root / hw / kvmvapic.c @ c3203fa5
History | View | Annotate | Download (22.9 kB)
1 |
/*
|
---|---|
2 |
* TPR optimization for 32-bit Windows guests (XP and Server 2003)
|
3 |
*
|
4 |
* Copyright (C) 2007-2008 Qumranet Technologies
|
5 |
* Copyright (C) 2012 Jan Kiszka, Siemens AG
|
6 |
*
|
7 |
* This work is licensed under the terms of the GNU GPL version 2, or
|
8 |
* (at your option) any later version. See the COPYING file in the
|
9 |
* top-level directory.
|
10 |
*/
|
11 |
#include "sysemu/sysemu.h" |
12 |
#include "sysemu/cpus.h" |
13 |
#include "sysemu/kvm.h" |
14 |
#include "apic_internal.h" |
15 |
|
16 |
#define APIC_DEFAULT_ADDRESS 0xfee00000 |
17 |
|
18 |
#define VAPIC_IO_PORT 0x7e |
19 |
|
20 |
#define VAPIC_CPU_SHIFT 7 |
21 |
|
22 |
#define ROM_BLOCK_SIZE 512 |
23 |
#define ROM_BLOCK_MASK (~(ROM_BLOCK_SIZE - 1)) |
24 |
|
25 |
typedef enum VAPICMode { |
26 |
VAPIC_INACTIVE = 0,
|
27 |
VAPIC_ACTIVE = 1,
|
28 |
VAPIC_STANDBY = 2,
|
29 |
} VAPICMode; |
30 |
|
31 |
typedef struct VAPICHandlers { |
32 |
uint32_t set_tpr; |
33 |
uint32_t set_tpr_eax; |
34 |
uint32_t get_tpr[8];
|
35 |
uint32_t get_tpr_stack; |
36 |
} QEMU_PACKED VAPICHandlers; |
37 |
|
38 |
typedef struct GuestROMState { |
39 |
char signature[8]; |
40 |
uint32_t vaddr; |
41 |
uint32_t fixup_start; |
42 |
uint32_t fixup_end; |
43 |
uint32_t vapic_vaddr; |
44 |
uint32_t vapic_size; |
45 |
uint32_t vcpu_shift; |
46 |
uint32_t real_tpr_addr; |
47 |
VAPICHandlers up; |
48 |
VAPICHandlers mp; |
49 |
} QEMU_PACKED GuestROMState; |
50 |
|
51 |
typedef struct VAPICROMState { |
52 |
SysBusDevice busdev; |
53 |
MemoryRegion io; |
54 |
MemoryRegion rom; |
55 |
uint32_t state; |
56 |
uint32_t rom_state_paddr; |
57 |
uint32_t rom_state_vaddr; |
58 |
uint32_t vapic_paddr; |
59 |
uint32_t real_tpr_addr; |
60 |
GuestROMState rom_state; |
61 |
size_t rom_size; |
62 |
bool rom_mapped_writable;
|
63 |
} VAPICROMState; |
64 |
|
65 |
#define TPR_INSTR_ABS_MODRM 0x1 |
66 |
#define TPR_INSTR_MATCH_MODRM_REG 0x2 |
67 |
|
68 |
typedef struct TPRInstruction { |
69 |
uint8_t opcode; |
70 |
uint8_t modrm_reg; |
71 |
unsigned int flags; |
72 |
TPRAccess access; |
73 |
size_t length; |
74 |
off_t addr_offset; |
75 |
} TPRInstruction; |
76 |
|
77 |
/* must be sorted by length, shortest first */
|
78 |
static const TPRInstruction tpr_instr[] = { |
79 |
{ /* mov abs to eax */
|
80 |
.opcode = 0xa1,
|
81 |
.access = TPR_ACCESS_READ, |
82 |
.length = 5,
|
83 |
.addr_offset = 1,
|
84 |
}, |
85 |
{ /* mov eax to abs */
|
86 |
.opcode = 0xa3,
|
87 |
.access = TPR_ACCESS_WRITE, |
88 |
.length = 5,
|
89 |
.addr_offset = 1,
|
90 |
}, |
91 |
{ /* mov r32 to r/m32 */
|
92 |
.opcode = 0x89,
|
93 |
.flags = TPR_INSTR_ABS_MODRM, |
94 |
.access = TPR_ACCESS_WRITE, |
95 |
.length = 6,
|
96 |
.addr_offset = 2,
|
97 |
}, |
98 |
{ /* mov r/m32 to r32 */
|
99 |
.opcode = 0x8b,
|
100 |
.flags = TPR_INSTR_ABS_MODRM, |
101 |
.access = TPR_ACCESS_READ, |
102 |
.length = 6,
|
103 |
.addr_offset = 2,
|
104 |
}, |
105 |
{ /* push r/m32 */
|
106 |
.opcode = 0xff,
|
107 |
.modrm_reg = 6,
|
108 |
.flags = TPR_INSTR_ABS_MODRM | TPR_INSTR_MATCH_MODRM_REG, |
109 |
