kvm-tpr-opt.c

   1 /*
   2  * tpr optimization for qemu/kvm
   3  *
   4  * Copyright (C) 2007-2008 Qumranet Technologies
   5  *
   6  * Licensed under the terms of the GNU GPL version 2 or higher.
   7  */
   8
   9 #include "config.h"
  10 #include "config-host.h"
  11
  12 #include <string.h>
  13
  14 #include "hw/hw.h"
  15 #include "sysemu.h"
  16 #include "qemu-kvm.h"
  17 #include "cpu.h"
  18
  19 #include <stdio.h>
  20
  21 extern kvm_context_t kvm_context;
  22
  23 static uint64_t map_addr(struct kvm_sregs *sregs, target_ulong virt, unsigned *perms)
  24 {
  25     uint64_t mask = ((1ull << 48) - 1) & ~4095ull;
  26     uint64_t p, pp = 7;
  27
  28     p = sregs->cr3;
  29     if (sregs->cr4 & 0x20) {
  30         p &= ~31ull;
  31         p = ldq_phys(p + 8 * (virt >> 30));
  32         if (!(p & 1))
  33             return -1ull;
  34         p &= mask;
  35         p = ldq_phys(p + 8 * ((virt >> 21) & 511));
  36         if (!(p & 1))
  37             return -1ull;
  38         pp &= p;
  39         if (p & 128) {
  40             p += ((virt >> 12) & 511) << 12;
  41         } else {
  42             p &= mask;
  43             p = ldq_phys(p + 8 * ((virt >> 12) & 511));
  44             if (!(p & 1))
  45                 return -1ull;
  46             pp &= p;
  47         }
  48     } else {
  49         p &= mask;
  50         p = ldl_phys(p + 4 * ((virt >> 22) & 1023));
  51         if (!(p & 1))
  52             return -1ull;
  53         pp &= p;
  54         if (p & 128) {
  55             p += ((virt >> 12) & 1023) << 12;
  56         } else {
  57             p &= mask;
  58             p = ldl_phys(p + 4 * ((virt >> 12) & 1023));
  59             pp &= p;
  60             if (!(p & 1))
  61                 return -1ull;
  62         }
  63     }
  64     if (perms)
  65         *perms = pp >> 1;
  66     p &= mask;
  67     return p + (virt & 4095);
  68 }
  69
  70 static uint8_t read_byte_virt(CPUState *env, target_ulong virt)
  71 {
  72     struct kvm_sregs sregs;
  73
  74     kvm_get_sregs(kvm_context, env->cpu_index, &sregs);
  75     return ldub_phys(map_addr(&sregs, virt, NULL));
  76 }
  77
  78 static void write_byte_virt(CPUState *env, target_ulong virt, uint8_t b)
  79 {
  80     struct kvm_sregs sregs;
  81
  82     kvm_get_sregs(kvm_context, env->cpu_index, &sregs);
  83     stb_phys(map_addr(&sregs, virt, NULL), b);
  84 }
  85
  86 static __u64 kvm_rsp_read(CPUState *env)
  87 {
  88     struct kvm_regs regs;
  89
  90     kvm_get_regs(kvm_context, env->cpu_index, &regs);
  91     return regs.rsp;
  92 }
  93
  94 struct vapic_bios {
  95     char signature[8];
  96     uint32_t virt_base;
  97     uint32_t fixup_start;
  98     uint32_t fixup_end;
  99     uint32_t vapic;
 100     uint32_t vapic_size;
 101     uint32_t vcpu_shift;
 102     uint32_t real_tpr;
 103     struct vapic_patches {
 104         uint32_t set_tpr;
 105         uint32_t set_tpr_eax;
 106         uint32_t get_tpr[8];
 107         uint32_t get_tpr_stack;
 108     } __attribute__((packed)) up, mp;
 109 } __attribute__((packed));
 110
 111 static struct vapic_bios vapic_bios;
 112
 113 static uint32_t real_tpr;
 114 static uint32_t bios_addr;
 115 static uint32_t vapic_phys;
 116 static int bios_enabled;
 117 static uint32_t vbios_desc_phys;
 118
 119 void update_vbios_real_tpr()
 120 {
 121     cpu_physical_memory_rw(vbios_desc_phys, (void *)&vapic_bios, sizeof vapic_bios, 0);
 122     vapic_bios.real_tpr = real_tpr;
 123     vapic_bios.vcpu_shift = 7;
 124     cpu_physical_memory_rw(vbios_desc_phys, (void *)&vapic_bios, sizeof vapic_bios, 1);
 125 }
 126
 127 static unsigned modrm_reg(uint8_t modrm)
 128 {
 129     return (modrm >> 3) & 7;
 130 }
 131
 132 static int is_abs_modrm(uint8_t modrm)
 133 {
 134     return (modrm & 0xc7) == 0x05;
 135 }
 136
 137 static int instruction_is_ok(CPUState *env, uint64_t rip, int is_write)
 138 {
 139     uint8_t b1, b2;
 140     unsigned addr_offset;
 141     uint32_t addr;
 142     uint64_t p;
 143
