2 * TPR optimization for 32-bit Windows guests (XP and Server 2003)
4 * Copyright (C) 2007-2008 Qumranet Technologies
5 * Copyright (C) 2012 Jan Kiszka, Siemens AG
7 * This work is licensed under the terms of the GNU GPL version 2, or
8 * (at your option) any later version. See the COPYING file in the
11 #include "sysemu/sysemu.h"
12 #include "sysemu/cpus.h"
13 #include "sysemu/kvm.h"
14 #include "hw/i386/apic_internal.h"
15 #include "hw/sysbus.h"
17 #define VAPIC_IO_PORT 0x7e
19 #define VAPIC_CPU_SHIFT 7
21 #define ROM_BLOCK_SIZE 512
22 #define ROM_BLOCK_MASK (~(ROM_BLOCK_SIZE - 1))
24 typedef enum VAPICMode
{
30 typedef struct VAPICHandlers
{
34 uint32_t get_tpr_stack
;
35 } QEMU_PACKED VAPICHandlers
;
37 typedef struct GuestROMState
{
45 uint32_t real_tpr_addr
;
48 } QEMU_PACKED GuestROMState
;
50 typedef struct VAPICROMState
{
55 uint32_t rom_state_paddr
;
56 uint32_t rom_state_vaddr
;
58 uint32_t real_tpr_addr
;
59 GuestROMState rom_state
;
61 bool rom_mapped_writable
;
64 #define TYPE_VAPIC "kvmvapic"
65 #define VAPIC(obj) OBJECT_CHECK(VAPICROMState, (obj), TYPE_VAPIC)
67 #define TPR_INSTR_ABS_MODRM 0x1
68 #define TPR_INSTR_MATCH_MODRM_REG 0x2
70 typedef struct TPRInstruction
{
79 /* must be sorted by length, shortest first */
80 static const TPRInstruction tpr_instr
[] = {
81 { /* mov abs to eax */
83 .access
= TPR_ACCESS_READ
,
87 { /* mov eax to abs */
89 .access
= TPR_ACCESS_WRITE
,
93 { /* mov r32 to r/m32 */
95 .flags
= TPR_INSTR_ABS_MODRM
,
96 .access
= TPR_ACCESS_WRITE
,
100 { /* mov r/m32 to r32 */
102 .flags
= TPR_INSTR_ABS_MODRM
,
103 .access
= TPR_ACCESS_READ
,
110 .flags
= TPR_INSTR_ABS_MODRM
| TPR_INSTR_MATCH_MODRM_REG
,
111 .access
= TPR_ACCESS_READ
,
115 { /* mov imm32, r/m32 (c7/0) */
118 .flags
= TPR_INSTR_ABS_MODRM
| TPR_INSTR_MATCH_MODRM_REG
,
119 .access
= TPR_ACCESS_WRITE
,
125 static void read_guest_rom_state(VAPICROMState
*s
)
127 cpu_physical_memory_read(s
->rom_state_paddr
, &s
->rom_state
,
128 sizeof(GuestROMState
));
131 static void write_guest_rom_state(VAPICROMState
*s
)
133 cpu_physical_memory_write(s
->rom_state_paddr
, &s
->rom_state
,
134 sizeof(GuestROMState
));
137 static void update_guest_rom_state(VAPICROMState
*s
)
139 read_guest_rom_state(s
);
141 s
->rom_state
.real_tpr_addr
= cpu_to_le32(s
->real_tpr_addr
);
142 s
->rom_state
.vcpu_shift
= cpu_to_le32(VAPIC_CPU_SHIFT
);
144 write_guest_rom_state(s
);
147 static int find_real_tpr_addr(VAPICROMState
*s
, CPUX86State
*env
)
149 CPUState
*cs
= CPU(x86_env_get_cpu(env
));
153 if (s
->state
== VAPIC_ACTIVE
) {
157 * If there is no prior TPR access instruction we could analyze (which is
158 * the case after resume from hibernation), we need to scan the possible
159 * virtual address space for the APIC mapping.