.access = TPR_ACCESS_READ, |
110 |
.length = 6,
|
111 |
.addr_offset = 2,
|
112 |
}, |
113 |
{ /* mov imm32, r/m32 (c7/0) */
|
114 |
.opcode = 0xc7,
|
115 |
.modrm_reg = 0,
|
116 |
.flags = TPR_INSTR_ABS_MODRM | TPR_INSTR_MATCH_MODRM_REG, |
117 |
.access = TPR_ACCESS_WRITE, |
118 |
.length = 10,
|
119 |
.addr_offset = 2,
|
120 |
}, |
121 |
}; |
122 |
|
123 |
static void read_guest_rom_state(VAPICROMState *s) |
124 |
{ |
125 |
cpu_physical_memory_rw(s->rom_state_paddr, (void *)&s->rom_state,
|
126 |
sizeof(GuestROMState), 0); |
127 |
} |
128 |
|
129 |
static void write_guest_rom_state(VAPICROMState *s) |
130 |
{ |
131 |
cpu_physical_memory_rw(s->rom_state_paddr, (void *)&s->rom_state,
|
132 |
sizeof(GuestROMState), 1); |
133 |
} |
134 |
|
135 |
static void update_guest_rom_state(VAPICROMState *s) |
136 |
{ |
137 |
read_guest_rom_state(s); |
138 |
|
139 |
s->rom_state.real_tpr_addr = cpu_to_le32(s->real_tpr_addr); |
140 |
s->rom_state.vcpu_shift = cpu_to_le32(VAPIC_CPU_SHIFT); |
141 |
|
142 |
write_guest_rom_state(s); |
143 |
} |
144 |
|
145 |
static int find_real_tpr_addr(VAPICROMState *s, CPUX86State *env) |
146 |
{ |
147 |
hwaddr paddr; |
148 |
target_ulong addr; |
149 |
|
150 |
if (s->state == VAPIC_ACTIVE) {
|
151 |
return 0; |
152 |
} |
153 |
/*
|
154 |
* If there is no prior TPR access instruction we could analyze (which is
|
155 |
* the case after resume from hibernation), we need to scan the possible
|
156 |
* virtual address space for the APIC mapping.
|
157 |
*/
|
158 |
for (addr = 0xfffff000; addr >= 0x80000000; addr -= TARGET_PAGE_SIZE) { |
159 |
paddr = cpu_get_phys_page_debug(env, addr); |
160 |
if (paddr != APIC_DEFAULT_ADDRESS) {
|
161 |
continue;
|
162 |
} |
163 |
s->real_tpr_addr = addr + 0x80;
|
164 |
update_guest_rom_state(s); |
165 |
return 0; |
166 |
} |
167 |
return -1; |
168 |
} |
169 |
|
170 |
static uint8_t modrm_reg(uint8_t modrm)
|
171 |
{ |
172 |
return (modrm >> 3) & 7; |
173 |
} |
174 |
|
175 |
static bool is_abs_modrm(uint8_t modrm) |
176 |
{ |
177 |
return (modrm & 0xc7) == 0x05; |
178 |
} |
179 |
|
180 |
static bool opcode_matches(uint8_t *opcode, const TPRInstruction *instr) |
181 |
{ |
182 |
return opcode[0] == instr->opcode && |
183 |
(!(instr->flags & TPR_INSTR_ABS_MODRM) || is_abs_modrm(opcode[1])) &&
|
184 |
(!(instr->flags & TPR_INSTR_MATCH_MODRM_REG) || |
185 |
modrm_reg(opcode[1]) == instr->modrm_reg);
|
186 |
} |
187 |
|
188 |
static int evaluate_tpr_instruction(VAPICROMState *s, CPUX86State *env, |
189 |
target_ulong *pip, TPRAccess access) |
190 |
{ |
191 |
const TPRInstruction *instr;
|
192 |
target_ulong ip = *pip; |
193 |
uint8_t opcode[2];
|
194 |
uint32_t real_tpr_addr; |
195 |
int i;
|
196 |
|
197 |
if ((ip & 0xf0000000ULL) != 0x80000000ULL && |
198 |
(ip & 0xf0000000ULL) != 0xe0000000ULL) { |
199 |
return -1; |
200 |
} |
201 |
|
202 |
/*
|
203 |
* Early Windows 2003 SMP initialization contains a
|
204 |
*
|
205 |
* mov imm32, r/m32
|
206 |
*
|
207 |
* instruction that is patched by TPR optimization. The problem is that
|
208 |
* RSP, used by the patched instruction, is zero, so the guest gets a
|
209 |
* double fault and dies.
