root / hw / i386 / kvmvapic.c @ 18e5eec4
History | View | Annotate | Download (23.4 kB)
1 |
/*
|
---|---|
2 |
* TPR optimization for 32-bit Windows guests (XP and Server 2003)
|
3 |
*
|
4 |
* Copyright (C) 2007-2008 Qumranet Technologies
|
5 |
* Copyright (C) 2012 Jan Kiszka, Siemens AG
|
6 |
*
|
7 |
* This work is licensed under the terms of the GNU GPL version 2, or
|
8 |
* (at your option) any later version. See the COPYING file in the
|
9 |
* top-level directory.
|
10 |
*/
|
11 |
#include "sysemu/sysemu.h" |
12 |
#include "sysemu/cpus.h" |
13 |
#include "sysemu/kvm.h" |
14 |
#include "hw/i386/apic_internal.h" |
15 |
#include "hw/sysbus.h" |
16 |
|
17 |
#define VAPIC_IO_PORT 0x7e |
18 |
|
19 |
#define VAPIC_CPU_SHIFT 7 |
20 |
|
21 |
#define ROM_BLOCK_SIZE 512 |
22 |
#define ROM_BLOCK_MASK (~(ROM_BLOCK_SIZE - 1)) |
23 |
|
24 |
typedef enum VAPICMode { |
25 |
VAPIC_INACTIVE = 0,
|
26 |
VAPIC_ACTIVE = 1,
|
27 |
VAPIC_STANDBY = 2,
|
28 |
} VAPICMode; |
29 |
|
30 |
typedef struct VAPICHandlers { |
31 |
uint32_t set_tpr; |
32 |
uint32_t set_tpr_eax; |
33 |
uint32_t get_tpr[8];
|
34 |
uint32_t get_tpr_stack; |
35 |
} QEMU_PACKED VAPICHandlers; |
36 |
|
37 |
typedef struct GuestROMState { |
38 |
char signature[8]; |
39 |
uint32_t vaddr; |
40 |
uint32_t fixup_start; |
41 |
uint32_t fixup_end; |
42 |
uint32_t vapic_vaddr; |
43 |
uint32_t vapic_size; |
44 |
uint32_t vcpu_shift; |
45 |
uint32_t real_tpr_addr; |
46 |
VAPICHandlers up; |
47 |
VAPICHandlers mp; |
48 |
} QEMU_PACKED GuestROMState; |
49 |
|
50 |
typedef struct VAPICROMState { |
51 |
SysBusDevice busdev; |
52 |
MemoryRegion io; |
53 |
MemoryRegion rom; |
54 |
uint32_t state; |
55 |
uint32_t rom_state_paddr; |
56 |
uint32_t rom_state_vaddr; |
57 |
uint32_t vapic_paddr; |
58 |
uint32_t real_tpr_addr; |
59 |
GuestROMState rom_state; |
60 |
size_t rom_size; |
61 |
bool rom_mapped_writable;
|
62 |
} VAPICROMState; |
63 |
|
64 |
#define TYPE_VAPIC "kvmvapic" |
65 |
#define VAPIC(obj) OBJECT_CHECK(VAPICROMState, (obj), TYPE_VAPIC)
|
66 |
|
67 |
#define TPR_INSTR_ABS_MODRM 0x1 |
68 |
#define TPR_INSTR_MATCH_MODRM_REG 0x2 |
69 |
|
70 |
typedef struct TPRInstruction { |
71 |
uint8_t opcode; |
72 |
uint8_t modrm_reg; |
73 |
unsigned int flags; |
74 |
TPRAccess access; |
75 |
size_t length; |
76 |
off_t addr_offset; |
77 |
} TPRInstruction; |
78 |
|
79 |
/* must be sorted by length, shortest first */
|
80 |
static const TPRInstruction tpr_instr[] = { |
81 |
{ /* mov abs to eax */
|
82 |
.opcode = 0xa1,
|
83 |
.access = TPR_ACCESS_READ, |
84 |
.length = 5,
|
85 |
.addr_offset = 1,
|
86 |
}, |
87 |
{ /* mov eax to abs */
|
88 |
.opcode = 0xa3,
|
89 |
.access = TPR_ACCESS_WRITE, |
90 |
.length = 5,
|
91 |
.addr_offset = 1,
|
92 |
}, |
93 |
{ /* mov r32 to r/m32 */
|
94 |
.opcode = 0x89,
|
95 |
.flags = TPR_INSTR_ABS_MODRM, |
96 |
.access = TPR_ACCESS_WRITE, |
97 |
.length = 6,
|
98 |
.addr_offset = 2,
|
99 |
}, |
100 |
{ /* mov r/m32 to r32 */
|
101 |
.opcode = 0x8b,
|
102 |
.flags = TPR_INSTR_ABS_MODRM, |
103 |
.access = TPR_ACCESS_READ, |
104 |
.length = 6,
|
105 |
.addr_offset = 2,
|
106 |
}, |
107 |
{ /* push r/m32 */
|
108 |
.opcode = 0xff,
|
109 |
.modrm_reg = 6,
|
110 |
.flags = TPR_INSTR_ABS_MODRM | TPR_INSTR_MATCH_MODRM_REG, |
