1 // Copyright 2024, Linaro Limited 2 // Author(s): Manos Pitsidianakis <manos.pitsidianakis@linaro.org> 3 // SPDX-License-Identifier: GPL-2.0-or-later 4 5 use core::ptr::{addr_of_mut, NonNull}; 6 use std::{ 7 ffi::CStr, 8 os::raw::{c_int, c_uchar, c_uint, c_void}, 9 }; 10 11 use qemu_api::{ 12 bindings::{self, *}, 13 c_str, 14 irq::InterruptSource, 15 prelude::*, 16 qdev::DeviceImpl, 17 qom::ObjectImpl, 18 }; 19 20 use crate::{ 21 device_class, 22 memory_ops::PL011_OPS, 23 registers::{self, Interrupt}, 24 RegisterOffset, 25 }; 26 27 /// Integer Baud Rate Divider, `UARTIBRD` 28 const IBRD_MASK: u32 = 0xffff; 29 30 /// Fractional Baud Rate Divider, `UARTFBRD` 31 const FBRD_MASK: u32 = 0x3f; 32 33 const DATA_BREAK: u32 = 1 << 10; 34 35 /// QEMU sourced constant. 36 pub const PL011_FIFO_DEPTH: usize = 16_usize; 37 38 #[derive(Clone, Copy, Debug)] 39 enum DeviceId { 40 #[allow(dead_code)] 41 Arm = 0, 42 Luminary, 43 } 44 45 impl std::ops::Index<hwaddr> for DeviceId { 46 type Output = c_uchar; 47 48 fn index(&self, idx: hwaddr) -> &Self::Output { 49 match self { 50 Self::Arm => &Self::PL011_ID_ARM[idx as usize], 51 Self::Luminary => &Self::PL011_ID_LUMINARY[idx as usize], 52 } 53 } 54 } 55 56 impl DeviceId { 57 const PL011_ID_ARM: [c_uchar; 8] = [0x11, 0x10, 0x14, 0x00, 0x0d, 0xf0, 0x05, 0xb1]; 58 const PL011_ID_LUMINARY: [c_uchar; 8] = [0x11, 0x00, 0x18, 0x01, 0x0d, 0xf0, 0x05, 0xb1]; 59 } 60 61 #[repr(C)] 62 #[derive(Debug, qemu_api_macros::Object, qemu_api_macros::offsets)] 63 /// PL011 Device Model in QEMU 64 pub struct PL011State { 65 pub parent_obj: SysBusDevice, 66 pub iomem: MemoryRegion, 67 #[doc(alias = "fr")] 68 pub flags: registers::Flags, 69 #[doc(alias = "lcr")] 70 pub line_control: registers::LineControl, 71 #[doc(alias = "rsr")] 72 pub receive_status_error_clear: registers::ReceiveStatusErrorClear, 73 #[doc(alias = "cr")] 74 pub control: registers::Control, 75 pub dmacr: u32, 76 pub int_enabled: u32, 77 pub int_level: u32, 78 pub read_fifo: [u32; PL011_FIFO_DEPTH], 79 pub ilpr: u32, 80 pub ibrd: u32, 81 pub fbrd: u32, 82 pub ifl: u32, 83 pub read_pos: usize, 84 pub read_count: usize, 85 pub read_trigger: usize, 86 #[doc(alias = "chr")] 87 pub char_backend: CharBackend, 88 /// QEMU interrupts 89 /// 90 /// ```text 91 /// * sysbus MMIO region 0: device registers 92 /// * sysbus IRQ 0: `UARTINTR` (combined interrupt line) 93 /// * sysbus IRQ 1: `UARTRXINTR` (receive FIFO interrupt line) 94 /// * sysbus IRQ 2: `UARTTXINTR` (transmit FIFO interrupt line) 95 /// * sysbus IRQ 3: `UARTRTINTR` (receive timeout interrupt line) 96 /// * sysbus IRQ 4: `UARTMSINTR` (momem status interrupt line) 97 /// * sysbus IRQ 5: `UARTEINTR` (error interrupt line) 98 /// ``` 99 #[doc(alias = "irq")] 100 pub interrupts: [InterruptSource; IRQMASK.len()], 101 #[doc(alias = "clk")] 102 pub clock: NonNull<Clock>, 103 #[doc(alias = "migrate_clk")] 104 pub migrate_clock: bool, 105 /// The byte string that identifies the device. 106 device_id: DeviceId, 107 } 108 109 qom_isa!