2 * TPR optimization for 32-bit Windows guests (XP and Server 2003)
4 * Copyright (C) 2007-2008 Qumranet Technologies
5 * Copyright (C) 2012 Jan Kiszka, Siemens AG
7 * This work is licensed under the terms of the GNU GPL version 2, or
8 * (at your option) any later version. See the COPYING file in the
11 #include "qemu/osdep.h"
12 #include "qemu-common.h"
14 #include "sysemu/sysemu.h"
15 #include "sysemu/cpus.h"
16 #include "sysemu/kvm.h"
17 #include "hw/i386/apic_internal.h"
18 #include "hw/sysbus.h"
20 #define VAPIC_IO_PORT 0x7e
22 #define VAPIC_CPU_SHIFT 7
24 #define ROM_BLOCK_SIZE 512
25 #define ROM_BLOCK_MASK (~(ROM_BLOCK_SIZE - 1))
27 typedef enum VAPICMode
{
33 typedef struct VAPICHandlers
{
37 uint32_t get_tpr_stack
;
38 } QEMU_PACKED VAPICHandlers
;
40 typedef struct GuestROMState
{
48 uint32_t real_tpr_addr
;
51 } QEMU_PACKED GuestROMState
;
53 typedef struct VAPICROMState
{
58 uint32_t rom_state_paddr
;
59 uint32_t rom_state_vaddr
;
61 uint32_t real_tpr_addr
;
62 GuestROMState rom_state
;
64 bool rom_mapped_writable
;
65 VMChangeStateEntry
*vmsentry
;
68 #define TYPE_VAPIC "kvmvapic"
69 #define VAPIC(obj) OBJECT_CHECK(VAPICROMState, (obj), TYPE_VAPIC)
71 #define TPR_INSTR_ABS_MODRM 0x1
72 #define TPR_INSTR_MATCH_MODRM_REG 0x2
74 typedef struct TPRInstruction
{
83 /* must be sorted by length, shortest first */
84 static const TPRInstruction tpr_instr
[] = {
85 { /* mov abs to eax */
87 .access
= TPR_ACCESS_READ
,
91 { /* mov eax to abs */
93 .access
= TPR_ACCESS_WRITE
,
97 { /* mov r32 to r/m32 */
99 .flags
= TPR_INSTR_ABS_MODRM
,
100 .access
= TPR_ACCESS_WRITE
,
104 { /* mov r/m32 to r32 */
106 .flags
= TPR_INSTR_ABS_MODRM
,
107 .access
= TPR_ACCESS_READ
,
114 .flags
= TPR_INSTR_ABS_MODRM
| TPR_INSTR_MATCH_MODRM_REG
,
115 .access
= TPR_ACCESS_READ
,
119 { /* mov imm32, r/m32 (c7/0) */
122 .flags
= TPR_INSTR_ABS_MODRM
| TPR_INSTR_MATCH_MODRM_REG
,
123 .access
= TPR_ACCESS_WRITE
,
129 static void read_guest_rom_state(VAPICROMState
*s
)
131 cpu_physical_memory_read(s
->rom_state_paddr
, &s
->rom_state
,
132 sizeof(GuestROMState
));
135 static void write_guest_rom_state(VAPICROMState
*s
)
137 cpu_physical_memory_write(s
->rom_state_paddr
, &s
->rom_state
,
138 sizeof(GuestROMState
));
141 static void update_guest_rom_state(VAPICROMState
*s
)
143 read_guest_rom_state(s
);
145 s
->rom_state
.real_tpr_addr
= cpu_to_le32(s
->real_tpr_addr
);
146 s
->rom_state
.vcpu_shift
= cpu_to_le32(VAPIC_CPU_SHIFT
);
148 write_guest_rom_state(s
);
151 static int find_real_tpr_addr(VAPICROMState
*s
, CPUX86State
*env
)
153 CPUState
*cs
= CPU(x86_env_get_cpu(env
));
157 if (s
->state
== VAPIC_ACTIVE
) {
161 * If there is no prior TPR access instruction we could analyze (which is
162 * the case after resume from hibernation), we need to scan the possible
163 * virtual address space for the APIC mapping.
