| 1 | /* |
| 2 | * QEMU educational PCI device |
| 3 | * |
| 4 | * Copyright (c) 2012-2015 Jiri Slaby |
| 5 | * |
| 6 | * Permission is hereby granted, free of charge, to any person obtaining a |
| 7 | * copy of this software and associated documentation files (the "Software"), |
| 8 | * to deal in the Software without restriction, including without limitation |
| 9 | * the rights to use, copy, modify, merge, publish, distribute, sublicense, |
| 10 | * and/or sell copies of the Software, and to permit persons to whom the |
| 11 | * Software is furnished to do so, subject to the following conditions: |
| 12 | * |
| 13 | * The above copyright notice and this permission notice shall be included in |
| 14 | * all copies or substantial portions of the Software. |
| 15 | * |
| 16 | * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR |
| 17 | * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, |
| 18 | * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE |
| 19 | * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER |
| 20 | * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING |
| 21 | * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER |
| 22 | * DEALINGS IN THE SOFTWARE. |
| 23 | */ |
| 24 | |
| 25 | #include "qemu/osdep.h" |
| 26 | #include "qemu/log.h" |
| 27 | #include "qemu/units.h" |
| 28 | #include "hw/pci/pci.h" |
| 29 | #include "hw/pci/msi.h" |
| 30 | #include "qemu/timer.h" |
| 31 | #include "qom/object.h" |
| 32 | #include "qemu/main-loop.h" /* iothread mutex */ |
| 33 | #include "qemu/module.h" |
| 34 | #include "qapi/visitor.h" |
| 35 | |
| 36 | #define TYPE_PCI_EDU_DEVICE "edu" |
| 37 | typedef struct EduState EduState; |
| 38 | DECLARE_INSTANCE_CHECKER(EduState, EDU, |
| 39 | TYPE_PCI_EDU_DEVICE) |
| 40 | |
| 41 | #define FACT_IRQ 0x00000001 |
| 42 | #define DMA_IRQ 0x00000100 |
| 43 | |
| 44 | #define DMA_START 0x40000 |
| 45 | #define DMA_SIZE 4096 |
| 46 | |
| 47 | struct EduState { |
| 48 | PCIDevice pdev; |
| 49 | MemoryRegion mmio; |
| 50 | |
| 51 | QemuThread thread; |
| 52 | QemuMutex thr_mutex; |
| 53 | QemuCond thr_cond; |
| 54 | bool stopping; |
| 55 | |
| 56 | uint32_t addr4; |
| 57 | uint32_t fact; |
| 58 | #define EDU_STATUS_COMPUTING 0x01 |
| 59 | #define EDU_STATUS_IRQFACT 0x80 |
| 60 | uint32_t status; |
| 61 | |
| 62 | uint32_t irq_status; |
| 63 | |
| 64 | #define EDU_DMA_RUN 0x1 |
| 65 | #define EDU_DMA_DIR(cmd) (((cmd) & 0x2) >> 1) |
| 66 | # define EDU_DMA_FROM_PCI 0 |
| 67 | # define EDU_DMA_TO_PCI 1 |
| 68 | #define EDU_DMA_IRQ 0x4 |
| 69 | struct dma_state { |
| 70 | dma_addr_t src; |
| 71 | dma_addr_t dst; |
| 72 | dma_addr_t cnt; |
| 73 | dma_addr_t cmd; |
| 74 | } dma; |
| 75 | QEMUTimer dma_timer; |
| 76 | char dma_buf[DMA_SIZE]; |
| 77 | uint64_t dma_mask; |
| 78 | }; |