|
210 |
*/
|
211 |
if (env->regs[R_ESP] == 0) { |
212 |
return -1; |
213 |
} |
214 |
|
215 |
if (kvm_enabled() && !kvm_irqchip_in_kernel()) {
|
216 |
/*
|
217 |
* KVM without kernel-based TPR access reporting will pass an IP that
|
218 |
* points after the accessing instruction. So we need to look backward
|
219 |
* to find the reason.
|
220 |
*/
|
221 |
for (i = 0; i < ARRAY_SIZE(tpr_instr); i++) { |
222 |
instr = &tpr_instr[i]; |
223 |
if (instr->access != access) {
|
224 |
continue;
|
225 |
} |
226 |
if (cpu_memory_rw_debug(env, ip - instr->length, opcode,
|
227 |
sizeof(opcode), 0) < 0) { |
228 |
return -1; |
229 |
} |
230 |
if (opcode_matches(opcode, instr)) {
|
231 |
ip -= instr->length; |
232 |
goto instruction_ok;
|
233 |
} |
234 |
} |
235 |
return -1; |
236 |
} else {
|
237 |
if (cpu_memory_rw_debug(env, ip, opcode, sizeof(opcode), 0) < 0) { |
238 |
return -1; |
239 |
} |
240 |
for (i = 0; i < ARRAY_SIZE(tpr_instr); i++) { |
241 |
instr = &tpr_instr[i]; |
242 |
if (opcode_matches(opcode, instr)) {
|
243 |
goto instruction_ok;
|
244 |
} |
245 |
} |
246 |
return -1; |
247 |
} |
248 |
|
249 |
instruction_ok:
|
250 |
/*
|
251 |
* Grab the virtual TPR address from the instruction
|
252 |
* and update the cached values.
|
253 |
*/
|
254 |
if (cpu_memory_rw_debug(env, ip + instr->addr_offset,
|
255 |
(void *)&real_tpr_addr,
|
256 |
sizeof(real_tpr_addr), 0) < 0) { |
257 |
return -1; |
258 |
} |
259 |
real_tpr_addr = le32_to_cpu(real_tpr_addr); |
260 |
if ((real_tpr_addr & 0xfff) != 0x80) { |
261 |
return -1; |
262 |
} |
263 |
s->real_tpr_addr = real_tpr_addr; |
264 |
update_guest_rom_state(s); |
265 |
|
266 |
*pip = ip; |
267 |
return 0; |
268 |
} |
269 |
|
270 |
static int update_rom_mapping(VAPICROMState *s, CPUX86State *env, target_ulong ip) |
271 |
{ |
272 |
hwaddr paddr; |
273 |
uint32_t rom_state_vaddr; |
274 |
uint32_t pos, patch, offset; |
275 |
|
276 |
/* nothing to do if already activated */
|
277 |
if (s->state == VAPIC_ACTIVE) {
|
278 |
return 0; |
279 |
} |
280 |
|
281 |
/* bail out if ROM init code was not executed (missing ROM?) */
|
282 |
if (s->state == VAPIC_INACTIVE) {
|
283 |
return -1; |
284 |
} |
285 |
|
286 |
/* find out virtual address of the ROM */
|
287 |
rom_state_vaddr = s->rom_state_paddr + (ip & 0xf0000000);
|
288 |
paddr = cpu_get_phys_page_debug(env, rom_state_vaddr); |
289 |
if (paddr == -1) { |
290 |
return -1; |
291 |
} |
292 |
paddr += rom_state_vaddr & ~TARGET_PAGE_MASK; |
293 |
if (paddr != s->rom_state_paddr) {
|
294 |
return -1; |
295 |
} |
296 |
read_guest_rom_state(s); |
297 |
if (memcmp(s->rom_state.signature, "kvm aPiC", 8) != 0) { |
298 |
return -1; |
299 |
} |
300 |
s->rom_state_vaddr = rom_state_vaddr; |
301 |
|
302 |
/* fixup addresses in ROM if needed */
|
303 |
if (rom_state_vaddr == le32_to_cpu(s->rom_state.vaddr)) {
|
304 |
return 0; |
305 |
} |
306 |
for (pos = le32_to_cpu(s->rom_state.fixup_start);
|
307 |
pos < le32_to_cpu(s->rom_state.fixup_end); |
308 |
pos += 4) {
|
309 |
cpu_physical_memory_rw(paddr + pos - s->rom_state.vaddr, |
310 |
(void *)&offset, sizeof(offset), 0); |
311 |
offset = le32_to_cpu(offset); |
312 |
cpu_physical_memory_rw(paddr + offset, (void *)&patch,
|
313 |
sizeof(patch), 0); |
314 |
patch = le32_to_cpu(patch); |
315 |
patch += rom_state_vaddr - le32_to_cpu(s->rom_state.vaddr); |
316 |
patch = cpu_to_le32(patch); |
317 |
cpu_physical_memory_rw(paddr + offset, (void *)&patch,
|
318 |
sizeof(patch), 1); |
319 |
} |
320 |
read_guest_rom_state(s); |
321 |
s->vapic_paddr = paddr + le32_to_cpu(s->rom_state.vapic_vaddr) - |
322 |
le32_to_cpu(s->rom_state.vaddr); |
323 |
|
324 |
return 0; |
325 |
} |
326 |
|
327 |
/*
|
328 |
* Tries to read the unique processor number from the Kernel Processor Control
|
329 |
* Region (KPCR) of 32-bit Windows XP and Server 2003. Returns -1 if the KPCR
|
330 |
* cannot be accessed or is considered invalid. This also ensures that we are
|
331 |
* not patching the wrong guest.
