2 * tpr optimization for qemu/kvm
4 * Copyright (C) 2007-2008 Qumranet Technologies
6 * Licensed under the terms of the GNU GPL version 2 or higher.
10 #include "config-host.h"
22 static uint64_t map_addr(struct kvm_sregs
*sregs
, target_ulong virt
, unsigned *perms
)
24 uint64_t mask
= ((1ull << 48) - 1) & ~4095ull;
28 if (sregs
->cr4
& 0x20) {
30 p
= ldq_phys(p
+ 8 * (virt
>> 30));
34 p
= ldq_phys(p
+ 8 * ((virt
>> 21) & 511));
39 p
+= ((virt
>> 12) & 511) << 12;
42 p
= ldq_phys(p
+ 8 * ((virt
>> 12) & 511));
49 p
= ldl_phys(p
+ 4 * ((virt
>> 22) & 1023));
54 p
+= ((virt
>> 12) & 1023) << 12;
57 p
= ldl_phys(p
+ 4 * ((virt
>> 12) & 1023));
66 return p
+ (virt
& 4095);
69 static uint8_t read_byte_virt(CPUState
*env
, target_ulong virt
)
71 struct kvm_sregs sregs
;
73 kvm_get_sregs(env
, &sregs
);
74 return ldub_phys(map_addr(&sregs
, virt
, NULL
));
77 static void write_byte_virt(CPUState
*env
, target_ulong virt
, uint8_t b
)
79 struct kvm_sregs sregs
;
81 kvm_get_sregs(env
, &sregs
);
82 stb_phys(map_addr(&sregs
, virt
, NULL
), b
);
85 static __u64
kvm_rsp_read(CPUState
*env
)
89 kvm_get_regs(env
, ®s
);
102 struct vapic_patches
{
104 uint32_t set_tpr_eax
;
106 uint32_t get_tpr_stack
;
107 } __attribute__((packed
)) up
, mp
;
108 } __attribute__((packed
));
110 static struct vapic_bios vapic_bios
;
112 static uint32_t real_tpr
;
113 static uint32_t bios_addr
;
114 static uint32_t vapic_phys
;
115 static uint32_t bios_enabled
;
116 static uint32_t vbios_desc_phys
;
117 static uint32_t vapic_bios_addr
;
119 static void update_vbios_real_tpr(void)
121 cpu_physical_memory_rw(vbios_desc_phys
, (void *)&vapic_bios
, sizeof vapic_bios
, 0);
122 vapic_bios
.real_tpr
= real_tpr
;
123 vapic_bios
.vcpu_shift
= 7;
124 cpu_physical_memory_rw(vbios_desc_phys
, (void *)&vapic_bios
, sizeof vapic_bios
, 1);
127 static unsigned modrm_reg(uint8_t modrm
)
129 return (modrm
>> 3) & 7;
132 static int is_abs_modrm(uint8_t modrm
)
134 return (modrm
& 0xc7) == 0x05;
137 static int instruction_is_ok(CPUState
*env
, uint64_t rip
, int is_write
)
140 unsigned addr_offset
;
144 if ((rip
& 0xf0000000) != 0x80000000 && (rip
& 0xf0000000) != 0xe0000000)
146 if (kvm_rsp_read(env
) == 0)
148 b1
= read_byte_virt(env
, rip
);
149 b2
= read_byte_virt(env
, rip
+ 1);
151 case 0xc7: /* mov imm32, r/m32 (c7/0) */
152 if (modrm_reg(b2
) != 0)
155 case 0x89: /* mov r32 to r/m32 */
156 case 0x8b: /* mov r/m32 to r32 */
157 if (!is_abs_modrm(b2
))
161 case 0xa1: /* mov abs to eax */
162 case 0xa3: /* mov eax to abs */
165 case 0xff: /* push r/m32 */
166 if (modrm_reg(b2
) != 6 || !is_abs_modrm(b2
))
172 p
= rip
+ addr_offset
;
173 addr
= read_byte_virt(env
, p
++);
174 addr
