2 * TPR optimization for 32-bit Windows guests (XP and Server 2003)
4 * Copyright (C) 2007-2008 Qumranet Technologies
5 * Copyright (C) 2012 Jan Kiszka, Siemens AG
7 * This work is licensed under the terms of the GNU GPL version 2, or
8 * (at your option) any later version. See the COPYING file in the
12 #include "qemu/osdep.h"
13 #include "qemu/module.h"
15 #include "sysemu/sysemu.h"
16 #include "sysemu/cpus.h"
17 #include "sysemu/hw_accel.h"
18 #include "sysemu/kvm.h"
19 #include "sysemu/runstate.h"
20 #include "hw/i386/apic_internal.h"
21 #include "hw/sysbus.h"
22 #include "hw/boards.h"
23 #include "migration/vmstate.h"
25 #include "qom/object.h"
27 #define VAPIC_IO_PORT 0x7e
29 #define VAPIC_CPU_SHIFT 7
31 #define ROM_BLOCK_SIZE 512
32 #define ROM_BLOCK_MASK (~(ROM_BLOCK_SIZE - 1))
34 typedef enum VAPICMode
{
40 typedef struct VAPICHandlers
{
44 uint32_t get_tpr_stack
;
45 } QEMU_PACKED VAPICHandlers
;
47 typedef struct GuestROMState
{
55 uint32_t real_tpr_addr
;
58 } QEMU_PACKED GuestROMState
;
60 struct VAPICROMState
{
65 uint32_t rom_state_paddr
;
66 uint32_t rom_state_vaddr
;
68 uint32_t real_tpr_addr
;
69 GuestROMState rom_state
;
71 bool rom_mapped_writable
;
72 VMChangeStateEntry
*vmsentry
;
75 #define TYPE_VAPIC "kvmvapic"
76 OBJECT_DECLARE_SIMPLE_TYPE(VAPICROMState
, VAPIC
)
78 #define TPR_INSTR_ABS_MODRM 0x1
79 #define TPR_INSTR_MATCH_MODRM_REG 0x2
81 typedef struct TPRInstruction
{
90 /* must be sorted by length, shortest first */
91 static const TPRInstruction tpr_instr
[] = {
92 { /* mov abs to eax */
94 .access
= TPR_ACCESS_READ
,
98 { /* mov eax to abs */
100 .access
= TPR_ACCESS_WRITE
,
104 { /* mov r32 to r/m32 */
106 .flags
= TPR_INSTR_ABS_MODRM
,
107 .access
= TPR_ACCESS_WRITE
,
111 { /* mov r/m32 to r32 */
113 .flags
= TPR_INSTR_ABS_MODRM
,
114 .access
= TPR_ACCESS_READ
,
121 .flags
= TPR_INSTR_ABS_MODRM
| TPR_INSTR_MATCH_MODRM_REG
,
122 .access
= TPR_ACCESS_READ
,
126 { /* mov imm32, r/m32 (c7/0) */
129 .flags
= TPR_INSTR_ABS_MODRM
| TPR_INSTR_MATCH_MODRM_REG
,
130 .access
= TPR_ACCESS_WRITE
,
136 static void read_guest_rom_state(VAPICROMState
*s
)
138 cpu_physical_memory_read(s
->rom_state_paddr
, &s
->rom_state
,
139 sizeof(GuestROMState
));
142 static void write_guest_rom_state(VAPICROMState
*s
)
144 cpu_physical_memory_write(s
->rom_state_paddr
, &s
->rom_state
,
145 sizeof(GuestROMState
));
148 static void update_guest_rom_state(VAPICROMState
*s
)
150 read_guest_rom_state(s
);
152 s
->rom_state
.real_tpr_addr
= cpu_to_le32(s
->real_tpr_addr
);
153 s
->rom_state
.vcpu_shift
= cpu_to_le32(VAPIC_CPU_SHIFT
);
155 write_guest_rom_state(s
);
158 static int find_real_tpr_addr(VAPICROMState
*s
, CPUX86State
*env
)
160 CPUState
*cs
= env_cpu(env
);
164 if (s
->state
== VAPIC_ACTIVE
) {
168 * If there is no prior TPR access instruction we could analyze (which is
169 * the case after resume from hibernation), we need to scan the possible
170 * virtual address space for the APIC mapping.
