android qemu-kvm i8254 pit虚拟设备-阿里云开发者社区

开发者社区> 开发与运维> 正文
登录阅读全文

android qemu-kvm i8254 pit虚拟设备

简介: ubuntu12.04下使用android emulator,启用kvm加速,模拟i8254定时器的代码比较旧,对应于qemu0.14或者之前的版本,这时还没有QOM(qemu object model)模型,虚拟设备的代码是比较简单的。

ubuntu12.04下使用android emulator,启用kvm加速,模拟i8254定时器的代码比较旧,对应于qemu0.14或者之前的版本,这时还没有QOM(qemu object model)模型,虚拟设备的代码是比较简单的。


玩虚拟设备之前,首先得搞明白真实设备怎么玩,有篇文档:http://blog.csdn.net/u013007900/article/details/50408903,看不太明白就再看看计组和哈工大出版的C语言测控,以前上课用的这个。


8254使用的端口时0x40~0x43,共计4个8bit端口,输入时钟频率1193kHZ,使用IRQ0,对应中断向量表中的INT 8。怎么对应,看http://www.360doc.com/content/09/1017/08/128139_7395798.shtmlhttp://blog.csdn.net/duguteng/article/details/7552774

8259主片的IRQ0~7对应INT 8~INT F,从片的IRQ8~IRQ15对应INT 70~INT 77。


有份以前上C语言测控时写的代码,使用了8254的,输入采样周期(in ms)和采样次数,每次采样时打印一个'8'。

注意定时器的最大周期比较短,大约55ms,所以需要使用软件方式扩大定时器的周期,注意周期不是10ms的倍数时的特殊处理。

定时器0工作于模式3,方波发生器。用学硬件的话来说,就是自动重装定时器;用学软件的话来说,就是周期定时器,不是oneshot的。

/* C语言测控程序设计
 * 2012年3月29日
 * 系统XP sp3,编译器:TC3.0,编辑器:VIM7.3
 * */

#include <stdio.h>
#include <dos.h>
#include <graphics.h>
#include <math.h>
#include <string.h>

/*参数*/
float   gfT;                                    //采样周期
long    glN;                                    //采样次数
int     giFlag;                                 //标记时间到
long    glUserCnt;                              //已采样次数
int     giTimerN;                               //采样周期除以10ms
int     giTimerSmallValue;                      //采样周期模10ms后,对应的定时器初值
int     giTimerCnt;                             //定时器中断次数

void    LoadConfig(void);                       //读取配置文件
void    interrupt (*OldIsr08)(void);            //原先的中断函数指针
void    interrupt MyIsr08(void);                //自定义的中断函数
void    TimerInit(void);                        //定时器初始化函数
void    TimerExit(void);                        //定时器恢复函数
void    UserTimerIsr(void);                     //每个采样周期都会调用的函数

int     main()
{
    /*读取配置*/
    LoadConfig();

    /*初始化*/
    TimerInit();

    while((glUserCnt < glN) || (glN == 0))
    {
        if(kbhit())     //特定按键退出
        {
            if(getch() == ' ')
                break;
        }
        if(giFlag)
        {
            giFlag = 0;
            putchar('8');
        }
    }

    /*恢复定时器和dos界面*/
    TimerExit();
    printf("\nthe times of interrupt is: %ld\n",glUserCnt);
    getch();
    return 0;
}

/*定时器中断函数,每到用户设定的时间,调用一次UserTimerIsr()*/
void    interrupt MyIsr08(void)
{
    giTimerCnt++;
    if(giTimerN == 0)   //采样周期小于10ms的情况
    {
        giTimerCnt = 0;
        UserTimerIsr();
        outportb(0x20, 0x20); //清除中断标志位,可以看8259相关的资料
        return;
    }
    if((giTimerSmallValue == 0) && (giTimerCnt == giTimerN))    //采样周期是10ms的倍数的情况
    {
        giTimerCnt = 0;
        UserTimerIsr();
        outportb(0x20, 0x20);
        return;
    }
    if((giTimerSmallValue != 0) && (giTimerN != 0)) //采样周期大于10ms,且不是10ms倍数的情况
    {
        if(giTimerCnt == 1)
        {
            disable();
            outportb(0x43, 0x36);
            outportb(0x40, 0x9d);
            outportb(0x40, 0x2e);
            enable();
        }
        if(giTimerCnt == (giTimerN + 1))
        {
            giTimerCnt = 0;
            disable();
            outportb(0x43, 0x36);
            outportb(0x40, giTimerSmallValue & 0xff);
            outportb(0x40, (giTimerSmallValue >> 8) & 0xff);
            enable();
            UserTimerIsr();
        }
        outportb(0x20, 0x20);
        return;
    }
    outportb(0x20, 0x20);
}

