一，前言

qemu中glib库API研究--Apple的学习笔记我研究了下glib事件我触发，因为我猜测是将仿真的elf传入后，进行机器码翻译后会触发glib的某个事件，然后通知到graphic模块进行显示。所有有了glib API基础，那么我又开始看源码，验证我的猜测是否正确。看了源码后，发现LED的on和off事件触发和glib的事件触发没有直接关系。

二，SDL2的LED ON事件触发

SDL2中polling检查到事件后，会调用SDL2进行显示
while (SDL_PollEvent(&event)) {
cortexm_graphic_process_event(&event);
}
而事件触发是在gpio_led_turn函数中调用了
cortexm_graphic_enqueue_event(GRAPHIC_EVENT_LED_TURN, state, (void*) is_on)此函数中是通过SDL_PushEvent来推送SDL2的事件。
而gpio_led_turn是被gpio_led_irq_handler调用的。此中断函数是在初始化时候注册的。cm_irq_init_in(DEVICE(obj), gpio_led_irq_handler, IRQ_GPIO_LED_IN, 1)它最终会调用qemu_allocate_irq来注册。
那么要调用到这个被注册的irq函数，则需要调用qemu_set_irq。是谁调用的呢？继续分析，我就直接在gpio_led_irq_handler打断点调试。

三，仿真写IO后的事件触发

Thread 2 "qemu-system-gnu" hit Breakpoint 1, gpio_led_irq_handler (opaque=0x19a14f0, n=0, level=1)
    at /work/qemu-gnuarmeclipse-dev/hw/cortexm/gpio-led.c:172
172     GPIOLEDState *state = GPIO_LED_STATE(opaque);
(gdb) bt
#0  gpio_led_irq_handler (opaque=0x19a14f0, n=0, level=1) at /work/qemu-gnuarmeclipse-dev/hw/cortexm/gpio-led.c:172
#1  0x005cb04e in qemu_set_irq (irq=0x19a1d48, level=1) at hw/core/irq.c:44
#2  0x004b033a in cm_irq_set (irq=0x19a1d48, level=1) at /work/qemu-gnuarmeclipse-dev/hw/cortexm/helper.c:803
#3  0x004de930 in stm32_gpio_set_odr_irqs (state=0x1652e38, old_odr=512, new_odr=1536)
    at /work/qemu-gnuarmeclipse-dev/hw/cortexm/stm32/gpio.c:2522
#4  0x004de792 in stm32_gpio_update_odr_and_idr (state=0x1652e38, odr=0x16af0b8, idr=0x16a6d28, new_value=1536)
    at /work/qemu-gnuarmeclipse-dev/hw/cortexm/stm32/gpio.c:2477
#5  0x004de60a in stm32f4_gpio_bsrr_post_write_callback (reg=0x16b6eb0, periph=0x1652e38, addr=24, offset=0, size=2, value=1024, full_value=1024)
    at /work/qemu-gnuarmeclipse-dev/hw/cortexm/stm32/gpio.c:2422
#6  0x004b8f86 in peripheral_register_write_callback (reg=0x16b6eb0, periph=0x1652e38, addr=24, offset=0, size=2, value=1024)
    at /work/qemu-gnuarmeclipse-dev/hw/cortexm/peripheral-register.c:585
#7  0x004ba7bb in peripheral_write_callback (opaque=0x1652e38, addr=24, value=1024, size=2)
    at /work/qemu-gnuarmeclipse-dev/hw/cortexm/peripheral.c:258
#8  0x00485908 in memory_region_write_accessor (mr=0x165308c, addr=24, value=0xaded7b20, size=2, shift=0, mask=65535, attrs=...)
    at /work/qemu-gnuarmeclipse-dev/memory.c:530
#9  0x00485b64 in access_with_adjusted_size (addr=24, value=0xaded7b20, size=2, access_size_min=1, access_size_max=4, 
    access=0x4857f7 <memory_region_write_accessor>, mr=0x165308c, attrs=...) at /work/qemu-gnuarmeclipse-dev/memory.c:596
#10 0x0048828e in memory_region_dispatch_write (mr=0x165308c, addr=24, data=1024, size=2, attrs=...) at /work/qemu-gnuarmeclipse-dev/memory.c:1334
#11 0x0048eb76 in io_writex (env=0xfee054, iotlbentry=0xff7200, val=1024, addr=1073878040, retaddr=2926064946, size=2)
    at /work/qemu-gnuarmeclipse-dev/cputlb.c:534
#12 0x00490355 in io_writew (env=0xfee054, mmu_idx=1, index=133, val=1024, addr=1073878040, retaddr=2926064946)
    at /work/qemu-gnuarmeclipse-dev/softmmu_template.h:265
#13 0x00490654 in helper_le_stw_mmu (env=0xfee054, addr=1073878040, val=1024, oi=17, retaddr=2926064946)
    at /work/qemu-gnuarmeclipse-dev/softmmu_template.h:300
#14 0xae683532 in code_gen_buffer ()
#15 0x0043ad4a in cpu_tb_exec (cpu=0xfe9ea8, itb=0xae0bb8c0) at /work/qemu-gnuarmeclipse-dev/cpu-exec.c:173
#16 0x0043b96e in cpu_loop_exec_tb (cpu=0xfe9ea8, tb=0xae0bb8c0, last_tb=0xaded7fb4, tb_exit=0xaded7fb8, sc=0xaded7fc4)
    at /work/qemu-gnuarmeclipse-dev/cpu-exec.c:553
#17 0x0043bc0b in cpu_exec (cpu=0xfe9ea8) at /work/qemu-gnuarmeclipse-dev/cpu-exec.c:647
#18 0x0046fbe4 in tcg_cpu_exec (cpu=0xfe9ea8) at /work/qemu-gnuarmeclipse-dev/cpus.c:1117
#19 0x0046fe50 in qemu_tcg_cpu_thread_fn (arg=0xfe9ea8) at /work/qemu-gnuarmeclipse-dev/cpus.c:1197
#20 0xb7bdb295 in start_thread (arg=0xaded8b40) at pthread_create.c:333
#21 0xb7b051ae in clone () at ../sysdeps/unix/sysv/linux/i386/clone.S:114