111 |
.access = TPR_ACCESS_READ, |
112 |
.length = 6,
|
113 |
.addr_offset = 2,
|
114 |
}, |
115 |
{ /* mov imm32, r/m32 (c7/0) */
|
116 |
.opcode = 0xc7,
|
117 |
.modrm_reg = 0,
|
118 |
.flags = TPR_INSTR_ABS_MODRM | TPR_INSTR_MATCH_MODRM_REG, |
119 |
.access = TPR_ACCESS_WRITE, |
120 |
.length = 10,
|
121 |
.addr_offset = 2,
|
122 |
}, |
123 |
}; |
124 |
|
125 |
static void read_guest_rom_state(VAPICROMState *s) |
126 |
{ |
127 |
cpu_physical_memory_rw(s->rom_state_paddr, (void *)&s->rom_state,
|
128 |
sizeof(GuestROMState), 0); |
129 |
} |
130 |
|
131 |
static void write_guest_rom_state(VAPICROMState *s) |
132 |
{ |
133 |
cpu_physical_memory_rw(s->rom_state_paddr, (void *)&s->rom_state,
|
134 |
sizeof(GuestROMState), 1); |
135 |
} |
136 |
|
137 |
static void update_guest_rom_state(VAPICROMState *s) |
138 |
{ |
139 |
read_guest_rom_state(s); |
140 |
|
141 |
s->rom_state.real_tpr_addr = cpu_to_le32(s->real_tpr_addr); |
142 |
s->rom_state.vcpu_shift = cpu_to_le32(VAPIC_CPU_SHIFT); |
143 |
|
144 |
write_guest_rom_state(s); |
145 |
} |
146 |
|
147 |
static int find_real_tpr_addr(VAPICROMState *s, CPUX86State *env) |
148 |
{ |
149 |
CPUState *cs = CPU(x86_env_get_cpu(env)); |
150 |
hwaddr paddr; |
151 |
target_ulong addr; |
152 |
|
153 |
if (s->state == VAPIC_ACTIVE) {
|
154 |
return 0; |
155 |
} |
156 |
/*
|
157 |
* If there is no prior TPR access instruction we could analyze (which is
|
158 |
* the case after resume from hibernation), we need to scan the possible
|
159 |
* virtual address space for the APIC mapping.
|
160 |
*/
|
161 |
for (addr = 0xfffff000; addr >= 0x80000000; addr -= TARGET_PAGE_SIZE) { |
162 |
paddr = cpu_get_phys_page_debug(cs, addr); |
163 |
if (paddr != APIC_DEFAULT_ADDRESS) {
|
164 |
continue;
|
165 |
} |
166 |
s->real_tpr_addr = addr + 0x80;
|
167 |
update_guest_rom_state(s); |
168 |
return 0; |
169 |
} |
170 |
return -1; |
171 |
} |
172 |
|
173 |
static uint8_t modrm_reg(uint8_t modrm)
|
174 |
{ |
175 |
return (modrm >> 3) & 7; |
176 |
} |
177 |
|
178 |
static bool is_abs_modrm(uint8_t modrm) |
179 |
{ |
180 |
return (modrm & 0xc7) == 0x05; |
181 |
} |
182 |
|
183 |
static bool opcode_matches(uint8_t *opcode, const TPRInstruction *instr) |
184 |
{ |
185 |
return opcode[0] == instr->opcode && |
186 |
(!(instr->flags & TPR_INSTR_ABS_MODRM) || is_abs_modrm(opcode[1])) &&
|
187 |
(!(instr->flags & TPR_INSTR_MATCH_MODRM_REG) || |
188 |
modrm_reg(opcode[1]) == instr->modrm_reg);
|
189 |
} |
190 |
|
191 |
static int evaluate_tpr_instruction(VAPICROMState *s, X86CPU *cpu, |
192 |
target_ulong *pip, TPRAccess access) |
193 |
{ |
194 |
CPUState *cs = CPU(cpu); |
195 |
const TPRInstruction *instr;
|
196 |
target_ulong ip = *pip; |
197 |
uint8_t opcode[2];
|
198 |
uint32_t real_tpr_addr; |
199 |
int i;
|
200 |
|
201 |
if ((ip & 0xf0000000ULL) != 0x80000000ULL && |
202 |
(ip & 0xf0000000ULL) != 0xe0000000ULL) { |
203 |
return -1; |
204 |
} |
205 |
|
206 |
/*
|
207 |
* Early Windows 2003 SMP initialization contains a
|
208 |
*
|
209 |
* mov imm32, r/m32
|
210 |
*
|
211 |
* instruction that is patched by TPR optimization. The problem is that
|
212 |
* RSP, used by the patched instruction, is zero, so the guest gets a
|
213 |
* double fault and dies.
