From mboxrd@z Thu Jan 1 00:00:00 1970 Return-Path: X-Spam-Checker-Version: SpamAssassin 3.4.0 (2014-02-07) on aws-us-west-2-korg-lkml-1.web.codeaurora.org Received: from lists.gnu.org (lists.gnu.org [209.51.188.17]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by smtp.lore.kernel.org (Postfix) with ESMTPS id 0C562C5320E for ; Mon, 26 Aug 2024 01:20:30 +0000 (UTC) Received: from localhost ([::1] helo=lists1p.gnu.org) by lists.gnu.org with esmtp (Exim 4.90_1) (envelope-from ) id 1siOOM-00039E-TA; Sun, 25 Aug 2024 21:19:34 -0400 Received: from eggs.gnu.org ([2001:470:142:3::10]) by lists.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_256_GCM_SHA384:256) (Exim 4.90_1) (envelope-from ) id 1siOOL-00038f-L3 for qemu-devel@nongnu.org; Sun, 25 Aug 2024 21:19:33 -0400 Received: from mail-ed1-x52b.google.com ([2a00:1450:4864:20::52b]) by eggs.gnu.org with esmtps (TLS1.2:ECDHE_RSA_AES_128_GCM_SHA256:128) (Exim 4.90_1) (envelope-from ) id 1siOOI-0008Gw-47 for qemu-devel@nongnu.org; Sun, 25 Aug 2024 21:19:33 -0400 Received: by mail-ed1-x52b.google.com with SMTP id 4fb4d7f45d1cf-5bec87ececeso4091939a12.0 for ; Sun, 25 Aug 2024 18:19:28 -0700 (PDT) DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=gmail.com; s=20230601; t=1724635167; x=1725239967; darn=nongnu.org; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:from:to:cc:subject:date:message-id:reply-to; bh=wF+WaWG2nghgwRymtmlWgu1+/PXICL9nmT0jfdY6j0g=; b=gxSQf2fzI4snkGQ7AhvBIG7FPe4vqerQCg3ngAe2QEAmgi2EF/M+quH9H9Zq58zvL7 BqHWzI90qtrCrNiONb9ALQwZqYCVeUiuLbngkSRJd/2EwfQww90KegE5oQ4Z10I0Ukg7 dscSyrTz3tzs3dCrE8uZ2Wo5mazw5n7PY7KfMjffDTzKiRDF3NPIas8hR0tkjMUUgi7+ CwJl8ghJPunYVkHVUnp3dftCl0cNeMXfkN9t3a8FnxLQOBRq36O5BmCkDGajwVArhsTL jkZW1WBlcUIxXto/A0CH8db4AjvdFbRF1H4qKr3byeOMwpc2sq66BAEo2toQSB2ZGH9S mqVQ== X-Google-DKIM-Signature: v=1; a=rsa-sha256; c=relaxed/relaxed; d=1e100.net; s=20230601; t=1724635167; x=1725239967; h=cc:to:subject:message-id:date:from:in-reply-to:references :mime-version:x-gm-message-state:from:to:cc:subject:date:message-id :reply-to; bh=wF+WaWG2nghgwRymtmlWgu1+/PXICL9nmT0jfdY6j0g=; b=KaGnQz0rvn80vtcq5B8oDSi2OP7I+fGz6X6/3Iv1YTPXwI6nQnvxlBNkNT50UJldIe VCLeOv7qu7itZuEfAp9oIEq0vEpkiiXOAaGR7tUYb74Ggy9zHsLYN1p6FL38HRJbXmvo 8Ib35lFfCbejcJYOjqHGcH/YGhf+/UrbAnBbDDxICYORXFLuO6EbZI2m05V4W398f4a4 V0JSwrqSmyw2JaVns8rOdzCgGmF/qSleWKRSVmACLr8t6DX91zxz6HPwnXEt8lX1mXwe EVo1I8PrtQ+S/Z609l5vSqDWrow//fdEjE7JF1vJwnwjD4Eu+RA1eYTWiNyUS2kyZbbd YeMA== X-Gm-Message-State: AOJu0Ywd5HmIWT7pT0LHNtI2ZBVFKVOMZ56xhjWPwXqW+EFsVO+9q3aW ARakiuBQErAuvN57su2zKOQ0yEOdZOXC84io+0loDBAPcjAQ9WDR9QQMkptks6nj02IexI6m4NU jgg2lkAzTPgU4J7bf//LHWwdYlu9IGw== X-Google-Smtp-Source: AGHT+IET2xlwwIonYqL1fU53+9ub14+4BP5vp0zZvrLoEOeEXaQKUyT+bAv/R03EC1y7GjAYc55UJsw5SWkGdf3SBLY= X-Received: by 2002:a05:6402:40c7:b0:5be:dbbb:2d49 with SMTP id 4fb4d7f45d1cf-5c08915f381mr5981814a12.1.1724635166154; Sun, 25 Aug 2024 18:19:26 -0700 (PDT) MIME-Version: 1.0 References: In-Reply-To: From: Zero Tang Date: Mon, 26 Aug 2024 09:19:13 +0800 Message-ID: Subject: Re: [PATCH] hw/misc: Add a virtual PCILeech device To: qemu-devel@nongnu.org Cc: mst@redhat.com, marcel.apfelbaum@gmail.com Content-Type: multipart/alternative; boundary="0000000000007226ee06208beaf1" Received-SPF: pass client-ip=2a00:1450:4864:20::52b; envelope-from=zero.tangptr@gmail.com; helo=mail-ed1-x52b.google.com X-Spam_score_int: -20 X-Spam_score: -2.1 X-Spam_bar: -- X-Spam_report: (-2.1 / 5.0 requ) BAYES_00=-1.9, DKIM_SIGNED=0.1, DKIM_VALID=-0.1, DKIM_VALID_AU=-0.1, DKIM_VALID_EF=-0.1, FREEMAIL_FROM=0.001, HK_RANDOM_ENVFROM=0.001, HK_RANDOM_FROM=0.001, HTML_MESSAGE=0.001, RCVD_IN_DNSWL_NONE=-0.0001, SPF_HELO_NONE=0.001, SPF_PASS=-0.001, T_SCC_BODY_TEXT_LINE=-0.01 autolearn=ham autolearn_force=no X-Spam_action: no action X-BeenThere: qemu-devel@nongnu.org X-Mailman-Version: 2.1.29 Precedence: list List-Id: List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , Errors-To: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org Sender: qemu-devel-bounces+qemu-devel=archiver.kernel.org@nongnu.org --0000000000007226ee06208beaf1 Content-Type: text/plain; charset="UTF-8" Content-Transfer-Encoding: quoted-printable I'd like to *PING* this patch once again. Please review this patch. If there is anything missing or ambiguous in the patch, please let me know. Thanks, Zero Tang On Sun, Aug 18, 2024 at 1:30=E2=80=AFAM Zero Tang = wrote: > Hello, > > I'd