|= read_byte_virt(env
, p
++) << 8;
175 addr
|= read_byte_virt(env
, p
++) << 16;
176 addr
|= read_byte_virt(env
, p
++) << 24;
177 if ((addr
& 0xfff) != 0x80)
180 update_vbios_real_tpr();
184 static int bios_is_mapped(CPUState
*env
, uint64_t rip
)
188 struct kvm_sregs sregs
;
191 uint32_t offset
, fixup
, start
= vapic_bios_addr
? : 0xe0000;
196 kvm_get_sregs(env
, &sregs
);
198 probe
= (rip
& 0xf0000000) + start
;
199 phys
= map_addr(&sregs
, probe
, &perms
);
203 for (i
= 0; i
< 64; ++i
) {
204 cpu_physical_memory_read(phys
, (void *)&vapic_bios
, sizeof(vapic_bios
));
205 if (memcmp(vapic_bios
.signature
, "kvm aPiC", 8) == 0)
212 if (bios_addr
== vapic_bios
.virt_base
)
214 vbios_desc_phys
= phys
;
215 for (i
= vapic_bios
.fixup_start
; i
< vapic_bios
.fixup_end
; i
+= 4) {
216 offset
= ldl_phys(phys
+ i
- vapic_bios
.virt_base
);
217 fixup
= phys
+ offset
;
218 stl_phys(fixup
, ldl_phys(fixup
) + bios_addr
- vapic_bios
.virt_base
);
220 vapic_phys
= vapic_bios
.vapic
- vapic_bios
.virt_base
+ phys
;
224 static int get_pcr_cpu(CPUState
*env
)
228 kvm_save_registers(env
);
230 if (cpu_memory_rw_debug(env
, env
->segs
[R_FS
].base
+ 0x51, &b
, 1, 0) < 0)
236 static int enable_vapic(CPUState
*env
)
238 static uint8_t one
= 1;
239 int pcr_cpu
= get_pcr_cpu(env
);
244 kvm_enable_vapic(env
, vapic_phys
+ (pcr_cpu
<< 7));
245 cpu_physical_memory_rw(vapic_phys
+ (pcr_cpu
<< 7) + 4, &one
, 1, 1);
251 static void patch_call(CPUState
*env
, uint64_t rip
, uint32_t target
)
255 offset
= target
- vapic_bios
.virt_base
+ bios_addr
- rip
- 5;
256 write_byte_virt(env
, rip
, 0xe8); /* call near */
257 write_byte_virt(env
, rip
+ 1, offset
);
258 write_byte_virt(env
, rip
+ 2, offset
>> 8);
259 write_byte_virt(env
, rip
+ 3, offset
>> 16);
260 write_byte_virt(env
, rip
+ 4, offset
>> 24);
263 static void patch_instruction(CPUState
*env
, uint64_t rip
)
266 struct vapic_patches
*vp
;
268 vp
= smp_cpus
== 1 ? &vapic_bios
.up
: &vapic_bios
.mp
;
269 b1
= read_byte_virt(env
, rip
);
270 b2
= read_byte_virt(env
, rip
+ 1);
272 case 0x89: /* mov r32 to r/m32 */
273 write_byte_virt(env
, rip
, 0x50 + modrm_reg(b2
)); /* push reg */
274 patch_call(env
, rip
+ 1, vp
->set_tpr
);
276 case 0x8b: /* mov r/m32 to r32 */
277 write_byte_virt(env
, rip
, 0x90);
278 patch_call(env
, rip
+ 1, vp
->get_tpr
[modrm_reg(b2
)]);
280 case 0xa1: /* mov abs to eax */
281 patch_call(env
, rip
, vp
->get_tpr
[0]);
283 case 0xa3: /* mov eax to abs */
284 patch_call(env
, rip
, vp
->set_tpr_eax
);
286 case 0xc7: /* mov imm32, r/m32 (c7/0) */
287 write_byte_virt(env
, rip
, 0x68); /* push imm32 */
288 write_byte_virt(env
, rip
+ 1, read_byte_virt(env
, rip
+6));
289 write_byte_virt(env
, rip
