1 // Copyright 2024, Linaro Limited 2 // Author(s): Manos Pitsidianakis <manos.pitsidianakis@linaro.org> 3 // SPDX-License-Identifier: GPL-2.0-or-later 4 5 use core::ptr::{addr_of_mut, NonNull}; 6 use std::{ 7 ffi::CStr, 8 os::raw::{c_int, c_uchar, c_uint, c_void}, 9 }; 10 11 use qemu_api::{ 12 bindings::{self, *}, 13 c_str, 14 definitions::ObjectImpl, 15 device_class::DeviceImpl, 16 impl_device_class, 17 irq::InterruptSource, 18 prelude::*, 19 }; 20 21 use crate::{ 22 device_class, 23 memory_ops::PL011_OPS, 24 registers::{self, Interrupt}, 25 RegisterOffset, 26 }; 27 28 /// Integer Baud Rate Divider, `UARTIBRD` 29 const IBRD_MASK: u32 = 0xffff; 30 31 /// Fractional Baud Rate Divider, `UARTFBRD` 32 const FBRD_MASK: u32 = 0x3f; 33 34 const DATA_BREAK: u32 = 1 << 10; 35 36 /// QEMU sourced constant. 37 pub const PL011_FIFO_DEPTH: usize = 16_usize; 38 39 #[derive(Clone, Copy, Debug)] 40 enum DeviceId { 41 #[allow(dead_code)] 42 Arm = 0, 43 Luminary, 44 } 45 46 impl std::ops::Index<hwaddr> for DeviceId { 47 type Output = c_uchar; 48 49 fn index(&self, idx: hwaddr) -> &Self::Output { 50 match self { 51 Self::Arm => &Self::PL011_ID_ARM[idx as usize], 52 Self::Luminary => &Self::PL011_ID_LUMINARY[idx as usize], 53 } 54 } 55 } 56 57 impl DeviceId { 58 const PL011_ID_ARM: [c_uchar; 8] = [0x11, 0x10, 0x14, 0x00, 0x0d, 0xf0, 0x05, 0xb1]; 59 const PL011_ID_LUMINARY: [c_uchar; 8] = [0x11, 0x00, 0x18, 0x01, 0x0d, 0xf0, 0x05, 0xb1]; 60 } 61 62 #[repr(C)] 63 #[derive(Debug, qemu_api_macros::Object, qemu_api_macros::offsets)] 64 /// PL011 Device Model in QEMU 65 pub struct PL011State { 66 pub parent_obj: SysBusDevice, 67 pub iomem: MemoryRegion, 68 #[doc(alias = "fr")] 69 pub flags: registers::Flags, 70 #[doc(alias = "lcr")] 71 pub line_control: registers::LineControl, 72 #[doc(alias = "rsr")] 73 pub receive_status_error_clear: registers::ReceiveStatusErrorClear, 74 #[doc(alias = "cr")] 75 pub control: registers::Control, 76 pub dmacr: u32, 77 pub int_enabled: u32, 78 pub int_level: u32, 79 pub read_fifo: [u32; PL011_FIFO_DEPTH], 80 pub ilpr: u32, 81 pub ibrd: u32, 82 pub fbrd: u32, 83 pub ifl: u32, 84 pub read_pos: usize, 85 pub read_count: usize, 86 pub read_trigger: usize, 87 #[doc(alias = "chr")] 88 pub char_backend: CharBackend, 89 /// QEMU interrupts 90 /// 91 /// ```text 92 /// * sysbus MMIO region 0: device registers 93 /// * sysbus IRQ 0: `UARTINTR` (combined interrupt line) 94 /// * sysbus IRQ 1: `UARTRXINTR` (receive FIFO interrupt line) 95 /// * sysbus IRQ 2: `UARTTXINTR` (transmit FIFO interrupt line) 96 /// * sysbus IRQ 3: `UARTRTINTR` (receive timeout interrupt line) 97 /// * sysbus IRQ 4: `UARTMSINTR` (momem status interrupt line) 98 /// * sysbus IRQ 5: `UARTEINTR` (error interrupt line) 99 /// ``` 100 #[doc(alias = "irq")] 101 pub interrupts: [InterruptSource; IRQMASK.len()], 102 #[doc(alias = "clk")] 103 pub clock: NonNull<Clock>, 104 #[doc(alias = "migrate_clk")] 105 pub migrate_clock: bool, 106 /// The byte string that identifies the device. 