1 // Copyright 2024, Linaro Limited 2 // Author(s): Manos Pitsidianakis <manos.pitsidianakis@linaro.org> 3 // SPDX-License-Identifier: GPL-2.0-or-later 4 5 use core::ptr::{addr_of_mut, NonNull}; 6 use std::{ 7 ffi::CStr, 8 os::raw::{c_int, c_uchar, c_uint, c_void}, 9 }; 10 11 use qemu_api::{ 12 bindings::{self, *}, 13 c_str, 14 irq::InterruptSource, 15 prelude::*, 16 qdev::DeviceImpl, 17 qom::ObjectImpl, 18 }; 19 20 use crate::{ 21 device_class, 22 memory_ops::PL011_OPS, 23 registers::{self, Interrupt}, 24 RegisterOffset, 25 }; 26 27 /// Integer Baud Rate Divider, `UARTIBRD` 28 const IBRD_MASK: u32 = 0xffff; 29 30 /// Fractional Baud Rate Divider, `UARTFBRD` 31 const FBRD_MASK: u32 = 0x3f; 32 33 /// QEMU sourced constant. 34 pub const PL011_FIFO_DEPTH: usize = 16_usize; 35 36 #[derive(Clone, Copy, Debug)] 37 enum DeviceId { 38 #[allow(dead_code)] 39 Arm = 0, 40 Luminary, 41 } 42 43 impl std::ops::Index<hwaddr> for DeviceId { 44 type Output = c_uchar; 45 46 fn index(&self, idx: hwaddr) -> &Self::Output { 47 match self { 48 Self::Arm => &Self::PL011_ID_ARM[idx as usize], 49 Self::Luminary => &Self::PL011_ID_LUMINARY[idx as usize], 50 } 51 } 52 } 53 54 impl DeviceId { 55 const PL011_ID_ARM: [c_uchar; 8] = [0x11, 0x10, 0x14, 0x00, 0x0d, 0xf0, 0x05, 0xb1]; 56 const PL011_ID_LUMINARY: [c_uchar; 8] = [0x11, 0x00, 0x18, 0x01, 0x0d, 0xf0, 0x05, 0xb1]; 57 } 58 59 #[repr(C)] 60 #[derive(Debug, qemu_api_macros::Object, qemu_api_macros::offsets)] 61 /// PL011 Device Model in QEMU 62 pub struct PL011State { 63 pub parent_obj: SysBusDevice, 64 pub iomem: MemoryRegion, 65 #[doc(alias = "fr")] 66 pub flags: registers::Flags, 67 #[doc(alias = "lcr")] 68 pub line_control: registers::LineControl, 69 #[doc(alias = "rsr")] 70 pub receive_status_error_clear: registers::ReceiveStatusErrorClear, 71 #[doc(alias = "cr")] 72 pub control: registers::Control, 73 pub dmacr: u32, 74 pub int_enabled: u32, 75 pub int_level: u32, 76 pub read_fifo: [registers::Data; PL011_FIFO_DEPTH], 77 pub ilpr: u32, 78 pub ibrd: u32, 79 pub fbrd: u32, 80 pub ifl: u32, 81 pub read_pos: usize, 82 pub read_count: usize, 83 pub read_trigger: usize, 84 #[doc(alias = "chr")] 85 pub char_backend: CharBackend, 86 /// QEMU interrupts 87 /// 88 /// ```text 89 /// * sysbus MMIO region 0: device registers 90 /// * sysbus IRQ 0: `UARTINTR` (combined interrupt line) 91 /// * sysbus IRQ 1: `UARTRXINTR` (receive FIFO interrupt line) 92 /// * sysbus IRQ 2: `UARTTXINTR` (transmit FIFO interrupt line) 93 /// * sysbus IRQ 3: `UARTRTINTR` (receive timeout interrupt line) 94 /// * sysbus IRQ 4: `UARTMSINTR` (momem status interrupt line) 95 /// * sysbus IRQ 5: `UARTEINTR` (error interrupt line) 96 /// ``` 97 #[doc(alias = "irq")] 98 pub interrupts: [InterruptSource; IRQMASK.len()], 99 #[doc(alias = "clk")] 100 pub clock: NonNull<Clock>, 101 #[doc(alias = "migrate_clk")] 102 pub migrate_clock: bool, 103 /// The byte string that identifies the device. 104 device_id: DeviceId, 105 } 106 107 qom_isa!