161 for (addr
= 0xfffff000; addr
>= 0x80000000; addr
-= TARGET_PAGE_SIZE
) {
162 paddr
= cpu_get_phys_page_debug(cs
, addr
);
163 if (paddr
!= APIC_DEFAULT_ADDRESS
) {
166 s
->real_tpr_addr
= addr
+ 0x80;
167 update_guest_rom_state(s
);
173 static uint8_t modrm_reg(uint8_t modrm
)
175 return (modrm
>> 3) & 7;
178 static bool is_abs_modrm(uint8_t modrm
)
180 return (modrm
& 0xc7) == 0x05;
183 static bool opcode_matches(uint8_t *opcode
, const TPRInstruction
*instr
)
185 return opcode
[0] == instr
->opcode
&&
186 (!(instr
->flags
& TPR_INSTR_ABS_MODRM
) || is_abs_modrm(opcode
[1])) &&
187 (!(instr
->flags
& TPR_INSTR_MATCH_MODRM_REG
) ||
188 modrm_reg(opcode
[1]) == instr
->modrm_reg
);
191 static int evaluate_tpr_instruction(VAPICROMState
*s
, X86CPU
*cpu
,
192 target_ulong
*pip
, TPRAccess access
)
194 CPUState
*cs
= CPU(cpu
);
195 const TPRInstruction
*instr
;
196 target_ulong ip
= *pip
;
198 uint32_t real_tpr_addr
;
201 if ((ip
& 0xf0000000ULL
) != 0x80000000ULL
&&
202 (ip
& 0xf0000000ULL
) != 0xe0000000ULL
) {
207 * Early Windows 2003 SMP initialization contains a
211 * instruction that is patched by TPR optimization. The problem is that
212 * RSP, used by the patched instruction, is zero, so the guest gets a
213 * double fault and dies.
215 if (cpu
->env
.regs
[R_ESP
] == 0) {
219 if (kvm_enabled() && !kvm_irqchip_in_kernel()) {
221 * KVM without kernel-based TPR access reporting will pass an IP that
222 * points after the accessing instruction. So we need to look backward
223 * to find the reason.
225 for (i
= 0; i
< ARRAY_SIZE(tpr_instr
); i
++) {
226 instr
= &tpr_instr
[i
];
227 if (instr
->access
!= access
) {
230 if (cpu_memory_rw_debug(cs
, ip
- instr
->length
, opcode
,
231 sizeof(opcode
), 0) < 0) {
234 if (opcode_matches(opcode
, instr
)) {
241 if (cpu_memory_rw_debug(cs
, ip
, opcode
, sizeof(opcode
), 0) < 0) {
244 for (i
= 0; i
< ARRAY_SIZE(tpr_instr
); i
++) {
245 instr
= &tpr_instr
[i
];
246 if (opcode_matches(opcode
, instr
)) {
255 * Grab the virtual TPR address from the instruction
256 * and update the cached values.
