1 /*
2 * QEMU RISC-V Host Target Interface (HTIF) Emulation
3 *
4 * Copyright (c) 2016-2017 Sagar Karandikar, sagark@eecs.berkeley.edu
5 * Copyright (c) 2017-2018 SiFive, Inc.
6 *
7 * This provides HTIF device emulation for QEMU. At the moment this allows
8 * for identical copies of bbl/linux to run on both spike and QEMU.
9 *
10 * This program is free software; you can redistribute it and/or modify it
11 * under the terms and conditions of the GNU General Public License,
12 * version 2 or later, as published by the Free Software Foundation.
13 *
14 * This program is distributed in the hope it will be useful, but WITHOUT
15 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or
16 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for
17 * more details.
18 *
19 * You should have received a copy of the GNU General Public License along with
20 * this program. If not, see <http://www.gnu.org/licenses/>.
21 */
22
23 #include "qemu/osdep.h"
24 #include "qapi/error.h"
25 #include "qemu/log.h"
26 #include "hw/char/riscv_htif.h"
27 #include "chardev/char.h"
28 #include "chardev/char-fe.h"
29 #include "qemu/timer.h"
30 #include "qemu/error-report.h"
31 #include "exec/address-spaces.h"
32 #include "exec/tswap.h"
33 #include "sysemu/dma.h"
34 #include "sysemu/runstate.h"
35
36 #define RISCV_DEBUG_HTIF 0
37 #define HTIF_DEBUG(fmt, ...) \
38 do { \
39 if (RISCV_DEBUG_HTIF) { \
40 qemu_log_mask(LOG_TRACE, "%s: " fmt "\n", __func__, ##__VA_ARGS__);\
41 } \
42 } while (0)
43
44 #define HTIF_DEV_SHIFT 56
45 #define HTIF_CMD_SHIFT 48
46
47 #define HTIF_DEV_SYSTEM 0
48 #define HTIF_DEV_CONSOLE 1
49
50 #define HTIF_SYSTEM_CMD_SYSCALL 0
51 #define HTIF_CONSOLE_CMD_GETC 0
52 #define HTIF_CONSOLE_CMD_PUTC 1
53
54 /* PK system call number */
55 #define PK_SYS_WRITE 64
56
57 const char *sig_file;
58 uint8_t line_size = 16;
59
60 static uint64_t fromhost_addr, tohost_addr, begin_sig_addr, end_sig_addr;
61
htif_symbol_callback(const char * st_name,int st_info,uint64_t st_value,uint64_t st_size)62 void htif_symbol_callback(const char *st_name, int st_info, uint64_t st_value,
63 uint64_t st_size)
64 {
65 if (strcmp("fromhost", st_name) == 0) {
66 fromhost_addr = st_value;
67 if (st_size != 8) {
68 error_report("HTIF fromhost must be 8 bytes");
69 exit(1);
70 }
71 } else if (strcmp("tohost", st_name) == 0) {
72 tohost_addr = st_value;
73 if (st_size != 8) {
74 error_report("HTIF tohost must be 8 bytes");
75 exit(1);
76 }
77 } else if (strcmp("begin_signature", st_name) == 0) {
78 begin_sig_addr = st_value;
79 } else if (strcmp("end_signature", st_name) == 0) {
80 end_sig_addr = st_value;
81 }
82 }
83
84 /*
85 * Called by the char dev to see if HTIF is ready to accept input.
86 */
htif_can_recv(void * opaque)87 static int htif_can_recv(void *opaque)
88 {
89 return 1;
90 }
91
92 /*
93 * Called by the char dev to supply input to HTIF console.
94 * We assume that we will receive one character at a time.
95 */
htif_recv(void * opaque,const uint8_t * buf,int size)96 static void htif_recv(void *opaque, const uint8_t *buf, int size)
97 {
98 HTIFState *s = opaque;
99
100 if (size != 1) {
101 return;
102 }
103
104 /*
105 * TODO - we need to check whether mfromhost is zero which indicates
106 * the device is ready to receive. The current implementation
107 * will drop characters
108 */
109
110 uint64_t val_written = s->pending_read;
111 uint64_t resp = 0x100 | *buf;
112
113 s->fromhost = (val_written >> 48 << 48) | (resp << 16 >> 16);
114 }
115
116 /*
117 * Called by the char dev to supply special events to the HTIF console.
118 * Not used for HTIF.
119 */
htif_event(void * opaque,QEMUChrEvent event)120 static void htif_event(void *opaque, QEMUChrEvent event)
121 {
122
123 }
124
htif_be_change(void * opaque)125 static int htif_be_change(void *opaque)
126 {
127 HTIFState *s = opaque;
128
129 qemu_chr_fe_set_handlers(&s->chr, htif_can_recv, htif_recv, htif_event,
130 htif_be_change, s, NULL, true);
131
132 return 0;
133 }
134
135 /*
136 * See below the tohost register format.
137 *
138 * Bits 63:56 indicate the "device".
139 * Bits 55:48 indicate the "command".