172 for (addr
= 0xfffff000; addr
>= 0x80000000; addr
-= TARGET_PAGE_SIZE
) {
173 paddr
= cpu_get_phys_page_debug(cs
, addr
);
174 if (paddr
!= APIC_DEFAULT_ADDRESS
) {
177 s
->real_tpr_addr
= addr
+ 0x80;
178 update_guest_rom_state(s
);
184 static uint8_t modrm_reg(uint8_t modrm
)
186 return (modrm
>> 3) & 7;
189 static bool is_abs_modrm(uint8_t modrm
)
191 return (modrm
& 0xc7) == 0x05;
194 static bool opcode_matches(uint8_t *opcode
, const TPRInstruction
*instr
)
196 return opcode
[0] == instr
->opcode
&&
197 (!(instr
->flags
& TPR_INSTR_ABS_MODRM
) || is_abs_modrm(opcode
[1])) &&
198 (!(instr
->flags
& TPR_INSTR_MATCH_MODRM_REG
) ||
199 modrm_reg(opcode
[1]) == instr
->modrm_reg
);
202 static int evaluate_tpr_instruction(VAPICROMState
*s
, X86CPU
*cpu
,
203 target_ulong
*pip
, TPRAccess access
)
205 CPUState
*cs
= CPU(cpu
);
206 const TPRInstruction
*instr
;
207 target_ulong ip
= *pip
;
209 uint32_t real_tpr_addr
;
212 if ((ip
& 0xf0000000ULL
) != 0x80000000ULL
&&
213 (ip
& 0xf0000000ULL
) != 0xe0000000ULL
) {
218 * Early Windows 2003 SMP initialization contains a
222 * instruction that is patched by TPR optimization. The problem is that
223 * RSP, used by the patched instruction, is zero, so the guest gets a
224 * double fault and dies.
226 if (cpu
->env
.regs
[R_ESP
] == 0) {
230 if (kvm_enabled() && !kvm_irqchip_in_kernel()) {
232 * KVM without kernel-based TPR access reporting will pass an IP that
233 * points after the accessing instruction. So we need to look backward
234 * to find the reason.
236 for (i
= 0; i
< ARRAY_SIZE(tpr_instr
); i
++) {
237 instr
= &tpr_instr
[i
];
238 if (instr
->access
!= access
) {
241 if (cpu_memory_rw_debug(cs
, ip
- instr
->length
, opcode
,
242 sizeof(opcode
), 0) < 0) {
245 if (opcode_matches(opcode
, instr
)) {
252 if (cpu_memory_rw_debug(cs
, ip
, opcode
, sizeof(opcode
), 0) < 0) {
255 for (i
= 0; i
< ARRAY_SIZE(tpr_instr
); i
++) {
256 instr
= &tpr_instr
[i
];
257 if (opcode_matches(opcode
, instr
)) {
266 * Grab the virtual TPR address from the instruction
267 * and update the cached values.