258 if (cpu_memory_rw_debug(cs
, ip
+ instr
->addr_offset
,
259 (void *)&real_tpr_addr
,
260 sizeof(real_tpr_addr
), 0) < 0) {
263 real_tpr_addr
= le32_to_cpu(real_tpr_addr
);
264 if ((real_tpr_addr
& 0xfff) != 0x80) {
267 s
->real_tpr_addr
= real_tpr_addr
;
268 update_guest_rom_state(s
);
274 static int update_rom_mapping(VAPICROMState
*s
, CPUX86State
*env
, target_ulong ip
)
276 CPUState
*cs
= CPU(x86_env_get_cpu(env
));
278 uint32_t rom_state_vaddr
;
279 uint32_t pos
, patch
, offset
;
281 /* nothing to do if already activated */
282 if (s
->state
== VAPIC_ACTIVE
) {
286 /* bail out if ROM init code was not executed (missing ROM?) */
287 if (s
->state
== VAPIC_INACTIVE
) {
291 /* find out virtual address of the ROM */
292 rom_state_vaddr
= s
->rom_state_paddr
+ (ip
& 0xf0000000);
293 paddr
= cpu_get_phys_page_debug(cs
, rom_state_vaddr
);
297 paddr
+= rom_state_vaddr
& ~TARGET_PAGE_MASK
;
298 if (paddr
!= s
->rom_state_paddr
) {
301 read_guest_rom_state(s
);
302 if (memcmp(s
->rom_state
.signature
, "kvm aPiC", 8) != 0) {
305 s
->rom_state_vaddr
= rom_state_vaddr
;
307 /* fixup addresses in ROM if needed */
308 if (rom_state_vaddr
== le32_to_cpu(s
->rom_state
.vaddr
)) {
311 for (pos
= le32_to_cpu(s
->rom_state
.fixup_start
);
312 pos
< le32_to_cpu(s
->rom_state
.fixup_end
);
314 cpu_physical_memory_read(paddr
+ pos
- s
->rom_state
.vaddr
,
315 &offset
, sizeof(offset
));
316 offset
= le32_to_cpu(offset
);
317 cpu_physical_memory_read(paddr
+ offset
, &patch
, sizeof(patch
));
318 patch
= le32_to_cpu(patch
);
319 patch
+= rom_state_vaddr
- le32_to_cpu(s
->rom_state
.vaddr
);
320 patch
= cpu_to_le32(patch
);
321 cpu_physical_memory_write(paddr
+ offset
, &patch
, sizeof(patch
));
323 read_guest_rom_state(s
);
324 s
->vapic_paddr
= paddr
+ le32_to_cpu(s
->rom_state
.vapic_vaddr
) -
325 le32_to_cpu(s
->rom_state
.vaddr
);
331 * Tries to read the unique processor number from the Kernel Processor Control
332 * Region (KPCR) of 32-bit Windows XP and Server 2003. Returns -1 if the KPCR
333 * cannot be accessed or is considered invalid. This also ensures that we are
334 * not patching the wrong guest.
336 static int get_kpcr_number(X86CPU
*cpu
)
338 CPUX86State
*env
= &cpu
->env
;
346 if (cpu_memory_rw_debug(CPU(cpu
), env
->segs
[R_FS
].base
,
347 (void *)&kpcr
, sizeof(kpcr
), 0) < 0 ||
348 kpcr
.self
!= env
->segs
[R_FS
].base
) {
354 static int vapic_enable(VAPICROMState
*s
, X86CPU
*cpu
)
356 int cpu_number
= get_kpcr_number(cpu
);
358 static const uint8_t enabled
= 1;
360 if (cpu_number
< 0) {
363 vapic_paddr
= s
->vapic_paddr
+
364 (((hwaddr
)cpu_number
) << VAPIC_CPU_SHIFT
);
365 cpu_physical_memory_write(vapic_paddr
+ offsetof(VAPICState
, enabled
),
366 &enabled
, sizeof(enabled
));
367 apic_enable_vapic(cpu
->apic_state
, vapic_paddr
);
369 s
->state
= VAPIC_ACTIVE
;
374 static void patch_byte(X86CPU
*cpu
, target_ulong addr
, uint8_t byte
)
376 cpu_memory_rw_debug(CPU(cpu
), addr
, &byte
, 1, 1);
379 static void patch_call(VAPICROMState
*s
, X86CPU
*cpu
, target_ulong ip
,
384 offset
= cpu_to_le32(target