| 79 | |
| 80 | static bool edu_msi_enabled(EduState *edu) |
| 81 | { |
| 82 | return msi_enabled(&edu->pdev); |
| 83 | } |
| 84 | |
| 85 | static void edu_raise_irq(EduState *edu, uint32_t val) |
| 86 | { |
| 87 | edu->irq_status |= val; |
| 88 | if (edu->irq_status) { |
| 89 | if (edu_msi_enabled(edu)) { |
| 90 | msi_notify(&edu->pdev, 0); |
| 91 | } else { |
| 92 | pci_set_irq(&edu->pdev, 1); |
| 93 | } |
| 94 | } |
| 95 | } |
| 96 | |
| 97 | static void edu_lower_irq(EduState *edu, uint32_t val) |
| 98 | { |
| 99 | edu->irq_status &= ~val; |
| 100 | |
| 101 | if (!edu->irq_status && !edu_msi_enabled(edu)) { |
| 102 | pci_set_irq(&edu->pdev, 0); |
| 103 | } |
| 104 | } |
| 105 | |
| 106 | static bool edu_check_range(uint64_t xfer_start, uint64_t xfer_size, |
| 107 | uint64_t dma_start, uint64_t dma_size) |
| 108 | { |
| 109 | uint64_t xfer_end = xfer_start + xfer_size; |
| 110 | uint64_t dma_end = dma_start + dma_size; |
| 111 | |
| 112 | /* |
| 113 | * 1. ensure we aren't overflowing |
| 114 | * 2. ensure that xfer is within dma address range |
| 115 | */ |
| 116 | if (dma_end >= dma_start && xfer_end >= xfer_start && |
| 117 | xfer_start >= dma_start && xfer_end <= dma_end) { |
| 118 | return true; |
| 119 | } |
| 120 | |
| 121 | qemu_log_mask(LOG_GUEST_ERROR, |
| 122 | "EDU: DMA range 0x%016"PRIx64"-0x%016"PRIx64 |
| 123 | " out of bounds (0x%016"PRIx64"-0x%016"PRIx64")!", |
| 124 | xfer_start, xfer_end - 1, dma_start, dma_end - 1); |
| 125 | |
| 126 | return false; |
| 127 | } |
| 128 | |
| 129 | static dma_addr_t edu_clamp_addr(const EduState *edu, dma_addr_t addr) |
| 130 | { |
| 131 | dma_addr_t res = addr & edu->dma_mask; |
| 132 | |
| 133 | if (addr != res) { |
| 134 | qemu_log_mask(LOG_GUEST_ERROR, |
| 135 | "EDU: clamping DMA 0x%016"PRIx64" to 0x%016"PRIx64"!", |
| 136 | addr, res); |
| 137 | } |
| 138 | |
| 139 | return res; |
| 140 | } |
| 141 | |
| 142 | static void edu_dma_timer(void *opaque) |
| 143 | { |
| 144 | EduState *edu = opaque; |
| 145 | bool raise_irq = false; |
| 146 | |
| 147 | if (!(edu->dma.cmd & EDU_DMA_RUN)) { |
| 148 | return; |
| 149 | } |
| 150 | |
| 151 | if (EDU_DMA_DIR(edu->dma.cmd) == EDU_DMA_FROM_PCI) { |
| 152 | uint64_t dst = edu->dma.dst; |
| 153 | if (edu_check_range(dst, edu->dma.cnt, DMA_START, DMA_SIZE)) { |
| 154 | dst -= DMA_START; |
| 155 | pci_dma_read(&edu->pdev, edu_clamp_addr(edu, edu->dma.src), |
| 156 | edu->dma_buf + dst, edu->dma.cnt); |
| 157 | } |
| 158 | } else { |
| 159 | uint64_t src = edu->dma.src; |
| 160 | if (edu_check_range(src, edu->dma.cnt, DMA_START, DMA_SIZE)) { |
| 161 | src -= DMA_START; |
| 162 | pci_dma_write(&edu->pdev, edu_clamp_addr(edu, edu->dma.dst), |
| 163 | edu->dma_buf + src, edu->dma.cnt); |
| 164 | } |
| 165 | } |
| 166 | |
| 167 | edu->dma.cmd &= ~EDU_DMA_RUN; |