165 for (addr
= 0xfffff000; addr
>= 0x80000000; addr
-= TARGET_PAGE_SIZE
) {
166 paddr
= cpu_get_phys_page_debug(cs
, addr
);
167 if (paddr
!= APIC_DEFAULT_ADDRESS
) {
170 s
->real_tpr_addr
= addr
+ 0x80;
171 update_guest_rom_state(s
);
177 static uint8_t modrm_reg(uint8_t modrm
)
179 return (modrm
>> 3) & 7;
182 static bool is_abs_modrm(uint8_t modrm
)
184 return (modrm
& 0xc7) == 0x05;
187 static bool opcode_matches(uint8_t *opcode
, const TPRInstruction
*instr
)
189 return opcode
[0] == instr
->opcode
&&
190 (!(instr
->flags
& TPR_INSTR_ABS_MODRM
) || is_abs_modrm(opcode
[1])) &&
191 (!(instr
->flags
& TPR_INSTR_MATCH_MODRM_REG
) ||
192 modrm_reg(opcode
[1]) == instr
->modrm_reg
);
195 static int evaluate_tpr_instruction(VAPICROMState
*s
, X86CPU
*cpu
,
196 target_ulong
*pip
, TPRAccess access
)
198 CPUState
*cs
= CPU(cpu
);
199 const TPRInstruction
*instr
;
200 target_ulong ip
= *pip
;
202 uint32_t real_tpr_addr
;
205 if ((ip
& 0xf0000000ULL
) != 0x80000000ULL
&&
206 (ip
& 0xf0000000ULL
) != 0xe0000000ULL
) {
211 * Early Windows 2003 SMP initialization contains a
215 * instruction that is patched by TPR optimization. The problem is that
216 * RSP, used by the patched instruction, is zero, so the guest gets a
217 * double fault and dies.
219 if (cpu
->env
.regs
[R_ESP
] == 0) {
223 if (kvm_enabled() && !kvm_irqchip_in_kernel()) {
225 * KVM without kernel-based TPR access reporting will pass an IP that
226 * points after the accessing instruction. So we need to look backward
227 * to find the reason.
229 for (i
= 0; i
< ARRAY_SIZE(tpr_instr
); i
++) {
230 instr
= &tpr_instr
[i
];
231 if (instr
->access
!= access
) {
234 if (cpu_memory_rw_debug(cs
, ip
- instr
->length
, opcode
,
235 sizeof(opcode
), 0) < 0) {
238 if (opcode_matches(opcode
, instr
)) {
245 if (cpu_memory_rw_debug(cs
, ip
, opcode
, sizeof(opcode
), 0) < 0) {
248 for (i
= 0; i
< ARRAY_SIZE(tpr_instr
); i
++) {
249 instr
= &tpr_instr
[i
];
250 if (opcode_matches(opcode
, instr
)) {
259 * Grab the virtual TPR address from the instruction
260 * and update the cached values.
