1 // Copyright 2024, Linaro Limited 2 // Author(s): Manos Pitsidianakis <manos.pitsidianakis@linaro.org> 3 // SPDX-License-Identifier: GPL-2.0-or-later 4 5 use core::ptr::{addr_of_mut, NonNull}; 6 use std::{ 7 ffi::CStr, 8 os::raw::{c_int, c_uchar, c_uint, c_void}, 9 }; 10 11 use qemu_api::{ 12 bindings::{self, *}, 13 c_str, 14 definitions::ObjectImpl, 15 device_class::TYPE_SYS_BUS_DEVICE, 16 irq::InterruptSource, 17 }; 18 19 use crate::{ 20 memory_ops::PL011_OPS, 21 registers::{self, Interrupt}, 22 RegisterOffset, 23 }; 24 25 /// Integer Baud Rate Divider, `UARTIBRD` 26 const IBRD_MASK: u32 = 0xffff; 27 28 /// Fractional Baud Rate Divider, `UARTFBRD` 29 const FBRD_MASK: u32 = 0x3f; 30 31 const DATA_BREAK: u32 = 1 << 10; 32 33 /// QEMU sourced constant. 34 pub const PL011_FIFO_DEPTH: usize = 16_usize; 35 36 #[derive(Clone, Copy, Debug)] 37 enum DeviceId { 38 #[allow(dead_code)] 39 Arm = 0, 40 Luminary, 41 } 42 43 impl std::ops::Index<hwaddr> for DeviceId { 44 type Output = c_uchar; 45 46 fn index(&self, idx: hwaddr) -> &Self::Output { 47 match self { 48 Self::Arm => &Self::PL011_ID_ARM[idx as usize], 49 Self::Luminary => &Self::PL011_ID_LUMINARY[idx as usize], 50 } 51 } 52 } 53 54 impl DeviceId { 55 const PL011_ID_ARM: [c_uchar; 8] = [0x11, 0x10, 0x14, 0x00, 0x0d, 0xf0, 0x05, 0xb1]; 56 const PL011_ID_LUMINARY: [c_uchar; 8] = [0x11, 0x00, 0x18, 0x01, 0x0d, 0xf0, 0x05, 0xb1]; 57 } 58 59 #[repr(C)] 60 #[derive(Debug, qemu_api_macros::Object, qemu_api_macros::offsets)] 61 /// PL011 Device Model in QEMU 62 pub struct PL011State { 63 pub parent_obj: SysBusDevice, 64 pub iomem: MemoryRegion, 65 #[doc(alias = "fr")] 66 pub flags: registers::Flags, 67 #[doc(alias = "lcr")] 68 pub line_control: registers::LineControl, 69 #[doc(alias = "rsr")] 70 pub receive_status_error_clear: registers::ReceiveStatusErrorClear, 71 #[doc(alias = "cr")] 72 pub control: registers::Control, 73 pub dmacr: u32, 74 pub int_enabled: u32, 75 pub int_level: u32, 76 pub read_fifo: [u32; PL011_FIFO_DEPTH], 77 pub ilpr: u32, 78 pub ibrd: u32, 79 pub fbrd: u32, 80 pub ifl: u32, 81 pub read_pos: usize, 82 pub read_count: usize, 83 pub read_trigger: usize, 84 #[doc(alias = "chr")] 85 pub char_backend: CharBackend, 86 /// QEMU interrupts 87 /// 88 /// ```text 89 /// * sysbus MMIO region 0: device registers 90 /// * sysbus IRQ 0: `UARTINTR` (combined interrupt line) 91 /// * sysbus IRQ 1: `UARTRXINTR` (receive FIFO interrupt line) 92 /// * sysbus IRQ 2: `UARTTXINTR` (transmit FIFO interrupt line) 93 /// * sysbus IRQ 3: `UARTRTINTR` (receive timeout interrupt line) 94 /// * sysbus IRQ 4: `UARTMSINTR` (momem status interrupt line) 95 /// * sysbus IRQ 5: `UARTEINTR` (error interrupt line) 96 /// ``` 97 #[doc(alias = "irq")] 98 pub interrupts: [InterruptSource; IRQMASK.len()], 99 #[doc(alias = "clk")] 100 pub clock: NonNull<Clock>, 101 #[doc(alias = "migrate_clk")] 102 pub migrate_clock: bool, 103 /// The byte string that identifies the device. 