1 // Copyright 2024, Linaro Limited 2 // Author(s): Manos Pitsidianakis <manos.pitsidianakis@linaro.org> 3 // SPDX-License-Identifier: GPL-2.0-or-later 4 5 use core::ptr::{addr_of_mut, NonNull}; 6 use std::{ 7 ffi::CStr, 8 os::raw::{c_int, c_uchar, c_uint, c_void}, 9 }; 10 11 use qemu_api::{ 12 bindings::{self, *}, 13 c_str, 14 irq::InterruptSource, 15 prelude::*, 16 qdev::DeviceImpl, 17 qom::ObjectImpl, 18 }; 19 20 use crate::{ 21 device_class, 22 memory_ops::PL011_OPS, 23 registers::{self, Interrupt}, 24 RegisterOffset, 25 }; 26 27 /// Integer Baud Rate Divider, `UARTIBRD` 28 const IBRD_MASK: u32 = 0xffff; 29 30 /// Fractional Baud Rate Divider, `UARTFBRD` 31 const FBRD_MASK: u32 = 0x3f; 32 33 const DATA_BREAK: u32 = 1 << 10; 34 35 /// QEMU sourced constant. 36 pub const PL011_FIFO_DEPTH: usize = 16_usize; 37 38 #[derive(Clone, Copy, Debug)] 39 enum DeviceId { 40 #[allow(dead_code)] 41 Arm = 0, 42 Luminary, 43 } 44 45 impl std::ops::Index<hwaddr> for DeviceId { 46 type Output = c_uchar; 47 48 fn index(&self, idx: hwaddr) -> &Self::Output { 49 match self { 50 Self::Arm => &Self::PL011_ID_ARM[idx as usize], 51 Self::Luminary => &Self::PL011_ID_LUMINARY[idx as usize], 52 } 53 } 54 } 55 56 impl DeviceId { 57 const PL011_ID_ARM: [c_uchar; 8] = [0x11, 0x10, 0x14, 0x00, 0x0d, 0xf0, 0x05, 0xb1]; 58 const PL011_ID_LUMINARY: [c_uchar; 8] = [0x11, 0x00, 0x18, 0x01, 0x0d, 0xf0, 0x05, 0xb1]; 59 } 60 61 #[repr(C)] 62 #[derive(Debug, qemu_api_macros::Object, qemu_api_macros::offsets)] 63 /// PL011 Device Model in QEMU 64 pub struct PL011State { 65 pub parent_obj: SysBusDevice, 66 pub iomem: MemoryRegion, 67 #[doc(alias = "fr")] 68 pub flags: registers::Flags, 69 #[doc(alias = "lcr")] 70 pub line_control: registers::LineControl, 71 #[doc(alias = "rsr")] 72 pub receive_status_error_clear: registers::ReceiveStatusErrorClear, 73 #[doc(alias = "cr")] 74 pub control: registers::Control, 75 pub dmacr: u32, 76 pub int_enabled: u32, 77 pub int_level: u32, 78 pub read_fifo: [u32; PL011_FIFO_DEPTH], 79 pub ilpr: u32, 80 pub ibrd: u32, 81 pub fbrd: u32, 82 pub ifl: u32, 83 pub read_pos: usize, 84 pub read_count: usize, 85 pub read_trigger: usize, 86 #[doc(alias = "chr")] 87 pub char_backend: CharBackend, 88 /// QEMU interrupts 89 /// 90 /// ```text 91 /// * sysbus MMIO region 0: device registers 92 /// * sysbus IRQ 0: `UARTINTR` (combined interrupt line) 93 /// * sysbus IRQ 1: `UARTRXINTR` (receive FIFO interrupt line) 94 /// * sysbus IRQ 2: `UARTTXINTR` (transmit FIFO interrupt line) 95 /// * sysbus IRQ 3: `UARTRTINTR` (receive timeout interrupt line) 96 /// * sysbus IRQ 4: `UARTMSINTR` (momem status interrupt line) 97 /// * sysbus IRQ 5: `UARTEINTR` (error interrupt line) 98 /// ``` 99 #[doc(alias = "irq")] 100 pub interrupts: [InterruptSource; IRQMASK.len()], 101 #[doc(alias = "clk")] 102 pub clock: NonNull<Clock>, 103 #[doc(alias = "migrate_clk")] 104 pub migrate_clock: bool, 105 /// The byte string that identifies the device. 106 device_id: DeviceId, 107 } 108 109 qom_isa!