like to ping this patch in that the QEMU-PCILeech plugin is now merge= d > into the PCILeech repository: > https://github.com/ufrisk/LeechCore-plugins/pull/10 > The Patchew link is: > https://patchew.org/QEMU/CAAXNugBYhpx249dUWgyXOtGjkxWatRHJSq94LrVFMGP._5F= GjX7aA@mail.gmail.com/ > > Kind Regards, > Zero Tang > > On Tue, Aug 6, 2024 at 5:28=E2=80=AFPM Zero Tang = wrote: > >> This virtual PCILeech device aims to help security researchers attack th= e >> guest via DMA and test their IOMMU defenses. >> This device is intended to support any systems with PCI, but I am only >> able to test x86-based guests. >> For what PCILeech is, check PCILeech GitHub repository: >> https://github.com/ufrisk/pcileech >> The QEMU-PCILeech plugin is currently awaiting merging: >> https://github.com/ufrisk/LeechCore-plugins/pull/10 >> >> This is my first time contributing to QEMU and I am sorry that I forgot >> to include a "[PATCH]" prefix in the title from my previous email and th= at >> I didn't cc to relevant maintainers. >> If needed, add my name and contact info into the maintainer's list. >> >> Signed-off-by: Zero Tang >> --- >> hw/misc/Kconfig | 5 ++++ >> hw/misc/meson.build | 1 + >> hw/misc/pcileech.c | 291 >> ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++= +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++= +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++= +++++ >> 3 files changed, 297 insertions(+) >> >> diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig >> index 1e08785b83..6c3ea7bf74 100644 >> --- a/hw/misc/Kconfig >> +++ b/hw/misc/Kconfig >> @@ -30,6 +30,11 @@ config EDU >> default y if TEST_DEVICES >> depends on PCI && MSI_NONBROKEN >> >> +config PCILEECH >> + bool >> + default y >> + depends on PCI >> + >> config PCA9552 >> bool >> depends on I2C >> diff --git a/hw/misc/meson.build b/hw/misc/meson.build >> index 2ca8717be2..e79931b9a6 100644 >> --- a/hw/misc/meson.build >> +++ b/hw/misc/meson.build >> @@ -1,5 +1,6 @@ >> system_ss.add(when: 'CONFIG_APPLESMC', if_true: files('applesmc.c')) >> system_ss.add(when: 'CONFIG_EDU', if_true: files('edu.c')) >> +system_ss.add(when: 'CONFIG_PCILEECH', if_true: files('pcileech.c')) >> system_ss.add(when: 'CONFIG_FW_CFG_DMA', if_true: files('vmcoreinfo.c')= ) >> system_ss.add(when: 'CONFIG_ISA_DEBUG', if_true: files('debugexit.c')) >> system_ss.add(when: 'CONFIG_ISA_TESTDEV', if_true: files('pc-testdev.c'= )) >> diff --git a/hw/misc/pcileech.c b/hw/misc/pcileech.c >> new file mode 100644 >> index 0000000000..252a570161 >> --- /dev/null >> +++ b/hw/misc/pcileech.c >> @@ -0,0 +1,291 @@ >> +/* >> + * QEMU Virtual PCILeech Device >> + * >> + * Copyright (c) 2024 Zero Tang >> + * >> + * Permission is hereby granted, free of charge, to any person obtainin= g >> a >> + * copy of this software and associated documentation files (the >> "Software"), >> + * to deal in the Software without restriction, including without >> limitation >> + * the rights to use, copy, modify, merge, publish, distribute, >> sublicense, >> + * and/or sell copies of the Software, and to permit persons to whom th= e >> + * Software is furnished to do so, subject to the following conditions: >> + * >> + * The above copyright notice and this permission notice shall be >> included in >> + * all copies or substantial portions of the Software. >> + * >> + * THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, >> EXPRESS OR >> + * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF >> MERCHANTABILITY, >> + * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT >> SHALL THE >> + * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTH= ER >> + * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, >> ARISING >> + * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER >> + * DEALINGS IN THE SOFTWARE. >> + */ >> + >> +#include "qemu/osdep.h" >> +#include "qemu/units.h" >> +#include "hw/pci/pci.h" >> +#include "hw/hw.h" >> +#include "hw/pci/msi.h" >> +#include "qemu/timer.h" >> +#include "hw/qdev-properties.h" >> +#include "hw/qdev-properties-system.h" >> +#include "qom/object.h" >> +#include "qemu/main-loop.h" /* iothread mutex */ >> +#include "qemu/module.h" >> +#include "qapi/visitor.h" >> + >> +#define TYPE_PCILEECH_DEVICE "pcileech" >> + >> +struct LeechRequestHeader { >> + uint8_t endianness; /* 0 - Little, 1 - Big */ >> + uint8_t command; /* 0 - Read, 1 - Write */ >> + uint8_t