1 /* 2 * QEMU RISC-V Host Target Interface (HTIF) Emulation 3 * 4 * Copyright (c) 2016-2017 Sagar Karandikar, sagark@eecs.berkeley.edu 5 * Copyright (c) 2017-2018 SiFive, Inc. 6 * 7 * This provides HTIF device emulation for QEMU. At the moment this allows 8 * for identical copies of bbl/linux to run on both spike and QEMU. 9 * 10 * This program is free software; you can redistribute it and/or modify it 11 * under the terms and conditions of the GNU General Public License, 12 * version 2 or later, as published by the Free Software Foundation. 13 * 14 * This program is distributed in the hope it will be useful, but WITHOUT 15 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 16 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for 17 * more details. 18 * 19 * You should have received a copy of the GNU General Public License along with 20 * this program. If not, see <http://www.gnu.org/licenses/>. 21 */ 22 23 #include "qemu/osdep.h" 24 #include "qapi/error.h" 25 #include "qemu/log.h" 26 #include "hw/char/riscv_htif.h" 27 #include "chardev/char.h" 28 #include "chardev/char-fe.h" 29 #include "qemu/timer.h" 30 #include "qemu/error-report.h" 31 #include "exec/address-spaces.h" 32 #include "exec/tswap.h" 33 #include "sysemu/dma.h" 34 #include "sysemu/runstate.h" 35 36 #define RISCV_DEBUG_HTIF 0 37 #define HTIF_DEBUG(fmt, ...) \ 38 do { \ 39 if (RISCV_DEBUG_HTIF) { \ 40 qemu_log_mask(LOG_TRACE, "%s: " fmt "\n", __func__, ##__VA_ARGS__);\ 41 } \ 42 } while (0) 43 44 #define HTIF_DEV_SHIFT 56 45 #define HTIF_CMD_SHIFT 48 46 47 #define HTIF_DEV_SYSTEM 0 48 #define HTIF_DEV_CONSOLE 1 49 50 #define HTIF_SYSTEM_CMD_SYSCALL 0 51 #define HTIF_CONSOLE_CMD_GETC 0 52 #define HTIF_CONSOLE_CMD_PUTC 1 53 54 /* PK system call number */ 55 #define PK_SYS_WRITE 64 56 57 const char *sig_file; 58 uint8_t line_size = 16; 59 60 static uint64_t fromhost_addr, tohost_addr, begin_sig_addr, end_sig_addr; 61 62 void htif_symbol_callback(const char *st_name, int st_info, uint64_t st_value, 63 uint64_t st_size) 64 { 65 if (strcmp("fromhost", st_name) == 0) { 66 fromhost_addr = st_value; 67 if (st_size != 8) { 68 error_report("HTIF fromhost must be 8 bytes"); 69 exit(1); 70 } 71 } else if (strcmp("tohost", st_name) == 0) { 72 tohost_addr = st_value; 73 if (st_size != 8) { 74 error_report("HTIF tohost must be 8 bytes"); 75 exit(1); 76 } 77 } else if (strcmp("begin_signature", st_name) == 0) { 78 begin_sig_addr = st_value; 79 } else if (strcmp("end_signature", st_name) == 0) { 80 end_sig_addr = st_value; 81 } 82 } 83 84 /* 85 * Called by the char dev to see if HTIF is ready to accept input. 86 */ 87 static int htif_can_recv(void *opaque) 88 { 89 return 1; 90 } 91 92 /* 93 * Called by the char dev to supply input to HTIF console. 94 * We assume that we will receive one character at a time. 95 */ 96 static void htif_recv(void *opaque, const uint8_t *buf, int size) 97 { 98 HTIFState *s = opaque; 99 100 if (size != 1) { 101 return; 102 } 103 104 /* 105 * TODO - we need to check whether mfromhost is zero which indicates 106 * the device is ready to receive. The current implementation 107 * will drop characters 108 */ 109 110 uint64_t val_written = s->pending_read; 111 uint64_t resp = 0x100 | *buf; 112 113 s->fromhost = (val_written >> 48 << 48) | (resp << 16 >> 16); 114 } 115 116 /* 117 * Called by the char dev to supply special events to the HTIF console. 118 * Not used for HTIF. 119 */ 120 static void htif_event(void *opaque, QEMUChrEvent event) 121 { 122 123 } 124 125 static int htif_be_change(void *opaque) 126 { 127 HTIFState *s = opaque; 128 129 qemu_chr_fe_set_handlers(&s->chr, htif_can_recv, htif_recv, htif_event, 130 htif_be_change, s, NULL, true); 131 132 return 0; 133 } 134 135 /* 136 * See below the tohost register format. 