| 168 | if (edu->dma.cmd & EDU_DMA_IRQ) { |
| 169 | raise_irq = true; |
| 170 | } |
| 171 | |
| 172 | if (raise_irq) { |
| 173 | edu_raise_irq(edu, DMA_IRQ); |
| 174 | } |
| 175 | } |
| 176 | |
| 177 | static void dma_rw(EduState *edu, bool write, dma_addr_t *val, dma_addr_t *dma, |
| 178 | bool timer) |
| 179 | { |
| 180 | if (write && (edu->dma.cmd & EDU_DMA_RUN)) { |
| 181 | return; |
| 182 | } |
| 183 | |
| 184 | if (write) { |
| 185 | *dma = *val; |
| 186 | } else { |
| 187 | *val = *dma; |
| 188 | } |
| 189 | |
| 190 | if (timer) { |
| 191 | timer_mod(&edu->dma_timer, qemu_clock_get_ms(QEMU_CLOCK_VIRTUAL) + 100); |
| 192 | } |
| 193 | } |
| 194 | |
| 195 | static uint64_t edu_mmio_read(void *opaque, hwaddr addr, unsigned size) |
| 196 | { |
| 197 | EduState *edu = opaque; |
| 198 | uint64_t val = ~0ULL; |
| 199 | |
| 200 | if (addr < 0x80 && size != 4) { |
| 201 | return val; |
| 202 | } |
| 203 | |
| 204 | if (addr >= 0x80 && size != 4 && size != 8) { |
| 205 | return val; |
| 206 | } |
| 207 | |
| 208 | switch (addr) { |
| 209 | case 0x00: |
| 210 | val = 0x010000edu; |
| 211 | break; |
| 212 | case 0x04: |
| 213 | val = edu->addr4; |
| 214 | break; |
| 215 | case 0x08: |
| 216 | qemu_mutex_lock(&edu->thr_mutex); |
| 217 | val = edu->fact; |
| 218 | qemu_mutex_unlock(&edu->thr_mutex); |
| 219 | break; |
| 220 | case 0x20: |
| 221 | val = qatomic_read(&edu->status); |
| 222 | break; |
| 223 | case 0x24: |
| 224 | val = edu->irq_status; |
| 225 | break; |
| 226 | case 0x80: |
| 227 | dma_rw(edu, false, &val, &edu->dma.src, false); |
| 228 | break; |
| 229 | case 0x88: |
| 230 | dma_rw(edu, false, &val, &edu->dma.dst, false); |
| 231 | break; |
| 232 | case 0x90: |
| 233 | dma_rw(edu, false, &val, &edu->dma.cnt, false); |
| 234 | break; |
| 235 | case 0x98: |
| 236 | dma_rw(edu, false, &val, &edu->dma.cmd, false); |
| 237 | break; |
| 238 | } |
| 239 | |
| 240 | return val; |
| 241 | } |
| 242 | |
| 243 | static void edu_mmio_write(void *opaque, hwaddr addr, uint64_t val, |
| 244 | unsigned size) |
| 245 | { |
| 246 | EduState *edu = opaque; |
| 247 | |
| 248 | if (addr < 0x80 && size != 4) { |
| 249 | return; |
| 250 | } |
| 251 | |
| 252 | if (addr >= 0x80 && size != 4 && size != 8) { |
| 253 | return; |
| 254 | } |
| 255 | |
| 256 | switch (addr) { |
| 257 | case 0x04: |
| 258 | edu->addr4 = ~val; |
| 259 | break; |
| 260 | case 0x08: |
| 261 | if (qatomic_read(&edu->status) & EDU_STATUS_COMPUTING) { |
| 262 | break; |
| 263 | } |
| 264 | /* EDU_STATUS_COMPUTING cannot go 0->1 concurrently, because it is only |
| 265 | * set in this function and it is under the iothread mutex. |
| 266 | */ |
| 267 | qemu_mutex_lock(&edu->thr_mutex); |
| 268 | edu->fact = val; |
| 269 | qatomic_or(&edu->status, EDU_STATUS_COMPUTING); |