- ip
- 5);
385 patch_byte(cpu
, ip
, 0xe8); /* call near */
386 cpu_memory_rw_debug(CPU(cpu
), ip
+ 1, (void *)&offset
, sizeof(offset
), 1);
389 static void patch_instruction(VAPICROMState
*s
, X86CPU
*cpu
, target_ulong ip
)
391 CPUState
*cs
= CPU(cpu
);
392 CPUX86State
*env
= &cpu
->env
;
393 VAPICHandlers
*handlers
;
396 target_ulong current_pc
= 0;
397 target_ulong current_cs_base
= 0;
398 int current_flags
= 0;
401 handlers
= &s
->rom_state
.up
;
403 handlers
= &s
->rom_state
.mp
;
406 if (!kvm_enabled()) {
407 cpu_restore_state(cs
, cs
->mem_io_pc
);
408 cpu_get_tb_cpu_state(env
, ¤t_pc
, ¤t_cs_base
,
414 cpu_memory_rw_debug(cs
, ip
, opcode
, sizeof(opcode
), 0);
417 case 0x89: /* mov r32 to r/m32 */
418 patch_byte(cpu
, ip
, 0x50 + modrm_reg(opcode
[1])); /* push reg */
419 patch_call(s
, cpu
, ip
+ 1, handlers
->set_tpr
);
421 case 0x8b: /* mov r/m32 to r32 */
422 patch_byte(cpu
, ip
, 0x90);
423 patch_call(s
, cpu
, ip
+ 1, handlers
->get_tpr
[modrm_reg(opcode
[1])]);
425 case 0xa1: /* mov abs to eax */
426 patch_call(s
, cpu
, ip
, handlers
->get_tpr
[0]);
428 case 0xa3: /* mov eax to abs */
429 patch_call(s
, cpu
, ip
, handlers
->set_tpr_eax
);
431 case 0xc7: /* mov imm32, r/m32 (c7/0) */
432 patch_byte(cpu
, ip
, 0x68); /* push imm32 */
433 cpu_memory_rw_debug(cs
, ip
+ 6, (void *)&imm32
, sizeof(imm32
), 0);
434 cpu_memory_rw_debug(cs
, ip
+ 1, (void *)&imm32
, sizeof(imm32
), 1);
435 patch_call(s
, cpu
, ip
+ 5, handlers
->set_tpr
);
437 case 0xff: /* push r/m32 */
438 patch_byte(cpu
, ip
, 0x50); /* push eax */
439 patch_call(s
, cpu
, ip
+ 1, handlers
->get_tpr_stack
);
447 if (!kvm_enabled()) {
448 cs
->current_tb
= NULL
;
449 tb_gen_code(cs
, current_pc
, current_cs_base
, current_flags
, 1);
450 cpu_resume_from_signal(cs
, NULL
);
454 void vapic_report_tpr_access(DeviceState
*dev
, CPUState
*cs
, target_ulong ip
,
457 VAPICROMState
*s
= VAPIC(dev
);
458 X86CPU
*cpu
= X86_CPU(cs
);
459 CPUX86State
*env
= &cpu
->env
;
461 cpu_synchronize_state(cs
);
463 if (evaluate_tpr_instruction(s
, cpu
, &ip
, access
) < 0) {
464 if (s
->state
== VAPIC_ACTIVE
) {
465 vapic_enable(s
, cpu
);
469 if (update_rom_mapping(s
, env
, ip
) < 0) {
472 if (vapic_enable(s
, cpu
) < 0) {
475 patch_instruction(s
, cpu
, ip
);
478 typedef struct VAPICEnableTPRReporting
{
481 } VAPICEnableTPRReporting
;
483 static void vapic_do_enable_tpr_reporting(void *data
)
485 VAPICEnableTPRReporting
*info
= data
;
487 apic_enable_tpr_access_reporting(info
->apic
, info
->enable
);
490 static void vapic_enable_tpr_reporting(bool enable
)
492 VAPICEnableTPRReporting info
= {
500 info
.apic
= cpu
->apic_state
;
501 run_on_cpu(cs
, vapic_do_enable_tpr_reporting
, &info
);
505 static void vapic_reset(DeviceState
*dev
)
507 VAPICROMState
*s
= VAPIC(dev
);
509 s
->state
= VAPIC_INACTIVE
;
510 s
->rom_state_paddr
= 0;
511 vapic_enable_tpr_reporting(false);
515 * Set the IRQ polling hypercalls to the supported variant:
516 * - vmcall if using KVM in-kernel irqchip
517 * - 32-bit VAPIC port write otherwise
519 static int patch_hypercalls(VAPICROMState
