kvm-tpr-opt.c

   1
   2 #include "config.h"
   3 #include "config-host.h"
   4
   5 #include <string.h>
   6
   7 #include "hw/hw.h"
   8 #include "sysemu.h"
   9 #include "qemu-kvm.h"
  10 #include "cpu.h"
  11
  12 #include <stdio.h>
  13
  14 extern kvm_context_t kvm_context;
  15
  16 static uint64_t map_addr(struct kvm_sregs *sregs, target_ulong virt, unsigned *perms)
  17 {
  18     uint64_t mask = ((1ull << 48) - 1) & ~4095ull;
  19     uint64_t p, pp = 7;
  20
  21     p = sregs->cr3;
  22     if (sregs->cr4 & 0x20) {
  23         p &= ~31ull;
  24         p = ldq_phys(p + 8 * (virt >> 30));
  25         if (!(p & 1))
  26             return -1ull;
  27         p &= mask;
  28         p = ldq_phys(p + 8 * ((virt >> 21) & 511));
  29         if (!(p & 1))
  30             return -1ull;
  31         pp &= p;
  32         if (p & 128) {
  33             p += ((virt >> 12) & 511) << 12;
  34         } else {
  35             p &= mask;
  36             p = ldq_phys(p + 8 * ((virt >> 12) & 511));
  37             if (!(p & 1))
  38                 return -1ull;
  39             pp &= p;
  40         }
  41     } else {
  42         p &= mask;
  43         p = ldl_phys(p + 4 * ((virt >> 22) & 1023));
  44         if (!(p & 1))
  45             return -1ull;
  46         pp &= p;
  47         if (p & 128) {
  48             p += ((virt >> 12) & 1023) << 12;
  49         } else {
  50             p &= mask;
  51             p = ldl_phys(p + 4 * ((virt >> 12) & 1023));
  52             pp &= p;
  53             if (!(p & 1))
  54                 return -1ull;
  55         }
  56     }
  57     if (perms)
  58         *perms = pp >> 1;
  59     p &= mask;
  60     return p + (virt & 4095);
  61 }
  62
  63 static uint8_t read_byte_virt(CPUState *env, target_ulong virt)
  64 {
  65     struct kvm_sregs sregs;
  66
  67     kvm_get_sregs(kvm_context, env->cpu_index, &sregs);
  68     return ldub_phys(map_addr(&sregs, virt, NULL));
  69 }
  70
  71 static void write_byte_virt(CPUState *env, target_ulong virt, uint8_t b)
  72 {
  73     struct kvm_sregs sregs;
  74
  75     kvm_get_sregs(kvm_context, env->cpu_index, &sregs);
  76     stb_phys(map_addr(&sregs, virt, NULL), b);
  77 }
  78
  79 static uint32_t get_bios_map(CPUState *env, unsigned *perms)
  80 {
  81     uint32_t v;
  82     struct kvm_sregs sregs;
  83
  84     kvm_get_sregs(kvm_context, env->cpu_index, &sregs);
  85
  86     for (v = -4096u; v != 0; v -= 4096)
  87         if (map_addr(&sregs, v, perms) == 0xe0000)
  88             return v;
  89     return -1u;
  90 }
  91
  92 struct vapic_bios {
  93     char signature[8];
  94     uint32_t virt_base;
  95     uint32_t fixup_start;
  96     uint32_t fixup_end;
  97     uint32_t vapic;
  98     uint32_t vapic_size;
  99     uint32_t vcpu_shift;
 100     uint32_t real_tpr;
 101     uint32_t set_tpr;
 102     uint32_t set_tpr_eax;
 103     uint32_t get_tpr[8];
 104 };
 105
 106 static struct vapic_bios vapic_bios;
 107
 108 static uint32_t real_tpr;
 109 static uint32_t bios_addr;
 110 static uint32_t vapic_phys;
 111 static int bios_enabled;
 112 static uint32_t vbios_desc_phys;
 113
 114 void update_vbios_real_tpr()
 115 {
 116     cpu_physical_memory_rw(vbios_desc_phys, (void *)&vapic_bios, sizeof vapic_bios, 0);
 117     vapic_bios.real_tpr = real_tpr;
 118     vapic_bios.vcpu_shift = 7;
 119     cpu_physical_memory_rw(vbios_desc_phys, (void *)&vapic_bios, sizeof vapic_bios, 1);
 120 }
 121
 122 static unsigned modrm_reg(uint8_t modrm)
 123 {
 124     return (modrm >> 3) & 7;
 125 }
 126
 127 static int is_abs_modrm(uint8_t modrm)
 128 {
 129     return (modrm & 0xc7) == 0x05;
 130 }
 131
 132 static int instruction_is_ok(CPUState *env, uint64_t rip, int is_write)
 133 {
 134     uint8_t b1, b2;
 135     unsigned addr_offset;
 136     uint32_t addr;
 137     uint64_t p;
 138
 139     if ((rip & 0xf0000000) != 0x80000000 && (rip & 0xf0000000) != 0xe0000000)
 140         return 0;
 141     b1 = read_byte_virt(env, rip);
 142     b2 = read_byte_virt(env, rip + 1);
 143     switch (b1) {
 144     case 0xc7: /* mov imm32, r/m32 (c7/0) */
 145         if (modrm_reg(b2) != 0)
 146             return 0;
 147         /* fall through */
 148     case 0x89: /* mov r32 to r/m32 */
 149     case 0x8b: /* mov r/m32 to r32 */
 150         if (!is_abs_modrm(b2))
 151             return 0;
 152         addr_offset = 2;
 153         break;
 154     case 0xa1: /* mov abs to eax */
 155     case 0xa3: /* mov eax to abs */
 156         addr_offset = 1;
 157         break;