(PL011State : SysBusDevice, DeviceState, Object); 108 109 unsafe impl ObjectType for PL011State { 110 type Class = <SysBusDevice as ObjectType>::Class; 111 const TYPE_NAME: &'static CStr = crate::TYPE_PL011; 112 } 113 114 impl ObjectImpl for PL011State { 115 type ParentType = SysBusDevice; 116 117 const INSTANCE_INIT: Option<unsafe fn(&mut Self)> = Some(Self::init); 118 } 119 120 impl DeviceImpl for PL011State { 121 fn properties() -> &'static [Property] { 122 &device_class::PL011_PROPERTIES 123 } 124 fn vmsd() -> Option<&'static VMStateDescription> { 125 Some(&device_class::VMSTATE_PL011) 126 } 127 const REALIZE: Option<fn(&mut Self)> = Some(Self::realize); 128 const RESET: Option<fn(&mut Self)> = Some(Self::reset); 129 } 130 131 impl PL011State { 132 /// Initializes a pre-allocated, unitialized instance of `PL011State`. 133 /// 134 /// # Safety 135 /// 136 /// `self` must point to a correctly sized and aligned location for the 137 /// `PL011State` type. It must not be called more than once on the same 138 /// location/instance. All its fields are expected to hold unitialized 139 /// values with the sole exception of `parent_obj`. 140 unsafe fn init(&mut self) { 141 const CLK_NAME: &CStr = c_str!("clk"); 142 143 // SAFETY: 144 // 145 // self and self.iomem are guaranteed to be valid at this point since callers 146 // must make sure the `self` reference is valid. 147 unsafe { 148 memory_region_init_io( 149 addr_of_mut!(self.iomem), 150 addr_of_mut!(*self).cast::<Object>(), 151 &PL011_OPS, 152 addr_of_mut!(*self).cast::<c_void>(), 153 Self::TYPE_NAME.as_ptr(), 154 0x1000, 155 ); 156 157 let sbd: &mut SysBusDevice = self.upcast_mut(); 158 sysbus_init_mmio(sbd, addr_of_mut!(self.iomem)); 159 } 160 161 for irq in self.interrupts.iter() { 162 let sbd: &SysBusDevice = self.upcast(); 163 sbd.init_irq(irq); 164 } 165 166 // SAFETY: 167 // 168 // self.clock is not initialized at this point; but since `NonNull<_>` is Copy, 169 // we can overwrite the undefined value without side effects. This is 170 // safe since all PL011State instances are created by QOM code which 171 // calls this function to initialize the fields; therefore no code is 172 // able to access an invalid self.clock value. 173 unsafe { 174 let dev: &mut DeviceState = self.upcast_mut(); 175 self.clock = NonNull::new(qdev_init_clock_in( 176 dev, 177 CLK_NAME.as_ptr(), 178 None, /* pl011_clock_update */ 179 addr_of_mut!(*self).cast::<c_void>(), 180 ClockEvent::ClockUpdate.0, 181 )) 182 .unwrap(); 183 } 184 } 185 186 pub fn read(&mut self, offset: hwaddr, _size: c_uint) -> std::ops::ControlFlow<u64, u64> { 187 use RegisterOffset::*; 188 189 let value = match RegisterOffset::try_from(offset) { 190 Err(v) if (0x3f8..0x400).contains(&(v >> 2)) => { 191 u32::from(self.device_id[(offset - 0xfe0) >> 2]) 192 } 193 Err(_) => { 194 // qemu_log_mask(LOG_GUEST_ERROR, "pl011_read: Bad offset 0x%x\n", (int)offset); 195 0 196 } 197 Ok(DR) => { 198 self.flags.set_receive_fifo_full(false); 199 let c = self.read_fifo[self.read_pos]; 200 if self.read_count > 0 { 201 self.read_count -= 1; 202 self.read_pos = (self.read_pos + 1) & (self.fifo_depth() - 1); 203 } 204 if self.read_count == 0 { 205 self.flags.set_receive_fifo_empty(true); 206 } 207 if self.read_count + 1 == self.read_trigger { 208 self.int_level &= !registers::INT_RX; 209 } 210 // Update error bits. 211 self.receive_status_error_clear.set_from_data(c); 212 self.update(); 