1 // Copyright 2024, Linaro Limited 2 // Author(s): Manos Pitsidianakis <manos.pitsidianakis@linaro.org> 3 // SPDX-License-Identifier: GPL-2.0-or-later 4 5 use core::ptr::{addr_of_mut, NonNull}; 6 use std::{ 7 ffi::CStr, 8 os::raw::{c_int, c_uchar, c_uint, c_void}, 9 }; 10 11 use qemu_api::{ 12 bindings::{self, *}, 13 c_str, 14 definitions::ObjectImpl, 15 device_class::TYPE_SYS_BUS_DEVICE, 16 irq::InterruptSource, 17 }; 18 19 use crate::{ 20 memory_ops::PL011_OPS, 21 registers::{self, Interrupt}, 22 RegisterOffset, 23 }; 24 25 /// Integer Baud Rate Divider, `UARTIBRD` 26 const IBRD_MASK: u32 = 0xffff; 27 28 /// Fractional Baud Rate Divider, `UARTFBRD` 29 const FBRD_MASK: u32 = 0x3f; 30 31 const DATA_BREAK: u32 = 1 << 10; 32 33 /// QEMU sourced constant. 34 pub const PL011_FIFO_DEPTH: usize = 16_usize; 35 36 #[derive(Clone, Copy, Debug)] 37 enum DeviceId { 38 #[allow(dead_code)] 39 Arm = 0, 40 Luminary, 41 } 42 43 impl std::ops::Index<hwaddr> for DeviceId { 44 type Output = c_uchar; 45 46 fn index(&self, idx: hwaddr) -> &Self::Output { 47 match self { 48 Self::Arm => &Self::PL011_ID_ARM[idx as usize], 49 Self::Luminary => &Self::PL011_ID_LUMINARY[idx as usize], 50 } 51 } 52 } 53 54 impl DeviceId { 55 const PL011_ID_ARM: [c_uchar; 8] = [0x11, 0x10, 0x14, 0x00, 0x0d, 0xf0, 0x05, 0xb1]; 56 const PL011_ID_LUMINARY: [c_uchar; 8] = [0x11, 0x00, 0x18, 0x01, 0x0d, 0xf0, 0x05, 0xb1]; 57 } 58 59 #[repr(C)] 60 #[derive(Debug, qemu_api_macros::Object, qemu_api_macros::offsets)] 61 /// PL011 Device Model in QEMU 62 pub struct PL011State { 63 pub parent_obj: SysBusDevice, 64 pub iomem: MemoryRegion, 65 #[doc(alias = "fr")] 66 pub flags: registers::Flags, 67 #[doc(alias = "lcr")] 68 pub line_control: registers::LineControl, 69 #[doc(alias = "rsr")] 70 pub receive_status_error_clear: registers::ReceiveStatusErrorClear, 71 #[doc(alias = "cr")] 72 pub control: registers::Control, 73 pub dmacr: u32, 74 pub int_enabled: u32, 75 pub int_level: u32, 76 pub read_fifo: [u32; PL011_FIFO_DEPTH], 77 pub ilpr: u32, 78 pub ibrd: u32, 79 pub fbrd: u32, 80 pub ifl: u32, 81 pub read_pos: usize, 82 pub read_count: usize, 83 pub read_trigger: usize, 84 #[doc(alias = "chr")] 85 pub char_backend: CharBackend, 86 /// QEMU interrupts 87 /// 88 /// ```text 89 /// * sysbus MMIO region 0: device registers 90 /// * sysbus IRQ 0: `UARTINTR` (combined interrupt line) 91 /// * sysbus IRQ 1: `UARTRXINTR` (receive FIFO interrupt line) 92 /// * sysbus IRQ 2: `UARTTXINTR` (transmit FIFO interrupt line) 93 /// * sysbus IRQ 3: `UARTRTINTR` (receive timeout interrupt line) 94 /// * sysbus IRQ 4: `UARTMSINTR` (momem status interrupt line) 95 /// * sysbus IRQ 5: `UARTEINTR` (error interrupt line) 96 /// ``` 97 #[doc(alias = "irq")] 98 pub interrupts: [InterruptSource; IRQMASK.len()], 99 #[doc(alias = "clk")] 100 pub clock: NonNull<Clock>, 101 #[doc(alias = "migrate_clk")] 102 pub migrate_clock: bool, 103 /// The byte string that identifies the device. 