27	* this copy as we process tags and then ask the framebuffer to use
	28	* it at the end.
	29	*/
	30	BCM2835FBConfig fbconfig = s->fbdev->config;
	31	bool fbconfig_updated = false;
04f1ab15 AB	32
	33	value &= ~0xf;
	34
	35	s->addr = value;
	36
eab71394	37	tot_len = ldl_le_phys(&s->dma_as, value);
04f1ab15 AB	38
	39	/* @(addr + 4) : Buffer response code */
	40	value = s->addr + 8;
	41	while (value + 8 <= s->addr + tot_len) {
eab71394 AB	42	tag = ldl_le_phys(&s->dma_as, value);
eab71394 AB	43	bufsize = ldl_le_phys(&s->dma_as, value + 4);
04f1ab15 AB	44	/* @(value + 8) : Request/response indicator */
	45	resplen = 0;
	46	switch (tag) {
	47	case 0x00000000: /* End tag */
	48	break;
	49	case 0x00000001: /* Get firmware revision */
eab71394	50	stl_le_phys(&s->dma_as, value + 12, 346337);
04f1ab15 AB	51	resplen = 4;
	52	break;
	53	case 0x00010001: /* Get board model */
	54	qemu_log_mask(LOG_UNIMP,
	55	"bcm2835_property: %x get board model NYI\n", tag);
	56	resplen = 4;
	57	break;
	58	case 0x00010002: /* Get board revision */
eab71394	59	stl_le_phys(&s->dma_as, value + 12, s->board_rev);
04f1ab15 AB	60	resplen = 4;
	61	break;
	62	case 0x00010003: /* Get board MAC address */
	63	resplen = sizeof(s->macaddr.a);
	64	dma_memory_write(&s->dma_as, value + 12, s->macaddr.a, resplen);
	65	break;
	66	case 0x00010004: /* Get board serial */
	67	qemu_log_mask(LOG_UNIMP,
	68	"bcm2835_property: %x get board serial NYI\n", tag);
	69	resplen = 8;
	70	break;
	71	case 0x00010005: /* Get ARM memory */
	72	/* base */
eab71394	73	stl_le_phys(&s->dma_as, value + 12, 0);
04f1ab15	74	/* size */
355a8ccc GE	75	stl_le_phys(&s->dma_as, value + 16, s->fbdev->vcram_base);
	76	resplen = 8;
	77	break;
	78	case 0x00010006: /* Get VC memory */
	79	/* base */
	80	stl_le_phys(&s->dma_as, value + 12, s->fbdev->vcram_base);
	81	/* size */
	82	stl_le_phys(&s->dma_as, value + 16, s->fbdev->vcram_size);
04f1ab15 AB	83	resplen = 8;
	84	break;
	85	case 0x00028001: /* Set power state */
	86	/* Assume that whatever device they asked for exists,
	87	* and we'll just claim we set it to the desired state
	88	*/
eab71394 AB	89	tmp = ldl_le_phys(&s->dma_as, value + 16);
eab71394 AB	90	stl_le_phys(&s->dma_as, value + 16, (tmp & 1));
04f1ab15 AB	91	resplen = 8;
	92	break;
	93
	94	/* Clocks */
	95
	96	case 0x00030001: /* Get clock state */
eab71394	97	stl_le_phys(&s->dma_as, value + 16, 0x1);
04f1ab15 AB	98	resplen = 8;
	99	break;
	100
	101	case 0x00038001: /* Set clock state */
	102	qemu_log_mask(LOG_UNIMP,
	103	"bcm2835_property: %x set clock state NYI\n", tag);
	104	resplen = 8;
	105	break;
	106
	107	case 0x00030002: /* Get clock rate */
	108	case 0x00030004: /* Get max clock rate */
	109	case 0x00030007: /* Get min clock rate */
eab71394	110	switch (ldl_le_phys(&s->dma_as, value + 12)) {
04f1ab15	111	case 1: /* EMMC */
eab71394	112	stl_le_phys(&s->dma_as, value + 16, 50000000);
04f1ab15 AB	113	break;
04f1ab15 AB	114	case 2: /* UART */
eab71394	115	stl_le_phys(&s->dma_as, value + 16, 3000000);
04f1ab15 AB	116	break;
04f1ab15 AB	117	default:
eab71394	118	stl_le_phys(&s->dma_as, value + 16, 700000000);
04f1ab15 AB	119	break;
	120	}
	121	resplen = 8;
	122	break;
	123
	124	case 0x00038002: /* Set clock rate */
	125	case 0x00038004: /* Set max clock rate */
	126	case 0x00038007: /* Set min clock rate */
	127	qemu_log_mask(LOG_UNIMP,