|
332 |
*/
|
333 |
static int get_kpcr_number(CPUX86State *env) |
334 |
{ |
335 |
struct kpcr {
|
336 |
uint8_t fill1[0x1c];
|
337 |
uint32_t self; |
338 |
uint8_t fill2[0x31];
|
339 |
uint8_t number; |
340 |
} QEMU_PACKED kpcr; |
341 |
|
342 |
if (cpu_memory_rw_debug(env, env->segs[R_FS].base,
|
343 |
(void *)&kpcr, sizeof(kpcr), 0) < 0 || |
344 |
kpcr.self != env->segs[R_FS].base) { |
345 |
return -1; |
346 |
} |
347 |
return kpcr.number;
|
348 |
} |
349 |
|
350 |
static int vapic_enable(VAPICROMState *s, CPUX86State *env) |
351 |
{ |
352 |
int cpu_number = get_kpcr_number(env);
|
353 |
hwaddr vapic_paddr; |
354 |
static const uint8_t enabled = 1; |
355 |
|
356 |
if (cpu_number < 0) { |
357 |
return -1; |
358 |
} |
359 |
vapic_paddr = s->vapic_paddr + |
360 |
(((hwaddr)cpu_number) << VAPIC_CPU_SHIFT); |
361 |
cpu_physical_memory_rw(vapic_paddr + offsetof(VAPICState, enabled), |
362 |
(void *)&enabled, sizeof(enabled), 1); |
363 |
apic_enable_vapic(env->apic_state, vapic_paddr); |
364 |
|
365 |
s->state = VAPIC_ACTIVE; |
366 |
|
367 |
return 0; |
368 |
} |
369 |
|
370 |
static void patch_byte(CPUX86State *env, target_ulong addr, uint8_t byte) |
371 |
{ |
372 |
cpu_memory_rw_debug(env, addr, &byte, 1, 1); |
373 |
} |
374 |
|
375 |
static void patch_call(VAPICROMState *s, CPUX86State *env, target_ulong ip, |
376 |
uint32_t target) |
377 |
{ |
378 |
uint32_t offset; |
379 |
|
380 |
offset = cpu_to_le32(target - ip - 5);
|
381 |
patch_byte(env, ip, 0xe8); /* call near */ |
382 |
cpu_memory_rw_debug(env, ip + 1, (void *)&offset, sizeof(offset), 1); |
383 |
} |
384 |
|
385 |
static void patch_instruction(VAPICROMState *s, CPUX86State *env, target_ulong ip) |
386 |
{ |
387 |
VAPICHandlers *handlers; |
388 |
uint8_t opcode[2];
|
389 |
uint32_t imm32; |
390 |
target_ulong current_pc = 0;
|
391 |
target_ulong current_cs_base = 0;
|
392 |
int current_flags = 0; |
393 |
|
394 |
if (smp_cpus == 1) { |
395 |
handlers = &s->rom_state.up; |
396 |
} else {
|
397 |
handlers = &s->rom_state.mp; |
398 |
} |
399 |
|
400 |
if (!kvm_enabled()) {
|
401 |
cpu_restore_state(env, env->mem_io_pc); |
402 |
cpu_get_tb_cpu_state(env, ¤t_pc, ¤t_cs_base, |
403 |
¤t_flags); |
404 |
} |
405 |
|
406 |
pause_all_vcpus(); |
407 |
|
408 |
cpu_memory_rw_debug(env, ip, opcode, sizeof(opcode), 0); |
409 |
|
410 |
switch (opcode[0]) { |
411 |
case 0x89: /* mov r32 to r/m32 */ |
412 |
patch_byte(env, ip, 0x50 + modrm_reg(opcode[1])); /* push reg */ |
413 |
patch_call(s, env, ip + 1, handlers->set_tpr);
|
414 |
break;
|
415 |
case 0x8b: /* mov r/m32 to r32 */ |
416 |
patch_byte(env, ip, 0x90);
|
417 |
patch_call(s, env, ip + 1, handlers->get_tpr[modrm_reg(opcode[1])]); |
418 |
break;
|
419 |
case 0xa1: /* mov abs to eax */ |
420 |
patch_call(s, env, ip, handlers->get_tpr[0]);
|
421 |
break;
|
422 |
case 0xa3: /* mov eax to abs */ |
423 |
patch_call(s, env, ip, handlers->set_tpr_eax); |
424 |
break;
|
425 |
case 0xc7: /* mov imm32, r/m32 (c7/0) */ |
426 |
patch_byte(env, ip, 0x68); /* push imm32 */ |
427 |
cpu_memory_rw_debug(env, ip + 6, (void *)&imm32, sizeof(imm32), 0); |
428 |
cpu_memory_rw_debug(env, ip + 1, (void *)&imm32, sizeof(imm32), 1); |
429 |
patch_call(s, env, ip + 5, handlers->set_tpr);
|
430 |
break;
|
431 |
case 0xff: /* push r/m32 */ |
432 |
patch_byte(env, ip, 0x50); /* push eax */ |
433 |
patch_call(s, env, ip + 1, handlers->get_tpr_stack);
|
434 |
break;
|
435 |
default:
|
436 |
abort(); |
437 |
} |
438 |
|
439 |
resume_all_vcpus(); |
440 |
|
441 |
if (!kvm_enabled()) {
|
442 |
env->current_tb = NULL;
|
443 |
tb_gen_code(env, current_pc, current_cs_base, current_flags, 1);
|
444 |
cpu_resume_from_signal(env, NULL);
|
445 |
} |
446 |
} |
447 |
|
448 |
void vapic_report_tpr_access(DeviceState *dev, void *cpu, target_ulong ip, |
449 |
TPRAccess access) |
450 |
{ |
451 |
VAPICROMState *s = DO_UPCAST(VAPICROMState, busdev.qdev, dev); |
452 |
CPUX86State *env = cpu; |
453 |
|
454 |
cpu_synchronize_state(env); |
455 |
|
456 |
if (evaluate_tpr_instruction(s, env, &ip, access) < 0) { |
457 |
if (s->state == VAPIC_ACTIVE) {
|
458 |
vapic_enable(s, env); |
459 |
} |
460 |
return;
|
461 |
} |
462 |
if (update_rom_mapping(s, env, ip) < 0) { |
463 |
return;
|
464 |
} |
465 |
if (vapic_enable(s, env) < 0) { |
466 |
return;
|
467 |
} |
468 |
patch_instruction(s, env, ip); |
469 |
} |
470 |
|
471 |
typedef struct VAPICEnableTPRReporting { |
472 |
DeviceState *apic; |
473 |
bool enable;
|
474 |
} VAPICEnableTPRReporting; |
475 |
|
476 |
static void vapic_do_enable_tpr_reporting(void *data) |
477 |
{ |
478 |
VAPICEnableTPRReporting *info = data; |
479 |
|
480 |
apic_enable_tpr_access_reporting(info->apic, info->enable); |
481 |
} |
482 |
|
483 |
static void vapic_enable_tpr_reporting(bool enable) |
484 |
{ |
485 |
VAPICEnableTPRReporting info = { |
486 |
.enable = enable, |
487 |
}; |
488 |
X86CPU *cpu; |
489 |
CPUX86State *env; |
490 |
|
491 |
for (env = first_cpu; env != NULL; env = env->next_cpu) { |
492 |
cpu = x86_env_get_cpu(env); |
493 |
info.apic = env->apic_state; |
494 |
run_on_cpu(CPU(cpu), vapic_do_enable_tpr_reporting, &info); |
495 |
} |
496 |
} |
497 |
|
498 |
static void vapic_reset(DeviceState *dev) |
499 |
{ |
500 |
VAPICROMState *s = DO_UPCAST(VAPICROMState, busdev.qdev, dev); |
501 |
|
502 |
if (s->state == VAPIC_ACTIVE) {
|
503 |
s->state = VAPIC_STANDBY; |
504 |
} |
505 |
vapic_enable_tpr_reporting(false);
|
506 |
} |
507 |
|
508 |
/*
|
509 |
* Set the IRQ polling hypercalls to the supported variant:
|
510 |
* - vmcall if using KVM in-kernel irqchip
|
511 |
* - 32-bit VAPIC port write otherwise
|
512 |
*/
|
513 |
static int patch_hypercalls(VAPICROMState *s) |
514 |
{ |
515 |
hwaddr rom_paddr = s->rom_state_paddr & ROM_BLOCK_MASK; |
516 |
static const uint8_t vmcall_pattern[] = { /* vmcall */ |
517 |
0xb8, 0x1, 0, 0, 0, 0xf, 0x1, 0xc1 |
518 |
}; |
519 |
static const uint8_t outl_pattern[] = { /* nop; outl %eax,0x7e */ |
520 |
0xb8, 0x1, 0, 0, 0, 0x90, 0xe7, 0x7e |
521 |
}; |
522 |
uint8_t alternates[2];
|
523 |
const uint8_t *pattern;
|
524 |
const uint8_t *patch;
|
525 |
int patches = 0; |
526 |
off_t pos; |
527 |
uint8_t *rom; |
528 |
|
529 |
rom = g_malloc(s->rom_size); |
530 |
cpu_physical_memory_rw(rom_paddr, rom, s->rom_size, 0);
|
531 |
|
532 |