/*初始化定时器*/
void    TimerInit(void)
{
    giTimerN = (int)(gfT / 10);
    giTimerSmallValue = (int)((gfT - giTimerN * 10) * 1193); // 输入时钟频率1193kHZ
    disable();
    OldIsr08 = getvect(0x08);
    if(giTimerSmallValue)
    {
        outportb(0x43, 0x36);
        outportb(0x40, giTimerSmallValue & 0xff);
        outportb(0x40, (giTimerSmallValue >> 8) & 0xff);
    }
    else
    {
        outportb(0x43, 0x36);
        outportb(0x40, 0x9d);
        outportb(0x40, 0x2e);
    }
    setvect(0x08, MyIsr08);
    enable();
}

/*恢复定时器原先的服务函数和周期*/
void    TimerExit(void)
{
    disable();
    outportb(0x43, 0x36);
    outportb(0x40, 0x00);
    outportb(0x40, 0x00);
    setvect(0x08, OldIsr08);
    enable();
}

/*每个采样周期都会调用的函数*/
void    UserTimerIsr(void)
{
    glUserCnt++;
    giFlag = 1;
}

/*获取配置信息*/
void    LoadConfig(void)
{
    printf("input T and N\n");
    scanf("%f %ld", &gfT, &glN);
    while(getchar() != 10);
    if( gfT <= 0 || glN < 0)
    {
        printf("error, try again\n");
        LoadConfig();
    }
}

真的看完了,现在开始看模拟的。

8254的初始化是在pc_init1中执行的,设置iobase为0x40,IRQ为0,INT 8:

pit = pit_init(0x40, i8259[0]);


8254是有三个timer的,只用到了channel 0的timer。

qemu有自己的定时器,输入时钟是1G,对应1ns。8254的输入时钟是1193kHZ,如何模拟的呢?

根据8254的设置,计算出来下一个中断到临的tick次数,在根据8254和qemu timer频率的不同,对tick进行转换,然后设置qemu timer的定时设置,当qemu timer超时时,callback函数就是8254的中断处理函数pit_irq_timer。在中断函数中,再进行一些其它的处理,如重新装载之类的。

PITState *pit_init(int base, qemu_irq irq)
{
    PITState *pit = &pit_state;
    PITChannelState *s;

    s = &pit->channels[0];
    /* the timer 0 is connected to an IRQ */
    s->irq_timer = timer_new(QEMU_CLOCK_VIRTUAL, SCALE_NS, pit_irq_timer, s);
    s->irq = irq;

    register_savevm(NULL, "i8254", base, 1, pit_save, pit_load, pit);

    qemu_register_reset(pit_reset, 0, pit);
    register_ioport_write(base, 4, 1, pit_ioport_write, pit);
    register_ioport_read(base, 3, 1, pit_ioport_read, pit);

    pit_reset(pit);

    return pit;
}



qemu_register_reset是用链表保存一些复位函数的:

void qemu_register_reset(QEMUResetHandler *func, int order, void *opaque)
{
    QEMUResetEntry **pre, *re;

    pre = &first_reset_entry;
    while (*pre != NULL && (*pre)->order >= order) {
        pre = &(*pre)->next;
    }
    re = g_malloc0(sizeof(QEMUResetEntry));
    re->func = func;
    re->opaque = opaque;
    re->order = order;
    re->next = NULL;
    *pre = re;
}


当然pit_init最后也调用了pit_reset函数对寄存器进行复位,将mode设置为3,设置gate,计数值归零:

static void pit_reset(void *opaque)
{
    PITState *pit = opaque;
    PITChannelState *s;
    int i;

    for(i = 0;i < 3; i++) {
        s = &pit->channels[i];
        s->mode = 3;
        s->gate = (i != 2);
        pit_load_count(s, 0);
    }
}

这两行设置了寄存器的读写函数,注意这里是PMIO方式,不是MMIO方式的寄存器。0x40~0x43的写函数设置为pit_ioport_write;0x40~0x42的读函数设置为pit_ioport_read:

register_ioport_write(base, 4, 1, pit_ioport_write, pit);
register_ioport_read(base, 3, 1, pit_ioport_read, pit);


