ChrisYin
Posts: 5
Joined: Tue May 15, 2018 9:03 pm

information of bcm2835 mailbox and doorbell

Thu Nov 08, 2018 7:58 pm

Hi, everyone.

Currently I'm working on virtualization technology in Raspberry Pi3 board.

I want to emulate the firmware of the Pi3 board., including bcm2835 mailbox, doorbell, board property, power management, etc.

But I could not find any useful information about the bcm2835-doorbell in its documentations:

https://www.raspberrypi.org/documentati ... herals.pdf
https://www.raspberrypi.org/documentati ... rev3.4.pdf

After the test, I found that the start address of the bcm2835-doorbell is from 0x3f00b840 to 0x3f00b848.
But I need to know more , like the function of each bit in 0x3f00b840.
How does the bcm2835-doorbell work?


Hope anyone could help me...

LdB
Posts: 1062
Joined: Wed Dec 07, 2016 2:29 pm

Re: information of bcm2835 mailbox and doorbell

Fri Nov 09, 2018 1:37 am

Careful there are two sets of mailboxes and doorbells, you would need to emulated both correctly

The core mailboxes and doorbells are detailed in
https://www.raspberrypi.org/documentati ... rev3.4.pdf
The system has sixteen mailboxes, four for each core. The system has no doorbells. You can use the
mailboxes as doorbells instead.
So those are the mailboxes to and between cores, you use that for core control.

There is another mailbox for communication with the GPU and other peripherals which is the one you have found
but not got address right which on the PI3 will be at 0x3F00B880

The interface is messily detailed here and it doesn't tell you which channel is which way
The top channel (0) is VC4 to ARM, the bottom channel (1) is ARM to VC4
https://github.com/raspberrypi/firmware/wiki/Mailboxes
It's usually confusing when you first see it because it's that little bit at the bottom so here is the structure
and you are really only interested in the 4 registers, channel 0 (0x0, 0x18) and channel 1 (0x20, 0x38)

Code: Select all

struct __attribute__((__packed__, aligned(4))) MailBoxRegisters {
	const uint32_t Read0;		// 0x00         Read data from VC to ARM (read only at arm hence const)
	uint32_t Unused[3];		// 0x04-0x0F
	uint32_t Peek0;			// 0x10
	uint32_t Sender0;		// 0x14
	uint32_t Status0;		// 0x18         Status of VC to ARM (status of mailbox above at 0x00)
	uint32_t Config0;		// 0x1C        
	uint32_t Write1;		// 0x20         Write data from ARM to VC  (write only at arm)
	uint32_t Unused2[3];		// 0x24-0x2F
	uint32_t Peek1;			// 0x30
	uint32_t Sender1;		// 0x34
	uint32_t Status1;		// 0x38         Status of ARM to VC (Stats of mailbox above at 0x20)
	uint32_t Config1;		// 0x3C 
};
What goes thru that to the GPU and other peripherals is contained in details here
https://github.com/raspberrypi/firmware ... -interface

User avatar
Ultibo
Posts: 150
Joined: Wed Sep 30, 2015 10:29 am
Location: Australia
Contact: Website

Re: information of bcm2835 mailbox and doorbell

Sat Nov 10, 2018 10:57 pm

ChrisYin wrote:
Thu Nov 08, 2018 7:58 pm
But I could not find any useful information about the bcm2835-doorbell in its documentations:

https://www.raspberrypi.org/documentati ... herals.pdf
https://www.raspberrypi.org/documentati ... rev3.4.pdf

After the test, I found that the start address of the bcm2835-doorbell is from 0x3f00b840 to 0x3f00b848.
But I need to know more , like the function of each bit in 0x3f00b840.
How does the bcm2835-doorbell work?
The only thing I know of that uses the doorbell (at 0xb840) as opposed to the mailbox (at 0xb880) is the VCHIQ driver which uses it to initiate an interrupt that signals the other side of an event.

It doesn't really document the device or what the bits mean but it does give a tiny bit of information, you can also see it in use in our VCHIQ implementation.
Ultibo.org | Make something amazing
https://ultibo.org

Threads, multi-core, OpenGL, Camera, FAT, NTFS, TCP/IP, USB and more in 3MB with 2 second boot!

ChrisYin
Posts: 5
Joined: Tue May 15, 2018 9:03 pm

Re: information of bcm2835 mailbox and doorbell

Mon Nov 12, 2018 3:16 pm

LdB wrote:
Fri Nov 09, 2018 1:37 am
Careful there are two sets of mailboxes and doorbells, you would need to emulated both correctly

The core mailboxes and doorbells are detailed in
https://www.raspberrypi.org/documentati ... rev3.4.pdf
The system has sixteen mailboxes, four for each core. The system has no doorbells. You can use the
mailboxes as doorbells instead.
So those are the mailboxes to and between cores, you use that for core control.

