2 * TPR optimization for 32-bit Windows guests (XP and Server 2003)
4 * Copyright (C) 2007-2008 Qumranet Technologies
5 * Copyright (C) 2012 Jan Kiszka, Siemens AG
7 * This work is licensed under the terms of the GNU GPL version 2, or
8 * (at your option) any later version. See the COPYING file in the
12 #include "qemu/osdep.h"
13 #include "qemu/module.h"
15 #include "sysemu/sysemu.h"
16 #include "sysemu/cpus.h"
17 #include "sysemu/hw_accel.h"
18 #include "sysemu/kvm.h"
19 #include "sysemu/runstate.h"
20 #include "hw/i386/apic_internal.h"
21 #include "hw/sysbus.h"
22 #include "hw/boards.h"
23 #include "migration/vmstate.h"
25 #include "qom/object.h"
27 #define VAPIC_IO_PORT 0x7e
29 #define VAPIC_CPU_SHIFT 7
31 #define ROM_BLOCK_SIZE 512
32 #define ROM_BLOCK_MASK (~(ROM_BLOCK_SIZE - 1))
34 typedef enum VAPICMode
{
40 typedef struct VAPICHandlers
{
44 uint32_t get_tpr_stack
;
45 } QEMU_PACKED VAPICHandlers
;
47 typedef struct GuestROMState
{
55 uint32_t real_tpr_addr
;
58 } QEMU_PACKED GuestROMState
;
60 struct VAPICROMState
{
65 uint32_t rom_state_paddr
;
66 uint32_t rom_state_vaddr
;
68 uint32_t real_tpr_addr
;
69 GuestROMState rom_state
;
71 bool rom_mapped_writable
;
72 VMChangeStateEntry
*vmsentry
;
74 typedef struct VAPICROMState VAPICROMState
;
76 #define TYPE_VAPIC "kvmvapic"
77 #define VAPIC(obj) OBJECT_CHECK(VAPICROMState, (obj), TYPE_VAPIC)
79 #define TPR_INSTR_ABS_MODRM 0x1
80 #define TPR_INSTR_MATCH_MODRM_REG 0x2
82 typedef struct TPRInstruction
{
91 /* must be sorted by length, shortest first */
92 static const TPRInstruction tpr_instr
[] = {
93 { /* mov abs to eax */
95 .access
= TPR_ACCESS_READ
,
99 { /* mov eax to abs */
101 .access
= TPR_ACCESS_WRITE
,
105 { /* mov r32 to r/m32 */
107 .flags
= TPR_INSTR_ABS_MODRM
,
108 .access
= TPR_ACCESS_WRITE
,
112 { /* mov r/m32 to r32 */
114 .flags
= TPR_INSTR_ABS_MODRM
,
115 .access
= TPR_ACCESS_READ
,
122 .flags
= TPR_INSTR_ABS_MODRM
| TPR_INSTR_MATCH_MODRM_REG
,
123 .access
= TPR_ACCESS_READ
,
127 { /* mov imm32, r/m32 (c7/0) */
130 .flags
= TPR_INSTR_ABS_MODRM
| TPR_INSTR_MATCH_MODRM_REG
,
131 .access
= TPR_ACCESS_WRITE
,
137 static void read_guest_rom_state(VAPICROMState
*s
)
139 cpu_physical_memory_read(s
->rom_state_paddr
, &s
->rom_state
,
140 sizeof(GuestROMState
));
143 static void write_guest_rom_state(VAPICROMState
*s
)
145 cpu_physical_memory_write(s
->rom_state_paddr
, &s
->rom_state
,
146 sizeof(GuestROMState
));
149 static void update_guest_rom_state(VAPICROMState
*s
)
151 read_guest_rom_state(s
);
153 s
->rom_state
.real_tpr_addr
= cpu_to_le32(s
->real_tpr_addr
);
154 s
->rom_state
.vcpu_shift
= cpu_to_le32(VAPIC_CPU_SHIFT
);
156 write_guest_rom_state(s
);
159 static int find_real_tpr_addr(VAPICROMState
*s
, CPUX86State
*env
)
161 CPUState
*cs
= env_cpu(env
);
165 if (s
->state
== VAPIC_ACTIVE
) {
169 * If there is no prior TPR access instruction we could analyze (which is
170 * the case after resume from hibernation), we need to scan the possible
171 * virtual address space for the APIC mapping.