213 // Must call qemu_chr_fe_accept_input, so return Continue: 214 let c = u32::from(c); 215 return std::ops::ControlFlow::Continue(u64::from(c)); 216 } 217 Ok(RSR) => u32::from(self.receive_status_error_clear), 218 Ok(FR) => u32::from(self.flags), 219 Ok(FBRD) => self.fbrd, 220 Ok(ILPR) => self.ilpr, 221 Ok(IBRD) => self.ibrd, 222 Ok(LCR_H) => u32::from(self.line_control), 223 Ok(CR) => u32::from(self.control), 224 Ok(FLS) => self.ifl, 225 Ok(IMSC) => self.int_enabled, 226 Ok(RIS) => self.int_level, 227 Ok(MIS) => self.int_level & self.int_enabled, 228 Ok(ICR) => { 229 // "The UARTICR Register is the interrupt clear register and is write-only" 230 // Source: ARM DDI 0183G 3.3.13 Interrupt Clear Register, UARTICR 231 0 232 } 233 Ok(DMACR) => self.dmacr, 234 }; 235 std::ops::ControlFlow::Break(value.into()) 236 } 237 238 pub fn write(&mut self, offset: hwaddr, value: u64) { 239 // eprintln!("write offset {offset} value {value}"); 240 use RegisterOffset::*; 241 let value: u32 = value as u32; 242 match RegisterOffset::try_from(offset) { 243 Err(_bad_offset) => { 244 eprintln!("write bad offset {offset} value {value}"); 245 } 246 Ok(DR) => { 247 // ??? Check if transmitter is enabled. 248 let ch: u8 = value as u8; 249 // XXX this blocks entire thread. Rewrite to use 250 // qemu_chr_fe_write and background I/O callbacks 251 252 // SAFETY: self.char_backend is a valid CharBackend instance after it's been 253 // initialized in realize(). 254 unsafe { 255 qemu_chr_fe_write_all(addr_of_mut!(self.char_backend), &ch, 1); 256 } 257 self.loopback_tx(value); 258 self.int_level |= registers::INT_TX; 259 self.update(); 260 } 261 Ok(RSR) => { 262 self.receive_status_error_clear.reset(); 263 } 264 Ok(FR) => { 265 // flag writes are ignored 266 } 267 Ok(ILPR) => { 268 self.ilpr = value; 269 } 270 Ok(IBRD) => { 271 self.ibrd = value; 272 } 273 Ok(FBRD) => { 274 self.fbrd = value; 275 } 276 Ok(LCR_H) => { 277 let new_val: registers::LineControl = value.into(); 278 // Reset the FIFO state on FIFO enable or disable 279 if bool::from(self.line_control.fifos_enabled()) 280 ^ bool::from(new_val.fifos_enabled()) 281 { 282 self.reset_rx_fifo(); 283 self.reset_tx_fifo(); 284 } 285 if self.line_control.send_break() ^ new_val.send_break() { 286 let mut break_enable: c_int = new_val.send_break().into(); 287 // SAFETY: self.char_backend is a valid CharBackend instance after it's been 288 // initialized in realize(). 289 unsafe { 290 qemu_chr_fe_ioctl( 291 addr_of_mut!(self.char_backend), 292 CHR_IOCTL_SERIAL_SET_BREAK as i32, 293 addr_of_mut!(break_enable).cast::<c_void>(), 294 ); 295 } 296 self.loopback_break(break_enable > 0); 297 } 298 self.line_control = new_val; 299 self.set_read_trigger(); 300 } 301 Ok(CR) => { 302 // ??? Need to implement the enable bit. 303 self.control = value.into(); 304 self.loopback_mdmctrl(); 305 } 306 Ok(FLS) => { 307 self.ifl = value; 308 self.set_read_trigger(); 309 } 310 Ok(IMSC) => { 311 self.int_enabled = value; 312 self.update(); 313 } 314 Ok(RIS) => {} 315 Ok(MIS) => {} 316 Ok(ICR) => { 317 self.int_level &= !value; 318 self.update(); 319 } 320 Ok(DMACR) => { 321 self.dmacr = value; 322 if value & 3 > 0 { 323 // qemu_log_mask(LOG_UNIMP, "pl011: DMA not implemented\n"); 324 eprintln!