1 /* 2 * QEMU RISC-V Host Target Interface (HTIF) Emulation 3 * 4 * Copyright (c) 2016-2017 Sagar Karandikar, sagark@eecs.berkeley.edu 5 * Copyright (c) 2017-2018 SiFive, Inc. 6 * 7 * This provides HTIF device emulation for QEMU. At the moment this allows 8 * for identical copies of bbl/linux to run on both spike and QEMU. 9 * 10 * This program is free software; you can redistribute it and/or modify it 11 * under the terms and conditions of the GNU General Public License, 12 * version 2 or later, as published by the Free Software Foundation. 13 * 14 * This program is distributed in the hope it will be useful, but WITHOUT 15 * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or 16 * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for 17 * more details. 18 * 19 * You should have received a copy of the GNU General Public License along with 20 * this program. If not, see <http://www.gnu.org/licenses/>. 21 */ 22 23 #include "qemu/osdep.h" 24 #include "qapi/error.h" 25 #include "qemu/log.h" 26 #include "hw/char/riscv_htif.h" 27 #include "chardev/char.h" 28 #include "chardev/char-fe.h" 29 #include "qemu/timer.h" 30 #include "qemu/error-report.h" 31 #include "exec/address-spaces.h" 32 #include "exec/tswap.h" 33 #include "system/dma.h" 34 #include "system/runstate.h" 35 #include "trace.h" 36 37 #define HTIF_DEV_SHIFT 56 38 #define HTIF_CMD_SHIFT 48 39 40 #define HTIF_DEV_SYSTEM 0 41 #define HTIF_DEV_CONSOLE 1 42 43 #define HTIF_SYSTEM_CMD_SYSCALL 0 44 #define HTIF_CONSOLE_CMD_GETC 0 45 #define HTIF_CONSOLE_CMD_PUTC 1 46 47 /* PK system call number */ 48 #define PK_SYS_WRITE 64 49 50 const char *sig_file; 51 uint8_t line_size = 16; 52 53 static uint64_t fromhost_addr, tohost_addr, begin_sig_addr, end_sig_addr; 54 55 void htif_symbol_callback(const char *st_name, int st_info, uint64_t st_value, 56 uint64_t st_size) 57 { 58 if (strcmp("fromhost", st_name) == 0) { 59 fromhost_addr = st_value; 60 if (st_size != 8) { 61 error_report("HTIF fromhost must be 8 bytes"); 62 exit(1); 63 } 64 } else if (strcmp("tohost", st_name) == 0) { 65 tohost_addr = st_value; 66 if (st_size != 8) { 67 error_report("HTIF tohost must be 8 bytes"); 68 exit(1); 69 } 70 } else if (strcmp("begin_signature", st_name) == 0) { 71 begin_sig_addr = st_value; 72 } else if (strcmp("end_signature", st_name) == 0) { 73 end_sig_addr = st_value; 74 } 75 } 76 77 /* 78 * Called by the char dev to see if HTIF is ready to accept input. 79 */ 80 static int htif_can_recv(void *opaque) 81 { 82 return 1; 83 } 84 85 /* 86 * Called by the char dev to supply input to HTIF console. 87 * We assume that we will receive one character at a time. 88 */ 89 static void htif_recv(void *opaque, const uint8_t *buf, int size) 90 { 91 HTIFState *s = opaque; 92 93 if (size != 1) { 94 return; 95 } 96 97 /* 98 * TODO - we need to check whether mfromhost is zero which indicates 99 * the device is ready to receive. The current implementation 100 * will drop characters 101 */ 102 103 uint64_t val_written = s->pending_read; 104 uint64_t resp = 0x100 | *buf; 105 106 s->fromhost = (val_written >> 48 << 48) | (resp << 16 >> 16); 107 } 108 109 /* 110 * Called by the char dev to supply special events to the HTIF console. 111 * Not used for HTIF. 112 */ 113 static void htif_event(void *opaque, QEMUChrEvent event) 114 { 115 116 } 117 118 static int htif_be_change(void *opaque) 119 { 120 HTIFState *s = opaque; 121 122 qemu_chr_fe_set_handlers(&s->chr, htif_can_recv, htif_recv, htif_event, 123 htif_be_change, s, NULL, true); 124 125 return 0; 126 } 127 128 /* 129 * See below the tohost register format. 130 * 131 * Bits 63:56 indicate the "device". 132 * Bits 55:48 indicate the "command". 