2 * Arm PrimeCell PL011 UART
4 * Copyright (c) 2006 CodeSourcery.
5 * Written by Paul Brook
7 * This code is licensed under the GPL.
12 * + sysbus MMIO region 0: device registers
13 * + sysbus IRQ 0: UARTINTR (combined interrupt line)
14 * + sysbus IRQ 1: UARTRXINTR (receive FIFO interrupt line)
15 * + sysbus IRQ 2: UARTTXINTR (transmit FIFO interrupt line)
16 * + sysbus IRQ 3: UARTRTINTR (receive timeout interrupt line)
17 * + sysbus IRQ 4: UARTMSINTR (momem status interrupt line)
18 * + sysbus IRQ 5: UARTEINTR (error interrupt line)
21 #include "qemu/osdep.h"
22 #include "qapi/error.h"
23 #include "hw/char/pl011.h"
25 #include "hw/sysbus.h"
26 #include "hw/qdev-clock.h"
27 #include "hw/qdev-properties.h"
28 #include "hw/qdev-properties-system.h"
29 #include "migration/vmstate.h"
30 #include "chardev/char-fe.h"
31 #include "chardev/char-serial.h"
33 #include "qemu/module.h"
36 DeviceState
*pl011_create(hwaddr addr
, qemu_irq irq
, Chardev
*chr
)
41 dev
= qdev_new("pl011");
42 s
= SYS_BUS_DEVICE(dev
);
43 qdev_prop_set_chr(dev
, "chardev", chr
);
44 sysbus_realize_and_unref(s
, &error_fatal
);
45 sysbus_mmio_map(s
, 0, addr
);
46 sysbus_connect_irq(s
, 0, irq
);
51 /* Flag Register, UARTFR */
52 #define PL011_FLAG_RI 0x100
53 #define PL011_FLAG_TXFE 0x80
54 #define PL011_FLAG_RXFF 0x40
55 #define PL011_FLAG_TXFF 0x20
56 #define PL011_FLAG_RXFE 0x10
57 #define PL011_FLAG_DCD 0x04
58 #define PL011_FLAG_DSR 0x02
59 #define PL011_FLAG_CTS 0x01
61 /* Data Register, UARTDR */
62 #define DR_BE (1 << 10)
64 /* Interrupt status bits in UARTRIS, UARTMIS, UARTIMSC */
65 #define INT_OE (1 << 10)
66 #define INT_BE (1 << 9)
67 #define INT_PE (1 << 8)
68 #define INT_FE (1 << 7)
69 #define INT_RT (1 << 6)
70 #define INT_TX (1 << 5)
71 #define INT_RX (1 << 4)
72 #define INT_DSR (1 << 3)
73 #define INT_DCD (1 << 2)
74 #define INT_CTS (1 << 1)
75 #define INT_RI (1 << 0)
76 #define INT_E (INT_OE | INT_BE | INT_PE | INT_FE)
77 #define INT_MS (INT_RI | INT_DSR | INT_DCD | INT_CTS)
79 /* Line Control Register, UARTLCR_H */
80 #define LCR_FEN (1 << 4)
81 #define LCR_BRK (1 << 0)
83 /* Control Register, UARTCR */
84 #define CR_OUT2 (1 << 13)
85 #define CR_OUT1 (1 << 12)
86 #define CR_RTS (1 << 11)
87 #define CR_DTR (1 << 10)
88 #define CR_LBE (1 << 7)
90 /* Integer Baud Rate Divider, UARTIBRD */
91 #define IBRD_MASK 0x3f
93 /* Fractional Baud Rate Divider, UARTFBRD */
94 #define FBRD_MASK 0xffff
96 static const unsigned char pl011_id_arm
[8] =
97 { 0x11, 0x10, 0x14, 0x00, 0x0d, 0xf0, 0x05, 0xb1 };
98 static const unsigned char pl011_id_luminary
[8] =
99 { 0x11, 0x00, 0x18, 0x01, 0x0d, 0xf0, 0x05, 0xb1 };
101 static const char *pl011_regname(hwaddr offset
)
103 static const char *const rname
[] = {
104 [0] = "DR", [1] = "RSR", [6] = "FR", [8] = "ILPR", [9] = "IBRD",
105 [10] = "FBRD", [11] = "LCRH", [12] = "CR", [13] = "IFLS", [14] = "IMSC",
106 [15] = "RIS", [16] = "MIS", [17] = "ICR", [18] = "DMACR",
108 unsigned idx
= offset
>> 2;
110 if (idx
< ARRAY_SIZE(rname
) && rname
[idx
]) {
113 if (idx
>= 0x3f8 && idx
