kvm-tpr-opt.c

   1 /*
   2  * tpr optimization for qemu/kvm
   3  *
   4  * Copyright (C) 2007-2008 Qumranet Technologies
   5  *
   6  * Licensed under the terms of the GNU GPL version 2 or higher.
   7  */
   8
   9 #include "config.h"
  10 #include "config-host.h"
  11
  12 #include <string.h>
  13
  14 #include "hw/hw.h"
  15 #include "hw/isa.h"
  16 #include "sysemu.h"
  17 #include "qemu-kvm.h"
  18 #include "cpu.h"
  19
  20 #include <stdio.h>
  21
  22 static uint64_t map_addr(struct kvm_sregs *sregs, target_ulong virt, unsigned *perms)
  23 {
  24     uint64_t mask = ((1ull << 48) - 1) & ~4095ull;
  25     uint64_t p, pp = 7;
  26
  27     p = sregs->cr3;
  28     if (sregs->cr4 & 0x20) {
  29         p &= ~31ull;
  30         p = ldq_phys(p + 8 * (virt >> 30));
  31         if (!(p & 1))
  32             return -1ull;
  33         p &= mask;
  34         p = ldq_phys(p + 8 * ((virt >> 21) & 511));
  35         if (!(p & 1))
  36             return -1ull;
  37         pp &= p;
  38         if (p & 128) {
  39             p += ((virt >> 12) & 511) << 12;
  40         } else {
  41             p &= mask;
  42             p = ldq_phys(p + 8 * ((virt >> 12) & 511));
  43             if (!(p & 1))
  44                 return -1ull;
  45             pp &= p;
  46         }
  47     } else {
  48         p &= mask;
  49         p = ldl_phys(p + 4 * ((virt >> 22) & 1023));
  50         if (!(p & 1))
  51             return -1ull;
  52         pp &= p;
  53         if (p & 128) {
  54             p += ((virt >> 12) & 1023) << 12;
  55         } else {
  56             p &= mask;
  57             p = ldl_phys(p + 4 * ((virt >> 12) & 1023));
  58             pp &= p;
  59             if (!(p & 1))
  60                 return -1ull;
  61         }
  62     }
  63     if (perms)
  64         *perms = pp >> 1;
  65     p &= mask;
  66     return p + (virt & 4095);
  67 }
  68
  69 static uint8_t read_byte_virt(CPUState *env, target_ulong virt)
  70 {
  71     struct kvm_sregs sregs;
  72
  73     kvm_get_sregs(env->kvm_cpu_state.vcpu_ctx, &sregs);
  74     return ldub_phys(map_addr(&sregs, virt, NULL));
  75 }
  76
  77 static void write_byte_virt(CPUState *env, target_ulong virt, uint8_t b)
  78 {
  79     struct kvm_sregs sregs;
  80
  81     kvm_get_sregs(env->kvm_cpu_state.vcpu_ctx, &sregs);
  82     stb_phys(map_addr(&sregs, virt, NULL), b);
  83 }
  84
  85 static __u64 kvm_rsp_read(CPUState *env)
  86 {
  87     struct kvm_regs regs;
  88
  89     kvm_get_regs(env->kvm_cpu_state.vcpu_ctx, &regs);
  90     return regs.rsp;
  91 }
  92
  93 struct vapic_bios {
  94     char signature[8];
  95     uint32_t virt_base;
  96     uint32_t fixup_start;
  97     uint32_t fixup_end;
  98     uint32_t vapic;
  99     uint32_t vapic_size;
 100     uint32_t vcpu_shift;
 101     uint32_t real_tpr;
 102     struct vapic_patches {
 103         uint32_t set_tpr;
 104         uint32_t set_tpr_eax;
 105         uint32_t get_tpr[8];
 106         uint32_t get_tpr_stack;
 107     } __attribute__((packed)) up, mp;