104 device_id: DeviceId, 105 } 106 107 impl ObjectImpl for PL011State { 108 type Class = PL011Class; 109 const TYPE_INFO: qemu_api::bindings::TypeInfo = qemu_api::type_info! { Self }; 110 const TYPE_NAME: &'static CStr = crate::TYPE_PL011; 111 const PARENT_TYPE_NAME: Option<&'static CStr> = Some(TYPE_SYS_BUS_DEVICE); 112 const INSTANCE_INIT: Option<unsafe extern "C" fn(obj: *mut Object)> = Some(pl011_init); 113 } 114 115 #[repr(C)] 116 pub struct PL011Class { 117 _inner: [u8; 0], 118 } 119 120 impl qemu_api::definitions::ClassInitImpl for PL011Class { 121 const CLASS_INIT: Option<unsafe extern "C" fn(klass: *mut ObjectClass, data: *mut c_void)> = 122 Some(crate::device_class::pl011_class_init); 123 const CLASS_BASE_INIT: Option< 124 unsafe extern "C" fn(klass: *mut ObjectClass, data: *mut c_void), 125 > = None; 126 } 127 128 impl PL011State { 129 /// Initializes a pre-allocated, unitialized instance of `PL011State`. 130 /// 131 /// # Safety 132 /// 133 /// `self` must point to a correctly sized and aligned location for the 134 /// `PL011State` type. It must not be called more than once on the same 135 /// location/instance. All its fields are expected to hold unitialized 136 /// values with the sole exception of `parent_obj`. 137 unsafe fn init(&mut self) { 138 const CLK_NAME: &CStr = c_str!("clk"); 139 140 let sbd = unsafe { &mut *(addr_of_mut!(*self).cast::<SysBusDevice>()) }; 141 142 // SAFETY: 143 // 144 // self and self.iomem are guaranteed to be valid at this point since callers 145 // must make sure the `self` reference is valid. 146 unsafe { 147 memory_region_init_io( 148 addr_of_mut!(self.iomem), 149 addr_of_mut!(*self).cast::<Object>(), 150 &PL011_OPS, 151 addr_of_mut!(*self).cast::<c_void>(), 152 Self::TYPE_INFO.name, 153 0x1000, 154 ); 155 sysbus_init_mmio(sbd, addr_of_mut!(self.iomem)); 156 } 157 158 for irq in self.interrupts.iter() { 159 sbd.init_irq(irq); 160 } 161 162 let dev = addr_of_mut!(*self).cast::<DeviceState>(); 163 164 // SAFETY: 165 // 166 // self.clock is not initialized at this point; but since `NonNull<_>` is Copy, 167 // we can overwrite the undefined value without side effects. This is 168 // safe since all PL011State instances are created by QOM code which 169 // calls this function to initialize the fields; therefore no code is 170 // able to access an invalid self.clock value. 171 unsafe { 172 self.clock = NonNull::new(qdev_init_clock_in( 173 dev, 174 CLK_NAME.as_ptr(), 175 None, /* pl011_clock_update */ 176 addr_of_mut!(*self).cast::<c_void>(), 177 ClockEvent::ClockUpdate.0, 178 )) 179 .unwrap(); 180 } 181 } 182 183 pub fn read(&mut self, offset: hwaddr, _size: c_uint) -> std::ops::ControlFlow<u64, u64> { 184 use RegisterOffset::*; 185 186 std::ops::ControlFlow::Break(match RegisterOffset::try_from(offset) { 187 Err(v) if (0x3f8..0x400).contains(&(v >> 2)) => { 188 u64::from(self.device_id[(offset - 0xfe0) >> 2]) 189 } 190 Err(_) => { 191 // qemu_log_mask(LOG_GUEST_ERROR, "pl011_read: Bad offset 0x%x\n", (int)offset); 192 0 193 } 194 Ok(DR) => { 195 self.flags.set_receive_fifo_full(false); 196 let c = self.read_fifo[self.read_pos]; 197 if self.read_count > 0 { 198 self.read_count -= 1; 199 self.read_pos = (self.read_pos + 1) & (self.fifo_depth() - 1); 200 } 201 if self.read_count == 0 { 202 self.flags.set_receive_fifo_empty(true); 203 } 204 if self.read_count + 1 == self.read_trigger { 205 self.int_level &= !registers::INT_RX; 206 } 207 // Update error bits. 208 self.receive_status_error_clear = c.to_be_bytes()[3].into(); 209 self.update(); 210 // Must call qemu_chr_fe_accept_input, so return Continue: 211 return std::ops::ControlFlow::Continue(c.into()); 212 } 213 Ok(RSR) => u8::from(self.receive_status_error_clear).into(), 214 Ok(FR) => u16::from(self.flags).into(), 215 Ok(FBRD) => self.fbrd.into(), 216 Ok(ILPR) => self.ilpr.into(), 217 Ok(IBRD) => self.ibrd.into(), 218 Ok(LCR_H) => u16::from(self.line_control).into(), 219 Ok(CR) => { 220 // We exercise our self-control. 