<= 0x400) {
119 /* Which bits in the interrupt status matter for each outbound IRQ line ? */
120 static const uint32_t irqmask
[] = {
121 INT_E
| INT_MS
| INT_RT
| INT_TX
| INT_RX
, /* combined IRQ */
129 static void pl011_update(PL011State
*s
)
134 flags
= s
->int_level
& s
->int_enabled
;
135 trace_pl011_irq_state(flags
!= 0);
136 for (i
= 0; i
< ARRAY_SIZE(s
->irq
); i
++) {
137 qemu_set_irq(s
->irq
[i
], (flags
& irqmask
[i
]) != 0);
141 static bool pl011_is_fifo_enabled(PL011State
*s
)
143 return (s
->lcr
& LCR_FEN
) != 0;
146 static inline unsigned pl011_get_fifo_depth(PL011State
*s
)
148 /* Note: FIFO depth is expected to be power-of-2 */
149 return pl011_is_fifo_enabled(s
) ? PL011_FIFO_DEPTH
: 1;
152 static inline void pl011_reset_fifo(PL011State
*s
)
157 /* Reset FIFO flags */
158 s
->flags
&= ~(PL011_FLAG_RXFF
| PL011_FLAG_TXFF
);
159 s
->flags
|= PL011_FLAG_RXFE
| PL011_FLAG_TXFE
;
162 static uint64_t pl011_read(void *opaque
, hwaddr offset
,
165 PL011State
*s
= (PL011State
*)opaque
;
169 switch (offset
>> 2) {
171 s
->flags
&= ~PL011_FLAG_RXFF
;
172 c
= s
->read_fifo
[s
->read_pos
];
173 if (s
->read_count
> 0) {
175 s
->read_pos
= (s
->read_pos
+ 1) & (pl011_get_fifo_depth(s
) - 1);
177 if (s
->read_count
== 0) {
178 s
->flags
|= PL011_FLAG_RXFE
;
180 if (s
->read_count
== s
->read_trigger
- 1)
181 s
->int_level
&= ~ INT_RX
;
182 trace_pl011_read_fifo(s
->read_count
);
185 qemu_chr_fe_accept_input(&s
->chr
);
188 case 1: /* UARTRSR */
194 case 8: /* UARTILPR */
197 case 9: /* UARTIBRD */
200 case 10: /* UARTFBRD */
203 case 11: /* UARTLCR_H */
206 case 12: /* UARTCR */
209 case 13: /* UARTIFLS */
212 case 14: /* UARTIMSC */
215 case 15: /* UARTRIS */
218 case 16: /* UARTMIS */
219 r
= s
->int_level
& s
->int_enabled
;
221 case 18: /* UARTDMACR */
224 case 0x3f8 ... 0x400:
225 r
= s
->id
[(offset
- 0xfe0) >> 2];
228 qemu_log_mask(LOG_GUEST_ERROR
,
229 "pl011_read: Bad offset 0x%x\n", (int)offset
);
234 trace_pl011_read(offset
, r
, pl011_regname(offset
));
238 static void pl011_set_read_trigger(PL011State
*s
)
241 /* The docs say the RX interrupt is triggered when the FIFO exceeds
242 the threshold. However linux only reads the FIFO in response to an
243 interrupt. Triggering the interrupt when the FIFO is non-empty seems
244 to make things work. */
245 if (s
->lcr
& LCR_FEN
)
246 s
->read_trigger
= (s
->ifl
>> 1) & 0x1c;
252 static unsigned int pl011_get_baudrate(const PL011State
*s
)
260 clk
= clock_get_hz(s
->clk
);
261 return (clk
/ ((s
->ibrd
<< 6) + s
->fbrd
)) << 2;
264 static void pl011_trace_baudrate_change(const PL011State
*s
)
266 trace_pl011_baudrate_change(pl011_get_baudrate(s
),
267 clock_get_hz(s
->clk
),
271 static bool pl011_loopback_enabled(PL011State
*s
)
273 return !!(s
->cr
& CR_LBE
);
276 static void pl011_loopback_mdmctrl(PL011State
*s
)
280 if (!pl011_loopback_enabled(s
)) {
285 * Loopback software-driven modem control outputs to modem status inputs:
291 * The loopback happens immediately even if this call is triggered
292 * by setting only CR.LBE.