| 270 | qemu_cond_signal(&edu->thr_cond); |
| 271 | qemu_mutex_unlock(&edu->thr_mutex); |
| 272 | break; |
| 273 | case 0x20: |
| 274 | if (val & EDU_STATUS_IRQFACT) { |
| 275 | qatomic_or(&edu->status, EDU_STATUS_IRQFACT); |
| 276 | /* Order check of the COMPUTING flag after setting IRQFACT. */ |
| 277 | smp_mb__after_rmw(); |
| 278 | } else { |
| 279 | qatomic_and(&edu->status, ~EDU_STATUS_IRQFACT); |
| 280 | } |
| 281 | break; |
| 282 | case 0x60: |
| 283 | edu_raise_irq(edu, val); |
| 284 | break; |
| 285 | case 0x64: |
| 286 | edu_lower_irq(edu, val); |
| 287 | break; |
| 288 | case 0x80: |
| 289 | dma_rw(edu, true, &val, &edu->dma.src, false); |
| 290 | break; |
| 291 | case 0x88: |
| 292 | dma_rw(edu, true, &val, &edu->dma.dst, false); |
| 293 | break; |
| 294 | case 0x90: |
| 295 | dma_rw(edu, true, &val, &edu->dma.cnt, false); |
| 296 | break; |
| 297 | case 0x98: |
| 298 | if (!(val & EDU_DMA_RUN)) { |
| 299 | break; |
| 300 | } |
| 301 | dma_rw(edu, true, &val, &edu->dma.cmd, true); |
| 302 | break; |
| 303 | } |
| 304 | } |
| 305 | |
| 306 | static const MemoryRegionOps edu_mmio_ops = { |
| 307 | .read = edu_mmio_read, |
| 308 | .write = edu_mmio_write, |
| 309 | .endianness = DEVICE_NATIVE_ENDIAN, |
| 310 | .valid = { |
| 311 | .min_access_size = 4, |
| 312 | .max_access_size = 8, |
| 313 | }, |
| 314 | .impl = { |
| 315 | .min_access_size = 4, |
| 316 | .max_access_size = 8, |
| 317 | }, |
| 318 | |
| 319 | }; |
| 320 | |
| 321 | /* |
| 322 | * We purposely use a thread, so that users are forced to wait for the status |
| 323 | * register. |
| 324 | */ |
| 325 | static void *edu_fact_thread(void *opaque) |
| 326 | { |
| 327 | EduState *edu = opaque; |
| 328 | |
| 329 | while (1) { |
| 330 | uint32_t val, ret = 1; |
| 331 | |
| 332 | qemu_mutex_lock(&edu->thr_mutex); |
| 333 | while ((qatomic_read(&edu->status) & EDU_STATUS_COMPUTING) == 0 && |
| 334 | !edu->stopping) { |
| 335 | qemu_cond_wait(&edu->thr_cond, &edu->thr_mutex); |
| 336 | } |
| 337 | |
| 338 | if (edu->stopping) { |
| 339 | qemu_mutex_unlock(&edu->thr_mutex); |
| 340 | break; |
| 341 | } |
| 342 | |
| 343 | val = edu->fact; |
| 344 | qemu_mutex_unlock(&edu->thr_mutex); |
| 345 | |
| 346 | while (val > 0) { |
| 347 | ret *= val--; |
| 348 | } |
| 349 | |
| 350 | /* |
| 351 | * We should sleep for a random period here, so that students are |
| 352 | * forced to check the status properly. |
| 353 | */ |
| 354 | |
| 355 | qemu_mutex_lock(&edu->thr_mutex); |
| 356 | edu->fact = ret; |
| 357 | qemu_mutex_unlock(&edu->thr_mutex); |
| 358 | qatomic_and(&edu->status, ~EDU_STATUS_COMPUTING); |
| 359 | |
| 360 | /* Clear COMPUTING flag before checking IRQFACT. */ |
| 361 | smp_mb__after_rmw(); |
| 362 | |
| 363 | if (qatomic_read(&edu->status) & EDU_STATUS_IRQFACT) { |