137 * 138 * Bits 63:56 indicate the "device". 139 * Bits 55:48 indicate the "command". 140 * 141 * Device 0 is the syscall device, which is used to emulate Unixy syscalls. 142 * It only implements command 0, which has two subfunctions: 143 * - If bit 0 is clear, then bits 47:0 represent a pointer to a struct 144 * describing the syscall. 145 * - If bit 1 is set, then bits 47:1 represent an exit code, with a zero 146 * value indicating success and other values indicating failure. 147 * 148 * Device 1 is the blocking character device. 149 * - Command 0 reads a character 150 * - Command 1 writes a character from the 8 LSBs of tohost 151 * 152 * For RV32, the tohost register is zero-extended, so only device=0 and 153 * command=0 (i.e. HTIF syscalls/exit codes) are supported. 154 */ 155 static void htif_handle_tohost_write(HTIFState *s, uint64_t val_written) 156 { 157 uint8_t device = val_written >> HTIF_DEV_SHIFT; 158 uint8_t cmd = val_written >> HTIF_CMD_SHIFT; 159 uint64_t payload = val_written & 0xFFFFFFFFFFFFULL; 160 int resp = 0; 161 162 HTIF_DEBUG("mtohost write: device: %d cmd: %d what: %02" PRIx64 163 " -payload: %016" PRIx64 "\n", device, cmd, payload & 0xFF, payload); 164 165 /* 166 * Currently, there is a fixed mapping of devices: 167 * 0: riscv-tests Pass/Fail Reporting Only (no syscall proxy) 168 * 1: Console 169 */ 170 if (unlikely(device == HTIF_DEV_SYSTEM)) { 171 /* frontend syscall handler, shutdown and exit code support */ 172 if (cmd == HTIF_SYSTEM_CMD_SYSCALL) { 173 if (payload & 0x1) { 174 /* exit code */ 175 int exit_code = payload >> 1; 176 177 /* 178 * Dump signature data if sig_file is specified and 179 * begin/end_signature symbols exist. 180 */ 181 if (sig_file && begin_sig_addr && end_sig_addr) { 182 uint64_t sig_len = end_sig_addr - begin_sig_addr; 183 char *sig_data = g_malloc(sig_len); 184 dma_memory_read(&address_space_memory, begin_sig_addr, 185 sig_data, sig_len, MEMTXATTRS_UNSPECIFIED); 186 FILE *signature = fopen(sig_file, "w"); 187 if (signature == NULL) { 188 error_report("Unable to open %s with error %s", 189 sig_file, strerror(errno)); 190 exit(1); 191 } 192 193 for (int i = 0; i < sig_len; i += line_size) { 194 for (int j = line_size; j > 0; j--) { 195 if (i + j <= sig_len) { 196 fprintf(signature, "%02x", 197 sig_data[i + j - 1] & 0xff); 198 } else { 199 fprintf(signature, "%02x", 0); 200 } 201 } 202 fprintf(signature, "\n"); 203 } 204 205 fclose(signature); 206 g_free(sig_data); 207 } 208 209 qemu_system_shutdown_request_with_code( 210 SHUTDOWN_CAUSE_GUEST_SHUTDOWN, exit_code); 211 return; 212 } else { 213 uint64_t syscall[8]; 214 cpu_physical_memory_read(payload, syscall, sizeof(syscall)); 215 if (tswap64(syscall[0]) == PK_SYS_WRITE && 216 tswap64(syscall[1]) == HTIF_DEV_CONSOLE && 217 tswap64(syscall[3]) == HTIF_CONSOLE_CMD_PUTC) { 218 uint8_t ch; 219 cpu_physical_memory_read(tswap64(syscall[2]), &ch, 1); 220 /* 221 * XXX this blocks entire thread. Rewrite to use 222 * qemu_chr_fe_write and background I/O callbacks 223 */ 224 qemu_chr_fe_write_all(&s->chr, &ch, 1); 225 resp = 0x100 | (uint8_t)payload; 226 } else { 227 qemu_log_mask(LOG_UNIMP, 228 "pk syscall proxy not supported\n"); 229 } 230 } 231 } else { 232 qemu_log("HTIF device %d: unknown command\n", device); 233 } 234 } else if (likely(device == HTIF_DEV_CONSOLE)) { 235 /* HTIF Console */ 236 if (cmd == HTIF_CONSOLE_CMD_GETC) { 237 /* this should be a queue, but not yet implemented as such */ 238 s->pending_read = val_written; 239 s->tohost = 0; /* clear to indicate we read */ 240 return; 241 } else if (cmd == HTIF_CONSOLE_CMD_PUTC) { 242 uint8_t ch = (uint8_t)payload; 243 /* 244 * XXX this blocks entire thread. Rewrite to use 245 * qemu_chr_fe_write and background I/O callbacks 246 */ 247 qemu_chr_fe_write_all(&s->chr, &ch, 1); 248 resp = 0x100 | (uint8_t)payload; 249 } else { 250 qemu_log("HTIF device %d: unknown command\n", device); 251 } 252 } else { 253 qemu_log("HTIF unknown device or command\n"); 254 HTIF_DEBUG("device: %d cmd: %d what: %02" PRIx64 255 " payload: %016" PRIx64, device, cmd, payload & 0xFF, payload); 256 } 257 /* 258 * Latest bbl does not set fromhost to 0 if there is a value in tohost. 