262 if (cpu_memory_rw_debug(cs
, ip
+ instr
->addr_offset
,
263 (void *)&real_tpr_addr
,
264 sizeof(real_tpr_addr
), 0) < 0) {
267 real_tpr_addr
= le32_to_cpu(real_tpr_addr
);
268 if ((real_tpr_addr
& 0xfff) != 0x80) {
271 s
->real_tpr_addr
= real_tpr_addr
;
272 update_guest_rom_state(s
);
278 static int update_rom_mapping(VAPICROMState
*s
, CPUX86State
*env
, target_ulong ip
)
280 CPUState
*cs
= CPU(x86_env_get_cpu(env
));
282 uint32_t rom_state_vaddr
;
283 uint32_t pos
, patch
, offset
;
285 /* nothing to do if already activated */
286 if (s
->state
== VAPIC_ACTIVE
) {
290 /* bail out if ROM init code was not executed (missing ROM?) */
291 if (s
->state
== VAPIC_INACTIVE
) {
295 /* find out virtual address of the ROM */
296 rom_state_vaddr
= s
->rom_state_paddr
+ (ip
& 0xf0000000);
297 paddr
= cpu_get_phys_page_debug(cs
, rom_state_vaddr
);
301 paddr
+= rom_state_vaddr
& ~TARGET_PAGE_MASK
;
302 if (paddr
!= s
->rom_state_paddr
) {
305 read_guest_rom_state(s
);
306 if (memcmp(s
->rom_state
.signature
, "kvm aPiC", 8) != 0) {
309 s
->rom_state_vaddr
= rom_state_vaddr
;
311 /* fixup addresses in ROM if needed */
312 if (rom_state_vaddr
== le32_to_cpu(s
->rom_state
.vaddr
)) {
315 for (pos
= le32_to_cpu(s
->rom_state
.fixup_start
);
316 pos
< le32_to_cpu(s
->rom_state
.fixup_end
);
318 cpu_physical_memory_read(paddr
+ pos
- s
->rom_state
.vaddr
,
319 &offset
, sizeof(offset
));
320 offset
= le32_to_cpu(offset
);
321 cpu_physical_memory_read(paddr
+ offset
, &patch
, sizeof(patch
));
322 patch
= le32_to_cpu(patch
);
323 patch
+= rom_state_vaddr
- le32_to_cpu(s
->rom_state
.vaddr
);
324 patch
= cpu_to_le32(patch
);
325 cpu_physical_memory_write(paddr
+ offset
, &patch
, sizeof(patch
));
327 read_guest_rom_state(s
);
328 s
->vapic_paddr
= paddr
+ le32_to_cpu(s
->rom_state
.vapic_vaddr
) -
329 le32_to_cpu(s
->rom_state
.vaddr
);
335 * Tries to read the unique processor number from the Kernel Processor Control
336 * Region (KPCR) of 32-bit Windows XP and Server 2003. Returns -1 if the KPCR
337 * cannot be accessed or is considered invalid. This also ensures that we are
338 * not patching the wrong guest.
340 static int get_kpcr_number(X86CPU
*cpu
)
342 CPUX86State
*env
= &cpu
->env
;
350 if (cpu_memory_rw_debug(CPU(cpu
), env
->segs
[R_FS
].base
,
351 (void *)&kpcr
, sizeof(kpcr
), 0) < 0 ||
352 kpcr
.self
!= env
->segs
[R_FS
].base
) {
358 static int vapic_enable(VAPICROMState
*s
, X86CPU
*cpu
)
360 int cpu_number
= get_kpcr_number(cpu
);
362 static const uint8_t enabled
= 1;
364 if (cpu_number
< 0) {
367 vapic_paddr
= s
->vapic_paddr
+
368 (((hwaddr
)cpu_number
) << VAPIC_CPU_SHIFT
);
369 cpu_physical_memory_write(vapic_paddr
+ offsetof(VAPICState
, enabled
),
370 &enabled
, sizeof(enabled
));
371 apic_enable_vapic(cpu
->apic_state
, vapic_paddr
);
373 s
->state
= VAPIC_ACTIVE
;
378 static void patch_byte(X86CPU
*cpu
, target_ulong addr
, uint8_t byte
)
380 cpu_memory_rw_debug(CPU(cpu
), addr
, &byte
, 1, 1);
383 static void patch_call(VAPICROMState
*s
, X86CPU
*cpu
, target_ulong ip
