| 1 | /* |
| 2 | * QEMU RISC-V Host Target Interface (HTIF) Emulation |
| 3 | * |
| 4 | * Copyright (c) 2016-2017 Sagar Karandikar, sagark@eecs.berkeley.edu |
| 5 | * Copyright (c) 2017-2018 SiFive, Inc. |
| 6 | * |
| 7 | * This provides HTIF device emulation for QEMU. At the moment this allows |
| 8 | * for identical copies of bbl/linux to run on both spike and QEMU. |
| 9 | * |
| 10 | * This program is free software; you can redistribute it and/or modify it |
| 11 | * under the terms and conditions of the GNU General Public License, |
| 12 | * version 2 or later, as published by the Free Software Foundation. |
| 13 | * |
| 14 | * This program is distributed in the hope it will be useful, but WITHOUT |
| 15 | * ANY WARRANTY; without even the implied warranty of MERCHANTABILITY or |
| 16 | * FITNESS FOR A PARTICULAR PURPOSE. See the GNU General Public License for |
| 17 | * more details. |
| 18 | * |
| 19 | * You should have received a copy of the GNU General Public License along with |
| 20 | * this program. If not, see <http://www.gnu.org/licenses/>. |
| 21 | */ |
| 22 | |
| 23 | #include "qemu/osdep.h" |
| 24 | #include "qapi/error.h" |
| 25 | #include "qemu/log.h" |
| 26 | #include "hw/char/riscv_htif.h" |
| 27 | #include "chardev/char.h" |
| 28 | #include "chardev/char-fe.h" |
| 29 | #include "qemu/timer.h" |
| 30 | #include "qemu/error-report.h" |
| 31 | #include "system/address-spaces.h" |
| 32 | #include "system/dma.h" |
| 33 | #include "system/physmem.h" |
| 34 | #include "system/runstate.h" |
| 35 | #include "exec/cpu-common.h" |
| 36 | #include "trace.h" |
| 37 | |
| 38 | #define HTIF_DEV_SHIFT 56 |
| 39 | #define HTIF_CMD_SHIFT 48 |
| 40 | |
| 41 | #define HTIF_DEV_SYSTEM 0 |
| 42 | #define HTIF_DEV_CONSOLE 1 |
| 43 | |
| 44 | #define HTIF_SYSTEM_CMD_SYSCALL 0 |
| 45 | #define HTIF_CONSOLE_CMD_GETC 0 |
| 46 | #define HTIF_CONSOLE_CMD_PUTC 1 |
| 47 | |
| 48 | /* PK system call number */ |
| 49 | #define PK_SYS_WRITE 64 |
| 50 | |
| 51 | const char *sig_file; |
| 52 | uint8_t line_size = 16; |
| 53 | |
| 54 | static uint64_t fromhost_addr, tohost_addr, begin_sig_addr, end_sig_addr; |
| 55 | |
| 56 | void htif_symbol_callback(const char *st_name, int st_info, uint64_t st_value, |
| 57 | uint64_t st_size) |
| 58 | { |
| 59 | if (strcmp("fromhost", st_name) == 0) { |
| 60 | fromhost_addr = st_value; |
| 61 | if (st_size != 8) { |
| 62 | error_report("HTIF fromhost must be 8 bytes"); |
| 63 | exit(1); |
| 64 | } |
| 65 | } else if (strcmp("tohost", st_name) == 0) { |
| 66 | tohost_addr = st_value; |
| 67 | if (st_size != 8) { |
| 68 | error_report("HTIF tohost must be 8 bytes"); |
| 69 | exit(1); |
| 70 | } |
| 71 | } else if (strcmp("begin_signature", st_name) == 0) { |
| 72 | begin_sig_addr = st_value; |
| 73 | } else if (strcmp("end_signature", st_name) == 0) { |
| 74 | end_sig_addr = st_value; |
| 75 | } |
| 76 | } |
| 77 | |
| 78 | /* |
| 79 | * Called by the char dev to see if HTIF is ready to accept input. |
| 80 | */ |
| 81 | static int htif_can_recv(void *opaque) |
| 82 | { |
| 83 | return 1; |
| 84 | } |
| 85 | |
| 86 | /* |
| 87 | * Called by the char dev to supply input to HTIF console. |
| 88 | * We assume that we will receive one character at a time. |
| 89 | */ |
| 90 | static void htif_recv(void *opaque, const uint8_t *buf, int size) |
| 91 | { |
| 92 | HTIFState *s = opaque; |
| 93 | |
| 94 | if (size != 1) { |