(PL011State : SysBusDevice, DeviceState, Object); 110 111 unsafe impl ObjectType for PL011State { 112 type Class = <SysBusDevice as ObjectType>::Class; 113 const TYPE_NAME: &'static CStr = crate::TYPE_PL011; 114 } 115 116 impl ObjectImpl for PL011State { 117 type ParentType = SysBusDevice; 118 119 const INSTANCE_INIT: Option<unsafe fn(&mut Self)> = Some(Self::init); 120 } 121 122 impl DeviceImpl for PL011State { 123 fn properties() -> &'static [Property] { 124 &device_class::PL011_PROPERTIES 125 } 126 fn vmsd() -> Option<&'static VMStateDescription> { 127 Some(&device_class::VMSTATE_PL011) 128 } 129 const REALIZE: Option<fn(&mut Self)> = Some(Self::realize); 130 const RESET: Option<fn(&mut Self)> = Some(Self::reset); 131 } 132 133 impl PL011State { 134 /// Initializes a pre-allocated, unitialized instance of `PL011State`. 135 /// 136 /// # Safety 137 /// 138 /// `self` must point to a correctly sized and aligned location for the 139 /// `PL011State` type. It must not be called more than once on the same 140 /// location/instance. All its fields are expected to hold unitialized 141 /// values with the sole exception of `parent_obj`. 142 unsafe fn init(&mut self) { 143 const CLK_NAME: &CStr = c_str!("clk"); 144 145 // SAFETY: 146 // 147 // self and self.iomem are guaranteed to be valid at this point since callers 148 // must make sure the `self` reference is valid. 149 unsafe { 150 memory_region_init_io( 151 addr_of_mut!(self.iomem), 152 addr_of_mut!(*self).cast::<Object>(), 153 &PL011_OPS, 154 addr_of_mut!(*self).cast::<c_void>(), 155 Self::TYPE_NAME.as_ptr(), 156 0x1000, 157 ); 158 159 let sbd: &mut SysBusDevice = self.upcast_mut(); 160 sysbus_init_mmio(sbd, addr_of_mut!(self.iomem)); 161 } 162 163 for irq in self.interrupts.iter() { 164 let sbd: &SysBusDevice = self.upcast(); 165 sbd.init_irq(irq); 166 } 167 168 // SAFETY: 169 // 170 // self.clock is not initialized at this point; but since `NonNull<_>` is Copy, 171 // we can overwrite the undefined value without side effects. This is 172 // safe since all PL011State instances are created by QOM code which 173 // calls this function to initialize the fields; therefore no code is 174 // able to access an invalid self.clock value. 175 unsafe { 176 let dev: &mut DeviceState = self.upcast_mut(); 177 self.clock = NonNull::new(qdev_init_clock_in( 178 dev, 179 CLK_NAME.as_ptr(), 180 None, /* pl011_clock_update */ 181 addr_of_mut!(*self).cast::<c_void>(), 182 ClockEvent::ClockUpdate.0, 183 )) 184 .unwrap(); 185 } 186 } 187 188 pub fn read(&mut self, offset: hwaddr, _size: c_uint) -> std::ops::ControlFlow<u64, u64> { 189 use RegisterOffset::*; 190 191 std::ops::ControlFlow::Break(match RegisterOffset::try_from(offset) { 192 Err(v) if (0x3f8..0x400).contains(&(v >> 2)) => { 193 u64::from(self.device_id[(offset - 0xfe0) >> 2]) 194 } 195 Err(_) => { 196 // qemu_log_mask(LOG_GUEST_ERROR, "pl011_read: Bad offset 0x%x\n", (int)offset); 197 0 198 } 199 Ok(DR) => { 200 self.flags.set_receive_fifo_full(false); 201 let c = self.read_fifo[self.read_pos]; 202 if self.read_count > 0 { 203 self.read_count -= 1; 204 self.read_pos = (self.read_pos + 1) & (self.fifo_depth() - 1); 205 } 206 if self.read_count == 0 { 207 self.flags.set_receive_fifo_empty(true); 208 } 209 if self.read_count + 1 == self.read_trigger { 210 self.int_level &= !registers::INT_RX; 211 } 212 // Update error bits. 213 self.receive_status_error_clear = c.to_be_bytes()[3].into(); 214 self.update(); 215 // Must call qemu_chr_fe_accept_input, so return Continue: 216 return std::ops::ControlFlow::Continue(c.into()); 217 } 218 Ok(RSR) => u8::from(self.receive_status_error_clear).into(), 219 Ok(FR) => u16::from(self.flags).into(), 220 Ok(FBRD) => self.fbrd.into(), 221 Ok(ILPR) => self.ilpr.into(), 222 Ok(IBRD) => self.ibrd.into(), 223 Ok(LCR_H) => u16::from(self.line_control).into(), 224 Ok(CR) => { 225 // We exercise our self-control. 226 u16::from(self.control).into() 227 } 228 Ok(FLS) => self.ifl.into(), 229 Ok(IMSC) => self.int_enabled.into(), 230 Ok(RIS) => self.int_level.into(), 231 Ok(MIS) => u64::from(self.int_level & self.int_enabled), 232 Ok(ICR) => { 233 // "The UARTICR Register is the interrupt clear register and is write-only" 234 // Source: ARM DDI 0183G 3.3.13 Interrupt Clear Register, UARTICR 235 0 236 } 237 Ok(DMACR) => self.dmacr.into(), 238 }) 239 } 240 241 pub fn write(&mut self, offset: hwaddr, value: u64) { 242 // eprintln!("write offset {offset} value {value}"); 243 use RegisterOffset::*; 244 let value: u32 = value as u32; 245 match RegisterOffset::try_from(offset) { 246 Err(_bad_offset) => { 247 eprintln!("write bad offset {offset} value {value}"); 248 } 249 Ok(DR) => { 250 // ??? Check if transmitter is enabled. 251 let ch: u8 = value as u8; 252 // XXX this blocks entire thread. Rewrite to use 253 // qemu_chr_fe_write and background I/O callbacks 254 255 // SAFETY: self.char_backend is a valid CharBackend instance after it's been 256 // initialized in realize(). 257 unsafe { 258 qemu_chr_fe_write_all(addr_of_mut!(self.char_backend), &ch, 1); 259 } 260 self.loopback_tx(value); 261 self.int_level |= registers::INT_TX; 262 self.update(); 263 } 264 Ok(RSR) => { 265 self.receive_status_error_clear = 0.into(); 266 } 267 Ok(FR) => { 268 // flag writes are ignored 269 } 270 Ok(ILPR) => { 271 self.ilpr = value; 272 } 273 Ok(IBRD) => { 274 self.ibrd = value; 275 } 276 Ok(FBRD) => { 277 self.fbrd = value; 278 } 279 Ok(LCR_H) => { 280 let value = value as u16; 281 let new_val: registers::LineControl = value.into(); 282 // Reset the FIFO state on FIFO enable or disable 283 if bool::from(self.line_control.fifos_enabled()) 284 ^ bool::from(new_val.fifos_enabled()) 285 { 286 self.reset_fifo(); 287 } 288 if self.line_control.send_break() ^ new_val.send_break() { 289 let mut break_enable: c_int = new_val.send_break().into(); 290 // SAFETY: self.char_backend is a valid CharBackend instance after it's been 291 // initialized in realize(). 292 unsafe { 293 qemu_chr_fe_ioctl( 294 addr_of_mut!(self.char_backend), 295 CHR_IOCTL_SERIAL_SET_BREAK as i32, 296 addr_of_mut!(break_enable).cast::<c_void>(), 297 ); 298 } 299 self.loopback_break(break_enable > 0); 300 } 301 self.line_control = new_val; 302 self.set_read_trigger(); 303 } 304 Ok(CR) => { 305 // ??? Need to implement the enable bit. 306 let value = value as u16; 307 self.control = value.into(); 308 self.loopback_mdmctrl(); 309 } 310 Ok(FLS) => { 311 self.ifl = value; 312 self.set_read_trigger(); 313 } 314 Ok(IMSC) => { 315 self.int_enabled = value; 316 self.update(); 317 } 318 Ok(RIS) => {} 319 Ok(MIS) => {} 320 Ok(ICR) => { 321 self.int_level &= !value; 322 self.update(); 323 } 324 Ok(DMACR) => { 325 self.dmacr = value; 326 if value & 3 > 0 { 327 // qemu_log_mask(LOG_UNIMP, "pl011: DMA not implemented\n"); 328 eprintln!