写函数,看懂寄存器的使用后,这个函数还是比较简单的:

static void pit_ioport_write(void *opaque, uint32_t addr, uint32_t val)
{
    PITState *pit = opaque;
    int channel, access;
    PITChannelState *s;

    addr &= 3;
    if (addr == 3) {
        channel = val >> 6;
        if (channel == 3) {
            /* read back command */
            for(channel = 0; channel < 3; channel++) {
                s = &pit->channels[channel];
                if (val & (2 << channel)) {
                    if (!(val & 0x20)) {
                        pit_latch_count(s);
                    }
                    if (!(val & 0x10) && !s->status_latched) {
                        /* status latch */
                        /* XXX: add BCD and null count */
                        s->status =  (pit_get_out1(s, qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL) 7) |
                            (s->rw_mode << 4) |
                            (s->mode << 1) |
                            s->bcd;
                        s->status_latched = 1;
                    }
                }
            }
        } else {
            s = &pit->channels[channel];
            access = (val >> 4) & 3;
            if (access == 0) {
                pit_latch_count(s);
            } else {
                s->rw_mode = access;
                s->read_state = access;
                s->write_state = access;

                s->mode = (val >> 1) & 7;
                s->bcd = val & 1;
                /* XXX: update irq timer ? */
            }
        }
    } else {
        s = &pit->channels[addr];
        switch(s->write_state) {
        default:
        case RW_STATE_LSB:
            pit_load_count(s, val);
            break;
        case RW_STATE_MSB:
            pit_load_count(s, val << 8);
            break;
        case RW_STATE_WORD0:
            s->write_latch = val;
            s->write_state = RW_STATE_WORD1;
            break;
        case RW_STATE_WORD1:
            pit_load_count(s, s->write_latch | (val << 8));
            s->write_state = RW_STATE_WORD0;
            break;
        }
    }
}


pit_latch_count用于锁存当前的计数值:

static void pit_latch_count(PITChannelState *s)
{
    if (!s->count_latched) {
        s->latched_count = pit_get_count(s);
        s->count_latched = s->rw_mode;
    }
}


pit_load_count用于装载计数值,count_load_time是装载时tick的值(tick++ in every ns);count是8254的周期,8254自己的计数值会按照1193kHZ的频率递减的。注意和count_load_time单位的不同,以及后续单位的转换。最后调用pit_irq_timer_update,对qemu timer进行更新。

static inline void pit_load_count(PITChannelState *s, int val)
{
    if (val == 0)
        val = 0x10000;
    s->count_load_time = qemu_clock_get_ns(QEMU_CLOCK_VIRTUAL);
    s->count = val;
    pit_irq_timer_update(s, s->count_load_time);
}


pit_irq_timer_update函数干两件事:

1、计算irq_level,就是比较tick的值和设定的值,满足条件时就会qemu_set_irq触发中断请求

2、计算expire_time,并且调用timer_mod更新qemu timer,让qemu timer在8254下一个需要产生中断的时候产生timeout,并调用callback,也就是8254的中断函数

static void pit_irq_timer_update(PITChannelState *s, int64_t current_time)
{
    int64_t expire_time;
    int irq_level;

    if (!s->irq_timer)
        return;
    expire_time = pit_get_next_transition_time(s, current_time);
    irq_level = pit_get_out1(s, current_time);
    qemu_set_irq(s->irq, irq_level);
#ifdef DEBUG_PIT
    printf("irq_level=%d next_delay=%f\n",
           irq_level,
           (double)(expire_time - current_time) / get_ticks_per_sec());
#endif
    s->next_transition_time = expire_time;
    if (expire_time != -1)
        timer_mod(s->irq_timer, expire_time);
    else
        timer_del(s->irq_timer);
}


8254的中断函数,也就是qemu timer的callback函数,也调用了pit_irq_timer_update:

static void pit_irq_timer(void *opaque)
{
    PITChannelState *s = opaque;

    pit_irq_timer_update(s, s->next_transition_time);
}


寄存器的读函数:

static uint32_t pit_ioport_read(void *opaque, uint32_t addr)
{
    PITState *pit = opaque;
    int ret, count;
    PITChannelState *s;