for (pos = 0; pos < s->rom_size - sizeof(vmcall_pattern); pos++) { |
533 |
if (kvm_irqchip_in_kernel()) {
|
534 |
pattern = outl_pattern; |
535 |
alternates[0] = outl_pattern[7]; |
536 |
alternates[1] = outl_pattern[7]; |
537 |
patch = &vmcall_pattern[5];
|
538 |
} else {
|
539 |
pattern = vmcall_pattern; |
540 |
alternates[0] = vmcall_pattern[7]; |
541 |
alternates[1] = 0xd9; /* AMD's VMMCALL */ |
542 |
patch = &outl_pattern[5];
|
543 |
} |
544 |
if (memcmp(rom + pos, pattern, 7) == 0 && |
545 |
(rom[pos + 7] == alternates[0] || rom[pos + 7] == alternates[1])) { |
546 |
cpu_physical_memory_rw(rom_paddr + pos + 5, (uint8_t *)patch,
|
547 |
3, 1); |
548 |
/*
|
549 |
* Don't flush the tb here. Under ordinary conditions, the patched
|
550 |
* calls are miles away from the current IP. Under malicious
|
551 |
* conditions, the guest could trick us to crash.
|
552 |
*/
|
553 |
} |
554 |
} |
555 |
|
556 |
g_free(rom); |
557 |
|
558 |
if (patches != 0 && patches != 2) { |
559 |
return -1; |
560 |
} |
561 |
|
562 |
return 0; |
563 |
} |
564 |
|
565 |
/*
|
566 |
* For TCG mode or the time KVM honors read-only memory regions, we need to
|
567 |
* enable write access to the option ROM so that variables can be updated by
|
568 |
* the guest.
|
569 |
*/
|
570 |
static void vapic_map_rom_writable(VAPICROMState *s) |
571 |
{ |
572 |
hwaddr rom_paddr = s->rom_state_paddr & ROM_BLOCK_MASK; |
573 |
MemoryRegionSection section; |
574 |
MemoryRegion *as; |
575 |
size_t rom_size; |
576 |
uint8_t *ram; |
577 |
|
578 |
as = sysbus_address_space(&s->busdev); |
579 |
|
580 |
if (s->rom_mapped_writable) {
|
581 |
memory_region_del_subregion(as, &s->rom); |
582 |
memory_region_destroy(&s->rom); |
583 |
} |
584 |
|
585 |
/* grab RAM memory region (region @rom_paddr may still be pc.rom) */
|
586 |
section = memory_region_find(as, 0, 1); |
587 |
|
588 |
/* read ROM size from RAM region */
|
589 |
ram = memory_region_get_ram_ptr(section.mr); |
590 |
rom_size = ram[rom_paddr + 2] * ROM_BLOCK_SIZE;
|
591 |
s->rom_size = rom_size; |
592 |
|
593 |
/* We need to round to avoid creating subpages
|
594 |
* from which we cannot run code. */
|
595 |
rom_size += rom_paddr & ~TARGET_PAGE_MASK; |
596 |
rom_paddr &= TARGET_PAGE_MASK; |
597 |
rom_size = TARGET_PAGE_ALIGN(rom_size); |
598 |
|
599 |
memory_region_init_alias(&s->rom, "kvmvapic-rom", section.mr, rom_paddr,
|
600 |
rom_size); |
601 |
memory_region_add_subregion_overlap(as, rom_paddr, &s->rom, 1000);
|
602 |
s->rom_mapped_writable = true;
|
603 |
} |
604 |
|
605 |
static int vapic_prepare(VAPICROMState *s) |
606 |
{ |
607 |
vapic_map_rom_writable(s); |
608 |
|
609 |
if (patch_hypercalls(s) < 0) { |
610 |
return -1; |
611 |
} |
612 |
|
613 |
vapic_enable_tpr_reporting(true);
|
614 |
|
615 |
return 0; |
616 |
} |
617 |
|
618 |
static void vapic_write(void *opaque, hwaddr addr, uint64_t data, |
619 |
unsigned int size) |
620 |
{ |
621 |
CPUX86State *env = cpu_single_env; |
622 |
hwaddr rom_paddr; |
623 |
VAPICROMState *s = opaque; |
624 |
|
625 |
cpu_synchronize_state(env); |
626 |
|
627 |
/*
|
628 |
* The VAPIC supports two PIO-based hypercalls, both via port 0x7E.