("pl011: DMA not implemented"); 329 } 330 } 331 } 332 } 333 334 #[inline] 335 fn loopback_tx(&mut self, value: u32) { 336 if !self.loopback_enabled() { 337 return; 338 } 339 340 // Caveat: 341 // 342 // In real hardware, TX loopback happens at the serial-bit level 343 // and then reassembled by the RX logics back into bytes and placed 344 // into the RX fifo. That is, loopback happens after TX fifo. 345 // 346 // Because the real hardware TX fifo is time-drained at the frame 347 // rate governed by the configured serial format, some loopback 348 // bytes in TX fifo may still be able to get into the RX fifo 349 // that could be full at times while being drained at software 350 // pace. 351 // 352 // In such scenario, the RX draining pace is the major factor 353 // deciding which loopback bytes get into the RX fifo, unless 354 // hardware flow-control is enabled. 355 // 356 // For simplicity, the above described is not emulated. 357 self.put_fifo(value); 358 } 359 360 fn loopback_mdmctrl(&mut self) { 361 if !self.loopback_enabled() { 362 return; 363 } 364 365 /* 366 * Loopback software-driven modem control outputs to modem status inputs: 367 * FR.RI <= CR.Out2 368 * FR.DCD <= CR.Out1 369 * FR.CTS <= CR.RTS 370 * FR.DSR <= CR.DTR 371 * 372 * The loopback happens immediately even if this call is triggered 373 * by setting only CR.LBE. 374 * 375 * CTS/RTS updates due to enabled hardware flow controls are not 376 * dealt with here. 377 */ 378 379 self.flags.set_ring_indicator(self.control.out_2()); 380 self.flags.set_data_carrier_detect(self.control.out_1()); 381 self.flags.set_clear_to_send(self.control.request_to_send()); 382 self.flags 383 .set_data_set_ready(self.control.data_transmit_ready()); 384 385 // Change interrupts based on updated FR 386 let mut il = self.int_level; 387 388 il &= !Interrupt::MS; 389 390 if self.flags.data_set_ready() { 391 il |= Interrupt::DSR as u32; 392 } 393 if self.flags.data_carrier_detect() { 394 il |= Interrupt::DCD as u32; 395 } 396 if self.flags.clear_to_send() { 397 il |= Interrupt::CTS as u32; 398 } 399 if self.flags.ring_indicator() { 400 il |= Interrupt::RI as u32; 401 } 402 self.int_level = il; 403 self.update(); 404 } 405 406 fn loopback_break(&mut self, enable: bool) { 407 if enable { 408 self.loopback_tx(DATA_BREAK); 409 } 410 } 411 412 fn set_read_trigger(&mut self) { 413 self.read_trigger = 1; 414 } 415 416 pub fn realize(&mut self) { 417 // SAFETY: self.char_backend has the correct size and alignment for a 418 // CharBackend object, and its callbacks are of the correct types. 419 unsafe { 420 qemu_chr_fe_set_handlers( 421 addr_of_mut!(self.char_backend), 422 Some(pl011_can_receive), 423 Some(pl011_receive), 424 Some(pl011_event), 425 None, 426 addr_of_mut!