140 *
141 * Device 0 is the syscall device, which is used to emulate Unixy syscalls.
142 * It only implements command 0, which has two subfunctions:
143 * - If bit 0 is clear, then bits 47:0 represent a pointer to a struct
144 * describing the syscall.
145 * - If bit 1 is set, then bits 47:1 represent an exit code, with a zero
146 * value indicating success and other values indicating failure.
147 *
148 * Device 1 is the blocking character device.
149 * - Command 0 reads a character
150 * - Command 1 writes a character from the 8 LSBs of tohost
151 *
152 * For RV32, the tohost register is zero-extended, so only device=0 and
153 * command=0 (i.e. HTIF syscalls/exit codes) are supported.
154 */
htif_handle_tohost_write(HTIFState * s,uint64_t val_written)155 static void htif_handle_tohost_write(HTIFState *s, uint64_t val_written)
156 {
157 uint8_t device = val_written >> HTIF_DEV_SHIFT;
158 uint8_t cmd = val_written >> HTIF_CMD_SHIFT;
159 uint64_t payload = val_written & 0xFFFFFFFFFFFFULL;
160 int resp = 0;
161
162 HTIF_DEBUG("mtohost write: device: %d cmd: %d what: %02" PRIx64
163 " -payload: %016" PRIx64 "\n", device, cmd, payload & 0xFF, payload);
164
165 /*
166 * Currently, there is a fixed mapping of devices:
167 * 0: riscv-tests Pass/Fail Reporting Only (no syscall proxy)
168 * 1: Console
169 */
170 if (unlikely(device == HTIF_DEV_SYSTEM)) {
171 /* frontend syscall handler, shutdown and exit code support */
172 if (cmd == HTIF_SYSTEM_CMD_SYSCALL) {
173 if (payload & 0x1) {
174 /* exit code */
175 int exit_code = payload >> 1;
176
177 /*
178 * Dump signature data if sig_file is specified and
179 * begin/end_signature symbols exist.
180 */
181 if (sig_file && begin_sig_addr && end_sig_addr) {
182 uint64_t sig_len = end_sig_addr - begin_sig_addr;
183 char *sig_data = g_malloc(sig_len);
184 dma_memory_read(&address_space_memory, begin_sig_addr,
185 sig_data, sig_len, MEMTXATTRS_UNSPECIFIED);
186 FILE *signature = fopen(sig_file, "w");
187 if (signature == NULL) {
188 error_report("Unable to open %s with error %s",
189 sig_file, strerror(errno));
190 exit(1);
191 }
192
193 for (int i = 0; i < sig_len; i += line_size) {
194 for (int j = line_size; j > 0; j--) {
195 if (i + j <= sig_len) {
196 fprintf(signature, "%02x",
197 sig_data[i + j - 1] & 0xff);
198 } else {
199 fprintf(signature, "%02x", 0);
200 }
201 }
202 fprintf(signature, "\n");
203 }
204
205 fclose(signature);
206 g_free(sig_data);
207 }
208
209 qemu_system_shutdown_request_with_code(
210 SHUTDOWN_CAUSE_GUEST_SHUTDOWN, exit_code);
211 return;
212 } else {
213 uint64_t syscall[8];
214 cpu_physical_memory_read(payload, syscall, sizeof(syscall));
215 if (tswap64(syscall[0]) == PK_SYS_WRITE &&
216 tswap64(syscall[1]) == HTIF_DEV_CONSOLE &&
217 tswap64(syscall[3]) == HTIF_CONSOLE_CMD_PUTC) {
218 uint8_t ch;
219 cpu_physical_memory_read(tswap64(syscall[2]), &ch, 1);
220 /*
221 * XXX this blocks entire thread. Rewrite to use
222 * qemu_chr_fe_write and background I/O callbacks
223 */
224 qemu_chr_fe_write_all(&s->chr, &ch, 1);
225 resp = 0x100 | (uint8_t)payload;
226 } else {
227 qemu_log_mask(LOG_UNIMP,
228 "pk syscall proxy not supported\n");
229 }
230 }
231 } else {
232 qemu_log("HTIF device %d: unknown command\n", device);
233 }
234 } else if (likely(device == HTIF_DEV_CONSOLE)) {
235 /* HTIF Console */
236 if (cmd == HTIF_CONSOLE_CMD_GETC) {
237 /* this should be a queue, but not yet implemented as such */
238 s->pending_read = val_written;
239 s->tohost = 0; /* clear to indicate we read */
240 return;
241 } else if (cmd == HTIF_CONSOLE_CMD_PUTC) {
242 uint8_t ch = (uint8_t)payload;
243 /*
244 * XXX this blocks entire thread. Rewrite to use
245 * qemu_chr_fe_write and background I/O callbacks
246 */
247 qemu_chr_fe_write_all(&s->chr, &ch, 1);
248 resp = 0x100 | (uint8_t)payload;
249 } else {
250 qemu_log("HTIF device %d: unknown command\n", device);
251 }
252 } else {
253 qemu_log("HTIF unknown device or command\n");
254 HTIF_DEBUG("device: %d cmd: %d what: %02" PRIx64
255 " payload: %016" PRIx64, device, cmd, payload & 0xFF, payload);
256 }
257 /*
258 * Latest bbl does not set fromhost to 0 if there is a value in tohost.