294 * CTS/RTS updates due to enabled hardware flow controls are not
298 fr
= s
->flags
& ~(PL011_FLAG_RI
| PL011_FLAG_DCD
|
299 PL011_FLAG_DSR
| PL011_FLAG_CTS
);
300 fr
|= (cr
& CR_OUT2
) ? PL011_FLAG_RI
: 0;
301 fr
|= (cr
& CR_OUT1
) ? PL011_FLAG_DCD
: 0;
302 fr
|= (cr
& CR_RTS
) ? PL011_FLAG_CTS
: 0;
303 fr
|= (cr
& CR_DTR
) ? PL011_FLAG_DSR
: 0;
305 /* Change interrupts based on updated FR */
306 il
= s
->int_level
& ~(INT_DSR
| INT_DCD
| INT_CTS
| INT_RI
);
307 il
|= (fr
& PL011_FLAG_DSR
) ? INT_DSR
: 0;
308 il
|= (fr
& PL011_FLAG_DCD
) ? INT_DCD
: 0;
309 il
|= (fr
& PL011_FLAG_CTS
) ? INT_CTS
: 0;
310 il
|= (fr
& PL011_FLAG_RI
) ? INT_RI
: 0;
317 static void pl011_put_fifo(void *opaque
, uint32_t value
);
319 static void pl011_loopback_tx(PL011State
*s
, uint32_t value
)
321 if (!pl011_loopback_enabled(s
)) {
328 * In real hardware, TX loopback happens at the serial-bit level
329 * and then reassembled by the RX logics back into bytes and placed
330 * into the RX fifo. That is, loopback happens after TX fifo.
332 * Because the real hardware TX fifo is time-drained at the frame
333 * rate governed by the configured serial format, some loopback
334 * bytes in TX fifo may still be able to get into the RX fifo
335 * that could be full at times while being drained at software
338 * In such scenario, the RX draining pace is the major factor
339 * deciding which loopback bytes get into the RX fifo, unless
340 * hardware flow-control is enabled.
342 * For simplicity, the above described is not emulated.
344 pl011_put_fifo(s
, value
);
347 static void pl011_loopback_break(PL011State
*s
, int brk_enable
)
350 pl011_loopback_tx(s
, DR_BE
);
354 static void pl011_write(void *opaque
, hwaddr offset
,
355 uint64_t value
, unsigned size
)
357 PL011State
*s
= (PL011State
*)opaque
;
360 trace_pl011_write(offset
, value
, pl011_regname(offset
));
362 switch (offset
>> 2) {
364 /* ??? Check if transmitter is enabled. */
366 /* XXX this blocks entire thread. Rewrite to use
367 * qemu_chr_fe_write and background I/O callbacks */
368 qemu_chr_fe_write_all(&s
->chr
, &ch
, 1);
369 pl011_loopback_tx(s
, ch
);
370 s
->int_level
|= INT_TX
;
373 case 1: /* UARTRSR/UARTECR */
377 /* Writes to Flag register are ignored. */
379 case 8: /* UARTILPR */
382 case 9: /* UARTIBRD */
383 s
->ibrd
= value
& IBRD_MASK
;
384 pl011_trace_baudrate_change(s
);
386 case 10: /* UARTFBRD */
387 s
->fbrd
= value
& FBRD_MASK
;
388 pl011_trace_baudrate_change(s
);
390 case 11: /* UARTLCR_H */
391 /* Reset the FIFO state on FIFO enable or disable */
392 if ((s
->lcr
^ value
) & LCR_FEN
) {
395 if ((s
->lcr
^ value
) & LCR_BRK
) {
396 int break_enable
= value
& LCR_BRK
;
397 qemu_chr_fe_ioctl(&s
->chr
, CHR_IOCTL_SERIAL_SET_BREAK
,
399 pl011_loopback_break(s
, break_enable
);
402 pl011_set_read_trigger(s
);
404 case 12: /* UARTCR */
405 /* ??? Need to implement the enable bit. */
