2 * tpr optimization for qemu/kvm
4 * Copyright (C) 2007-2008 Qumranet Technologies
6 * Licensed under the terms of the GNU GPL version 2 or higher.
10 #include "config-host.h"
22 static uint64_t map_addr(struct kvm_sregs
*sregs
, target_ulong virt
, unsigned *perms
)
24 uint64_t mask
= ((1ull << 48) - 1) & ~4095ull;
28 if (sregs
->cr4
& 0x20) {
30 p
= ldq_phys(p
+ 8 * (virt
>> 30));
34 p
= ldq_phys(p
+ 8 * ((virt
>> 21) & 511));
39 p
+= ((virt
>> 12) & 511) << 12;
42 p
= ldq_phys(p
+ 8 * ((virt
>> 12) & 511));
49 p
= ldl_phys(p
+ 4 * ((virt
>> 22) & 1023));
54 p
+= ((virt
>> 12) & 1023) << 12;
57 p
= ldl_phys(p
+ 4 * ((virt
>> 12) & 1023));
66 return p
+ (virt
& 4095);
69 static uint8_t read_byte_virt(CPUState
*env
, target_ulong virt
)
71 struct kvm_sregs sregs
;
73 kvm_get_sregs(env
, &sregs
);
74 return ldub_phys(map_addr(&sregs
, virt
, NULL
));
77 static void write_byte_virt(CPUState
*env
, target_ulong virt
, uint8_t b
)
79 struct kvm_sregs sregs
;
81 kvm_get_sregs(env
, &sregs
);
82 stb_phys(map_addr(&sregs
, virt
, NULL
), b
);
85 static __u64
kvm_rsp_read(CPUState
*env
)
89 kvm_get_regs(env
, ®s
);
102 struct vapic_patches
{
104 uint32_t set_tpr_eax
;
106 uint32_t get_tpr_stack
;
107 } __attribute__((packed
)) up
, mp
;
108 } __attribute__((packed
));
110 static struct vapic_bios vapic_bios
;
112 static uint32_t real_tpr
;
113 static uint32_t bios_addr
;
114 static uint32_t vapic_phys
;
115 static uint32_t bios_enabled
;
116 static uint32_t vbios_desc_phys
;
117 static uint32_t vapic_bios_addr
;
119 static void update_vbios_real_tpr(void)
121 cpu_physical_memory_rw(vbios_desc_phys
, (void *)&vapic_bios
, sizeof vapic_bios
, 0);
122 vapic_bios
.real_tpr
= real_tpr
;
123 vapic_bios
.vcpu_shift
= 7;
124 cpu_physical_memory_rw(vbios_desc_phys
, (void *)&vapic_bios
, sizeof vapic_bios
, 1);
127 static unsigned modrm_reg(uint8_t modrm
)
129 return (modrm
>> 3) & 7;
132 static int is_abs_modrm(uint8_t modrm
)
134 return (modrm
& 0xc7) == 0x05;
137 static int instruction_is_ok(CPUState
*env
, uint64_t rip
, int is_write
)
140 unsigned addr_offset
;
144 if ((rip
& 0xf0000000) != 0x80000000 && (rip
& 0xf0000000) != 0xe0000000)
146 if (kvm_rsp_read(env
) == 0)
148 b1
= read_byte_virt(env
, rip
);
149 b2
= read_byte_virt(env
, rip
+ 1);
151 case 0xc7: /* mov imm32, r/m32 (c7/0) */
152 if (modrm_reg(b2
) != 0)
155 case 0x89: /* mov r32 to r/m32 */
156 case 0x8b: /* mov r/m32 to r32 */
157 if (!is_abs_modrm(b2
))
161 case 0xa1: /* mov abs to eax */
162 case 0xa3: /* mov eax to abs */
165 case 0xff: /* push r/m32 */
166 if (modrm_reg(b2
) != 6 || !is_abs_modrm(b2
))
172 p
= rip
+ addr_offset
;
173 addr
= read_byte_virt(env
, p
++);
174 addr
|= read_byte_virt(env
, p
++) << 8;
175 addr
|= read_byte_virt(env
