1 /*
2 * KQEMU support
3 *
4 * Copyright (c) 2005-2008 Fabrice Bellard
5 *
6 * This library is free software; you can redistribute it and/or
7 * modify it under the terms of the GNU Lesser General Public
8 * License as published by the Free Software Foundation; either
9 * version 2 of the License, or (at your option) any later version.
10 *
11 * This library is distributed in the hope that it will be useful,
12 * but WITHOUT ANY WARRANTY; without even the implied warranty of
13 * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE. See the GNU
14 * Lesser General Public License for more details.
15 *
16 * You should have received a copy of the GNU Lesser General Public
17 * License along with this library; if not, write to the Free Software
18 * Foundation, Inc., 51 Franklin Street, Fifth Floor, Boston MA 02110-1301 USA
19 */
20 #include "config.h"
21 #ifdef _WIN32
22 #include <windows.h>
23 #include <winioctl.h>
24 #else
25 #include <sys/types.h>
26 #include <sys/mman.h>
27 #include <sys/ioctl.h>
28 #endif
29 #ifdef HOST_SOLARIS
30 #include <sys/ioccom.h>
31 #endif
32 #include <stdlib.h>
33 #include <stdio.h>
34 #include <stdarg.h>
35 #include <string.h>
36 #include <errno.h>
37 #include <unistd.h>
38 #include <inttypes.h>
39
40 #include "cpu.h"
41 #include "exec-all.h"
42 #include "qemu-common.h"
43
44 #ifdef CONFIG_KQEMU
45
46 #define DEBUG
47 //#define PROFILE
48
49
50 #ifdef DEBUG
51 # define LOG_INT(...) qemu_log_mask(CPU_LOG_INT, ## __VA_ARGS__)
52 # define LOG_INT_STATE(env) log_cpu_state_mask(CPU_LOG_INT, (env), 0)
53 #else
54 # define LOG_INT(...) do { } while (0)
55 # define LOG_INT_STATE(env) do { } while (0)
56 #endif
57
58 #include <unistd.h>
59 #include <fcntl.h>
60 #include "kqemu.h"
61
62 #ifdef _WIN32
63 #define KQEMU_DEVICE "\\\\.\\kqemu"
64 #else
65 #define KQEMU_DEVICE "/dev/kqemu"
66 #endif
67
68 static void qpi_init(void);
69
70 #ifdef _WIN32
71 #define KQEMU_INVALID_FD INVALID_HANDLE_VALUE
72 HANDLE kqemu_fd = KQEMU_INVALID_FD;
73 #define kqemu_closefd(x) CloseHandle(x)
74 #else
75 #define KQEMU_INVALID_FD -1
76 int kqemu_fd = KQEMU_INVALID_FD;
77 #define kqemu_closefd(x) close(x)
78 #endif
79
80 /* 0 = not allowed
81 1 = user kqemu
82 2 = kernel kqemu
83 */
84 int kqemu_allowed = 1;
85 uint64_t *pages_to_flush;
86 unsigned int nb_pages_to_flush;
87 uint64_t *ram_pages_to_update;
88 unsigned int nb_ram_pages_to_update;
89 uint64_t *modified_ram_pages;
90 unsigned int nb_modified_ram_pages;
91 uint8_t *modified_ram_pages_table;
92 int qpi_io_memory;
93 uint32_t kqemu_comm_base; /* physical address of the QPI communication page */
94 ram_addr_t kqemu_phys_ram_size;
95 uint8_t *kqemu_phys_ram_base;
96
97 #define cpuid(index, eax, ebx, ecx, edx) \
98 asm volatile ("cpuid" \
99 : "=a" (eax), "=b" (ebx), "=c" (ecx), "=d" (edx) \
100 : "0" (index))
101
102 #ifdef __x86_64__
is_cpuid_supported(void)103 static int is_cpuid_supported(void)
104 {
105 return 1;
106 }
107 #else
is_cpuid_supported(void)108 static int is_cpuid_supported(void)
109 {
110 int v0, v1;
111 asm volatile ("pushf\n"
112 "popl %0\n"
113 "movl %0, %1\n"
114 "xorl $0x00200000, %0\n"