269 if (cpu_memory_rw_debug(cs
, ip
+ instr
->addr_offset
,
270 (void *)&real_tpr_addr
,
271 sizeof(real_tpr_addr
), 0) < 0) {
274 real_tpr_addr
= le32_to_cpu(real_tpr_addr
);
275 if ((real_tpr_addr
& 0xfff) != 0x80) {
278 s
->real_tpr_addr
= real_tpr_addr
;
279 update_guest_rom_state(s
);
285 static int update_rom_mapping(VAPICROMState
*s
, CPUX86State
*env
, target_ulong ip
)
287 CPUState
*cs
= env_cpu(env
);
289 uint32_t rom_state_vaddr
;
290 uint32_t pos
, patch
, offset
;
292 /* nothing to do if already activated */
293 if (s
->state
== VAPIC_ACTIVE
) {
297 /* bail out if ROM init code was not executed (missing ROM?) */
298 if (s
->state
== VAPIC_INACTIVE
) {
302 /* find out virtual address of the ROM */
303 rom_state_vaddr
= s
->rom_state_paddr
+ (ip
& 0xf0000000);
304 paddr
= cpu_get_phys_page_debug(cs
, rom_state_vaddr
);
308 paddr
+= rom_state_vaddr
& ~TARGET_PAGE_MASK
;
309 if (paddr
!= s
->rom_state_paddr
) {
312 read_guest_rom_state(s
);
313 if (memcmp(s
->rom_state
.signature
, "kvm aPiC", 8) != 0) {
316 s
->rom_state_vaddr
= rom_state_vaddr
;
318 /* fixup addresses in ROM if needed */
319 if (rom_state_vaddr
== le32_to_cpu(s
->rom_state
.vaddr
)) {
322 for (pos
= le32_to_cpu(s
->rom_state
.fixup_start
);
323 pos
< le32_to_cpu(s
->rom_state
.fixup_end
);
325 cpu_physical_memory_read(paddr
+ pos
- s
->rom_state
.vaddr
,
326 &offset
, sizeof(offset
));
327 offset
= le32_to_cpu(offset
);
328 cpu_physical_memory_read(paddr
+ offset
, &patch
, sizeof(patch
));
329 patch
= le32_to_cpu(patch
);
330 patch
+= rom_state_vaddr
- le32_to_cpu(s
->rom_state
.vaddr
);
331 patch
= cpu_to_le32(patch
);
332 cpu_physical_memory_write(paddr
+ offset
, &patch
, sizeof(patch
));
334 read_guest_rom_state(s
);
335 s
->vapic_paddr
= paddr
+ le32_to_cpu(s
->rom_state
.vapic_vaddr
) -
336 le32_to_cpu(s
->rom_state
.vaddr
);
342 * Tries to read the unique processor number from the Kernel Processor Control
343 * Region (KPCR) of 32-bit Windows XP and Server 2003. Returns -1 if the KPCR
344 * cannot be accessed or is considered invalid. This also ensures that we are
345 * not patching the wrong guest.
347 static int get_kpcr_number(X86CPU
*cpu
)
349 CPUX86State
*env
= &cpu
->env
;
357 if (cpu_memory_rw_debug(CPU(cpu
), env
->segs
[R_FS
].base
,
358 (void *)&kpcr
, sizeof(kpcr
), 0) < 0 ||
359 kpcr
.self
!= env
->segs
[R_FS
].base
) {
365 static int vapic_enable(VAPICROMState
*s
, X86CPU
*cpu
)
367 int cpu_number
= get_kpcr_number(cpu
);
369 static const uint8_t enabled
= 1;
371 if (cpu_number
< 0) {
374 vapic_paddr
= s
->vapic_paddr
+
375 (((hwaddr
)cpu_number
) << VAPIC_CPU_SHIFT
);
376 cpu_physical_memory_write(vapic_paddr
+ offsetof(VAPICState
, enabled
),
377 &enabled
, sizeof(enabled
));
378 apic_enable_vapic(cpu
->apic_state
, vapic_paddr
);
380 s
->state
= VAPIC_ACTIVE
;
385 static void patch_byte(X86CPU
*cpu
, target_ulong addr
, uint8_t byte
)
387 cpu_memory_rw_debug(CPU(cpu
), addr
, &byte
, 1, 1);
390 static void patch_call(X86CPU
*cpu
, target_ulong ip
, uint32_t target
)
394 offset
= cpu_to_le32(target
- ip
- 5);
395 patch_byte(cpu
, ip