("pl011: DMA not implemented"); 325 } 326 } 327 } 328 } 329 330 #[inline] 331 fn loopback_tx(&mut self, value: u32) { 332 if !self.loopback_enabled() { 333 return; 334 } 335 336 // Caveat: 337 // 338 // In real hardware, TX loopback happens at the serial-bit level 339 // and then reassembled by the RX logics back into bytes and placed 340 // into the RX fifo. That is, loopback happens after TX fifo. 341 // 342 // Because the real hardware TX fifo is time-drained at the frame 343 // rate governed by the configured serial format, some loopback 344 // bytes in TX fifo may still be able to get into the RX fifo 345 // that could be full at times while being drained at software 346 // pace. 347 // 348 // In such scenario, the RX draining pace is the major factor 349 // deciding which loopback bytes get into the RX fifo, unless 350 // hardware flow-control is enabled. 351 // 352 // For simplicity, the above described is not emulated. 353 self.put_fifo(value); 354 } 355 356 fn loopback_mdmctrl(&mut self) { 357 if !self.loopback_enabled() { 358 return; 359 } 360 361 /* 362 * Loopback software-driven modem control outputs to modem status inputs: 363 * FR.RI <= CR.Out2 364 * FR.DCD <= CR.Out1 365 * FR.CTS <= CR.RTS 366 * FR.DSR <= CR.DTR 367 * 368 * The loopback happens immediately even if this call is triggered 369 * by setting only CR.LBE. 370 * 371 * CTS/RTS updates due to enabled hardware flow controls are not 372 * dealt with here. 373 */ 374 375 self.flags.set_ring_indicator(self.control.out_2()); 376 self.flags.set_data_carrier_detect(self.control.out_1()); 377 self.flags.set_clear_to_send(self.control.request_to_send()); 378 self.flags 379 .set_data_set_ready(self.control.data_transmit_ready()); 380 381 // Change interrupts based on updated FR 382 let mut il = self.int_level; 383 384 il &= !Interrupt::MS; 385 386 if self.flags.data_set_ready() { 387 il |= Interrupt::DSR as u32; 388 } 389 if self.flags.data_carrier_detect() { 390 il |= Interrupt::DCD as u32; 391 } 392 if self.flags.clear_to_send() { 393 il |= Interrupt::CTS as u32; 394 } 395 if self.flags.ring_indicator() { 396 il |= Interrupt::RI as u32; 397 } 398 self.int_level = il; 399 self.update(); 400 } 401 402 fn loopback_break(&mut self, enable: bool) { 403 if enable { 404 self.loopback_tx(registers::Data::BREAK.into()); 405 } 406 } 407 408 fn set_read_trigger(&mut self) { 409 self.read_trigger = 1; 410 } 411 412 pub fn realize(&mut self) { 413 // SAFETY: self.char_backend has the correct size and alignment for a 414 // CharBackend object, and its callbacks are of the correct types. 415 unsafe { 416 qemu_chr_fe_set_handlers( 417 addr_of_mut!(self.char_backend), 418 Some(pl011_can_receive), 419 Some(pl011_receive), 420 Some(pl011_event), 421 None, 422 addr_of_mut!