115 "pushl %0\n"
116 "popf\n"
117 "pushf\n"
118 "popl %0\n"
119 : "=a" (v0), "=d" (v1)
120 :
121 : "cc");
122 return (v0 != v1);
123 }
124 #endif
125
kqemu_update_cpuid(CPUState * env)126 static void kqemu_update_cpuid(CPUState *env)
127 {
128 int critical_features_mask, features, ext_features, ext_features_mask;
129 uint32_t eax, ebx, ecx, edx;
130
131 /* the following features are kept identical on the host and
132 target cpus because they are important for user code. Strictly
133 speaking, only SSE really matters because the OS must support
134 it if the user code uses it. */
135 critical_features_mask =
136 CPUID_CMOV | CPUID_CX8 |
137 CPUID_FXSR | CPUID_MMX | CPUID_SSE |
138 CPUID_SSE2 | CPUID_SEP;
139 ext_features_mask = CPUID_EXT_SSE3 | CPUID_EXT_MONITOR;
140 if (!is_cpuid_supported()) {
141 features = 0;
142 ext_features = 0;
143 } else {
144 cpuid(1, eax, ebx, ecx, edx);
145 features = edx;
146 ext_features = ecx;
147 }
148 #ifdef __x86_64__
149 /* NOTE: on x86_64 CPUs, SYSENTER is not supported in
150 compatibility mode, so in order to have the best performances
151 it is better not to use it */
152 features &= ~CPUID_SEP;
153 #endif
154 env->cpuid_features = (env->cpuid_features & ~critical_features_mask) |
155 (features & critical_features_mask);
156 env->cpuid_ext_features = (env->cpuid_ext_features & ~ext_features_mask) |
157 (ext_features & ext_features_mask);
158 /* XXX: we could update more of the target CPUID state so that the
159 non accelerated code sees exactly the same CPU features as the
160 accelerated code */
161 }
162
kqemu_init(CPUState * env)163 int kqemu_init(CPUState *env)
164 {
165 struct kqemu_init kinit;
166 int ret, version;
167 #ifdef _WIN32
168 DWORD temp;
169 #endif
170
171 if (!kqemu_allowed)
172 return -1;
173
174 #ifdef _WIN32
175 kqemu_fd = CreateFile(KQEMU_DEVICE, GENERIC_WRITE | GENERIC_READ,
176 FILE_SHARE_READ | FILE_SHARE_WRITE,
177 NULL, OPEN_EXISTING, FILE_ATTRIBUTE_NORMAL,
178 NULL);
179 if (kqemu_fd == KQEMU_INVALID_FD) {
180 fprintf(stderr, "Could not open '%s' - QEMU acceleration layer not activated: %lu\n",
181 KQEMU_DEVICE, GetLastError());
182 return -1;
183 }
184 #else
185 kqemu_fd = open(KQEMU_DEVICE, O_RDWR);
186 if (kqemu_fd == KQEMU_INVALID_FD) {
187 fprintf(stderr, "Could not open '%s' - QEMU acceleration layer not activated: %s\n",
188 KQEMU_DEVICE, strerror(errno));
189 return -1;
190 }
191 #endif
192 version = 0;
193 #ifdef _WIN32
194 DeviceIoControl(kqemu_fd, KQEMU_GET_VERSION, NULL, 0,
195 &version, sizeof(version), &temp, NULL);
196 #else
197 ioctl(kqemu_fd, KQEMU_GET_VERSION, &version);
198 #endif
199 if (version != KQEMU_VERSION) {
200 fprintf(stderr, "Version mismatch between kqemu module and qemu (%08x %08x) - disabling kqemu use\n",
201 version, KQEMU_VERSION);
202 goto fail;
203 }
204
205 pages_to_flush = qemu_vmalloc(KQEMU_MAX_PAGES_TO_FLUSH *
206 sizeof(uint64_t));
207 if (!pages_to_flush)
208 goto fail;
209
210 ram_pages_to_update = qemu_vmalloc(KQEMU_MAX_RAM_PAGES_TO_UPDATE *
211 sizeof(uint64_t));
212 if (!ram_pages_to_update)
213 goto fail;
214
215 modified_ram_pages = qemu_vmalloc(KQEMU_MAX_MODIFIED_RAM_PAGES *
