1 /* 2 * QEMU RISC-V Host Target Interface (HTIF) Emulation 3 * 4 * Copyright (c) 2016-2017 Sagar Karandikar, sagark@eecs.berkeley.edu 5 * Copyright (c) 2017-2018 SiFive, Inc. 6 * 7 * This provides HTIF device emulation for QEMU. At the moment this allows 8 * for identical copies of bbl/linux to run on both spike and QEMU. 9 * 10 * This program is free software; you can redistribute it and/or modify it 11 * under the terms and conditions of the GNU General Public License, 12 * version 2 or later, as published by the Free Software Foundation. 13 * 14 * This program is distributed in the hope it will be useful, but WITHOUT 15 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 16 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for 17 * more details. 18 * 19 * You should have received a copy of the GNU General Public License along with 20 * this program. If not, see <http://www.gnu.org/licenses/>. 21 */ 22 23 #include "qemu/osdep.h" 24 #include "qapi/error.h" 25 #include "qemu/log.h" 26 #include "hw/char/riscv_htif.h" 27 #include "hw/char/serial.h" 28 #include "chardev/char.h" 29 #include "chardev/char-fe.h" 30 #include "qemu/timer.h" 31 #include "qemu/error-report.h" 32 #include "exec/address-spaces.h" 33 #include "sysemu/dma.h" 34 35 #define RISCV_DEBUG_HTIF 0 36 #define HTIF_DEBUG(fmt, ...) \ 37 do { \ 38 if (RISCV_DEBUG_HTIF) { \ 39 qemu_log_mask(LOG_TRACE, "%s: " fmt "\n", __func__, ##__VA_ARGS__);\ 40 } \ 41 } while (0) 42 43 #define HTIF_DEV_SHIFT 56 44 #define HTIF_CMD_SHIFT 48 45 46 #define HTIF_DEV_SYSTEM 0 47 #define HTIF_DEV_CONSOLE 1 48 49 #define HTIF_SYSTEM_CMD_SYSCALL 0 50 #define HTIF_CONSOLE_CMD_GETC 0 51 #define HTIF_CONSOLE_CMD_PUTC 1 52 53 /* PK system call number */ 54 #define PK_SYS_WRITE 64 55 56 const char *sig_file; 57 uint8_t line_size = 16; 58 59 static uint64_t fromhost_addr, tohost_addr, begin_sig_addr, end_sig_addr; 60 61 void htif_symbol_callback(const char *st_name, int st_info, uint64_t st_value, 62 uint64_t st_size) 63 { 64 if (strcmp("fromhost", st_name) == 0) { 65 fromhost_addr = st_value; 66 if (st_size != 8) { 67 error_report("HTIF fromhost must be 8 bytes"); 68 exit(1); 69 } 70 } else if (strcmp("tohost", st_name) == 0) { 71 tohost_addr = st_value; 72 if (st_size != 8) { 73 error_report("HTIF tohost must be 8 bytes"); 74 exit(1); 75 } 76 } else if (strcmp("begin_signature", st_name) == 0) { 77 begin_sig_addr = st_value; 78 } else if (strcmp("end_signature", st_name) == 0) { 79 end_sig_addr = st_value; 80 } 81 } 82 83 /* 84 * Called by the char dev to see if HTIF is ready to accept input. 85 */ 86 static int htif_can_recv(void *opaque) 87 { 88 return 1; 89 } 90 91 /* 92 * Called by the char dev to supply input to HTIF console. 93 * We assume that we will receive one character at a time. 94 */ 95 static void htif_recv(void *opaque, const uint8_t *buf, int size) 96 { 97 HTIFState *s = opaque; 98 99 if (size != 1) { 100 return; 101 } 102 103 /* 104 * TODO - we need to check whether mfromhost is zero which indicates 105 * the device is ready to receive. The current implementation 106 * will drop characters 107 */ 108 109 uint64_t val_written = s->pending_read; 110 uint64_t resp = 0x100 | *buf; 111 112 s->fromhost = (val_written >> 48 << 48) | (resp << 16 >> 16); 113 } 114 115 /* 116 * Called by the char dev to supply special events to the HTIF console. 117 * Not used for HTIF. 118 */ 119 static void htif_event(void *opaque, QEMUChrEvent event) 120 { 121 122 } 123 124 static int htif_be_change(void *opaque) 125 { 126 HTIFState *s = opaque; 127 128 qemu_chr_fe_set_handlers(&s->chr, htif_can_recv, htif_recv, htif_event, 129 htif_be_change, s, NULL, true); 130 131 return 0; 132 } 133 134 /* 135 * See below the tohost register format. 136 * 137 * Bits 63:56 indicate the "device". 138 * Bits 55:48 indicate the "command". 139 * 140 * Device 0 is the syscall device, which is used to emulate Unixy syscalls. 141 * It only implements command 0, which has two subfunctions: 142 * - If bit 0 is clear, then bits 47:0 represent a pointer to a struct 143 * describing the syscall. 144 * - If bit 1 is set, then bits 47:1 represent an exit code, with a zero 145 * value indicating success and other values indicating failure. 146 * 147 * Device 1 is the blocking character device. 148 * - Command 0 reads a character 149 * - Command 1 writes a character from the 8 LSBs of tohost 150 * 151 * For RV32, the tohost register is zero-extended, so only device=0 and 152 * command=0 (i.e. HTIF syscalls/exit codes) are supported. 153 */ 154 static void htif_handle_tohost_write(HTIFState *s, uint64_t val_written) 155 { 156 uint8_t device = val_written >> HTIF_DEV_SHIFT; 157 uint8_t cmd = val_written >> HTIF_CMD_SHIFT; 158 uint64_t payload = val_written & 0xFFFFFFFFFFFFULL; 159 int resp = 0; 160 161 HTIF_DEBUG("mtohost write: device: %d cmd: %d what: %02" PRIx64 162 " -payload: %016" PRIx64 "\n", device, cmd, payload & 0xFF, payload); 163 164 /* 165 * Currently, there is a fixed mapping of devices: 166 * 0: riscv-tests Pass/Fail Reporting Only (no syscall proxy) 167 * 1: Console 168 */ 169 if (unlikely(device == HTIF_DEV_SYSTEM)) { 170 /* frontend syscall handler, shutdown and exit code support */ 171 if (cmd == HTIF_SYSTEM_CMD_SYSCALL) { 172 if (payload & 0x1) { 173 /* exit code */ 174 int exit_code = payload >> 1; 175 176 /* 177 * Dump signature data if sig_file is specified and 178 * begin/end_signature symbols exist. 179 */ 180 if (sig_file && begin_sig_addr && end_sig_addr) { 181 uint64_t sig_len = end_sig_addr - begin_sig_addr; 182 char *sig_data = g_malloc(sig_len); 183 dma_memory_read(&address_space_memory, begin_sig_addr, 184 sig_data, sig_len, MEMTXATTRS_UNSPECIFIED); 185 FILE *signature = fopen(sig_file, "w"); 186 if (signature == NULL) { 187 error_report("Unable to open %s with error %s", 188 sig_file, strerror(errno)); 189 exit(1); 190 } 191 192 for (int i = 0; i < sig_len; i += line_size) { 193 for (int j = line_size; j > 0; j--) { 194 if (i + j <= sig_len) { 195 fprintf(signature, "%02x", 196 sig_data[i + j - 1] & 0xff); 197 } else { 198 fprintf(signature, "%02x", 0); 199 } 200 } 201 fprintf(signature, "\n"); 202 } 203 204 fclose(signature); 205 g_free(sig_data); 206 } 207 208 exit(exit_code); 209 } else { 210 uint64_t syscall[8]; 211 cpu_physical_memory_read(payload, syscall, sizeof(syscall)); 212 if (syscall[0] == PK_SYS_WRITE && 213 syscall[1] == HTIF_DEV_CONSOLE && 214 syscall[3] == HTIF_CONSOLE_CMD_PUTC) { 215 uint8_t ch; 216 cpu_physical_memory_read(syscall[2], &ch, 1); 217 qemu_chr_fe_write(&s->chr, &ch, 1); 218 resp = 0x100 | (uint8_t)payload; 219 } else { 220 qemu_log_mask(LOG_UNIMP, 221 "pk syscall proxy not supported\n"); 222 } 223 } 224 } else { 225 qemu_log("HTIF device %d: unknown command\n", device); 226 } 227 } else if (likely(device == HTIF_DEV_CONSOLE)) { 228 /* HTIF Console */ 229 if (cmd == HTIF_CONSOLE_CMD_GETC) { 230 /* this should be a queue, but not yet implemented as such */ 231 s->pending_read = val_written; 232 s->tohost = 0; /* clear to indicate we read */ 233 return; 234 } else if (cmd == HTIF_CONSOLE_CMD_PUTC) { 235 qemu_chr_fe_write(&s->chr, (uint8_t *)&payload, 1); 236 resp = 0x100 | (uint8_t)payload; 237 } else { 238 qemu_log("HTIF device %d: unknown command\n", device); 239 } 240 } else { 241 qemu_log("HTIF unknown device or command\n"); 242 HTIF_DEBUG("device: %d cmd: %d what: %02" PRIx64 243 " payload: %016" PRIx64, device, cmd, payload & 0xFF, payload); 244 } 245 /* 246 * Latest bbl does not set fromhost to 0 if there is a value in tohost. 247 * With this code enabled, qemu hangs waiting for fromhost to go to 0. 248 * With this code disabled, qemu works with bbl priv v1.9.1 and v1.10. 249 * HTIF needs protocol documentation and a more complete state machine. 250 * 251 * while (!s->fromhost_inprogress && 252 * s->fromhost != 0x0) { 253 * } 254 */ 255 s->fromhost = (val_written >> 48 << 48) | (resp << 16 >> 16); 256 s->tohost = 0; /* clear to indicate we read */ 257 } 258 259 #define TOHOST_OFFSET1 (s->tohost_offset) 260 #define TOHOST_OFFSET2 (s->tohost_offset + 4) 261 #define FROMHOST_OFFSET1 (s->fromhost_offset) 262 #define FROMHOST_OFFSET2 (s->fromhost_offset + 4) 263 264 /* CPU wants to read an HTIF register */ 265 static uint64_t htif_mm_read(void *opaque, hwaddr addr, unsigned size) 266 { 267 HTIFState *s = opaque; 268 if (addr == TOHOST_OFFSET1) { 269 return s->tohost & 0xFFFFFFFF; 270 } else if (addr == TOHOST_OFFSET2) { 271 return (s->tohost >> 32) & 0xFFFFFFFF; 272 } else if (addr == FROMHOST_OFFSET1) { 273 return s->fromhost & 0xFFFFFFFF; 274 } else if (addr == FROMHOST_OFFSET2) { 275 return (s->fromhost >> 32) & 0xFFFFFFFF; 276 } else { 277 qemu_log("Invalid htif read: address %016" PRIx64 "\n", 278 (uint64_t)addr); 279 return 0; 280 } 281 } 282 283 /* CPU wrote to an HTIF register */ 284 static void htif_mm_write(void *opaque, hwaddr addr, 285 uint64_t value, unsigned size) 286 { 287 HTIFState *s = opaque; 288 if (addr == TOHOST_OFFSET1) { 289 if (s->tohost == 0x0) { 290 s->allow_tohost = 1; 291 s->tohost = value & 0xFFFFFFFF; 292 } else { 293 s->allow_tohost = 0; 294 } 295 } else if (addr == TOHOST_OFFSET2) { 296 if (s->allow_tohost) { 297 s->tohost |= value << 32; 298 htif_handle_tohost_write(s, s->tohost); 299 } 300 } else if (addr == FROMHOST_OFFSET1) { 301 s->fromhost_inprogress = 1; 302 s->fromhost = value & 0xFFFFFFFF; 303 } else if (addr == FROMHOST_OFFSET2) { 304 s->fromhost |= value << 32; 305 s->fromhost_inprogress = 0; 306 } else { 307 qemu_log("Invalid htif write: address %016" PRIx64 "\n", 308 (uint64_t)addr); 309 } 310 } 311 312 static const MemoryRegionOps htif_mm_ops = { 313 .read = htif_mm_read, 314 .write = htif_mm_write, 315 }; 316 317 HTIFState *htif_mm_init(MemoryRegion *address_space, Chardev *chr, 318 uint64_t nonelf_base, bool custom_base) 319 { 320 uint64_t base, size, tohost_offset, fromhost_offset; 321 322 if (custom_base) { 323 fromhost_addr = nonelf_base; 324 tohost_addr = nonelf_base + 8; 325 } else { 326 if (!fromhost_addr || !tohost_addr) { 327 error_report("Invalid HTIF fromhost or tohost address"); 328 exit(1); 329 } 330 } 331 332 base = MIN(tohost_addr, fromhost_addr); 333 size = MAX(tohost_addr + 8, fromhost_addr + 8) - base; 334 tohost_offset = tohost_addr - base; 335 fromhost_offset = fromhost_addr - base; 336 337 HTIFState *s = g_new0(HTIFState, 1); 338 s->tohost_offset = tohost_offset; 339 s->fromhost_offset = fromhost_offset; 340 s->pending_read = 0; 341 s->allow_tohost = 0; 342 s->fromhost_inprogress = 0; 343 qemu_chr_fe_init(&s->chr, chr, &error_abort); 344 qemu_chr_fe_set_handlers(&s->chr, htif_can_recv, htif_recv, htif_event, 345 htif_be_change, s, NULL, true); 346 347 memory_region_init_io(&s->mmio, NULL, &htif_mm_ops, s, 348 TYPE_HTIF_UART, size); 349 memory_region_add_subregion_overlap(address_space, base, 350 &s->mmio, 1); 351 352 return s; 353 } 354