221 u16::from(self.control).into() 222 } 223 Ok(FLS) => self.ifl.into(), 224 Ok(IMSC) => self.int_enabled.into(), 225 Ok(RIS) => self.int_level.into(), 226 Ok(MIS) => u64::from(self.int_level & self.int_enabled), 227 Ok(ICR) => { 228 // "The UARTICR Register is the interrupt clear register and is write-only" 229 // Source: ARM DDI 0183G 3.3.13 Interrupt Clear Register, UARTICR 230 0 231 } 232 Ok(DMACR) => self.dmacr.into(), 233 }) 234 } 235 236 pub fn write(&mut self, offset: hwaddr, value: u64) { 237 // eprintln!("write offset {offset} value {value}"); 238 use RegisterOffset::*; 239 let value: u32 = value as u32; 240 match RegisterOffset::try_from(offset) { 241 Err(_bad_offset) => { 242 eprintln!("write bad offset {offset} value {value}"); 243 } 244 Ok(DR) => { 245 // ??? Check if transmitter is enabled. 246 let ch: u8 = value as u8; 247 // XXX this blocks entire thread. Rewrite to use 248 // qemu_chr_fe_write and background I/O callbacks 249 250 // SAFETY: self.char_backend is a valid CharBackend instance after it's been 251 // initialized in realize(). 252 unsafe { 253 qemu_chr_fe_write_all(addr_of_mut!(self.char_backend), &ch, 1); 254 } 255 self.loopback_tx(value); 256 self.int_level |= registers::INT_TX; 257 self.update(); 258 } 259 Ok(RSR) => { 260 self.receive_status_error_clear = 0.into(); 261 } 262 Ok(FR) => { 263 // flag writes are ignored 264 } 265 Ok(ILPR) => { 266 self.ilpr = value; 267 } 268 Ok(IBRD) => { 269 self.ibrd = value; 270 } 271 Ok(FBRD) => { 272 self.fbrd = value; 273 } 274 Ok(LCR_H) => { 275 let value = value as u16; 276 let new_val: registers::LineControl = value.into(); 277 // Reset the FIFO state on FIFO enable or disable 278 if bool::from(self.line_control.fifos_enabled()) 279 ^ bool::from(new_val.fifos_enabled()) 280 { 281 self.reset_fifo(); 282 } 283 if self.line_control.send_break() ^ new_val.send_break() { 284 let mut break_enable: c_int = new_val.send_break().into(); 285 // SAFETY: self.char_backend is a valid CharBackend instance after it's been 286 // initialized in realize(). 287 unsafe { 288 qemu_chr_fe_ioctl( 289 addr_of_mut!(self.char_backend), 290 CHR_IOCTL_SERIAL_SET_BREAK as i32, 291 addr_of_mut!(break_enable).cast::<c_void>(), 292 ); 293 } 294 self.loopback_break(break_enable > 0); 295 } 296 self.line_control = new_val; 297 self.set_read_trigger(); 298 } 299 Ok(CR) => { 300 // ??? Need to implement the enable bit. 301 let value = value as u16; 302 self.control = value.into(); 303 self.loopback_mdmctrl(); 304 } 305 Ok(FLS) => { 306 self.ifl = value; 307 self.set_read_trigger(); 308 } 309 Ok(IMSC) => { 310 self.int_enabled = value; 311 self.update(); 312 } 313 Ok(RIS) => {} 314 Ok(MIS) => {} 315 Ok(ICR) => { 316 self.int_level &= !value; 317 self.update(); 318 } 319 Ok(DMACR) => { 320 self.dmacr = value; 321 if value & 3 > 0 { 322 // qemu_log_mask(LOG_UNIMP, "pl011: DMA not implemented\n"); 323 eprintln!