259 * With this code enabled, qemu hangs waiting for fromhost to go to 0.
260 * With this code disabled, qemu works with bbl priv v1.9.1 and v1.10.
261 * HTIF needs protocol documentation and a more complete state machine.
262 *
263 * while (!s->fromhost_inprogress &&
264 * s->fromhost != 0x0) {
265 * }
266 */
267 s->fromhost = (val_written >> 48 << 48) | (resp << 16 >> 16);
268 s->tohost = 0; /* clear to indicate we read */
269 }
270
271 #define TOHOST_OFFSET1 (s->tohost_offset)
272 #define TOHOST_OFFSET2 (s->tohost_offset + 4)
273 #define FROMHOST_OFFSET1 (s->fromhost_offset)
274 #define FROMHOST_OFFSET2 (s->fromhost_offset + 4)
275
276 /* CPU wants to read an HTIF register */
htif_mm_read(void * opaque,hwaddr addr,unsigned size)277 static uint64_t htif_mm_read(void *opaque, hwaddr addr, unsigned size)
278 {
279 HTIFState *s = opaque;
280 if (addr == TOHOST_OFFSET1) {
281 return s->tohost & 0xFFFFFFFF;
282 } else if (addr == TOHOST_OFFSET2) {
283 return (s->tohost >> 32) & 0xFFFFFFFF;
284 } else if (addr == FROMHOST_OFFSET1) {
285 return s->fromhost & 0xFFFFFFFF;
286 } else if (addr == FROMHOST_OFFSET2) {
287 return (s->fromhost >> 32) & 0xFFFFFFFF;
288 } else {
289 qemu_log("Invalid htif read: address %016" PRIx64 "\n",
290 (uint64_t)addr);
291 return 0;
292 }
293 }
294
295 /* CPU wrote to an HTIF register */
htif_mm_write(void * opaque,hwaddr addr,uint64_t value,unsigned size)296 static void htif_mm_write(void *opaque, hwaddr addr,
297 uint64_t value, unsigned size)
298 {
299 HTIFState *s = opaque;
300 if (addr == TOHOST_OFFSET1) {
301 if (s->tohost == 0x0) {
302 s->allow_tohost = 1;
303 s->tohost = value & 0xFFFFFFFF;
304 } else {
305 s->allow_tohost = 0;
306 }
307 } else if (addr == TOHOST_OFFSET2) {
308 if (s->allow_tohost) {
309 s->tohost |= value << 32;
310 htif_handle_tohost_write(s, s->tohost);
311 }
312 } else if (addr == FROMHOST_OFFSET1) {
313 s->fromhost_inprogress = 1;
314 s->fromhost = value & 0xFFFFFFFF;
315 } else if (addr == FROMHOST_OFFSET2) {
316 s->fromhost |= value << 32;
317 s->fromhost_inprogress = 0;
318 } else {
319 qemu_log("Invalid htif write: address %016" PRIx64 "\n",
320 (uint64_t)addr);
321 }
322 }
323
324 static const MemoryRegionOps htif_mm_ops = {
325 .read = htif_mm_read,
326 .write = htif_mm_write,
327 };
328
htif_mm_init(MemoryRegion * address_space,Chardev * chr,uint64_t nonelf_base,bool custom_base)329 HTIFState *htif_mm_init(MemoryRegion *address_space, Chardev *chr,
330 uint64_t nonelf_base, bool custom_base)
331 {
332 uint64_t base, size, tohost_offset, fromhost_offset;
333
334 if (custom_base) {
335 fromhost_addr = nonelf_base;
336 tohost_addr = nonelf_base + 8;
337 } else {
338 if (!fromhost_addr || !tohost_addr) {
339 error_report("Invalid HTIF fromhost or tohost address");
340 exit(1);
341 }
342 }
343
344 base = MIN(tohost_addr, fromhost_addr);
345 size = MAX(tohost_addr + 8, fromhost_addr + 8) - base;
346 tohost_offset = tohost_addr - base;
347 fromhost_offset = fromhost_addr - base;
348
349 HTIFState *s = g_new0(HTIFState, 1);
350 s->tohost_offset = tohost_offset;
351 s->fromhost_offset = fromhost_offset;
352 s->pending_read = 0;
353 s->allow_tohost = 0;
354 s->fromhost_inprogress = 0;
355 qemu_chr_fe_init(&s->chr, chr, &error_abort);
356 qemu_chr_fe_set_handlers(&s->chr, htif_can_recv, htif_recv, htif_event,
357 htif_be_change, s, NULL, true);
358
359 memory_region_init_io(&s->mmio, NULL, &htif_mm_ops, s,
360 TYPE_HTIF_UART, size);
361 memory_region_add_subregion_overlap(address_space, base,
362 &s->mmio, 1);
363
364 return s;
365 }
366