]>
Commit | Line | Data |
---|---|---|
e5ad936b JK |
1 | /* |
2 | * TPR optimization for 32-bit Windows guests (XP and Server 2003) | |
3 | * | |
4 | * Copyright (C) 2007-2008 Qumranet Technologies | |
5 | * Copyright (C) 2012 Jan Kiszka, Siemens AG | |
6 | * | |
7 | * This work is licensed under the terms of the GNU GPL version 2, or | |
8 | * (at your option) any later version. See the COPYING file in the | |
9 | * top-level directory. | |
10 | */ | |
11 | #include "sysemu.h" | |
12 | #include "cpus.h" | |
13 | #include "kvm.h" | |
14 | #include "apic_internal.h" | |
15 | ||
16 | #define APIC_DEFAULT_ADDRESS 0xfee00000 | |
17 | ||
18 | #define VAPIC_IO_PORT 0x7e | |
19 | ||
20 | #define VAPIC_CPU_SHIFT 7 | |
21 | ||
22 | #define ROM_BLOCK_SIZE 512 | |
23 | #define ROM_BLOCK_MASK (~(ROM_BLOCK_SIZE - 1)) | |
24 | ||
25 | typedef enum VAPICMode { | |
26 | VAPIC_INACTIVE = 0, | |
27 | VAPIC_ACTIVE = 1, | |
28 | VAPIC_STANDBY = 2, | |
29 | } VAPICMode; | |
30 | ||
31 | typedef struct VAPICHandlers { | |
32 | uint32_t set_tpr; | |
33 | uint32_t set_tpr_eax; | |
34 | uint32_t get_tpr[8]; | |
35 | uint32_t get_tpr_stack; | |
36 | } QEMU_PACKED VAPICHandlers; | |
37 | ||
38 | typedef struct GuestROMState { | |
39 | char signature[8]; | |
40 | uint32_t vaddr; | |
41 | uint32_t fixup_start; | |
42 | uint32_t fixup_end; | |
43 | uint32_t vapic_vaddr; | |
44 | uint32_t vapic_size; | |
45 | uint32_t vcpu_shift; | |
46 | uint32_t real_tpr_addr; | |
47 | VAPICHandlers up; | |
48 | VAPICHandlers mp; | |
49 | } QEMU_PACKED GuestROMState; | |
50 | ||
51 | typedef struct VAPICROMState { | |
52 | SysBusDevice busdev; | |
53 | MemoryRegion io; | |
54 | MemoryRegion rom; | |
55 | uint32_t state; | |
56 | uint32_t rom_state_paddr; | |
57 | uint32_t rom_state_vaddr; | |
58 | uint32_t vapic_paddr; | |
59 | uint32_t real_tpr_addr; | |
60 | GuestROMState rom_state; | |
61 | size_t rom_size; | |
62 | bool rom_mapped_writable; | |
63 | } VAPICROMState; | |
64 | ||
65 | #define TPR_INSTR_ABS_MODRM 0x1 | |
66 | #define TPR_INSTR_MATCH_MODRM_REG 0x2 | |
67 | ||
68 | typedef struct TPRInstruction { | |
69 | uint8_t opcode; | |
70 | uint8_t modrm_reg; | |
71 | unsigned int flags; | |
72 | TPRAccess access; | |
73 | size_t length; | |
74 | off_t addr_offset; | |
75 | } TPRInstruction; | |
76 | ||
77 | /* must be sorted by length, shortest first */ | |
78 | static const TPRInstruction tpr_instr[] = { | |
79 | { /* mov abs to eax */ | |
80 | .opcode = 0xa1, | |
81 | .access = TPR_ACCESS_READ, | |
82 | .length = 5, | |
83 | .addr_offset = 1, | |
84 | }, | |
85 | { /* mov eax to abs */ | |
86 | .opcode = 0xa3, | |
87 | .access = TPR_ACCESS_WRITE, | |
88 | .length = 5, | |
89 | .addr_offset = 1, | |
90 | }, | |
91 | { /* mov r32 to r/m32 */ | |
92 | .opcode = 0x89, | |
93 | .flags = TPR_INSTR_ABS_MODRM, | |
94 | .access = TPR_ACCESS_WRITE, | |
95 | .length = 6, | |
96 | .addr_offset = 2, | |
97 | }, | |
98 | { /* mov r/m32 to r32 */ | |
99 | .opcode = 0x8b, | |
100 | .flags = TPR_INSTR_ABS_MODRM, | |
101 | .access = TPR_ACCESS_READ, | |
102 | .length = 6, | |
103 | .addr_offset = 2, | |
104 | }, | |
105 | { /* push r/m32 */ | |
106 | .opcode = 0xff, | |
107 | .modrm_reg = 6, | |
108 | .flags = TPR_INSTR_ABS_MODRM | TPR_INSTR_MATCH_MODRM_REG, | |
109 | .access = TPR_ACCESS_READ, | |
110 | .length = 6, | |
111 | .addr_offset = 2, | |
112 | }, | |
113 | { /* mov imm32, r/m32 (c7/0) */ | |
114 | .opcode = 0xc7, | |
115 | .modrm_reg = 0, | |