|
214 |
*/
|
215 |
if (cpu->env.regs[R_ESP] == 0) { |
216 |
return -1; |
217 |
} |
218 |
|
219 |
if (kvm_enabled() && !kvm_irqchip_in_kernel()) {
|
220 |
/*
|
221 |
* KVM without kernel-based TPR access reporting will pass an IP that
|
222 |
* points after the accessing instruction. So we need to look backward
|
223 |
* to find the reason.
|
224 |
*/
|
225 |
for (i = 0; i < ARRAY_SIZE(tpr_instr); i++) { |
226 |
instr = &tpr_instr[i]; |
227 |
if (instr->access != access) {
|
228 |
continue;
|
229 |
} |
230 |
if (cpu_memory_rw_debug(cs, ip - instr->length, opcode,
|
231 |
sizeof(opcode), 0) < 0) { |
232 |
return -1; |
233 |
} |
234 |
if (opcode_matches(opcode, instr)) {
|
235 |
ip -= instr->length; |
236 |
goto instruction_ok;
|
237 |
} |
238 |
} |
239 |
return -1; |
240 |
} else {
|
241 |
if (cpu_memory_rw_debug(cs, ip, opcode, sizeof(opcode), 0) < 0) { |
242 |
return -1; |
243 |
} |
244 |
for (i = 0; i < ARRAY_SIZE(tpr_instr); i++) { |
245 |
instr = &tpr_instr[i]; |
246 |
if (opcode_matches(opcode, instr)) {
|
247 |
goto instruction_ok;
|
248 |
} |
249 |
} |
250 |
return -1; |
251 |
} |
252 |
|
253 |
instruction_ok:
|
254 |
/*
|
255 |
* Grab the virtual TPR address from the instruction
|
256 |
* and update the cached values.
|
257 |
*/
|
258 |
if (cpu_memory_rw_debug(cs, ip + instr->addr_offset,
|
259 |
(void *)&real_tpr_addr,
|
260 |
sizeof(real_tpr_addr), 0) < 0) { |
261 |
return -1; |
262 |
} |
263 |
real_tpr_addr = le32_to_cpu(real_tpr_addr); |
264 |
if ((real_tpr_addr & 0xfff) != 0x80) { |
265 |
return -1; |
266 |
} |
267 |
s->real_tpr_addr = real_tpr_addr; |
268 |
update_guest_rom_state(s); |
269 |
|
270 |
*pip = ip; |
271 |
return 0; |
272 |
} |
273 |
|
274 |
static int update_rom_mapping(VAPICROMState *s, CPUX86State *env, target_ulong ip) |
275 |
{ |
276 |
CPUState *cs = CPU(x86_env_get_cpu(env)); |
277 |
hwaddr paddr; |
278 |
uint32_t rom_state_vaddr; |
279 |
uint32_t pos, patch, offset; |
280 |
|
281 |
/* nothing to do if already activated */
|
282 |
if (s->state == VAPIC_ACTIVE) {
|
283 |
return 0; |
284 |
} |
285 |
|
286 |
/* bail out if ROM init code was not executed (missing ROM?) */
|
287 |
if (s->state == VAPIC_INACTIVE) {
|
288 |
return -1; |
289 |
} |
290 |
|
291 |
/* find out virtual address of the ROM */
|
292 |
rom_state_vaddr = s->rom_state_paddr + (ip & 0xf0000000);
|
293 |
paddr = cpu_get_phys_page_debug(cs, rom_state_vaddr); |
294 |
if (paddr == -1) { |
295 |
return -1; |
296 |
} |
297 |
paddr += rom_state_vaddr & ~TARGET_PAGE_MASK; |
298 |
if (paddr != s->rom_state_paddr) {
|
299 |
return -1; |
300 |
} |
301 |
read_guest_rom_state(s); |
302 |
if (memcmp(s->rom_state.signature, "kvm aPiC", 8) != 0) { |
303 |
return -1; |
304 |
} |
305 |
s->rom_state_vaddr = rom_state_vaddr; |
306 |
|
307 |
/* fixup addresses in ROM if needed */
|
308 |
if (rom_state_vaddr == le32_to_cpu(s->rom_state.vaddr)) {
|
309 |
return 0; |
310 |
} |
311 |
for (pos = le32_to_cpu(s->rom_state.fixup_start);
|
312 |
pos < le32_to_cpu(s->rom_state.fixup_end); |
313 |
pos += 4) {
|
314 |
cpu_physical_memory_rw(paddr + pos - s->rom_state.vaddr, |
315 |
(void *)&offset, sizeof(offset), 0); |
316 |
offset = le32_to_cpu(offset); |
317 |
cpu_physical_memory_rw(paddr + offset, (void *)&patch,
|
318 |
sizeof(patch), 0); |
319 |
patch = le32_to_cpu(patch); |
320 |
patch += rom_state_vaddr - le32_to_cpu(s->rom_state.vaddr); |
321 |
patch = cpu_to_le32(patch); |
322 |
cpu_physical_memory_rw(paddr + offset, (void *)&patch,
|
323 |
sizeof(patch), 1); |
324 |
} |
325 |
read_guest_rom_state(s); |
326 |
s->vapic_paddr = paddr + le32_to_cpu(s->rom_state.vapic_vaddr) - |
327 |
le32_to_cpu(s->rom_state.vaddr); |
328 |
|
329 |
return 0; |
330 |
} |
331 |
|
332 |
/*
|
333 |
* Tries to read the unique processor number from the Kernel Processor Control
|
334 |
* Region (KPCR) of 32-bit Windows XP and Server 2003. Returns -1 if the KPCR
|
335 |
* cannot be accessed or is considered invalid. This also ensures that we are
|
336 |
* not patching the wrong guest.