reserved[6]; >> + /* Variable Endianness */ >> + uint64_t address; >> + uint64_t length; >> +}; >> + >> +struct LeechResponseHeader { >> + uint8_t endianness; /* 0 - Little, 1 - Big */ >> + uint8_t reserved[3]; >> + MemTxResult result; >> + uint64_t length; /* Indicates length of data followed by header = */ >> +}; >> + >> +/* Verify the header length */ >> +static_assert(sizeof(struct LeechRequestHeader) =3D=3D 24); >> +static_assert(sizeof(struct LeechResponseHeader) =3D=3D 16); >> + >> +struct PciLeechState { >> + /* Internal State */ >> + PCIDevice device; >> + QemuThread thread; >> + QemuMutex mutex; >> + bool endianness; >> + bool stopping; >> + /* Communication */ >> + char *host; >> + uint16_t port; >> + int sockfd; >> +}; >> + >> +typedef struct LeechRequestHeader LeechRequestHeader; >> +typedef struct PciLeechState PciLeechState; >> + >> +DECLARE_INSTANCE_CHECKER(PciLeechState, PCILEECH, TYPE_PCILEECH_DEVICE) >> + >> +static void pci_leech_process_write_request(PciLeechState *state, >> + LeechRequestHeader *request= , >> + int incoming) >> +{ >> + char buff[1024]; >> + for (uint64_t i =3D 0; i < request->length; i +=3D sizeof(buff)) { >> + struct LeechResponseHeader response =3D { 0 }; >> + char* response_buffer =3D (char *)&response; >> + const uint64_t writelen =3D (request->length - i) <=3D sizeof(b= uff) ? >> + (request->length - i) : >> sizeof(buff); >> + ssize_t recvlen =3D 0, sendlen =3D 0; >> + while (recvlen < writelen) { >> + recvlen +=3D recv(incoming, &buff[recvlen], writelen - >> recvlen, 0); >> + } >> + response.endianness =3D state->endianness; >> + response.result =3D pci_dma_write(&state->device, request->addr= ess >> + i, >> + buff, >> writelen); >> + if (response.result) { >> + printf("PCILeech: Address 0x%lX Write Error! MemTxResult: >> 0x%X\n", >> + request->address + i, response.result); >> + } >> + response.length =3D 0; >> + while (sendlen < sizeof(struct LeechResponseHeader)) { >> + sendlen +=3D send(incoming, &response_buffer[sendlen], >> + sizeof(struct LeechResponseHeader) - >> sendlen, 0); >> + } >> + } >> +} >> + >> +static void pci_leech_process_read_request(PciLeechState *state, >> + LeechRequestHeader *request= , >> + int incoming) >> +{ >> + char buff[1024]; >> + for (uint64_t i =3D 0; i < request->length; i +=3D sizeof(buff)) { >> + struct LeechResponseHeader response =3D { 0 }; >> + char* response_buffer =3D (char *)&response; >> + const uint64_t readlen =3D (request->length - i) <=3D sizeof(bu= ff) ? >> + (request->length - i) : sizeof(buff= ); >> + ssize_t sendlen =3D 0; >> + response.endianness =3D state->endianness; >> + response.result =3D pci_dma_read(&state->device, request->addre= ss >> + i, >> + buff, >> readlen); >> + if (response.result) { >> + printf("PCILeech: Address 0x%lX Read Error! MemTxResult: >> 0x%X\n", >> + request->address + i, response.result); >> + } >> + response.length =3D (request->endianness !=3D state->endianness= ) ? >> + bswap64(readlen) : readlen; >> + while (sendlen < sizeof(struct LeechResponseHeader)) { >> + sendlen +=3D send(incoming, &response_buffer[sendlen], >> + sizeof(struct LeechResponseHeader) - >> sendlen, 0); >> + } >> + sendlen =3D 0; >> + while (sendlen < readlen) { >> + sendlen +=3D send(incoming, &buff[sendlen], readlen - sendl= en, >> 0); >> + } >> + } >> +} >> + >> +static void *pci_leech_worker_thread(void *opaque) >> +{ >> + PciLeechState *state =3D PCILEECH(opaque); >> + while (1) { >> + LeechRequestHeader request; >> + char *request_buffer =3D (char *)&request; >> + ssize_t received =3D 0; >> + int incoming; >> + struct sockaddr address; >> + socklen_t addrlen; >> + /* Check if we are stopping. */ >> + qemu_mutex_lock(&state->mutex); >> + if (state->stopping) { >> + qemu_mutex_unlock(&state->mutex); >> + break; >> + } >> + qemu_mutex_unlock(&state->mutex); >> + /* Accept PCILeech requests. */ >> + /* Use HTTP1.0-like protocol for simplicity. */ >> + incoming =3D accept(state->sockfd, &address, &addrlen); >> + if (incoming < 0) { >> + puts("WARNING: Failed to accept socket for PCILeech! >> Skipping " >> + "Request...\n"); >> + continue; >> + } >> + /* Get PCILeech requests. */ >> + while (received < sizeof(LeechRequestHeader)) { >> + received +=3D recv(incoming, &request_buffer[received], >> + sizeof(LeechRequestHeader) - received, 0); >> + } >> + /* Swap endianness. */ >> + if (request.endianness !