, 0xe8); /* call near */
396 cpu_memory_rw_debug(CPU(cpu
), ip
+ 1, (void *)&offset
, sizeof(offset
), 1);
399 typedef struct PatchInfo
{
400 VAPICHandlers
*handler
;
404 static void do_patch_instruction(CPUState
*cs
, run_on_cpu_data data
)
406 X86CPU
*x86_cpu
= X86_CPU(cs
);
407 PatchInfo
*info
= (PatchInfo
*) data
.host_ptr
;
408 VAPICHandlers
*handlers
= info
->handler
;
409 target_ulong ip
= info
->ip
;
413 cpu_memory_rw_debug(cs
, ip
, opcode
, sizeof(opcode
), 0);
416 case 0x89: /* mov r32 to r/m32 */
417 patch_byte(x86_cpu
, ip
, 0x50 + modrm_reg(opcode
[1])); /* push reg */
418 patch_call(x86_cpu
, ip
+ 1, handlers
->set_tpr
);
420 case 0x8b: /* mov r/m32 to r32 */
421 patch_byte(x86_cpu
, ip
, 0x90);
422 patch_call(x86_cpu
, ip
+ 1, handlers
->get_tpr
[modrm_reg(opcode
[1])]);
424 case 0xa1: /* mov abs to eax */
425 patch_call(x86_cpu
, ip
, handlers
->get_tpr
[0]);
427 case 0xa3: /* mov eax to abs */
428 patch_call(x86_cpu
, ip
, handlers
->set_tpr_eax
);
430 case 0xc7: /* mov imm32, r/m32 (c7/0) */
431 patch_byte(x86_cpu
, ip
, 0x68); /* push imm32 */
432 cpu_memory_rw_debug(cs
, ip
+ 6, (void *)&imm32
, sizeof(imm32
), 0);
433 cpu_memory_rw_debug(cs
, ip
+ 1, (void *)&imm32
, sizeof(imm32
), 1);
434 patch_call(x86_cpu
, ip
+ 5, handlers
->set_tpr
);
436 case 0xff: /* push r/m32 */
437 patch_byte(x86_cpu
, ip
, 0x50); /* push eax */
438 patch_call(x86_cpu
, ip
+ 1, handlers
->get_tpr_stack
);
447 static void patch_instruction(VAPICROMState
*s
, X86CPU
*cpu
, target_ulong ip
)
449 MachineState
*ms
= MACHINE(qdev_get_machine());
450 CPUState
*cs
= CPU(cpu
);
451 VAPICHandlers
*handlers
;
454 if (ms
->smp
.cpus
== 1) {
455 handlers
= &s
->rom_state
.up
;
457 handlers
= &s
->rom_state
.mp
;
460 info
= g_new(PatchInfo
, 1);
461 info
->handler
= handlers
;
464 async_safe_run_on_cpu(cs
, do_patch_instruction
, RUN_ON_CPU_HOST_PTR(info
));
467 void vapic_report_tpr_access(DeviceState
*dev
, CPUState
*cs
, target_ulong ip
,
470 VAPICROMState
*s
= VAPIC(dev
);
471 X86CPU
*cpu
= X86_CPU(cs
);
472 CPUX86State
*env
= &cpu
->env
;
474 cpu_synchronize_state(cs
);
476 if (evaluate_tpr_instruction(s
, cpu
, &ip
, access
) < 0) {
477 if (s
->state
== VAPIC_ACTIVE
) {
478 vapic_enable(s
, cpu
);
482 if (update_rom_mapping(s
, env
, ip
) < 0) {
485 if (vapic_enable(s
, cpu
) < 0) {
488 patch_instruction(s
, cpu
, ip
);
491 typedef struct VAPICEnableTPRReporting
{
494 } VAPICEnableTPRReporting
;
496 static void vapic_do_enable_tpr_reporting(CPUState
*cpu
, run_on_cpu_data data
)
498 VAPICEnableTPRReporting
*info
= data
.host_ptr
;
499 apic_enable_tpr_access_reporting(info
->apic
, info
->enable
);
502 static void vapic_enable_tpr_reporting(bool enable
)
504 VAPICEnableTPRReporting info
= {
512 info
.apic
= cpu
->apic_state
;
513 run_on_cpu(cs
, vapic_do_enable_tpr_reporting
, RUN_ON_CPU_HOST_PTR(&info
));
517 static void vapic_reset(DeviceState
*dev
)
519 VAPICROMState
*s
= VAPIC(dev
);
521 s
->state
= VAPIC_INACTIVE
;
522 s
->rom_state_paddr
= 0;
523 vapic_enable_tpr_reporting(false);
527 * Set the IRQ polling hypercalls to the supported variant:
528 * - vmcall if using KVM in-kernel irqchip
529 * - 32-bit VAPIC port write otherwise
531 static int patch_hypercalls(VAPICROMState
*s
)
533 hwaddr rom_paddr
= s
->rom_state_paddr
& ROM_BLOCK_MASK
;
534 static const uint8_t vmcall_pattern
[] = { /* vmcall */
535 0xb8, 0x1, 0, 0, 0, 0xf, 0x1, 0xc1
537 static const uint8_t outl_pattern
[] = { /* nop; outl %eax,0x7e */
538 0xb8, 0x1, 0, 0, 0, 0x90, 0xe7, 0x7e
540 uint8_t alternates
[2];
541 const uint8_t *pattern
;
542 const uint8_t *patch
;
546 rom
= g_malloc(s
->rom_size
);
547 cpu_physical_memory_read(rom_paddr
, rom
, s
->rom_size
);
549 for (pos
= 0; pos
< s
->rom_size
- sizeof(vmcall_pattern
); pos
++) {
550 if (kvm_irqchip_in_kernel()) {
551 pattern
= outl_pattern
;
552 alternates
[0] = outl_pattern
[7];
553 alternates
[1] = outl_pattern
[7];
554 patch
= &vmcall_pattern
[5];
556 pattern
= vmcall_pattern
;
557 alternates
[0] = vmcall_pattern
[7];
558 alternates
[1] = 0xd9; /* AMD's VMMCALL */
559 patch
= &outl_pattern
[5];
561 if (memcmp(rom
+ pos
, pattern
, 7) == 0 &&
562 (rom
[pos
+ 7] == alternates
[0] || rom
[pos
+ 7] == alternates
[1])) {
563 cpu_physical_memory_write(rom_paddr
+ pos
+ 5, patch
, 3);
565 * Don't flush the tb here. Under ordinary conditions, the patched
566 * calls are miles away from the current IP. Under malicious
567 * conditions, the guest could trick us to crash.
577 * For TCG mode or the time KVM honors read-only memory regions, we need to
578 * enable write access to the option ROM so that variables can be updated by
581 static int vapic_map_rom_writable(VAPICROMState
*s
)
583 hwaddr rom_paddr
= s
->rom_state_paddr
& ROM_BLOCK_MASK
;
584 MemoryRegionSection section
;
589 as
= sysbus_address_space(&s
->busdev
);
591 if (s
->rom_mapped_writable
) {
592 memory_region_del_subregion(as
, &s
->rom
);
593 object_unparent(OBJECT(&s
->rom
));
596 /* grab RAM memory region (region @rom_paddr may still be pc.rom) */
597 section
= memory_region_find(as
, 0, 1);
599 /* read ROM size from RAM region */
600 if (rom_paddr
+ 2 >= memory_region_size(section
.mr
)) {
603 ram
= memory_region_get_ram_ptr(section
.mr
);
604 rom_size
= ram
[rom_paddr
+ 2] * ROM_BLOCK_SIZE
;
608 s
->rom_size
= rom_size
;
610 /* We need to round to avoid creating subpages
611 * from which we cannot run code. */
612 rom_size
+= rom_paddr
& ~TARGET_PAGE_MASK
;
613 rom_paddr
&= TARGET_PAGE_MASK
;
614 rom_size
= TARGET_PAGE_ALIGN(rom_size
);
616 memory_region_init_alias(&s
->rom
, OBJECT(s
), "kvmvapic-rom", section
.mr
,
617 rom_paddr
, rom_size
);
618 memory_region_add_subregion_overlap(as
, rom_paddr
, &s
->rom
, 1000);
619 s
->rom_mapped_writable
= true;
620 memory_region_unref(section
.mr
);
625 static int vapic_prepare(VAPICROMState
*s
)
627 if (vapic_map_rom_writable(s
) < 0) {
631 if (patch_hypercalls(s
) < 0) {
635 vapic_enable_tpr_reporting(true);
640 static void vapic_write(void *opaque
, hwaddr addr
, uint64_t data
,
643 VAPICROMState
*s
= opaque
;
652 cpu_synchronize_state(current_cpu
);
653 cpu
= X86_CPU(current_cpu
);
657 * The VAPIC supports two PIO-based hypercalls, both via port 0x7E.