,
388 offset
= cpu_to_le32(target
- ip
- 5);
389 patch_byte(cpu
, ip
, 0xe8); /* call near */
390 cpu_memory_rw_debug(CPU(cpu
), ip
+ 1, (void *)&offset
, sizeof(offset
), 1);
393 static void patch_instruction(VAPICROMState
*s
, X86CPU
*cpu
, target_ulong ip
)
395 CPUState
*cs
= CPU(cpu
);
396 CPUX86State
*env
= &cpu
->env
;
397 VAPICHandlers
*handlers
;
400 target_ulong current_pc
= 0;
401 target_ulong current_cs_base
= 0;
402 uint32_t current_flags
= 0;
405 handlers
= &s
->rom_state
.up
;
407 handlers
= &s
->rom_state
.mp
;
410 if (!kvm_enabled()) {
411 cpu_get_tb_cpu_state(env
, ¤t_pc
, ¤t_cs_base
,
417 cpu_memory_rw_debug(cs
, ip
, opcode
, sizeof(opcode
), 0);
420 case 0x89: /* mov r32 to r/m32 */
421 patch_byte(cpu
, ip
, 0x50 + modrm_reg(opcode
[1])); /* push reg */
422 patch_call(s
, cpu
, ip
+ 1, handlers
->set_tpr
);
424 case 0x8b: /* mov r/m32 to r32 */
425 patch_byte(cpu
, ip
, 0x90);
426 patch_call(s
, cpu
, ip
+ 1, handlers
->get_tpr
[modrm_reg(opcode
[1])]);
428 case 0xa1: /* mov abs to eax */
429 patch_call(s
, cpu
, ip
, handlers
->get_tpr
[0]);
431 case 0xa3: /* mov eax to abs */
432 patch_call(s
, cpu
, ip
, handlers
->set_tpr_eax
);
434 case 0xc7: /* mov imm32, r/m32 (c7/0) */
435 patch_byte(cpu
, ip
, 0x68); /* push imm32 */
436 cpu_memory_rw_debug(cs
, ip
+ 6, (void *)&imm32
, sizeof(imm32
), 0);
437 cpu_memory_rw_debug(cs
, ip
+ 1, (void *)&imm32
, sizeof(imm32
), 1);
438 patch_call(s
, cpu
, ip
+ 5, handlers
->set_tpr
);
440 case 0xff: /* push r/m32 */
441 patch_byte(cpu
, ip
, 0x50); /* push eax */
442 patch_call(s
, cpu
, ip
+ 1, handlers
->get_tpr_stack
);
450 if (!kvm_enabled()) {
451 tb_gen_code(cs
, current_pc
, current_cs_base
, current_flags
, 1);
452 cpu_resume_from_signal(cs
, NULL
);
456 void vapic_report_tpr_access(DeviceState
*dev
, CPUState
*cs
, target_ulong ip
,
459 VAPICROMState
*s
= VAPIC(dev
);
460 X86CPU
*cpu
= X86_CPU(cs
);
461 CPUX86State
*env
= &cpu
->env
;
463 cpu_synchronize_state(cs
);
465 if (evaluate_tpr_instruction(s
, cpu
, &ip
, access
) < 0) {
466 if (s
->state
== VAPIC_ACTIVE
) {
467 vapic_enable(s
, cpu
);
471 if (update_rom_mapping(s
, env
, ip
) < 0) {
474 if (vapic_enable(s
, cpu
) < 0) {
477 patch_instruction(s
, cpu
, ip
);
480 typedef struct VAPICEnableTPRReporting
{
483 } VAPICEnableTPRReporting
;
485 static void vapic_do_enable_tpr_reporting(void *data
)
487 VAPICEnableTPRReporting
*info
= data
;
489 apic_enable_tpr_access_reporting(info
->apic
, info
->enable
);
492 static void vapic_enable_tpr_reporting(bool enable
)
494 VAPICEnableTPRReporting info
= {
502 info
.apic
= cpu
->apic_state
;
503 run_on_cpu(cs
, vapic_do_enable_tpr_reporting
, &info
);
507 static void vapic_reset(DeviceState
*dev
)
509 VAPICROMState
*s
= VAPIC(dev
);
511 s
->state
= VAPIC_INACTIVE
;
512 s
->rom_state_paddr
= 0;
513 vapic_enable_tpr_reporting(false);
517 * Set the IRQ polling hypercalls to the supported variant:
518 * - vmcall if using KVM in-kernel irqchip
519 * - 32-bit VAPIC port write otherwise