107 device_id: DeviceId, 108 } 109 110 unsafe impl ObjectType for PL011State { 111 type Class = PL011Class; 112 const TYPE_NAME: &'static CStr = crate::TYPE_PL011; 113 } 114 115 impl ObjectImpl for PL011State { 116 const PARENT_TYPE_NAME: Option<&'static CStr> = Some(<SysBusDevice as ObjectType>::TYPE_NAME); 117 const INSTANCE_INIT: Option<unsafe fn(&mut Self)> = Some(Self::init); 118 } 119 120 #[repr(C)] 121 pub struct PL011Class { 122 _inner: [u8; 0], 123 } 124 125 impl DeviceImpl for PL011State { 126 fn properties() -> &'static [Property] { 127 &device_class::PL011_PROPERTIES 128 } 129 fn vmsd() -> Option<&'static VMStateDescription> { 130 Some(&device_class::VMSTATE_PL011) 131 } 132 const REALIZE: Option<fn(&mut Self)> = Some(Self::realize); 133 const RESET: Option<fn(&mut Self)> = Some(Self::reset); 134 } 135 136 impl_device_class!(PL011State); 137 138 impl PL011State { 139 /// Initializes a pre-allocated, unitialized instance of `PL011State`. 140 /// 141 /// # Safety 142 /// 143 /// `self` must point to a correctly sized and aligned location for the 144 /// `PL011State` type. It must not be called more than once on the same 145 /// location/instance. All its fields are expected to hold unitialized 146 /// values with the sole exception of `parent_obj`. 147 unsafe fn init(&mut self) { 148 const CLK_NAME: &CStr = c_str!("clk"); 149 150 let sbd = unsafe { &mut *(addr_of_mut!(*self).cast::<SysBusDevice>()) }; 151 152 // SAFETY: 153 // 154 // self and self.iomem are guaranteed to be valid at this point since callers 155 // must make sure the `self` reference is valid. 156 unsafe { 157 memory_region_init_io( 158 addr_of_mut!(self.iomem), 159 addr_of_mut!(*self).cast::<Object>(), 160 &PL011_OPS, 161 addr_of_mut!(*self).cast::<c_void>(), 162 Self::TYPE_NAME.as_ptr(), 163 0x1000, 164 ); 165 sysbus_init_mmio(sbd, addr_of_mut!(self.iomem)); 166 } 167 168 for irq in self.interrupts.iter() { 169 sbd.init_irq(irq); 170 } 171 172 let dev = addr_of_mut!(*self).cast::<DeviceState>(); 173 174 // SAFETY: 175 // 176 // self.clock is not initialized at this point; but since `NonNull<_>` is Copy, 177 // we can overwrite the undefined value without side effects. This is 178 // safe since all PL011State instances are created by QOM code which 179 // calls this function to initialize the fields; therefore no code is 180 // able to access an invalid self.clock value. 181 unsafe { 182 self.clock = NonNull::new(qdev_init_clock_in( 183 dev, 184 CLK_NAME.as_ptr(), 185 None, /* pl011_clock_update */ 186 addr_of_mut!(*self).cast::<c_void>(), 187 ClockEvent::ClockUpdate.0, 188 )) 189 .unwrap(); 190 } 191 } 192 193 pub fn read(&mut self, offset: hwaddr, _size: c_uint) -> std::ops::ControlFlow<u64, u64> { 194 use RegisterOffset::*; 195 196 std::ops::ControlFlow::Break(match RegisterOffset::try_from(offset) { 197 Err(v) if (0x3f8..0x400).contains(&(v >> 2)) => { 198 u64::from(self.device_id[(offset - 0xfe0) >> 2]) 199 } 200 Err(_) => { 201 // qemu_log_mask(LOG_GUEST_ERROR, "pl011_read: Bad offset 0x%x\n", (int)offset); 202 0 203 } 204 Ok(DR) => { 205 self.flags.set_receive_fifo_full(false); 206 let c = self.read_fifo[self.read_pos]; 207 if self.read_count > 0 { 208 self.read_count -= 1; 209 self.read_pos = (self.read_pos + 1) & (self.fifo_depth() - 1); 210 } 211 if self.read_count == 0 { 212 self.flags.set_receive_fifo_empty(true); 213 } 214 if self.read_count + 1 == self.read_trigger { 215 self.int_level &= !registers::INT_RX; 216 } 217 // Update error bits. 218 self.receive_status_error_clear = c.to_be_bytes()[3].into(); 219 self.update(); 220 // Must call qemu_chr_fe_accept_input, so return Continue: 221 return std::ops::ControlFlow::Continue(c.into()); 222 } 223 Ok(RSR) => u8::from(self.receive_status_error_clear).into(), 224 Ok(FR) => u16::from(self.flags).into(), 225 Ok(FBRD) => self.fbrd.into(), 226 Ok(ILPR) => self.ilpr.into(), 227 Ok(IBRD) => self.ibrd.into(), 228 Ok(LCR_H) => u16::from(self.line_control).into(), 229 Ok(CR) => { 230 // We exercise our self-control. 231 u16::from(self.control).into() 232 } 233 Ok(FLS) => self.ifl.into(), 234 Ok(IMSC) => self.int_enabled.into(), 235 Ok(RIS) => self.int_level.into(), 236 Ok(MIS) => u64::from(self.int_level & self.int_enabled), 237 Ok(ICR) => { 238 // "The UARTICR Register is the interrupt clear register and is write-only" 239 // Source: ARM DDI 0183G 3.3.13 Interrupt Clear Register, UARTICR 240 0 241 } 242 Ok(DMACR) => self.dmacr.into(), 243 }) 244 } 245 246 pub fn write(&mut self, offset: hwaddr, value: u64) { 247 // eprintln!("write offset {offset} value {value}"); 248 use RegisterOffset::*; 249 let value: u32 = value as u32; 250 match RegisterOffset::try_from(offset) { 251 Err(_bad_offset) => { 252 eprintln!("write bad offset {offset} value {value}"); 253 } 254 Ok(DR) => { 255 // ??? Check if transmitter is enabled. 256 let ch: u8 = value as u8; 257 // XXX this blocks entire thread. Rewrite to use 258 // qemu_chr_fe_write and background I/O callbacks 259 260 // SAFETY: self.char_backend is a valid CharBackend instance after it's been 261 // initialized in realize(). 262 unsafe { 263 qemu_chr_fe_write_all(addr_of_mut!(self.char_backend), &ch, 1); 264 } 265 self.loopback_tx(value); 266 self.int_level |= registers::INT_TX; 267 self.update(); 268 } 269 Ok(RSR) => { 270 self.receive_status_error_clear = 0.into(); 271 } 272 Ok(FR) => { 273 // flag writes are ignored 274 } 275 Ok(ILPR) => { 276 self.ilpr = value; 277 } 278 Ok(IBRD) => { 279 self.ibrd = value; 280 } 281 Ok(FBRD) => { 282 self.fbrd = value; 283 } 284 Ok(LCR_H) => { 285 let value = value as u16; 286 let new_val: registers::LineControl = value.into(); 287 // Reset the FIFO state on FIFO enable or disable 288 if bool::from(self.line_control.fifos_enabled()) 289 ^ bool::from(new_val.fifos_enabled()) 290 { 291 self.reset_fifo(); 292 } 293 if self.line_control.send_break() ^ new_val.send_break() { 294 let mut break_enable: c_int = new_val.send_break().into(); 295 // SAFETY: self.char_backend is a valid CharBackend instance after it's been 296 // initialized in realize(). 297 unsafe { 298 qemu_chr_fe_ioctl( 299 addr_of_mut!(self.char_backend), 300 CHR_IOCTL_SERIAL_SET_BREAK as i32, 301 addr_of_mut!(break_enable).cast::<c_void>(), 302 ); 303 } 304 self.loopback_break(break_enable > 0); 305 } 306 self.line_control = new_val; 307 self.set_read_trigger(); 308 } 309 Ok(CR) => { 310 // ??? Need to implement the enable bit. 311 let value = value as u16; 312 self.control = value.into(); 313 self.loopback_mdmctrl(); 314 } 315 Ok(FLS) => { 316 self.ifl = value; 317 self.set_read_trigger(); 318 } 319 Ok(IMSC) => { 320 self.int_enabled = value; 321 self.update(); 322 } 323 Ok(RIS) => {} 324 Ok(MIS) => {} 325 Ok(ICR) => { 326 self.int_level &= !value; 327 self.update(); 328 } 329 Ok(DMACR) => { 330 self.dmacr = value; 331 if value & 3 > 0 { 332 // qemu_log_mask(LOG_UNIMP, "pl011: DMA not implemented\n"); 333 eprintln!