=3D state->endianness) { >> + request.address =3D bswap64(request.address); >> + request.length =3D bswap64(request.length); >> + } >> + /* Process PCILeech requests. */ >> + qemu_mutex_lock(&state->mutex); >> + if (request.command) { >> + pci_leech_process_write_request(state, &request, incoming); >> + } else { >> + pci_leech_process_read_request(state, &request, incoming); >> + } >> + qemu_mutex_unlock(&state->mutex); >> + close(incoming); >> + } >> + return NULL; >> +} >> + >> +static void pci_leech_realize(PCIDevice *pdev, Error **errp) >> +{ >> + PciLeechState *state =3D PCILEECH(pdev); >> + struct sockaddr_in sock_addr; >> + char host_ip[16]; >> + struct hostent *he =3D gethostbyname(state->host); >> + if (he =3D=3D NULL) { >> + puts("gethostbyname failed!"); >> + exit(EXIT_FAILURE); >> + } >> + /* Initialize the socket for PCILeech. */ >> + state->sockfd =3D socket(AF_INET, SOCK_STREAM, 0); >> + if (state->sockfd < 0) { >> + puts("Failed to initialize socket for PCILeech!"); >> + exit(EXIT_FAILURE); >> + } >> + sock_addr.sin_family =3D AF_INET; >> + sock_addr.sin_addr =3D *(struct in_addr *)he->h_addr; >> + sock_addr.sin_port =3D htons(state->port); >> + inet_ntop(AF_INET, &sock_addr.sin_addr, host_ip, sizeof(host_ip)); >> + if (bind(state->sockfd, (struct sockaddr *)&sock_addr, >> sizeof(sock_addr)) >> + < 0= ) >> { >> + puts("Failed to bind socket for PCILeech!"); >> + close(state->sockfd); >> + exit(EXIT_FAILURE); >> + } >> + if (listen(state->sockfd, 10) < 0) { >> + puts("Failed to listen to socket for PCILeech!"); >> + close(state->sockfd); >> + exit(EXIT_FAILURE); >> + } >> + printf("INFO: PCILeech is listening on %s:%u...\n", host_ip, >> state->port); >> + /* Initialize the thread for PCILeech. */ >> + qemu_mutex_init(&state->mutex); >> + qemu_thread_create(&state->thread, "pcileech", >> pci_leech_worker_thread, >> + state, QEMU_THREAD_JOINABLE= ); >> +} >> + >> +static void pci_leech_finalize(PCIDevice *pdev) >> +{ >> + PciLeechState *state =3D PCILEECH(pdev); >> + puts("Stopping PCILeech Worker..."); >> + qemu_mutex_lock(&state->mutex); >> + state->stopping =3D true; >> + qemu_mutex_unlock(&state->mutex); >> + close(state->sockfd); >> + qemu_thread_join(&state->thread); >> + qemu_mutex_destroy(&state->mutex); >> +} >> + >> +char pci_leech_default_host[] =3D "0.0.0.0"; >> + >> +static void pci_leech_instance_init(Object *obj) >> +{ >> + int x =3D 1; >> + char* y =3D (char *)&x; >> + PciLeechState *state =3D PCILEECH(obj); >> + /* QEMU's String-Property can't specify default value. */ >> + /* So we have to set the default on our own. */ >> + if (state->host =3D=3D NULL) { >> + state->host =3D pci_leech_default_host; >> + } >> + /* Save Our Endianness. */ >> + state->endianness =3D (*y =3D=3D 0); >> +} >> + >> +static Property leech_properties[] =3D { >> + DEFINE_PROP_UINT16("port", PciLeechState, port, 6789), >> + DEFINE_PROP_STRING("host", PciLeechState, host), >> + DEFINE_PROP_END_OF_LIST(), >> +}; >> + >> +static void pci_leech_class_init(ObjectClass *class, void *data) >> +{ >> + DeviceClass *dc =3D DEVICE_CLASS(class); >> + PCIDeviceClass *k =3D PCI_DEVICE_CLASS(class); >> + k->realize =3D pci_leech_realize; >> + k->exit =3D pci_leech_finalize; >> + /* Change the Vendor/Device ID to your favor. */ >> + /* These are the default values from PCILeech-FPGA. */ >> + k->vendor_id =3D PCI_VENDOR_ID_XILINX; >> + k->device_id =3D 0x0666; >> + k->revision =3D 0; >> + k->class_id =3D PCI_CLASS_NETWORK_ETHERNET; >> + device_class_set_props(dc, leech_properties); >> + set_bit(DEVICE_CATEGORY_MISC, dc->categories); >> +} >> + >> +static void pci_leech_register_types(void) >> +{ >> + static InterfaceInfo interfaces[] =3D { >> + {INTERFACE_CONVENTIONAL_PCI_DEVICE}, >> + {}, >> + }; >> + static const TypeInfo leech_info =3D { >> + .name =3D TYPE_PCILEECH_DEVICE, >> + .parent =3D TYPE_PCI_DEVICE, >> + .instance_size =3D sizeof(PciLeechState), >> + .instance_init =3D pci_leech_instance_init, >> + .class_init =3D pci_leech_class_init, >> + .interfaces =3D interfaces, >> + }; >> + type_register_static(&leech_info); >> +} >> + >> +type_init(pci_leech_register_types) >> > --0000000000007226ee06208beaf1 Content-Type: text/html; charset="UTF-8" Content-Transfer-Encoding: quoted-printable
I'd like to PING this patch once again. Please = review this patch. If there is anything missing or ambiguous in the patch, = please let me know.