(PL011State : SysBusDevice, DeviceState, Object); 110 111 unsafe impl ObjectType for PL011State { 112 type Class = <SysBusDevice as ObjectType>::Class; 113 const TYPE_NAME: &'static CStr = crate::TYPE_PL011; 114 } 115 116 impl ObjectImpl for PL011State { 117 type ParentType = SysBusDevice; 118 119 const INSTANCE_INIT: Option<unsafe fn(&mut Self)> = Some(Self::init); 120 } 121 122 impl DeviceImpl for PL011State { 123 fn properties() -> &'static [Property] { 124 &device_class::PL011_PROPERTIES 125 } 126 fn vmsd() -> Option<&'static VMStateDescription> { 127 Some(&device_class::VMSTATE_PL011) 128 } 129 const REALIZE: Option<fn(&mut Self)> = Some(Self::realize); 130 const RESET: Option<fn(&mut Self)> = Some(Self::reset); 131 } 132 133 impl PL011State { 134 /// Initializes a pre-allocated, unitialized instance of `PL011State`. 135 /// 136 /// # Safety 137 /// 138 /// `self` must point to a correctly sized and aligned location for the 139 /// `PL011State` type. It must not be called more than once on the same 140 /// location/instance. All its fields are expected to hold unitialized 141 /// values with the sole exception of `parent_obj`. 142 unsafe fn init(&mut self) { 143 const CLK_NAME: &CStr = c_str!("clk"); 144 145 // SAFETY: 146 // 147 // self and self.iomem are guaranteed to be valid at this point since callers 148 // must make sure the `self` reference is valid. 149 unsafe { 150 memory_region_init_io( 151 addr_of_mut!(self.iomem), 152 addr_of_mut!(*self).cast::<Object>(), 153 &PL011_OPS, 154 addr_of_mut!(*self).cast::<c_void>(), 155 Self::TYPE_NAME.as_ptr(), 156 0x1000, 157 ); 158 159 let sbd: &mut SysBusDevice = self.upcast_mut(); 160 sysbus_init_mmio(sbd, addr_of_mut!(self.iomem)); 161 } 162 163 for irq in self.interrupts.iter() { 164 let sbd: &SysBusDevice = self.upcast(); 165 sbd.init_irq(irq); 166 } 167 168 // SAFETY: 169 // 170 // self.clock is not initialized at this point; but since `NonNull<_>` is Copy, 171 // we can overwrite the undefined value without side effects. This is 172 // safe since all PL011State instances are created by QOM code which 173 // calls this function to initialize the fields; therefore no code is 174 // able to access an invalid self.clock value. 175 unsafe { 176 let dev: &mut DeviceState = self.upcast_mut(); 177 self.clock = NonNull::new(qdev_init_clock_in( 178 dev, 179 CLK_NAME.as_ptr(), 180 None, /* pl011_clock_update */ 181 addr_of_mut!(*self).cast::<c_void>(), 182 ClockEvent::ClockUpdate.0, 183 )) 184 .unwrap(); 185 } 186 } 187 188 pub fn read(&mut self, offset: hwaddr, _size: c_uint) -> std::ops::ControlFlow<u64, u64> { 189 use RegisterOffset::*; 190 191 std::ops::ControlFlow::Break(match RegisterOffset::try_from(offset) { 192 Err(v) if (0x3f8..0x400).contains(&(v >> 2)) => { 193 u64::from(self.device_id[(offset - 0xfe0) >> 2]) 194 } 195 Err(_) => { 196 // qemu_log_mask(LOG_GUEST_ERROR, "pl011_read: Bad offset 0x%x\n", (int)offset); 197 0 198 } 199 Ok(DR) => { 200 self.flags.set_receive_fifo_full(false); 201 let c = self.read_fifo[self.read_pos]; 202 if self.read_count > 0 { 203 self.read_count -= 1; 204 self.read_pos = (self.read_pos + 1) & (self.fifo_depth() - 1); 205 } 206 if self.read_count == 0 { 207 self.flags.set_receive_fifo_empty(true); 208 } 209 if self.read_count + 1 == self.read_trigger { 210 self.int_level &= !registers::INT_RX; 211 } 212 // Update error bits. 213 self.receive_status_error_clear = c.to_be_bytes()[3].into(); 214 self.update(); 215 // Must call qemu_chr_fe_accept_input, so return Continue: 216 return std::ops::ControlFlow::Continue(c.into()); 217 } 218 Ok(RSR) => u8::from(self.receive_status_error_clear).into(), 219 Ok(FR) => u16::from(self.flags).into(), 220 Ok(FBRD) => self.fbrd.into(), 221 Ok(ILPR) => self.ilpr.into(), 222 Ok(IBRD) => self.ibrd.into(), 223 Ok(LCR_H) => u16::from(self.line_control).into(), 224 Ok(CR) => { 225 // We exercise our self-control. 