(*self).cast::<c_void>(), 423 core::ptr::null_mut(), 424 true, 425 ); 426 } 427 } 428 429 pub fn reset(&mut self) { 430 self.line_control.reset(); 431 self.receive_status_error_clear.reset(); 432 self.dmacr = 0; 433 self.int_enabled = 0; 434 self.int_level = 0; 435 self.ilpr = 0; 436 self.ibrd = 0; 437 self.fbrd = 0; 438 self.read_trigger = 1; 439 self.ifl = 0x12; 440 self.control.reset(); 441 self.flags.reset(); 442 self.reset_rx_fifo(); 443 self.reset_tx_fifo(); 444 } 445 446 pub fn reset_rx_fifo(&mut self) { 447 self.read_count = 0; 448 self.read_pos = 0; 449 450 // Reset FIFO flags 451 self.flags.set_receive_fifo_full(false); 452 self.flags.set_receive_fifo_empty(true); 453 } 454 455 pub fn reset_tx_fifo(&mut self) { 456 // Reset FIFO flags 457 self.flags.set_transmit_fifo_full(false); 458 self.flags.set_transmit_fifo_empty(true); 459 } 460 461 pub fn can_receive(&self) -> bool { 462 // trace_pl011_can_receive(s->lcr, s->read_count, r); 463 self.read_count < self.fifo_depth() 464 } 465 466 pub fn event(&mut self, event: QEMUChrEvent) { 467 if event == bindings::QEMUChrEvent::CHR_EVENT_BREAK && !self.loopback_enabled() { 468 self.put_fifo(registers::Data::BREAK.into()); 469 } 470 } 471 472 #[inline] 473 pub fn fifo_enabled(&self) -> bool { 474 matches!(self.line_control.fifos_enabled(), registers::Mode::FIFO) 475 } 476 477 #[inline] 478 pub fn loopback_enabled(&self) -> bool { 479 self.control.enable_loopback() 480 } 481 482 #[inline] 483 pub fn fifo_depth(&self) -> usize { 484 // Note: FIFO depth is expected to be power-of-2 485 if self.fifo_enabled() { 486 return PL011_FIFO_DEPTH; 487 } 488 1 489 } 490 491 pub fn put_fifo(&mut self, value: c_uint) { 492 let depth = self.fifo_depth(); 493 assert!(depth > 0); 494 let slot = (self.read_pos + self.read_count) & (depth - 1); 495 self.read_fifo[slot] = registers::Data::from(value); 496 self.read_count += 1; 497 self.flags.set_receive_fifo_empty(false); 498 if self.read_count == depth { 499 self.flags.set_receive_fifo_full(true); 500 } 501 502 if self.read_count == self.read_trigger { 503 self.int_level |= registers::INT_RX; 504 self.update(); 505 } 506 } 507 508 pub fn update(&self) { 509 let flags = self.int_level & self.int_enabled; 510 for (irq, i) in self.interrupts.iter().zip(IRQMASK) { 511 irq.set(flags & i != 0); 512 } 513 } 514 515 pub fn post_load(&mut self, _version_id: u32) -> Result<(), ()> { 516 /* Sanity-check input state */ 517 if self.read_pos >= self.read_fifo.len() || self.read_count > self.read_fifo.len() { 518 return Err(()); 519 } 520 521 if !self.fifo_enabled() && self.read_count > 0 && self.read_pos > 0 { 522 // Older versions of PL011 didn't ensure that the single 523 // character in the FIFO in FIFO-disabled mode is in 524 // element 0 of the array; convert to follow the current 525 // code's assumptions. 526 self.read_fifo[0] = self.read_fifo[self.read_pos]; 527 self.read_pos = 0; 528 } 529 530 self.ibrd &= IBRD_MASK; 531 self.fbrd &= FBRD_MASK; 532 533 Ok(()) 534 } 535 } 536 537 /// Which bits in the interrupt status matter for each outbound IRQ line ? 538 pub const IRQMASK: [u32; 6] = [ 539 /* combined IRQ */ 540 Interrupt::E 541 | Interrupt::MS 542 | Interrupt::RT as u32 543 | Interrupt::TX as u32 544 | Interrupt::RX as u32, 545 Interrupt::RX as u32, 546 Interrupt::TX as u32, 547 Interrupt::RT as u32, 548 Interrupt::MS, 549 Interrupt::E, 550 ]; 551 552 /// # Safety 553 /// 554 /// We expect the FFI user of this function to pass a valid pointer, that has 555 /// the same size as [`PL011State`]. We also expect the device is 556 /// readable/writeable from one thread at any time. 557 pub unsafe extern "C" fn pl011_can_receive(opaque: *mut c_void) -> c_int { 558 unsafe { 559 debug_assert!