Thanks,
Zero Tang

On = Sun, Aug 18, 2024 at 1:30=E2=80=AFAM Zero Tang <zero.tangptr@gmail.com> wrote:
Hello,
<= div>
I'd like to ping this patch in that the QEMU-PCILeech plu= gin is now merged into the PCILeech repository:=C2=A0https://github.= com/ufrisk/LeechCore-plugins/pull/10
On Tue, Aug 6,= 2024 at 5:28=E2=80=AFPM Zero Tang <zero.tangptr@gmail.com> wrote:
This virtual PCILeech device aims to help securit= y researchers attack the guest via DMA and test their IOMMU defenses.
This device is intended to sup= port any systems with PCI, but I am only able to test x86-based guests.
For what PCILeech is, check = PCILeech GitHub repository:=C2=A0https://github.com/ufrisk/pcileech
<= div>The QEMU-PCILeech plugin is currently awaiting merging:=C2=A0htt= ps://github.com/ufrisk/LeechCore-plugins/pull/10

This is my first time contributing to QEMU and I am sorry that I forgot = to include a "[PATCH]" prefix in the title from my previous email= and that I didn't cc to relevant maintainers.
If needed, add= my name and contact info into the maintainer's list.

Signed-off-by: Zero Tang <zero.tangptr@gmail.com>
---
=C2=A0hw/misc/Kconfig= =C2=A0 =C2=A0 | =C2=A0 5 ++++
=C2=A0hw/misc/meson.build | =C2=A0 1 +=C2=A0hw/misc/pcileech.c =C2=A0| 291 +++++++++++++++++++++++++++++++++++++= +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++= +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++++= ++++++++++++++++++++++++++++++++++++++++
=C2=A03 files changed, 297 inse= rtions(+)

diff --git a/hw/misc/Kconfig b/hw/misc/Kconfig
index 1e= 08785b83..6c3ea7bf74 100644
--- a/hw/misc/Kconfig
+++ b/hw/misc/Kconf= ig
@@ -30,6 +30,11 @@ config EDU
=C2=A0 =C2=A0 =C2=A0default y if TES= T_DEVICES
=C2=A0 =C2=A0 =C2=A0depends on PCI && MSI_NONBROKEN=C2=A0
+config PCILEECH
+ =C2=A0 =C2=A0bool
+ =C2=A0 =C2=A0defaul= t y
+ =C2=A0 =C2=A0depends on PCI
+
=C2=A0config PCA9552
=C2=A0= =C2=A0 =C2=A0bool
=C2=A0 =C2=A0 =C2=A0depends on I2C
diff --git a/hw= /misc/meson.build b/hw/misc/meson.build
index 2ca8717be2..e79931b9a6 100= 644
--- a/hw/misc/meson.build
+++ b/hw/misc/meson.build
@@ -1,5 +1= ,6 @@
=C2=A0system_ss.add(when: 'CONFIG_APPLESMC', if_true: file= s('applesmc.c'))
=C2=A0system_ss.add(when: 'CONFIG_EDU',= if_true: files('edu.c'))
+system_ss.add(when: 'CONFIG_PCILE= ECH', if_true: files('pcileech.c'))
=C2=A0system_ss.add(when= : 'CONFIG_FW_CFG_DMA', if_true: files('vmcoreinfo.c'))
= =C2=A0system_ss.add(when: 'CONFIG_ISA_DEBUG', if_true: files('d= ebugexit.c'))
=C2=A0system_ss.add(when: 'CONFIG_ISA_TESTDEV'= , if_true: files('pc-testdev.c'))
diff --git a/hw/misc/pcileech.= c b/hw/misc/pcileech.c
new file mode 100644
index 0000000000..252a570= 161
--- /dev/null
+++ b/hw/misc/pcileech.c
@@ -0,0 +1,291 @@
+/= *
+ * QEMU Virtual PCILeech Device
+ *
+ * Copyright (c) 2024 Zero= Tang
+ *
+ * Permission is hereby granted, free of charge, to any pe= rson obtaining a
+ * copy of this software and associated documentation = files (the "Software"),
+ * to deal in the Software without re= striction, including without limitation
+ * the rights to use, copy, mod= ify, merge, publish, distribute, sublicense,
+ * and/or sell copies of t= he Software, and to permit persons to whom the
+ * Software is furnished= to do so, subject to the following conditions:
+ *
+ * The above cop= yright notice and this permission notice shall be included in
+ * all co= pies or substantial portions of the Software.
+ *
+ * THE SOFTWARE IS= PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+ = * IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,<= br>+ * FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SH= ALL THE
+ * AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGE= S OR OTHER
+ * LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHE= RWISE, ARISING
+ * FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR TH= E USE OR OTHER
+ * DEALINGS IN THE SOFTWARE.