226 u16::from(self.control).into() 227 } 228 Ok(FLS) => self.ifl.into(), 229 Ok(IMSC) => self.int_enabled.into(), 230 Ok(RIS) => self.int_level.into(), 231 Ok(MIS) => u64::from(self.int_level & self.int_enabled), 232 Ok(ICR) => { 233 // "The UARTICR Register is the interrupt clear register and is write-only" 234 // Source: ARM DDI 0183G 3.3.13 Interrupt Clear Register, UARTICR 235 0 236 } 237 Ok(DMACR) => self.dmacr.into(), 238 }) 239 } 240 241 pub fn write(&mut self, offset: hwaddr, value: u64) { 242 // eprintln!("write offset {offset} value {value}"); 243 use RegisterOffset::*; 244 let value: u32 = value as u32; 245 match RegisterOffset::try_from(offset) { 246 Err(_bad_offset) => { 247 eprintln!("write bad offset {offset} value {value}"); 248 } 249 Ok(DR) => { 250 // ??? Check if transmitter is enabled. 251 let ch: u8 = value as u8; 252 // XXX this blocks entire thread. Rewrite to use 253 // qemu_chr_fe_write and background I/O callbacks 254 255 // SAFETY: self.char_backend is a valid CharBackend instance after it's been 256 // initialized in realize(). 257 unsafe { 258 qemu_chr_fe_write_all(addr_of_mut!(self.char_backend), &ch, 1); 259 } 260 self.loopback_tx(value); 261 self.int_level |= registers::INT_TX; 262 self.update(); 263 } 264 Ok(RSR) => { 265 self.receive_status_error_clear.reset(); 266 } 267 Ok(FR) => { 268 // flag writes are ignored 269 } 270 Ok(ILPR) => { 271 self.ilpr = value; 272 } 273 Ok(IBRD) => { 274 self.ibrd = value; 275 } 276 Ok(FBRD) => { 277 self.fbrd = value; 278 } 279 Ok(LCR_H) => { 280 let value = value as u16; 281 let new_val: registers::LineControl = value.into(); 282 // Reset the FIFO state on FIFO enable or disable 283 if bool::from(self.line_control.fifos_enabled()) 284 ^ bool::from(new_val.fifos_enabled()) 285 { 286 self.reset_rx_fifo(); 287 self.reset_tx_fifo(); 288 } 289 if self.line_control.send_break() ^ new_val.send_break() { 290 let mut break_enable: c_int = new_val.send_break().into(); 291 // SAFETY: self.char_backend is a valid CharBackend instance after it's been 292 // initialized in realize(). 293 unsafe { 294 qemu_chr_fe_ioctl( 295 addr_of_mut!(self.char_backend), 296 CHR_IOCTL_SERIAL_SET_BREAK as i32, 297 addr_of_mut!(break_enable).cast::<c_void>(), 298 ); 299 } 300 self.loopback_break(break_enable > 0); 301 } 302 self.line_control = new_val; 303 self.set_read_trigger(); 304 } 305 Ok(CR) => { 306 // ??? Need to implement the enable bit. 307 let value = value as u16; 308 self.control = value.into(); 309 self.loopback_mdmctrl(); 310 } 311 Ok(FLS) => { 312 self.ifl = value; 313 self.set_read_trigger(); 314 } 315 Ok(IMSC) => { 316 self.int_enabled = value; 317 self.update(); 318 } 319 Ok(RIS) => {} 320 Ok(MIS) => {} 321 Ok(ICR) => { 322 self.int_level &= !value; 323 self.update(); 324 } 325 Ok(DMACR) => { 326 self.dmacr = value; 327 if value & 3 > 0 { 328 // qemu_log_mask(LOG_UNIMP, "pl011: DMA not implemented\n"); 329 eprintln!