173 for (addr
= 0xfffff000; addr
>= 0x80000000; addr
-= TARGET_PAGE_SIZE
) {
174 paddr
= cpu_get_phys_page_debug(cs
, addr
);
175 if (paddr
!= APIC_DEFAULT_ADDRESS
) {
178 s
->real_tpr_addr
= addr
+ 0x80;
179 update_guest_rom_state(s
);
185 static uint8_t modrm_reg(uint8_t modrm
)
187 return (modrm
>> 3) & 7;
190 static bool is_abs_modrm(uint8_t modrm
)
192 return (modrm
& 0xc7) == 0x05;
195 static bool opcode_matches(uint8_t *opcode
, const TPRInstruction
*instr
)
197 return opcode
[0] == instr
->opcode
&&
198 (!(instr
->flags
& TPR_INSTR_ABS_MODRM
) || is_abs_modrm(opcode
[1])) &&
199 (!(instr
->flags
& TPR_INSTR_MATCH_MODRM_REG
) ||
200 modrm_reg(opcode
[1]) == instr
->modrm_reg
);
203 static int evaluate_tpr_instruction(VAPICROMState
*s
, X86CPU
*cpu
,
204 target_ulong
*pip
, TPRAccess access
)
206 CPUState
*cs
= CPU(cpu
);
207 const TPRInstruction
*instr
;
208 target_ulong ip
= *pip
;
210 uint32_t real_tpr_addr
;
213 if ((ip
& 0xf0000000ULL
) != 0x80000000ULL
&&
214 (ip
& 0xf0000000ULL
) != 0xe0000000ULL
) {
219 * Early Windows 2003 SMP initialization contains a
223 * instruction that is patched by TPR optimization. The problem is that
224 * RSP, used by the patched instruction, is zero, so the guest gets a
225 * double fault and dies.
227 if (cpu
->env
.regs
[R_ESP
] == 0) {
231 if (kvm_enabled() && !kvm_irqchip_in_kernel()) {
233 * KVM without kernel-based TPR access reporting will pass an IP that
234 * points after the accessing instruction. So we need to look backward
235 * to find the reason.
237 for (i
= 0; i
< ARRAY_SIZE(tpr_instr
); i
++) {
238 instr
= &tpr_instr
[i
];
239 if (instr
->access
!= access
) {
242 if (cpu_memory_rw_debug(cs
, ip
- instr
->length
, opcode
,
243 sizeof(opcode
), 0) < 0) {
246 if (opcode_matches(opcode
, instr
)) {
253 if (cpu_memory_rw_debug(cs
, ip
, opcode
, sizeof(opcode
), 0) < 0) {
256 for (i
= 0; i
< ARRAY_SIZE(tpr_instr
); i
++) {
257 instr
= &tpr_instr
[i
];
258 if (opcode_matches(opcode
, instr
)) {
267 * Grab the virtual TPR address from the instruction
268 * and update the cached values.