+ */
+
+#include &= quot;qemu/osdep.h"
+#include "qemu/units.h"
+#include = "hw/pci/pci.h"
+#include "hw/hw.h"
+#include &quo= t;hw/pci/msi.h"
+#include "qemu/timer.h"
+#include &qu= ot;hw/qdev-properties.h"
+#include "hw/qdev-properties-system.= h"
+#include "qom/object.h"
+#include "qemu/main-= loop.h" /* iothread mutex */
+#include "qemu/module.h"+#include "qapi/visitor.h"
+
+#define TYPE_PCILEECH_DEVICE= "pcileech"
+
+struct LeechRequestHeader {
+ =C2=A0 =C2= =A0uint8_t endianness; /* 0 - Little, 1 - Big */
+ =C2=A0 =C2=A0uint8_t = command; =C2=A0 =C2=A0/* 0 - Read, 1 - Write */
+ =C2=A0 =C2=A0uint8_t r= eserved[6];
+ =C2=A0 =C2=A0/* Variable Endianness */
+ =C2=A0 =C2=A0u= int64_t address;
+ =C2=A0 =C2=A0uint64_t length;
+};
+
+struct = LeechResponseHeader {
+ =C2=A0 =C2=A0uint8_t endianness; /* 0 - Little, = 1 - Big */
+ =C2=A0 =C2=A0uint8_t reserved[3];
+ =C2=A0 =C2=A0MemTxRe= sult result;
+ =C2=A0 =C2=A0uint64_t length; =C2=A0 =C2=A0/* Indicates l= ength of data followed by header */
+};
+
+/* Verify the header le= ngth */
+static_assert(sizeof(struct LeechRequestHeader) =3D=3D 24);
= +static_assert(sizeof(struct LeechResponseHeader) =3D=3D 16);
+
+stru= ct PciLeechState {
+ =C2=A0 =C2=A0/* Internal State */
+ =C2=A0 =C2= =A0PCIDevice device;
+ =C2=A0 =C2=A0QemuThread thread;
+ =C2=A0 =C2= =A0QemuMutex mutex;
+ =C2=A0 =C2=A0bool endianness;
+ =C2=A0 =C2=A0bo= ol stopping;
+ =C2=A0 =C2=A0/* Communication */
+ =C2=A0 =C2=A0char *= host;
+ =C2=A0 =C2=A0uint16_t port;
+ =C2=A0 =C2=A0int sockfd;
+};=
+
+typedef struct LeechRequestHeader LeechRequestHeader;
+typedef= struct PciLeechState PciLeechState;
+
+DECLARE_INSTANCE_CHECKER(PciL= eechState, PCILEECH, TYPE_PCILEECH_DEVICE)
+
+static void pci_leech_p= rocess_write_request(PciLeechState *state,
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0LeechRequestHeader *req= uest,
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0int incoming)
+{
+ =C2=A0 =C2=A0char buff[1024];
= + =C2=A0 =C2=A0for (uint64_t i =3D 0; i < request->length; i +=3D siz= eof(buff)) {
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0struct LeechResponseHeader res= ponse =3D { 0 };
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0char* response_buffer =3D = (char *)&response;
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0const uint64_t write= len =3D (request->length - i) <=3D sizeof(buff) ?
+ =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 (request->length - = i) : sizeof(buff);
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0ssize_t recvlen =3D 0, s= endlen =3D 0;
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0while (recvlen < writelen)= {
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0recvlen +=3D recv(incoming= , &buff[recvlen], writelen - recvlen, 0);
+ =C2=A0 =C2=A0 =C2=A0 =C2= =A0}
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0response.endianness =3D state->endi= anness;
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0response.result =3D pci_dma_write(&= amp;state->device, request->address + i,
+ =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0buff, writelen);
+ =C2=A0 =C2= =A0 =C2=A0 =C2=A0if (response.result) {
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0printf("PCILeech: Address 0x%lX Write Error! MemTxResult:= 0x%X\n",
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0= =C2=A0 =C2=A0request->address + i, response.result);
+ =C2=A0 =C2=A0= =C2=A0 =C2=A0}
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0response.length =3D 0;
+= =C2=A0 =C2=A0 =C2=A0 =C2=A0while (sendlen < sizeof(struct LeechResponse= Header)) {
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0sendlen +=3D send(= incoming, &response_buffer[sendlen],
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0sizeof= (struct LeechResponseHeader) - sendlen, 0);
+ =C2=A0 =C2=A0 =C2=A0 =C2= =A0}
+ =C2=A0 =C2=A0}
+}
+
+static void pci_leech_process_read_= request(PciLeechState *state,
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0LeechRequestHeader *request,
+ = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0int incoming)
+{
+ =C2=A0 =C2=A0char buff[1024];
+ =C2=A0 = =C2=A0for (uint64_t i =3D 0; i < request->length; i +=3D sizeof(buff)= ) {
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0struct LeechResponseHeader response =3D= { 0 };
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0char* response_buffer =3D (char *)&= amp;response;
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0const uint64_t readlen =3D (r= equest->length - i) <=3D sizeof(buff) ?
+ =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0(request->length - i) : sizeof(buff);
+ = =C2=A0 =C2=A0 =C2=A0 =C2=A0ssize_t sendlen =3D 0;
+ =C2=A0 =C2=A0 =C2=A0= =C2=A0response.endianness =3D state->endianness;
+ =C2=A0 =C2=A0 =C2= =A0 =C2=A0response.result =3D pci_dma_read(&state->device, request-&= gt;address + i,
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0buff, readlen);
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0if (response.resu= lt) {
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0printf("PCILeech: = Address 0x%lX Read Error! MemTxResult: 0x%X\n",
+ =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0request->address + i= , response.result);
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0}
+ =C2=A0 =C2=A0 = =C2=A0 =C2=A0response.length =3D (request->endianness !=3D state->end= ianness) ?