216 sizeof(uint64_t));
217 if (!modified_ram_pages)
218 goto fail;
219 modified_ram_pages_table =
220 qemu_mallocz(kqemu_phys_ram_size >> TARGET_PAGE_BITS);
221 if (!modified_ram_pages_table)
222 goto fail;
223
224 memset(&kinit, 0, sizeof(kinit)); /* set the paddings to zero */
225 kinit.ram_base = kqemu_phys_ram_base;
226 kinit.ram_size = kqemu_phys_ram_size;
227 kinit.ram_dirty = phys_ram_dirty;
228 kinit.pages_to_flush = pages_to_flush;
229 kinit.ram_pages_to_update = ram_pages_to_update;
230 kinit.modified_ram_pages = modified_ram_pages;
231 #ifdef _WIN32
232 ret = DeviceIoControl(kqemu_fd, KQEMU_INIT, &kinit, sizeof(kinit),
233 NULL, 0, &temp, NULL) == TRUE ? 0 : -1;
234 #else
235 ret = ioctl(kqemu_fd, KQEMU_INIT, &kinit);
236 #endif
237 if (ret < 0) {
238 fprintf(stderr, "Error %d while initializing QEMU acceleration layer - disabling it for now\n", ret);
239 fail:
240 kqemu_closefd(kqemu_fd);
241 kqemu_fd = KQEMU_INVALID_FD;
242 return -1;
243 }
244 kqemu_update_cpuid(env);
245 env->kqemu_enabled = kqemu_allowed;
246 nb_pages_to_flush = 0;
247 nb_ram_pages_to_update = 0;
248
249 qpi_init();
250 return 0;
251 }
252
kqemu_flush_page(CPUState * env,target_ulong addr)253 void kqemu_flush_page(CPUState *env, target_ulong addr)
254 {
255 LOG_INT("kqemu_flush_page: addr=" TARGET_FMT_lx "\n", addr);
256 if (nb_pages_to_flush >= KQEMU_MAX_PAGES_TO_FLUSH)
257 nb_pages_to_flush = KQEMU_FLUSH_ALL;
258 else
259 pages_to_flush[nb_pages_to_flush++] = addr;
260 }
261
kqemu_flush(CPUState * env,int global)262 void kqemu_flush(CPUState *env, int global)
263 {
264 LOG_INT("kqemu_flush:\n");
265 nb_pages_to_flush = KQEMU_FLUSH_ALL;
266 }
267
kqemu_set_notdirty(CPUState * env,ram_addr_t ram_addr)268 void kqemu_set_notdirty(CPUState *env, ram_addr_t ram_addr)
269 {
270 LOG_INT("kqemu_set_notdirty: addr=%08lx\n",
271 (unsigned long)ram_addr);
272 /* we only track transitions to dirty state */
273 if (phys_ram_dirty[ram_addr >> TARGET_PAGE_BITS] != 0xff)
274 return;
275 if (nb_ram_pages_to_update >= KQEMU_MAX_RAM_PAGES_TO_UPDATE)
276 nb_ram_pages_to_update = KQEMU_RAM_PAGES_UPDATE_ALL;
277 else
278 ram_pages_to_update[nb_ram_pages_to_update++] = ram_addr;
279 }
280
kqemu_reset_modified_ram_pages(void)281 static void kqemu_reset_modified_ram_pages(void)
282 {
283 int i;
284 unsigned long page_index;
285
286 for(i = 0; i < nb_modified_ram_pages; i++) {
287 page_index = modified_ram_pages[i] >> TARGET_PAGE_BITS;
288 modified_ram_pages_table[page_index] = 0;
289 }
290 nb_modified_ram_pages = 0;
291 }
292
kqemu_modify_page(CPUState * env,ram_addr_t ram_addr)293 void kqemu_modify_page(CPUState *env, ram_addr_t ram_addr)
294 {
295 unsigned long page_index;
296 int ret;
297 #ifdef _WIN32
298 DWORD temp;
299 #endif
300
301 page_index = ram_addr >> TARGET_PAGE_BITS;
302 if (!modified_ram_pages_table[page_index]) {
303 #if 0
304 printf("%d: modify_page=%08lx\n", nb_modified_ram_pages, ram_addr);
305 #endif
306 modified_ram_pages_table[page_index] = 1;
307 modified_ram_pages[nb_modified_ram_pages++] = ram_addr;
308 if (nb_modified_ram_pages >= KQEMU_MAX_MODIFIED_RAM_PAGES) {
309 /* flush */