("pl011: DMA not implemented"); 334 } 335 } 336 } 337 } 338 339 #[inline] 340 fn loopback_tx(&mut self, value: u32) { 341 if !self.loopback_enabled() { 342 return; 343 } 344 345 // Caveat: 346 // 347 // In real hardware, TX loopback happens at the serial-bit level 348 // and then reassembled by the RX logics back into bytes and placed 349 // into the RX fifo. That is, loopback happens after TX fifo. 350 // 351 // Because the real hardware TX fifo is time-drained at the frame 352 // rate governed by the configured serial format, some loopback 353 // bytes in TX fifo may still be able to get into the RX fifo 354 // that could be full at times while being drained at software 355 // pace. 356 // 357 // In such scenario, the RX draining pace is the major factor 358 // deciding which loopback bytes get into the RX fifo, unless 359 // hardware flow-control is enabled. 360 // 361 // For simplicity, the above described is not emulated. 362 self.put_fifo(value); 363 } 364 365 fn loopback_mdmctrl(&mut self) { 366 if !self.loopback_enabled() { 367 return; 368 } 369 370 /* 371 * Loopback software-driven modem control outputs to modem status inputs: 372 * FR.RI <= CR.Out2 373 * FR.DCD <= CR.Out1 374 * FR.CTS <= CR.RTS 375 * FR.DSR <= CR.DTR 376 * 377 * The loopback happens immediately even if this call is triggered 378 * by setting only CR.LBE. 379 * 380 * CTS/RTS updates due to enabled hardware flow controls are not 381 * dealt with here. 382 */ 383 384 self.flags.set_ring_indicator(self.control.out_2()); 385 self.flags.set_data_carrier_detect(self.control.out_1()); 386 self.flags.set_clear_to_send(self.control.request_to_send()); 387 self.flags 388 .set_data_set_ready(self.control.data_transmit_ready()); 389 390 // Change interrupts based on updated FR 391 let mut il = self.int_level; 392 393 il &= !Interrupt::MS; 394 395 if self.flags.data_set_ready() { 396 il |= Interrupt::DSR as u32; 397 } 398 if self.flags.data_carrier_detect() { 399 il |= Interrupt::DCD as u32; 400 } 401 if self.flags.clear_to_send() { 402 il |= Interrupt::CTS as u32; 403 } 404 if self.flags.ring_indicator() { 405 il |= Interrupt::RI as u32; 406 } 407 self.int_level = il; 408 self.update(); 409 } 410 411 fn loopback_break(&mut self, enable: bool) { 412 if enable { 413 self.loopback_tx(DATA_BREAK); 414 } 415 } 416 417 fn set_read_trigger(&mut self) { 418 self.read_trigger = 1; 419 } 420 421 pub fn realize(&mut self) { 422 // SAFETY: self.char_backend has the correct size and alignment for a 423 // CharBackend object, and its callbacks are of the correct types. 424 unsafe { 425 qemu_chr_fe_set_handlers( 426 addr_of_mut!(self.char_backend), 427 Some(pl011_can_receive), 428 Some(pl011_receive), 429 Some(pl011_event), 430 None, 431 addr_of_mut!