 144     if ((rip & 0xf0000000) != 0x80000000 && (rip & 0xf0000000) != 0xe0000000)
 145         return 0;
 146     if (kvm_rsp_read(env) == 0)
 147         return 0;
 148     b1 = read_byte_virt(env, rip);
 149     b2 = read_byte_virt(env, rip + 1);
 150     switch (b1) {
 151     case 0xc7: /* mov imm32, r/m32 (c7/0) */
 152         if (modrm_reg(b2) != 0)
 153             return 0;
 154         /* fall through */
 155     case 0x89: /* mov r32 to r/m32 */
 156     case 0x8b: /* mov r/m32 to r32 */
 157         if (!is_abs_modrm(b2))
 158             return 0;
 159         addr_offset = 2;
 160         break;
 161     case 0xa1: /* mov abs to eax */
 162     case 0xa3: /* mov eax to abs */
 163         addr_offset = 1;
 164         break;
 165     case 0xff: /* push r/m32 */
 166         if (modrm_reg(b2) != 6 || !is_abs_modrm(b2))
 167             return 0;
 168         addr_offset = 2;
 169     default:
 170         return 0;
 171     }
 172     p = rip + addr_offset;
 173     addr = read_byte_virt(env, p++);
 174     addr |= read_byte_virt(env, p++) << 8;
 175     addr |= read_byte_virt(env, p++) << 16;
 176     addr |= read_byte_virt(env, p++) << 24;
 177     if ((addr & 0xfff) != 0x80)
 178         return 0;
 179     real_tpr = addr;
 180     update_vbios_real_tpr();
 181     return 1;
 182 }
 183
 184 static int bios_is_mapped(CPUState *env, uint64_t rip)
 185 {
 186     uint32_t probe;
 187     uint64_t phys;
 188     struct kvm_sregs sregs;
 189     unsigned perms;
 190     uint32_t i;
 191     uint32_t offset, fixup;
 192
 193     if (bios_enabled)
 194         return 1;
 195
 196     kvm_get_sregs(kvm_context, env->cpu_index, &sregs);
 197
 198     probe = (rip & 0xf0000000) + 0xe0000;
 199     phys = map_addr(&sregs, probe, &perms);
 200     if (phys != 0xe0000)
 201         return 0;
 202     bios_addr = probe;
 203     for (i = 0; i < 64; ++i) {
 204         cpu_physical_memory_read(phys, (void *)&vapic_bios, sizeof(vapic_bios));
 205         if (memcmp(vapic_bios.signature, "kvm aPiC", 8) == 0)
 206             break;
 207         phys += 1024;
 208         bios_addr += 1024;
 209     }
 210     if (i == 64)
 211         return 0;
 212     if (bios_addr == vapic_bios.virt_base)
 213         return 1;
 214     vbios_desc_phys = phys;
 215     for (i = vapic_bios.fixup_start; i < vapic_bios.fixup_end; i += 4) {
 216         offset = ldl_phys(phys + i - vapic_bios.virt_base);
 217         fixup = phys + offset;
 218         stl_phys(fixup, ldl_phys(fixup) + bios_addr - vapic_bios.virt_base);
 219     }
 220     vapic_phys = vapic_bios.vapic - vapic_bios.virt_base + phys;
 221     return 1;
 222 }
 223
 224 static int enable_vapic(CPUState *env)
 225 {
 226     struct kvm_sregs sregs;
 227
 228     if (smp_cpus > 1) {/* uniprocessor doesn't need cpu id */
 229         kvm_get_sregs(kvm_context, env->cpu_index, &sregs);
 230         sregs.tr.selector = 0xdb + (env->cpu_index << 8);
 231         kvm_set_sregs(kvm_context, env->cpu_index, &sregs);
 232     }
 233
 234     kvm_enable_vapic(kvm_context, env->cpu_index,
 235                      vapic_phys + (env->cpu_index << 7));
 236     bios_enabled = 1;
 237
 238     return 1;
 239 }
 240
 241 static void patch_call(CPUState *env, uint64_t rip, uint32_t target)
 242 {
 243     uint32_t offset;
 244
 245     offset = target - vapic_bios.virt_base + bios_addr - rip - 5;
 246     write_byte_virt(env, rip, 0xe8); /* call near */
 247     write_byte_virt(env, rip + 1, offset);
 248     write_byte_virt(env, rip + 2, offset >> 8);
 249     write_byte_virt(env, rip + 3, offset >> 16);
 250     write_byte_virt(env, rip + 4, offset >> 24);
 251 }
 252
 253 static void patch_instruction(CPUState *env, uint64_t rip)
 254 {
 255     uint8_t b1, b2;
 256     struct vapic_patches *vp;
 257
 258     vp = smp_cpus == 1 ? &vapic_bios.up : &vapic_bios.mp;
 259     b1 = read_byte_virt(env, rip);
 260     b2 = read_byte_virt(env, rip + 1);
 261     switch (b1) {
 262     case 0x89: /* mov r32 to r/m32 */
 263         write_byte_virt(env, rip, 0x50 + modrm_reg(b2));  /* push reg */