259 * With this code enabled, qemu hangs waiting for fromhost to go to 0. 260 * With this code disabled, qemu works with bbl priv v1.9.1 and v1.10. 261 * HTIF needs protocol documentation and a more complete state machine. 262 * 263 * while (!s->fromhost_inprogress && 264 * s->fromhost != 0x0) { 265 * } 266 */ 267 s->fromhost = (val_written >> 48 << 48) | (resp << 16 >> 16); 268 s->tohost = 0; /* clear to indicate we read */ 269 } 270 271 #define TOHOST_OFFSET1 (s->tohost_offset) 272 #define TOHOST_OFFSET2 (s->tohost_offset + 4) 273 #define FROMHOST_OFFSET1 (s->fromhost_offset) 274 #define FROMHOST_OFFSET2 (s->fromhost_offset + 4) 275 276 /* CPU wants to read an HTIF register */ 277 static uint64_t htif_mm_read(void *opaque, hwaddr addr, unsigned size) 278 { 279 HTIFState *s = opaque; 280 if (addr == TOHOST_OFFSET1) { 281 return s->tohost & 0xFFFFFFFF; 282 } else if (addr == TOHOST_OFFSET2) { 283 return (s->tohost >> 32) & 0xFFFFFFFF; 284 } else if (addr == FROMHOST_OFFSET1) { 285 return s->fromhost & 0xFFFFFFFF; 286 } else if (addr == FROMHOST_OFFSET2) { 287 return (s->fromhost >> 32) & 0xFFFFFFFF; 288 } else { 289 qemu_log("Invalid htif read: address %016" PRIx64 "\n", 290 (uint64_t)addr); 291 return 0; 292 } 293 } 294 295 /* CPU wrote to an HTIF register */ 296 static void htif_mm_write(void *opaque, hwaddr addr, 297 uint64_t value, unsigned size) 298 { 299 HTIFState *s = opaque; 300 if (addr == TOHOST_OFFSET1) { 301 if (s->tohost == 0x0) { 302 s->allow_tohost = 1; 303 s->tohost = value & 0xFFFFFFFF; 304 } else { 305 s->allow_tohost = 0; 306 } 307 } else if (addr == TOHOST_OFFSET2) { 308 if (s->allow_tohost) { 309 s->tohost |= value << 32; 310 htif_handle_tohost_write(s, s->tohost); 311 } 312 } else if (addr == FROMHOST_OFFSET1) { 313 s->fromhost_inprogress = 1; 314 s->fromhost = value & 0xFFFFFFFF; 315 } else if (addr == FROMHOST_OFFSET2) { 316 s->fromhost |= value << 32; 317 s->fromhost_inprogress = 0; 318 } else { 319 qemu_log("Invalid htif write: address %016" PRIx64 "\n", 320 (uint64_t)addr); 321 } 322 } 323 324 static const MemoryRegionOps htif_mm_ops = { 325 .read = htif_mm_read, 326 .write = htif_mm_write, 327 }; 328 329 HTIFState *htif_mm_init(MemoryRegion *address_space, Chardev *chr, 330 uint64_t nonelf_base, bool custom_base) 331 { 332 uint64_t base, size, tohost_offset, fromhost_offset; 333 334 if (custom_base) { 335 fromhost_addr = nonelf_base; 336 tohost_addr = nonelf_base + 8; 337 } else { 338 if (!fromhost_addr || !tohost_addr) { 339 error_report("Invalid HTIF fromhost or tohost address"); 340 exit(1); 341 } 342 } 343 344 base = MIN(tohost_addr, fromhost_addr); 345 size = MAX(tohost_addr + 8, fromhost_addr + 8) - base; 346 tohost_offset = tohost_addr - base; 347 fromhost_offset = fromhost_addr - base; 348 349 HTIFState *s = g_new0(HTIFState, 1); 350 s->tohost_offset = tohost_offset; 351 s->fromhost_offset = fromhost_offset; 352 s->pending_read = 0; 353 s->allow_tohost = 0; 354 s->fromhost_inprogress = 0; 355 qemu_chr_fe_init(&s->chr, chr, &error_abort); 356 qemu_chr_fe_set_handlers(&s->chr, htif_can_recv, htif_recv, htif_event, 357 htif_be_change, s, NULL, true); 358 359 memory_region_init_io(&s->mmio, NULL, &htif_mm_ops, s, 360 TYPE_HTIF_UART, size); 361 memory_region_add_subregion_overlap(address_space, base, 362 &s->mmio, 1); 363 364 return s; 365 } 366