(*self).cast::<c_void>(), 432 core::ptr::null_mut(), 433 true, 434 ); 435 } 436 } 437 438 pub fn reset(&mut self) { 439 self.line_control.reset(); 440 self.receive_status_error_clear.reset(); 441 self.dmacr = 0; 442 self.int_enabled = 0; 443 self.int_level = 0; 444 self.ilpr = 0; 445 self.ibrd = 0; 446 self.fbrd = 0; 447 self.read_trigger = 1; 448 self.ifl = 0x12; 449 self.control.reset(); 450 self.flags = 0.into(); 451 self.reset_fifo(); 452 } 453 454 pub fn reset_fifo(&mut self) { 455 self.read_count = 0; 456 self.read_pos = 0; 457 458 /* Reset FIFO flags */ 459 self.flags.reset(); 460 } 461 462 pub fn can_receive(&self) -> bool { 463 // trace_pl011_can_receive(s->lcr, s->read_count, r); 464 self.read_count < self.fifo_depth() 465 } 466 467 pub fn event(&mut self, event: QEMUChrEvent) { 468 if event == bindings::QEMUChrEvent::CHR_EVENT_BREAK && !self.fifo_enabled() { 469 self.put_fifo(DATA_BREAK); 470 self.receive_status_error_clear.set_break_error(true); 471 } 472 } 473 474 #[inline] 475 pub fn fifo_enabled(&self) -> bool { 476 matches!(self.line_control.fifos_enabled(), registers::Mode::FIFO) 477 } 478 479 #[inline] 480 pub fn loopback_enabled(&self) -> bool { 481 self.control.enable_loopback() 482 } 483 484 #[inline] 485 pub fn fifo_depth(&self) -> usize { 486 // Note: FIFO depth is expected to be power-of-2 487 if self.fifo_enabled() { 488 return PL011_FIFO_DEPTH; 489 } 490 1 491 } 492 493 pub fn put_fifo(&mut self, value: c_uint) { 494 let depth = self.fifo_depth(); 495 assert!(depth > 0); 496 let slot = (self.read_pos + self.read_count) & (depth - 1); 497 self.read_fifo[slot] = value; 498 self.read_count += 1; 499 self.flags.set_receive_fifo_empty(false); 500 if self.read_count == depth { 501 self.flags.set_receive_fifo_full(true); 502 } 503 504 if self.read_count == self.read_trigger { 505 self.int_level |= registers::INT_RX; 506 self.update(); 507 } 508 } 509 510 pub fn update(&self) { 511 let flags = self.int_level & self.int_enabled; 512 for (irq, i) in self.interrupts.iter().zip(IRQMASK) { 513 irq.set(flags & i != 0); 514 } 515 } 516 517 pub fn post_load(&mut self, _version_id: u32) -> Result<(), ()> { 518 /* Sanity-check input state */ 519 if self.read_pos >= self.read_fifo.len() || self.read_count > self.read_fifo.len() { 520 return Err(()); 521 } 522 523 if !self.fifo_enabled() && self.read_count > 0 && self.read_pos > 0 { 524 // Older versions of PL011 didn't ensure that the single 525 // character in the FIFO in FIFO-disabled mode is in 526 // element 0 of the array; convert to follow the current 527 // code's assumptions. 528 self.read_fifo[0] = self.read_fifo[self.read_pos]; 529 self.read_pos = 0; 530 } 531 532 self.ibrd &= IBRD_MASK; 533 self.fbrd &= FBRD_MASK; 534 535 Ok(()) 536 } 537 } 538 539 /// Which bits in the interrupt status matter for each outbound IRQ line ? 540 pub const IRQMASK: [u32; 6] = [ 541 /* combined IRQ */ 542 Interrupt::E 543 | Interrupt::MS 544 | Interrupt::RT as u32 545 | Interrupt::TX as u32 546 | Interrupt::RX as u32, 547 Interrupt::RX as u32, 548 Interrupt::TX as u32, 549 Interrupt::RT as u32, 550 Interrupt::MS, 551 Interrupt::E, 552 ]; 553 554 /// # Safety 555 /// 556 /// We expect the FFI user of this function to pass a valid pointer, that has 557 /// the same size as [`PL011State`]. We also expect the device is 558 /// readable/writeable from one thread at any time. 559 pub unsafe extern "C" fn pl011_can_receive(opaque: *mut c_void) -> c_int { 560 unsafe { 561 debug_assert!