270 if (cpu_memory_rw_debug(cs
, ip
+ instr
->addr_offset
,
271 (void *)&real_tpr_addr
,
272 sizeof(real_tpr_addr
), 0) < 0) {
275 real_tpr_addr
= le32_to_cpu(real_tpr_addr
);
276 if ((real_tpr_addr
& 0xfff) != 0x80) {
279 s
->real_tpr_addr
= real_tpr_addr
;
280 update_guest_rom_state(s
);
286 static int update_rom_mapping(VAPICROMState
*s
, CPUX86State
*env
, target_ulong ip
)
288 CPUState
*cs
= env_cpu(env
);
290 uint32_t rom_state_vaddr
;
291 uint32_t pos
, patch
, offset
;
293 /* nothing to do if already activated */
294 if (s
->state
== VAPIC_ACTIVE
) {
298 /* bail out if ROM init code was not executed (missing ROM?) */
299 if (s
->state
== VAPIC_INACTIVE
) {
303 /* find out virtual address of the ROM */
304 rom_state_vaddr
= s
->rom_state_paddr
+ (ip
& 0xf0000000);
305 paddr
= cpu_get_phys_page_debug(cs
, rom_state_vaddr
);
309 paddr
+= rom_state_vaddr
& ~TARGET_PAGE_MASK
;
310 if (paddr
!= s
->rom_state_paddr
) {
313 read_guest_rom_state(s
);
314 if (memcmp(s
->rom_state
.signature
, "kvm aPiC", 8) != 0) {
317 s
->rom_state_vaddr
= rom_state_vaddr
;
319 /* fixup addresses in ROM if needed */
320 if (rom_state_vaddr
== le32_to_cpu(s
->rom_state
.vaddr
)) {
323 for (pos
= le32_to_cpu(s
->rom_state
.fixup_start
);
324 pos
< le32_to_cpu(s
->rom_state
.fixup_end
);
326 cpu_physical_memory_read(paddr
+ pos
- s
->rom_state
.vaddr
,
327 &offset
, sizeof(offset
));
328 offset
= le32_to_cpu(offset
);
329 cpu_physical_memory_read(paddr
+ offset
, &patch
, sizeof(patch
));
330 patch
= le32_to_cpu(patch
);
331 patch
+= rom_state_vaddr
- le32_to_cpu(s
->rom_state
.vaddr
);
332 patch
= cpu_to_le32(patch
);
333 cpu_physical_memory_write(paddr
+ offset
, &patch
, sizeof(patch
));
335 read_guest_rom_state(s
);
336 s
->vapic_paddr
= paddr
+ le32_to_cpu(s
->rom_state
.vapic_vaddr
) -
337 le32_to_cpu(s
->rom_state
.vaddr
);
343 * Tries to read the unique processor number from the Kernel Processor Control
344 * Region (KPCR) of 32-bit Windows XP and Server 2003. Returns -1 if the KPCR
345 * cannot be accessed or is considered invalid. This also ensures that we are
346 * not patching the wrong guest.
348 static int get_kpcr_number(X86CPU
*cpu
)
350 CPUX86State
*env
= &cpu
->env
;
358 if (cpu_memory_rw_debug(CPU(cpu
), env
->segs
[R_FS
].base
,
359 (void *)&kpcr
, sizeof(kpcr
), 0) < 0 ||
360 kpcr
.self
!= env
->segs
[R_FS
].base
) {
366 static int vapic_enable(VAPICROMState
*s
, X86CPU
*cpu
)
368 int cpu_number
= get_kpcr_number(cpu
);
370 static const uint8_t enabled
= 1;
372 if (cpu_number
< 0) {
375 vapic_paddr
= s
->vapic_paddr
+
376 (((hwaddr
)cpu_number
) << VAPIC_CPU_SHIFT
);
377 cpu_physical_memory_write(vapic_paddr
+ offsetof(VAPICState
, enabled
),
378 &enabled
, sizeof(enabled
));
379 apic_enable_vapic(cpu
->apic_state
, vapic_paddr
);
381 s
->state
= VAPIC_ACTIVE
;
386 static void patch_byte(X86CPU
*cpu
, target_ulong addr
, uint8_t byte
)
388 cpu_memory_rw_debug(CPU(cpu
), addr
, &byte
, 1, 1);
391 static void patch_call(X86CPU
*cpu
, target_ulong ip
, uint32_t target
)
395 offset
= cpu_to_le32(target
- ip
- 5);
396 patch_byte(cpu
, ip
