## Start our Ox64 Emulator with NuttX
$ ./temu nuttx.cfg

TinyEMU Emulator for Ox64 BL808 RISC-V SBC
NuttShell (NSH) NuttX-12.4.0-RC0
nsh>

## Run our Expect Script...
$ ./nuttx.exp

## Which starts the Ox64 Emulator...
spawn ./temu nuttx.cfg

  ## And sends a Command to the Emulator
  nsh> uname -a
  NuttX 12.4.0-RC0 55ec92e181 Jan 24 2024 00:11:08 risc-v ox64
  nsh> 

#!/usr/bin/expect
## Expect Script for Testing NuttX with Ox64 BL808 Emulator

## For every 1 character sent, wait 0.001 milliseconds
set send_slow {1 0.001}

## Start the Ox64 BL808 Emulator
spawn ./temu nuttx.cfg

## Wait for the prompt and enter `uname -a`
## `send -s` will send slowly (0.001 ms per char)
expect "nsh> "
send -s "uname -a\r"

## Wait for the prompt and enter `ostest`
expect "nsh> "
send -s "ostest\r"

## Wait at most 30 seconds
set timeout 30

## Check the response...
expect {
  ## If we see this message, exit normally
  "ostest_main: Exiting with status -1" { exit 0 }

  ## If timeout, exit with an error
  timeout { exit 1 }
}

## Run our Expect Script to start Ox64 Emulator...
$ ./nuttx.exp
spawn ./temu nuttx.cfg

  ## And run all kinds of NuttX Tests
  nsh> ostest
  ...
  ostest_main: Exiting with status -1
  nsh>

## Our Expect Script completes successfully

## Run our Automated Test
## Every day at 0:55 UTC
## (After Daily Build at 0:00 UTC)
on:
  schedule:
    - cron: '55 0 * * *'

## Install `expect` and the Build Prerequisites on Ubuntu
sudo apt -y update
sudo apt -y install \
  expect libcurl4-openssl-dev libssl-dev zlib1g-dev libsdl2-dev wget

## Build our Ox64 BL808 Emulator
git clone https://github.com/lupyuen/ox64-tinyemu
pushd ox64-tinyemu
make
cp temu ..
popd

brew install openssl sdl2
make \
  CFLAGS="-I$(brew --prefix)/opt/openssl/include -I$(brew --prefix)/opt/sdl2/include" \
  LDFLAGS="-L$(brew --prefix)/opt/openssl/lib -L$(brew --prefix)/opt/sdl2/lib" \
  CONFIG_MACOS=y

## Location of Daily NuttX Builds
## `outputs.date` looks like `2024-01-25`
url=https://github.com/lupyuen/nuttx-ox64/releases/download/nuttx-ox64-${{ steps.date.outputs.date }}

## Download the NuttX Build and print the Git Hash
wget $url/Image
wget $url/nuttx.hash
cat nuttx.hash

## Git Hash looks like...
## NuttX Source: https://github.com/apache/nuttx/tree/501896415589aa1a0264b0765746d8bdb43bdf42
## NuttX Apps: https://github.com/apache/nuttx-apps/tree/a16fb23dd752e84849ffcf865fc5d6d5ac745e43

## Download the Test Script from github.com/lupyuen/nuttx-ox64
url=https://github.com/lupyuen/nuttx-ox64/raw/main
wget $url/nuttx.cfg
wget $url/nuttx.exp

## Run the Test Script
chmod +x nuttx.exp
./nuttx.exp

// At Startup: Init the TinyEMU Boot Code...
void copy_bios(...) {
  ...
  // Load RAM_BASE_ADDR into Register T0.
  // That's 0x5020_0000, the Start Address of
  // NuttX Kernel (Linux too)
  auipc t0, RAM_BASE_ADDR

  // Load the Device Tree into Register A1.
  // (Used by Linux but not NuttX)
  auipc a1, dtb
  addi  a1, a1, dtb

  // Load the Hart ID (CPU ID: 0) into Register A0
  csrr  a0, mhartid

  // Previously: We jump to RAM_BASE_ADDR in Machine Mode
  // Now: We jump to RAM_BASE_ADDR in Supervisor Mode...