+ 2, read_byte_virt(env
, rip
+7));
290 write_byte_virt(env
, rip
+ 3, read_byte_virt(env
, rip
+8));
291 write_byte_virt(env
, rip
+ 4, read_byte_virt(env
, rip
+9));
292 patch_call(env
, rip
+ 5, vp
->set_tpr
);
294 case 0xff: /* push r/m32 */
295 printf("patching push\n");
296 write_byte_virt(env
, rip
, 0x50); /* push eax */
297 patch_call(env
, rip
+ 1, vp
->get_tpr_stack
);
300 printf("funny insn %02x %02x\n", b1
, b2
);
304 void kvm_tpr_access_report(CPUState
*env
, uint64_t rip
, int is_write
)
306 if (!instruction_is_ok(env
, rip
, is_write
))
308 if (!bios_is_mapped(env
, rip
))
310 if (!enable_vapic(env
))
312 patch_instruction(env
, rip
);
315 void kvm_tpr_vcpu_start(CPUState
*env
)
317 kvm_enable_tpr_access_reporting(env
);
322 static void tpr_save(QEMUFile
*f
, void *s
)
326 for (i
= 0; i
< (sizeof vapic_bios
) / 4; ++i
)
327 qemu_put_be32s(f
, &((uint32_t *)&vapic_bios
)[i
]);
328 qemu_put_be32s(f
, &bios_enabled
);
329 qemu_put_be32s(f
, &real_tpr
);
330 qemu_put_be32s(f
, &bios_addr
);
331 qemu_put_be32s(f
, &vapic_phys
);
332 qemu_put_be32s(f
, &vbios_desc_phys
);
335 static int tpr_load(QEMUFile
*f
, void *s
, int version_id
)
342 for (i
= 0; i
< (sizeof vapic_bios
) / 4; ++i
)
343 qemu_get_be32s(f
, &((uint32_t *)&vapic_bios
)[i
]);
344 qemu_get_be32s(f
, &bios_enabled
);
345 qemu_get_be32s(f
, &real_tpr
);
346 qemu_get_be32s(f
, &bios_addr
);
347 qemu_get_be32s(f
, &vapic_phys
);
348 qemu_get_be32s(f
, &vbios_desc_phys
);
351 CPUState
*env
= first_cpu
->next_cpu
;
353 for (env
= first_cpu
; env
!= NULL
; env
= env
->next_cpu
)
360 static void vtpr_ioport_write16(void *opaque
, uint32_t addr
, uint32_t val
)
362 struct kvm_regs regs
;
363 CPUState
*env
= cpu_single_env
;
364 struct kvm_sregs sregs
;
365 kvm_get_regs(env
, ®s
);
366 kvm_get_sregs(env
, &sregs
);
367 vapic_bios_addr
= ((sregs
.cs
.base
+ regs
.rip
) & ~(512 - 1)) + val
;
371 static void vtpr_ioport_write(void *opaque
, uint32_t addr
, uint32_t val
)
373 CPUState
*env
= cpu_single_env
;
374 struct kvm_regs regs
;
375 struct kvm_sregs sregs
;
378 kvm_get_regs(env
, ®s
);
380 write_byte_virt(env
, rip
, 0x66);
381 write_byte_virt(env
, rip
+ 1, 0x90);
384 if (!bios_is_mapped(env
, rip
))
385 printf("bios not mapped?\n");
386 kvm_get_sregs(env
, &sregs
);
387 for (addr
= 0xfffff000u
; addr
>= 0x80000000u
; addr
-= 4096)
388 if (map_addr(&sregs
, addr
, NULL
) == 0xfee00000u
) {
389 real_tpr
= addr
+ 0x80;
393 update_vbios_real_tpr();
397 void kvm_tpr_opt_setup(void)
399 register_savevm("kvm-tpr-opt", 0, 1, tpr_save
, tpr_load
, NULL
);
400 register_ioport_write(0x7e, 1, 1, vtpr_ioport_write
, NULL
);
401 register_ioport_write(0x7e, 2, 2, vtpr_ioport_write16
, NULL
);