, 0xe8); /* call near */
397 cpu_memory_rw_debug(CPU(cpu
), ip
+ 1, (void *)&offset
, sizeof(offset
), 1);
400 typedef struct PatchInfo
{
401 VAPICHandlers
*handler
;
405 static void do_patch_instruction(CPUState
*cs
, run_on_cpu_data data
)
407 X86CPU
*x86_cpu
= X86_CPU(cs
);
408 PatchInfo
*info
= (PatchInfo
*) data
.host_ptr
;
409 VAPICHandlers
*handlers
= info
->handler
;
410 target_ulong ip
= info
->ip
;
414 cpu_memory_rw_debug(cs
, ip
, opcode
, sizeof(opcode
), 0);
417 case 0x89: /* mov r32 to r/m32 */
418 patch_byte(x86_cpu
, ip
, 0x50 + modrm_reg(opcode
[1])); /* push reg */
419 patch_call(x86_cpu
, ip
+ 1, handlers
->set_tpr
);
421 case 0x8b: /* mov r/m32 to r32 */
422 patch_byte(x86_cpu
, ip
, 0x90);
423 patch_call(x86_cpu
, ip
+ 1, handlers
->get_tpr
[modrm_reg(opcode
[1])]);
425 case 0xa1: /* mov abs to eax */
426 patch_call(x86_cpu
, ip
, handlers
->get_tpr
[0]);
428 case 0xa3: /* mov eax to abs */
429 patch_call(x86_cpu
, ip
, handlers
->set_tpr_eax
);
431 case 0xc7: /* mov imm32, r/m32 (c7/0) */
432 patch_byte(x86_cpu
, ip
, 0x68); /* push imm32 */
433 cpu_memory_rw_debug(cs
, ip
+ 6, (void *)&imm32
, sizeof(imm32
), 0);
434 cpu_memory_rw_debug(cs
, ip
+ 1, (void *)&imm32
, sizeof(imm32
), 1);
435 patch_call(x86_cpu
, ip
+ 5, handlers
->set_tpr
);
437 case 0xff: /* push r/m32 */
438 patch_byte(x86_cpu
, ip
, 0x50); /* push eax */
439 patch_call(x86_cpu
, ip
+ 1, handlers
->get_tpr_stack
);
448 static void patch_instruction(VAPICROMState
*s
, X86CPU
*cpu
, target_ulong ip
)
450 MachineState
*ms
= MACHINE(qdev_get_machine());
451 CPUState
*cs
= CPU(cpu
);
452 VAPICHandlers
*handlers
;
455 if (ms
->smp
.cpus
== 1) {
456 handlers
= &s
->rom_state
.up
;
458 handlers
= &s
->rom_state
.mp
;
461 info
= g_new(PatchInfo
, 1);
462 info
->handler
= handlers
;
465 async_safe_run_on_cpu(cs
, do_patch_instruction
, RUN_ON_CPU_HOST_PTR(info
));
468 void vapic_report_tpr_access(DeviceState
*dev
, CPUState
*cs
, target_ulong ip
,
471 VAPICROMState
*s
= VAPIC(dev
);
472 X86CPU
*cpu
= X86_CPU(cs
);
473 CPUX86State
*env
= &cpu
->env
;
475 cpu_synchronize_state(cs
);
477 if (evaluate_tpr_instruction(s
, cpu
, &ip
, access
) < 0) {
478 if (s
->state
== VAPIC_ACTIVE
) {
479 vapic_enable(s
, cpu
);
483 if (update_rom_mapping(s
, env
, ip
) < 0) {
486 if (vapic_enable(s
, cpu
) < 0) {
489 patch_instruction(s
, cpu
, ip
);
492 typedef struct VAPICEnableTPRReporting
{
495 } VAPICEnableTPRReporting
;
497 static void vapic_do_enable_tpr_reporting(CPUState
*cpu
, run_on_cpu_data data
)
499 VAPICEnableTPRReporting
*info
= data
.host_ptr
;
500 apic_enable_tpr_access_reporting(info
->apic
, info
->enable
);
503 static void vapic_enable_tpr_reporting(bool enable
)
505 VAPICEnableTPRReporting info
= {
513 info
.apic
= cpu
->apic_state
;
514 run_on_cpu(cs
, vapic_do_enable_tpr_reporting
, RUN_ON_CPU_HOST_PTR(&info
));
518 static void vapic_reset(DeviceState
*dev
)
520 VAPICROMState
*s
= VAPIC(dev
);
522 s
->state
= VAPIC_INACTIVE
;
523 s
->rom_state_paddr
= 0;
524 vapic_enable_tpr_reporting(false);
528 * Set the IRQ polling hypercalls to the supported variant:
