1 /* 2 * QEMU RISC-V Host Target Interface (HTIF) Emulation 3 * 4 * Copyright (c) 2016-2017 Sagar Karandikar, sagark@eecs.berkeley.edu 5 * Copyright (c) 2017-2018 SiFive, Inc. 6 * 7 * This provides HTIF device emulation for QEMU. At the moment this allows 8 * for identical copies of bbl/linux to run on both spike and QEMU. 9 * 10 * This program is free software; you can redistribute it and/or modify it 11 * under the terms and conditions of the GNU General Public License, 12 * version 2 or later, as published by the Free Software Foundation. 13 * 14 * This program is distributed in the hope it will be useful, but WITHOUT 15 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 16 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for 17 * more details. 18 * 19 * You should have received a copy of the GNU General Public License along with 20 * this program. If not, see <http://www.gnu.org/licenses/>. 21 */ 22 23 #include "qemu/osdep.h" 24 #include "qapi/error.h" 25 #include "qemu/log.h" 26 #include "hw/char/riscv_htif.h" 27 #include "hw/char/serial.h" 28 #include "chardev/char.h" 29 #include "chardev/char-fe.h" 30 #include "qemu/timer.h" 31 #include "qemu/error-report.h" 32 33 #define RISCV_DEBUG_HTIF 0 34 #define HTIF_DEBUG(fmt, ...) \ 35 do { \ 36 if (RISCV_DEBUG_HTIF) { \ 37 qemu_log_mask(LOG_TRACE, "%s: " fmt "\n", __func__, ##__VA_ARGS__);\ 38 } \ 39 } while (0) 40 41 #define HTIF_DEV_SHIFT 56 42 #define HTIF_CMD_SHIFT 48 43 44 #define HTIF_DEV_SYSTEM 0 45 #define HTIF_DEV_CONSOLE 1 46 47 #define HTIF_SYSTEM_CMD_SYSCALL 0 48 #define HTIF_CONSOLE_CMD_GETC 0 49 #define HTIF_CONSOLE_CMD_PUTC 1 50 51 /* PK system call number */ 52 #define PK_SYS_WRITE 64 53 54 static uint64_t fromhost_addr, tohost_addr; 55 56 void htif_symbol_callback(const char *st_name, int st_info, uint64_t st_value, 57 uint64_t st_size) 58 { 59 if (strcmp("fromhost", st_name) == 0) { 60 fromhost_addr = st_value; 61 if (st_size != 8) { 62 error_report("HTIF fromhost must be 8 bytes"); 63 exit(1); 64 } 65 } else if (strcmp("tohost", st_name) == 0) { 66 tohost_addr = st_value; 67 if (st_size != 8) { 68 error_report("HTIF tohost must be 8 bytes"); 69 exit(1); 70 } 71 } 72 } 73 74 /* 75 * Called by the char dev to see if HTIF is ready to accept input. 76 */ 77 static int htif_can_recv(void *opaque) 78 { 79 return 1; 80 } 81 82 /* 83 * Called by the char dev to supply input to HTIF console. 84 * We assume that we will receive one character at a time. 85 */ 86 static void htif_recv(void *opaque, const uint8_t *buf, int size) 87 { 88 HTIFState *s = opaque; 89 90 if (size != 1) { 91 return; 92 } 93 94 /* 95 * TODO - we need to check whether mfromhost is zero which indicates 96 * the device is ready to receive. The current implementation 97 * will drop characters 98 */ 99 100 uint64_t val_written = s->pending_read; 101 uint64_t resp = 0x100 | *buf; 102 103 s->fromhost = (val_written >> 48 << 48) | (resp << 16 >> 16); 104 } 105 106 /* 107 * Called by the char dev to supply special events to the HTIF console. 108 * Not used for HTIF. 109 */ 110 static void htif_event(void *opaque, QEMUChrEvent event) 111 { 112 113 } 114 115 static int htif_be_change(void *opaque) 116 { 117 HTIFState *s = opaque; 118 119 qemu_chr_fe_set_handlers(&s->chr, htif_can_recv, htif_recv, htif_event, 120 htif_be_change, s, NULL, true); 121 122 return 0; 123 } 124 125 /* 126 * See below the tohost register format. 