(!opaque.is_null()); 562 let state = NonNull::new_unchecked(opaque.cast::<PL011State>()); 563 state.as_ref().can_receive().into() 564 } 565 } 566 567 /// # Safety 568 /// 569 /// We expect the FFI user of this function to pass a valid pointer, that has 570 /// the same size as [`PL011State`]. We also expect the device is 571 /// readable/writeable from one thread at any time. 572 /// 573 /// The buffer and size arguments must also be valid. 574 pub unsafe extern "C" fn pl011_receive(opaque: *mut c_void, buf: *const u8, size: c_int) { 575 unsafe { 576 debug_assert!(!opaque.is_null()); 577 let mut state = NonNull::new_unchecked(opaque.cast::<PL011State>()); 578 if state.as_ref().loopback_enabled() { 579 return; 580 } 581 if size > 0 { 582 debug_assert!(!buf.is_null()); 583 state.as_mut().put_fifo(c_uint::from(buf.read_volatile())) 584 } 585 } 586 } 587 588 /// # Safety 589 /// 590 /// We expect the FFI user of this function to pass a valid pointer, that has 591 /// the same size as [`PL011State`]. We also expect the device is 592 /// readable/writeable from one thread at any time. 593 pub unsafe extern "C" fn pl011_event(opaque: *mut c_void, event: QEMUChrEvent) { 594 unsafe { 595 debug_assert!(!opaque.is_null()); 596 let mut state = NonNull::new_unchecked(opaque.cast::<PL011State>()); 597 state.as_mut().event(event) 598 } 599 } 600 601 /// # Safety 602 /// 603 /// We expect the FFI user of this function to pass a valid pointer for `chr`. 604 #[no_mangle] 605 pub unsafe extern "C" fn pl011_create( 606 addr: u64, 607 irq: qemu_irq, 608 chr: *mut Chardev, 609 ) -> *mut DeviceState { 610 unsafe { 611 let dev: *mut DeviceState = qdev_new(PL011State::TYPE_NAME.as_ptr()); 612 let sysbus: *mut SysBusDevice = dev.cast::<SysBusDevice>(); 613 614 qdev_prop_set_chr(dev, c_str!("chardev").as_ptr(), chr); 615 sysbus_realize_and_unref(sysbus, addr_of_mut!(error_fatal)); 616 sysbus_mmio_map(sysbus, 0, addr); 617 sysbus_connect_irq(sysbus, 0, irq); 618 dev 619 } 620 } 621 622 #[repr(C)] 623 #[derive(Debug, qemu_api_macros::Object)] 624 /// PL011 Luminary device model. 625 pub struct PL011Luminary { 626 parent_obj: PL011State, 627 } 628 629 #[repr(C)] 630 pub struct PL011LuminaryClass { 631 _inner: [u8; 0], 632 } 633 634 impl PL011Luminary { 635 /// Initializes a pre-allocated, unitialized instance of `PL011Luminary`. 636 /// 637 /// # Safety 638 /// 639 /// We expect the FFI user of this function to pass a valid pointer, that 640 /// has the same size as [`PL011Luminary`]. We also expect the device is 641 /// readable/writeable from one thread at any time. 642 unsafe fn init(&mut self) { 643 self.parent_obj.device_id = DeviceId::Luminary; 644 } 645 } 646 647 unsafe impl ObjectType for PL011Luminary { 648 type Class = PL011LuminaryClass; 649 const TYPE_NAME: &'static CStr = crate::TYPE_PL011_LUMINARY; 650 } 651 652 impl ObjectImpl for PL011Luminary { 653 const PARENT_TYPE_NAME: Option<&'static CStr> = Some(<PL011State as ObjectType>::TYPE_NAME); 654 const INSTANCE_INIT: Option<unsafe fn(&mut Self)> = Some(Self::init); 655 } 656 657 impl DeviceImpl for PL011Luminary {} 658 659 impl_device_class!(PL011Luminary); 660