116 | .flags = TPR_INSTR_ABS_MODRM | TPR_INSTR_MATCH_MODRM_REG, | |
117 | .access = TPR_ACCESS_WRITE, | |
118 | .length = 10, | |
119 | .addr_offset = 2, | |
120 | }, | |
121 | }; | |
122 | ||
123 | static void read_guest_rom_state(VAPICROMState *s) | |
124 | { | |
125 | cpu_physical_memory_rw(s->rom_state_paddr, (void *)&s->rom_state, | |
126 | sizeof(GuestROMState), 0); | |
127 | } | |
128 | ||
129 | static void write_guest_rom_state(VAPICROMState *s) | |
130 | { | |
131 | cpu_physical_memory_rw(s->rom_state_paddr, (void *)&s->rom_state, | |
132 | sizeof(GuestROMState), 1); | |
133 | } | |
134 | ||
135 | static void update_guest_rom_state(VAPICROMState *s) | |
136 | { | |
137 | read_guest_rom_state(s); | |
138 | ||
139 | s->rom_state.real_tpr_addr = cpu_to_le32(s->real_tpr_addr); | |
140 | s->rom_state.vcpu_shift = cpu_to_le32(VAPIC_CPU_SHIFT); | |
141 | ||
142 | write_guest_rom_state(s); | |
143 | } | |
144 | ||
4a8fa5dc | 145 | static int find_real_tpr_addr(VAPICROMState *s, CPUX86State *env) |
e5ad936b | 146 | { |
a8170e5e | 147 | hwaddr paddr; |
e5ad936b JK |
148 | target_ulong addr; |
149 | ||
150 | if (s->state == VAPIC_ACTIVE) { | |
151 | return 0; | |
152 | } | |
153 | /* | |
154 | * If there is no prior TPR access instruction we could analyze (which is | |
155 | * the case after resume from hibernation), we need to scan the possible | |
156 | * virtual address space for the APIC mapping. | |
157 | */ | |
158 | for (addr = 0xfffff000; addr >= 0x80000000; addr -= TARGET_PAGE_SIZE) { | |
159 | paddr = cpu_get_phys_page_debug(env, addr); | |
160 | if (paddr != APIC_DEFAULT_ADDRESS) { | |
161 | continue; | |
162 | } | |
163 | s->real_tpr_addr = addr + 0x80; | |
164 | update_guest_rom_state(s); | |
165 | return 0; | |
166 | } | |
167 | return -1; | |
168 | } | |
169 | ||
170 | static uint8_t modrm_reg(uint8_t modrm) | |
171 | { | |
172 | return (modrm >> 3) & 7; | |
173 | } | |
174 | ||
175 | static bool is_abs_modrm(uint8_t modrm) | |
176 | { | |
177 | return (modrm & 0xc7) == 0x05; | |
178 | } | |
179 | ||
180 | static bool opcode_matches(uint8_t *opcode, const TPRInstruction *instr) | |
181 | { | |
182 | return opcode[0] == instr->opcode && | |
183 | (!(instr->flags & TPR_INSTR_ABS_MODRM) || is_abs_modrm(opcode[1])) && | |
184 | (!(instr->flags & TPR_INSTR_MATCH_MODRM_REG) || | |
185 | modrm_reg(opcode[1]) == instr->modrm_reg); | |
186 | } | |
187 | ||
4a8fa5dc | 188 | static int evaluate_tpr_instruction(VAPICROMState *s, CPUX86State *env, |
e5ad936b JK |
189 | target_ulong *pip, TPRAccess access) |
190 | { | |
191 | const TPRInstruction *instr; | |
192 | target_ulong ip = *pip; | |
193 | uint8_t opcode[2]; | |
194 | uint32_t real_tpr_addr; | |
195 | int i; | |
196 | ||
197 | if ((ip & 0xf0000000ULL) != 0x80000000ULL && | |
198 | (ip & 0xf0000000ULL) != 0xe0000000ULL) { | |
199 | return -1; | |
200 | } | |
201 | ||
202 | /* | |
203 | * Early Windows 2003 SMP initialization contains a | |
204 | * | |
205 | * mov imm32, r/m32 | |
206 | * | |
207 | * instruction that is patched by TPR optimization. The problem is that | |
208 | * RSP, used by the patched instruction, is zero, so the guest gets a | |
209 | * double fault and dies. | |
210 | */ | |
211 | if (env->regs[R_ESP] == 0) { | |
212 | return -1; | |
213 | } | |
214 | ||
215 | if (kvm_enabled() && !kvm_irqchip_in_kernel()) { | |
216 | /* | |
217 | * KVM without kernel-based TPR access reporting will pass an IP that | |
218 | * points after the accessing instruction. So we need to look backward | |