|
337 |
*/
|
338 |
static int get_kpcr_number(X86CPU *cpu) |
339 |
{ |
340 |
CPUX86State *env = &cpu->env; |
341 |
struct kpcr {
|
342 |
uint8_t fill1[0x1c];
|
343 |
uint32_t self; |
344 |
uint8_t fill2[0x31];
|
345 |
uint8_t number; |
346 |
} QEMU_PACKED kpcr; |
347 |
|
348 |
if (cpu_memory_rw_debug(CPU(cpu), env->segs[R_FS].base,
|
349 |
(void *)&kpcr, sizeof(kpcr), 0) < 0 || |
350 |
kpcr.self != env->segs[R_FS].base) { |
351 |
return -1; |
352 |
} |
353 |
return kpcr.number;
|
354 |
} |
355 |
|
356 |
static int vapic_enable(VAPICROMState *s, X86CPU *cpu) |
357 |
{ |
358 |
int cpu_number = get_kpcr_number(cpu);
|
359 |
hwaddr vapic_paddr; |
360 |
static const uint8_t enabled = 1; |
361 |
|
362 |
if (cpu_number < 0) { |
363 |
return -1; |
364 |
} |
365 |
vapic_paddr = s->vapic_paddr + |
366 |
(((hwaddr)cpu_number) << VAPIC_CPU_SHIFT); |
367 |
cpu_physical_memory_rw(vapic_paddr + offsetof(VAPICState, enabled), |
368 |
(void *)&enabled, sizeof(enabled), 1); |
369 |
apic_enable_vapic(cpu->env.apic_state, vapic_paddr); |
370 |
|
371 |
s->state = VAPIC_ACTIVE; |
372 |
|
373 |
return 0; |
374 |
} |
375 |
|
376 |
static void patch_byte(X86CPU *cpu, target_ulong addr, uint8_t byte) |
377 |
{ |
378 |
cpu_memory_rw_debug(CPU(cpu), addr, &byte, 1, 1); |
379 |
} |
380 |
|
381 |
static void patch_call(VAPICROMState *s, X86CPU *cpu, target_ulong ip, |
382 |
uint32_t target) |
383 |
{ |
384 |
uint32_t offset; |
385 |
|
386 |
offset = cpu_to_le32(target - ip - 5);
|
387 |
patch_byte(cpu, ip, 0xe8); /* call near */ |
388 |
cpu_memory_rw_debug(CPU(cpu), ip + 1, (void *)&offset, sizeof(offset), 1); |
389 |
} |
390 |
|
391 |
static void patch_instruction(VAPICROMState *s, X86CPU *cpu, target_ulong ip) |
392 |
{ |
393 |
CPUState *cs = CPU(cpu); |
394 |
CPUX86State *env = &cpu->env; |
395 |
VAPICHandlers *handlers; |
396 |
uint8_t opcode[2];
|
397 |
uint32_t imm32; |
398 |
target_ulong current_pc = 0;
|
399 |
target_ulong current_cs_base = 0;
|
400 |
int current_flags = 0; |
401 |
|
402 |
if (smp_cpus == 1) { |
403 |
handlers = &s->rom_state.up; |
404 |
} else {
|
405 |
handlers = &s->rom_state.mp; |
406 |
} |
407 |
|
408 |
if (!kvm_enabled()) {
|
409 |
cpu_restore_state(env, env->mem_io_pc); |
410 |
cpu_get_tb_cpu_state(env, ¤t_pc, ¤t_cs_base, |
411 |
¤t_flags); |
412 |
} |
413 |
|
414 |
pause_all_vcpus(); |
415 |
|
416 |
cpu_memory_rw_debug(cs, ip, opcode, sizeof(opcode), 0); |
417 |
|
418 |
switch (opcode[0]) { |
419 |
case 0x89: /* mov r32 to r/m32 */ |
420 |
patch_byte(cpu, ip, 0x50 + modrm_reg(opcode[1])); /* push reg */ |
421 |
patch_call(s, cpu, ip + 1, handlers->set_tpr);
|
422 |
break;
|
423 |
case 0x8b: /* mov r/m32 to r32 */ |
424 |
patch_byte(cpu, ip, 0x90);
|
425 |
patch_call(s, cpu, ip + 1, handlers->get_tpr[modrm_reg(opcode[1])]); |
426 |
break;
|
427 |
case 0xa1: /* mov abs to eax */ |
428 |
patch_call(s, cpu, ip, handlers->get_tpr[0]);
|
429 |
break;
|
430 |
case 0xa3: /* mov eax to abs */ |
431 |
patch_call(s, cpu, ip, handlers->set_tpr_eax); |
432 |
break;
|
433 |
case 0xc7: /* mov imm32, r/m32 (c7/0) */ |
434 |
patch_byte(cpu, ip, 0x68); /* push imm32 */ |
435 |
cpu_memory_rw_debug(cs, ip + 6, (void *)&imm32, sizeof(imm32), 0); |
436 |
cpu_memory_rw_debug(cs, ip + 1, (void *)&imm32, sizeof(imm32), 1); |