*s
)
521 hwaddr rom_paddr
= s
->rom_state_paddr
& ROM_BLOCK_MASK
;
522 static const uint8_t vmcall_pattern
[] = { /* vmcall */
523 0xb8, 0x1, 0, 0, 0, 0xf, 0x1, 0xc1
525 static const uint8_t outl_pattern
[] = { /* nop; outl %eax,0x7e */
526 0xb8, 0x1, 0, 0, 0, 0x90, 0xe7, 0x7e
528 uint8_t alternates
[2];
529 const uint8_t *pattern
;
530 const uint8_t *patch
;
535 rom
= g_malloc(s
->rom_size
);
536 cpu_physical_memory_read(rom_paddr
, rom
, s
->rom_size
);
538 for (pos
= 0; pos
< s
->rom_size
- sizeof(vmcall_pattern
); pos
++) {
539 if (kvm_irqchip_in_kernel()) {
540 pattern
= outl_pattern
;
541 alternates
[0] = outl_pattern
[7];
542 alternates
[1] = outl_pattern
[7];
543 patch
= &vmcall_pattern
[5];
545 pattern
= vmcall_pattern
;
546 alternates
[0] = vmcall_pattern
[7];
547 alternates
[1] = 0xd9; /* AMD's VMMCALL */
548 patch
= &outl_pattern
[5];
550 if (memcmp(rom
+ pos
, pattern
, 7) == 0 &&
551 (rom
[pos
+ 7] == alternates
[0] || rom
[pos
+ 7] == alternates
[1])) {
552 cpu_physical_memory_write(rom_paddr
+ pos
+ 5, patch
, 3);
554 * Don't flush the tb here. Under ordinary conditions, the patched
555 * calls are miles away from the current IP. Under malicious
556 * conditions, the guest could trick us to crash.
563 if (patches
!= 0 && patches
!= 2) {
571 * For TCG mode or the time KVM honors read-only memory regions, we need to
572 * enable write access to the option ROM so that variables can be updated by
575 static int vapic_map_rom_writable(VAPICROMState
*s
)
577 hwaddr rom_paddr
= s
->rom_state_paddr
& ROM_BLOCK_MASK
;
578 MemoryRegionSection section
;
583 as
= sysbus_address_space(&s
->busdev
);
585 if (s
->rom_mapped_writable
) {
586 memory_region_del_subregion(as
, &s
->rom
);
587 object_unparent(OBJECT(&s
->rom
));
590 /* grab RAM memory region (region @rom_paddr may still be pc.rom) */
591 section
= memory_region_find(as
, 0, 1);
593 /* read ROM size from RAM region */
594 if (rom_paddr
+ 2 >= memory_region_size(section
.mr
)) {
597 ram
= memory_region_get_ram_ptr(section
.mr
);
598 rom_size
= ram
[rom_paddr
+ 2] * ROM_BLOCK_SIZE
;
602 s
->rom_size
= rom_size
;
604 /* We need to round to avoid creating subpages
605 * from which we cannot run code. */
606 rom_size
+= rom_paddr
& ~TARGET_PAGE_MASK
;
607 rom_paddr
&= TARGET_PAGE_MASK
;
608 rom_size
= TARGET_PAGE_ALIGN(rom_size
);
610 memory_region_init_alias(&s
->rom
, OBJECT(s
), "kvmvapic-rom", section
.mr
,
611 rom_paddr
, rom_size
);
612 memory_region_add_subregion_overlap(as
, rom_paddr
, &s
->rom
, 1000);
613 s
->rom_mapped_writable
= true;
614 memory_region_unref(section
.mr
);
619 static int vapic_prepare(VAPICROMState
*s
)
621 if (vapic_map_rom_writable(s
) < 0) {
625 if (patch_hypercalls(s
) < 0) {
629 vapic_enable_tpr_reporting(true);
634 static void vapic_write(void *opaque
, hwaddr addr
, uint64_t data
,
637 CPUState
*cs
= current_cpu
;
638 X86CPU
*cpu
= X86_CPU(cs
);
639 CPUX86State
*env
= &cpu
->env
;
641 VAPICROMState
*s
= opaque
;
643 cpu_synchronize_state(cs
);
646 * The VAPIC supports two PIO-based hypercalls, both via port 0x7E.