	128	"bcm2835_property: %x set clock rates NYI\n", tag);
	129	resplen = 8;
	130	break;
	131
	132	/* Temperature */
	133
	134	case 0x00030006: /* Get temperature */
eab71394	135	stl_le_phys(&s->dma_as, value + 16, 25000);
04f1ab15 AB	136	resplen = 8;
	137	break;
	138
	139	case 0x0003000A: /* Get max temperature */
eab71394	140	stl_le_phys(&s->dma_as, value + 16, 99000);
04f1ab15 AB	141	resplen = 8;
	142	break;
	143
355a8ccc GE	144	/* Frame buffer */
	145
	146	case 0x00040001: /* Allocate buffer */
193100b5	147	stl_le_phys(&s->dma_as, value + 12, fbconfig.base);
27a5dc7b	148	stl_le_phys(&s->dma_as, value + 16,
9a1f03f4	149	bcm2835_fb_get_size(&fbconfig));
355a8ccc GE	150	resplen = 8;
	151	break;
	152	case 0x00048001: /* Release buffer */
	153	resplen = 0;
	154	break;
	155	case 0x00040002: /* Blank screen */
	156	resplen = 4;
	157	break;
01f18af9 PM	158	case 0x00044003: /* Test physical display width/height */
	159	case 0x00044004: /* Test virtual display width/height */
	160	resplen = 8;
	161	break;
	162	case 0x00048003: /* Set physical display width/height */
193100b5 PM	163	fbconfig.xres = ldl_le_phys(&s->dma_as, value + 12);
193100b5 PM	164	fbconfig.yres = ldl_le_phys(&s->dma_as, value + 16);
f8add62c	165	bcm2835_fb_validate_config(&fbconfig);
193100b5	166	fbconfig_updated = true;
f8add62c PM	167	/* fall through */
	168	case 0x00040003: /* Get physical display width/height */
	169	stl_le_phys(&s->dma_as, value + 12, fbconfig.xres);
	170	stl_le_phys(&s->dma_as, value + 16, fbconfig.yres);
355a8ccc GE	171	resplen = 8;
355a8ccc GE	172	break;
01f18af9 PM	173	case 0x00048004: /* Set virtual display width/height */
	174	fbconfig.xres_virtual = ldl_le_phys(&s->dma_as, value + 12);
	175	fbconfig.yres_virtual = ldl_le_phys(&s->dma_as, value + 16);
f8add62c	176	bcm2835_fb_validate_config(&fbconfig);
01f18af9	177	fbconfig_updated = true;
f8add62c PM	178	/* fall through */
	179	case 0x00040004: /* Get virtual display width/height */
	180	stl_le_phys(&s->dma_as, value + 12, fbconfig.xres_virtual);
	181	stl_le_phys(&s->dma_as, value + 16, fbconfig.yres_virtual);
01f18af9 PM	182	resplen = 8;
01f18af9 PM	183	break;
355a8ccc GE	184	case 0x00044005: /* Test depth */
	185	resplen = 4;
	186	break;
	187	case 0x00048005: /* Set depth */
193100b5	188	fbconfig.bpp = ldl_le_phys(&s->dma_as, value + 12);
f8add62c	189	bcm2835_fb_validate_config(&fbconfig);
193100b5	190	fbconfig_updated = true;
f8add62c PM	191	/* fall through */
	192	case 0x00040005: /* Get depth */
	193	stl_le_phys(&s->dma_as, value + 12, fbconfig.bpp);
355a8ccc GE	194	resplen = 4;
	195	break;
	196	case 0x00044006: /* Test pixel order */
	197	resplen = 4;
	198	break;
	199	case 0x00048006: /* Set pixel order */
193100b5	200	fbconfig.pixo = ldl_le_phys(&s->dma_as, value + 12);
f8add62c	201	bcm2835_fb_validate_config(&fbconfig);
193100b5	202	fbconfig_updated = true;
f8add62c PM	203	/* fall through */
	204	case 0x00040006: /* Get pixel order */
	205	stl_le_phys(&s->dma_as, value + 12, fbconfig.pixo);
355a8ccc GE	206	resplen = 4;
	207	break;
	208	case 0x00044007: /* Test pixel alpha */
	209	resplen = 4;
	210	break;
	211	case 0x00048007: /* Set alpha */
193100b5	212	fbconfig.alpha = ldl_le_phys(&s->dma_as, value + 12);
f8add62c	213	bcm2835_fb_validate_config(&fbconfig);
193100b5	214	fbconfig_updated = true;