437 |
patch_call(s, cpu, ip + 5, handlers->set_tpr);
|
438 |
break;
|
439 |
case 0xff: /* push r/m32 */ |
440 |
patch_byte(cpu, ip, 0x50); /* push eax */ |
441 |
patch_call(s, cpu, ip + 1, handlers->get_tpr_stack);
|
442 |
break;
|
443 |
default:
|
444 |
abort(); |
445 |
} |
446 |
|
447 |
resume_all_vcpus(); |
448 |
|
449 |
if (!kvm_enabled()) {
|
450 |
cs->current_tb = NULL;
|
451 |
tb_gen_code(env, current_pc, current_cs_base, current_flags, 1);
|
452 |
cpu_resume_from_signal(env, NULL);
|
453 |
} |
454 |
} |
455 |
|
456 |
void vapic_report_tpr_access(DeviceState *dev, CPUState *cs, target_ulong ip,
|
457 |
TPRAccess access) |
458 |
{ |
459 |
VAPICROMState *s = VAPIC(dev); |
460 |
X86CPU *cpu = X86_CPU(cs); |
461 |
CPUX86State *env = &cpu->env; |
462 |
|
463 |
cpu_synchronize_state(cs); |
464 |
|
465 |
if (evaluate_tpr_instruction(s, cpu, &ip, access) < 0) { |
466 |
if (s->state == VAPIC_ACTIVE) {
|
467 |
vapic_enable(s, cpu); |
468 |
} |
469 |
return;
|
470 |
} |
471 |
if (update_rom_mapping(s, env, ip) < 0) { |
472 |
return;
|
473 |
} |
474 |
if (vapic_enable(s, cpu) < 0) { |
475 |
return;
|
476 |
} |
477 |
patch_instruction(s, cpu, ip); |
478 |
} |
479 |
|
480 |
typedef struct VAPICEnableTPRReporting { |
481 |
DeviceState *apic; |
482 |
bool enable;
|
483 |
} VAPICEnableTPRReporting; |
484 |
|
485 |
static void vapic_do_enable_tpr_reporting(void *data) |
486 |
{ |
487 |
VAPICEnableTPRReporting *info = data; |
488 |
|
489 |
apic_enable_tpr_access_reporting(info->apic, info->enable); |
490 |
} |
491 |
|
492 |
static void vapic_enable_tpr_reporting(bool enable) |
493 |
{ |
494 |
VAPICEnableTPRReporting info = { |
495 |
.enable = enable, |
496 |
}; |
497 |
CPUState *cs; |
498 |
X86CPU *cpu; |
499 |
CPUX86State *env; |
500 |
|
501 |
CPU_FOREACH(cs) { |
502 |
cpu = X86_CPU(cs); |
503 |
env = &cpu->env; |
504 |
info.apic = env->apic_state; |
505 |
run_on_cpu(cs, vapic_do_enable_tpr_reporting, &info); |
506 |
} |
507 |
} |
508 |
|
509 |
static void vapic_reset(DeviceState *dev) |
510 |
{ |
511 |
VAPICROMState *s = VAPIC(dev); |
512 |
|
513 |
if (s->state == VAPIC_ACTIVE) {
|
514 |
s->state = VAPIC_STANDBY; |
515 |
} |
516 |
vapic_enable_tpr_reporting(false);
|
517 |
} |
518 |
|
519 |
/*
|
520 |
* Set the IRQ polling hypercalls to the supported variant:
|
521 |
* - vmcall if using KVM in-kernel irqchip
|
522 |
* - 32-bit VAPIC port write otherwise
|
523 |
*/
|
524 |
static int patch_hypercalls(VAPICROMState *s) |
525 |
{ |
526 |
hwaddr rom_paddr = s->rom_state_paddr & ROM_BLOCK_MASK; |
527 |
static const uint8_t vmcall_pattern[] = { /* vmcall */ |
528 |
0xb8, 0x1, 0, 0, 0, 0xf, 0x1, 0xc1 |
529 |
}; |
530 |
static const uint8_t outl_pattern[] = { /* nop; outl %eax,0x7e */ |
531 |
0xb8, 0x1, 0, 0, 0, 0x90, 0xe7, 0x7e |
532 |
}; |
533 |
uint8_t alternates[2];
|
534 |
const uint8_t *pattern;
|
535 |
const uint8_t *patch;
|
536 |
int patches = 0; |
537 |
off_t pos; |
538 |
uint8_t *rom; |
539 |
|
540 |
rom = g_malloc(s->rom_size); |
541 |
cpu_physical_memory_rw(rom_paddr, rom, s->rom_size, 0);
|
542 |
|
543 |
for (pos = 0; pos < s->rom_size - sizeof(vmcall_pattern); pos++) { |
544 |
if (kvm_irqchip_in_kernel()) {
|
545 |
pattern = outl_pattern; |
546 |