219 | * to find the reason. | |
220 | */ | |
221 | for (i = 0; i < ARRAY_SIZE(tpr_instr); i++) { | |
222 | instr = &tpr_instr[i]; | |
223 | if (instr->access != access) { | |
224 | continue; | |
225 | } | |
226 | if (cpu_memory_rw_debug(env, ip - instr->length, opcode, | |
227 | sizeof(opcode), 0) < 0) { | |
228 | return -1; | |
229 | } | |
230 | if (opcode_matches(opcode, instr)) { | |
231 | ip -= instr->length; | |
232 | goto instruction_ok; | |
233 | } | |
234 | } | |
235 | return -1; | |
236 | } else { | |
237 | if (cpu_memory_rw_debug(env, ip, opcode, sizeof(opcode), 0) < 0) { | |
238 | return -1; | |
239 | } | |
240 | for (i = 0; i < ARRAY_SIZE(tpr_instr); i++) { | |
241 | instr = &tpr_instr[i]; | |
242 | if (opcode_matches(opcode, instr)) { | |
243 | goto instruction_ok; | |
244 | } | |
245 | } | |
246 | return -1; | |
247 | } | |
248 | ||
249 | instruction_ok: | |
250 | /* | |
251 | * Grab the virtual TPR address from the instruction | |
252 | * and update the cached values. | |
253 | */ | |
254 | if (cpu_memory_rw_debug(env, ip + instr->addr_offset, | |
255 | (void *)&real_tpr_addr, | |
256 | sizeof(real_tpr_addr), 0) < 0) { | |
257 | return -1; | |
258 | } | |
259 | real_tpr_addr = le32_to_cpu(real_tpr_addr); | |
260 | if ((real_tpr_addr & 0xfff) != 0x80) { | |
261 | return -1; | |
262 | } | |
263 | s->real_tpr_addr = real_tpr_addr; | |
264 | update_guest_rom_state(s); | |
265 | ||
266 | *pip = ip; | |
267 | return 0; | |
268 | } | |
269 | ||
4a8fa5dc | 270 | static int update_rom_mapping(VAPICROMState *s, CPUX86State *env, target_ulong ip) |
e5ad936b | 271 | { |
a8170e5e | 272 | hwaddr paddr; |
e5ad936b JK |
273 | uint32_t rom_state_vaddr; |
274 | uint32_t pos, patch, offset; | |
275 | ||
276 | /* nothing to do if already activated */ | |
277 | if (s->state == VAPIC_ACTIVE) { | |
278 | return 0; | |
279 | } | |
280 | ||
281 | /* bail out if ROM init code was not executed (missing ROM?) */ | |
282 | if (s->state == VAPIC_INACTIVE) { | |
283 | return -1; | |
284 | } | |
285 | ||
286 | /* find out virtual address of the ROM */ | |
287 | rom_state_vaddr = s->rom_state_paddr + (ip & 0xf0000000); | |
288 | paddr = cpu_get_phys_page_debug(env, rom_state_vaddr); | |
289 | if (paddr == -1) { | |
290 | return -1; | |
291 | } | |
292 | paddr += rom_state_vaddr & ~TARGET_PAGE_MASK; | |
293 | if (paddr != s->rom_state_paddr) { | |
294 | return -1; | |
295 | } | |
296 | read_guest_rom_state(s); | |
297 | if (memcmp(s->rom_state.signature, "kvm aPiC", 8) != 0) { | |
298 | return -1; | |
299 | } | |
300 | s->rom_state_vaddr = rom_state_vaddr; | |
301 | ||
302 | /* fixup addresses in ROM if needed */ | |
303 | if (rom_state_vaddr == le32_to_cpu(s->rom_state.vaddr)) { | |
304 | return 0; | |
305 | } | |
306 | for (pos = le32_to_cpu(s->rom_state.fixup_start); | |
307 | pos < le32_to_cpu(s->rom_state.fixup_end); | |
308 | pos += 4) { | |
309 | cpu_physical_memory_rw(paddr + pos - s->rom_state.vaddr, | |
310 | (void *)&offset, sizeof(offset), 0); | |
311 | offset = le32_to_cpu(offset); | |
312 | cpu_physical_memory_rw(paddr + offset, (void *)&patch, | |
313 | sizeof(patch), 0); | |
314 | patch = le32_to_cpu(patch); | |
315 | patch += rom_state_vaddr - le32_to_cpu(s->rom_state.vaddr); | |
316 | patch = cpu_to_le32(patch); | |
317 | cpu_physical_memory_rw(paddr + offset, (void *)&patch, | |
318 | sizeof(patch), 1); | |
319 | } | |
320 | read_guest_rom_state(s); | |
321 | s->vapic_paddr = paddr + le32_to_cpu(s->rom_state.vapic_vaddr) - | |