127 * 128 * Bits 63:56 indicate the "device". 129 * Bits 55:48 indicate the "command". 130 * 131 * Device 0 is the syscall device, which is used to emulate Unixy syscalls. 132 * It only implements command 0, which has two subfunctions: 133 * - If bit 0 is clear, then bits 47:0 represent a pointer to a struct 134 * describing the syscall. 135 * - If bit 1 is set, then bits 47:1 represent an exit code, with a zero 136 * value indicating success and other values indicating failure. 137 * 138 * Device 1 is the blocking character device. 139 * - Command 0 reads a character 140 * - Command 1 writes a character from the 8 LSBs of tohost 141 * 142 * For RV32, the tohost register is zero-extended, so only device=0 and 143 * command=0 (i.e. HTIF syscalls/exit codes) are supported. 144 */ 145 static void htif_handle_tohost_write(HTIFState *s, uint64_t val_written) 146 { 147 uint8_t device = val_written >> HTIF_DEV_SHIFT; 148 uint8_t cmd = val_written >> HTIF_CMD_SHIFT; 149 uint64_t payload = val_written & 0xFFFFFFFFFFFFULL; 150 int resp = 0; 151 152 HTIF_DEBUG("mtohost write: device: %d cmd: %d what: %02" PRIx64 153 " -payload: %016" PRIx64 "\n", device, cmd, payload & 0xFF, payload); 154 155 /* 156 * Currently, there is a fixed mapping of devices: 157 * 0: riscv-tests Pass/Fail Reporting Only (no syscall proxy) 158 * 1: Console 159 */ 160 if (unlikely(device == HTIF_DEV_SYSTEM)) { 161 /* frontend syscall handler, shutdown and exit code support */ 162 if (cmd == HTIF_SYSTEM_CMD_SYSCALL) { 163 if (payload & 0x1) { 164 /* exit code */ 165 int exit_code = payload >> 1; 166 exit(exit_code); 167 } else { 168 uint64_t syscall[8]; 169 cpu_physical_memory_read(payload, syscall, sizeof(syscall)); 170 if (syscall[0] == PK_SYS_WRITE && 171 syscall[1] == HTIF_DEV_CONSOLE && 172 syscall[3] == HTIF_CONSOLE_CMD_PUTC) { 173 uint8_t ch; 174 cpu_physical_memory_read(syscall[2], &ch, 1); 175 qemu_chr_fe_write(&s->chr, &ch, 1); 176 resp = 0x100 | (uint8_t)payload; 177 } else { 178 qemu_log_mask(LOG_UNIMP, 179 "pk syscall proxy not supported\n"); 180 } 181 } 182 } else { 183 qemu_log("HTIF device %d: unknown command\n", device); 184 } 185 } else if (likely(device == HTIF_DEV_CONSOLE)) { 186 /* HTIF Console */ 187 if (cmd == HTIF_CONSOLE_CMD_GETC) { 188 /* this should be a queue, but not yet implemented as such */ 189 s->pending_read = val_written; 190 s->tohost = 0; /* clear to indicate we read */ 191 return; 192 } else if (cmd == HTIF_CONSOLE_CMD_PUTC) { 193 qemu_chr_fe_write(&s->chr, (uint8_t *)&payload, 1); 194 resp = 0x100 | (uint8_t)payload; 195 } else { 196 qemu_log("HTIF device %d: unknown command\n", device); 197 } 198 } else { 199 qemu_log("HTIF unknown device or command\n"); 200 HTIF_DEBUG("device: %d cmd: %d what: %02" PRIx64 201 " payload: %016" PRIx64, device, cmd, payload & 0xFF, payload); 202 } 203 /* 204 * Latest bbl does not set fromhost to 0 if there is a value in tohost. 205 * With this code enabled, qemu hangs waiting for fromhost to go to 0. 206 * With this code disabled, qemu works with bbl priv v1.9.1 and v1.10. 