(!opaque.is_null()); 560 let state = NonNull::new_unchecked(opaque.cast::<PL011State>()); 561 state.as_ref().can_receive().into() 562 } 563 } 564 565 /// # Safety 566 /// 567 /// We expect the FFI user of this function to pass a valid pointer, that has 568 /// the same size as [`PL011State`]. We also expect the device is 569 /// readable/writeable from one thread at any time. 570 /// 571 /// The buffer and size arguments must also be valid. 572 pub unsafe extern "C" fn pl011_receive(opaque: *mut c_void, buf: *const u8, size: c_int) { 573 unsafe { 574 debug_assert!(!opaque.is_null()); 575 let mut state = NonNull::new_unchecked(opaque.cast::<PL011State>()); 576 if state.as_ref().loopback_enabled() { 577 return; 578 } 579 if size > 0 { 580 debug_assert!(!buf.is_null()); 581 state.as_mut().put_fifo(c_uint::from(buf.read_volatile())) 582 } 583 } 584 } 585 586 /// # Safety 587 /// 588 /// We expect the FFI user of this function to pass a valid pointer, that has 589 /// the same size as [`PL011State`]. We also expect the device is 590 /// readable/writeable from one thread at any time. 591 pub unsafe extern "C" fn pl011_event(opaque: *mut c_void, event: QEMUChrEvent) { 592 unsafe { 593 debug_assert!(!opaque.is_null()); 594 let mut state = NonNull::new_unchecked(opaque.cast::<PL011State>()); 595 state.as_mut().event(event) 596 } 597 } 598 599 /// # Safety 600 /// 601 /// We expect the FFI user of this function to pass a valid pointer for `chr`. 602 #[no_mangle] 603 pub unsafe extern "C" fn pl011_create( 604 addr: u64, 605 irq: qemu_irq, 606 chr: *mut Chardev, 607 ) -> *mut DeviceState { 608 unsafe { 609 let dev: *mut DeviceState = qdev_new(PL011State::TYPE_NAME.as_ptr()); 610 let sysbus: *mut SysBusDevice = dev.cast::<SysBusDevice>(); 611 612 qdev_prop_set_chr(dev, c_str!("chardev").as_ptr(), chr); 613 sysbus_realize_and_unref(sysbus, addr_of_mut!(error_fatal)); 614 sysbus_mmio_map(sysbus, 0, addr); 615 sysbus_connect_irq(sysbus, 0, irq); 616 dev 617 } 618 } 619 620 #[repr(C)] 621 #[derive(Debug, qemu_api_macros::Object)] 622 /// PL011 Luminary device model. 623 pub struct PL011Luminary { 624 parent_obj: PL011State, 625 } 626 627 impl PL011Luminary { 628 /// Initializes a pre-allocated, unitialized instance of `PL011Luminary`. 629 /// 630 /// # Safety 631 /// 632 /// We expect the FFI user of this function to pass a valid pointer, that 633 /// has the same size as [`PL011Luminary`]. We also expect the device is 634 /// readable/writeable from one thread at any time. 635 unsafe fn init(&mut self) { 636 self.parent_obj.device_id = DeviceId::Luminary; 637 } 638 } 639 640 qom_isa!(PL011Luminary : PL011State, SysBusDevice, DeviceState, Object); 641 642 unsafe impl ObjectType for PL011Luminary { 643 type Class = <PL011State as ObjectType>::Class; 644 const TYPE_NAME: &'static CStr = crate::TYPE_PL011_LUMINARY; 645 } 646 647 impl ObjectImpl for PL011Luminary { 648 type ParentType = PL011State; 649 650 const INSTANCE_INIT: Option<unsafe fn(&mut Self)> = Some(Self::init); 651 } 652 653 impl DeviceImpl for PL011Luminary {} 654