("pl011: DMA not implemented"); 324 } 325 } 326 } 327 } 328 329 #[inline] 330 fn loopback_tx(&mut self, value: u32) { 331 if !self.loopback_enabled() { 332 return; 333 } 334 335 // Caveat: 336 // 337 // In real hardware, TX loopback happens at the serial-bit level 338 // and then reassembled by the RX logics back into bytes and placed 339 // into the RX fifo. That is, loopback happens after TX fifo. 340 // 341 // Because the real hardware TX fifo is time-drained at the frame 342 // rate governed by the configured serial format, some loopback 343 // bytes in TX fifo may still be able to get into the RX fifo 344 // that could be full at times while being drained at software 345 // pace. 346 // 347 // In such scenario, the RX draining pace is the major factor 348 // deciding which loopback bytes get into the RX fifo, unless 349 // hardware flow-control is enabled. 350 // 351 // For simplicity, the above described is not emulated. 352 self.put_fifo(value); 353 } 354 355 fn loopback_mdmctrl(&mut self) { 356 if !self.loopback_enabled() { 357 return; 358 } 359 360 /* 361 * Loopback software-driven modem control outputs to modem status inputs: 362 * FR.RI <= CR.Out2 363 * FR.DCD <= CR.Out1 364 * FR.CTS <= CR.RTS 365 * FR.DSR <= CR.DTR 366 * 367 * The loopback happens immediately even if this call is triggered 368 * by setting only CR.LBE. 369 * 370 * CTS/RTS updates due to enabled hardware flow controls are not 371 * dealt with here. 372 */ 373 374 self.flags.set_ring_indicator(self.control.out_2()); 375 self.flags.set_data_carrier_detect(self.control.out_1()); 376 self.flags.set_clear_to_send(self.control.request_to_send()); 377 self.flags 378 .set_data_set_ready(self.control.data_transmit_ready()); 379 380 // Change interrupts based on updated FR 381 let mut il = self.int_level; 382 383 il &= !Interrupt::MS; 384 385 if self.flags.data_set_ready() { 386 il |= Interrupt::DSR as u32; 387 } 388 if self.flags.data_carrier_detect() { 389 il |= Interrupt::DCD as u32; 390 } 391 if self.flags.clear_to_send() { 392 il |= Interrupt::CTS as u32; 393 } 394 if self.flags.ring_indicator() { 395 il |= Interrupt::RI as u32; 396 } 397 self.int_level = il; 398 self.update(); 399 } 400 401 fn loopback_break(&mut self, enable: bool) { 402 if enable { 403 self.loopback_tx(DATA_BREAK); 404 } 405 } 406 407 fn set_read_trigger(&mut self) { 408 self.read_trigger = 1; 409 } 410 411 pub fn realize(&mut self) { 412 // SAFETY: self.char_backend has the correct size and alignment for a 413 // CharBackend object, and its callbacks are of the correct types. 414 unsafe { 415 qemu_chr_fe_set_handlers( 416 addr_of_mut!(self.char_backend), 417 Some(pl011_can_receive), 418 Some(pl011_receive), 419 Some(pl011_event), 420 None, 421 addr_of_mut!(*self).cast::<c_void>(), 422 core::ptr::null_mut(), 423 true, 424 ); 425 } 426 } 427 428 pub fn reset(&mut self) { 429 self.line_control.reset(); 430 self.receive_status_error_clear.reset(); 431 self.dmacr = 0; 432 self.int_enabled = 0; 433 self.int_level = 0; 434 self.ilpr = 0; 435 self.ibrd = 0; 436 self.fbrd = 0; 437 self.read_trigger = 1; 438 self.ifl = 0x12; 439 self.control.reset(); 440 self.flags = 0.into(); 441 self.reset_fifo(); 442 } 443 444 pub fn reset_fifo(&mut self) { 445 self.read_count = 0; 446 self.read_pos = 0; 447 448 /* Reset FIFO flags */ 449 self.flags.reset(); 450 } 451 452 pub fn can_receive(&self) -> bool { 453 // trace_pl011_can_receive(s->lcr, s->read_count, r); 454 self.read_count < self.fifo_depth() 455 } 456 457 pub fn event(&mut self, event: QEMUChrEvent) { 458 if event == bindings::QEMUChrEvent::CHR_EVENT_BREAK && !self.fifo_enabled() { 459 self.put_fifo(DATA_BREAK); 460 self.receive_status_error_clear.set_break_error(true); 461 } 462 } 463 464 #[inline] 465 pub fn fifo_enabled(&self) -> bool { 466 matches!