|
629 |
* o 16-bit write access:
|
630 |
* Reports the option ROM initialization to the hypervisor. Written
|
631 |
* value is the offset of the state structure in the ROM.
|
632 |
* o 8-bit write access:
|
633 |
* Reactivates the VAPIC after a guest hibernation, i.e. after the
|
634 |
* option ROM content has been re-initialized by a guest power cycle.
|
635 |
* o 32-bit write access:
|
636 |
* Poll for pending IRQs, considering the current VAPIC state.
|
637 |
*/
|
638 |
switch (size) {
|
639 |
case 2: |
640 |
if (s->state == VAPIC_INACTIVE) {
|
641 |
rom_paddr = (env->segs[R_CS].base + env->eip) & ROM_BLOCK_MASK; |
642 |
s->rom_state_paddr = rom_paddr + data; |
643 |
|
644 |
s->state = VAPIC_STANDBY; |
645 |
} |
646 |
if (vapic_prepare(s) < 0) { |
647 |
s->state = VAPIC_INACTIVE; |
648 |
break;
|
649 |
} |
650 |
break;
|
651 |
case 1: |
652 |
if (kvm_enabled()) {
|
653 |
/*
|
654 |
* Disable triggering instruction in ROM by writing a NOP.
|
655 |
*
|
656 |
* We cannot do this in TCG mode as the reported IP is not
|
657 |
* accurate.
|
658 |
*/
|
659 |
pause_all_vcpus(); |
660 |
patch_byte(env, env->eip - 2, 0x66); |
661 |
patch_byte(env, env->eip - 1, 0x90); |
662 |
resume_all_vcpus(); |
663 |
} |
664 |
|
665 |
if (s->state == VAPIC_ACTIVE) {
|
666 |
break;
|
667 |
} |
668 |
if (update_rom_mapping(s, env, env->eip) < 0) { |
669 |
break;
|
670 |
} |
671 |
if (find_real_tpr_addr(s, env) < 0) { |
672 |
break;
|
673 |
} |
674 |
vapic_enable(s, env); |
675 |
break;
|
676 |
default:
|
677 |
case 4: |
678 |
if (!kvm_irqchip_in_kernel()) {
|
679 |
apic_poll_irq(env->apic_state); |
680 |
} |
681 |
break;
|
682 |
} |
683 |
} |
684 |
|
685 |
static const MemoryRegionOps vapic_ops = { |
686 |
.write = vapic_write, |
687 |
.endianness = DEVICE_NATIVE_ENDIAN, |
688 |
}; |
689 |
|
690 |
static int vapic_init(SysBusDevice *dev) |
691 |
{ |
692 |
VAPICROMState *s = FROM_SYSBUS(VAPICROMState, dev); |
693 |
|
694 |
memory_region_init_io(&s->io, &vapic_ops, s, "kvmvapic", 2); |
695 |
sysbus_add_io(dev, VAPIC_IO_PORT, &s->io); |
696 |
sysbus_init_ioports(dev, VAPIC_IO_PORT, 2);
|
697 |
|
698 |
option_rom[nb_option_roms].name = "kvmvapic.bin";
|
699 |
option_rom[nb_option_roms].bootindex = -1;
|
700 |
nb_option_roms++; |
701 |
|
702 |
return 0; |
703 |
} |
704 |
|
705 |
static void do_vapic_enable(void *data) |
706 |
{ |
707 |
VAPICROMState *s = data; |
708 |
|
709 |
vapic_enable(s, first_cpu); |
710 |
} |
711 |
|
712 |
static int vapic_post_load(void *opaque, int version_id) |
713 |
{ |
714 |
VAPICROMState *s = opaque; |
715 |
uint8_t *zero; |
716 |
|
717 |
/*
|
718 |
* The old implementation of qemu-kvm did not provide the state
|
719 |
* VAPIC_STANDBY. Reconstruct it.
