ChrisYin
Posts: 4
Joined: Tue May 15, 2018 9:03 pm

information of bcm2835 mailbox and doorbell

Thu Nov 08, 2018 7:58 pm

Hi, everyone.

Currently I'm working on virtualization technology in Raspberry Pi3 board.

I want to emulate the firmware of the Pi3 board., including bcm2835 mailbox, doorbell, board property, power management, etc.

But I could not find any useful information about the bcm2835-doorbell in its documentations:

https://www.raspberrypi.org/documentati ... herals.pdf
https://www.raspberrypi.org/documentati ... rev3.4.pdf

After the test, I found that the start address of the bcm2835-doorbell is from 0x3f00b840 to 0x3f00b848.
But I need to know more , like the function of each bit in 0x3f00b840.
How does the bcm2835-doorbell work?


Hope anyone could help me...

LdB
Posts: 866
Joined: Wed Dec 07, 2016 2:29 pm

Re: information of bcm2835 mailbox and doorbell

Fri Nov 09, 2018 1:37 am

Careful there are two sets of mailboxes and doorbells, you would need to emulated both correctly

The core mailboxes and doorbells are detailed in
https://www.raspberrypi.org/documentati ... rev3.4.pdf
The system has sixteen mailboxes, four for each core. The system has no doorbells. You can use the
mailboxes as doorbells instead.
So those are the mailboxes to and between cores, you use that for core control.

There is another mailbox for communication with the GPU and other peripherals which is the one you have found
but not got address right which on the PI3 will be at 0x3F00B880

The interface is messily detailed here and it doesn't tell you which channel is which way
The top channel (0) is VC4 to ARM, the bottom channel (1) is ARM to VC4
https://github.com/raspberrypi/firmware/wiki/Mailboxes
It's usually confusing when you first see it because it's that little bit at the bottom so here is the structure
and you are really only interested in the 4 registers, channel 0 (0x0, 0x18) and channel 1 (0x20, 0x38)

Code: Select all

struct __attribute__((__packed__, aligned(4))) MailBoxRegisters {
	const uint32_t Read0;		// 0x00         Read data from VC to ARM (read only at arm hence const)
	uint32_t Unused[3];		// 0x04-0x0F
	uint32_t Peek0;			// 0x10
	uint32_t Sender0;		// 0x14
	uint32_t Status0;		// 0x18         Status of VC to ARM (status of mailbox above at 0x00)
	uint32_t Config0;		// 0x1C        
	uint32_t Write1;		// 0x20         Write data from ARM to VC  (write only at arm)
	uint32_t Unused2[3];		// 0x24-0x2F
	uint32_t Peek1;			// 0x30
	uint32_t Sender1;		// 0x34
	uint32_t Status1;		// 0x38         Status of ARM to VC (Stats of mailbox above at 0x20)
	uint32_t Config1;		// 0x3C 
};
What goes thru that to the GPU and other peripherals is contained in details here
https://github.com/raspberrypi/firmware ... -interface

User avatar
Ultibo
Posts: 136
Joined: Wed Sep 30, 2015 10:29 am
Location: Australia
Contact: Website

Re: information of bcm2835 mailbox and doorbell

Sat Nov 10, 2018 10:57 pm

ChrisYin wrote:
Thu Nov 08, 2018 7:58 pm
But I could not find any useful information about the bcm2835-doorbell in its documentations:

https://www.raspberrypi.org/documentati ... herals.pdf
https://www.raspberrypi.org/documentati ... rev3.4.pdf

After the test, I found that the start address of the bcm2835-doorbell is from 0x3f00b840 to 0x3f00b848.
But I need to know more , like the function of each bit in 0x3f00b840.
How does the bcm2835-doorbell work?
The only thing I know of that uses the doorbell (at 0xb840) as opposed to the mailbox (at 0xb880) is the VCHIQ driver which uses it to initiate an interrupt that signals the other side of an event.

It doesn't really document the device or what the bits mean but it does give a tiny bit of information, you can also see it in use in our VCHIQ implementation.
Ultibo.org | Make something amazing
https://ultibo.org

Threads, multi-core, OpenGL, Camera, FAT, NTFS, TCP/IP, USB and more in 3MB with 2 second boot!

ChrisYin
Posts: 4
Joined: Tue May 15, 2018 9:03 pm

Re: information of bcm2835 mailbox and doorbell

Mon Nov 12, 2018 3:16 pm

LdB wrote:
Fri Nov 09, 2018 1:37 am
Careful there are two sets of mailboxes and doorbells, you would need to emulated both correctly

The core mailboxes and doorbells are detailed in
https://www.raspberrypi.org/documentati ... rev3.4.pdf
The system has sixteen mailboxes, four for each core. The system has no doorbells. You can use the
mailboxes as doorbells instead.
So those are the mailboxes to and between cores, you use that for core control.

There is another mailbox for communication with the GPU and other peripherals which is the one you have found
but not got address right which on the PI3 will be at 0x3F00B880

The interface is messily detailed here and it doesn't tell you which channel is which way
The top channel (0) is VC4 to ARM, the bottom channel (1) is ARM to VC4
https://github.com/raspberrypi/firmware/wiki/Mailboxes
It's usually confusing when you first see it because it's that little bit at the bottom so here is the structure
and you are really only interested in the 4 registers, channel 0 (0x0, 0x18) and channel 1 (0x20, 0x38)

Code: Select all

struct __attribute__((__packed__, aligned(4))) MailBoxRegisters {
	const uint32_t Read0;		// 0x00         Read data from VC to ARM (read only at arm hence const)
	uint32_t Unused[3];		// 0x04-0x0F
	uint32_t Peek0;			// 0x10
	uint32_t Sender0;		// 0x14
	uint32_t Status0;		// 0x18         Status of VC to ARM (status of mailbox above at 0x00)
	uint32_t Config0;		// 0x1C        
	uint32_t Write1;		// 0x20         Write data from ARM to VC  (write only at arm)
	uint32_t Unused2[3];		// 0x24-0x2F
	uint32_t Peek1;			// 0x30
	uint32_t Sender1;		// 0x34
	uint32_t Status1;		// 0x38         Status of ARM to VC (Stats of mailbox above at 0x20)
	uint32_t Config1;		// 0x3C 
};
What goes thru that to the GPU and other peripherals is contained in details here
https://github.com/raspberrypi/firmware ... -interface
Thanks for your informative reply!
I understand how does the bcm2835 mailbox work, which is used to communicate with VC4.
Mailbox interrupt will be arouse when VideoCore has message sent to ARM.
But I'm still wondering how does the doorbell interrupt arise?

ChrisYin
Posts: 4
Joined: Tue May 15, 2018 9:03 pm

Re: information of bcm2835 mailbox and doorbell

Mon Nov 12, 2018 3:28 pm

Ultibo wrote:
Sat Nov 10, 2018 10:57 pm
The only thing I know of that uses the doorbell (at 0xb840) as opposed to the mailbox (at 0xb880) is the VCHIQ driver which uses it to initiate an interrupt that signals the other side of an event.

It doesn't really document the device or what the bits mean but it does give a tiny bit of information, you can also see it in use in our VCHIQ implementation.
Thanks for your reply!
I read your VCHIQ implementation.
If I want to clear the doorbell interrupt and get the message from VideoCore, I need to read it in VCHIQ_DOORBELL_BELL0(0x3f00b840).
If I want to send the message to VideoCore, I need to write the message to VCHIQ_DOORBELL_BELL2(0x3f00b848).
Is this right?
I'm also wondering that is any configuration bit or status bit for the bcm2835-doorbell.

Return to “Bare metal, Assembly language”