104 device_id: DeviceId, 105 } 106 107 impl ObjectImpl for PL011State { 108 type Class = PL011Class; 109 const TYPE_NAME: &'static CStr = crate::TYPE_PL011; 110 const PARENT_TYPE_NAME: Option<&'static CStr> = Some(TYPE_SYS_BUS_DEVICE); 111 const INSTANCE_INIT: Option<unsafe extern "C" fn(obj: *mut Object)> = Some(pl011_init); 112 } 113 114 #[repr(C)] 115 pub struct PL011Class { 116 _inner: [u8; 0], 117 } 118 119 impl qemu_api::definitions::ClassInitImpl for PL011Class { 120 const CLASS_INIT: Option<unsafe extern "C" fn(klass: *mut ObjectClass, data: *mut c_void)> = 121 Some(crate::device_class::pl011_class_init); 122 const CLASS_BASE_INIT: Option< 123 unsafe extern "C" fn(klass: *mut ObjectClass, data: *mut c_void), 124 > = None; 125 } 126 127 impl PL011State { 128 /// Initializes a pre-allocated, unitialized instance of `PL011State`. 129 /// 130 /// # Safety 131 /// 132 /// `self` must point to a correctly sized and aligned location for the 133 /// `PL011State` type. It must not be called more than once on the same 134 /// location/instance. All its fields are expected to hold unitialized 135 /// values with the sole exception of `parent_obj`. 136 unsafe fn init(&mut self) { 137 const CLK_NAME: &CStr = c_str!("clk"); 138 139 let sbd = unsafe { &mut *(addr_of_mut!(*self).cast::<SysBusDevice>()) }; 140 141 // SAFETY: 142 // 143 // self and self.iomem are guaranteed to be valid at this point since callers 144 // must make sure the `self` reference is valid. 145 unsafe { 146 memory_region_init_io( 147 addr_of_mut!(self.iomem), 148 addr_of_mut!(*self).cast::<Object>(), 149 &PL011_OPS, 150 addr_of_mut!(*self).cast::<c_void>(), 151 Self::TYPE_NAME.as_ptr(), 152 0x1000, 153 ); 154 sysbus_init_mmio(sbd, addr_of_mut!(self.iomem)); 155 } 156 157 for irq in self.interrupts.iter() { 158 sbd.init_irq(irq); 159 } 160 161 let dev = addr_of_mut!(*self).cast::<DeviceState>(); 162 163 // SAFETY: 164 // 165 // self.clock is not initialized at this point; but since `NonNull<_>` is Copy, 166 // we can overwrite the undefined value without side effects. This is 167 // safe since all PL011State instances are created by QOM code which 168 // calls this function to initialize the fields; therefore no code is 169 // able to access an invalid self.clock value. 170 unsafe { 171 self.clock = NonNull::new(qdev_init_clock_in( 172 dev, 173 CLK_NAME.as_ptr(), 174 None, /* pl011_clock_update */ 175 addr_of_mut!(*self).cast::<c_void>(), 176 ClockEvent::ClockUpdate.0, 177 )) 178 .unwrap(); 179 } 180 } 181 182 pub fn read(&mut self, offset: hwaddr, _size: c_uint) -> std::ops::ControlFlow<u64, u64> { 183 use RegisterOffset::*; 184 185 std::ops::ControlFlow::Break(match RegisterOffset::try_from(offset) { 186 Err(v) if (0x3f8..0x400).contains(&(v >> 2)) => { 187 u64::from(self.device_id[(offset - 0xfe0) >> 2]) 188 } 189 Err(_) => { 190 // qemu_log_mask(LOG_GUEST_ERROR, "pl011_read: Bad offset 0x%x\n", (int)offset); 191 0 192 } 193 Ok(DR) => { 194 self.flags.set_receive_fifo_full(false); 195 let c = self.read_fifo[self.read_pos]; 196 if self.read_count > 0 { 197 self.read_count -= 1; 198 self.read_pos = (self.read_pos + 1) & (self.fifo_depth() - 1); 199 } 200 if self.read_count == 0 { 201 self.flags.set_receive_fifo_empty(true); 202 } 203 if self.read_count + 1 == self.read_trigger { 204 self.int_level &= !registers::INT_RX; 205 } 206 // Update error bits. 207 self.receive_status_error_clear = c.to_be_bytes()[3].into(); 208 self.update(); 209 // Must call qemu_chr_fe_accept_input, so return Continue: 210 return std::ops::ControlFlow::Continue(c.into()); 211 } 212 Ok(RSR) => u8::from(self.receive_status_error_clear).into(), 213 Ok(FR) => u16::from(self.flags).into(), 214 Ok(FBRD) => self.fbrd.into(), 215 Ok(ILPR) => self.ilpr.into(), 216 Ok(IBRD) => self.ibrd.into(), 217 Ok(LCR_H) => u16::from(self.line_control).into(), 218 Ok(CR) => { 219 // We exercise our self-control. 