| 364 | bql_lock(); |
| 365 | edu_raise_irq(edu, FACT_IRQ); |
| 366 | bql_unlock(); |
| 367 | } |
| 368 | } |
| 369 | |
| 370 | return NULL; |
| 371 | } |
| 372 | |
| 373 | static void pci_edu_realize(PCIDevice *pdev, Error **errp) |
| 374 | { |
| 375 | EduState *edu = EDU(pdev); |
| 376 | uint8_t *pci_conf = pdev->config; |
| 377 | |
| 378 | pci_config_set_interrupt_pin(pci_conf, 1); |
| 379 | |
| 380 | if (msi_init(pdev, 0, 1, true, false, errp)) { |
| 381 | return; |
| 382 | } |
| 383 | |
| 384 | timer_init_ms(&edu->dma_timer, QEMU_CLOCK_VIRTUAL, edu_dma_timer, edu); |
| 385 | |
| 386 | qemu_mutex_init(&edu->thr_mutex); |
| 387 | qemu_cond_init(&edu->thr_cond); |
| 388 | qemu_thread_create(&edu->thread, "edu", edu_fact_thread, |
| 389 | edu, QEMU_THREAD_JOINABLE); |
| 390 | |
| 391 | memory_region_init_io(&edu->mmio, OBJECT(edu), &edu_mmio_ops, edu, |
| 392 | "edu-mmio", 1 * MiB); |
| 393 | pci_register_bar(pdev, 0, PCI_BASE_ADDRESS_SPACE_MEMORY, &edu->mmio); |
| 394 | } |
| 395 | |
| 396 | static void pci_edu_uninit(PCIDevice *pdev) |
| 397 | { |
| 398 | EduState *edu = EDU(pdev); |
| 399 | |
| 400 | qemu_mutex_lock(&edu->thr_mutex); |
| 401 | edu->stopping = true; |
| 402 | qemu_mutex_unlock(&edu->thr_mutex); |
| 403 | qemu_cond_signal(&edu->thr_cond); |
| 404 | qemu_thread_join(&edu->thread); |
| 405 | |
| 406 | qemu_cond_destroy(&edu->thr_cond); |
| 407 | qemu_mutex_destroy(&edu->thr_mutex); |
| 408 | |
| 409 | timer_del(&edu->dma_timer); |
| 410 | msi_uninit(pdev); |
| 411 | } |
| 412 | |
| 413 | static void edu_instance_init(Object *obj) |
| 414 | { |
| 415 | EduState *edu = EDU(obj); |
| 416 | |
| 417 | edu->dma_mask = (1UL << 28) - 1; |
| 418 | object_property_add_uint64_ptr(obj, "dma_mask", |
| 419 | &edu->dma_mask, OBJ_PROP_FLAG_READWRITE); |
| 420 | } |
| 421 | |
| 422 | static void edu_class_init(ObjectClass *class, const void *data) |
| 423 | { |
| 424 | DeviceClass *dc = DEVICE_CLASS(class); |
| 425 | PCIDeviceClass *k = PCI_DEVICE_CLASS(class); |
| 426 | |
| 427 | k->realize = pci_edu_realize; |
| 428 | k->exit = pci_edu_uninit; |
| 429 | k->vendor_id = PCI_VENDOR_ID_QEMU; |
| 430 | k->device_id = 0x11e8; |
| 431 | k->revision = 0x10; |
| 432 | k->class_id = PCI_CLASS_OTHERS; |
| 433 | set_bit(DEVICE_CATEGORY_MISC, dc->categories); |
| 434 | } |
| 435 | |
| 436 | static const TypeInfo edu_types[] = { |
| 437 | { |
| 438 | .name = TYPE_PCI_EDU_DEVICE, |
| 439 | .parent = TYPE_PCI_DEVICE, |
| 440 | .instance_size = sizeof(EduState), |
| 441 | .instance_init = edu_instance_init, |
| 442 | .class_init = edu_class_init, |
| 443 | .interfaces = (const InterfaceInfo[]) { |
| 444 | { INTERFACE_CONVENTIONAL_PCI_DEVICE }, |
| 445 | { }, |
| 446 | }, |
| 447 | } |
| 448 | }; |
| 449 | |
| 450 | DEFINE_TYPES(edu_types) |