529 * - vmcall if using KVM in-kernel irqchip
530 * - 32-bit VAPIC port write otherwise
532 static int patch_hypercalls(VAPICROMState
*s
)
534 hwaddr rom_paddr
= s
->rom_state_paddr
& ROM_BLOCK_MASK
;
535 static const uint8_t vmcall_pattern
[] = { /* vmcall */
536 0xb8, 0x1, 0, 0, 0, 0xf, 0x1, 0xc1
538 static const uint8_t outl_pattern
[] = { /* nop; outl %eax,0x7e */
539 0xb8, 0x1, 0, 0, 0, 0x90, 0xe7, 0x7e
541 uint8_t alternates
[2];
542 const uint8_t *pattern
;
543 const uint8_t *patch
;
547 rom
= g_malloc(s
->rom_size
);
548 cpu_physical_memory_read(rom_paddr
, rom
, s
->rom_size
);
550 for (pos
= 0; pos
< s
->rom_size
- sizeof(vmcall_pattern
); pos
++) {
551 if (kvm_irqchip_in_kernel()) {
552 pattern
= outl_pattern
;
553 alternates
[0] = outl_pattern
[7];
554 alternates
[1] = outl_pattern
[7];
555 patch
= &vmcall_pattern
[5];
557 pattern
= vmcall_pattern
;
558 alternates
[0] = vmcall_pattern
[7];
559 alternates
[1] = 0xd9; /* AMD's VMMCALL */
560 patch
= &outl_pattern
[5];
562 if (memcmp(rom
+ pos
, pattern
, 7) == 0 &&
563 (rom
[pos
+ 7] == alternates
[0] || rom
[pos
+ 7] == alternates
[1])) {
564 cpu_physical_memory_write(rom_paddr
+ pos
+ 5, patch
, 3);
566 * Don't flush the tb here. Under ordinary conditions, the patched
567 * calls are miles away from the current IP. Under malicious
568 * conditions, the guest could trick us to crash.
578 * For TCG mode or the time KVM honors read-only memory regions, we need to
579 * enable write access to the option ROM so that variables can be updated by
582 static int vapic_map_rom_writable(VAPICROMState
*s
)
584 hwaddr rom_paddr
= s
->rom_state_paddr
& ROM_BLOCK_MASK
;
585 MemoryRegionSection section
;
590 as
= sysbus_address_space(&s
->busdev
);
592 if (s
->rom_mapped_writable
) {
593 memory_region_del_subregion(as
, &s
->rom
);
594 object_unparent(OBJECT(&s
->rom
));
597 /* grab RAM memory region (region @rom_paddr may still be pc.rom) */
598 section
= memory_region_find(as
, 0, 1);
600 /* read ROM size from RAM region */
601 if (rom_paddr
+ 2 >= memory_region_size(section
.mr
)) {
604 ram
= memory_region_get_ram_ptr(section
.mr
);
605 rom_size
= ram
[rom_paddr
+ 2] * ROM_BLOCK_SIZE
;
609 s
->rom_size
= rom_size
;
611 /* We need to round to avoid creating subpages
612 * from which we cannot run code. */
613 rom_size
+= rom_paddr
& ~TARGET_PAGE_MASK
;
614 rom_paddr
&= TARGET_PAGE_MASK
;
615 rom_size
= TARGET_PAGE_ALIGN(rom_size
);
617 memory_region_init_alias(&s
->rom
, OBJECT(s
), "kvmvapic-rom", section
.mr
,
618 rom_paddr
, rom_size
);
619 memory_region_add_subregion_overlap(as
, rom_paddr
, &s
->rom
, 1000);
620 s
->rom_mapped_writable
= true;
621 memory_region_unref(section
.mr
);
626 static int vapic_prepare(VAPICROMState
*s
)
628 if (vapic_map_rom_writable(s
) < 0) {
632 if (patch_hypercalls(s
) < 0) {
636 vapic_enable_tpr_reporting(true);
641 static void vapic_write(void *opaque
, hwaddr addr
, uint64_t data
,
644 VAPICROMState
*s
= opaque
;
653 cpu_synchronize_state(current_cpu
);
654 cpu
= X86_CPU(current_cpu
);
658 * The VAPIC supports two PIO-based hypercalls, both via port 0x7E.