(*self).cast::<c_void>(), 427 core::ptr::null_mut(), 428 true, 429 ); 430 } 431 } 432 433 pub fn reset(&mut self) { 434 self.line_control.reset(); 435 self.receive_status_error_clear.reset(); 436 self.dmacr = 0; 437 self.int_enabled = 0; 438 self.int_level = 0; 439 self.ilpr = 0; 440 self.ibrd = 0; 441 self.fbrd = 0; 442 self.read_trigger = 1; 443 self.ifl = 0x12; 444 self.control.reset(); 445 self.flags = 0.into(); 446 self.reset_fifo(); 447 } 448 449 pub fn reset_fifo(&mut self) { 450 self.read_count = 0; 451 self.read_pos = 0; 452 453 /* Reset FIFO flags */ 454 self.flags.reset(); 455 } 456 457 pub fn can_receive(&self) -> bool { 458 // trace_pl011_can_receive(s->lcr, s->read_count, r); 459 self.read_count < self.fifo_depth() 460 } 461 462 pub fn event(&mut self, event: QEMUChrEvent) { 463 if event == bindings::QEMUChrEvent::CHR_EVENT_BREAK && !self.fifo_enabled() { 464 self.put_fifo(DATA_BREAK); 465 self.receive_status_error_clear.set_break_error(true); 466 } 467 } 468 469 #[inline] 470 pub fn fifo_enabled(&self) -> bool { 471 matches!(self.line_control.fifos_enabled(), registers::Mode::FIFO) 472 } 473 474 #[inline] 475 pub fn loopback_enabled(&self) -> bool { 476 self.control.enable_loopback() 477 } 478 479 #[inline] 480 pub fn fifo_depth(&self) -> usize { 481 // Note: FIFO depth is expected to be power-of-2 482 if self.fifo_enabled() { 483 return PL011_FIFO_DEPTH; 484 } 485 1 486 } 487 488 pub fn put_fifo(&mut self, value: c_uint) { 489 let depth = self.fifo_depth(); 490 assert!(depth > 0); 491 let slot = (self.read_pos + self.read_count) & (depth - 1); 492 self.read_fifo[slot] = value; 493 self.read_count += 1; 494 self.flags.set_receive_fifo_empty(false); 495 if self.read_count == depth { 496 self.flags.set_receive_fifo_full(true); 497 } 498 499 if self.read_count == self.read_trigger { 500 self.int_level |= registers::INT_RX; 501 self.update(); 502 } 503 } 504 505 pub fn update(&self) { 506 let flags = self.int_level & self.int_enabled; 507 for (irq, i) in self.interrupts.iter().zip(IRQMASK) { 508 irq.set(flags & i != 0); 509 } 510 } 511 512 pub fn post_load(&mut self, _version_id: u32) -> Result<(), ()> { 513 /* Sanity-check input state */ 514 if self.read_pos >= self.read_fifo.len() || self.read_count > self.read_fifo.len() { 515 return Err(()); 516 } 517 518 if !self.fifo_enabled() && self.read_count > 0 && self.read_pos > 0 { 519 // Older versions of PL011 didn't ensure that the single 520 // character in the FIFO in FIFO-disabled mode is in 521 // element 0 of the array; convert to follow the current 522 // code's assumptions. 523 self.read_fifo[0] = self.read_fifo[self.read_pos]; 524 self.read_pos = 0; 525 } 526 527 self.ibrd &= IBRD_MASK; 528 self.fbrd &= FBRD_MASK; 529 530 Ok(()) 531 } 532 } 533 534 /// Which bits in the interrupt status matter for each outbound IRQ line ? 535 pub const IRQMASK: [u32; 6] = [ 536 /* combined IRQ */ 537 Interrupt::E 538 | Interrupt::MS 539 | Interrupt::RT as u32 540 | Interrupt::TX as u32 541 | Interrupt::RX as u32, 542 Interrupt::RX as u32, 543 Interrupt::TX as u32, 544 Interrupt::RT as u32, 545 Interrupt::MS, 546 Interrupt::E, 547 ]; 548 549 /// # Safety 550 /// 551 /// We expect the FFI user of this function to pass a valid pointer, that has 552 /// the same size as [`PL011State`]. We also expect the device is 553 /// readable/writeable from one thread at any time. 554 pub unsafe extern "C" fn pl011_can_receive(opaque: *mut c_void) -> c_int { 555 unsafe { 556 debug_assert!