("pl011: DMA not implemented"); 330 } 331 } 332 } 333 } 334 335 #[inline] 336 fn loopback_tx(&mut self, value: u32) { 337 if !self.loopback_enabled() { 338 return; 339 } 340 341 // Caveat: 342 // 343 // In real hardware, TX loopback happens at the serial-bit level 344 // and then reassembled by the RX logics back into bytes and placed 345 // into the RX fifo. That is, loopback happens after TX fifo. 346 // 347 // Because the real hardware TX fifo is time-drained at the frame 348 // rate governed by the configured serial format, some loopback 349 // bytes in TX fifo may still be able to get into the RX fifo 350 // that could be full at times while being drained at software 351 // pace. 352 // 353 // In such scenario, the RX draining pace is the major factor 354 // deciding which loopback bytes get into the RX fifo, unless 355 // hardware flow-control is enabled. 356 // 357 // For simplicity, the above described is not emulated. 358 self.put_fifo(value); 359 } 360 361 fn loopback_mdmctrl(&mut self) { 362 if !self.loopback_enabled() { 363 return; 364 } 365 366 /* 367 * Loopback software-driven modem control outputs to modem status inputs: 368 * FR.RI <= CR.Out2 369 * FR.DCD <= CR.Out1 370 * FR.CTS <= CR.RTS 371 * FR.DSR <= CR.DTR 372 * 373 * The loopback happens immediately even if this call is triggered 374 * by setting only CR.LBE. 375 * 376 * CTS/RTS updates due to enabled hardware flow controls are not 377 * dealt with here. 378 */ 379 380 self.flags.set_ring_indicator(self.control.out_2()); 381 self.flags.set_data_carrier_detect(self.control.out_1()); 382 self.flags.set_clear_to_send(self.control.request_to_send()); 383 self.flags 384 .set_data_set_ready(self.control.data_transmit_ready()); 385 386 // Change interrupts based on updated FR 387 let mut il = self.int_level; 388 389 il &= !Interrupt::MS; 390 391 if self.flags.data_set_ready() { 392 il |= Interrupt::DSR as u32; 393 } 394 if self.flags.data_carrier_detect() { 395 il |= Interrupt::DCD as u32; 396 } 397 if self.flags.clear_to_send() { 398 il |= Interrupt::CTS as u32; 399 } 400 if self.flags.ring_indicator() { 401 il |= Interrupt::RI as u32; 402 } 403 self.int_level = il; 404 self.update(); 405 } 406 407 fn loopback_break(&mut self, enable: bool) { 408 if enable { 409 self.loopback_tx(DATA_BREAK); 410 } 411 } 412 413 fn set_read_trigger(&mut self) { 414 self.read_trigger = 1; 415 } 416 417 pub fn realize(&mut self) { 418 // SAFETY: self.char_backend has the correct size and alignment for a 419 // CharBackend object, and its callbacks are of the correct types. 420 unsafe { 421 qemu_chr_fe_set_handlers( 422 addr_of_mut!(self.char_backend), 423 Some(pl011_can_receive), 424 Some(pl011_receive), 425 Some(pl011_event), 426 None, 427 addr_of_mut!