207 * HTIF needs protocol documentation and a more complete state machine. 208 * 209 * while (!s->fromhost_inprogress && 210 * s->fromhost != 0x0) { 211 * } 212 */ 213 s->fromhost = (val_written >> 48 << 48) | (resp << 16 >> 16); 214 s->tohost = 0; /* clear to indicate we read */ 215 } 216 217 #define TOHOST_OFFSET1 (s->tohost_offset) 218 #define TOHOST_OFFSET2 (s->tohost_offset + 4) 219 #define FROMHOST_OFFSET1 (s->fromhost_offset) 220 #define FROMHOST_OFFSET2 (s->fromhost_offset + 4) 221 222 /* CPU wants to read an HTIF register */ 223 static uint64_t htif_mm_read(void *opaque, hwaddr addr, unsigned size) 224 { 225 HTIFState *s = opaque; 226 if (addr == TOHOST_OFFSET1) { 227 return s->tohost & 0xFFFFFFFF; 228 } else if (addr == TOHOST_OFFSET2) { 229 return (s->tohost >> 32) & 0xFFFFFFFF; 230 } else if (addr == FROMHOST_OFFSET1) { 231 return s->fromhost & 0xFFFFFFFF; 232 } else if (addr == FROMHOST_OFFSET2) { 233 return (s->fromhost >> 32) & 0xFFFFFFFF; 234 } else { 235 qemu_log("Invalid htif read: address %016" PRIx64 "\n", 236 (uint64_t)addr); 237 return 0; 238 } 239 } 240 241 /* CPU wrote to an HTIF register */ 242 static void htif_mm_write(void *opaque, hwaddr addr, 243 uint64_t value, unsigned size) 244 { 245 HTIFState *s = opaque; 246 if (addr == TOHOST_OFFSET1) { 247 if (s->tohost == 0x0) { 248 s->allow_tohost = 1; 249 s->tohost = value & 0xFFFFFFFF; 250 } else { 251 s->allow_tohost = 0; 252 } 253 } else if (addr == TOHOST_OFFSET2) { 254 if (s->allow_tohost) { 255 s->tohost |= value << 32; 256 htif_handle_tohost_write(s, s->tohost); 257 } 258 } else if (addr == FROMHOST_OFFSET1) { 259 s->fromhost_inprogress = 1; 260 s->fromhost = value & 0xFFFFFFFF; 261 } else if (addr == FROMHOST_OFFSET2) { 262 s->fromhost |= value << 32; 263 s->fromhost_inprogress = 0; 264 } else { 265 qemu_log("Invalid htif write: address %016" PRIx64 "\n", 266 (uint64_t)addr); 267 } 268 } 269 270 static const MemoryRegionOps htif_mm_ops = { 271 .read = htif_mm_read, 272 .write = htif_mm_write, 273 }; 274 275 HTIFState *htif_mm_init(MemoryRegion *address_space, Chardev *chr, 276 uint64_t nonelf_base, bool custom_base) 277 { 278 uint64_t base, size, tohost_offset, fromhost_offset; 279 280 if (custom_base) { 281 fromhost_addr = nonelf_base; 282 tohost_addr = nonelf_base + 8; 283 } else { 284 if (!fromhost_addr || !tohost_addr) { 285 error_report("Invalid HTIF fromhost or tohost address"); 286 exit(1); 287 } 288 } 289 290 base = MIN(tohost_addr, fromhost_addr); 291 size = MAX(tohost_addr + 8, fromhost_addr + 8) - base; 292 tohost_offset = tohost_addr - base; 293 fromhost_offset = fromhost_addr - base; 294 295 HTIFState *s = g_new0(HTIFState, 1); 296 s->tohost_offset = tohost_offset; 297 s->fromhost_offset = fromhost_offset; 298 s->pending_read = 0; 299 s->allow_tohost = 0; 300 s->fromhost_inprogress = 0; 301 qemu_chr_fe_init(&s->chr, chr, &error_abort); 302 qemu_chr_fe_set_handlers(&s->chr, htif_can_recv, htif_recv, htif_event, 303 htif_be_change, s, NULL, true); 304 305 memory_region_init_io(&s->mmio, NULL, &htif_mm_ops, s, 306 TYPE_HTIF_UART, size); 307 memory_region_add_subregion_overlap(address_space, base, 308 &s->mmio, 1); 309 310 return s; 311 } 312