 108 } __attribute__((packed));
 109
 110 static struct vapic_bios vapic_bios;
 111
 112 static uint32_t real_tpr;
 113 static uint32_t bios_addr;
 114 static uint32_t vapic_phys;
 115 static uint32_t bios_enabled;
 116 static uint32_t vbios_desc_phys;
 117
 118 static void update_vbios_real_tpr(void)
 119 {
 120     cpu_physical_memory_rw(vbios_desc_phys, (void *)&vapic_bios, sizeof vapic_bios, 0);
 121     vapic_bios.real_tpr = real_tpr;
 122     vapic_bios.vcpu_shift = 7;
 123     cpu_physical_memory_rw(vbios_desc_phys, (void *)&vapic_bios, sizeof vapic_bios, 1);
 124 }
 125
 126 static unsigned modrm_reg(uint8_t modrm)
 127 {
 128     return (modrm >> 3) & 7;
 129 }
 130
 131 static int is_abs_modrm(uint8_t modrm)
 132 {
 133     return (modrm & 0xc7) == 0x05;
 134 }
 135
 136 static int instruction_is_ok(CPUState *env, uint64_t rip, int is_write)
 137 {
 138     uint8_t b1, b2;
 139     unsigned addr_offset;
 140     uint32_t addr;
 141     uint64_t p;
 142
 143     if ((rip & 0xf0000000) != 0x80000000 && (rip & 0xf0000000) != 0xe0000000)
 144         return 0;
 145     if (kvm_rsp_read(env) == 0)
 146         return 0;
 147     b1 = read_byte_virt(env, rip);
 148     b2 = read_byte_virt(env, rip + 1);
 149     switch (b1) {
 150     case 0xc7: /* mov imm32, r/m32 (c7/0) */
 151         if (modrm_reg(b2) != 0)
 152             return 0;
 153         /* fall through */
 154     case 0x89: /* mov r32 to r/m32 */
 155     case 0x8b: /* mov r/m32 to r32 */
 156         if (!is_abs_modrm(b2))
 157             return 0;
 158         addr_offset = 2;
 159         break;
 160     case 0xa1: /* mov abs to eax */
 161     case 0xa3: /* mov eax to abs */
 162         addr_offset = 1;
 163         break;
 164     case 0xff: /* push r/m32 */
 165         if (modrm_reg(b2) != 6 || !is_abs_modrm(b2))
 166             return 0;
 167         addr_offset = 2;
 168     default:
 169         return 0;
 170     }
 171     p = rip + addr_offset;
 172     addr = read_byte_virt(env, p++);
 173     addr |= read_byte_virt(env, p++) << 8;
 174     addr |= read_byte_virt(env, p++) << 16;
 175     addr |= read_byte_virt(env, p++) << 24;
 176     if ((addr & 0xfff) != 0x80)
 177         return 0;
 178     real_tpr = addr;
 179     update_vbios_real_tpr();
 180     return 1;
 181 }
 182
 183 static int bios_is_mapped(CPUState *env, uint64_t rip)
 184 {
 185     uint32_t probe;
 186     uint64_t phys;
 187     struct kvm_sregs sregs;
 188     unsigned perms;
 189     uint32_t i;
 190     uint32_t offset, fixup;
 191
 192     if (bios_enabled)
 193         return 1;
 194
 195     kvm_get_sregs(env->kvm_cpu_state.vcpu_ctx, &sregs);
 196
 197     probe = (rip & 0xf0000000) + 0xe0000;
 198     phys = map_addr(&sregs, probe, &perms);
 199     if (phys != 0xe0000)
 200         return 0;
 201     bios_addr = probe;
 202     for (i = 0; i < 64; ++i) {
 203         cpu_physical_memory_read(phys, (void *)&vapic_bios, sizeof(vapic_bios));
 204         if (memcmp(vapic_bios.signature, "kvm aPiC", 8) == 0)
 205             break;
 206         phys += 1024;