There is another mailbox for communication with the GPU and other peripherals which is the one you have found
but not got address right which on the PI3 will be at 0x3F00B880

The interface is messily detailed here and it doesn't tell you which channel is which way
The top channel (0) is VC4 to ARM, the bottom channel (1) is ARM to VC4
https://github.com/raspberrypi/firmware/wiki/Mailboxes
It's usually confusing when you first see it because it's that little bit at the bottom so here is the structure
and you are really only interested in the 4 registers, channel 0 (0x0, 0x18) and channel 1 (0x20, 0x38)

Code: Select all

struct __attribute__((__packed__, aligned(4))) MailBoxRegisters {
	const uint32_t Read0;		// 0x00         Read data from VC to ARM (read only at arm hence const)
	uint32_t Unused[3];		// 0x04-0x0F
	uint32_t Peek0;			// 0x10
	uint32_t Sender0;		// 0x14
	uint32_t Status0;		// 0x18         Status of VC to ARM (status of mailbox above at 0x00)
	uint32_t Config0;		// 0x1C        
	uint32_t Write1;		// 0x20         Write data from ARM to VC  (write only at arm)
	uint32_t Unused2[3];		// 0x24-0x2F
	uint32_t Peek1;			// 0x30
	uint32_t Sender1;		// 0x34
	uint32_t Status1;		// 0x38         Status of ARM to VC (Stats of mailbox above at 0x20)
	uint32_t Config1;		// 0x3C 
};
What goes thru that to the GPU and other peripherals is contained in details here
https://github.com/raspberrypi/firmware ... -interface
Thanks for your informative reply!
I understand how does the bcm2835 mailbox work, which is used to communicate with VC4.
Mailbox interrupt will be arouse when VideoCore has message sent to ARM.
But I'm still wondering how does the doorbell interrupt arise?

ChrisYin
Posts: 5
Joined: Tue May 15, 2018 9:03 pm

Re: information of bcm2835 mailbox and doorbell

Mon Nov 12, 2018 3:28 pm

Ultibo wrote:
Sat Nov 10, 2018 10:57 pm
The only thing I know of that uses the doorbell (at 0xb840) as opposed to the mailbox (at 0xb880) is the VCHIQ driver which uses it to initiate an interrupt that signals the other side of an event.

It doesn't really document the device or what the bits mean but it does give a tiny bit of information, you can also see it in use in our VCHIQ implementation.
Thanks for your reply!
I read your VCHIQ implementation.
If I want to clear the doorbell interrupt and get the message from VideoCore, I need to read it in VCHIQ_DOORBELL_BELL0(0x3f00b840).
If I want to send the message to VideoCore, I need to write the message to VCHIQ_DOORBELL_BELL2(0x3f00b848).
Is this right?
I'm also wondering that is any configuration bit or status bit for the bcm2835-doorbell.

User avatar
Ultibo
Posts: 150
Joined: Wed Sep 30, 2015 10:29 am
Location: Australia
Contact: Website

Re: information of bcm2835 mailbox and doorbell

Wed Nov 14, 2018 10:52 pm

ChrisYin wrote:
Mon Nov 12, 2018 3:28 pm
If I want to clear the doorbell interrupt and get the message from VideoCore, I need to read it in VCHIQ_DOORBELL_BELL0(0x3f00b840).
If I want to send the message to VideoCore, I need to write the message to VCHIQ_DOORBELL_BELL2(0x3f00b848).
Is this right?
Yes that's correct but only in the context of the VCHIQ protocol and its use of the doorbell.

As I said previously the VCHIQ is the only use of the doorbell that I have seen and it isn't a general purpose communication device, it is used for signalling events between the ARM and GPU sides of the protocol by triggering an interrupt.

The BCM2835 ARM Peripherals document says on page 109 that there are 4 doorbells (0 / 1 are GPU to ARM and 2 / 3 are ARM to GPU) so you can probably guess the addresses of each as 0xb840, 0xb844, 0xb848 and 0xb84c but we don't have any more information about the nature or design of the doorbell device itself.
ChrisYin wrote:
Mon Nov 12, 2018 3:28 pm
I'm also wondering that is any configuration bit or status bit for the bcm2835-doorbell.
It's possible that there are config and status registers but without any further information there is no way to know, for the VCHIQ the ARM sends a mailbox message to the GPU to start the protocol and it's possible that the GPU does some configuration of the device during that process.

Of course there is also the interrupt status and enable/disable for doorbells 0 and 1 which is documented in the basic pending and base interrupt enable/disable registers starting on page 113 of the document above.

Hope that helps.
Ultibo.org | Make something amazing
https://ultibo.org

Threads, multi-core, OpenGL, Camera, FAT, NTFS, TCP/IP, USB and more in 3MB with 2 second boot!

ChrisYin
Posts: 5
Joined: Tue May 15, 2018 9:03 pm

Re: information of bcm2835 mailbox and doorbell

Thu Nov 15, 2018 3:32 pm

Ultibo wrote:
Wed Nov 14, 2018 10:52 pm
It's possible that there are config and status registers but without any further information there is no way to know, for the VCHIQ the ARM sends a mailbox message to the GPU to start the protocol and it's possible that the GPU does some configuration of the device during that process.

Of course there is also the interrupt status and enable/disable for doorbells 0 and 1 which is documented in the basic pending and base interrupt enable/disable registers starting on page 113 of the document above.

Hope that helps.
Thanks for your help. :D

Return to “Bare metal, Assembly language”