407 pl011_loopback_mdmctrl(s
);
409 case 13: /* UARTIFS */
411 pl011_set_read_trigger(s
);
413 case 14: /* UARTIMSC */
414 s
->int_enabled
= value
;
417 case 17: /* UARTICR */
418 s
->int_level
&= ~value
;
421 case 18: /* UARTDMACR */
424 qemu_log_mask(LOG_UNIMP
, "pl011: DMA not implemented\n");
428 qemu_log_mask(LOG_GUEST_ERROR
,
429 "pl011_write: Bad offset 0x%x\n", (int)offset
);
433 static int pl011_can_receive(void *opaque
)
435 PL011State
*s
= (PL011State
*)opaque
;
438 r
= s
->read_count
< pl011_get_fifo_depth(s
);
439 trace_pl011_can_receive(s
->lcr
, s
->read_count
, r
);
443 static void pl011_put_fifo(void *opaque
, uint32_t value
)
445 PL011State
*s
= (PL011State
*)opaque
;
449 pipe_depth
= pl011_get_fifo_depth(s
);
450 slot
= (s
->read_pos
+ s
->read_count
) & (pipe_depth
- 1);
451 s
->read_fifo
[slot
] = value
;
453 s
->flags
&= ~PL011_FLAG_RXFE
;
454 trace_pl011_put_fifo(value
, s
->read_count
);
455 if (s
->read_count
== pipe_depth
) {
456 trace_pl011_put_fifo_full();
457 s
->flags
|= PL011_FLAG_RXFF
;
459 if (s
->read_count
== s
->read_trigger
) {
460 s
->int_level
|= INT_RX
;
465 static void pl011_receive(void *opaque
, const uint8_t *buf
, int size
)
468 * In loopback mode, the RX input signal is internally disconnected
469 * from the entire receiving logics; thus, all inputs are ignored,
470 * and BREAK detection on RX input signal is also not performed.
472 if (pl011_loopback_enabled(opaque
)) {
476 pl011_put_fifo(opaque
, *buf
);
479 static void pl011_event(void *opaque
, QEMUChrEvent event
)
481 if (event
== CHR_EVENT_BREAK
&& !pl011_loopback_enabled(opaque
)) {
482 pl011_put_fifo(opaque
, DR_BE
);
486 static void pl011_clock_update(void *opaque
, ClockEvent event
)
488 PL011State
*s
= PL011(opaque
);
490 pl011_trace_baudrate_change(s
);
493 static const MemoryRegionOps pl011_ops
= {
495 .write
= pl011_write
,
496 .endianness
= DEVICE_NATIVE_ENDIAN
,
497 .impl
.min_access_size
= 4,
498 .impl
.max_access_size
= 4,
501 static bool pl011_clock_needed(void *opaque
)
503 PL011State
*s
= PL011(opaque
);
505 return s
->migrate_clk
;
508 static const VMStateDescription vmstate_pl011_clock
= {
509 .name
= "pl011/clock",
511 .minimum_version_id
= 1,
512 .needed
= pl011_clock_needed
,
513 .fields
= (const VMStateField
[]) {
514 VMSTATE_CLOCK(clk
, PL011State
),
515 VMSTATE_END_OF_LIST()
519 static int pl011_post_load(void *opaque
, int version_id
)
521 PL011State
* s
= opaque
;
523 /* Sanity-check input state */
524 if (s
->read_pos
>= ARRAY_SIZE(s
->read_fifo
) ||
525 s
->read_count
> ARRAY_SIZE(s
->read_fifo
)) {
529 if (!pl011_is_fifo_enabled(s
) && s
->read_count
> 0 && s
->read_pos
> 0) {
531 * Older versions of PL011 didn't ensure that the single
532 * character in the FIFO in FIFO-disabled mode is in
533 * element 0 of the array; convert to follow the current
534 * code's assumptions.