 207         bios_addr += 1024;
 208     }
 209     if (i == 64)
 210         return 0;
 211     if (bios_addr == vapic_bios.virt_base)
 212         return 1;
 213     vbios_desc_phys = phys;
 214     for (i = vapic_bios.fixup_start; i < vapic_bios.fixup_end; i += 4) {
 215         offset = ldl_phys(phys + i - vapic_bios.virt_base);
 216         fixup = phys + offset;
 217         stl_phys(fixup, ldl_phys(fixup) + bios_addr - vapic_bios.virt_base);
 218     }
 219     vapic_phys = vapic_bios.vapic - vapic_bios.virt_base + phys;
 220     return 1;
 221 }
 222
 223 static int get_pcr_cpu(CPUState *env)
 224 {
 225     uint8_t b;
 226
 227     kvm_save_registers(env);
 228
 229     if (cpu_memory_rw_debug(env, env->segs[R_FS].base + 0x51, &b, 1, 0) < 0)
 230             return -1;
 231
 232     return (int)b;
 233 }
 234
 235 static int enable_vapic(CPUState *env)
 236 {
 237     static uint8_t one = 1;
 238     int pcr_cpu = get_pcr_cpu(env);
 239
 240     if (pcr_cpu < 0)
 241             return 0;
 242
 243     kvm_enable_vapic(env->kvm_cpu_state.vcpu_ctx, vapic_phys + (pcr_cpu << 7));
 244     cpu_physical_memory_rw(vapic_phys + (pcr_cpu << 7) + 4, &one, 1, 1);
 245     bios_enabled = 1;
 246
 247     return 1;
 248 }
 249
 250 static void patch_call(CPUState *env, uint64_t rip, uint32_t target)
 251 {
 252     uint32_t offset;
 253
 254     offset = target - vapic_bios.virt_base + bios_addr - rip - 5;
 255     write_byte_virt(env, rip, 0xe8); /* call near */
 256     write_byte_virt(env, rip + 1, offset);
 257     write_byte_virt(env, rip + 2, offset >> 8);
 258     write_byte_virt(env, rip + 3, offset >> 16);
 259     write_byte_virt(env, rip + 4, offset >> 24);
 260 }
 261
 262 static void patch_instruction(CPUState *env, uint64_t rip)
 263 {
 264     uint8_t b1, b2;
 265     struct vapic_patches *vp;
 266
 267     vp = smp_cpus == 1 ? &vapic_bios.up : &vapic_bios.mp;
 268     b1 = read_byte_virt(env, rip);
 269     b2 = read_byte_virt(env, rip + 1);
 270     switch (b1) {
 271     case 0x89: /* mov r32 to r/m32 */
 272         write_byte_virt(env, rip, 0x50 + modrm_reg(b2));  /* push reg */
 273         patch_call(env, rip + 1, vp->set_tpr);
 274         break;
 275     case 0x8b: /* mov r/m32 to r32 */
 276         write_byte_virt(env, rip, 0x90);
 277         patch_call(env, rip + 1, vp->get_tpr[modrm_reg(b2)]);
 278         break;
 279     case 0xa1: /* mov abs to eax */
 280         patch_call(env, rip, vp->get_tpr[0]);
 281         break;
 282     case 0xa3: /* mov eax to abs */
 283         patch_call(env, rip, vp->set_tpr_eax);
 284         break;
 285     case 0xc7: /* mov imm32, r/m32 (c7/0) */
 286         write_byte_virt(env, rip, 0x68);  /* push imm32 */
 287         write_byte_virt(env, rip + 1, read_byte_virt(env, rip+6));
 288         write_byte_virt(env, rip + 2, read_byte_virt(env, rip+7));
 289         write_byte_virt(env, rip + 3, read_byte_virt(env, rip+8));
 290         write_byte_virt(env, rip + 4, read_byte_virt(env, rip+9));
 291         patch_call(env, rip + 5, vp->set_tpr);
 292         break;