 158     default:
 159         return 0;
 160     }
 161     p = rip + addr_offset;
 162     addr = read_byte_virt(env, p++);
 163     addr |= read_byte_virt(env, p++) << 8;
 164     addr |= read_byte_virt(env, p++) << 16;
 165     addr |= read_byte_virt(env, p++) << 24;
 166     if ((addr & 0xfff) != 0x80)
 167         return 0;
 168     real_tpr = addr;
 169     update_vbios_real_tpr();
 170     return 1;
 171 }
 172
 173 static int bios_is_mapped(CPUState *env, uint64_t rip)
 174 {
 175     uint32_t probe;
 176     uint64_t phys;
 177     struct kvm_sregs sregs;
 178     unsigned perms;
 179     uint32_t i;
 180     uint32_t offset, fixup;
 181
 182     if (bios_enabled)
 183         return 1;
 184
 185     kvm_get_sregs(kvm_context, env->cpu_index, &sregs);
 186
 187     probe = (rip & 0xf0000000) + 0xe0000;
 188     phys = map_addr(&sregs, probe, &perms);
 189     if (phys != 0xe0000)
 190         return 0;
 191     bios_addr = probe;
 192     for (i = 0; i < 64; ++i) {
 193         cpu_physical_memory_read(phys, (void *)&vapic_bios, sizeof(vapic_bios));
 194         if (memcmp(vapic_bios.signature, "kvm aPiC", 8) == 0)
 195             break;
 196         phys += 1024;
 197         bios_addr += 1024;
 198     }
 199     if (i == 64)
 200         return 0;
 201     if (bios_addr == vapic_bios.virt_base)
 202         return 1;
 203     vbios_desc_phys = phys;
 204     for (i = vapic_bios.fixup_start; i < vapic_bios.fixup_end; i += 4) {
 205         offset = ldl_phys(phys + i - vapic_bios.virt_base);
 206         fixup = phys + offset;
 207         stl_phys(fixup, ldl_phys(fixup) + bios_addr - vapic_bios.virt_base);
 208     }
 209     vapic_phys = vapic_bios.vapic - vapic_bios.virt_base + phys;
 210     return 1;
 211 }
 212
 213 static int enable_vapic(CPUState *env)
 214 {
 215     struct kvm_sregs sregs;
 216
 217     kvm_get_sregs(kvm_context, env->cpu_index, &sregs);
 218     sregs.tr.selector = 0xdb + (env->cpu_index << 8);
 219     kvm_set_sregs(kvm_context, env->cpu_index, &sregs);
 220
 221     kvm_enable_vapic(kvm_context, env->cpu_index,
 222                      vapic_phys + (env->cpu_index << 7));
 223     return 1;
 224 }
 225
 226 static void patch_call(CPUState *env, uint64_t rip, uint32_t target)
 227 {
 228     uint32_t offset;
 229
 230     offset = target - vapic_bios.virt_base + bios_addr - rip - 5;
 231     write_byte_virt(env, rip, 0xe8); /* call near */
 232     write_byte_virt(env, rip + 1, offset);
 233     write_byte_virt(env, rip + 2, offset >> 8);
 234     write_byte_virt(env, rip + 3, offset >> 16);
 235     write_byte_virt(env, rip + 4, offset >> 24);
 236 }
 237
 238 static void patch_instruction(CPUState *env, uint64_t rip)
 239 {
 240     uint8_t b1, b2;
 241
 242     b1 = read_byte_virt(env, rip);
 243     b2 = read_byte_virt(env, rip + 1);
 244     switch (b1) {
 245     case 0x89: /* mov r32 to r/m32 */
 246         write_byte_virt(env, rip, 0x50 + modrm_reg(b2));  /* push reg */
 247         patch_call(env, rip + 1, vapic_bios.set_tpr);
 248         break;
 249     case 0x8b: /* mov r/m32 to r32 */
 250         write_byte_virt(env, rip, 0x90);
 251         patch_call(env, rip + 1, vapic_bios.get_tpr[modrm_reg(b2)]);
 252         break;
 253     case 0xa1: /* mov abs to eax */
 254         patch_call(env, rip, vapic_bios.get_tpr[0]);
 255         break;
 256     case 0xa3: /* mov eax to abs */
 257         patch_call(env, rip, vapic_bios.set_tpr_eax);
 258         break;
 259     case 0xc7: /* mov imm32, r/m32 (c7/0) */
 260         write_byte_virt(env, rip, 0x68);  /* push imm32 */
 261         write_byte_virt(env, rip + 1, read_byte_virt(env, rip+6));
 262         write_byte_virt(env, rip + 2, read_byte_virt(env, rip+7));
 263         write_byte_virt(env, rip + 3, read_byte_virt(env, rip+8));
 264         write_byte_virt(env, rip + 4, read_byte_virt(env, rip+9));
 265         patch_call(env, rip + 5, vapic_bios.set_tpr);
 266         break;
 267     default:
 268         printf("funny insn %02x %02x\n", b1, b2);
 269     }
 270 }
 271
 272 void kvm_tpr_access_report(CPUState *env, uint64_t rip, int is_write)
 273 {
 274     if (!instruction_is_ok(env, rip, is_write))
 275         return;
 276     if (!bios_is_mapped(env, rip))
 277         return;
 278     if (!enable_vapic(env))
 279         return;
 280     patch_instruction(env, rip);
 281 }
 282
 283 void kvm_tpr_opt_setup(CPUState *env)
 284 {
 285     if (smp_cpus > 1)
 286         return;
 287     kvm_enable_tpr_access_reporting(kvm_context, env->cpu_index);
 288 }