    addr &= 3;
    s = &pit->channels[addr];
    if (s->status_latched) {
        s->status_latched = 0;
        ret = s->status;
    } else if (s->count_latched) {
        switch(s->count_latched) {
        default:
        case RW_STATE_LSB:
            ret = s->latched_count & 0xff;
            s->count_latched = 0;
            break;
        case RW_STATE_MSB:
            ret = s->latched_count >> 8;
            s->count_latched = 0;
            break;
        case RW_STATE_WORD0:
            ret = s->latched_count & 0xff;
            s->count_latched = RW_STATE_MSB;
            break;
        }
    } else {
        switch(s->read_state) {
        default:
        case RW_STATE_LSB:
            count = pit_get_count(s);
            ret = count & 0xff;
            break;
        case RW_STATE_MSB:
            count = pit_get_count(s);
            ret = (count >> 8) & 0xff;
            break;
        case RW_STATE_WORD0:
            count = pit_get_count(s);
            ret = count & 0xff;
            s->read_state = RW_STATE_WORD1;
            break;
        case RW_STATE_WORD1:
            count = pit_get_count(s);
            ret = (count >> 8) & 0xff;
            s->read_state = RW_STATE_WORD0;
            break;
        }
    }
    return ret;
}


当kvm执行到PMIO的操作时,会退出,然后调用kvm_handle_io:

        case KVM_EXIT_IO:
            dprintf("handle_io\n");
            ret = kvm_handle_io(cpu, run->io.port,
                                (uint8_t *)run + run->io.data_offset,
                                run->io.direction,
                                run->io.size,
                                run->io.count);
            break;

static int kvm_handle_io(CPUState *cpu, uint16_t port, void *data,
                         int direction, int size, uint32_t count)
{
    int i;
    uint8_t *ptr = data;

    for (i = 0; i < count; i++) {
        if (direction == KVM_EXIT_IO_IN) {
            switch (size) {
            case 1:
                stb_p(ptr, cpu_inb(port));
                break;
            case 2:
                stw_p(ptr, cpu_inw(port));
                break;
            case 4:
                stl_p(ptr, cpu_inl(port));
                break;
            }
        } else {
            switch (size) {
            case 1:
                cpu_outb(port, ldub_p(ptr));
                break;
            case 2:
                cpu_outw(port, lduw_p(ptr));
                break;
            case 4:
                cpu_outl(port, ldl_p(ptr));
                break;
            }
        }

        ptr += size;
    }

    return 1;
}

以8bit读为例子:

uint8_t cpu_inb(pio_addr_t addr)
{
    uint8_t val;
    val = ioport_read(0, addr);
    LOG_IOPORT("inb : %04"FMT_pioaddr" %02"PRIx8"\n", addr, val);
    return val;
}

static uint32_t ioport_read(int index, uint32_t address)
{
    static IOPortReadFunc * const default_func[3] = {
        default_ioport_readb,
        default_ioport_readw,
        default_ioport_readl
    };
    IOPortReadFunc *func = ioport_read_table[index][address];
    if (!func)
        func = default_func[index];
    return func(ioport_opaque[address], address);
}


PMIO的地址和opaque以及读写函数的绑定,使用register_ioport_read,register_ioport_write函数,在i8254.c的pit_init中调用的:
int register_ioport_read(pio_addr_t start, int length, int size,
                         IOPortReadFunc *func, void *opaque)
{
    pio_addr_t i;
    int bsize;

    if (ioport_bsize(size, &bsize)) {
        hw_error("register_ioport_read: invalid size");
        return -1;
    }
    for(i = start; i < start + length; i += size) {
        ioport_read_table[bsize][i] = func;
        if (ioport_opaque[i] != NULL && ioport_opaque[i] != opaque)
            hw_error("register_ioport_read: invalid opaque");
        ioport_opaque[i] = opaque;
    }
    return 0;
}

pit_save,pit_load,register_savevm用于快照和恢复的,可以不看。

现在qemu的8254都是使用了QOM模型了,这个模型太TMD的复杂了。另外hw/i386/kvm/timer/i8254.c中提供了kvm-pit,使用kvm提供的内核态的8254的模拟,中断的处理和IO的读写都在内核态,不需要退出kvm了,速度要更快些。类似的,8259之类的也有kvm内核态的实现,所以说android emulator的性能还是有提升空间的。

版权声明:本文内容由阿里云实名注册用户自发贡献,版权归原作者所有,阿里云开发者社区不拥有其著作权,亦不承担相应法律责任。具体规则请查看《阿里云开发者社区用户服务协议》和《阿里云开发者社区知识产权保护指引》。如果您发现本社区中有涉嫌抄袭的内容,填写侵权投诉表单进行举报,一经查实,本社区将立刻删除涉嫌侵权内容。

分享: