hw/i386/kvmvapic.c

   1 /*
   2  * TPR optimization for 32-bit Windows guests (XP and Server 2003)
   3  *
   4  * Copyright (C) 2007-2008 Qumranet Technologies
   5  * Copyright (C) 2012      Jan Kiszka, Siemens AG
   6  *
   7  * This work is licensed under the terms of the GNU GPL version 2, or
   8  * (at your option) any later version. See the COPYING file in the
   9  * top-level directory.
  10  */
  11 #include "qemu/osdep.h"
  12 #include "qemu-common.h"
  13 #include "cpu.h"
  14 #include "exec/exec-all.h"
  15 #include "sysemu/sysemu.h"
  16 #include "sysemu/cpus.h"
  17 #include "sysemu/kvm.h"
  18 #include "hw/i386/apic_internal.h"
  19 #include "hw/sysbus.h"
  20
  21 #define VAPIC_IO_PORT           0x7e
  22
  23 #define VAPIC_CPU_SHIFT         7
  24
  25 #define ROM_BLOCK_SIZE          512
  26 #define ROM_BLOCK_MASK          (~(ROM_BLOCK_SIZE - 1))
  27
  28 typedef enum VAPICMode {
  29     VAPIC_INACTIVE = 0,
  30     VAPIC_ACTIVE   = 1,
  31     VAPIC_STANDBY  = 2,
  32 } VAPICMode;
  33
  34 typedef struct VAPICHandlers {
  35     uint32_t set_tpr;
  36     uint32_t set_tpr_eax;
  37     uint32_t get_tpr[8];
  38     uint32_t get_tpr_stack;
  39 } QEMU_PACKED VAPICHandlers;
  40
  41 typedef struct GuestROMState {
  42     char signature[8];
  43     uint32_t vaddr;
  44     uint32_t fixup_start;
  45     uint32_t fixup_end;
  46     uint32_t vapic_vaddr;
  47     uint32_t vapic_size;
  48     uint32_t vcpu_shift;
  49     uint32_t real_tpr_addr;
  50     VAPICHandlers up;
  51     VAPICHandlers mp;
  52 } QEMU_PACKED GuestROMState;
  53
  54 typedef struct VAPICROMState {
  55     SysBusDevice busdev;
  56     MemoryRegion io;
  57     MemoryRegion rom;
  58     uint32_t state;
  59     uint32_t rom_state_paddr;
  60     uint32_t rom_state_vaddr;
  61     uint32_t vapic_paddr;
  62     uint32_t real_tpr_addr;
  63     GuestROMState rom_state;
  64     size_t rom_size;
  65     bool rom_mapped_writable;
  66     VMChangeStateEntry *vmsentry;
  67 } VAPICROMState;
  68
  69 #define TYPE_VAPIC "kvmvapic"
  70 #define VAPIC(obj) OBJECT_CHECK(VAPICROMState, (obj), TYPE_VAPIC)
  71
  72 #define TPR_INSTR_ABS_MODRM             0x1
  73 #define TPR_INSTR_MATCH_MODRM_REG       0x2
  74
  75 typedef struct TPRInstruction {
  76     uint8_t opcode;
  77     uint8_t modrm_reg;
  78     unsigned int flags;
  79     TPRAccess access;
  80     size_t length;
  81     off_t addr_offset;
  82 } TPRInstruction;
  83
  84 /* must be sorted by length, shortest first */
  85 static const TPRInstruction tpr_instr[] = {
  86     { /* mov abs to eax */
  87         .opcode = 0xa1,
  88         .access = TPR_ACCESS_READ,
  89         .length = 5,
  90         .addr_offset = 1,
  91     },
  92     { /* mov eax to abs */
  93         .opcode = 0xa3,
  94         .access = TPR_ACCESS_WRITE,
  95         .length = 5,
  96         .addr_offset = 1,
  97     },
  98     { /* mov r32 to r/m32 */
  99         .opcode = 0x89,
 100         .flags = TPR_INSTR_ABS_MODRM,
 101         .access = TPR_ACCESS_WRITE,
 102         .length = 6,
 103         .addr_offset = 2,
 104     },
 105     { /* mov r/m32 to r32 */
 106         .opcode = 0x8b,
 107         .flags = TPR_INSTR_ABS_MODRM,
 108         .access = TPR_ACCESS_READ,
 109         .length = 6,
 110         .addr_offset = 2,
 111     },
 112     { /* push r/m32 */
 113         .opcode = 0xff,
 114         .modrm_reg = 6,
 115         .flags = TPR_INSTR_ABS_MODRM | TPR_INSTR_MATCH_MODRM_REG,
 116         .access = TPR_ACCESS_READ,
 117         .length = 6,
 118         .addr_offset = 2,
 119     },
 120     { /* mov imm32, r/m32 (c7/0) */
 121         .opcode = 0xc7,
 122         .modrm_reg = 0,
 123         .flags = TPR_INSTR_ABS_MODRM | TPR_INSTR_MATCH_MODRM_REG,
 124         .access = TPR_ACCESS_WRITE,
 125         .length = 10,
 126         .addr_offset = 2,
 127     },
 128 };
 129
 130 static void read_guest_rom_state(VAPICROMState *s)
 131 {
 132     cpu_physical_memory_read(s->rom_state_paddr, &s->rom_state,
 133                              sizeof(GuestROMState));
 134 }
 135
 136 static void write_guest_rom_state(VAPICROMState *s)
 137 {
 138     cpu_physical_memory_write(s->rom_state_paddr, &s->rom_state,
 139                               sizeof(GuestROMState));
 140 }
 141
 142 static void update_guest_rom_state(VAPICROMState *s)
 143 {
 144     read_guest_rom_state(s);
 145
 146     s->rom_state.real_tpr_addr = cpu_to_le32(s->real_tpr_addr);
 147     s->rom_state.vcpu_shift = cpu_to_le32(VAPIC_CPU_SHIFT);
 148
 149     write_guest_rom_state(s);
 150 }
 151
 152 static int find_real_tpr_addr(VAPICROMState *s, CPUX86State *env)
 153 {
 154     CPUState *cs = CPU(x86_env_get_cpu(env));
 155     hwaddr paddr;
 156     target_ulong addr;
 157
 158     if (s->state == VAPIC_ACTIVE) {
 159         return 0;
 160     }
 161     /*
 162      * If there is no prior TPR access instruction we could analyze (which is
 163      * the case after resume from hibernation), we need to scan the possible
 164      * virtual address space for the APIC mapping.
 165      */
 166     for (addr = 0xfffff000; addr >= 0x80000000; addr -= TARGET_PAGE_SIZE) {
 167         paddr = cpu_get_phys_page_debug(cs, addr);
 168         if (paddr != APIC_DEFAULT_ADDRESS) {
 169             continue;
 170         }
 171         s->real_tpr_addr = addr + 0x80;
 172         update_guest_rom_state(s);
 173         return 0;
 174     }
 175     return -1;
 176 }
 177
 178 static uint8_t modrm_reg(uint8_t modrm)
 179 {
 180     return (modrm >> 3) & 7;
 181 }
 182
 183 static bool is_abs_modrm(uint8_t modrm)
 184 {
 185     return (modrm & 0xc7) == 0x05;
 186 }
 187
 188 static bool opcode_matches(uint8_t *opcode, const TPRInstruction *instr)
 189 {
 190     return opcode[0] == instr->opcode &&
 191         (!(instr->flags & TPR_INSTR_ABS_MODRM) || is_abs_modrm(opcode[1])) &&
 192         (!(instr->flags & TPR_INSTR_MATCH_MODRM_REG) ||
 193          modrm_reg(opcode[1]) == instr->modrm_reg);
 194 }
 195
 196 static int evaluate_tpr_instruction(VAPICROMState *s, X86CPU *cpu,
 197                                     target_ulong *pip, TPRAccess access)
 198 {
 199     CPUState *cs = CPU(cpu);
 200     const TPRInstruction *instr;
 201     target_ulong ip = *pip;
 202     uint8_t opcode[2];
 203     uint32_t real_tpr_addr;
 204     int i;
 205
 206     if ((ip & 0xf0000000ULL) != 0x80000000ULL &&
 207         (ip & 0xf0000000ULL) != 0xe0000000ULL) {
 208         return -1;
 209     }
 210
 211     /*
 212      * Early Windows 2003 SMP initialization contains a
 213      *
 214      *   mov imm32, r/m32
 215      *
 216      * instruction that is patched by TPR optimization. The problem is that
 217      * RSP, used by the patched instruction, is zero, so the guest gets a
 218      * double fault and dies.
 219      */
 220     if (cpu->env.regs[R_ESP] == 0) {
 221         return -1;
 222     }
 223
 224     if (kvm_enabled() && !kvm_irqchip_in_kernel()) {
 225         /*
 226          * KVM without kernel-based TPR access reporting will pass an IP that
 227          * points after the accessing instruction. So we need to look backward
 228          * to find the reason.
 229          */
 230         for (i = 0; i < ARRAY_SIZE(tpr_instr); i++) {
 231             instr = &tpr_instr[i];
 232             if (instr->access != access) {
 233                 continue;
 234             }
 235             if (cpu_memory_rw_debug(cs, ip - instr->length, opcode,
 236                                     sizeof(opcode), 0) < 0) {
 237                 return -1;
 238             }
 239             if (opcode_matches(opcode, instr)) {
 240                 ip -= instr->length;
 241                 goto instruction_ok;
 242             }
 243         }
 244         return -1;
 245     } else {
 246         if (cpu_memory_rw_debug(cs, ip, opcode, sizeof(opcode), 0) < 0) {
 247             return -1;
 248         }
 249         for (i = 0; i < ARRAY_SIZE(tpr_instr); i++) {
 250             instr = &tpr_instr[i];
 251             if (opcode_matches(opcode, instr)) {
 252                 goto instruction_ok;
 253             }
 254         }
 255         return -1;
 256     }
 257
 258 instruction_ok:
 259     /*
 260      * Grab the virtual TPR address from the instruction
 261      * and update the cached values.
 262      */
 263     if (cpu_memory_rw_debug(cs, ip + instr->addr_offset,
 264                             (void *)&real_tpr_addr,
 265                             sizeof(real_tpr_addr), 0) < 0) {
 266         return -1;
 267     }
 268     real_tpr_addr = le32_to_cpu(real_tpr_addr);
 269     if ((real_tpr_addr & 0xfff) != 0x80) {
 270         return -1;
 271     }
 272     s->real_tpr_addr = real_tpr_addr;
 273     update_guest_rom_state(s);
 274
 275     *pip = ip;
 276     return 0;
 277 }
 278
 279 static int update_rom_mapping(VAPICROMState *s, CPUX86State *env, target_ulong ip)
 280 {
 281     CPUState *cs = CPU(x86_env_get_cpu(env));
 282     hwaddr paddr;
 283     uint32_t rom_state_vaddr;
 284     uint32_t pos, patch, offset;
 285
 286     /* nothing to do if already activated */
 287     if (s->state == VAPIC_ACTIVE) {
 288         return 0;
 289     }
 290
 291     /* bail out if ROM init code was not executed (missing ROM?) */
 292     if (s->state == VAPIC_INACTIVE) {
 293         return -1;
 294     }
 295
 296     /* find out virtual address of the ROM */
 297     rom_state_vaddr = s->rom_state_paddr + (ip & 0xf0000000);
 298     paddr = cpu_get_phys_page_debug(cs, rom_state_vaddr);
 299     if (paddr == -1) {
 300         return -1;
 301     }
 302     paddr += rom_state_vaddr & ~TARGET_PAGE_MASK;
 303     if (paddr != s->rom_state_paddr) {
 304         return -1;
 305     }
 306     read_guest_rom_state(s);
 307     if (memcmp(s->rom_state.signature, "kvm aPiC", 8) != 0) {
 308         return -1;
 309     }
 310     s->rom_state_vaddr = rom_state_vaddr;
 311
 312     /* fixup addresses in ROM if needed */
 313     if (rom_state_vaddr == le32_to_cpu(s->rom_state.vaddr)) {
 314         return 0;
 315     }
 316     for (pos = le32_to_cpu(s->rom_state.fixup_start);
 317          pos < le32_to_cpu(s->rom_state.fixup_end);
 318          pos += 4) {
 319         cpu_physical_memory_read(paddr + pos - s->rom_state.vaddr,
 320                                  &offset, sizeof(offset));
 321         offset = le32_to_cpu(offset);
 322         cpu_physical_memory_read(paddr + offset, &patch, sizeof(patch));
 323         patch = le32_to_cpu(patch);
 324         patch += rom_state_vaddr - le32_to_cpu(s->rom_state.vaddr);
 325         patch = cpu_to_le32(patch);
 326         cpu_physical_memory_write(paddr + offset, &patch, sizeof(patch));
 327     }
 328     read_guest_rom_state(s);
 329     s->vapic_paddr = paddr + le32_to_cpu(s->rom_state.vapic_vaddr) -
 330         le32_to_cpu(s->rom_state.vaddr);
 331
 332     return 0;
 333 }
 334
 335 /*
 336  * Tries to read the unique processor number from the Kernel Processor Control
 337  * Region (KPCR) of 32-bit Windows XP and Server 2003. Returns -1 if the KPCR
 338  * cannot be accessed or is considered invalid. This also ensures that we are
 339  * not patching the wrong guest.
 340  */
 341 static int get_kpcr_number(X86CPU *cpu)
 342 {
 343     CPUX86State *env = &cpu->env;
 344     struct kpcr {
 345         uint8_t  fill1[0x1c];
 346         uint32_t self;
 347         uint8_t  fill2[0x31];
 348         uint8_t  number;
 349     } QEMU_PACKED kpcr;
 350
 351     if (cpu_memory_rw_debug(CPU(cpu), env->segs[R_FS].base,
 352                             (void *)&kpcr, sizeof(kpcr), 0) < 0 ||
 353         kpcr.self != env->segs[R_FS].base) {
 354         return -1;
 355     }
 356     return kpcr.number;
 357 }
 358
 359 static int vapic_enable(VAPICROMState *s, X86CPU *cpu)
 360 {
 361     int cpu_number = get_kpcr_number(cpu);
 362     hwaddr vapic_paddr;
 363     static const uint8_t enabled = 1;
 364
 365     if (cpu_number < 0) {
 366         return -1;
 367     }
 368     vapic_paddr = s->vapic_paddr +
 369         (((hwaddr)cpu_number) << VAPIC_CPU_SHIFT);
 370     cpu_physical_memory_write(vapic_paddr + offsetof(VAPICState, enabled),
 371                               &enabled, sizeof(enabled));
 372     apic_enable_vapic(cpu->apic_state, vapic_paddr);
 373
 374     s->state = VAPIC_ACTIVE;
 375
 376     return 0;
 377 }
 378
 379 static void patch_byte(X86CPU *cpu, target_ulong addr, uint8_t byte)
 380 {
 381     cpu_memory_rw_debug(CPU(cpu), addr, &byte, 1, 1);
 382 }
 383
 384 static void patch_call(VAPICROMState *s, X86CPU *cpu, target_ulong ip,
 385                        uint32_t target)
 386 {
 387     uint32_t offset;
 388
 389     offset = cpu_to_le32(target - ip - 5);
 390     patch_byte(cpu, ip, 0xe8); /* call near */
 391     cpu_memory_rw_debug(CPU(cpu), ip + 1, (void *)&offset, sizeof(offset), 1);
 392 }
 393
 394 static void patch_instruction(VAPICROMState *s, X86CPU *cpu, target_ulong ip)
 395 {
 396     CPUState *cs = CPU(cpu);
 397     CPUX86State *env = &cpu->env;
 398     VAPICHandlers *handlers;
 399     uint8_t opcode[2];
 400     uint32_t imm32;
 401     target_ulong current_pc = 0;
 402     target_ulong current_cs_base = 0;
 403     uint32_t current_flags = 0;
 404
 405     if (smp_cpus == 1) {
 406         handlers = &s->rom_state.up;
 407     } else {
 408         handlers = &s->rom_state.mp;
 409     }
 410
 411     if (!kvm_enabled()) {
 412         cpu_get_tb_cpu_state(env, &current_pc, &current_cs_base,
 413                              &current_flags);
 414     }
 415
 416     pause_all_vcpus();
 417
 418     cpu_memory_rw_debug(cs, ip, opcode, sizeof(opcode), 0);
 419
 420     switch (opcode[0]) {
 421     case 0x89: /* mov r32 to r/m32 */
 422         patch_byte(cpu, ip, 0x50 + modrm_reg(opcode[1]));  /* push reg */
 423         patch_call(s, cpu, ip + 1, handlers->set_tpr);
 424         break;
 425     case 0x8b: /* mov r/m32 to r32 */
 426         patch_byte(cpu, ip, 0x90);
 427         patch_call(s, cpu, ip + 1, handlers->get_tpr[modrm_reg(opcode[1])]);
 428         break;
 429     case 0xa1: /* mov abs to eax */
 430         patch_call(s, cpu, ip, handlers->get_tpr[0]);
 431         break;
 432     case 0xa3: /* mov eax to abs */
 433         patch_call(s, cpu, ip, handlers->set_tpr_eax);
 434         break;
 435     case 0xc7: /* mov imm32, r/m32 (c7/0) */
 436         patch_byte(cpu, ip, 0x68);  /* push imm32 */
 437         cpu_memory_rw_debug(cs, ip + 6, (void *)&imm32, sizeof(imm32), 0);
 438         cpu_memory_rw_debug(cs, ip + 1, (void *)&imm32, sizeof(imm32), 1);
 439         patch_call(s, cpu, ip + 5, handlers->set_tpr);
 440         break;
 441     case 0xff: /* push r/m32 */
 442         patch_byte(cpu, ip, 0x50); /* push eax */
 443         patch_call(s, cpu, ip + 1, handlers->get_tpr_stack);
 444         break;
 445     default:
 446         abort();
 447     }
 448
 449     resume_all_vcpus();
 450
 451     if (!kvm_enabled()) {
 452         tb_gen_code(cs, current_pc, current_cs_base, current_flags, 1);
 453         cpu_resume_from_signal(cs, NULL);
 454     }
 455 }
 456
 457 void vapic_report_tpr_access(DeviceState *dev, CPUState *cs, target_ulong ip,
 458                              TPRAccess access)
 459 {
 460     VAPICROMState *s = VAPIC(dev);
 461     X86CPU *cpu = X86_CPU(cs);
 462     CPUX86State *env = &cpu->env;
 463
 464     cpu_synchronize_state(cs);
 465
 466     if (evaluate_tpr_instruction(s, cpu, &ip, access) < 0) {
 467         if (s->state == VAPIC_ACTIVE) {
 468             vapic_enable(s, cpu);
 469         }
 470         return;
 471     }
 472     if (update_rom_mapping(s, env, ip) < 0) {
 473         return;
 474     }
 475     if (vapic_enable(s, cpu) < 0) {
 476         return;
 477     }
 478     patch_instruction(s, cpu, ip);
 479 }
 480
 481 typedef struct VAPICEnableTPRReporting {
 482     DeviceState *apic;
 483     bool enable;
 484 } VAPICEnableTPRReporting;
 485
 486 static void vapic_do_enable_tpr_reporting(void *data)
 487 {
 488     VAPICEnableTPRReporting *info = data;
 489
 490     apic_enable_tpr_access_reporting(info->apic, info->enable);
 491 }
 492
 493 static void vapic_enable_tpr_reporting(bool enable)
 494 {
 495     VAPICEnableTPRReporting info = {
 496         .enable = enable,
 497     };
 498     CPUState *cs;
 499     X86CPU *cpu;
 500
 501     CPU_FOREACH(cs) {
 502         cpu = X86_CPU(cs);
 503         info.apic = cpu->apic_state;
 504         run_on_cpu(cs, vapic_do_enable_tpr_reporting, &info);
 505     }
 506 }
 507
 508 static void vapic_reset(DeviceState *dev)
 509 {
 510     VAPICROMState *s = VAPIC(dev);
 511
 512     s->state = VAPIC_INACTIVE;
 513     s->rom_state_paddr = 0;
 514     vapic_enable_tpr_reporting(false);
 515 }
 516
 517 /*
 518  * Set the IRQ polling hypercalls to the supported variant:
 519  *  - vmcall if using KVM in-kernel irqchip
 520  *  - 32-bit VAPIC port write otherwise
 521  */
 522 static int patch_hypercalls(VAPICROMState *s)
 523 {
 524     hwaddr rom_paddr = s->rom_state_paddr & ROM_BLOCK_MASK;
 525     static const uint8_t vmcall_pattern[] = { /* vmcall */
 526         0xb8, 0x1, 0, 0, 0, 0xf, 0x1, 0xc1
 527     };
 528     static const uint8_t outl_pattern[] = { /* nop; outl %eax,0x7e */
 529         0xb8, 0x1, 0, 0, 0, 0x90, 0xe7, 0x7e
 530     };
 531     uint8_t alternates[2];
 532     const uint8_t *pattern;
 533     const uint8_t *patch;
 534     int patches = 0;
 535     off_t pos;
 536     uint8_t *rom;
 537
 538     rom = g_malloc(s->rom_size);
 539     cpu_physical_memory_read(rom_paddr, rom, s->rom_size);
 540
 541     for (pos = 0; pos < s->rom_size - sizeof(vmcall_pattern); pos++) {
 542         if (kvm_irqchip_in_kernel()) {
 543             pattern = outl_pattern;
 544             alternates[0] = outl_pattern[7];
 545             alternates[1] = outl_pattern[7];
 546             patch = &vmcall_pattern[5];
 547         } else {
 548             pattern = vmcall_pattern;
 549             alternates[0] = vmcall_pattern[7];
 550             alternates[1] = 0xd9; /* AMD's VMMCALL */
 551             patch = &outl_pattern[5];
 552         }
 553         if (memcmp(rom + pos, pattern, 7) == 0 &&
 554             (rom[pos + 7] == alternates[0] || rom[pos + 7] == alternates[1])) {
 555             cpu_physical_memory_write(rom_paddr + pos + 5, patch, 3);
 556             /*
 557              * Don't flush the tb here. Under ordinary conditions, the patched
 558              * calls are miles away from the current IP. Under malicious
 559              * conditions, the guest could trick us to crash.
 560              */
 561         }
 562     }
 563
 564     g_free(rom);
 565
 566     if (patches != 0 && patches != 2) {
 567         return -1;
 568     }
 569
 570     return 0;
 571 }
 572
 573 /*
 574  * For TCG mode or the time KVM honors read-only memory regions, we need to
 575  * enable write access to the option ROM so that variables can be updated by
 576  * the guest.
 577  */
 578 static int vapic_map_rom_writable(VAPICROMState *s)
 579 {
 580     hwaddr rom_paddr = s->rom_state_paddr & ROM_BLOCK_MASK;
 581     MemoryRegionSection section;
 582     MemoryRegion *as;
 583     size_t rom_size;
 584     uint8_t *ram;
 585
 586     as = sysbus_address_space(&s->busdev);
 587
 588     if (s->rom_mapped_writable) {
 589         memory_region_del_subregion(as, &s->rom);
 590         object_unparent(OBJECT(&s->rom));
 591     }
 592
 593     /* grab RAM memory region (region @rom_paddr may still be pc.rom) */
 594     section = memory_region_find(as, 0, 1);
 595
 596     /* read ROM size from RAM region */
 597     if (rom_paddr + 2 >= memory_region_size(section.mr)) {
 598         return -1;
 599     }
 600     ram = memory_region_get_ram_ptr(section.mr);
 601     rom_size = ram[rom_paddr + 2] * ROM_BLOCK_SIZE;
 602     if (rom_size == 0) {
 603         return -1;
 604     }
 605     s->rom_size = rom_size;
 606
 607     /* We need to round to avoid creating subpages
 608      * from which we cannot run code. */
 609     rom_size += rom_paddr & ~TARGET_PAGE_MASK;
 610     rom_paddr &= TARGET_PAGE_MASK;
 611     rom_size = TARGET_PAGE_ALIGN(rom_size);
 612
 613     memory_region_init_alias(&s->rom, OBJECT(s), "kvmvapic-rom", section.mr,
 614                              rom_paddr, rom_size);
 615     memory_region_add_subregion_overlap(as, rom_paddr, &s->rom, 1000);
 616     s->rom_mapped_writable = true;
 617     memory_region_unref(section.mr);
 618
 619     return 0;
 620 }
 621
 622 static int vapic_prepare(VAPICROMState *s)
 623 {
 624     if (vapic_map_rom_writable(s) < 0) {
 625         return -1;
 626     }
 627
 628     if (patch_hypercalls(s) < 0) {
 629         return -1;
 630     }
 631
 632     vapic_enable_tpr_reporting(true);
 633
 634     return 0;
 635 }
 636
 637 static void vapic_write(void *opaque, hwaddr addr, uint64_t data,
 638                         unsigned int size)
 639 {
 640     VAPICROMState *s = opaque;
 641     X86CPU *cpu;
 642     CPUX86State *env;
 643     hwaddr rom_paddr;
 644
 645     if (!current_cpu) {
 646         return;
 647     }
 648
 649     cpu_synchronize_state(current_cpu);
 650     cpu = X86_CPU(current_cpu);
 651     env = &cpu->env;
 652
 653     /*
 654      * The VAPIC supports two PIO-based hypercalls, both via port 0x7E.