(*self).cast::<c_void>(), 428 core::ptr::null_mut(), 429 true, 430 ); 431 } 432 } 433 434 pub fn reset(&mut self) { 435 self.line_control.reset(); 436 self.receive_status_error_clear.reset(); 437 self.dmacr = 0; 438 self.int_enabled = 0; 439 self.int_level = 0; 440 self.ilpr = 0; 441 self.ibrd = 0; 442 self.fbrd = 0; 443 self.read_trigger = 1; 444 self.ifl = 0x12; 445 self.control.reset(); 446 self.flags.reset(); 447 self.reset_rx_fifo(); 448 self.reset_tx_fifo(); 449 } 450 451 pub fn reset_rx_fifo(&mut self) { 452 self.read_count = 0; 453 self.read_pos = 0; 454 455 // Reset FIFO flags 456 self.flags.set_receive_fifo_full(false); 457 self.flags.set_receive_fifo_empty(true); 458 } 459 460 pub fn reset_tx_fifo(&mut self) { 461 // Reset FIFO flags 462 self.flags.set_transmit_fifo_full(false); 463 self.flags.set_transmit_fifo_empty(true); 464 } 465 466 pub fn can_receive(&self) -> bool { 467 // trace_pl011_can_receive(s->lcr, s->read_count, r); 468 self.read_count < self.fifo_depth() 469 } 470 471 pub fn event(&mut self, event: QEMUChrEvent) { 472 if event == bindings::QEMUChrEvent::CHR_EVENT_BREAK && !self.loopback_enabled() { 473 self.put_fifo(DATA_BREAK); 474 } 475 } 476 477 #[inline] 478 pub fn fifo_enabled(&self) -> bool { 479 matches!(self.line_control.fifos_enabled(), registers::Mode::FIFO) 480 } 481 482 #[inline] 483 pub fn loopback_enabled(&self) -> bool { 484 self.control.enable_loopback() 485 } 486 487 #[inline] 488 pub fn fifo_depth(&self) -> usize { 489 // Note: FIFO depth is expected to be power-of-2 490 if self.fifo_enabled() { 491 return PL011_FIFO_DEPTH; 492 } 493 1 494 } 495 496 pub fn put_fifo(&mut self, value: c_uint) { 497 let depth = self.fifo_depth(); 498 assert!(depth > 0); 499 let slot = (self.read_pos + self.read_count) & (depth - 1); 500 self.read_fifo[slot] = value; 501 self.read_count += 1; 502 self.flags.set_receive_fifo_empty(false); 503 if self.read_count == depth { 504 self.flags.set_receive_fifo_full(true); 505 } 506 507 if self.read_count == self.read_trigger { 508 self.int_level |= registers::INT_RX; 509 self.update(); 510 } 511 } 512 513 pub fn update(&self) { 514 let flags = self.int_level & self.int_enabled; 515 for (irq, i) in self.interrupts.iter().zip(IRQMASK) { 516 irq.set(flags & i != 0); 517 } 518 } 519 520 pub fn post_load(&mut self, _version_id: u32) -> Result<(), ()> { 521 /* Sanity-check input state */ 522 if self.read_pos >= self.read_fifo.len() || self.read_count > self.read_fifo.len() { 523 return Err(()); 524 } 525 526 if !self.fifo_enabled() && self.read_count > 0 && self.read_pos > 0 { 527 // Older versions of PL011 didn't ensure that the single 528 // character in the FIFO in FIFO-disabled mode is in 529 // element 0 of the array; convert to follow the current 530 // code's assumptions. 531 self.read_fifo[0] = self.read_fifo[self.read_pos]; 532 self.read_pos = 0; 533 } 534 535 self.ibrd &= IBRD_MASK; 536 self.fbrd &= FBRD_MASK; 537 538 Ok(()) 539 } 540 } 541 542 /// Which bits in the interrupt status matter for each outbound IRQ line ? 543 pub const IRQMASK: [u32; 6] = [ 544 /* combined IRQ */ 545 Interrupt::E 546 | Interrupt::MS 547 | Interrupt::RT as u32 548 | Interrupt::TX as u32 549 | Interrupt::RX as u32, 550 Interrupt::RX as u32, 551 Interrupt::TX as u32, 552 Interrupt::RT as u32, 553 Interrupt::MS, 554 Interrupt::E, 555 ]; 556 557 /// # Safety 558 /// 559 /// We expect the FFI user of this function to pass a valid pointer, that has 560 /// the same size as [`PL011State`]. We also expect the device is 561 /// readable/writeable from one thread at any time. 562 pub unsafe extern "C" fn pl011_can_receive(opaque: *mut c_void) -> c_int { 563 unsafe { 564 debug_assert!