322 | le32_to_cpu(s->rom_state.vaddr); | |
323 | ||
324 | return 0; | |
325 | } | |
326 | ||
327 | /* | |
328 | * Tries to read the unique processor number from the Kernel Processor Control | |
329 | * Region (KPCR) of 32-bit Windows XP and Server 2003. Returns -1 if the KPCR | |
330 | * cannot be accessed or is considered invalid. This also ensures that we are | |
331 | * not patching the wrong guest. | |
332 | */ | |
4a8fa5dc | 333 | static int get_kpcr_number(CPUX86State *env) |
e5ad936b JK |
334 | { |
335 | struct kpcr { | |
336 | uint8_t fill1[0x1c]; | |
337 | uint32_t self; | |
338 | uint8_t fill2[0x31]; | |
339 | uint8_t number; | |
340 | } QEMU_PACKED kpcr; | |
341 | ||
342 | if (cpu_memory_rw_debug(env, env->segs[R_FS].base, | |
343 | (void *)&kpcr, sizeof(kpcr), 0) < 0 || | |
344 | kpcr.self != env->segs[R_FS].base) { | |
345 | return -1; | |
346 | } | |
347 | return kpcr.number; | |
348 | } | |
349 | ||
4a8fa5dc | 350 | static int vapic_enable(VAPICROMState *s, CPUX86State *env) |
e5ad936b JK |
351 | { |
352 | int cpu_number = get_kpcr_number(env); | |
a8170e5e | 353 | hwaddr vapic_paddr; |
e5ad936b JK |
354 | static const uint8_t enabled = 1; |
355 | ||
356 | if (cpu_number < 0) { | |
357 | return -1; | |
358 | } | |
359 | vapic_paddr = s->vapic_paddr + | |
a8170e5e | 360 | (((hwaddr)cpu_number) << VAPIC_CPU_SHIFT); |
e5ad936b JK |
361 | cpu_physical_memory_rw(vapic_paddr + offsetof(VAPICState, enabled), |
362 | (void *)&enabled, sizeof(enabled), 1); | |
363 | apic_enable_vapic(env->apic_state, vapic_paddr); | |
364 | ||
365 | s->state = VAPIC_ACTIVE; | |
366 | ||
367 | return 0; | |
368 | } | |
369 | ||
4a8fa5dc | 370 | static void patch_byte(CPUX86State *env, target_ulong addr, uint8_t byte) |
e5ad936b JK |
371 | { |
372 | cpu_memory_rw_debug(env, addr, &byte, 1, 1); | |
373 | } | |
374 | ||
4a8fa5dc | 375 | static void patch_call(VAPICROMState *s, CPUX86State *env, target_ulong ip, |
e5ad936b JK |
376 | uint32_t target) |
377 | { | |
378 | uint32_t offset; | |
379 | ||
380 | offset = cpu_to_le32(target - ip - 5); | |
381 | patch_byte(env, ip, 0xe8); /* call near */ | |
382 | cpu_memory_rw_debug(env, ip + 1, (void *)&offset, sizeof(offset), 1); | |
383 | } | |
384 | ||
4a8fa5dc | 385 | static void patch_instruction(VAPICROMState *s, CPUX86State *env, target_ulong ip) |
e5ad936b | 386 | { |
e5ad936b JK |
387 | VAPICHandlers *handlers; |
388 | uint8_t opcode[2]; | |
389 | uint32_t imm32; | |
5c61afec JK |
390 | TranslationBlock *current_tb; |
391 | target_ulong current_pc = 0; | |
392 | target_ulong current_cs_base = 0; | |
393 | int current_flags = 0; | |
e5ad936b JK |
394 | |
395 | if (smp_cpus == 1) { | |
396 | handlers = &s->rom_state.up; | |
397 | } else { | |
398 | handlers = &s->rom_state.mp; | |
399 | } | |
400 | ||
5c61afec JK |
401 | if (!kvm_enabled()) { |
402 | current_tb = tb_find_pc(env->mem_io_pc); | |
403 | cpu_restore_state(current_tb, env, env->mem_io_pc); | |
404 | cpu_get_tb_cpu_state(env, ¤t_pc, ¤t_cs_base, | |
405 | ¤t_flags); | |
406 | } | |
407 | ||
e5ad936b JK |
408 | pause_all_vcpus(); |
409 | ||
410 | cpu_memory_rw_debug(env, ip, opcode, sizeof(opcode), 0); | |
411 | ||
412 | switch (opcode[0]) { | |
413 | case 0x89: /* mov r32 to r/m32 */ | |
414 | patch_byte(env, ip, 0x50 + modrm_reg(opcode[1])); /* push reg */ | |
415 | patch_call(s, env, ip + 1, handlers->set_tpr); | |
416 | break; | |
417 | case 0x8b: /* mov r/m32 to r32 */ | |