310 #ifdef _WIN32
311 ret = DeviceIoControl(kqemu_fd, KQEMU_MODIFY_RAM_PAGES,
312 &nb_modified_ram_pages,
313 sizeof(nb_modified_ram_pages),
314 NULL, 0, &temp, NULL);
315 #else
316 ret = ioctl(kqemu_fd, KQEMU_MODIFY_RAM_PAGES,
317 &nb_modified_ram_pages);
318 #endif
319 kqemu_reset_modified_ram_pages();
320 }
321 }
322 }
323
kqemu_set_phys_mem(uint64_t start_addr,ram_addr_t size,ram_addr_t phys_offset)324 void kqemu_set_phys_mem(uint64_t start_addr, ram_addr_t size,
325 ram_addr_t phys_offset)
326 {
327 struct kqemu_phys_mem kphys_mem1, *kphys_mem = &kphys_mem1;
328 uint64_t end;
329 int ret, io_index;
330
331 end = (start_addr + size + TARGET_PAGE_SIZE - 1) & TARGET_PAGE_MASK;
332 start_addr &= TARGET_PAGE_MASK;
333 kphys_mem->phys_addr = start_addr;
334 kphys_mem->size = end - start_addr;
335 kphys_mem->ram_addr = phys_offset & TARGET_PAGE_MASK;
336 io_index = phys_offset & ~TARGET_PAGE_MASK;
337 switch(io_index) {
338 case IO_MEM_RAM:
339 kphys_mem->io_index = KQEMU_IO_MEM_RAM;
340 break;
341 case IO_MEM_ROM:
342 kphys_mem->io_index = KQEMU_IO_MEM_ROM;
343 break;
344 default:
345 if (qpi_io_memory == io_index) {
346 kphys_mem->io_index = KQEMU_IO_MEM_COMM;
347 } else {
348 kphys_mem->io_index = KQEMU_IO_MEM_UNASSIGNED;
349 }
350 break;
351 }
352 #ifdef _WIN32
353 {
354 DWORD temp;
355 ret = DeviceIoControl(kqemu_fd, KQEMU_SET_PHYS_MEM,
356 kphys_mem, sizeof(*kphys_mem),
357 NULL, 0, &temp, NULL) == TRUE ? 0 : -1;
358 }
359 #else
360 ret = ioctl(kqemu_fd, KQEMU_SET_PHYS_MEM, kphys_mem);
361 #endif
362 if (ret < 0) {
363 fprintf(stderr, "kqemu: KQEMU_SET_PHYS_PAGE error=%d: start_addr=0x%016" PRIx64 " size=0x%08lx phys_offset=0x%08lx\n",
364 ret, start_addr,
365 (unsigned long)size, (unsigned long)phys_offset);
366 }
367 }
368
369 struct fpstate {
370 uint16_t fpuc;
371 uint16_t dummy1;
372 uint16_t fpus;
373 uint16_t dummy2;
374 uint16_t fptag;
375 uint16_t dummy3;
376
377 uint32_t fpip;
378 uint32_t fpcs;
379 uint32_t fpoo;
380 uint32_t fpos;
381 uint8_t fpregs1[8 * 10];
382 };
383
384 struct fpxstate {
385 uint16_t fpuc;
386 uint16_t fpus;
387 uint16_t fptag;
388 uint16_t fop;
389 uint32_t fpuip;
390 uint16_t cs_sel;
391 uint16_t dummy0;
392 uint32_t fpudp;
393 uint16_t ds_sel;
394 uint16_t dummy1;
395 uint32_t mxcsr;
396 uint32_t mxcsr_mask;
397 uint8_t fpregs1[8 * 16];
398 uint8_t xmm_regs[16 * 16];
399 uint8_t dummy2[96];
400 };
401
402 static struct fpxstate fpx1 __attribute__((aligned(16)));
403
restore_native_fp_frstor(CPUState * env)404 static void restore_native_fp_frstor(CPUState *env)
405 {
406 int fptag, i, j;
407 struct fpstate fp1, *fp = &fp1;
408
409 fp->fpuc = env->fpuc;
410 fp->fpus = (env->fpus & ~0x3800) | (env->fpstt & 0x7) << 11;
411 fptag = 0;
412 for (i=7; i>=0; i--) {
413 fptag <<= 2;
414 if (env->fptags[i]) {
415 fptag |= 3;
416 } else {
417 /* the FPU automatically computes it */
418 }
419 }
420 fp->fptag = fptag;
421 j = env->fpstt;
422 for(i = 0;i < 8; i++) {
423 memcpy(&fp->fpregs1[i * 10], &env->fpregs[j].d, 10);
424 j = (j + 1) & 7;
425 }
426 asm volatile ("frstor %0" : "=m" (*fp));
427 }
428
save_native_fp_fsave(CPUState * env)429 static void save_native_fp_fsave(CPUState *env)