659 * o 16-bit write access:
660 * Reports the option ROM initialization to the hypervisor. Written
661 * value is the offset of the state structure in the ROM.
662 * o 8-bit write access:
663 * Reactivates the VAPIC after a guest hibernation, i.e. after the
664 * option ROM content has been re-initialized by a guest power cycle.
665 * o 32-bit write access:
666 * Poll for pending IRQs, considering the current VAPIC state.
670 if (s
->state
== VAPIC_INACTIVE
) {
671 rom_paddr
= (env
->segs
[R_CS
].base
+ env
->eip
) & ROM_BLOCK_MASK
;
672 s
->rom_state_paddr
= rom_paddr
+ data
;
674 s
->state
= VAPIC_STANDBY
;
676 if (vapic_prepare(s
) < 0) {
677 s
->state
= VAPIC_INACTIVE
;
678 s
->rom_state_paddr
= 0;
685 * Disable triggering instruction in ROM by writing a NOP.
687 * We cannot do this in TCG mode as the reported IP is not
691 patch_byte(cpu
, env
->eip
- 2, 0x66);
692 patch_byte(cpu
, env
->eip
- 1, 0x90);
696 if (s
->state
== VAPIC_ACTIVE
) {
699 if (update_rom_mapping(s
, env
, env
->eip
) < 0) {
702 if (find_real_tpr_addr(s
, env
) < 0) {
705 vapic_enable(s
, cpu
);
709 if (!kvm_irqchip_in_kernel()) {
710 apic_poll_irq(cpu
->apic_state
);
716 static uint64_t vapic_read(void *opaque
, hwaddr addr
, unsigned size
)
721 static const MemoryRegionOps vapic_ops
= {
722 .write
= vapic_write
,
724 .endianness
= DEVICE_NATIVE_ENDIAN
,
727 static void vapic_realize(DeviceState
*dev
, Error
**errp
)
729 SysBusDevice
*sbd
= SYS_BUS_DEVICE(dev
);
730 VAPICROMState
*s
= VAPIC(dev
);
732 memory_region_init_io(&s
->io
, OBJECT(s
), &vapic_ops
, s
, "kvmvapic", 2);
733 sysbus_add_io(sbd
, VAPIC_IO_PORT
, &s
->io
);
734 sysbus_init_ioports(sbd
, VAPIC_IO_PORT
, 2);
736 option_rom
[nb_option_roms
].name
= "kvmvapic.bin";
737 option_rom
[nb_option_roms
].bootindex
= -1;
741 static void do_vapic_enable(CPUState
*cs
, run_on_cpu_data data
)
743 VAPICROMState
*s
= data
.host_ptr
;
744 X86CPU
*cpu
= X86_CPU(cs
);
746 static const uint8_t enabled
= 1;
747 cpu_physical_memory_write(s
->vapic_paddr
+ offsetof(VAPICState
, enabled
),
748 &enabled
, sizeof(enabled
));
749 apic_enable_vapic(cpu
->apic_state
, s
->vapic_paddr
);
750 s
->state
= VAPIC_ACTIVE
;
753 static void kvmvapic_vm_state_change(void *opaque
, int running
,
756 MachineState
*ms
= MACHINE(qdev_get_machine());
757 VAPICROMState
*s
= opaque
;
764 if (s
->state
== VAPIC_ACTIVE
) {
765 if (ms
->smp
.cpus
== 1) {
766 run_on_cpu(first_cpu
, do_vapic_enable
, RUN_ON_CPU_HOST_PTR(s
));
768 zero
= g_malloc0(s
->rom_state
.vapic_size
);
769 cpu_physical_memory_write(s
->vapic_paddr
, zero
,
770 s
->rom_state
.vapic_size
);
775 qemu_del_vm_change_state_handler(s
->vmsentry
);
779 static int vapic_post_load(void *opaque
, int version_id
)
781 VAPICROMState
*s
= opaque
;
784 * The old implementation of qemu-kvm did not provide the state
785 * VAPIC_STANDBY. Reconstruct it.