alternates[0] = outl_pattern[7]; |
547 |
alternates[1] = outl_pattern[7]; |
548 |
patch = &vmcall_pattern[5];
|
549 |
} else {
|
550 |
pattern = vmcall_pattern; |
551 |
alternates[0] = vmcall_pattern[7]; |
552 |
alternates[1] = 0xd9; /* AMD's VMMCALL */ |
553 |
patch = &outl_pattern[5];
|
554 |
} |
555 |
if (memcmp(rom + pos, pattern, 7) == 0 && |
556 |
(rom[pos + 7] == alternates[0] || rom[pos + 7] == alternates[1])) { |
557 |
cpu_physical_memory_rw(rom_paddr + pos + 5, (uint8_t *)patch,
|
558 |
3, 1); |
559 |
/*
|
560 |
* Don't flush the tb here. Under ordinary conditions, the patched
|
561 |
* calls are miles away from the current IP. Under malicious
|
562 |
* conditions, the guest could trick us to crash.
|
563 |
*/
|
564 |
} |
565 |
} |
566 |
|
567 |
g_free(rom); |
568 |
|
569 |
if (patches != 0 && patches != 2) { |
570 |
return -1; |
571 |
} |
572 |
|
573 |
return 0; |
574 |
} |
575 |
|
576 |
/*
|
577 |
* For TCG mode or the time KVM honors read-only memory regions, we need to
|
578 |
* enable write access to the option ROM so that variables can be updated by
|
579 |
* the guest.
|
580 |
*/
|
581 |
static int vapic_map_rom_writable(VAPICROMState *s) |
582 |
{ |
583 |
hwaddr rom_paddr = s->rom_state_paddr & ROM_BLOCK_MASK; |
584 |
MemoryRegionSection section; |
585 |
MemoryRegion *as; |
586 |
size_t rom_size; |
587 |
uint8_t *ram; |
588 |
|
589 |
as = sysbus_address_space(&s->busdev); |
590 |
|
591 |
if (s->rom_mapped_writable) {
|
592 |
memory_region_del_subregion(as, &s->rom); |
593 |
memory_region_destroy(&s->rom); |
594 |
} |
595 |
|
596 |
/* grab RAM memory region (region @rom_paddr may still be pc.rom) */
|
597 |
section = memory_region_find(as, 0, 1); |
598 |
|
599 |
/* read ROM size from RAM region */
|
600 |
ram = memory_region_get_ram_ptr(section.mr); |
601 |
rom_size = ram[rom_paddr + 2] * ROM_BLOCK_SIZE;
|
602 |
if (rom_size == 0) { |
603 |
return -1; |
604 |
} |
605 |
s->rom_size = rom_size; |
606 |
|
607 |
/* We need to round to avoid creating subpages
|
608 |
* from which we cannot run code. */
|
609 |
rom_size += rom_paddr & ~TARGET_PAGE_MASK; |
610 |
rom_paddr &= TARGET_PAGE_MASK; |
611 |
rom_size = TARGET_PAGE_ALIGN(rom_size); |
612 |
|
613 |
memory_region_init_alias(&s->rom, OBJECT(s), "kvmvapic-rom", section.mr,
|
614 |
rom_paddr, rom_size); |
615 |
memory_region_add_subregion_overlap(as, rom_paddr, &s->rom, 1000);
|
616 |
s->rom_mapped_writable = true;
|
617 |
memory_region_unref(section.mr); |
618 |
|
619 |
return 0; |
620 |
} |
621 |
|
622 |
static int vapic_prepare(VAPICROMState *s) |
623 |
{ |
624 |
if (vapic_map_rom_writable(s) < 0) { |
625 |
return -1; |
626 |
} |
627 |
|
628 |
if (patch_hypercalls(s) < 0) { |
629 |
return -1; |
630 |
} |
631 |
|
632 |
vapic_enable_tpr_reporting(true);
|
633 |
|
634 |
return 0; |
635 |
} |
636 |
|
637 |
static void vapic_write(void *opaque, hwaddr addr, uint64_t data, |
638 |
unsigned int size) |
639 |
{ |
640 |
CPUState *cs = current_cpu; |
641 |
X86CPU *cpu = X86_CPU(cs); |
642 |
CPUX86State *env = &cpu->env; |
643 |
hwaddr rom_paddr; |
644 |
VAPICROMState *s = opaque; |
645 |
|
646 |
cpu_synchronize_state(cs); |
647 |
|
648 |
/*
|
649 |
* The VAPIC supports two PIO-based hypercalls, both via port 0x7E.