220 u16::from(self.control).into() 221 } 222 Ok(FLS) => self.ifl.into(), 223 Ok(IMSC) => self.int_enabled.into(), 224 Ok(RIS) => self.int_level.into(), 225 Ok(MIS) => u64::from(self.int_level & self.int_enabled), 226 Ok(ICR) => { 227 // "The UARTICR Register is the interrupt clear register and is write-only" 228 // Source: ARM DDI 0183G 3.3.13 Interrupt Clear Register, UARTICR 229 0 230 } 231 Ok(DMACR) => self.dmacr.into(), 232 }) 233 } 234 235 pub fn write(&mut self, offset: hwaddr, value: u64) { 236 // eprintln!("write offset {offset} value {value}"); 237 use RegisterOffset::*; 238 let value: u32 = value as u32; 239 match RegisterOffset::try_from(offset) { 240 Err(_bad_offset) => { 241 eprintln!("write bad offset {offset} value {value}"); 242 } 243 Ok(DR) => { 244 // ??? Check if transmitter is enabled. 245 let ch: u8 = value as u8; 246 // XXX this blocks entire thread. Rewrite to use 247 // qemu_chr_fe_write and background I/O callbacks 248 249 // SAFETY: self.char_backend is a valid CharBackend instance after it's been 250 // initialized in realize(). 251 unsafe { 252 qemu_chr_fe_write_all(addr_of_mut!(self.char_backend), &ch, 1); 253 } 254 self.loopback_tx(value); 255 self.int_level |= registers::INT_TX; 256 self.update(); 257 } 258 Ok(RSR) => { 259 self.receive_status_error_clear = 0.into(); 260 } 261 Ok(FR) => { 262 // flag writes are ignored 263 } 264 Ok(ILPR) => { 265 self.ilpr = value; 266 } 267 Ok(IBRD) => { 268 self.ibrd = value; 269 } 270 Ok(FBRD) => { 271 self.fbrd = value; 272 } 273 Ok(LCR_H) => { 274 let value = value as u16; 275 let new_val: registers::LineControl = value.into(); 276 // Reset the FIFO state on FIFO enable or disable 277 if bool::from(self.line_control.fifos_enabled()) 278 ^ bool::from(new_val.fifos_enabled()) 279 { 280 self.reset_fifo(); 281 } 282 if self.line_control.send_break() ^ new_val.send_break() { 283 let mut break_enable: c_int = new_val.send_break().into(); 284 // SAFETY: self.char_backend is a valid CharBackend instance after it's been 285 // initialized in realize(). 286 unsafe { 287 qemu_chr_fe_ioctl( 288 addr_of_mut!(self.char_backend), 289 CHR_IOCTL_SERIAL_SET_BREAK as i32, 290 addr_of_mut!(break_enable).cast::<c_void>(), 291 ); 292 } 293 self.loopback_break(break_enable > 0); 294 } 295 self.line_control = new_val; 296 self.set_read_trigger(); 297 } 298 Ok(CR) => { 299 // ??? Need to implement the enable bit. 300 let value = value as u16; 301 self.control = value.into(); 302 self.loopback_mdmctrl(); 303 } 304 Ok(FLS) => { 305 self.ifl = value; 306 self.set_read_trigger(); 307 } 308 Ok(IMSC) => { 309 self.int_enabled = value; 310 self.update(); 311 } 312 Ok(RIS) => {} 313 Ok(MIS) => {} 314 Ok(ICR) => { 315 self.int_level &= !value; 316 self.update(); 317 } 318 Ok(DMACR) => { 319 self.dmacr = value; 320 if value & 3 > 0 { 321 // qemu_log_mask(LOG_UNIMP, "pl011: DMA not implemented\n"); 322 eprintln!