 264         patch_call(env, rip + 1, vp->set_tpr);
 265         break;
 266     case 0x8b: /* mov r/m32 to r32 */
 267         write_byte_virt(env, rip, 0x90);
 268         patch_call(env, rip + 1, vp->get_tpr[modrm_reg(b2)]);
 269         break;
 270     case 0xa1: /* mov abs to eax */
 271         patch_call(env, rip, vp->get_tpr[0]);
 272         break;
 273     case 0xa3: /* mov eax to abs */
 274         patch_call(env, rip, vp->set_tpr_eax);
 275         break;
 276     case 0xc7: /* mov imm32, r/m32 (c7/0) */
 277         write_byte_virt(env, rip, 0x68);  /* push imm32 */
 278         write_byte_virt(env, rip + 1, read_byte_virt(env, rip+6));
 279         write_byte_virt(env, rip + 2, read_byte_virt(env, rip+7));
 280         write_byte_virt(env, rip + 3, read_byte_virt(env, rip+8));
 281         write_byte_virt(env, rip + 4, read_byte_virt(env, rip+9));
 282         patch_call(env, rip + 5, vp->set_tpr);
 283         break;
 284     case 0xff: /* push r/m32 */
 285         printf("patching push\n");
 286         write_byte_virt(env, rip, 0x50); /* push eax */
 287         patch_call(env, rip + 1, vp->get_tpr_stack);
 288         break;
 289     default:
 290         printf("funny insn %02x %02x\n", b1, b2);
 291     }
 292 }
 293
 294 void kvm_tpr_access_report(CPUState *env, uint64_t rip, int is_write)
 295 {
 296     if (!instruction_is_ok(env, rip, is_write))
 297         return;
 298     if (!bios_is_mapped(env, rip))
 299         return;
 300     if (!enable_vapic(env))
 301         return;
 302     patch_instruction(env, rip);
 303 }
 304
 305 void kvm_tpr_vcpu_start(CPUState *env)
 306 {
 307     kvm_enable_tpr_access_reporting(kvm_context, env->cpu_index);
 308     if (bios_enabled)
 309         enable_vapic(env);
 310 }
 311
 312 static void tpr_save(QEMUFile *f, void *s)
 313 {
 314     int i;
 315
 316     for (i = 0; i < (sizeof vapic_bios) / 4; ++i)
 317         qemu_put_be32s(f, &((uint32_t *)&vapic_bios)[i]);
 318     qemu_put_be32s(f, &bios_enabled);
 319     qemu_put_be32s(f, &real_tpr);
 320     qemu_put_be32s(f, &bios_addr);
 321     qemu_put_be32s(f, &vapic_phys);
 322     qemu_put_be32s(f, &vbios_desc_phys);
 323 }
 324
 325 static int tpr_load(QEMUFile *f, void *s, int version_id)
 326 {
 327     int i;
 328
 329     if (version_id != 1)
 330         return -EINVAL;
 331
 332     for (i = 0; i < (sizeof vapic_bios) / 4; ++i)
 333         qemu_get_be32s(f, &((uint32_t *)&vapic_bios)[i]);
 334     qemu_get_be32s(f, &bios_enabled);
 335     qemu_get_be32s(f, &real_tpr);
 336     qemu_get_be32s(f, &bios_addr);
 337     qemu_get_be32s(f, &vapic_phys);
 338     qemu_get_be32s(f, &vbios_desc_phys);
 339
 340     if (bios_enabled) {
 341         CPUState *env = first_cpu->next_cpu;
 342
 343         for (env = first_cpu; env != NULL; env = env->next_cpu)
 344             enable_vapic(env);
 345     }
 346
 347     return 0;
 348 }
 349
 350 static void vtpr_ioport_write(void *opaque, uint32_t addr, uint32_t val)
 351 {
 352     CPUState *env = cpu_single_env;
 353     struct kvm_regs regs;
 354     struct kvm_sregs sregs;
 355     uint32_t rip, apic;
 356
 357     kvm_get_regs(kvm_context, env->cpu_index, &regs);
 358     rip = regs.rip - 2;
 359     write_byte_virt(env, rip, 0x66);
 360     write_byte_virt(env, rip + 1, 0x90);
 361     if (bios_enabled)
 362         return;
 363     if (!bios_is_mapped(env, rip))
 364         printf("bios not mapped?\n");
 365     kvm_get_sregs(kvm_context, env->cpu_index, &sregs);
 366     for (addr = 0xfffff000u; addr >= 0x80000000u; addr -= 4096)
 367         if (map_addr(&sregs, addr, NULL) == 0xfee00000u) {
 368             real_tpr = addr + 0x80;
 369             break;
 370         }
 371     bios_enabled = 1;
 372     update_vbios_real_tpr();
 373     enable_vapic(env);
 374 }
 375
 376 void kvm_tpr_opt_setup(CPUState *env)
 377 {
 378     register_savevm("kvm-tpr-opt", 0, 1, tpr_save, tpr_load, NULL);
 379     register_ioport_write(0x7e, 1, 1, vtpr_ioport_write, NULL);
 380 }
 381