(self.line_control.fifos_enabled(), registers::Mode::FIFO) 467 } 468 469 #[inline] 470 pub fn loopback_enabled(&self) -> bool { 471 self.control.enable_loopback() 472 } 473 474 #[inline] 475 pub fn fifo_depth(&self) -> usize { 476 // Note: FIFO depth is expected to be power-of-2 477 if self.fifo_enabled() { 478 return PL011_FIFO_DEPTH; 479 } 480 1 481 } 482 483 pub fn put_fifo(&mut self, value: c_uint) { 484 let depth = self.fifo_depth(); 485 assert!(depth > 0); 486 let slot = (self.read_pos + self.read_count) & (depth - 1); 487 self.read_fifo[slot] = value; 488 self.read_count += 1; 489 self.flags.set_receive_fifo_empty(false); 490 if self.read_count == depth { 491 self.flags.set_receive_fifo_full(true); 492 } 493 494 if self.read_count == self.read_trigger { 495 self.int_level |= registers::INT_RX; 496 self.update(); 497 } 498 } 499 500 pub fn update(&self) { 501 let flags = self.int_level & self.int_enabled; 502 for (irq, i) in self.interrupts.iter().zip(IRQMASK) { 503 irq.set(flags & i != 0); 504 } 505 } 506 507 pub fn post_load(&mut self, _version_id: u32) -> Result<(), ()> { 508 /* Sanity-check input state */ 509 if self.read_pos >= self.read_fifo.len() || self.read_count > self.read_fifo.len() { 510 return Err(()); 511 } 512 513 if !self.fifo_enabled() && self.read_count > 0 && self.read_pos > 0 { 514 // Older versions of PL011 didn't ensure that the single 515 // character in the FIFO in FIFO-disabled mode is in 516 // element 0 of the array; convert to follow the current 517 // code's assumptions. 518 self.read_fifo[0] = self.read_fifo[self.read_pos]; 519 self.read_pos = 0; 520 } 521 522 self.ibrd &= IBRD_MASK; 523 self.fbrd &= FBRD_MASK; 524 525 Ok(()) 526 } 527 } 528 529 /// Which bits in the interrupt status matter for each outbound IRQ line ? 530 pub const IRQMASK: [u32; 6] = [ 531 /* combined IRQ */ 532 Interrupt::E 533 | Interrupt::MS 534 | Interrupt::RT as u32 535 | Interrupt::TX as u32 536 | Interrupt::RX as u32, 537 Interrupt::RX as u32, 538 Interrupt::TX as u32, 539 Interrupt::RT as u32, 540 Interrupt::MS, 541 Interrupt::E, 542 ]; 543 544 /// # Safety 545 /// 546 /// We expect the FFI user of this function to pass a valid pointer, that has 547 /// the same size as [`PL011State`]. We also expect the device is 548 /// readable/writeable from one thread at any time. 549 pub unsafe extern "C" fn pl011_can_receive(opaque: *mut c_void) -> c_int { 550 unsafe { 551 debug_assert!(!opaque.is_null()); 552 let state = NonNull::new_unchecked(opaque.cast::<PL011State>()); 553 state.as_ref().can_receive().into() 554 } 555 } 556 557 /// # Safety 558 /// 559 /// We expect the FFI user of this function to pass a valid pointer, that has 560 /// the same size as [`PL011State`]. We also expect the device is 561 /// readable/writeable from one thread at any time. 562 /// 563 /// The buffer and size arguments must also be valid. 564 pub unsafe extern "C" fn pl011_receive(opaque: *mut c_void, buf: *const u8, size: c_int) { 565 unsafe { 566 debug_assert!(!opaque.is_null()); 567 let mut state = NonNull::new_unchecked(opaque.cast::<PL011State>()); 568 if state.as_ref().loopback_enabled() { 569 return; 570 } 571 if size > 0 { 572 debug_assert!