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0bswap64(readlen) : readlen;
+ =C2=A0 =C2=A0 =C2=A0 = =C2=A0while (sendlen < sizeof(struct LeechResponseHeader)) {
+ =C2=A0= =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0sendlen +=3D send(incoming, &respons= e_buffer[sendlen],
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0sizeof(struct LeechResponse= Header) - sendlen, 0);
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0}
+ =C2=A0 =C2=A0= =C2=A0 =C2=A0sendlen =3D 0;
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0while (sendlen= < readlen) {
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0sendlen +=3D= send(incoming, &buff[sendlen], readlen - sendlen, 0);
+ =C2=A0 =C2= =A0 =C2=A0 =C2=A0}
+ =C2=A0 =C2=A0}
+}
+
+static void *pci_leec= h_worker_thread(void *opaque)
+{
+ =C2=A0 =C2=A0PciLeechState *state = =3D PCILEECH(opaque);
+ =C2=A0 =C2=A0while (1) {
+ =C2=A0 =C2=A0 =C2= =A0 =C2=A0LeechRequestHeader request;
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0char = *request_buffer =3D (char *)&request;
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0s= size_t received =3D 0;
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0int incoming;
+ = =C2=A0 =C2=A0 =C2=A0 =C2=A0struct sockaddr address;
+ =C2=A0 =C2=A0 =C2= =A0 =C2=A0socklen_t addrlen;
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0/* Check if we= are stopping. */
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0qemu_mutex_lock(&stat= e->mutex);
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0if (state->stopping) {
= + =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0qemu_mutex_unlock(&state->= ;mutex);
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0break;
+ =C2=A0 = =C2=A0 =C2=A0 =C2=A0}
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0qemu_mutex_unlock(&am= p;state->mutex);
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0/* Accept PCILeech requ= ests. */
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0/* Use HTTP1.0-like protocol for s= implicity. */
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0incoming =3D accept(state->= ;sockfd, &address, &addrlen);
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0if (i= ncoming < 0) {
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0puts("= WARNING: Failed to accept socket for PCILeech! Skipping "
+ =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 "Request...\n");=
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0continue;
+ =C2=A0 =C2=A0= =C2=A0 =C2=A0}
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0/* Get PCILeech requests. *= /
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0while (received < sizeof(LeechRequestH= eader)) {
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0received +=3D recv(= incoming, &request_buffer[received],
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0sizeof= (LeechRequestHeader) - received, 0);
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0}
+= =C2=A0 =C2=A0 =C2=A0 =C2=A0/* Swap endianness. */
+ =C2=A0 =C2=A0 =C2= =A0 =C2=A0if (request.endianness !=3D state->endianness) {
+ =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0request.address =3D bswap64(request.addre= ss);
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0request.length =3D bswap= 64(request.length);
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0}
+ =C2=A0 =C2=A0 = =C2=A0 =C2=A0/* Process PCILeech requests. */
+ =C2=A0 =C2=A0 =C2=A0 =C2= =A0qemu_mutex_lock(&state->mutex);
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0i= f (request.command) {
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0pci_lee= ch_process_write_request(state, &request, incoming);
+ =C2=A0 =C2=A0= =C2=A0 =C2=A0} else {
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0pci_le= ech_process_read_request(state, &request, incoming);
+ =C2=A0 =C2=A0= =C2=A0 =C2=A0}
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0qemu_mutex_unlock(&stat= e->mutex);
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0close(incoming);
+ =C2=A0 = =C2=A0}
+ =C2=A0 =C2=A0return NULL;
+}
+
+static void pci_leech= _realize(PCIDevice *pdev, Error **errp)
+{
+ =C2=A0 =C2=A0PciLeechSta= te *state =3D PCILEECH(pdev);
+ =C2=A0 =C2=A0struct sockaddr_in sock_add= r;
+ =C2=A0 =C2=A0char host_ip[16];
+ =C2=A0 =C2=A0struct hostent *he= =3D gethostbyname(state->host);
+ =C2=A0 =C2=A0if (he =3D=3D NULL) {=
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0puts("gethostbyname failed!");+ =C2=A0 =C2=A0 =C2=A0 =C2=A0exit(EXIT_FAILURE);
+ =C2=A0 =C2=A0}
+= =C2=A0 =C2=A0/* Initialize the socket for PCILeech. */