("pl011: DMA not implemented"); 323 } 324 } 325 } 326 } 327 328 #[inline] 329 fn loopback_tx(&mut self, value: u32) { 330 if !self.loopback_enabled() { 331 return; 332 } 333 334 // Caveat: 335 // 336 // In real hardware, TX loopback happens at the serial-bit level 337 // and then reassembled by the RX logics back into bytes and placed 338 // into the RX fifo. That is, loopback happens after TX fifo. 339 // 340 // Because the real hardware TX fifo is time-drained at the frame 341 // rate governed by the configured serial format, some loopback 342 // bytes in TX fifo may still be able to get into the RX fifo 343 // that could be full at times while being drained at software 344 // pace. 345 // 346 // In such scenario, the RX draining pace is the major factor 347 // deciding which loopback bytes get into the RX fifo, unless 348 // hardware flow-control is enabled. 349 // 350 // For simplicity, the above described is not emulated. 351 self.put_fifo(value); 352 } 353 354 fn loopback_mdmctrl(&mut self) { 355 if !self.loopback_enabled() { 356 return; 357 } 358 359 /* 360 * Loopback software-driven modem control outputs to modem status inputs: 361 * FR.RI <= CR.Out2 362 * FR.DCD <= CR.Out1 363 * FR.CTS <= CR.RTS 364 * FR.DSR <= CR.DTR 365 * 366 * The loopback happens immediately even if this call is triggered 367 * by setting only CR.LBE. 368 * 369 * CTS/RTS updates due to enabled hardware flow controls are not 370 * dealt with here. 371 */ 372 373 self.flags.set_ring_indicator(self.control.out_2()); 374 self.flags.set_data_carrier_detect(self.control.out_1()); 375 self.flags.set_clear_to_send(self.control.request_to_send()); 376 self.flags 377 .set_data_set_ready(self.control.data_transmit_ready()); 378 379 // Change interrupts based on updated FR 380 let mut il = self.int_level; 381 382 il &= !Interrupt::MS; 383 384 if self.flags.data_set_ready() { 385 il |= Interrupt::DSR as u32; 386 } 387 if self.flags.data_carrier_detect() { 388 il |= Interrupt::DCD as u32; 389 } 390 if self.flags.clear_to_send() { 391 il |= Interrupt::CTS as u32; 392 } 393 if self.flags.ring_indicator() { 394 il |= Interrupt::RI as u32; 395 } 396 self.int_level = il; 397 self.update(); 398 } 399 400 fn loopback_break(&mut self, enable: bool) { 401 if enable { 402 self.loopback_tx(DATA_BREAK); 403 } 404 } 405 406 fn set_read_trigger(&mut self) { 407 self.read_trigger = 1; 408 } 409 410 pub fn realize(&mut self) { 411 // SAFETY: self.char_backend has the correct size and alignment for a 412 // CharBackend object, and its callbacks are of the correct types. 413 unsafe { 414 qemu_chr_fe_set_handlers( 415 addr_of_mut!(self.char_backend), 416 Some(pl011_can_receive), 417 Some(pl011_receive), 418 Some(pl011_event), 419 None, 420 addr_of_mut!(*self).cast::<c_void>(), 421 core::ptr::null_mut(), 422 true, 423 ); 424 } 425 } 426 427 pub fn reset(&mut self) { 428 self.line_control.reset(); 429 self.receive_status_error_clear.reset(); 430 self.dmacr = 0; 431 self.int_enabled = 0; 432 self.int_level = 0; 433 self.ilpr = 0; 434 self.ibrd = 0; 435 self.fbrd = 0; 436 self.read_trigger = 1; 437 self.ifl = 0x12; 438 self.control.reset(); 439 self.flags = 0.into(); 440 self.reset_fifo(); 441 } 442 443 pub fn reset_fifo(&mut self) { 444 self.read_count = 0; 445 self.read_pos = 0; 446 447 /* Reset FIFO flags */ 448 self.flags.reset(); 449 } 450 451 pub fn can_receive(&self) -> bool { 452 // trace_pl011_can_receive(s->lcr, s->read_count, r); 453 self.read_count < self.fifo_depth() 454 } 455 456 pub fn event(&mut self, event: QEMUChrEvent) { 457 if event == bindings::QEMUChrEvent::CHR_EVENT_BREAK && !self.fifo_enabled() { 458 self.put_fifo(DATA_BREAK); 459 self.receive_status_error_clear.set_break_error(true); 460 } 461 } 462 463 #[inline] 464 pub fn fifo_enabled(&self) -> bool { 465 matches!