 655      *  o 16-bit write access:
 656      *    Reports the option ROM initialization to the hypervisor. Written
 657      *    value is the offset of the state structure in the ROM.
 658      *  o 8-bit write access:
 659      *    Reactivates the VAPIC after a guest hibernation, i.e. after the
 660      *    option ROM content has been re-initialized by a guest power cycle.
 661      *  o 32-bit write access:
 662      *    Poll for pending IRQs, considering the current VAPIC state.
 663      */
 664     switch (size) {
 665     case 2:
 666         if (s->state == VAPIC_INACTIVE) {
 667             rom_paddr = (env->segs[R_CS].base + env->eip) & ROM_BLOCK_MASK;
 668             s->rom_state_paddr = rom_paddr + data;
 669
 670             s->state = VAPIC_STANDBY;
 671         }
 672         if (vapic_prepare(s) < 0) {
 673             s->state = VAPIC_INACTIVE;
 674             s->rom_state_paddr = 0;
 675             break;
 676         }
 677         break;
 678     case 1:
 679         if (kvm_enabled()) {
 680             /*
 681              * Disable triggering instruction in ROM by writing a NOP.
 682              *
 683              * We cannot do this in TCG mode as the reported IP is not
 684              * accurate.
 685              */
 686             pause_all_vcpus();
 687             patch_byte(cpu, env->eip - 2, 0x66);
 688             patch_byte(cpu, env->eip - 1, 0x90);
 689             resume_all_vcpus();
 690         }
 691
 692         if (s->state == VAPIC_ACTIVE) {
 693             break;
 694         }
 695         if (update_rom_mapping(s, env, env->eip) < 0) {
 696             break;
 697         }
 698         if (find_real_tpr_addr(s, env) < 0) {
 699             break;
 700         }
 701         vapic_enable(s, cpu);
 702         break;
 703     default:
 704     case 4:
 705         if (!kvm_irqchip_in_kernel()) {
 706             apic_poll_irq(cpu->apic_state);
 707         }
 708         break;
 709     }
 710 }
 711
 712 static uint64_t vapic_read(void *opaque, hwaddr addr, unsigned size)
 713 {
 714     return 0xffffffff;
 715 }
 716
 717 static const MemoryRegionOps vapic_ops = {
 718     .write = vapic_write,
 719     .read = vapic_read,
 720     .endianness = DEVICE_NATIVE_ENDIAN,
 721 };
 722
 723 static void vapic_realize(DeviceState *dev, Error **errp)
 724 {
 725     SysBusDevice *sbd = SYS_BUS_DEVICE(dev);
 726     VAPICROMState *s = VAPIC(dev);
 727
 728     memory_region_init_io(&s->io, OBJECT(s), &vapic_ops, s, "kvmvapic", 2);
 729     sysbus_add_io(sbd, VAPIC_IO_PORT, &s->io);
 730     sysbus_init_ioports(sbd, VAPIC_IO_PORT, 2);
 731
 732     option_rom[nb_option_roms].name = "kvmvapic.bin";
 733     option_rom[nb_option_roms].bootindex = -1;
 734     nb_option_roms++;
 735 }
 736
 737 static void do_vapic_enable(void *data)
 738 {
 739     VAPICROMState *s = data;
 740     X86CPU *cpu = X86_CPU(first_cpu);
 741
 742     static const uint8_t enabled = 1;
 743     cpu_physical_memory_write(s->vapic_paddr + offsetof(VAPICState, enabled),
 744                               &enabled, sizeof(enabled));
 745     apic_enable_vapic(cpu->apic_state, s->vapic_paddr);
 746     s->state = VAPIC_ACTIVE;
 747 }
 748
 749 static void kvmvapic_vm_state_change(void *opaque, int running,
 750                                      RunState state)
 751 {
 752     VAPICROMState *s = opaque;
 753     uint8_t *zero;
 754
 755     if (!running) {
 756         return;
 757     }
 758
 759     if (s->state == VAPIC_ACTIVE) {
 760         if (smp_cpus == 1) {
 761             run_on_cpu(first_cpu, do_vapic_enable, s);
 762         } else {
 763             zero = g_malloc0(s->rom_state.vapic_size);
 764             cpu_physical_memory_write(s->vapic_paddr, zero,
 765                                       s->rom_state.vapic_size);
 766             g_free(zero);
 767         }
 768     }
 769
 770     qemu_del_vm_change_state_handler(s->vmsentry);
 771 }
 772
 773 static int vapic_post_load(void *opaque, int version_id)
 774 {
 775     VAPICROMState *s = opaque;
 776
 777     /*
 778      * The old implementation of qemu-kvm did not provide the state
 779      * VAPIC_STANDBY. Reconstruct it.