| 95 | return; |
| 96 | } |
| 97 | |
| 98 | /* |
| 99 | * TODO - we need to check whether mfromhost is zero which indicates |
| 100 | * the device is ready to receive. The current implementation |
| 101 | * will drop characters |
| 102 | */ |
| 103 | |
| 104 | uint64_t val_written = s->pending_read; |
| 105 | uint64_t resp = 0x100 | *buf; |
| 106 | |
| 107 | s->fromhost = (val_written >> 48 << 48) | (resp << 16 >> 16); |
| 108 | } |
| 109 | |
| 110 | /* |
| 111 | * Called by the char dev to supply special events to the HTIF console. |
| 112 | * Not used for HTIF. |
| 113 | */ |
| 114 | static void htif_event(void *opaque, QEMUChrEvent event) |
| 115 | { |
| 116 | |
| 117 | } |
| 118 | |
| 119 | static int htif_be_change(void *opaque) |
| 120 | { |
| 121 | HTIFState *s = opaque; |
| 122 | |
| 123 | qemu_chr_fe_set_handlers(&s->chr, htif_can_recv, htif_recv, htif_event, |
| 124 | htif_be_change, s, NULL, true); |
| 125 | |
| 126 | return 0; |
| 127 | } |
| 128 | |
| 129 | /* |
| 130 | * See below the tohost register format. |
| 131 | * |
| 132 | * Bits 63:56 indicate the "device". |
| 133 | * Bits 55:48 indicate the "command". |
| 134 | * |
| 135 | * Device 0 is the syscall device, which is used to emulate Unixy syscalls. |
| 136 | * It only implements command 0, which has two subfunctions: |
| 137 | * - If bit 0 is clear, then bits 47:0 represent a pointer to a struct |
| 138 | * describing the syscall. |
| 139 | * - If bit 1 is set, then bits 47:1 represent an exit code, with a zero |
| 140 | * value indicating success and other values indicating failure. |
| 141 | * |
| 142 | * Device 1 is the blocking character device. |
| 143 | * - Command 0 reads a character |
| 144 | * - Command 1 writes a character from the 8 LSBs of tohost |
| 145 | * |
| 146 | * For RV32, the tohost register is zero-extended, so only device=0 and |
| 147 | * command=0 (i.e. HTIF syscalls/exit codes) are supported. |
| 148 | */ |
| 149 | static void htif_handle_tohost_write(HTIFState *s, uint64_t val_written) |
| 150 | { |
| 151 | uint8_t device = val_written >> HTIF_DEV_SHIFT; |
| 152 | uint8_t cmd = val_written >> HTIF_CMD_SHIFT; |
| 153 | uint64_t payload = val_written & 0xFFFFFFFFFFFFULL; |
| 154 | int resp = 0; |
| 155 | |
| 156 | trace_htif_uart_write_to_host(device, cmd, payload); |
| 157 | |
| 158 | /* |
| 159 | * Currently, there is a fixed mapping of devices: |
| 160 | * 0: riscv-tests Pass/Fail Reporting Only (no syscall proxy) |
| 161 | * 1: Console |
| 162 | */ |
| 163 | if (unlikely(device == HTIF_DEV_SYSTEM)) { |
| 164 | /* frontend syscall handler, shutdown and exit code support */ |
| 165 | if (cmd == HTIF_SYSTEM_CMD_SYSCALL) { |
| 166 | if (payload & 0x1) { |
| 167 | /* exit code */ |
| 168 | int exit_code = payload >> 1; |
| 169 | |
| 170 | /* |
| 171 | * Dump signature data if sig_file is specified and |
| 172 | * begin/end_signature symbols exist. |
| 173 | */ |
| 174 | if (sig_file && begin_sig_addr && end_sig_addr) { |
| 175 | if (end_sig_addr <= begin_sig_addr) { |
| 176 | error_report("Invalid HTIF signature range:" |
| 177 | " begin=0x%" PRIx64 " end=0x%" PRIx64, |
| 178 | begin_sig_addr, end_sig_addr); |
| 179 | return; |
| 180 | } |
| 181 | uint64_t sig_len = end_sig_addr - begin_sig_addr; |
| 182 | char *sig_data = g_malloc(sig_len); |
| 183 | dma_memory_read(&address_space_memory, begin_sig_addr, |