|
720 |
*/
|
721 |
if (s->state == VAPIC_INACTIVE && s->rom_state_paddr != 0) { |
722 |
s->state = VAPIC_STANDBY; |
723 |
} |
724 |
|
725 |
if (s->state != VAPIC_INACTIVE) {
|
726 |
if (vapic_prepare(s) < 0) { |
727 |
return -1; |
728 |
} |
729 |
} |
730 |
if (s->state == VAPIC_ACTIVE) {
|
731 |
if (smp_cpus == 1) { |
732 |
run_on_cpu(ENV_GET_CPU(first_cpu), do_vapic_enable, s); |
733 |
} else {
|
734 |
zero = g_malloc0(s->rom_state.vapic_size); |
735 |
cpu_physical_memory_rw(s->vapic_paddr, zero, |
736 |
s->rom_state.vapic_size, 1);
|
737 |
g_free(zero); |
738 |
} |
739 |
} |
740 |
|
741 |
return 0; |
742 |
} |
743 |
|
744 |
static const VMStateDescription vmstate_handlers = { |
745 |
.name = "kvmvapic-handlers",
|
746 |
.version_id = 1,
|
747 |
.minimum_version_id = 1,
|
748 |
.minimum_version_id_old = 1,
|
749 |
.fields = (VMStateField[]) { |
750 |
VMSTATE_UINT32(set_tpr, VAPICHandlers), |
751 |
VMSTATE_UINT32(set_tpr_eax, VAPICHandlers), |
752 |
VMSTATE_UINT32_ARRAY(get_tpr, VAPICHandlers, 8),
|
753 |
VMSTATE_UINT32(get_tpr_stack, VAPICHandlers), |
754 |
VMSTATE_END_OF_LIST() |
755 |
} |
756 |
}; |
757 |
|
758 |
static const VMStateDescription vmstate_guest_rom = { |
759 |
.name = "kvmvapic-guest-rom",
|
760 |
.version_id = 1,
|
761 |
.minimum_version_id = 1,
|
762 |
.minimum_version_id_old = 1,
|
763 |
.fields = (VMStateField[]) { |
764 |
VMSTATE_UNUSED(8), /* signature */ |
765 |
VMSTATE_UINT32(vaddr, GuestROMState), |
766 |
VMSTATE_UINT32(fixup_start, GuestROMState), |
767 |
VMSTATE_UINT32(fixup_end, GuestROMState), |
768 |
VMSTATE_UINT32(vapic_vaddr, GuestROMState), |
769 |
VMSTATE_UINT32(vapic_size, GuestROMState), |
770 |
VMSTATE_UINT32(vcpu_shift, GuestROMState), |
771 |
VMSTATE_UINT32(real_tpr_addr, GuestROMState), |
772 |
VMSTATE_STRUCT(up, GuestROMState, 0, vmstate_handlers, VAPICHandlers),
|
773 |
VMSTATE_STRUCT(mp, GuestROMState, 0, vmstate_handlers, VAPICHandlers),
|
774 |
VMSTATE_END_OF_LIST() |
775 |
} |
776 |
}; |
777 |
|
778 |
static const VMStateDescription vmstate_vapic = { |
779 |
.name = "kvm-tpr-opt", /* compatible with qemu-kvm VAPIC */ |
780 |
.version_id = 1,
|
781 |
.minimum_version_id = 1,
|
782 |
.minimum_version_id_old = 1,
|
783 |
.post_load = vapic_post_load, |
784 |
.fields = (VMStateField[]) { |
785 |
VMSTATE_STRUCT(rom_state, VAPICROMState, 0, vmstate_guest_rom,
|
786 |
GuestROMState), |
787 |
VMSTATE_UINT32(state, VAPICROMState), |
788 |
VMSTATE_UINT32(real_tpr_addr, VAPICROMState), |
789 |
VMSTATE_UINT32(rom_state_vaddr, VAPICROMState), |
790 |
VMSTATE_UINT32(vapic_paddr, VAPICROMState), |
791 |
VMSTATE_UINT32(rom_state_paddr, VAPICROMState), |
792 |
VMSTATE_END_OF_LIST() |
793 |
} |
794 |
}; |
795 |
|
796 |
static void vapic_class_init(ObjectClass *klass, void *data) |
797 |
{ |
798 |
SysBusDeviceClass *sc = SYS_BUS_DEVICE_CLASS(klass); |
799 |
DeviceClass *dc = DEVICE_CLASS(klass); |
800 |
|
801 |
dc->no_user = 1;
|
802 |
dc->reset = vapic_reset; |
803 |
dc->vmsd = &vmstate_vapic; |
804 |
sc->init = vapic_init; |
805 |
} |
806 |
|
807 |
static TypeInfo vapic_type = {
|
808 |
.name = "kvmvapic",
|
809 |
.parent = TYPE_SYS_BUS_DEVICE, |
810 |
.instance_size = sizeof(VAPICROMState),
|
811 |
.class_init = vapic_class_init, |
812 |
}; |
813 |
|
814 |
static void vapic_register(void) |
815 |
{ |
816 |
type_register_static(&vapic_type); |
817 |
} |
818 |
|
819 |
type_init(vapic_register); |