133 * 134 * Device 0 is the syscall device, which is used to emulate Unixy syscalls. 135 * It only implements command 0, which has two subfunctions: 136 * - If bit 0 is clear, then bits 47:0 represent a pointer to a struct 137 * describing the syscall. 138 * - If bit 1 is set, then bits 47:1 represent an exit code, with a zero 139 * value indicating success and other values indicating failure. 140 * 141 * Device 1 is the blocking character device. 142 * - Command 0 reads a character 143 * - Command 1 writes a character from the 8 LSBs of tohost 144 * 145 * For RV32, the tohost register is zero-extended, so only device=0 and 146 * command=0 (i.e. HTIF syscalls/exit codes) are supported. 147 */ 148 static void htif_handle_tohost_write(HTIFState *s, uint64_t val_written) 149 { 150 uint8_t device = val_written >> HTIF_DEV_SHIFT; 151 uint8_t cmd = val_written >> HTIF_CMD_SHIFT; 152 uint64_t payload = val_written & 0xFFFFFFFFFFFFULL; 153 int resp = 0; 154 155 trace_htif_uart_write_to_host(device, cmd, payload); 156 157 /* 158 * Currently, there is a fixed mapping of devices: 159 * 0: riscv-tests Pass/Fail Reporting Only (no syscall proxy) 160 * 1: Console 161 */ 162 if (unlikely(device == HTIF_DEV_SYSTEM)) { 163 /* frontend syscall handler, shutdown and exit code support */ 164 if (cmd == HTIF_SYSTEM_CMD_SYSCALL) { 165 if (payload & 0x1) { 166 /* exit code */ 167 int exit_code = payload >> 1; 168 169 /* 170 * Dump signature data if sig_file is specified and 171 * begin/end_signature symbols exist. 172 */ 173 if (sig_file && begin_sig_addr && end_sig_addr) { 174 uint64_t sig_len = end_sig_addr - begin_sig_addr; 175 char *sig_data = g_malloc(sig_len); 176 dma_memory_read(&address_space_memory, begin_sig_addr, 177 sig_data, sig_len, MEMTXATTRS_UNSPECIFIED); 178 FILE *signature = fopen(sig_file, "w"); 179 if (signature == NULL) { 180 error_report("Unable to open %s with error %s", 181 sig_file, strerror(errno)); 182 exit(1); 183 } 184 185 for (int i = 0; i < sig_len; i += line_size) { 186 for (int j = line_size; j > 0; j--) { 187 if (i + j <= sig_len) { 188 fprintf(signature, "%02x", 189 sig_data[i + j - 1] & 0xff); 190 } else { 191 fprintf(signature, "%02x", 0); 192 } 193 } 194 fprintf(signature, "\n"); 195 } 196 197 fclose(signature); 198 g_free(sig_data); 199 } 200 201 qemu_system_shutdown_request_with_code( 202 SHUTDOWN_CAUSE_GUEST_SHUTDOWN, exit_code); 203 return; 204 } else { 205 uint64_t syscall[8]; 206 cpu_physical_memory_read(payload, syscall, sizeof(syscall)); 207 if (le64_to_cpu(syscall[0]) == PK_SYS_WRITE && 208 le64_to_cpu(syscall[1]) == HTIF_DEV_CONSOLE && 209 le64_to_cpu(syscall[3]) == HTIF_CONSOLE_CMD_PUTC) { 210 uint8_t ch; 211 cpu_physical_memory_read(le64_to_cpu(syscall[2]), &ch, 1); 212 /* 213 * XXX this blocks entire thread. Rewrite to use 214 * qemu_chr_fe_write and background I/O callbacks 215 */ 216 qemu_chr_fe_write_all(&s->chr, &ch, 1); 217 resp = 0x100 | (uint8_t)payload; 218 } else { 219 qemu_log_mask(LOG_UNIMP, 220 "pk syscall proxy not supported\n"); 221 } 222 } 223 } else { 224 qemu_log("HTIF device %d: unknown command\n", device); 225 } 226 } else if (likely(device == HTIF_DEV_CONSOLE)) { 227 /* HTIF Console */ 228 if (cmd == HTIF_CONSOLE_CMD_GETC) { 229 /* this should be a queue, but not yet implemented as such */ 230 s->pending_read = val_written; 231 s->tohost = 0; /* clear to indicate we read */ 232 return; 233 } else if (cmd == HTIF_CONSOLE_CMD_PUTC) { 234 uint8_t ch = (uint8_t)payload; 235 /* 236 * XXX this blocks entire thread. Rewrite to use 237 * qemu_chr_fe_write and background I/O callbacks 238 */ 239 qemu_chr_fe_write_all(&s->chr, &ch, 1); 240 resp = 0x100 | (uint8_t)payload; 241 } else { 242 qemu_log("HTIF device %d: unknown command\n", device); 243 } 244 } else { 245 qemu_log("HTIF unknown device or command\n"); 246 trace_htif_uart_unknown_device_command(device, cmd, payload); 247 } 248 /* 249 * Latest bbl does not set fromhost to 0 if there is a value in tohost. 250 * With this code enabled, qemu hangs waiting for fromhost to go to 0. 251 * With this code disabled, qemu works with bbl priv v1.9.1 and v1.10. 252 * HTIF needs protocol documentation and a more complete state machine. 253 * 254 * while (!s->fromhost_inprogress && 255 * s->fromhost != 0x0) { 256 * } 257 */ 258 s->fromhost = (val_written >> 48 << 48) | (resp << 16 >> 16); 259 s->tohost = 0; /* clear to indicate we read */ 260 } 261 262 #define TOHOST_OFFSET1 (s->tohost_offset) 263 #define TOHOST_OFFSET2 (s->tohost_offset + 4) 264 #define FROMHOST_OFFSET1 (s->fromhost_offset) 265 #define FROMHOST_OFFSET2 (s->fromhost_offset + 4) 266 267 /* CPU wants to read an HTIF register */ 268 static uint64_t htif_mm_read(void *opaque, hwaddr addr, unsigned size) 269 { 270 HTIFState *s = opaque; 271 if (addr == TOHOST_OFFSET1) { 272 return s->tohost & 0xFFFFFFFF; 273 } else if (addr == TOHOST_OFFSET2) { 274 return (s->tohost >> 32) & 0xFFFFFFFF; 275 } else if (addr == FROMHOST_OFFSET1) { 276 return s->fromhost & 0xFFFFFFFF; 277 } else if (addr == FROMHOST_OFFSET2) { 278 return (s->fromhost >> 32) & 0xFFFFFFFF; 279 } else { 280 qemu_log("Invalid htif read: address %016" PRIx64 "\n", 281 (uint64_t)addr); 282 return 0; 283 } 284 } 285 286 /* CPU wrote to an HTIF register */ 287 static void htif_mm_write(void *opaque, hwaddr addr, 288 uint64_t value, unsigned size) 289 { 290 HTIFState *s = opaque; 291 if (addr == TOHOST_OFFSET1) { 292 if (s->tohost == 0x0) { 293 s->allow_tohost = 1; 294 s->tohost = value & 0xFFFFFFFF; 295 } else { 296 s->allow_tohost = 0; 297 } 298 } else if (addr == TOHOST_OFFSET2) { 299 if (s->allow_tohost) { 300 s->tohost |= value << 32; 301 htif_handle_tohost_write(s, s->tohost); 302 } 303 } else if (addr == FROMHOST_OFFSET1) { 304 s->fromhost_inprogress = 1; 305 s->fromhost = value & 0xFFFFFFFF; 306 } else if (addr == FROMHOST_OFFSET2) { 307 s->fromhost |= value << 32; 308 s->fromhost_inprogress = 0; 309 } else { 310 qemu_log("Invalid htif write: address %016" PRIx64 "\n", 311 (uint64_t)addr); 312 } 313 } 314 315 static const MemoryRegionOps htif_mm_ops = { 316 .read = htif_mm_read, 317 .write = htif_mm_write, 318 .endianness = DEVICE_LITTLE_ENDIAN, 319 .impl = { 320 .min_access_size = 4, 321 .max_access_size = 4, 322 }, 323 }; 324 325 HTIFState *htif_mm_init(MemoryRegion *address_space, Chardev *chr, 326 uint64_t nonelf_base, bool custom_base) 327 { 328 uint64_t base, size, tohost_offset, fromhost_offset; 329 330 if (custom_base) { 331 fromhost_addr = nonelf_base; 332 tohost_addr = nonelf_base + 8; 333 } else { 334 if (!fromhost_addr || !tohost_addr) { 335 error_report("Invalid HTIF fromhost or tohost address"); 336 exit(1); 337 } 338 } 339 340 base = MIN(tohost_addr, fromhost_addr); 341 size = MAX(tohost_addr + 8, fromhost_addr + 8) - base; 342 tohost_offset = tohost_addr - base; 343 fromhost_offset = fromhost_addr - base; 344 345 HTIFState *s = g_new0(HTIFState, 1); 346 s->tohost_offset = tohost_offset; 347 s->fromhost_offset = fromhost_offset; 348 s->pending_read = 0; 349 s->allow_tohost = 0; 350 s->fromhost_inprogress = 0; 351 qemu_chr_fe_init(&s->chr, chr, &error_abort); 352 qemu_chr_fe_set_handlers(&s->chr, htif_can_recv, htif_recv, htif_event, 353 htif_be_change, s, NULL, true); 354 355 memory_region_init_io(&s->mmio, NULL, &htif_mm_ops, s, 356 TYPE_HTIF_UART, size); 357 memory_region_add_subregion_overlap(address_space, base, 358 &s->mmio, 1); 359 360 return s; 361 } 362