  // Delegate all Exceptions to Supervisor Mode (instead of Machine Mode)
  // We set MEDELEG CSR Register to 0xFFFF
  lui   a5, 0x10   ; nop  // A5 is 0x10000
  addiw a5, a5, -1 ; nop  // A5 is 0xFFFF
  csrw  medeleg, a5

  // Delegate all Interrupts to Supervisor Mode (instead of Machine Mode)
  // We set MIDELEG CSR Register to 0xFFFF
  csrw  mideleg, a5

  // Rightfully: Follow the OpenSBI Settings for Ox64
  // Boot HART MIDELEG: 0x0222
  // Boot HART MEDELEG: 0xB109

  // Clear these bits in MSTATUS CSR Register...
  // MPP (Bits 11 and 12): Clear the Previous Privilege Mode
  lui   a5, 0xffffe ; nop
  addiw a5, a5, 2047
  csrc  mstatus, a5

  // Set these bits in MSTATUS CSR Register...
  // MPPS (Bit 11): Previous Privilege Mode is Supervisor Mode
  // SUM  (Bit 18): Allow Supervisor Mode to access Memory of User Mode
  lui   a5, 0x41
  addiw a5, a5, -2048
  csrs  mstatus, a5

  // Jump to RAM_BASE_ADDR in Supervisor Mode:
  // Set the MEPC CSR Register to RAM_BASE_ADDR
  // Then Return from Machine Mode to Supervisor Mode
  csrw  mepc, t0
  mret

// Fetch the System Time...
uint64_t riscv_sbi_get_time(void) {

  // Read the TIME CSR Register, which becomes
  // the `RDTIME` RISC-V Instruction
  return READ_CSR(time);
}

// Scan the Kernel Image for Special Instructions...
uint8_t *kernel_ptr = get_ram_ptr(s, RAM_BASE_ADDR, TRUE);
for (int i = 0; i < 0x10000; i++) {

  // If we find the ECALL Instruction:
  // 00000073 ecall
  const uint8_t ecall[] = { 0x73, 0x00, 0x00, 0x00 };
  if (memcmp(&kernel_ptr[i], ecall, sizeof(ecall)) == 0) {

    // Remember the ECALL Address
    ecall_addr = RAM_BASE_ADDR + i;
  }

// Read the TIME CSR Register, which becomes
// the `RDTIME` RISC-V Instruction
nuttx/arch/risc-v/src/common/supervisor/riscv_sbi.c:126
  riscv_sbi_get_time():
    return READ_CSR(time);
      5020bae6: c0102573  rdtime a0

  // If we find the RDTIME Instruction: (Read System Time)
  // c0102573 rdtime a0
  const uint8_t rdtime[] = { 0x73, 0x25, 0x10, 0xc0 };
  if (memcmp(&kernel_ptr[i], rdtime, sizeof(rdtime)) == 0) {

    // Patch RDTIME to become ECALL:
    // 00000073 ecall
    const uint8_t ecall[] = { 0x73, 0x00, 0x00, 0x00 };
    memcpy(&kernel_ptr[i], ecall,  sizeof(ecall));

    // Remember the RDTIME Address
    rdtime_addr = RAM_BASE_ADDR + i;
  }

## Ox64 Emulator patches the Special Instructions
$ ./temu nuttx.cfg

TinyEMU Emulator for Ox64 BL808 RISC-V SBC
Patched DCACHE.IALL (Invalidate all Page Table Entries in the D-Cache)
  at 0x5020099a
Patched SYNC.S (Ensure that all Cache Operations are completed)
  at 0x5020099e
Found ECALL (Start System Timer)
  at 0x5020bae0
Patched RDTIME (Read System Time)
  at 0x5020bae6

// VirtIO now emulates
// BL808 UART3 Interrupt
#define VIRTIO_IRQ 20

// When we receive a keypress...
int virtio_console_write_data(VIRTIODevice *s, const uint8_t *buf, int buf_len) {

  // Pass the keypress to NuttX later
  set_input(buf[0]);

  // Trigger the UART Interrupt
  s->int_status |= 1;
  set_irq(s->irq, 1);

// NuttX Interrupt Handler for BL808 UART
int uart_interrupt(int irq, void *context, void *arg) {

  // At 0x3000_2020: Read the UART Interrupt Status (uart_int_sts)
  int_status = getreg32(BL808_UART_INT_STS(uart_idx));