418 | patch_byte(env, ip, 0x90); | |
419 | patch_call(s, env, ip + 1, handlers->get_tpr[modrm_reg(opcode[1])]); | |
420 | break; | |
421 | case 0xa1: /* mov abs to eax */ | |
422 | patch_call(s, env, ip, handlers->get_tpr[0]); | |
423 | break; | |
424 | case 0xa3: /* mov eax to abs */ | |
425 | patch_call(s, env, ip, handlers->set_tpr_eax); | |
426 | break; | |
427 | case 0xc7: /* mov imm32, r/m32 (c7/0) */ | |
428 | patch_byte(env, ip, 0x68); /* push imm32 */ | |
429 | cpu_memory_rw_debug(env, ip + 6, (void *)&imm32, sizeof(imm32), 0); | |
430 | cpu_memory_rw_debug(env, ip + 1, (void *)&imm32, sizeof(imm32), 1); | |
431 | patch_call(s, env, ip + 5, handlers->set_tpr); | |
432 | break; | |
433 | case 0xff: /* push r/m32 */ | |
434 | patch_byte(env, ip, 0x50); /* push eax */ | |
435 | patch_call(s, env, ip + 1, handlers->get_tpr_stack); | |
436 | break; | |
437 | default: | |
438 | abort(); | |
439 | } | |
440 | ||
441 | resume_all_vcpus(); | |
442 | ||
5c61afec JK |
443 | if (!kvm_enabled()) { |
444 | env->current_tb = NULL; | |
445 | tb_gen_code(env, current_pc, current_cs_base, current_flags, 1); | |
446 | cpu_resume_from_signal(env, NULL); | |
447 | } | |
e5ad936b JK |
448 | } |
449 | ||
450 | void vapic_report_tpr_access(DeviceState *dev, void *cpu, target_ulong ip, | |
451 | TPRAccess access) | |
452 | { | |
453 | VAPICROMState *s = DO_UPCAST(VAPICROMState, busdev.qdev, dev); | |
4a8fa5dc | 454 | CPUX86State *env = cpu; |
e5ad936b JK |
455 | |
456 | cpu_synchronize_state(env); | |
457 | ||
458 | if (evaluate_tpr_instruction(s, env, &ip, access) < 0) { | |
459 | if (s->state == VAPIC_ACTIVE) { | |
460 | vapic_enable(s, env); | |
461 | } | |
462 | return; | |
463 | } | |
464 | if (update_rom_mapping(s, env, ip) < 0) { | |
465 | return; | |
466 | } | |
467 | if (vapic_enable(s, env) < 0) { | |
468 | return; | |
469 | } | |
470 | patch_instruction(s, env, ip); | |
471 | } | |
472 | ||
473 | typedef struct VAPICEnableTPRReporting { | |
474 | DeviceState *apic; | |
475 | bool enable; | |
476 | } VAPICEnableTPRReporting; | |
477 | ||
478 | static void vapic_do_enable_tpr_reporting(void *data) | |
479 | { | |
480 | VAPICEnableTPRReporting *info = data; | |
481 | ||
482 | apic_enable_tpr_access_reporting(info->apic, info->enable); | |
483 | } | |
484 | ||
485 | static void vapic_enable_tpr_reporting(bool enable) | |
486 | { | |
487 | VAPICEnableTPRReporting info = { | |
488 | .enable = enable, | |
489 | }; | |
f100f0b3 | 490 | X86CPU *cpu; |
4a8fa5dc | 491 | CPUX86State *env; |
e5ad936b JK |
492 | |
493 | for (env = first_cpu; env != NULL; env = env->next_cpu) { | |
f100f0b3 | 494 | cpu = x86_env_get_cpu(env); |
e5ad936b | 495 | info.apic = env->apic_state; |
f100f0b3 | 496 | run_on_cpu(CPU(cpu), vapic_do_enable_tpr_reporting, &info); |
e5ad936b JK |
497 | } |
498 | } | |
499 | ||
500 | static void vapic_reset(DeviceState *dev) | |
501 | { | |
502 | VAPICROMState *s = DO_UPCAST(VAPICROMState, busdev.qdev, dev); | |
503 | ||
504 | if (s->state == VAPIC_ACTIVE) { | |
505 | s->state = VAPIC_STANDBY; | |
506 | } | |
507 | vapic_enable_tpr_reporting(false); | |
508 | } | |
509 | ||
510 | /* | |
511 | * Set the IRQ polling hypercalls to the supported variant: | |
512 | * - vmcall if using KVM in-kernel irqchip | |
513 | * - 32-bit VAPIC port write otherwise | |
514 | */ | |
515 | static int patch_hypercalls(VAPICROMState *s) | |
516 | { | |
a8170e5e | 517 | hwaddr rom_paddr = s->rom_state_paddr & ROM_BLOCK_MASK; |
e5ad936b JK |