|
650 |
* o 16-bit write access:
|
651 |
* Reports the option ROM initialization to the hypervisor. Written
|
652 |
* value is the offset of the state structure in the ROM.
|
653 |
* o 8-bit write access:
|
654 |
* Reactivates the VAPIC after a guest hibernation, i.e. after the
|
655 |
* option ROM content has been re-initialized by a guest power cycle.
|
656 |
* o 32-bit write access:
|
657 |
* Poll for pending IRQs, considering the current VAPIC state.
|
658 |
*/
|
659 |
switch (size) {
|
660 |
case 2: |
661 |
if (s->state == VAPIC_INACTIVE) {
|
662 |
rom_paddr = (env->segs[R_CS].base + env->eip) & ROM_BLOCK_MASK; |
663 |
s->rom_state_paddr = rom_paddr + data; |
664 |
|
665 |
s->state = VAPIC_STANDBY; |
666 |
} |
667 |
if (vapic_prepare(s) < 0) { |
668 |
s->state = VAPIC_INACTIVE; |
669 |
break;
|
670 |
} |
671 |
break;
|
672 |
case 1: |
673 |
if (kvm_enabled()) {
|
674 |
/*
|
675 |
* Disable triggering instruction in ROM by writing a NOP.
|
676 |
*
|
677 |
* We cannot do this in TCG mode as the reported IP is not
|
678 |
* accurate.
|
679 |
*/
|
680 |
pause_all_vcpus(); |
681 |
patch_byte(cpu, env->eip - 2, 0x66); |
682 |
patch_byte(cpu, env->eip - 1, 0x90); |
683 |
resume_all_vcpus(); |
684 |
} |
685 |
|
686 |
if (s->state == VAPIC_ACTIVE) {
|
687 |
break;
|
688 |
} |
689 |
if (update_rom_mapping(s, env, env->eip) < 0) { |
690 |
break;
|
691 |
} |
692 |
if (find_real_tpr_addr(s, env) < 0) { |
693 |
break;
|
694 |
} |
695 |
vapic_enable(s, cpu); |
696 |
break;
|
697 |
default:
|
698 |
case 4: |
699 |
if (!kvm_irqchip_in_kernel()) {
|
700 |
apic_poll_irq(env->apic_state); |
701 |
} |
702 |
break;
|
703 |
} |
704 |
} |
705 |
|
706 |
static uint64_t vapic_read(void *opaque, hwaddr addr, unsigned size) |
707 |
{ |
708 |
return 0xffffffff; |
709 |
} |
710 |
|
711 |
static const MemoryRegionOps vapic_ops = { |
712 |
.write = vapic_write, |
713 |
.read = vapic_read, |
714 |
.endianness = DEVICE_NATIVE_ENDIAN, |
715 |
}; |
716 |
|
717 |
static void vapic_realize(DeviceState *dev, Error **errp) |
718 |
{ |
719 |
SysBusDevice *sbd = SYS_BUS_DEVICE(dev); |
720 |
VAPICROMState *s = VAPIC(dev); |
721 |
|
722 |
memory_region_init_io(&s->io, OBJECT(s), &vapic_ops, s, "kvmvapic", 2); |
723 |
sysbus_add_io(sbd, VAPIC_IO_PORT, &s->io); |
724 |
sysbus_init_ioports(sbd, VAPIC_IO_PORT, 2);
|
725 |
|
726 |
option_rom[nb_option_roms].name = "kvmvapic.bin";
|
727 |
option_rom[nb_option_roms].bootindex = -1;
|
728 |
nb_option_roms++; |
729 |
} |
730 |
|
731 |
static void do_vapic_enable(void *data) |
732 |
{ |
733 |
VAPICROMState *s = data; |
734 |
X86CPU *cpu = X86_CPU(first_cpu); |
735 |
|
736 |
vapic_enable(s, cpu); |
737 |
} |
738 |
|
739 |
static int vapic_post_load(void *opaque, int version_id) |
740 |
{ |
741 |
VAPICROMState *s = opaque; |
742 |
uint8_t *zero; |
743 |
|
744 |
/*
|
745 |
* The old implementation of qemu-kvm did not provide the state
|
746 |
* VAPIC_STANDBY. Reconstruct it.
