1 /* 2 * QEMU educational PCI device 3 * 4 * Copyright (c) 2012-2015 Jiri Slaby 5 * 6 * Permission is hereby granted, free of charge, to any person obtaining a 7 * copy of this software and associated documentation files (the "Software"), 8 * to deal in the Software without restriction, including without limitation 9 * the rights to use, copy, modify, merge, publish, distribute, sublicense, 10 * and/or sell copies of the Software, and to permit persons to whom the 11 * Software is furnished to do so, subject to the following conditions: 12 * 13 * The above copyright notice and this permission notice shall be included in 14 * all copies or substantial portions of the Software. 15 * 16 * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR 17 * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, 18 * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE 19 * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER 20 * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING 21 * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER 22 * DEALINGS IN THE SOFTWARE. 23 */ 24 25 #include "qemu/osdep.h" 26 #include "qemu/log.h" 27 #include "qemu/units.h" 28 #include "hw/pci/pci.h" 29 #include "hw/hw.h" 30 #include "hw/pci/msi.h" 31 #include "qemu/timer.h" 32 #include "qom/object.h" 33 #include "qemu/main-loop.h" /* iothread mutex */ 34 #include "qemu/module.h" 35 #include "qapi/visitor.h" 36 37 #define TYPE_PCI_EDU_DEVICE "edu" 38 typedef struct EduState EduState; 39 DECLARE_INSTANCE_CHECKER(EduState, EDU, 40 TYPE_PCI_EDU_DEVICE) 41 42 #define FACT_IRQ 0x00000001 43 #define DMA_IRQ 0x00000100 44 45 #define DMA_START 0x40000 46 #define DMA_SIZE 4096 47 48 struct EduState { 49 PCIDevice pdev; 50 MemoryRegion mmio; 51 52 QemuThread thread; 53 QemuMutex thr_mutex; 54 QemuCond thr_cond; 55 bool stopping; 56 57 uint32_t addr4; 58 uint32_t fact; 59 #define EDU_STATUS_COMPUTING 0x01 60 #define EDU_STATUS_IRQFACT 0x80 61 uint32_t status; 62 63 uint32_t irq_status; 64 65 #define EDU_DMA_RUN 0x1 66 #define EDU_DMA_DIR(cmd) (((cmd) & 0x2) >> 1) 67 # define EDU_DMA_FROM_PCI 0 68 # define EDU_DMA_TO_PCI 1 69 #define EDU_DMA_IRQ 0x4 70 struct dma_state { 71 dma_addr_t src; 72 dma_addr_t dst; 73 dma_addr_t cnt; 74 dma_addr_t cmd; 75 } dma; 76 QEMUTimer dma_timer; 77 char dma_buf[DMA_SIZE]; 78 uint64_t dma_mask; 79 }; 80 81 static bool edu_msi_enabled(EduState *edu) 82 { 83 return msi_enabled(&edu->pdev); 84 } 85 86 static void edu_raise_irq(EduState *edu, uint32_t val) 87 { 88 edu->irq_status |= val; 89 if (edu->irq_status) { 90 if (edu_msi_enabled(edu)) { 91 msi_notify(&edu->pdev, 0); 92 } else { 93 pci_set_irq(&edu->pdev, 1); 94 } 95 } 96 } 97 98 static void edu_lower_irq(EduState *edu, uint32_t val) 99 { 100 edu->irq_status &= ~val; 101 102 if (!edu->irq_status && !edu_msi_enabled(edu)) { 103 pci_set_irq(&edu->pdev, 0); 104 } 105 } 106 107 static void edu_check_range(uint64_t xfer_start, uint64_t xfer_size, 108 uint64_t dma_start, uint64_t dma_size) 109 { 110 uint64_t xfer_end = xfer_start + xfer_size; 111 uint64_t dma_end = dma_start + dma_size; 112 113 /* 114 * 1. ensure we aren't overflowing 115 * 2. ensure that xfer is within dma address range 116 */ 117 if (dma_end >= dma_start && xfer_end >= xfer_start && 118 xfer_start >= dma_start && xfer_end <= dma_end) { 119 return; 120 } 121 122 qemu_log_mask(LOG_GUEST_ERROR, 123 "EDU: DMA range 0x%016"PRIx64"-0x%016"PRIx64 124 " out of bounds (0x%016"PRIx64"-0x%016"PRIx64")!", 125 xfer_start, xfer_end - 1, dma_start, dma_end - 1); 126 } 127 128 static dma_addr_t edu_clamp_addr(const EduState *edu, dma_addr_t addr) 129 { 130 dma_addr_t res = addr & edu->dma_mask; 131 132 if (addr != res) { 133 qemu_log_mask(LOG_GUEST_ERROR, 134 "EDU: clamping DMA 0x%016"PRIx64" to 0x%016"PRIx64"!", 135 addr, res); 136 } 137 138 return res; 139 } 140 141 static void edu_dma_timer(void *opaque) 142 { 143 EduState *edu = opaque; 144 bool raise_irq = false; 145 146 if (!