647 * o 16-bit write access:
648 * Reports the option ROM initialization to the hypervisor. Written
649 * value is the offset of the state structure in the ROM.
650 * o 8-bit write access:
651 * Reactivates the VAPIC after a guest hibernation, i.e. after the
652 * option ROM content has been re-initialized by a guest power cycle.
653 * o 32-bit write access:
654 * Poll for pending IRQs, considering the current VAPIC state.
658 if (s
->state
== VAPIC_INACTIVE
) {
659 rom_paddr
= (env
->segs
[R_CS
].base
+ env
->eip
) & ROM_BLOCK_MASK
;
660 s
->rom_state_paddr
= rom_paddr
+ data
;
662 s
->state
= VAPIC_STANDBY
;
664 if (vapic_prepare(s
) < 0) {
665 s
->state
= VAPIC_INACTIVE
;
666 s
->rom_state_paddr
= 0;
673 * Disable triggering instruction in ROM by writing a NOP.
675 * We cannot do this in TCG mode as the reported IP is not
679 patch_byte(cpu
, env
->eip
- 2, 0x66);
680 patch_byte(cpu
, env
->eip
- 1, 0x90);
684 if (s
->state
== VAPIC_ACTIVE
) {
687 if (update_rom_mapping(s
, env
, env
->eip
) < 0) {
690 if (find_real_tpr_addr(s
, env
) < 0) {
693 vapic_enable(s
, cpu
);
697 if (!kvm_irqchip_in_kernel()) {
698 apic_poll_irq(cpu
->apic_state
);
704 static uint64_t vapic_read(void *opaque
, hwaddr addr
, unsigned size
)
709 static const MemoryRegionOps vapic_ops
= {
710 .write
= vapic_write
,
712 .endianness
= DEVICE_NATIVE_ENDIAN
,
715 static void vapic_realize(DeviceState
*dev
, Error
**errp
)
717 SysBusDevice
*sbd
= SYS_BUS_DEVICE(dev
);
718 VAPICROMState
*s
= VAPIC(dev
);
720 memory_region_init_io(&s
->io
, OBJECT(s
), &vapic_ops
, s
, "kvmvapic", 2);
721 sysbus_add_io(sbd
, VAPIC_IO_PORT
, &s
->io
);
722 sysbus_init_ioports(sbd
, VAPIC_IO_PORT
, 2);
724 option_rom
[nb_option_roms
].name
= "kvmvapic.bin";
725 option_rom
[nb_option_roms
].bootindex
= -1;
729 static void do_vapic_enable(void *data
)
731 VAPICROMState
*s
= data
;
732 X86CPU
*cpu
= X86_CPU(first_cpu
);
734 vapic_enable(s
, cpu
);
737 static int vapic_post_load(void *opaque
, int version_id
)
739 VAPICROMState
*s
= opaque
;
743 * The old implementation of qemu-kvm did not provide the state
744 * VAPIC_STANDBY. Reconstruct it.