(self.line_control.fifos_enabled(), registers::Mode::FIFO) 466 } 467 468 #[inline] 469 pub fn loopback_enabled(&self) -> bool { 470 self.control.enable_loopback() 471 } 472 473 #[inline] 474 pub fn fifo_depth(&self) -> usize { 475 // Note: FIFO depth is expected to be power-of-2 476 if self.fifo_enabled() { 477 return PL011_FIFO_DEPTH; 478 } 479 1 480 } 481 482 pub fn put_fifo(&mut self, value: c_uint) { 483 let depth = self.fifo_depth(); 484 assert!(depth > 0); 485 let slot = (self.read_pos + self.read_count) & (depth - 1); 486 self.read_fifo[slot] = value; 487 self.read_count += 1; 488 self.flags.set_receive_fifo_empty(false); 489 if self.read_count == depth { 490 self.flags.set_receive_fifo_full(true); 491 } 492 493 if self.read_count == self.read_trigger { 494 self.int_level |= registers::INT_RX; 495 self.update(); 496 } 497 } 498 499 pub fn update(&self) { 500 let flags = self.int_level & self.int_enabled; 501 for (irq, i) in self.interrupts.iter().zip(IRQMASK) { 502 irq.set(flags & i != 0); 503 } 504 } 505 506 pub fn post_load(&mut self, _version_id: u32) -> Result<(), ()> { 507 /* Sanity-check input state */ 508 if self.read_pos >= self.read_fifo.len() || self.read_count > self.read_fifo.len() { 509 return Err(()); 510 } 511 512 if !self.fifo_enabled() && self.read_count > 0 && self.read_pos > 0 { 513 // Older versions of PL011 didn't ensure that the single 514 // character in the FIFO in FIFO-disabled mode is in 515 // element 0 of the array; convert to follow the current 516 // code's assumptions. 517 self.read_fifo[0] = self.read_fifo[self.read_pos]; 518 self.read_pos = 0; 519 } 520 521 self.ibrd &= IBRD_MASK; 522 self.fbrd &= FBRD_MASK; 523 524 Ok(()) 525 } 526 } 527 528 /// Which bits in the interrupt status matter for each outbound IRQ line ? 529 pub const IRQMASK: [u32; 6] = [ 530 /* combined IRQ */ 531 Interrupt::E 532 | Interrupt::MS 533 | Interrupt::RT as u32 534 | Interrupt::TX as u32 535 | Interrupt::RX as u32, 536 Interrupt::RX as u32, 537 Interrupt::TX as u32, 538 Interrupt::RT as u32, 539 Interrupt::MS, 540 Interrupt::E, 541 ]; 542 543 /// # Safety 544 /// 545 /// We expect the FFI user of this function to pass a valid pointer, that has 546 /// the same size as [`PL011State`]. We also expect the device is 547 /// readable/writeable from one thread at any time. 548 pub unsafe extern "C" fn pl011_can_receive(opaque: *mut c_void) -> c_int { 549 unsafe { 550 debug_assert!(!opaque.is_null()); 551 let state = NonNull::new_unchecked(opaque.cast::<PL011State>()); 552 state.as_ref().can_receive().into() 553 } 554 } 555 556 /// # Safety 557 /// 558 /// We expect the FFI user of this function to pass a valid pointer, that has 559 /// the same size as [`PL011State`]. We also expect the device is 560 /// readable/writeable from one thread at any time. 561 /// 562 /// The buffer and size arguments must also be valid. 563 pub unsafe extern "C" fn pl011_receive(opaque: *mut c_void, buf: *const u8, size: c_int) { 564 unsafe { 565 debug_assert!