(!opaque.is_null()); 557 let state = NonNull::new_unchecked(opaque.cast::<PL011State>()); 558 state.as_ref().can_receive().into() 559 } 560 } 561 562 /// # Safety 563 /// 564 /// We expect the FFI user of this function to pass a valid pointer, that has 565 /// the same size as [`PL011State`]. We also expect the device is 566 /// readable/writeable from one thread at any time. 567 /// 568 /// The buffer and size arguments must also be valid. 569 pub unsafe extern "C" fn pl011_receive(opaque: *mut c_void, buf: *const u8, size: c_int) { 570 unsafe { 571 debug_assert!(!opaque.is_null()); 572 let mut state = NonNull::new_unchecked(opaque.cast::<PL011State>()); 573 if state.as_ref().loopback_enabled() { 574 return; 575 } 576 if size > 0 { 577 debug_assert!(!buf.is_null()); 578 state.as_mut().put_fifo(c_uint::from(buf.read_volatile())) 579 } 580 } 581 } 582 583 /// # Safety 584 /// 585 /// We expect the FFI user of this function to pass a valid pointer, that has 586 /// the same size as [`PL011State`]. We also expect the device is 587 /// readable/writeable from one thread at any time. 588 pub unsafe extern "C" fn pl011_event(opaque: *mut c_void, event: QEMUChrEvent) { 589 unsafe { 590 debug_assert!(!opaque.is_null()); 591 let mut state = NonNull::new_unchecked(opaque.cast::<PL011State>()); 592 state.as_mut().event(event) 593 } 594 } 595 596 /// # Safety 597 /// 598 /// We expect the FFI user of this function to pass a valid pointer for `chr`. 599 #[no_mangle] 600 pub unsafe extern "C" fn pl011_create( 601 addr: u64, 602 irq: qemu_irq, 603 chr: *mut Chardev, 604 ) -> *mut DeviceState { 605 unsafe { 606 let dev: *mut DeviceState = qdev_new(PL011State::TYPE_NAME.as_ptr()); 607 let sysbus: *mut SysBusDevice = dev.cast::<SysBusDevice>(); 608 609 qdev_prop_set_chr(dev, c_str!("chardev").as_ptr(), chr); 610 sysbus_realize_and_unref(sysbus, addr_of_mut!(error_fatal)); 611 sysbus_mmio_map(sysbus, 0, addr); 612 sysbus_connect_irq(sysbus, 0, irq); 613 dev 614 } 615 } 616 617 #[repr(C)] 618 #[derive(Debug, qemu_api_macros::Object)] 619 /// PL011 Luminary device model. 620 pub struct PL011Luminary { 621 parent_obj: PL011State, 622 } 623 624 impl PL011Luminary { 625 /// Initializes a pre-allocated, unitialized instance of `PL011Luminary`. 626 /// 627 /// # Safety 628 /// 629 /// We expect the FFI user of this function to pass a valid pointer, that 630 /// has the same size as [`PL011Luminary`]. We also expect the device is 631 /// readable/writeable from one thread at any time. 632 unsafe fn init(&mut self) { 633 self.parent_obj.device_id = DeviceId::Luminary; 634 } 635 } 636 637 qom_isa!(PL011Luminary : PL011State, SysBusDevice, DeviceState, Object); 638 639 unsafe impl ObjectType for PL011Luminary { 640 type Class = <PL011State as ObjectType>::Class; 641 const TYPE_NAME: &'static CStr = crate::TYPE_PL011_LUMINARY; 642 } 643 644 impl ObjectImpl for PL011Luminary { 645 type ParentType = PL011State; 646 647 const INSTANCE_INIT: Option<unsafe fn(&mut Self)> = Some(Self::init); 648 } 649 650 impl DeviceImpl for PL011Luminary {} 651