430 {
431 int fptag, i, j;
432 uint16_t fpuc;
433 struct fpstate fp1, *fp = &fp1;
434
435 asm volatile ("fsave %0" : : "m" (*fp));
436 env->fpuc = fp->fpuc;
437 env->fpstt = (fp->fpus >> 11) & 7;
438 env->fpus = fp->fpus & ~0x3800;
439 fptag = fp->fptag;
440 for(i = 0;i < 8; i++) {
441 env->fptags[i] = ((fptag & 3) == 3);
442 fptag >>= 2;
443 }
444 j = env->fpstt;
445 for(i = 0;i < 8; i++) {
446 memcpy(&env->fpregs[j].d, &fp->fpregs1[i * 10], 10);
447 j = (j + 1) & 7;
448 }
449 /* we must restore the default rounding state */
450 fpuc = 0x037f | (env->fpuc & (3 << 10));
451 asm volatile("fldcw %0" : : "m" (fpuc));
452 }
453
restore_native_fp_fxrstor(CPUState * env)454 static void restore_native_fp_fxrstor(CPUState *env)
455 {
456 struct fpxstate *fp = &fpx1;
457 int i, j, fptag;
458
459 fp->fpuc = env->fpuc;
460 fp->fpus = (env->fpus & ~0x3800) | (env->fpstt & 0x7) << 11;
461 fptag = 0;
462 for(i = 0; i < 8; i++)
463 fptag |= (env->fptags[i] << i);
464 fp->fptag = fptag ^ 0xff;
465
466 j = env->fpstt;
467 for(i = 0;i < 8; i++) {
468 memcpy(&fp->fpregs1[i * 16], &env->fpregs[j].d, 10);
469 j = (j + 1) & 7;
470 }
471 if (env->cpuid_features & CPUID_SSE) {
472 fp->mxcsr = env->mxcsr;
473 /* XXX: check if DAZ is not available */
474 fp->mxcsr_mask = 0xffff;
475 memcpy(fp->xmm_regs, env->xmm_regs, CPU_NB_REGS * 16);
476 }
477 asm volatile ("fxrstor %0" : "=m" (*fp));
478 }
479
save_native_fp_fxsave(CPUState * env)480 static void save_native_fp_fxsave(CPUState *env)
481 {
482 struct fpxstate *fp = &fpx1;
483 int fptag, i, j;
484 uint16_t fpuc;
485
486 asm volatile ("fxsave %0" : : "m" (*fp));
487 env->fpuc = fp->fpuc;
488 env->fpstt = (fp->fpus >> 11) & 7;
489 env->fpus = fp->fpus & ~0x3800;
490 fptag = fp->fptag ^ 0xff;
491 for(i = 0;i < 8; i++) {
492 env->fptags[i] = (fptag >> i) & 1;
493 }
494 j = env->fpstt;
495 for(i = 0;i < 8; i++) {
496 memcpy(&env->fpregs[j].d, &fp->fpregs1[i * 16], 10);
497 j = (j + 1) & 7;
498 }
499 if (env->cpuid_features & CPUID_SSE) {
500 env->mxcsr = fp->mxcsr;
501 memcpy(env->xmm_regs, fp->xmm_regs, CPU_NB_REGS * 16);
502 }
503
504 /* we must restore the default rounding state */
505 asm volatile ("fninit");
506 fpuc = 0x037f | (env->fpuc & (3 << 10));
507 asm volatile("fldcw %0" : : "m" (fpuc));
508 }
509
do_syscall(CPUState * env,struct kqemu_cpu_state * kenv)510 static int do_syscall(CPUState *env,
511 struct kqemu_cpu_state *kenv)
512 {
513 int selector;
514
515 selector = (env->star >> 32) & 0xffff;
516 #ifdef TARGET_X86_64
517 if (env->hflags & HF_LMA_MASK) {
518 int code64;
519
520 env->regs[R_ECX] = kenv->next_eip;
521 env->regs[11] = env->eflags;
522
523 code64 = env->hflags & HF_CS64_MASK;
524
525 cpu_x86_set_cpl(env, 0);
526 cpu_x86_load_seg_cache(env, R_CS, selector & 0xfffc,
527 0, 0xffffffff,
528 DESC_G_MASK | DESC_P_MASK |
529 DESC_S_MASK |
530 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK | DESC_L_MASK);
531 cpu_x86_load_seg_cache(env, R_SS, (selector + 8) & 0xfffc,
532 0, 0xffffffff,
533 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
534 DESC_S_MASK |
535 DESC_W_MASK | DESC_A_MASK);