(!buf.is_null()); 573 state.as_mut().put_fifo(c_uint::from(buf.read_volatile())) 574 } 575 } 576 } 577 578 /// # Safety 579 /// 580 /// We expect the FFI user of this function to pass a valid pointer, that has 581 /// the same size as [`PL011State`]. We also expect the device is 582 /// readable/writeable from one thread at any time. 583 pub unsafe extern "C" fn pl011_event(opaque: *mut c_void, event: QEMUChrEvent) { 584 unsafe { 585 debug_assert!(!opaque.is_null()); 586 let mut state = NonNull::new_unchecked(opaque.cast::<PL011State>()); 587 state.as_mut().event(event) 588 } 589 } 590 591 /// # Safety 592 /// 593 /// We expect the FFI user of this function to pass a valid pointer for `chr`. 594 #[no_mangle] 595 pub unsafe extern "C" fn pl011_create( 596 addr: u64, 597 irq: qemu_irq, 598 chr: *mut Chardev, 599 ) -> *mut DeviceState { 600 unsafe { 601 let dev: *mut DeviceState = qdev_new(PL011State::TYPE_INFO.name); 602 let sysbus: *mut SysBusDevice = dev.cast::<SysBusDevice>(); 603 604 qdev_prop_set_chr(dev, c_str!("chardev").as_ptr(), chr); 605 sysbus_realize_and_unref(sysbus, addr_of_mut!(error_fatal)); 606 sysbus_mmio_map(sysbus, 0, addr); 607 sysbus_connect_irq(sysbus, 0, irq); 608 dev 609 } 610 } 611 612 /// # Safety 613 /// 614 /// We expect the FFI user of this function to pass a valid pointer, that has 615 /// the same size as [`PL011State`]. We also expect the device is 616 /// readable/writeable from one thread at any time. 617 pub unsafe extern "C" fn pl011_init(obj: *mut Object) { 618 unsafe { 619 debug_assert!(!obj.is_null()); 620 let mut state = NonNull::new_unchecked(obj.cast::<PL011State>()); 621 state.as_mut().init(); 622 } 623 } 624 625 #[repr(C)] 626 #[derive(Debug, qemu_api_macros::Object)] 627 /// PL011 Luminary device model. 628 pub struct PL011Luminary { 629 parent_obj: PL011State, 630 } 631 632 #[repr(C)] 633 pub struct PL011LuminaryClass { 634 _inner: [u8; 0], 635 } 636 637 /// Initializes a pre-allocated, unitialized instance of `PL011Luminary`. 638 /// 639 /// # Safety 640 /// 641 /// We expect the FFI user of this function to pass a valid pointer, that has 642 /// the same size as [`PL011Luminary`]. We also expect the device is 643 /// readable/writeable from one thread at any time. 644 pub unsafe extern "C" fn pl011_luminary_init(obj: *mut Object) { 645 unsafe { 646 debug_assert!(!obj.is_null()); 647 let mut state = NonNull::new_unchecked(obj.cast::<PL011Luminary>()); 648 let state = state.as_mut(); 649 state.parent_obj.device_id = DeviceId::Luminary; 650 } 651 } 652 653 impl qemu_api::definitions::ClassInitImpl for PL011LuminaryClass { 654 const CLASS_INIT: Option<unsafe extern "C" fn(klass: *mut ObjectClass, data: *mut c_void)> = 655 None; 656 const CLASS_BASE_INIT: Option< 657 unsafe extern "C" fn(klass: *mut ObjectClass, data: *mut c_void), 658 > = None; 659 } 660 661 impl ObjectImpl for PL011Luminary { 662 type Class = PL011LuminaryClass; 663 const TYPE_INFO: qemu_api::bindings::TypeInfo = qemu_api::type_info! { Self }; 664 const TYPE_NAME: &'static CStr = crate::TYPE_PL011_LUMINARY; 665 const PARENT_TYPE_NAME: Option<&'static CStr> = Some(crate::TYPE_PL011); 666 const INSTANCE_INIT: Option<unsafe extern "C" fn(obj: *mut Object)> = Some(pl011_luminary_init); 667 } 668