787 if (s
->state
== VAPIC_INACTIVE
&& s
->rom_state_paddr
!= 0) {
788 s
->state
= VAPIC_STANDBY
;
791 if (s
->state
!= VAPIC_INACTIVE
) {
792 if (vapic_prepare(s
) < 0) {
799 qemu_add_vm_change_state_handler(kvmvapic_vm_state_change
, s
);
804 static const VMStateDescription vmstate_handlers
= {
805 .name
= "kvmvapic-handlers",
807 .minimum_version_id
= 1,
808 .fields
= (VMStateField
[]) {
809 VMSTATE_UINT32(set_tpr
, VAPICHandlers
),
810 VMSTATE_UINT32(set_tpr_eax
, VAPICHandlers
),
811 VMSTATE_UINT32_ARRAY(get_tpr
, VAPICHandlers
, 8),
812 VMSTATE_UINT32(get_tpr_stack
, VAPICHandlers
),
813 VMSTATE_END_OF_LIST()
817 static const VMStateDescription vmstate_guest_rom
= {
818 .name
= "kvmvapic-guest-rom",
820 .minimum_version_id
= 1,
821 .fields
= (VMStateField
[]) {
822 VMSTATE_UNUSED(8), /* signature */
823 VMSTATE_UINT32(vaddr
, GuestROMState
),
824 VMSTATE_UINT32(fixup_start
, GuestROMState
),
825 VMSTATE_UINT32(fixup_end
, GuestROMState
),
826 VMSTATE_UINT32(vapic_vaddr
, GuestROMState
),
827 VMSTATE_UINT32(vapic_size
, GuestROMState
),
828 VMSTATE_UINT32(vcpu_shift
, GuestROMState
),
829 VMSTATE_UINT32(real_tpr_addr
, GuestROMState
),
830 VMSTATE_STRUCT(up
, GuestROMState
, 0, vmstate_handlers
, VAPICHandlers
),
831 VMSTATE_STRUCT(mp
, GuestROMState
, 0, vmstate_handlers
, VAPICHandlers
),
832 VMSTATE_END_OF_LIST()
836 static const VMStateDescription vmstate_vapic
= {
837 .name
= "kvm-tpr-opt", /* compatible with qemu-kvm VAPIC */
839 .minimum_version_id
= 1,
840 .post_load
= vapic_post_load
,
841 .fields
= (VMStateField
[]) {
842 VMSTATE_STRUCT(rom_state
, VAPICROMState
, 0, vmstate_guest_rom
,
844 VMSTATE_UINT32(state
, VAPICROMState
),
845 VMSTATE_UINT32(real_tpr_addr
, VAPICROMState
),
846 VMSTATE_UINT32(rom_state_vaddr
, VAPICROMState
),
847 VMSTATE_UINT32(vapic_paddr
, VAPICROMState
),
848 VMSTATE_UINT32(rom_state_paddr
, VAPICROMState
),
849 VMSTATE_END_OF_LIST()
853 static void vapic_class_init(ObjectClass
*klass
, void *data
)
855 DeviceClass
*dc
= DEVICE_CLASS(klass
);
857 dc
->reset
= vapic_reset
;
858 dc
->vmsd
= &vmstate_vapic
;
859 dc
->realize
= vapic_realize
;
862 static const TypeInfo vapic_type
= {
864 .parent
= TYPE_SYS_BUS_DEVICE
,
865 .instance_size
= sizeof(VAPICROMState
),
866 .class_init
= vapic_class_init
,
869 static void vapic_register(void)
871 type_register_static(&vapic_type
);
874 type_init(vapic_register
);