536 env->eflags &= ~env->fmask;
537 if (code64)
538 env->eip = env->lstar;
539 else
540 env->eip = env->cstar;
541 } else
542 #endif
543 {
544 env->regs[R_ECX] = (uint32_t)kenv->next_eip;
545
546 cpu_x86_set_cpl(env, 0);
547 cpu_x86_load_seg_cache(env, R_CS, selector & 0xfffc,
548 0, 0xffffffff,
549 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
550 DESC_S_MASK |
551 DESC_CS_MASK | DESC_R_MASK | DESC_A_MASK);
552 cpu_x86_load_seg_cache(env, R_SS, (selector + 8) & 0xfffc,
553 0, 0xffffffff,
554 DESC_G_MASK | DESC_B_MASK | DESC_P_MASK |
555 DESC_S_MASK |
556 DESC_W_MASK | DESC_A_MASK);
557 env->eflags &= ~(IF_MASK | RF_MASK | VM_MASK);
558 env->eip = (uint32_t)env->star;
559 }
560 return 2;
561 }
562
563 #ifdef CONFIG_PROFILER
564
565 #define PC_REC_SIZE 1
566 #define PC_REC_HASH_BITS 16
567 #define PC_REC_HASH_SIZE (1 << PC_REC_HASH_BITS)
568
569 typedef struct PCRecord {
570 unsigned long pc;
571 int64_t count;
572 struct PCRecord *next;
573 } PCRecord;
574
575 static PCRecord *pc_rec_hash[PC_REC_HASH_SIZE];
576 static int nb_pc_records;
577
kqemu_record_pc(unsigned long pc)578 static void kqemu_record_pc(unsigned long pc)
579 {
580 unsigned long h;
581 PCRecord **pr, *r;
582
583 h = pc / PC_REC_SIZE;
584 h = h ^ (h >> PC_REC_HASH_BITS);
585 h &= (PC_REC_HASH_SIZE - 1);
586 pr = &pc_rec_hash[h];
587 for(;;) {
588 r = *pr;
589 if (r == NULL)
590 break;
591 if (r->pc == pc) {
592 r->count++;
593 return;
594 }
595 pr = &r->next;
596 }
597 r = malloc(sizeof(PCRecord));
598 r->count = 1;
599 r->pc = pc;
600 r->next = NULL;
601 *pr = r;
602 nb_pc_records++;
603 }
604
pc_rec_cmp(const void * p1,const void * p2)605 static int pc_rec_cmp(const void *p1, const void *p2)
606 {
607 PCRecord *r1 = *(PCRecord **)p1;
608 PCRecord *r2 = *(PCRecord **)p2;
609 if (r1->count < r2->count)
610 return 1;
611 else if (r1->count == r2->count)
612 return 0;
613 else
614 return -1;
615 }
616
kqemu_record_flush(void)617 static void kqemu_record_flush(void)
618 {
619 PCRecord *r, *r_next;
620 int h;
621
622 for(h = 0; h < PC_REC_HASH_SIZE; h++) {
623 for(r = pc_rec_hash[h]; r != NULL; r = r_next) {
624 r_next = r->next;
625 free(r);
626 }
627 pc_rec_hash[h] = NULL;
628 }
629 nb_pc_records = 0;
630 }
631
kqemu_record_dump(void)632 void kqemu_record_dump(void)
633 {
634 PCRecord **pr, *r;
635 int i, h;
636 FILE *f;
637 int64_t total, sum;
638
639 pr = malloc(sizeof(PCRecord *) * nb_pc_records);
640 i = 0;
641 total = 0;
642 for(h = 0; h < PC_REC_HASH_SIZE; h++) {
643 for(r = pc_rec_hash[h]; r != NULL; r = r->next) {
644 pr[i++] = r;
645 total += r->count;
646 }
647 }
648 qsort(pr, nb_pc_records, sizeof(PCRecord *), pc_rec_cmp);
649
650 f = fopen("/tmp/kqemu.stats", "w");
651 if (!f) {
652 perror("/tmp/kqemu.stats");
653 exit(1);
654 }
655 fprintf(f, "total: %" PRId64 "\n", total);
656 sum = 0;
657 for(i = 0; i < nb_pc_records; i++) {
658 r = pr[i];
659 sum += r->count;
660 fprintf(f, "%08lx: %" PRId64 " %0.2f%% %0.2f%%\n",
661 r->pc,
662 r->count,
663 (double)r->count / (double)total * 100.0,
664 (double)sum / (double)total * 100.0);
665 }
666 fclose(f);
667 free(pr);
668