, p
++) << 16;
176 addr
|= read_byte_virt(env
, p
++) << 24;
177 if ((addr
& 0xfff) != 0x80)
180 update_vbios_real_tpr();
184 static int bios_is_mapped(CPUState
*env
, uint64_t rip
)
188 struct kvm_sregs sregs
;
191 uint32_t offset
, fixup
, start
= vapic_bios_addr
? : 0xe0000;
196 kvm_get_sregs(env
, &sregs
);
198 probe
= (rip
& 0xf0000000) + start
;
199 phys
= map_addr(&sregs
, probe
, &perms
);
203 for (i
= 0; i
< 64; ++i
) {
204 cpu_physical_memory_read(phys
, (void *)&vapic_bios
, sizeof(vapic_bios
));
205 if (memcmp(vapic_bios
.signature
, "kvm aPiC", 8) == 0)
212 if (bios_addr
== vapic_bios
.virt_base
)
214 vbios_desc_phys
= phys
;
215 for (i
= vapic_bios
.fixup_start
; i
< vapic_bios
.fixup_end
; i
+= 4) {
216 offset
= ldl_phys(phys
+ i
- vapic_bios
.virt_base
);
217 fixup
= phys
+ offset
;
218 stl_phys(fixup
, ldl_phys(fixup
) + bios_addr
- vapic_bios
.virt_base
);
220 vapic_phys
= vapic_bios
.vapic
- vapic_bios
.virt_base
+ phys
;
224 static int get_pcr_cpu(CPUState
*env
)
228 cpu_synchronize_state(env
);
230 if (cpu_memory_rw_debug(env
, env
->segs
[R_FS
].base
+ 0x51, &b
, 1, 0) < 0)
236 int kvm_tpr_enable_vapic(CPUState
*env
)
238 static uint8_t one
= 1;
239 int pcr_cpu
= get_pcr_cpu(env
);
244 kvm_enable_vapic(env
, vapic_phys
+ (pcr_cpu
<< 7));
245 cpu_physical_memory_rw(vapic_phys
+ (pcr_cpu
<< 7) + 4, &one
, 1, 1);
246 env
->update_vapic
= 0;
251 static int enable_vapic(CPUState
*env
)
254 env
->update_vapic
= 1;
258 static void patch_call(CPUState
*env
, uint64_t rip
, uint32_t target
)
262 offset
= target
- vapic_bios
.virt_base
+ bios_addr
- rip
- 5;
263 write_byte_virt(env
, rip
, 0xe8); /* call near */
264 write_byte_virt(env
, rip
+ 1, offset
);
265 write_byte_virt(env
, rip
+ 2, offset
>> 8);
266 write_byte_virt(env
, rip
+ 3, offset
>> 16);
267 write_byte_virt(env
, rip
+ 4, offset
>> 24);
270 static void patch_instruction(CPUState
*env
, uint64_t rip
)
273 struct vapic_patches
*vp
;
275 vp
= smp_cpus
== 1 ? &vapic_bios
.up
: &vapic_bios
.mp
;
276 b1
= read_byte_virt(env
, rip
);
277 b2
= read_byte_virt(env
, rip
+ 1);
279 case 0x89: /* mov r32 to r/m32 */
280 write_byte_virt(env
, rip
, 0x50 + modrm_reg(b2
)); /* push reg */
281 patch_call(env
, rip
+ 1, vp
->set_tpr
);
283 case 0x8b: /* mov r/m32 to r32 */
284 write_byte_virt(env
, rip
, 0x90);
285 patch_call(env
, rip
+ 1, vp
->get_tpr
[modrm_reg(b2
)]);
287 case 0xa1: /* mov abs to eax */
288 patch_call(env
, rip
, vp
->get_tpr
[0]);
290 case 0xa3: /* mov eax to abs */
291 patch_call(env
, rip
, vp
->set_tpr_eax
);
293 case 0xc7: /* mov imm32, r/m32 (c7/0) */
294 write_byte_virt(env
, rip
, 0x68); /* push imm32 */
295 write_byte_virt(env
, rip
+ 1, read_byte_virt(env
, rip
+6));
296 write_byte_virt(env
, rip
+ 2, read_byte_virt(env