(edu->dma.cmd & EDU_DMA_RUN)) { 147 return; 148 } 149 150 if (EDU_DMA_DIR(edu->dma.cmd) == EDU_DMA_FROM_PCI) { 151 uint64_t dst = edu->dma.dst; 152 edu_check_range(dst, edu->dma.cnt, DMA_START, DMA_SIZE); 153 dst -= DMA_START; 154 pci_dma_read(&edu->pdev, edu_clamp_addr(edu, edu->dma.src), 155 edu->dma_buf + dst, edu->dma.cnt); 156 } else { 157 uint64_t src = edu->dma.src; 158 edu_check_range(src, edu->dma.cnt, DMA_START, DMA_SIZE); 159 src -= DMA_START; 160 pci_dma_write(&edu->pdev, edu_clamp_addr(edu, edu->dma.dst), 161 edu->dma_buf + src, edu->dma.cnt); 162 } 163 164 edu->dma.cmd &= ~EDU_DMA_RUN; 165 if (edu->dma.cmd & EDU_DMA_IRQ) { 166 raise_irq = true; 167 } 168 169 if (raise_irq) { 170 edu_raise_irq(edu, DMA_IRQ); 171 } 172 } 173 174 static void dma_rw(EduState *edu, bool write, dma_addr_t *val, dma_addr_t *dma, 175 bool timer) 176 { 177 if (write && (edu->dma.cmd & EDU_DMA_RUN)) { 178 return; 179 } 180 181 if (write) { 182 *dma = *val; 183 } else { 184 *val = *dma; 185 } 186 187 if (timer) { 188 timer_mod(&edu->dma_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + 100); 189 } 190 } 191 192 static uint64_t edu_mmio_read(void *opaque, hwaddr addr, unsigned size) 193 { 194 EduState *edu = opaque; 195 uint64_t val = ~0ULL; 196 197 if (addr < 0x80 && size != 4) { 198 return val; 199 } 200 201 if (addr >= 0x80 && size != 4 && size != 8) { 202 return val; 203 } 204 205 switch (addr) { 206 case 0x00: 207 val = 0x010000edu; 208 break; 209 case 0x04: 210 val = edu->addr4; 211 break; 212 case 0x08: 213 qemu_mutex_lock(&edu->thr_mutex); 214 val = edu->fact; 215 qemu_mutex_unlock(&edu->thr_mutex); 216 break; 217 case 0x20: 218 val = qatomic_read(&edu->status); 219 break; 220 case 0x24: 221 val = edu->irq_status; 222 break; 223 case 0x80: 224 dma_rw(edu, false, &val, &edu->dma.src, false); 225 break; 226 case 0x88: 227 dma_rw(edu, false, &val, &edu->dma.dst, false); 228 break; 229 case 0x90: 230 dma_rw(edu, false, &val, &edu->dma.cnt, false); 231 break; 232 case 0x98: 233 dma_rw(edu, false, &val, &edu->dma.cmd, false); 234 break; 235 } 236 237 return val; 238 } 239 240 static void edu_mmio_write(void *opaque, hwaddr addr, uint64_t val, 241 unsigned size) 242 { 243 EduState *edu = opaque; 244 245 if (addr < 0x80 && size != 4) { 246 return; 247 } 248 249 if (addr >= 0x80 && size != 4 && size != 8) { 250 return; 251 } 252 253 switch (addr) { 254 case 0x04: 255 edu->addr4 = ~val; 256 break; 257 case 0x08: 258 if (qatomic_read(&edu->status) & EDU_STATUS_COMPUTING) { 259 break; 260 } 261 /* EDU_STATUS_COMPUTING cannot go 0->1 concurrently, because it is only 262 * set in this function and it is under the iothread mutex. 263 */ 264 qemu_mutex_lock(&edu->thr_mutex); 265 edu->fact = val; 266 qatomic_or(&edu->status, EDU_STATUS_COMPUTING); 267 qemu_cond_signal(&edu->thr_cond); 268 qemu_mutex_unlock(&edu->thr_mutex); 269 break; 270 case 0x20: 271 if (val & EDU_STATUS_IRQFACT) { 272 qatomic_or(&edu->status, EDU_STATUS_IRQFACT); 273 /* Order check of the COMPUTING flag after setting IRQFACT. */ 274 smp_mb__after_rmw(); 275 } else { 276 qatomic_and(&edu->status, ~EDU_STATUS_IRQFACT); 277 } 278 break; 279 case 0x60: 280 edu_raise_irq(edu, val); 281 break; 282 case 0x64: 283 edu_lower_irq(edu, val); 284 break; 285 case 0x80: 286 dma_rw(edu, true, &val, &edu->dma.src, false); 287 break; 288 case 0x88: 289 dma_rw(edu, true, &val, &edu->dma.dst, false); 290 break; 291 case 0x90: 292 dma_rw(edu, true, &val, &edu->dma.cnt, false); 293 break; 294 case 0x98: 295 if (!