f8add62c PM	215	/* fall through */
	216	case 0x00040007: /* Get alpha */
	217	stl_le_phys(&s->dma_as, value + 12, fbconfig.alpha);
355a8ccc GE	218	resplen = 4;
	219	break;
	220	case 0x00040008: /* Get pitch */
193100b5	221	stl_le_phys(&s->dma_as, value + 12,
9a1f03f4	222	bcm2835_fb_get_pitch(&fbconfig));
355a8ccc GE	223	resplen = 4;
355a8ccc GE	224	break;
355a8ccc GE	225	case 0x00044009: /* Test virtual offset */
	226	resplen = 8;
	227	break;
	228	case 0x00048009: /* Set virtual offset */
193100b5 PM	229	fbconfig.xoffset = ldl_le_phys(&s->dma_as, value + 12);
193100b5 PM	230	fbconfig.yoffset = ldl_le_phys(&s->dma_as, value + 16);
f8add62c	231	bcm2835_fb_validate_config(&fbconfig);
193100b5	232	fbconfig_updated = true;
f8add62c PM	233	/* fall through */
	234	case 0x00040009: /* Get virtual offset */
	235	stl_le_phys(&s->dma_as, value + 12, fbconfig.xoffset);
	236	stl_le_phys(&s->dma_as, value + 16, fbconfig.yoffset);
355a8ccc GE	237	resplen = 8;
	238	break;
	239	case 0x0004000a: /* Get/Test/Set overscan */
	240	case 0x0004400a:
	241	case 0x0004800a:
	242	stl_le_phys(&s->dma_as, value + 12, 0);
	243	stl_le_phys(&s->dma_as, value + 16, 0);
	244	stl_le_phys(&s->dma_as, value + 20, 0);
	245	stl_le_phys(&s->dma_as, value + 24, 0);
	246	resplen = 16;
	247	break;
	248	case 0x0004800b: /* Set palette */
	249	offset = ldl_le_phys(&s->dma_as, value + 12);
	250	length = ldl_le_phys(&s->dma_as, value + 16);
	251	n = 0;
	252	while (n < length - offset) {
	253	color = ldl_le_phys(&s->dma_as, value + 20 + (n << 2));
	254	stl_le_phys(&s->dma_as,
	255	s->fbdev->vcram_base + ((offset + n) << 2), color);
	256	n++;
	257	}
	258	stl_le_phys(&s->dma_as, value + 12, 0);
	259	resplen = 4;
	260	break;
04f1ab15 AB	261
	262	case 0x00060001: /* Get DMA channels */
	263	/* channels 2-5 */
eab71394	264	stl_le_phys(&s->dma_as, value + 12, 0x003C);
04f1ab15 AB	265	resplen = 4;
	266	break;
	267
	268	case 0x00050001: /* Get command line */
	269	resplen = 0;
	270	break;
	271
	272	default:
	273	qemu_log_mask(LOG_GUEST_ERROR,
	274	"bcm2835_property: unhandled tag %08x\n", tag);
	275	break;
	276	}
	277
	278	if (tag == 0) {
	279	break;
	280	}
	281
eab71394	282	stl_le_phys(&s->dma_as, value + 8, (1 << 31) \| resplen);
04f1ab15 AB	283	value += bufsize + 12;
	284	}
	285
355a8ccc	286	/* Reconfigure framebuffer if required */
193100b5 PM	287	if (fbconfig_updated) {
193100b5 PM	288	bcm2835_fb_reconfigure(s->fbdev, &fbconfig);
355a8ccc GE	289	}
355a8ccc GE	290
04f1ab15	291	/* Buffer response code */
eab71394	292	stl_le_phys(&s->dma_as, s->addr + 4, (1 << 31));
04f1ab15 AB	293	}
	294
	295	static uint64_t bcm2835_property_read(void *opaque, hwaddr offset,
	296	unsigned size)
	297	{
	298	BCM2835PropertyState *s = opaque;
	299	uint32_t res = 0;
	300
	301	switch (offset) {
	302	case MBOX_AS_DATA:
	303	res = MBOX_CHAN_PROPERTY \| s->addr;
	304	s->pending = false;
	305	qemu_set_irq(s->mbox_irq, 0);
	306	break;
	307
	308	case MBOX_AS_PENDING:
	309	res = s->pending;
	310	break;
	311
	312	default:
	313	qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
	314	__func__, offset);
	315	return 0;
	316	}
	317
	318	return res;
	319	}
	320
	321	static void bcm2835_property_write(void *opaque, hwaddr offset,
	322	uint64_t value, unsigned size)
	323	{
	324	BCM2835PropertyState *s = opaque;
	325
	326	switch (offset) {
	327	case MBOX_AS_DATA:
	328	/* bcm2835_mbox should check our pending status before pushing */
	329	assert(!s->pending);
	330	s->pending = true;
	331	bcm2835_property_mbox_push(s, value);
	332	qemu_set_irq(s->mbox_irq, 1);
	333	break;
	334
	335	default:
	336	qemu_log_mask(LOG_GUEST_ERROR, "%s: Bad offset %"HWADDR_PRIx"\n",
	337	__func__, offset);
	338	return;
	339	}
	340	}
	341
	342	static const MemoryRegionOps bcm2835_property_ops = {
	343	.read = bcm2835_property_read,
	344	.write = bcm2835_property_write,
	345	.endianness = DEVICE_NATIVE_ENDIAN,
	346	.valid.min_access_size = 4,
	347	.valid.max_access_size = 4,
	348	};
	349
	350	static const VMStateDescription vmstate_bcm2835_property = {
	351	.name = TYPE_BCM2835_PROPERTY,
	352	.version_id = 1,
	353	.minimum_version_id = 1,
	354	.fields = (VMStateField[]) {
	355	VMSTATE_MACADDR(macaddr, BCM2835PropertyState),
	356	VMSTATE_UINT32(addr, BCM2835PropertyState),
357	VMSTATE_BOOL(pending, BCM2835PropertyState),
358	VMSTATE_END_OF_LIST()
359	}
360	};
361
362	static void bcm2835_property_init(Object *obj)
363	{
364	BCM2835PropertyState *s = BCM2835_PROPERTY(obj);
365
366	memory_region_init_io(&s->iomem, OBJECT(s), &bcm2835_property_ops, s,
367	TYPE_BCM2835_PROPERTY, 0x10);
368	sysbus_init_mmio(SYS_BUS_DEVICE(s), &s->iomem);
369	sysbus_init_irq(SYS_BUS_DEVICE(s), &s->mbox_irq);
370	}
371
372	static void bcm2835_property_reset(DeviceState *dev)
373	{
374	BCM2835PropertyState *s = BCM2835_PROPERTY(dev);
375
376	s->pending = false;
377	}
378
379	static void bcm2835_property_realize(DeviceState dev, Error *errp)
380	{
381	BCM2835PropertyState *s = BCM2835_PROPERTY(dev);
382	Object *obj;
383	Error *err = NULL;
384
355a8ccc GE	385	obj = object_property_get_link(OBJECT(dev), "fb", &err);
	386	if (obj == NULL) {
	387	error_setg(errp, "%s: required fb link not found: %s",
	388	__func__, error_get_pretty(err));
	389	return;
	390	}
	391
	392	s->fbdev = BCM2835_FB(obj);
	393
04f1ab15 AB	394	obj = object_property_get_link(OBJECT(dev), "dma-mr", &err);
	395	if (obj == NULL) {
	396	error_setg(errp, "%s: required dma-mr link not found: %s",
	397	__func__, error_get_pretty(err));
	398	return;
	399	}
	400
	401	s->dma_mr = MEMORY_REGION(obj);
	402	address_space_init(&s->dma_as, s->dma_mr, NULL);
	403
	404	/* TODO: connect to MAC address of USB NIC device, once we emulate it */
	405	qemu_macaddr_default_if_unset(&s->macaddr);
	406
	407	bcm2835_property_reset(dev);
	408	}
	409
	410	static Property bcm2835_property_props[] = {
f0afa731	411	DEFINE_PROP_UINT32("board-rev", BCM2835PropertyState, board_rev, 0),
04f1ab15 AB	412	DEFINE_PROP_END_OF_LIST()
	413	};
	414
	415	static void bcm2835_property_class_init(ObjectClass klass, void data)
	416	{
	417	DeviceClass *dc = DEVICE_CLASS(klass);
	418
	419	dc->props = bcm2835_property_props;
	420	dc->realize = bcm2835_property_realize;
	421	dc->vmsd = &vmstate_bcm2835_property;
	422	}
	423
	424	static TypeInfo bcm2835_property_info = {
	425	.name = TYPE_BCM2835_PROPERTY,
	426	.parent = TYPE_SYS_BUS_DEVICE,
	427	.instance_size = sizeof(BCM2835PropertyState),
	428	.class_init = bcm2835_property_class_init,
	429	.instance_init = bcm2835_property_init,
	430	};
	431
	432	static void bcm2835_property_register_types(void)
	433	{
	434	type_register_static(&bcm2835_property_info);
	435	}
	436
	437	type_init(bcm2835_property_register_types)