| 184 | sig_data, sig_len, MEMTXATTRS_UNSPECIFIED); |
| 185 | FILE *signature = fopen(sig_file, "w"); |
| 186 | if (signature == NULL) { |
| 187 | error_report("Unable to open %s with error %s", |
| 188 | sig_file, strerror(errno)); |
| 189 | exit(1); |
| 190 | } |
| 191 | |
| 192 | for (int i = 0; i < sig_len; i += line_size) { |
| 193 | for (int j = line_size; j > 0; j--) { |
| 194 | if (i + j <= sig_len) { |
| 195 | fprintf(signature, "%02x", |
| 196 | sig_data[i + j - 1] & 0xff); |
| 197 | } else { |
| 198 | fprintf(signature, "%02x", 0); |
| 199 | } |
| 200 | } |
| 201 | fprintf(signature, "\n"); |
| 202 | } |
| 203 | |
| 204 | fclose(signature); |
| 205 | g_free(sig_data); |
| 206 | } |
| 207 | |
| 208 | qemu_system_shutdown_request_with_code( |
| 209 | SHUTDOWN_CAUSE_GUEST_SHUTDOWN, exit_code); |
| 210 | return; |
| 211 | } else { |
| 212 | uint64_t syscall[8]; |
| 213 | physical_memory_read(payload, syscall, sizeof(syscall)); |
| 214 | if (le64_to_cpu(syscall[0]) == PK_SYS_WRITE && |
| 215 | le64_to_cpu(syscall[1]) == HTIF_DEV_CONSOLE && |
| 216 | le64_to_cpu(syscall[3]) == HTIF_CONSOLE_CMD_PUTC) { |
| 217 | uint8_t ch; |
| 218 | physical_memory_read(le64_to_cpu(syscall[2]), &ch, 1); |
| 219 | /* |
| 220 | * XXX this blocks entire thread. Rewrite to use |
| 221 | * qemu_chr_fe_write and background I/O callbacks |
| 222 | */ |
| 223 | qemu_chr_fe_write_all(&s->chr, &ch, 1); |
| 224 | resp = 0x100 | (uint8_t)payload; |
| 225 | } else { |
| 226 | qemu_log_mask(LOG_UNIMP, |
| 227 | "pk syscall proxy not supported\n"); |
| 228 | } |
| 229 | } |
| 230 | } else { |
| 231 | qemu_log("HTIF device %d: unknown command\n", device); |
| 232 | } |
| 233 | } else if (likely(device == HTIF_DEV_CONSOLE)) { |
| 234 | /* HTIF Console */ |
| 235 | if (cmd == HTIF_CONSOLE_CMD_GETC) { |
| 236 | /* this should be a queue, but not yet implemented as such */ |
| 237 | s->pending_read = val_written; |
| 238 | s->tohost = 0; /* clear to indicate we read */ |
| 239 | return; |
| 240 | } else if (cmd == HTIF_CONSOLE_CMD_PUTC) { |
| 241 | uint8_t ch = (uint8_t)payload; |
| 242 | /* |
| 243 | * XXX this blocks entire thread. Rewrite to use |
| 244 | * qemu_chr_fe_write and background I/O callbacks |
| 245 | */ |
| 246 | qemu_chr_fe_write_all(&s->chr, &ch, 1); |
| 247 | resp = 0x100 | (uint8_t)payload; |
| 248 | } else { |
| 249 | qemu_log("HTIF device %d: unknown command\n", device); |
| 250 | } |
| 251 | } else { |
| 252 | qemu_log("HTIF unknown device or command\n"); |
| 253 | trace_htif_uart_unknown_device_command(device, cmd, payload); |
| 254 | } |
| 255 | /* |
| 256 | * Latest bbl does not set fromhost to 0 if there is a value in tohost. |
| 257 | * With this code enabled, qemu hangs waiting for fromhost to go to 0. |
| 258 | * With this code disabled, qemu works with bbl priv v1.9.1 and v1.10. |
| 259 | * HTIF needs protocol documentation and a more complete state machine. |
| 260 | * |
| 261 | * while (!s->fromhost_inprogress && |
| 262 | * s->fromhost != 0x0) { |
| 263 | * } |
| 264 | */ |
| 265 | s->fromhost = (val_written >> 48 << 48) | (resp << 16 >> 16); |
| 266 | s->tohost = 0; /* clear to indicate we read */ |
| 267 | } |
| 268 | |
| 269 | #define TOHOST_OFFSET1 (s->tohost_offset) |
| 270 | #define TOHOST_OFFSET2 (s->tohost_offset + 4) |
| 271 | #define FROMHOST_OFFSET1 (s->fromhost_offset) |
| 272 | #define FROMHOST_OFFSET2 (s->fromhost_offset + 4) |