521 static int patch_hypercalls(VAPICROMState
*s
)
523 hwaddr rom_paddr
= s
->rom_state_paddr
& ROM_BLOCK_MASK
;
524 static const uint8_t vmcall_pattern
[] = { /* vmcall */
525 0xb8, 0x1, 0, 0, 0, 0xf, 0x1, 0xc1
527 static const uint8_t outl_pattern
[] = { /* nop; outl %eax,0x7e */
528 0xb8, 0x1, 0, 0, 0, 0x90, 0xe7, 0x7e
530 uint8_t alternates
[2];
531 const uint8_t *pattern
;
532 const uint8_t *patch
;
537 rom
= g_malloc(s
->rom_size
);
538 cpu_physical_memory_read(rom_paddr
, rom
, s
->rom_size
);
540 for (pos
= 0; pos
< s
->rom_size
- sizeof(vmcall_pattern
); pos
++) {
541 if (kvm_irqchip_in_kernel()) {
542 pattern
= outl_pattern
;
543 alternates
[0] = outl_pattern
[7];
544 alternates
[1] = outl_pattern
[7];
545 patch
= &vmcall_pattern
[5];
547 pattern
= vmcall_pattern
;
548 alternates
[0] = vmcall_pattern
[7];
549 alternates
[1] = 0xd9; /* AMD's VMMCALL */
550 patch
= &outl_pattern
[5];
552 if (memcmp(rom
+ pos
, pattern
, 7) == 0 &&
553 (rom
[pos
+ 7] == alternates
[0] || rom
[pos
+ 7] == alternates
[1])) {
554 cpu_physical_memory_write(rom_paddr
+ pos
+ 5, patch
, 3);
556 * Don't flush the tb here. Under ordinary conditions, the patched
557 * calls are miles away from the current IP. Under malicious
558 * conditions, the guest could trick us to crash.
565 if (patches
!= 0 && patches
!= 2) {
573 * For TCG mode or the time KVM honors read-only memory regions, we need to
574 * enable write access to the option ROM so that variables can be updated by
577 static int vapic_map_rom_writable(VAPICROMState
*s
)
579 hwaddr rom_paddr
= s
->rom_state_paddr
& ROM_BLOCK_MASK
;
580 MemoryRegionSection section
;
585 as
= sysbus_address_space(&s
->busdev
);
587 if (s
->rom_mapped_writable
) {
588 memory_region_del_subregion(as
, &s
->rom
);
589 object_unparent(OBJECT(&s
->rom
));
592 /* grab RAM memory region (region @rom_paddr may still be pc.rom) */
593 section
= memory_region_find(as
, 0, 1);
595 /* read ROM size from RAM region */
596 if (rom_paddr
+ 2 >= memory_region_size(section
.mr
)) {
599 ram
= memory_region_get_ram_ptr(section
.mr
);
600 rom_size
= ram
[rom_paddr
+ 2] * ROM_BLOCK_SIZE
;
604 s
->rom_size
= rom_size
;
606 /* We need to round to avoid creating subpages
607 * from which we cannot run code. */
608 rom_size
+= rom_paddr
& ~TARGET_PAGE_MASK
;
609 rom_paddr
&= TARGET_PAGE_MASK
;
610 rom_size
= TARGET_PAGE_ALIGN(rom_size
);
612 memory_region_init_alias(&s
->rom
, OBJECT(s
), "kvmvapic-rom", section
.mr
,
613 rom_paddr
, rom_size
);
614 memory_region_add_subregion_overlap(as
, rom_paddr
, &s
->rom
, 1000);
615 s
->rom_mapped_writable
= true;
616 memory_region_unref(section
.mr
);
621 static int vapic_prepare(VAPICROMState
*s
)
623 if (vapic_map_rom_writable(s
) < 0) {
627 if (patch_hypercalls(s
) < 0) {
631 vapic_enable_tpr_reporting(true);
636 static void vapic_write(void *opaque
, hwaddr addr
, uint64_t data
,
639 VAPICROMState
*s
= opaque
;
648 cpu_synchronize_state(current_cpu
);
649 cpu
= X86_CPU(current_cpu
);
653 * The VAPIC supports two PIO-based hypercalls, both via port 0x7E.