658 * o 16-bit write access:
659 * Reports the option ROM initialization to the hypervisor. Written
660 * value is the offset of the state structure in the ROM.
661 * o 8-bit write access:
662 * Reactivates the VAPIC after a guest hibernation, i.e. after the
663 * option ROM content has been re-initialized by a guest power cycle.
664 * o 32-bit write access:
665 * Poll for pending IRQs, considering the current VAPIC state.
669 if (s
->state
== VAPIC_INACTIVE
) {
670 rom_paddr
= (env
->segs
[R_CS
].base
+ env
->eip
) & ROM_BLOCK_MASK
;
671 s
->rom_state_paddr
= rom_paddr
+ data
;
673 s
->state
= VAPIC_STANDBY
;
675 if (vapic_prepare(s
) < 0) {
676 s
->state
= VAPIC_INACTIVE
;
677 s
->rom_state_paddr
= 0;
684 * Disable triggering instruction in ROM by writing a NOP.
686 * We cannot do this in TCG mode as the reported IP is not
690 patch_byte(cpu
, env
->eip
- 2, 0x66);
691 patch_byte(cpu
, env
->eip
- 1, 0x90);
695 if (s
->state
== VAPIC_ACTIVE
) {
698 if (update_rom_mapping(s
, env
, env
->eip
) < 0) {
701 if (find_real_tpr_addr(s
, env
) < 0) {
704 vapic_enable(s
, cpu
);
708 if (!kvm_irqchip_in_kernel()) {
709 apic_poll_irq(cpu
->apic_state
);
715 static uint64_t vapic_read(void *opaque
, hwaddr addr
, unsigned size
)
720 static const MemoryRegionOps vapic_ops
= {
721 .write
= vapic_write
,
723 .endianness
= DEVICE_NATIVE_ENDIAN
,
726 static void vapic_realize(DeviceState
*dev
, Error
**errp
)
728 SysBusDevice
*sbd
= SYS_BUS_DEVICE(dev
);
729 VAPICROMState
*s
= VAPIC(dev
);
731 memory_region_init_io(&s
->io
, OBJECT(s
), &vapic_ops
, s
, "kvmvapic", 2);
732 sysbus_add_io(sbd
, VAPIC_IO_PORT
, &s
->io
);
733 sysbus_init_ioports(sbd
, VAPIC_IO_PORT
, 2);
735 option_rom
[nb_option_roms
].name
= "kvmvapic.bin";
736 option_rom
[nb_option_roms
].bootindex
= -1;
740 static void do_vapic_enable(CPUState
*cs
, run_on_cpu_data data
)
742 VAPICROMState
*s
= data
.host_ptr
;
743 X86CPU
*cpu
= X86_CPU(cs
);
745 static const uint8_t enabled
= 1;
746 cpu_physical_memory_write(s
->vapic_paddr
+ offsetof(VAPICState
, enabled
),
747 &enabled
, sizeof(enabled
));
748 apic_enable_vapic(cpu
->apic_state
, s
->vapic_paddr
);
749 s
->state
= VAPIC_ACTIVE
;
752 static void kvmvapic_vm_state_change(void *opaque
, int running
,
755 MachineState
*ms
= MACHINE(qdev_get_machine());
756 VAPICROMState
*s
= opaque
;
763 if (s
->state
== VAPIC_ACTIVE
) {
764 if (ms
->smp
.cpus
== 1) {
765 run_on_cpu(first_cpu
, do_vapic_enable
, RUN_ON_CPU_HOST_PTR(s
));
767 zero
= g_malloc0(s
->rom_state
.vapic_size
);
768 cpu_physical_memory_write(s
->vapic_paddr
, zero
,
769 s
->rom_state
.vapic_size
);
774 qemu_del_vm_change_state_handler(s
->vmsentry
);
778 static int vapic_post_load(void *opaque
, int version_id
)
780 VAPICROMState
*s
= opaque
;
783 * The old implementation of qemu-kvm did not provide the state
784 * VAPIC_STANDBY. Reconstruct it.