按函数流，我的理解是先结合虚拟cpu解析bin文件，然后io_writex后对创建的class的memory范围检查，之后调用peripheral_write_callback判断class接口是否使能，判断使能后则调用stm32f4_gpio_bsrr_post_write_callback写寄存器。然后调用stm32_gpio_set_odr_irqs函数是判断ORD gpio的引脚电平变化，则会调用irq函数设置SDL2的LED ON事件来通知SDL2显示。

// Identify ODR bits that changed, then notify listeners (like LEDs)
// and trigger interrupts.
static void stm32_gpio_set_odr_irqs(STM32GPIOState *state, uint16_t old_odr,
        uint16_t new_odr)
{
    // Compute pins that changed value.
    uint16_t changed = old_odr ^ new_odr;

    // Filter changed pins that are outputs - do not touch input pins.
    uint16_t changed_out = changed & state->dir_mask;

    uint16_t mask = 1;
    if (changed_out) {
        int pin;
        for (pin = 0; pin < STM32_GPIO_PIN_COUNT; pin++, mask <<= 1) {
            // If the value of this pin has changed, then update
            // the output IRQ.
            if ((changed_out & mask) != 0) {
                int level = (new_odr & mask) ? 1 : 0;

                cm_irq_set(state->odr_irq[pin], level);//调用注册的函数

                stm32_gpio_set_exti_irq(state, pin, level);
            }
        }
    }
}

四，小结

至此从分析elf到写入io寄存器，到检查到pin脚状态变化后通知SDL2设置LED的数据流就清楚了。但是这里面和glib的事件触发没有直接关系，glib的ppoll事件用在哪里呢？网上查了下
Qemu_aio_context: VNC,QMP 命令
Iohandler->ctx：负责监控信号，中断，事件通知，socket等；
Iothread->ctx：主要负责io方面的监控；
Bs->ctx：负责blockjob等相关任务的监控
为什么我这个LED灯亮的过程没有用到呢？我想应该仿真ECU是没有使用PC的外设来共享，所以没有用到glib的事件触发，具体之后再分析吧，通过像拼图一样，一块块把qemu弄明白。