654 * o 16-bit write access:
655 * Reports the option ROM initialization to the hypervisor. Written
656 * value is the offset of the state structure in the ROM.
657 * o 8-bit write access:
658 * Reactivates the VAPIC after a guest hibernation, i.e. after the
659 * option ROM content has been re-initialized by a guest power cycle.
660 * o 32-bit write access:
661 * Poll for pending IRQs, considering the current VAPIC state.
665 if (s
->state
== VAPIC_INACTIVE
) {
666 rom_paddr
= (env
->segs
[R_CS
].base
+ env
->eip
) & ROM_BLOCK_MASK
;
667 s
->rom_state_paddr
= rom_paddr
+ data
;
669 s
->state
= VAPIC_STANDBY
;
671 if (vapic_prepare(s
) < 0) {
672 s
->state
= VAPIC_INACTIVE
;
673 s
->rom_state_paddr
= 0;
680 * Disable triggering instruction in ROM by writing a NOP.
682 * We cannot do this in TCG mode as the reported IP is not
686 patch_byte(cpu
, env
->eip
- 2, 0x66);
687 patch_byte(cpu
, env
->eip
- 1, 0x90);
691 if (s
->state
== VAPIC_ACTIVE
) {
694 if (update_rom_mapping(s
, env
, env
->eip
) < 0) {
697 if (find_real_tpr_addr(s
, env
) < 0) {
700 vapic_enable(s
, cpu
);
704 if (!kvm_irqchip_in_kernel()) {
705 apic_poll_irq(cpu
->apic_state
);
711 static uint64_t vapic_read(void *opaque
, hwaddr addr
, unsigned size
)
716 static const MemoryRegionOps vapic_ops
= {
717 .write
= vapic_write
,
719 .endianness
= DEVICE_NATIVE_ENDIAN
,
722 static void vapic_realize(DeviceState
*dev
, Error
**errp
)
724 SysBusDevice
*sbd
= SYS_BUS_DEVICE(dev
);
725 VAPICROMState
*s
= VAPIC(dev
);
727 memory_region_init_io(&s
->io
, OBJECT(s
), &vapic_ops
, s
, "kvmvapic", 2);
728 sysbus_add_io(sbd
, VAPIC_IO_PORT
, &s
->io
);
729 sysbus_init_ioports(sbd
, VAPIC_IO_PORT
, 2);
731 option_rom
[nb_option_roms
].name
= "kvmvapic.bin";
732 option_rom
[nb_option_roms
].bootindex
= -1;
736 static void do_vapic_enable(void *data
)
738 VAPICROMState
*s
= data
;
739 X86CPU
*cpu
= X86_CPU(first_cpu
);
741 static const uint8_t enabled
= 1;
742 cpu_physical_memory_write(s
->vapic_paddr
+ offsetof(VAPICState
, enabled
),
743 &enabled
, sizeof(enabled
));
744 apic_enable_vapic(cpu
->apic_state
, s
->vapic_paddr
);
745 s
->state
= VAPIC_ACTIVE
;
748 static void kvmvapic_vm_state_change(void *opaque
, int running
,
751 VAPICROMState
*s
= opaque
;
758 if (s
->state
== VAPIC_ACTIVE
) {
760 run_on_cpu(first_cpu
, do_vapic_enable
, s
);
762 zero
= g_malloc0(s
->rom_state
.vapic_size
);
763 cpu_physical_memory_write(s
->vapic_paddr
, zero
,
764 s
->rom_state
.vapic_size
);
769 qemu_del_vm_change_state_handler(s
->vmsentry
);
772 static int vapic_post_load(void *opaque
, int version_id
)
774 VAPICROMState
*s
= opaque
;
777 * The old implementation of qemu-kvm did not provide the state
778 * VAPIC_STANDBY. Reconstruct it.