536 s
->read_fifo
[0] = s
->read_fifo
[s
->read_pos
];
540 s
->ibrd
&= IBRD_MASK
;
541 s
->fbrd
&= FBRD_MASK
;
546 static const VMStateDescription vmstate_pl011
= {
549 .minimum_version_id
= 2,
550 .post_load
= pl011_post_load
,
551 .fields
= (const VMStateField
[]) {
552 VMSTATE_UINT32(readbuff
, PL011State
),
553 VMSTATE_UINT32(flags
, PL011State
),
554 VMSTATE_UINT32(lcr
, PL011State
),
555 VMSTATE_UINT32(rsr
, PL011State
),
556 VMSTATE_UINT32(cr
, PL011State
),
557 VMSTATE_UINT32(dmacr
, PL011State
),
558 VMSTATE_UINT32(int_enabled
, PL011State
),
559 VMSTATE_UINT32(int_level
, PL011State
),
560 VMSTATE_UINT32_ARRAY(read_fifo
, PL011State
, PL011_FIFO_DEPTH
),
561 VMSTATE_UINT32(ilpr
, PL011State
),
562 VMSTATE_UINT32(ibrd
, PL011State
),
563 VMSTATE_UINT32(fbrd
, PL011State
),
564 VMSTATE_UINT32(ifl
, PL011State
),
565 VMSTATE_INT32(read_pos
, PL011State
),
566 VMSTATE_INT32(read_count
, PL011State
),
567 VMSTATE_INT32(read_trigger
, PL011State
),
568 VMSTATE_END_OF_LIST()
570 .subsections
= (const VMStateDescription
* const []) {
571 &vmstate_pl011_clock
,
576 static Property pl011_properties
[] = {
577 DEFINE_PROP_CHR("chardev", PL011State
, chr
),
578 DEFINE_PROP_BOOL("migrate-clk", PL011State
, migrate_clk
, true),
579 DEFINE_PROP_END_OF_LIST(),
582 static void pl011_init(Object
*obj
)
584 SysBusDevice
*sbd
= SYS_BUS_DEVICE(obj
);
585 PL011State
*s
= PL011(obj
);
588 memory_region_init_io(&s
->iomem
, OBJECT(s
), &pl011_ops
, s
, "pl011", 0x1000);
589 sysbus_init_mmio(sbd
, &s
->iomem
);
590 for (i
= 0; i
< ARRAY_SIZE(s
->irq
); i
++) {
591 sysbus_init_irq(sbd
, &s
->irq
[i
]);
594 s
->clk
= qdev_init_clock_in(DEVICE(obj
), "clk", pl011_clock_update
, s
,
597 s
->id
= pl011_id_arm
;
600 static void pl011_realize(DeviceState
*dev
, Error
**errp
)
602 PL011State
*s
= PL011(dev
);
604 qemu_chr_fe_set_handlers(&s
->chr
, pl011_can_receive
, pl011_receive
,
605 pl011_event
, NULL
, s
, NULL
, true);
608 static void pl011_reset(DeviceState
*dev
)
610 PL011State
*s
= PL011(dev
);
627 static void pl011_class_init(ObjectClass
*oc
, void *data
)
629 DeviceClass
*dc
= DEVICE_CLASS(oc
);
631 dc
->realize
= pl011_realize
;
632 dc
->reset
= pl011_reset
;
633 dc
->vmsd
= &vmstate_pl011
;
634 device_class_set_props(dc
, pl011_properties
);
637 static const TypeInfo pl011_arm_info
= {
639 .parent
= TYPE_SYS_BUS_DEVICE
,
640 .instance_size
= sizeof(PL011State
),
641 .instance_init
= pl011_init
,
642 .class_init
= pl011_class_init
,
645 static void pl011_luminary_init(Object
*obj
)
647 PL011State
*s
= PL011(obj
);
649 s
->id
= pl011_id_luminary
;
652 static const TypeInfo pl011_luminary_info
= {
653 .name
= TYPE_PL011_LUMINARY
,
654 .parent
= TYPE_PL011
,
655 .instance_init
= pl011_luminary_init
,
658 static void pl011_register_types(void)
660 type_register_static(&pl011_arm_info
);
661 type_register_static(&pl011_luminary_info
);
664 type_init(pl011_register_types
)