, rip
+7));
297 write_byte_virt(env
, rip
+ 3, read_byte_virt(env
, rip
+8));
298 write_byte_virt(env
, rip
+ 4, read_byte_virt(env
, rip
+9));
299 patch_call(env
, rip
+ 5, vp
->set_tpr
);
301 case 0xff: /* push r/m32 */
302 printf("patching push\n");
303 write_byte_virt(env
, rip
, 0x50); /* push eax */
304 patch_call(env
, rip
+ 1, vp
->get_tpr_stack
);
307 printf("funny insn %02x %02x\n", b1
, b2
);
311 void kvm_tpr_access_report(CPUState
*env
, uint64_t rip
, int is_write
)
313 if (!instruction_is_ok(env
, rip
, is_write
))
315 if (!bios_is_mapped(env
, rip
))
317 if (!kvm_tpr_enable_vapic(env
))
319 patch_instruction(env
, rip
);
322 void kvm_tpr_vcpu_start(CPUState
*env
)
324 kvm_enable_tpr_access_reporting(env
);
326 kvm_tpr_enable_vapic(env
);
329 static void tpr_save(QEMUFile
*f
, void *s
)
333 for (i
= 0; i
< (sizeof vapic_bios
) / 4; ++i
)
334 qemu_put_be32s(f
, &((uint32_t *)&vapic_bios
)[i
]);
335 qemu_put_be32s(f
, &bios_enabled
);
336 qemu_put_be32s(f
, &real_tpr
);
337 qemu_put_be32s(f
, &bios_addr
);
338 qemu_put_be32s(f
, &vapic_phys
);
339 qemu_put_be32s(f
, &vbios_desc_phys
);
342 static int tpr_load(QEMUFile
*f
, void *s
, int version_id
)
349 for (i
= 0; i
< (sizeof vapic_bios
) / 4; ++i
)
350 qemu_get_be32s(f
, &((uint32_t *)&vapic_bios
)[i
]);
351 qemu_get_be32s(f
, &bios_enabled
);
352 qemu_get_be32s(f
, &real_tpr
);
353 qemu_get_be32s(f
, &bios_addr
);
354 qemu_get_be32s(f
, &vapic_phys
);
355 qemu_get_be32s(f
, &vbios_desc_phys
);
358 CPUState
*env
= first_cpu
->next_cpu
;
360 for (env
= first_cpu
; env
!= NULL
; env
= env
->next_cpu
)
367 static void vtpr_ioport_write16(void *opaque
, uint32_t addr
, uint32_t val
)
369 struct kvm_regs regs
;
370 CPUState
*env
= cpu_single_env
;
371 struct kvm_sregs sregs
;
372 kvm_get_regs(env
, ®s
);
373 kvm_get_sregs(env
, &sregs
);
374 vapic_bios_addr
= ((sregs
.cs
.base
+ regs
.rip
) & ~(512 - 1)) + val
;
378 static void vtpr_ioport_write(void *opaque
, uint32_t addr
, uint32_t val
)
380 CPUState
*env
= cpu_single_env
;
381 struct kvm_regs regs
;
382 struct kvm_sregs sregs
;
385 kvm_get_regs(env
, ®s
);
387 write_byte_virt(env
, rip
, 0x66);
388 write_byte_virt(env
, rip
+ 1, 0x90);
391 if (!bios_is_mapped(env
, rip
))
392 printf("bios not mapped?\n");
393 kvm_get_sregs(env
, &sregs
);
394 for (addr
= 0xfffff000u
; addr
>= 0x80000000u
; addr
-= 4096)
395 if (map_addr(&sregs
, addr
, NULL
) == 0xfee00000u
) {
396 real_tpr
= addr
+ 0x80;
400 update_vbios_real_tpr();
401 kvm_tpr_enable_vapic(env
);
404 void kvm_tpr_opt_setup(void)
406 register_savevm("kvm-tpr-opt", 0, 1, tpr_save
, tpr_load
, NULL
);
407 register_ioport_write(0x7e, 1, 1, vtpr_ioport_write
, NULL
);
408 register_ioport_write(0x7e, 2, 2, vtpr_ioport_write16
, NULL
);