746 if (s
->state
== VAPIC_INACTIVE
&& s
->rom_state_paddr
!= 0) {
747 s
->state
= VAPIC_STANDBY
;
750 if (s
->state
!= VAPIC_INACTIVE
) {
751 if (vapic_prepare(s
) < 0) {
755 if (s
->state
== VAPIC_ACTIVE
) {
757 run_on_cpu(first_cpu
, do_vapic_enable
, s
);
759 zero
= g_malloc0(s
->rom_state
.vapic_size
);
760 cpu_physical_memory_write(s
->vapic_paddr
, zero
,
761 s
->rom_state
.vapic_size
);
769 static const VMStateDescription vmstate_handlers
= {
770 .name
= "kvmvapic-handlers",
772 .minimum_version_id
= 1,
773 .fields
= (VMStateField
[]) {
774 VMSTATE_UINT32(set_tpr
, VAPICHandlers
),
775 VMSTATE_UINT32(set_tpr_eax
, VAPICHandlers
),
776 VMSTATE_UINT32_ARRAY(get_tpr
, VAPICHandlers
, 8),
777 VMSTATE_UINT32(get_tpr_stack
, VAPICHandlers
),
778 VMSTATE_END_OF_LIST()
782 static const VMStateDescription vmstate_guest_rom
= {
783 .name
= "kvmvapic-guest-rom",
785 .minimum_version_id
= 1,
786 .fields
= (VMStateField
[]) {
787 VMSTATE_UNUSED(8), /* signature */
788 VMSTATE_UINT32(vaddr
, GuestROMState
),
789 VMSTATE_UINT32(fixup_start
, GuestROMState
),
790 VMSTATE_UINT32(fixup_end
, GuestROMState
),
791 VMSTATE_UINT32(vapic_vaddr
, GuestROMState
),
792 VMSTATE_UINT32(vapic_size
, GuestROMState
),
793 VMSTATE_UINT32(vcpu_shift
, GuestROMState
),
794 VMSTATE_UINT32(real_tpr_addr
, GuestROMState
),
795 VMSTATE_STRUCT(up
, GuestROMState
, 0, vmstate_handlers
, VAPICHandlers
),
796 VMSTATE_STRUCT(mp
, GuestROMState
, 0, vmstate_handlers
, VAPICHandlers
),
797 VMSTATE_END_OF_LIST()
801 static const VMStateDescription vmstate_vapic
= {
802 .name
= "kvm-tpr-opt", /* compatible with qemu-kvm VAPIC */
804 .minimum_version_id
= 1,
805 .post_load
= vapic_post_load
,
806 .fields
= (VMStateField
[]) {
807 VMSTATE_STRUCT(rom_state
, VAPICROMState
, 0, vmstate_guest_rom
,
809 VMSTATE_UINT32(state
, VAPICROMState
),
810 VMSTATE_UINT32(real_tpr_addr
, VAPICROMState
),
811 VMSTATE_UINT32(rom_state_vaddr
, VAPICROMState
),
812 VMSTATE_UINT32(vapic_paddr
, VAPICROMState
),
813 VMSTATE_UINT32(rom_state_paddr
, VAPICROMState
),
814 VMSTATE_END_OF_LIST()
818 static void vapic_class_init(ObjectClass
*klass
, void *data
)
820 DeviceClass
*dc
= DEVICE_CLASS(klass
);
822 dc
->reset
= vapic_reset
;
823 dc
->vmsd
= &vmstate_vapic
;
824 dc
->realize
= vapic_realize
;
827 static const TypeInfo vapic_type
= {
829 .parent
= TYPE_SYS_BUS_DEVICE
,
830 .instance_size
= sizeof(VAPICROMState
),
831 .class_init
= vapic_class_init
,
834 static void vapic_register(void)
836 type_register_static(&vapic_type
);
839 type_init(vapic_register
);