780 if (s
->state
== VAPIC_INACTIVE
&& s
->rom_state_paddr
!= 0) {
781 s
->state
= VAPIC_STANDBY
;
784 if (s
->state
!= VAPIC_INACTIVE
) {
785 if (vapic_prepare(s
) < 0) {
792 qemu_add_vm_change_state_handler(kvmvapic_vm_state_change
, s
);
797 static const VMStateDescription vmstate_handlers
= {
798 .name
= "kvmvapic-handlers",
800 .minimum_version_id
= 1,
801 .fields
= (VMStateField
[]) {
802 VMSTATE_UINT32(set_tpr
, VAPICHandlers
),
803 VMSTATE_UINT32(set_tpr_eax
, VAPICHandlers
),
804 VMSTATE_UINT32_ARRAY(get_tpr
, VAPICHandlers
, 8),
805 VMSTATE_UINT32(get_tpr_stack
, VAPICHandlers
),
806 VMSTATE_END_OF_LIST()
810 static const VMStateDescription vmstate_guest_rom
= {
811 .name
= "kvmvapic-guest-rom",
813 .minimum_version_id
= 1,
814 .fields
= (VMStateField
[]) {
815 VMSTATE_UNUSED(8), /* signature */
816 VMSTATE_UINT32(vaddr
, GuestROMState
),
817 VMSTATE_UINT32(fixup_start
, GuestROMState
),
818 VMSTATE_UINT32(fixup_end
, GuestROMState
),
819 VMSTATE_UINT32(vapic_vaddr
, GuestROMState
),
820 VMSTATE_UINT32(vapic_size
, GuestROMState
),
821 VMSTATE_UINT32(vcpu_shift
, GuestROMState
),
822 VMSTATE_UINT32(real_tpr_addr
, GuestROMState
),
823 VMSTATE_STRUCT(up
, GuestROMState
, 0, vmstate_handlers
, VAPICHandlers
),
824 VMSTATE_STRUCT(mp
, GuestROMState
, 0, vmstate_handlers
, VAPICHandlers
),
825 VMSTATE_END_OF_LIST()
829 static const VMStateDescription vmstate_vapic
= {
830 .name
= "kvm-tpr-opt", /* compatible with qemu-kvm VAPIC */
832 .minimum_version_id
= 1,
833 .post_load
= vapic_post_load
,
834 .fields
= (VMStateField
[]) {
835 VMSTATE_STRUCT(rom_state
, VAPICROMState
, 0, vmstate_guest_rom
,
837 VMSTATE_UINT32(state
, VAPICROMState
),
838 VMSTATE_UINT32(real_tpr_addr
, VAPICROMState
),
839 VMSTATE_UINT32(rom_state_vaddr
, VAPICROMState
),
840 VMSTATE_UINT32(vapic_paddr
, VAPICROMState
),
841 VMSTATE_UINT32(rom_state_paddr
, VAPICROMState
),
842 VMSTATE_END_OF_LIST()
846 static void vapic_class_init(ObjectClass
*klass
, void *data
)
848 DeviceClass
*dc
= DEVICE_CLASS(klass
);
850 dc
->reset
= vapic_reset
;
851 dc
->vmsd
= &vmstate_vapic
;
852 dc
->realize
= vapic_realize
;
855 static const TypeInfo vapic_type
= {
857 .parent
= TYPE_SYS_BUS_DEVICE
,
858 .instance_size
= sizeof(VAPICROMState
),
859 .class_init
= vapic_class_init
,
862 static void vapic_register(void)
864 type_register_static(&vapic_type
);
867 type_init(vapic_register
);