669 kqemu_record_flush();
670 }
671 #endif
672
kqemu_load_seg(struct kqemu_segment_cache * ksc,const SegmentCache * sc)673 static inline void kqemu_load_seg(struct kqemu_segment_cache *ksc,
674 const SegmentCache *sc)
675 {
676 ksc->selector = sc->selector;
677 ksc->flags = sc->flags;
678 ksc->limit = sc->limit;
679 ksc->base = sc->base;
680 }
681
kqemu_save_seg(SegmentCache * sc,const struct kqemu_segment_cache * ksc)682 static inline void kqemu_save_seg(SegmentCache *sc,
683 const struct kqemu_segment_cache *ksc)
684 {
685 sc->selector = ksc->selector;
686 sc->flags = ksc->flags;
687 sc->limit = ksc->limit;
688 sc->base = ksc->base;
689 }
690
kqemu_cpu_exec(CPUState * env)691 int kqemu_cpu_exec(CPUState *env)
692 {
693 struct kqemu_cpu_state kcpu_state, *kenv = &kcpu_state;
694 int ret, cpl, i;
695 #ifdef CONFIG_PROFILER
696 int64_t ti;
697 #endif
698 #ifdef _WIN32
699 DWORD temp;
700 #endif
701
702 #ifdef CONFIG_PROFILER
703 ti = profile_getclock();
704 #endif
705 LOG_INT("kqemu: cpu_exec: enter\n");
706 LOG_INT_STATE(env);
707 for(i = 0; i < CPU_NB_REGS; i++)
708 kenv->regs[i] = env->regs[i];
709 kenv->eip = env->eip;
710 kenv->eflags = env->eflags;
711 for(i = 0; i < 6; i++)
712 kqemu_load_seg(&kenv->segs[i], &env->segs[i]);
713 kqemu_load_seg(&kenv->ldt, &env->ldt);
714 kqemu_load_seg(&kenv->tr, &env->tr);
715 kqemu_load_seg(&kenv->gdt, &env->gdt);
716 kqemu_load_seg(&kenv->idt, &env->idt);
717 kenv->cr0 = env->cr[0];
718 kenv->cr2 = env->cr[2];
719 kenv->cr3 = env->cr[3];
720 kenv->cr4 = env->cr[4];
721 kenv->a20_mask = env->a20_mask;
722 kenv->efer = env->efer;
723 kenv->tsc_offset = 0;
724 kenv->star = env->star;
725 kenv->sysenter_cs = env->sysenter_cs;
726 kenv->sysenter_esp = env->sysenter_esp;
727 kenv->sysenter_eip = env->sysenter_eip;
728 #ifdef TARGET_X86_64
729 kenv->lstar = env->lstar;
730 kenv->cstar = env->cstar;
731 kenv->fmask = env->fmask;
732 kenv->kernelgsbase = env->kernelgsbase;
733 #endif
734 if (env->dr[7] & 0xff) {
735 kenv->dr7 = env->dr[7];
736 kenv->dr0 = env->dr[0];
737 kenv->dr1 = env->dr[1];
738 kenv->dr2 = env->dr[2];
739 kenv->dr3 = env->dr[3];
740 } else {
741 kenv->dr7 = 0;
742 }
743 kenv->dr6 = env->dr[6];
744 cpl = (env->hflags & HF_CPL_MASK);
745 kenv->cpl = cpl;
746 kenv->nb_pages_to_flush = nb_pages_to_flush;
747 kenv->user_only = (env->kqemu_enabled == 1);
748 kenv->nb_ram_pages_to_update = nb_ram_pages_to_update;
749 nb_ram_pages_to_update = 0;
750 kenv->nb_modified_ram_pages = nb_modified_ram_pages;
751
752 kqemu_reset_modified_ram_pages();
753
754 if (env->cpuid_features & CPUID_FXSR)
755 restore_native_fp_fxrstor(env);
756 else
757 restore_native_fp_frstor(env);
758
759 #ifdef _WIN32
760 if (DeviceIoControl(kqemu_fd, KQEMU_EXEC,
761 kenv, sizeof(struct kqemu_cpu_state),
762 kenv, sizeof(struct kqemu_cpu_state),
763 &temp, NULL)) {
764 ret = kenv->retval;
765 } else {
766 ret = -1;
767 }
768 #else
769 ioctl(kqemu_fd, KQEMU_EXEC, kenv);
770 ret = kenv->retval;
771 #endif
772 if (env->cpuid_features & CPUID_FXSR)
773 save_native_fp_fxsave(env);
774 else
775 save_native_fp_fsave(env);
776
777 for(i = 0; i < CPU_NB_REGS; i++)