  // At 0x3000_2024: Read the UART Interrupt Mask (uart_int_mask)
  int_mask = getreg32(BL808_UART_INT_MASK(uart_idx));

  // If UART Interrupt Status says there's UART Input...
  if ((int_status & UART_INT_STS_URX_END_INT) &&
    !(int_mask & UART_INT_MASK_CR_URX_END_MASK)) {

    // At 0x3000_2028: Clear the UART Interrupt (uart_int_clear)
    putreg32(UART_INT_CLEAR_CR_URX_END_CLR, BL808_UART_INT_CLEAR(uart_idx));

    // At 0x3000_208C: Read the UART Input (uart_fifo_rdata)
    uart_recvchars(dev);

## When we press a key...
## TinyEMU triggers the UART Interrupt
plic_set_irq: irq_num=20, state=1
plic_update_mip: set_mip, pending=0x80000, served=0x0
raise_exception: cause=-2147483639
raise_exception2: cause=-2147483639, tval=0x0

## NuttX Claims the UART Interrupt
plic_read: offset=0x201004
plic_update_mip: reset_mip, pending=0x80000, served=0x80000

## NuttX handles the UART Interrupt in Interrupt Handler
virtio_ack_irq
plic_set_irq: irq_num=20, state=0
plic_update_mip: reset_mip, pending=0x0, served=0x80000

## NuttX Completes the UART Interrupt
plic_write: offset=0x201004, val=0x14
plic_update_mip: reset_mip, pending=0x0, served=0x0

// Load RAM_BASE_ADDR into Register T0.
// That's 0x5020_0000, the Start Address of
// NuttX Kernel (Linux too)
auipc t0, RAM_BASE_ADDR

// Testing: Can we jump like this?
// Jump to RAM_BASE_ADDR in Supervisor Mode:
// Set the MEPC CSR Register to RAM_BASE_ADDR
// Then Return from Machine Mode to Supervisor Mode
csrw  mepc, t0
mret

## Illegal Instruction in RISC-V User Mode (priv=U)
raise_exception2: cause=2
  tval=0x10401073
  pc=50200074
  priv=U
  mstatus=a00000080

nuttx/arch/risc-v/src/chip/bl808_head.S:124
  /* Disable all interrupts (i.e. timer, external) in sie */
  csrw sie, zero
    50200074: 10401073  csrw sie, zero

// Clear these bits in MSTATUS CSR Register...
// MPP (Bits 11 and 12): Clear the Previous Privilege Mode
lui   a5, 0xffffe ; nop
addiw a5, a5, 2047
csrc  mstatus, a5

// Set these bits in MSTATUS CSR Register...
// MPPS (Bit 11): Previous Privilege Mode is Supervisor Mode
// SUM  (Bit 18): Allow Supervisor Mode to access Memory of User Mode
lui   a5, 0x41
addiw a5, a5, -2048
csrs  mstatus, a5

// Return from Machine Mode to Supervisor Mode
mret

## NuttX Kernel starts NuttX Shell
nx_start_application: Starting init task: /system/bin/init

## NuttX Shell makes an ECALL from User Mode (priv=U)
raise_exception2: cause=8, tval=0x0
  pc=800019c6
  priv=U
  mstatus=a000400a1
  mideleg=00
  mie=00
  mip=80

## But TinyEMU jumps to Machine Mode! (priv=M)
raise_exception2: cause=2, tval=0x0
  pc=00
  priv=M
  mstatus=a000400a1
  mideleg=00
  mie=00
  mip=80

// Delegate all Exceptions to Supervisor Mode (instead of Machine Mode)
// We set MEDELEG CSR Register to 0xFFFF
lui   a5, 0x10   ; nop  // A5 is 0x10000
addiw a5, a5, -1 ; nop  // A5 is 0xFFFF
csrw  medeleg, a5

// Delegate all Interrupts to Supervisor Mode (instead of Machine Mode)
// We set MIDELEG CSR Register to 0xFFFF
csrw  mideleg, a5

// Rightfully: Follow the OpenSBI Settings for Ox64
// Boot HART MIDELEG: 0x0222
// Boot HART MEDELEG: 0xB109

nx_start_application:
  Starting init task:
    /system/bin/init
NuttShell (NSH) NuttX-12.4.0
nsh>