|
747 |
*/
|
748 |
if (s->state == VAPIC_INACTIVE && s->rom_state_paddr != 0) { |
749 |
s->state = VAPIC_STANDBY; |
750 |
} |
751 |
|
752 |
if (s->state != VAPIC_INACTIVE) {
|
753 |
if (vapic_prepare(s) < 0) { |
754 |
return -1; |
755 |
} |
756 |
} |
757 |
if (s->state == VAPIC_ACTIVE) {
|
758 |
if (smp_cpus == 1) { |
759 |
run_on_cpu(first_cpu, do_vapic_enable, s); |
760 |
} else {
|
761 |
zero = g_malloc0(s->rom_state.vapic_size); |
762 |
cpu_physical_memory_rw(s->vapic_paddr, zero, |
763 |
s->rom_state.vapic_size, 1);
|
764 |
g_free(zero); |
765 |
} |
766 |
} |
767 |
|
768 |
return 0; |
769 |
} |
770 |
|
771 |
static const VMStateDescription vmstate_handlers = { |
772 |
.name = "kvmvapic-handlers",
|
773 |
.version_id = 1,
|
774 |
.minimum_version_id = 1,
|
775 |
.minimum_version_id_old = 1,
|
776 |
.fields = (VMStateField[]) { |
777 |
VMSTATE_UINT32(set_tpr, VAPICHandlers), |
778 |
VMSTATE_UINT32(set_tpr_eax, VAPICHandlers), |
779 |
VMSTATE_UINT32_ARRAY(get_tpr, VAPICHandlers, 8),
|
780 |
VMSTATE_UINT32(get_tpr_stack, VAPICHandlers), |
781 |
VMSTATE_END_OF_LIST() |
782 |
} |
783 |
}; |
784 |
|
785 |
static const VMStateDescription vmstate_guest_rom = { |
786 |
.name = "kvmvapic-guest-rom",
|
787 |
.version_id = 1,
|
788 |
.minimum_version_id = 1,
|
789 |
.minimum_version_id_old = 1,
|
790 |
.fields = (VMStateField[]) { |
791 |
VMSTATE_UNUSED(8), /* signature */ |
792 |
VMSTATE_UINT32(vaddr, GuestROMState), |
793 |
VMSTATE_UINT32(fixup_start, GuestROMState), |
794 |
VMSTATE_UINT32(fixup_end, GuestROMState), |
795 |
VMSTATE_UINT32(vapic_vaddr, GuestROMState), |
796 |
VMSTATE_UINT32(vapic_size, GuestROMState), |
797 |
VMSTATE_UINT32(vcpu_shift, GuestROMState), |
798 |
VMSTATE_UINT32(real_tpr_addr, GuestROMState), |
799 |
VMSTATE_STRUCT(up, GuestROMState, 0, vmstate_handlers, VAPICHandlers),
|
800 |
VMSTATE_STRUCT(mp, GuestROMState, 0, vmstate_handlers, VAPICHandlers),
|
801 |
VMSTATE_END_OF_LIST() |
802 |
} |
803 |
}; |
804 |
|
805 |
static const VMStateDescription vmstate_vapic = { |
806 |
.name = "kvm-tpr-opt", /* compatible with qemu-kvm VAPIC */ |
807 |
.version_id = 1,
|
808 |
.minimum_version_id = 1,
|
809 |
.minimum_version_id_old = 1,
|
810 |
.post_load = vapic_post_load, |
811 |
.fields = (VMStateField[]) { |
812 |
VMSTATE_STRUCT(rom_state, VAPICROMState, 0, vmstate_guest_rom,
|
813 |
GuestROMState), |
814 |
VMSTATE_UINT32(state, VAPICROMState), |
815 |
VMSTATE_UINT32(real_tpr_addr, VAPICROMState), |
816 |
VMSTATE_UINT32(rom_state_vaddr, VAPICROMState), |
817 |
VMSTATE_UINT32(vapic_paddr, VAPICROMState), |
818 |
VMSTATE_UINT32(rom_state_paddr, VAPICROMState), |
819 |
VMSTATE_END_OF_LIST() |
820 |
} |
821 |
}; |
822 |
|
823 |
static void vapic_class_init(ObjectClass *klass, void *data) |
824 |
{ |
825 |
DeviceClass *dc = DEVICE_CLASS(klass); |
826 |
|
827 |
dc->no_user = 1;
|
828 |
dc->reset = vapic_reset; |
829 |
dc->vmsd = &vmstate_vapic; |
830 |
dc->realize = vapic_realize; |
831 |
} |
832 |
|
833 |
static const TypeInfo vapic_type = { |
834 |
.name = TYPE_VAPIC, |
835 |
.parent = TYPE_SYS_BUS_DEVICE, |
836 |
.instance_size = sizeof(VAPICROMState),
|
837 |
.class_init = vapic_class_init, |
838 |
}; |
839 |
|
840 |
static void vapic_register(void) |
841 |
{ |
842 |
type_register_static(&vapic_type); |
843 |
} |
844 |
|
845 |
type_init(vapic_register); |