 780      */
 781     if (s->state == VAPIC_INACTIVE && s->rom_state_paddr != 0) {
 782         s->state = VAPIC_STANDBY;
 783     }
 784
 785     if (s->state != VAPIC_INACTIVE) {
 786         if (vapic_prepare(s) < 0) {
 787             return -1;
 788         }
 789     }
 790
 791     if (!s->vmsentry) {
 792         s->vmsentry =
 793             qemu_add_vm_change_state_handler(kvmvapic_vm_state_change, s);
 794     }
 795     return 0;
 796 }
 797
 798 static const VMStateDescription vmstate_handlers = {
 799     .name = "kvmvapic-handlers",
 800     .version_id = 1,
 801     .minimum_version_id = 1,
 802     .fields = (VMStateField[]) {
 803         VMSTATE_UINT32(set_tpr, VAPICHandlers),
 804         VMSTATE_UINT32(set_tpr_eax, VAPICHandlers),
 805         VMSTATE_UINT32_ARRAY(get_tpr, VAPICHandlers, 8),
 806         VMSTATE_UINT32(get_tpr_stack, VAPICHandlers),
 807         VMSTATE_END_OF_LIST()
 808     }
 809 };
 810
 811 static const VMStateDescription vmstate_guest_rom = {
 812     .name = "kvmvapic-guest-rom",
 813     .version_id = 1,
 814     .minimum_version_id = 1,
 815     .fields = (VMStateField[]) {
 816         VMSTATE_UNUSED(8),     /* signature */
 817         VMSTATE_UINT32(vaddr, GuestROMState),
 818         VMSTATE_UINT32(fixup_start, GuestROMState),
 819         VMSTATE_UINT32(fixup_end, GuestROMState),
 820         VMSTATE_UINT32(vapic_vaddr, GuestROMState),
 821         VMSTATE_UINT32(vapic_size, GuestROMState),
 822         VMSTATE_UINT32(vcpu_shift, GuestROMState),
 823         VMSTATE_UINT32(real_tpr_addr, GuestROMState),
 824         VMSTATE_STRUCT(up, GuestROMState, 0, vmstate_handlers, VAPICHandlers),
 825         VMSTATE_STRUCT(mp, GuestROMState, 0, vmstate_handlers, VAPICHandlers),
 826         VMSTATE_END_OF_LIST()
 827     }
 828 };
 829
 830 static const VMStateDescription vmstate_vapic = {
 831     .name = "kvm-tpr-opt",      /* compatible with qemu-kvm VAPIC */
 832     .version_id = 1,
 833     .minimum_version_id = 1,
 834     .post_load = vapic_post_load,
 835     .fields = (VMStateField[]) {
 836         VMSTATE_STRUCT(rom_state, VAPICROMState, 0, vmstate_guest_rom,
 837                        GuestROMState),
 838         VMSTATE_UINT32(state, VAPICROMState),
 839         VMSTATE_UINT32(real_tpr_addr, VAPICROMState),
 840         VMSTATE_UINT32(rom_state_vaddr, VAPICROMState),
 841         VMSTATE_UINT32(vapic_paddr, VAPICROMState),
 842         VMSTATE_UINT32(rom_state_paddr, VAPICROMState),
 843         VMSTATE_END_OF_LIST()
 844     }
 845 };
 846
 847 static void vapic_class_init(ObjectClass *klass, void *data)
 848 {
 849     DeviceClass *dc = DEVICE_CLASS(klass);
 850
 851     dc->reset   = vapic_reset;
 852     dc->vmsd    = &vmstate_vapic;
 853     dc->realize = vapic_realize;
 854 }
 855
 856 static const TypeInfo vapic_type = {
 857     .name          = TYPE_VAPIC,
 858     .parent        = TYPE_SYS_BUS_DEVICE,
 859     .instance_size = sizeof(VAPICROMState),
 860     .class_init    = vapic_class_init,
 861 };
 862
 863 static void vapic_register(void)
 864 {
 865     type_register_static(&vapic_type);
 866 }
 867
 868 type_init(vapic_register);