518 | static const uint8_t vmcall_pattern[] = { /* vmcall */ |
519 | 0xb8, 0x1, 0, 0, 0, 0xf, 0x1, 0xc1 | |
520 | }; | |
521 | static const uint8_t outl_pattern[] = { /* nop; outl %eax,0x7e */ | |
522 | 0xb8, 0x1, 0, 0, 0, 0x90, 0xe7, 0x7e | |
523 | }; | |
524 | uint8_t alternates[2]; | |
525 | const uint8_t *pattern; | |
526 | const uint8_t *patch; | |
527 | int patches = 0; | |
528 | off_t pos; | |
529 | uint8_t *rom; | |
530 | ||
531 | rom = g_malloc(s->rom_size); | |
532 | cpu_physical_memory_rw(rom_paddr, rom, s->rom_size, 0); | |
533 | ||
534 | for (pos = 0; pos < s->rom_size - sizeof(vmcall_pattern); pos++) { | |
535 | if (kvm_irqchip_in_kernel()) { | |
536 | pattern = outl_pattern; | |
537 | alternates[0] = outl_pattern[7]; | |
538 | alternates[1] = outl_pattern[7]; | |
539 | patch = &vmcall_pattern[5]; | |
540 | } else { | |
541 | pattern = vmcall_pattern; | |
542 | alternates[0] = vmcall_pattern[7]; | |
543 | alternates[1] = 0xd9; /* AMD's VMMCALL */ | |
544 | patch = &outl_pattern[5]; | |
545 | } | |
546 | if (memcmp(rom + pos, pattern, 7) == 0 && | |
547 | (rom[pos + 7] == alternates[0] || rom[pos + 7] == alternates[1])) { | |
548 | cpu_physical_memory_rw(rom_paddr + pos + 5, (uint8_t *)patch, | |
549 | 3, 1); | |
550 | /* | |
551 | * Don't flush the tb here. Under ordinary conditions, the patched | |
552 | * calls are miles away from the current IP. Under malicious | |
553 | * conditions, the guest could trick us to crash. | |
554 | */ | |
555 | } | |
556 | } | |
557 | ||
558 | g_free(rom); | |
559 | ||
560 | if (patches != 0 && patches != 2) { | |
561 | return -1; | |
562 | } | |
563 | ||
564 | return 0; | |
565 | } | |
566 | ||
567 | /* | |
568 | * For TCG mode or the time KVM honors read-only memory regions, we need to | |
569 | * enable write access to the option ROM so that variables can be updated by | |
570 | * the guest. | |
571 | */ | |
572 | static void vapic_map_rom_writable(VAPICROMState *s) | |
573 | { | |
a8170e5e | 574 | hwaddr rom_paddr = s->rom_state_paddr & ROM_BLOCK_MASK; |
e5ad936b JK |
575 | MemoryRegionSection section; |
576 | MemoryRegion *as; | |
577 | size_t rom_size; | |
578 | uint8_t *ram; | |
579 | ||
580 | as = sysbus_address_space(&s->busdev); | |
581 | ||
582 | if (s->rom_mapped_writable) { | |
583 | memory_region_del_subregion(as, &s->rom); | |
584 | memory_region_destroy(&s->rom); | |
585 | } | |
586 | ||
587 | /* grab RAM memory region (region @rom_paddr may still be pc.rom) */ | |
588 | section = memory_region_find(as, 0, 1); | |
589 | ||
590 | /* read ROM size from RAM region */ | |
591 | ram = memory_region_get_ram_ptr(section.mr); | |
592 | rom_size = ram[rom_paddr + 2] * ROM_BLOCK_SIZE; | |
593 | s->rom_size = rom_size; | |
594 | ||
9512e4a9 | 595 | /* We need to round to avoid creating subpages |
e5ad936b | 596 | * from which we cannot run code. */ |
9512e4a9 AK |
597 | rom_size += rom_paddr & ~TARGET_PAGE_MASK; |
598 | rom_paddr &= TARGET_PAGE_MASK; | |
e5ad936b JK |
599 | rom_size = TARGET_PAGE_ALIGN(rom_size); |
600 | ||
601 | memory_region_init_alias(&s->rom, "kvmvapic-rom", section.mr, rom_paddr, | |
602 | rom_size); | |
603 | memory_region_add_subregion_overlap(as, rom_paddr, &s->rom, 1000); | |
604 | s->rom_mapped_writable = true; | |
605 | } | |
606 | ||
607 | static int vapic_prepare(VAPICROMState *s) | |
608 | { | |
609 | vapic_map_rom_writable(s); | |
610 | ||
611 | if (patch_hypercalls(s) < 0) { | |
612 | return -1; | |
613 | } | |
614 | ||
615 | vapic_enable_tpr_reporting(true); | |