786 if (s
->state
== VAPIC_INACTIVE
&& s
->rom_state_paddr
!= 0) {
787 s
->state
= VAPIC_STANDBY
;
790 if (s
->state
!= VAPIC_INACTIVE
) {
791 if (vapic_prepare(s
) < 0) {
798 qemu_add_vm_change_state_handler(kvmvapic_vm_state_change
, s
);
803 static const VMStateDescription vmstate_handlers
= {
804 .name
= "kvmvapic-handlers",
806 .minimum_version_id
= 1,
807 .fields
= (VMStateField
[]) {
808 VMSTATE_UINT32(set_tpr
, VAPICHandlers
),
809 VMSTATE_UINT32(set_tpr_eax
, VAPICHandlers
),
810 VMSTATE_UINT32_ARRAY(get_tpr
, VAPICHandlers
, 8),
811 VMSTATE_UINT32(get_tpr_stack
, VAPICHandlers
),
812 VMSTATE_END_OF_LIST()
816 static const VMStateDescription vmstate_guest_rom
= {
817 .name
= "kvmvapic-guest-rom",
819 .minimum_version_id
= 1,
820 .fields
= (VMStateField
[]) {
821 VMSTATE_UNUSED(8), /* signature */
822 VMSTATE_UINT32(vaddr
, GuestROMState
),
823 VMSTATE_UINT32(fixup_start
, GuestROMState
),
824 VMSTATE_UINT32(fixup_end
, GuestROMState
),
825 VMSTATE_UINT32(vapic_vaddr
, GuestROMState
),
826 VMSTATE_UINT32(vapic_size
, GuestROMState
),
827 VMSTATE_UINT32(vcpu_shift
, GuestROMState
),
828 VMSTATE_UINT32(real_tpr_addr
, GuestROMState
),
829 VMSTATE_STRUCT(up
, GuestROMState
, 0, vmstate_handlers
, VAPICHandlers
),
830 VMSTATE_STRUCT(mp
, GuestROMState
, 0, vmstate_handlers
, VAPICHandlers
),
831 VMSTATE_END_OF_LIST()
835 static const VMStateDescription vmstate_vapic
= {
836 .name
= "kvm-tpr-opt", /* compatible with qemu-kvm VAPIC */
838 .minimum_version_id
= 1,
839 .post_load
= vapic_post_load
,
840 .fields
= (VMStateField
[]) {
841 VMSTATE_STRUCT(rom_state
, VAPICROMState
, 0, vmstate_guest_rom
,
843 VMSTATE_UINT32(state
, VAPICROMState
),
844 VMSTATE_UINT32(real_tpr_addr
, VAPICROMState
),
845 VMSTATE_UINT32(rom_state_vaddr
, VAPICROMState
),
846 VMSTATE_UINT32(vapic_paddr
, VAPICROMState
),
847 VMSTATE_UINT32(rom_state_paddr
, VAPICROMState
),
848 VMSTATE_END_OF_LIST()
852 static void vapic_class_init(ObjectClass
*klass
, void *data
)
854 DeviceClass
*dc
= DEVICE_CLASS(klass
);
856 dc
->reset
= vapic_reset
;
857 dc
->vmsd
= &vmstate_vapic
;
858 dc
->realize
= vapic_realize
;
861 static const TypeInfo vapic_type
= {
863 .parent
= TYPE_SYS_BUS_DEVICE
,
864 .instance_size
= sizeof(VAPICROMState
),
865 .class_init
= vapic_class_init
,
868 static void vapic_register(void)
870 type_register_static(&vapic_type
);
873 type_init(vapic_register
);