## Ox64 Emulator patches the Special Instructions
$ ./temu nuttx.cfg

TinyEMU Emulator for Ox64 BL808 RISC-V SBC
Patched DCACHE.IALL (Invalidate all Page Table Entries in the D-Cache)
  at 0x5020099a
Patched SYNC.S (Ensure that all Cache Operations are completed)
  at 0x5020099e
Found ECALL (Start System Timer)
  at 0x5020bae0
Patched RDTIME (Read System Time)
  at 0x5020bae6

// Called by TinyEMU to handle RISC-V Exceptions
void raise_exception2(RISCVCPUState *s, uint32_t cause, target_ulong tval) {
  ...
  // If this is an ECALL from Supervisor Mode...
  // (Not ECALL from User Mode)
  if (cause == CAUSE_SUPERVISOR_ECALL) {

    // If Program Counter is the
    // ECALL to OpenSBI...
    if (s->pc == ecall_addr) {

      // We emulate the OpenSBI Set Timer Function:
      // https://github.com/riscv-non-isa/riscv-sbi-doc/blob/v1.0.0/riscv-sbi.adoc#61-function-set-timer-fid-0

      // Clear the Pending Timer Interrupt Bit
      // (Says the SBI Spec)
      riscv_cpu_reset_mip(s, MIP_STIP);

      // If Parameter A0 is not -1, set the System Timer (timecmp)
      // (Parameter A0 is Register X10)
      uint64_t timecmp = s->reg[10];
      if (timecmp != (uint64_t) -1) {
        set_timecmp(NULL, timecmp);
      }

      // Skip to the next instruction (RET)
      s->pc += 4;
      return;          

// Set the System Timer
void set_timecmp(RISCVMachine *machine0, uint64_t timecmp) {

  // At Startup: Remember the RISC-V Machine and return
  static RISCVMachine *machine = NULL;
  if (machine0 != NULL) { machine = machine0; return; }

  // Otherwise set the System Timer
  if (machine == NULL) { puts("set_timecmp: machine is null"); return; }
  machine->timecmp = timecmp;
}

## Ox64 Emulator patches the Special Instructions
$ ./temu nuttx.cfg

TinyEMU Emulator for Ox64 BL808 RISC-V SBC
Patched DCACHE.IALL (Invalidate all Page Table Entries in the D-Cache)
  at 0x5020099a
Patched SYNC.S (Ensure that all Cache Operations are completed)
  at 0x5020099e
Found ECALL (Start System Timer)
  at 0x5020bae0
Patched RDTIME (Read System Time)
  at 0x5020bae6

// Called by TinyEMU to handle RISC-V Exceptions
void raise_exception2(RISCVCPUState *s, uint32_t cause, target_ulong tval) {
  ...
  // If this is an ECALL from Supervisor Mode...
  // (Not ECALL from User Mode)
  if (cause == CAUSE_SUPERVISOR_ECALL) {

    // If Program Counter is the
    // (formerly) RDTIME Instruction...
    if (s->pc == rdtime_addr) {

      // We emulate the RDTIME Instruction to fetch the System Time:
      // https://five-embeddev.com/riscv-isa-manual/latest/counters.html#zicntr-standard-extension-for-base-counters-and-timers

      // Return the System Time in Register A0
      // (Which is aliased to Register X10)
      s->reg[10] = real_time;

      // Skip to the next instruction (RET)
      s->pc += 4;
      return; 

// Called by TinyEMU periodically to check the System Timer
static int riscv_machine_get_sleep_duration(VirtMachine *s1, int delay) {
  ...
  // Pass the System Time to raise_exception2()
  real_time = rtc_get_time(m);

  // If the Timer Interrupt has not been triggered...
  if (!(riscv_cpu_get_mip(s) & MIP_STIP)) {

    // And the System Timer has expired...
    const int64_t delay2 = m->timecmp - rtc_get_time(m);
    if (delay2 <= 0) {

      // We trigger the Timer Interrupt
      // for Supervisor Mode
      riscv_cpu_set_mip(s, MIP_STIP);
    }
  }

Loading...
TinyEMU Emulator for Ox64 BL808 RISC-V SBC
NuttShell (NSH) NuttX-12.4.0-RC0
nsh> usleep 1
nsh>