+ =C2=A0 =C2=A0s= tate->sockfd =3D socket(AF_INET, SOCK_STREAM, 0);
+ =C2=A0 =C2=A0if (= state->sockfd < 0) {
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0puts("Faile= d to initialize socket for PCILeech!");
+ =C2=A0 =C2=A0 =C2=A0 =C2= =A0exit(EXIT_FAILURE);
+ =C2=A0 =C2=A0}
+ =C2=A0 =C2=A0sock_addr.sin_= family =3D AF_INET;
+ =C2=A0 =C2=A0sock_addr.sin_addr =3D *(struct in_ad= dr *)he->h_addr;
+ =C2=A0 =C2=A0sock_addr.sin_port =3D htons(state-&g= t;port);
+ =C2=A0 =C2=A0inet_ntop(AF_INET, &sock_addr.sin_addr, host= _ip, sizeof(host_ip));
+ =C2=A0 =C2=A0if (bind(state->sockfd, (struct= sockaddr *)&sock_addr, sizeof(sock_addr))
+ =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0< 0= ) {
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0puts("Failed to bind socket for PC= ILeech!");
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0close(state->sockfd);+ =C2=A0 =C2=A0 =C2=A0 =C2=A0exit(EXIT_FAILURE);
+ =C2=A0 =C2=A0}
+ = =C2=A0 =C2=A0if (listen(state->sockfd, 10) < 0) {
+ =C2=A0 =C2=A0 = =C2=A0 =C2=A0puts("Failed to listen to socket for PCILeech!");+ =C2=A0 =C2=A0 =C2=A0 =C2=A0close(state->sockfd);
+ =C2=A0 =C2=A0 = =C2=A0 =C2=A0exit(EXIT_FAILURE);
+ =C2=A0 =C2=A0}
+ =C2=A0 =C2=A0prin= tf("INFO: PCILeech is listening on %s:%u...\n", host_ip, state-&g= t;port);
+ =C2=A0 =C2=A0/* Initialize the thread for PCILeech. */
+ = =C2=A0 =C2=A0qemu_mutex_init(&state->mutex);
+ =C2=A0 =C2=A0qemu_= thread_create(&state->thread, "pcileech", pci_leech_worker= _thread,
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2= =A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 =C2=A0 = =C2=A0 =C2=A0 =C2=A0state, QEMU_THREAD_JOINABLE);
+}
+
+static voi= d pci_leech_finalize(PCIDevice *pdev)
+{
+ =C2=A0 =C2=A0PciLeechState= *state =3D PCILEECH(pdev);
+ =C2=A0 =C2=A0puts("Stopping PCILeech = Worker...");
+ =C2=A0 =C2=A0qemu_mutex_lock(&state->mutex);<= br>+ =C2=A0 =C2=A0state->stopping =3D true;
+ =C2=A0 =C2=A0qemu_mutex= _unlock(&state->mutex);
+ =C2=A0 =C2=A0close(state->sockfd);+ =C2=A0 =C2=A0qemu_thread_join(&state->thread);
+ =C2=A0 =C2= =A0qemu_mutex_destroy(&state->mutex);
+}
+
+char pci_leech_= default_host[] =3D "0.0.0.0";
+
+static void pci_leech_inst= ance_init(Object *obj)
+{
+ =C2=A0 =C2=A0int x =3D 1;
+ =C2=A0 =C2= =A0char* y =3D (char *)&x;
+ =C2=A0 =C2=A0PciLeechState *state =3D P= CILEECH(obj);
+ =C2=A0 =C2=A0/* QEMU's String-Property can't spe= cify default value. */
+ =C2=A0 =C2=A0/* So we have to set the default o= n our own. */
+ =C2=A0 =C2=A0if (state->host =3D=3D NULL) {
+ =C2= =A0 =C2=A0 =C2=A0 =C2=A0state->host =3D pci_leech_default_host;
+ =C2= =A0 =C2=A0}
+ =C2=A0 =C2=A0/* Save Our Endianness. */
+ =C2=A0 =C2=A0= state->endianness =3D (*y =3D=3D 0);
+}
+
+static Property leec= h_properties[] =3D {
+ =C2=A0 =C2=A0DEFINE_PROP_UINT16("port",= PciLeechState, port, 6789),
+ =C2=A0 =C2=A0DEFINE_PROP_STRING("hos= t", PciLeechState, host),
+ =C2=A0 =C2=A0DEFINE_PROP_END_OF_LIST(),=
+};
+
+static void pci_leech_class_init(ObjectClass *class, void = *data)
+{
+ =C2=A0 =C2=A0DeviceClass *dc =3D DEVICE_CLASS(class);
= + =C2=A0 =C2=A0PCIDeviceClass *k =3D PCI_DEVICE_CLASS(class);
+ =C2=A0 = =C2=A0k->realize =3D pci_leech_realize;
+ =C2=A0 =C2=A0k->exit =3D= pci_leech_finalize;
+ =C2=A0 =C2=A0/* Change the Vendor/Device ID to yo= ur favor. */
+ =C2=A0 =C2=A0/* These are the default values from PCILeec= h-FPGA. */
+ =C2=A0 =C2=A0k->vendor_id =3D PCI_VENDOR_ID_XILINX;
+= =C2=A0 =C2=A0k->device_id =3D 0x0666;
+ =C2=A0 =C2=A0k->revision = =3D 0;
+ =C2=A0 =C2=A0k->class_id =3D PCI_CLASS_NETWORK_ETHERNET;
= + =C2=A0 =C2=A0device_class_set_props(dc, leech_properties);
+ =C2=A0 = =C2=A0set_bit(DEVICE_CATEGORY_MISC, dc->categories);
+}
+
+stat= ic void pci_leech_register_types(void)
+{
+ =C2=A0 =C2=A0static Inter= faceInfo interfaces[] =3D {
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0{INTERFACE_CONV= ENTIONAL_PCI_DEVICE},
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0{},
+ =C2=A0 =C2= =A0};
+ =C2=A0 =C2=A0static const TypeInfo leech_info =3D {
+ =C2=A0 = =C2=A0 =C2=A0 =C2=A0.name =3D TYPE_PCILEECH_DEVICE,
+ =C2=A0 =C2=A0 =C2= =A0 =C2=A0.parent =3D TYPE_PCI_DEVICE,
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0.ins= tance_size =3D sizeof(PciLeechState),
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0.inst= ance_init =3D pci_leech_instance_init,
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0.cla= ss_init =3D pci_leech_class_init,
+ =C2=A0 =C2=A0 =C2=A0 =C2=A0.interfac= es =3D interfaces,
+ =C2=A0 =C2=A0};
+ =C2=A0 =C2=A0type_register_sta= tic(&leech_info);
+}
+
+type_init(pci_leech_register_types)
--0000000000007226ee06208beaf1--