 293     case 0xff: /* push r/m32 */
 294         printf("patching push\n");
 295         write_byte_virt(env, rip, 0x50); /* push eax */
 296         patch_call(env, rip + 1, vp->get_tpr_stack);
 297         break;
 298     default:
 299         printf("funny insn %02x %02x\n", b1, b2);
 300     }
 301 }
 302
 303 void kvm_tpr_access_report(CPUState *env, uint64_t rip, int is_write)
 304 {
 305     if (!instruction_is_ok(env, rip, is_write))
 306         return;
 307     if (!bios_is_mapped(env, rip))
 308         return;
 309     if (!enable_vapic(env))
 310         return;
 311     patch_instruction(env, rip);
 312 }
 313
 314 void kvm_tpr_vcpu_start(CPUState *env)
 315 {
 316     kvm_enable_tpr_access_reporting(env->kvm_cpu_state.vcpu_ctx);
 317     if (bios_enabled)
 318         enable_vapic(env);
 319 }
 320
 321 static void tpr_save(QEMUFile *f, void *s)
 322 {
 323     int i;
 324
 325     for (i = 0; i < (sizeof vapic_bios) / 4; ++i)
 326         qemu_put_be32s(f, &((uint32_t *)&vapic_bios)[i]);
 327     qemu_put_be32s(f, &bios_enabled);
 328     qemu_put_be32s(f, &real_tpr);
 329     qemu_put_be32s(f, &bios_addr);
 330     qemu_put_be32s(f, &vapic_phys);
 331     qemu_put_be32s(f, &vbios_desc_phys);
 332 }
 333
 334 static int tpr_load(QEMUFile *f, void *s, int version_id)
 335 {
 336     int i;
 337
 338     if (version_id != 1)
 339         return -EINVAL;
 340
 341     for (i = 0; i < (sizeof vapic_bios) / 4; ++i)
 342         qemu_get_be32s(f, &((uint32_t *)&vapic_bios)[i]);
 343     qemu_get_be32s(f, &bios_enabled);
 344     qemu_get_be32s(f, &real_tpr);
 345     qemu_get_be32s(f, &bios_addr);
 346     qemu_get_be32s(f, &vapic_phys);
 347     qemu_get_be32s(f, &vbios_desc_phys);
 348
 349     if (bios_enabled) {
 350         CPUState *env = first_cpu->next_cpu;
 351
 352         for (env = first_cpu; env != NULL; env = env->next_cpu)
 353             enable_vapic(env);
 354     }
 355
 356     return 0;
 357 }
 358
 359 static void vtpr_ioport_write(void *opaque, uint32_t addr, uint32_t val)
 360 {
 361     CPUState *env = cpu_single_env;
 362     struct kvm_regs regs;
 363     struct kvm_sregs sregs;
 364     uint32_t rip;
 365
 366     kvm_get_regs(env->kvm_cpu_state.vcpu_ctx, &regs);
 367     rip = regs.rip - 2;
 368     write_byte_virt(env, rip, 0x66);
 369     write_byte_virt(env, rip + 1, 0x90);
 370     if (bios_enabled)
 371         return;
 372     if (!bios_is_mapped(env, rip))
 373         printf("bios not mapped?\n");
 374     kvm_get_sregs(env->kvm_cpu_state.vcpu_ctx, &sregs);
 375     for (addr = 0xfffff000u; addr >= 0x80000000u; addr -= 4096)
 376         if (map_addr(&sregs, addr, NULL) == 0xfee00000u) {
 377             real_tpr = addr + 0x80;
 378             break;
 379         }
 380     bios_enabled = 1;
 381     update_vbios_real_tpr();
 382     enable_vapic(env);
 383 }
 384
 385 void kvm_tpr_opt_setup(void)
 386 {
 387     register_savevm("kvm-tpr-opt", 0, 1, tpr_save, tpr_load, NULL);
 388     register_ioport_write(0x7e, 1, 1, vtpr_ioport_write, NULL);
 389 }
 390