616 | ||
617 | return 0; | |
618 | } | |
619 | ||
a8170e5e | 620 | static void vapic_write(void *opaque, hwaddr addr, uint64_t data, |
e5ad936b JK |
621 | unsigned int size) |
622 | { | |
4a8fa5dc | 623 | CPUX86State *env = cpu_single_env; |
a8170e5e | 624 | hwaddr rom_paddr; |
e5ad936b JK |
625 | VAPICROMState *s = opaque; |
626 | ||
627 | cpu_synchronize_state(env); | |
628 | ||
629 | /* | |
630 | * The VAPIC supports two PIO-based hypercalls, both via port 0x7E. | |
631 | * o 16-bit write access: | |
632 | * Reports the option ROM initialization to the hypervisor. Written | |
633 | * value is the offset of the state structure in the ROM. | |
634 | * o 8-bit write access: | |
635 | * Reactivates the VAPIC after a guest hibernation, i.e. after the | |
636 | * option ROM content has been re-initialized by a guest power cycle. | |
637 | * o 32-bit write access: | |
638 | * Poll for pending IRQs, considering the current VAPIC state. | |
639 | */ | |
640 | switch (size) { | |
641 | case 2: | |
642 | if (s->state == VAPIC_INACTIVE) { | |
643 | rom_paddr = (env->segs[R_CS].base + env->eip) & ROM_BLOCK_MASK; | |
644 | s->rom_state_paddr = rom_paddr + data; | |
645 | ||
646 | s->state = VAPIC_STANDBY; | |
647 | } | |
648 | if (vapic_prepare(s) < 0) { | |
649 | s->state = VAPIC_INACTIVE; | |
650 | break; | |
651 | } | |
652 | break; | |
653 | case 1: | |
654 | if (kvm_enabled()) { | |
655 | /* | |
656 | * Disable triggering instruction in ROM by writing a NOP. | |
657 | * | |
658 | * We cannot do this in TCG mode as the reported IP is not | |
659 | * accurate. | |
660 | */ | |
661 | pause_all_vcpus(); | |
662 | patch_byte(env, env->eip - 2, 0x66); | |
663 | patch_byte(env, env->eip - 1, 0x90); | |
664 | resume_all_vcpus(); | |
665 | } | |
666 | ||
667 | if (s->state == VAPIC_ACTIVE) { | |
668 | break; | |
669 | } | |
670 | if (update_rom_mapping(s, env, env->eip) < 0) { | |
671 | break; | |
672 | } | |
673 | if (find_real_tpr_addr(s, env) < 0) { | |
674 | break; | |
675 | } | |
676 | vapic_enable(s, env); | |
677 | break; | |
678 | default: | |
679 | case 4: | |
680 | if (!kvm_irqchip_in_kernel()) { | |
681 | apic_poll_irq(env->apic_state); | |
682 | } | |
683 | break; | |
684 | } | |
685 | } | |
686 | ||
687 | static const MemoryRegionOps vapic_ops = { | |
688 | .write = vapic_write, | |
689 | .endianness = DEVICE_NATIVE_ENDIAN, | |
690 | }; | |
691 | ||
692 | static int vapic_init(SysBusDevice *dev) | |
693 | { | |
694 | VAPICROMState *s = FROM_SYSBUS(VAPICROMState, dev); | |
695 | ||
696 | memory_region_init_io(&s->io, &vapic_ops, s, "kvmvapic", 2); | |
697 | sysbus_add_io(dev, VAPIC_IO_PORT, &s->io); | |
698 | sysbus_init_ioports(dev, VAPIC_IO_PORT, 2); | |
699 | ||
700 | option_rom[nb_option_roms].name = "kvmvapic.bin"; | |
701 | option_rom[nb_option_roms].bootindex = -1; | |
702 | nb_option_roms++; | |
703 | ||
704 | return 0; | |
705 | } | |
706 | ||
707 | static void do_vapic_enable(void *data) | |
708 | { | |
709 | VAPICROMState *s = data; | |
710 | ||
711 | vapic_enable(s, first_cpu); | |
712 | } | |
713 | ||
714 | static int vapic_post_load(void *opaque, int version_id) | |
715 | { | |
716 | VAPICROMState *s = opaque; | |
717 | uint8_t *zero; | |
718 | ||
719 | /* | |
720 | * The old implementation of qemu-kvm did not provide the state | |
721 | * VAPIC_STANDBY. Reconstruct it. | |
722 | */ | |
723 | if (s->state == VAPIC_INACTIVE && s->rom_state_paddr != 0) { | |
724 | s->state = VAPIC_STANDBY; | |