| 273 | |
| 274 | /* CPU wants to read an HTIF register */ |
| 275 | static uint64_t htif_mm_read(void *opaque, hwaddr addr, unsigned size) |
| 276 | { |
| 277 | HTIFState *s = opaque; |
| 278 | if (addr == TOHOST_OFFSET1) { |
| 279 | return s->tohost & 0xFFFFFFFF; |
| 280 | } else if (addr == TOHOST_OFFSET2) { |
| 281 | return (s->tohost >> 32) & 0xFFFFFFFF; |
| 282 | } else if (addr == FROMHOST_OFFSET1) { |
| 283 | return s->fromhost & 0xFFFFFFFF; |
| 284 | } else if (addr == FROMHOST_OFFSET2) { |
| 285 | return (s->fromhost >> 32) & 0xFFFFFFFF; |
| 286 | } else { |
| 287 | qemu_log("Invalid htif read: address %016" PRIx64 "\n", |
| 288 | (uint64_t)addr); |
| 289 | return 0; |
| 290 | } |
| 291 | } |
| 292 | |
| 293 | /* CPU wrote to an HTIF register */ |
| 294 | static void htif_mm_write(void *opaque, hwaddr addr, |
| 295 | uint64_t value, unsigned size) |
| 296 | { |
| 297 | HTIFState *s = opaque; |
| 298 | if (addr == TOHOST_OFFSET1) { |
| 299 | if (s->tohost == 0x0) { |
| 300 | s->allow_tohost = 1; |
| 301 | s->tohost = value & 0xFFFFFFFF; |
| 302 | } else { |
| 303 | s->allow_tohost = 0; |
| 304 | } |
| 305 | } else if (addr == TOHOST_OFFSET2) { |
| 306 | if (s->allow_tohost) { |
| 307 | s->tohost |= value << 32; |
| 308 | htif_handle_tohost_write(s, s->tohost); |
| 309 | } |
| 310 | } else if (addr == FROMHOST_OFFSET1) { |
| 311 | s->fromhost_inprogress = 1; |
| 312 | s->fromhost = value & 0xFFFFFFFF; |
| 313 | } else if (addr == FROMHOST_OFFSET2) { |
| 314 | s->fromhost |= value << 32; |
| 315 | s->fromhost_inprogress = 0; |
| 316 | } else { |
| 317 | qemu_log("Invalid htif write: address %016" PRIx64 "\n", |
| 318 | (uint64_t)addr); |
| 319 | } |
| 320 | } |
| 321 | |
| 322 | static const MemoryRegionOps htif_mm_ops = { |
| 323 | .read = htif_mm_read, |
| 324 | .write = htif_mm_write, |
| 325 | .endianness = DEVICE_LITTLE_ENDIAN, |
| 326 | .impl = { |
| 327 | .min_access_size = 4, |
| 328 | .max_access_size = 4, |
| 329 | }, |
| 330 | }; |
| 331 | |
| 332 | HTIFState *htif_mm_init(MemoryRegion *address_space, Chardev *chr, |
| 333 | uint64_t nonelf_base, bool custom_base) |
| 334 | { |
| 335 | uint64_t base, size, tohost_offset, fromhost_offset; |
| 336 | |
| 337 | if (custom_base) { |
| 338 | fromhost_addr = nonelf_base; |
| 339 | tohost_addr = nonelf_base + 8; |
| 340 | } else { |
| 341 | if (!fromhost_addr || !tohost_addr) { |
| 342 | error_report("Invalid HTIF fromhost or tohost address"); |
| 343 | exit(1); |
| 344 | } |
| 345 | } |
| 346 | |
| 347 | base = MIN(tohost_addr, fromhost_addr); |
| 348 | size = MAX(tohost_addr + 8, fromhost_addr + 8) - base; |
| 349 | tohost_offset = tohost_addr - base; |
| 350 | fromhost_offset = fromhost_addr - base; |
| 351 | |
| 352 | HTIFState *s = g_new0(HTIFState, 1); |
| 353 | s->tohost_offset = tohost_offset; |
| 354 | s->fromhost_offset = fromhost_offset; |
| 355 | s->pending_read = 0; |
| 356 | s->allow_tohost = 0; |
| 357 | s->fromhost_inprogress = 0; |
| 358 | qemu_chr_fe_init(&s->chr, chr, &error_abort); |
| 359 | qemu_chr_fe_set_handlers(&s->chr, htif_can_recv, htif_recv, htif_event, |
| 360 | htif_be_change, s, NULL, true); |
| 361 | |
| 362 | memory_region_init_io(&s->mmio, NULL, &htif_mm_ops, s, |
| 363 | TYPE_HTIF_UART, size); |
| 364 | memory_region_add_subregion_overlap(address_space, base, |
| 365 | &s->mmio, 1); |
| 366 | |
| 367 | return s; |
| 368 | } |