(val & EDU_DMA_RUN)) { 296 break; 297 } 298 dma_rw(edu, true, &val, &edu->dma.cmd, true); 299 break; 300 } 301 } 302 303 static const MemoryRegionOps edu_mmio_ops = { 304 .read = edu_mmio_read, 305 .write = edu_mmio_write, 306 .endianness = DEVICE_NATIVE_ENDIAN, 307 .valid = { 308 .min_access_size = 4, 309 .max_access_size = 8, 310 }, 311 .impl = { 312 .min_access_size = 4, 313 .max_access_size = 8, 314 }, 315 316 }; 317 318 /* 319 * We purposely use a thread, so that users are forced to wait for the status 320 * register. 321 */ 322 static void *edu_fact_thread(void *opaque) 323 { 324 EduState *edu = opaque; 325 326 while (1) { 327 uint32_t val, ret = 1; 328 329 qemu_mutex_lock(&edu->thr_mutex); 330 while ((qatomic_read(&edu->status) & EDU_STATUS_COMPUTING) == 0 && 331 !edu->stopping) { 332 qemu_cond_wait(&edu->thr_cond, &edu->thr_mutex); 333 } 334 335 if (edu->stopping) { 336 qemu_mutex_unlock(&edu->thr_mutex); 337 break; 338 } 339 340 val = edu->fact; 341 qemu_mutex_unlock(&edu->thr_mutex); 342 343 while (val > 0) { 344 ret *= val--; 345 } 346 347 /* 348 * We should sleep for a random period here, so that students are 349 * forced to check the status properly. 350 */ 351 352 qemu_mutex_lock(&edu->thr_mutex); 353 edu->fact = ret; 354 qemu_mutex_unlock(&edu->thr_mutex); 355 qatomic_and(&edu->status, ~EDU_STATUS_COMPUTING); 356 357 /* Clear COMPUTING flag before checking IRQFACT. */ 358 smp_mb__after_rmw(); 359 360 if (qatomic_read(&edu->status) & EDU_STATUS_IRQFACT) { 361 bql_lock(); 362 edu_raise_irq(edu, FACT_IRQ); 363 bql_unlock(); 364 } 365 } 366 367 return NULL; 368 } 369 370 static void pci_edu_realize(PCIDevice *pdev, Error **errp) 371 { 372 EduState *edu = EDU(pdev); 373 uint8_t *pci_conf = pdev->config; 374 375 pci_config_set_interrupt_pin(pci_conf, 1); 376 377 if (msi_init(pdev, 0, 1, true, false, errp)) { 378 return; 379 } 380 381 timer_init_ms(&edu->dma_timer, QEMU_CLOCK_VIRTUAL, edu_dma_timer, edu); 382 383 qemu_mutex_init(&edu->thr_mutex); 384 qemu_cond_init(&edu->thr_cond); 385 qemu_thread_create(&edu->thread, "edu", edu_fact_thread, 386 edu, QEMU_THREAD_JOINABLE); 387 388 memory_region_init_io(&edu->mmio, OBJECT(edu), &edu_mmio_ops, edu, 389 "edu-mmio", 1 * MiB); 390 pci_register_bar(pdev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &edu->mmio); 391 } 392 393 static void pci_edu_uninit(PCIDevice *pdev) 394 { 395 EduState *edu = EDU(pdev); 396 397 qemu_mutex_lock(&edu->thr_mutex); 398 edu->stopping = true; 399 qemu_mutex_unlock(&edu->thr_mutex); 400 qemu_cond_signal(&edu->thr_cond); 401 qemu_thread_join(&edu->thread); 402 403 qemu_cond_destroy(&edu->thr_cond); 404 qemu_mutex_destroy(&edu->thr_mutex); 405 406 timer_del(&edu->dma_timer); 407 msi_uninit(pdev); 408 } 409 410 static void edu_instance_init(Object *obj) 411 { 412 EduState *edu = EDU(obj); 413 414 edu->dma_mask = (1UL << 28) - 1; 415 object_property_add_uint64_ptr(obj, "dma_mask", 416 &edu->dma_mask, OBJ_PROP_FLAG_READWRITE); 417 } 418 419 static void edu_class_init(ObjectClass *class, void *data) 420 { 421 DeviceClass *dc = DEVICE_CLASS(class); 422 PCIDeviceClass *k = PCI_DEVICE_CLASS(class); 423 424 k->realize = pci_edu_realize; 425 k->exit = pci_edu_uninit; 426 k->vendor_id = PCI_VENDOR_ID_QEMU; 427 k->device_id = 0x11e8; 428 k->revision = 0x10; 429 k->class_id = PCI_CLASS_OTHERS; 430 set_bit(DEVICE_CATEGORY_MISC, dc->categories); 431 } 432 433 static void pci_edu_register_types(void) 434 { 435 static InterfaceInfo interfaces[] = { 436 { INTERFACE_CONVENTIONAL_PCI_DEVICE }, 437 { }, 438 }; 439 static const TypeInfo edu_info = { 440 .name = TYPE_PCI_EDU_DEVICE, 441 .parent = TYPE_PCI_DEVICE, 442 .instance_size = sizeof(EduState), 443 .instance_init = edu_instance_init, 444 .class_init = edu_class_init, 445 .interfaces = interfaces, 446 }; 447 448 type_register_static(&edu_info); 449 } 450 type_init(pci_edu_register_types) 451