725 | } | |
726 | ||
727 | if (s->state != VAPIC_INACTIVE) { | |
728 | if (vapic_prepare(s) < 0) { | |
729 | return -1; | |
730 | } | |
731 | } | |
732 | if (s->state == VAPIC_ACTIVE) { | |
733 | if (smp_cpus == 1) { | |
f100f0b3 | 734 | run_on_cpu(ENV_GET_CPU(first_cpu), do_vapic_enable, s); |
e5ad936b JK |
735 | } else { |
736 | zero = g_malloc0(s->rom_state.vapic_size); | |
737 | cpu_physical_memory_rw(s->vapic_paddr, zero, | |
738 | s->rom_state.vapic_size, 1); | |
739 | g_free(zero); | |
740 | } | |
741 | } | |
742 | ||
743 | return 0; | |
744 | } | |
745 | ||
746 | static const VMStateDescription vmstate_handlers = { | |
747 | .name = "kvmvapic-handlers", | |
748 | .version_id = 1, | |
749 | .minimum_version_id = 1, | |
750 | .minimum_version_id_old = 1, | |
751 | .fields = (VMStateField[]) { | |
752 | VMSTATE_UINT32(set_tpr, VAPICHandlers), | |
753 | VMSTATE_UINT32(set_tpr_eax, VAPICHandlers), | |
754 | VMSTATE_UINT32_ARRAY(get_tpr, VAPICHandlers, 8), | |
755 | VMSTATE_UINT32(get_tpr_stack, VAPICHandlers), | |
756 | VMSTATE_END_OF_LIST() | |
757 | } | |
758 | }; | |
759 | ||
760 | static const VMStateDescription vmstate_guest_rom = { | |
761 | .name = "kvmvapic-guest-rom", | |
762 | .version_id = 1, | |
763 | .minimum_version_id = 1, | |
764 | .minimum_version_id_old = 1, | |
765 | .fields = (VMStateField[]) { | |
766 | VMSTATE_UNUSED(8), /* signature */ | |
767 | VMSTATE_UINT32(vaddr, GuestROMState), | |
768 | VMSTATE_UINT32(fixup_start, GuestROMState), | |
769 | VMSTATE_UINT32(fixup_end, GuestROMState), | |
770 | VMSTATE_UINT32(vapic_vaddr, GuestROMState), | |
771 | VMSTATE_UINT32(vapic_size, GuestROMState), | |
772 | VMSTATE_UINT32(vcpu_shift, GuestROMState), | |
773 | VMSTATE_UINT32(real_tpr_addr, GuestROMState), | |
774 | VMSTATE_STRUCT(up, GuestROMState, 0, vmstate_handlers, VAPICHandlers), | |
775 | VMSTATE_STRUCT(mp, GuestROMState, 0, vmstate_handlers, VAPICHandlers), | |
776 | VMSTATE_END_OF_LIST() | |
777 | } | |
778 | }; | |
779 | ||
780 | static const VMStateDescription vmstate_vapic = { | |
781 | .name = "kvm-tpr-opt", /* compatible with qemu-kvm VAPIC */ | |
782 | .version_id = 1, | |
783 | .minimum_version_id = 1, | |
784 | .minimum_version_id_old = 1, | |
785 | .post_load = vapic_post_load, | |
786 | .fields = (VMStateField[]) { | |
787 | VMSTATE_STRUCT(rom_state, VAPICROMState, 0, vmstate_guest_rom, | |
788 | GuestROMState), | |
789 | VMSTATE_UINT32(state, VAPICROMState), | |
790 | VMSTATE_UINT32(real_tpr_addr, VAPICROMState), | |
791 | VMSTATE_UINT32(rom_state_vaddr, VAPICROMState), | |
792 | VMSTATE_UINT32(vapic_paddr, VAPICROMState), | |
793 | VMSTATE_UINT32(rom_state_paddr, VAPICROMState), | |
794 | VMSTATE_END_OF_LIST() | |
795 | } | |
796 | }; | |
797 | ||
798 | static void vapic_class_init(ObjectClass *klass, void *data) | |
799 | { | |
800 | SysBusDeviceClass *sc = SYS_BUS_DEVICE_CLASS(klass); | |
801 | DeviceClass *dc = DEVICE_CLASS(klass); | |
802 | ||
803 | dc->no_user = 1; | |
804 | dc->reset = vapic_reset; | |
805 | dc->vmsd = &vmstate_vapic; | |
806 | sc->init = vapic_init; | |
807 | } | |
808 | ||
809 | static TypeInfo vapic_type = { | |
810 | .name = "kvmvapic", | |
811 | .parent = TYPE_SYS_BUS_DEVICE, | |
812 | .instance_size = sizeof(VAPICROMState), | |
813 | .class_init = vapic_class_init, | |
814 | }; | |
815 | ||
816 | static void vapic_register(void) | |
817 | { | |
818 | type_register_static(&vapic_type); | |
819 | } | |
820 | ||
821 | type_init(vapic_register); |