(!opaque.is_null()); 566 let mut state = NonNull::new_unchecked(opaque.cast::<PL011State>()); 567 if state.as_ref().loopback_enabled() { 568 return; 569 } 570 if size > 0 { 571 debug_assert!(!buf.is_null()); 572 state.as_mut().put_fifo(c_uint::from(buf.read_volatile())) 573 } 574 } 575 } 576 577 /// # Safety 578 /// 579 /// We expect the FFI user of this function to pass a valid pointer, that has 580 /// the same size as [`PL011State`]. We also expect the device is 581 /// readable/writeable from one thread at any time. 582 pub unsafe extern "C" fn pl011_event(opaque: *mut c_void, event: QEMUChrEvent) { 583 unsafe { 584 debug_assert!(!opaque.is_null()); 585 let mut state = NonNull::new_unchecked(opaque.cast::<PL011State>()); 586 state.as_mut().event(event) 587 } 588 } 589 590 /// # Safety 591 /// 592 /// We expect the FFI user of this function to pass a valid pointer for `chr`. 593 #[no_mangle] 594 pub unsafe extern "C" fn pl011_create( 595 addr: u64, 596 irq: qemu_irq, 597 chr: *mut Chardev, 598 ) -> *mut DeviceState { 599 unsafe { 600 let dev: *mut DeviceState = qdev_new(PL011State::TYPE_NAME.as_ptr()); 601 let sysbus: *mut SysBusDevice = dev.cast::<SysBusDevice>(); 602 603 qdev_prop_set_chr(dev, c_str!("chardev").as_ptr(), chr); 604 sysbus_realize_and_unref(sysbus, addr_of_mut!(error_fatal)); 605 sysbus_mmio_map(sysbus, 0, addr); 606 sysbus_connect_irq(sysbus, 0, irq); 607 dev 608 } 609 } 610 611 /// # Safety 612 /// 613 /// We expect the FFI user of this function to pass a valid pointer, that has 614 /// the same size as [`PL011State`]. We also expect the device is 615 /// readable/writeable from one thread at any time. 616 pub unsafe extern "C" fn pl011_init(obj: *mut Object) { 617 unsafe { 618 debug_assert!(!obj.is_null()); 619 let mut state = NonNull::new_unchecked(obj.cast::<PL011State>()); 620 state.as_mut().init(); 621 } 622 } 623 624 #[repr(C)] 625 #[derive(Debug, qemu_api_macros::Object)] 626 /// PL011 Luminary device model. 627 pub struct PL011Luminary { 628 parent_obj: PL011State, 629 } 630 631 #[repr(C)] 632 pub struct PL011LuminaryClass { 633 _inner: [u8; 0], 634 } 635 636 /// Initializes a pre-allocated, unitialized instance of `PL011Luminary`. 637 /// 638 /// # Safety 639 /// 640 /// We expect the FFI user of this function to pass a valid pointer, that has 641 /// the same size as [`PL011Luminary`]. We also expect the device is 642 /// readable/writeable from one thread at any time. 643 pub unsafe extern "C" fn pl011_luminary_init(obj: *mut Object) { 644 unsafe { 645 debug_assert!(!obj.is_null()); 646 let mut state = NonNull::new_unchecked(obj.cast::<PL011Luminary>()); 647 let state = state.as_mut(); 648 state.parent_obj.device_id = DeviceId::Luminary; 649 } 650 } 651 652 impl qemu_api::definitions::ClassInitImpl for PL011LuminaryClass { 653 const CLASS_INIT: Option<unsafe extern "C" fn(klass: *mut ObjectClass, data: *mut c_void)> = 654 None; 655 const CLASS_BASE_INIT: Option< 656 unsafe extern "C" fn(klass: *mut ObjectClass, data: *mut c_void), 657 > = None; 658 } 659 660 impl ObjectImpl for PL011Luminary { 661 type Class = PL011LuminaryClass; 662 const TYPE_NAME: &'static CStr = crate::TYPE_PL011_LUMINARY; 663 const PARENT_TYPE_NAME: Option<&'static CStr> = Some(crate::TYPE_PL011); 664 const INSTANCE_INIT: Option<unsafe extern "C" fn(obj: *mut Object)> = Some(pl011_luminary_init); 665 } 666