(!opaque.is_null()); 565 let state = NonNull::new_unchecked(opaque.cast::<PL011State>()); 566 state.as_ref().can_receive().into() 567 } 568 } 569 570 /// # Safety 571 /// 572 /// We expect the FFI user of this function to pass a valid pointer, that has 573 /// the same size as [`PL011State`]. We also expect the device is 574 /// readable/writeable from one thread at any time. 575 /// 576 /// The buffer and size arguments must also be valid. 577 pub unsafe extern "C" fn pl011_receive(opaque: *mut c_void, buf: *const u8, size: c_int) { 578 unsafe { 579 debug_assert!(!opaque.is_null()); 580 let mut state = NonNull::new_unchecked(opaque.cast::<PL011State>()); 581 if state.as_ref().loopback_enabled() { 582 return; 583 } 584 if size > 0 { 585 debug_assert!(!buf.is_null()); 586 state.as_mut().put_fifo(c_uint::from(buf.read_volatile())) 587 } 588 } 589 } 590 591 /// # Safety 592 /// 593 /// We expect the FFI user of this function to pass a valid pointer, that has 594 /// the same size as [`PL011State`]. We also expect the device is 595 /// readable/writeable from one thread at any time. 596 pub unsafe extern "C" fn pl011_event(opaque: *mut c_void, event: QEMUChrEvent) { 597 unsafe { 598 debug_assert!(!opaque.is_null()); 599 let mut state = NonNull::new_unchecked(opaque.cast::<PL011State>()); 600 state.as_mut().event(event) 601 } 602 } 603 604 /// # Safety 605 /// 606 /// We expect the FFI user of this function to pass a valid pointer for `chr`. 607 #[no_mangle] 608 pub unsafe extern "C" fn pl011_create( 609 addr: u64, 610 irq: qemu_irq, 611 chr: *mut Chardev, 612 ) -> *mut DeviceState { 613 unsafe { 614 let dev: *mut DeviceState = qdev_new(PL011State::TYPE_NAME.as_ptr()); 615 let sysbus: *mut SysBusDevice = dev.cast::<SysBusDevice>(); 616 617 qdev_prop_set_chr(dev, c_str!("chardev").as_ptr(), chr); 618 sysbus_realize_and_unref(sysbus, addr_of_mut!(error_fatal)); 619 sysbus_mmio_map(sysbus, 0, addr); 620 sysbus_connect_irq(sysbus, 0, irq); 621 dev 622 } 623 } 624 625 #[repr(C)] 626 #[derive(Debug, qemu_api_macros::Object)] 627 /// PL011 Luminary device model. 628 pub struct PL011Luminary { 629 parent_obj: PL011State, 630 } 631 632 impl PL011Luminary { 633 /// Initializes a pre-allocated, unitialized instance of `PL011Luminary`. 634 /// 635 /// # Safety 636 /// 637 /// We expect the FFI user of this function to pass a valid pointer, that 638 /// has the same size as [`PL011Luminary`]. We also expect the device is 639 /// readable/writeable from one thread at any time. 640 unsafe fn init(&mut self) { 641 self.parent_obj.device_id = DeviceId::Luminary; 642 } 643 } 644 645 qom_isa!(PL011Luminary : PL011State, SysBusDevice, DeviceState, Object); 646 647 unsafe impl ObjectType for PL011Luminary { 648 type Class = <PL011State as ObjectType>::Class; 649 const TYPE_NAME: &'static CStr = crate::TYPE_PL011_LUMINARY; 650 } 651 652 impl ObjectImpl for PL011Luminary { 653 type ParentType = PL011State; 654 655 const INSTANCE_INIT: Option<unsafe fn(&mut Self)> = Some(Self::init); 656 } 657 658 impl DeviceImpl for PL011Luminary {} 659