778 env->regs[i] = kenv->regs[i];
779 env->eip = kenv->eip;
780 env->eflags = kenv->eflags;
781 for(i = 0; i < 6; i++)
782 kqemu_save_seg(&env->segs[i], &kenv->segs[i]);
783 cpu_x86_set_cpl(env, kenv->cpl);
784 kqemu_save_seg(&env->ldt, &kenv->ldt);
785 env->cr[0] = kenv->cr0;
786 env->cr[4] = kenv->cr4;
787 env->cr[3] = kenv->cr3;
788 env->cr[2] = kenv->cr2;
789 env->dr[6] = kenv->dr6;
790 #ifdef TARGET_X86_64
791 env->kernelgsbase = kenv->kernelgsbase;
792 #endif
793
794 /* flush pages as indicated by kqemu */
795 if (kenv->nb_pages_to_flush >= KQEMU_FLUSH_ALL) {
796 tlb_flush(env, 1);
797 } else {
798 for(i = 0; i < kenv->nb_pages_to_flush; i++) {
799 tlb_flush_page(env, pages_to_flush[i]);
800 }
801 }
802 nb_pages_to_flush = 0;
803
804 #ifdef CONFIG_PROFILER
805 kqemu_time += profile_getclock() - ti;
806 kqemu_exec_count++;
807 #endif
808
809 if (kenv->nb_ram_pages_to_update > 0) {
810 cpu_tlb_update_dirty(env);
811 }
812
813 if (kenv->nb_modified_ram_pages > 0) {
814 for(i = 0; i < kenv->nb_modified_ram_pages; i++) {
815 unsigned long addr;
816 addr = modified_ram_pages[i];
817 tb_invalidate_phys_page_range(addr, addr + TARGET_PAGE_SIZE, 0);
818 }
819 }
820
821 /* restore the hidden flags */
822 {
823 unsigned int new_hflags;
824 #ifdef TARGET_X86_64
825 if ((env->hflags & HF_LMA_MASK) &&
826 (env->segs[R_CS].flags & DESC_L_MASK)) {
827 /* long mode */
828 new_hflags = HF_CS32_MASK | HF_SS32_MASK | HF_CS64_MASK;
829 } else
830 #endif
831 {
832 /* legacy / compatibility case */
833 new_hflags = (env->segs[R_CS].flags & DESC_B_MASK)
834 >> (DESC_B_SHIFT - HF_CS32_SHIFT);
835 new_hflags |= (env->segs[R_SS].flags & DESC_B_MASK)
836 >> (DESC_B_SHIFT - HF_SS32_SHIFT);
837 if (!(env->cr[0] & CR0_PE_MASK) ||
838 (env->eflags & VM_MASK) ||
839 !(env->hflags & HF_CS32_MASK)) {
840 /* XXX: try to avoid this test. The problem comes from the
841 fact that is real mode or vm86 mode we only modify the
842 'base' and 'selector' fields of the segment cache to go
843 faster. A solution may be to force addseg to one in
844 translate-i386.c. */
845 new_hflags |= HF_ADDSEG_MASK;
846 } else {
847 new_hflags |= ((env->segs[R_DS].base |
848 env->segs[R_ES].base |
849 env->segs[R_SS].base) != 0) <<
850 HF_ADDSEG_SHIFT;
851 }
852 }
853 env->hflags = (env->hflags &
854 ~(HF_CS32_MASK | HF_SS32_MASK | HF_CS64_MASK | HF_ADDSEG_MASK)) |
855 new_hflags;
856 }
857 /* update FPU flags */
858 env->hflags = (env->hflags & ~(HF_MP_MASK | HF_EM_MASK | HF_TS_MASK)) |
859 ((env->cr[0] << (HF_MP_SHIFT - 1)) & (HF_MP_MASK | HF_EM_MASK | HF_TS_MASK));
860 if (env->cr[4] & CR4_OSFXSR_MASK)
861 env->hflags |= HF_OSFXSR_MASK;
862 else
863 env->hflags &= ~HF_OSFXSR_MASK;
864
865 LOG_INT("kqemu: kqemu_cpu_exec: ret=0x%x\n", ret);
866 if (ret == KQEMU_RET_SYSCALL) {
867 /* syscall instruction */
868 return do_syscall(env, kenv);
869 } else
870 if ((ret & 0xff00) == KQEMU_RET_INT) {
871 env->exception_index = ret & 0xff;
872 env->error_code = 0;
873 env->exception_is_int = 1;
874 env->exception_next_eip = kenv->next_eip;
875 #ifdef CONFIG_PROFILER
876 kqemu_ret_int_count++;
877 #endif
878 LOG_INT("kqemu: interrupt v=%02x:\n", env->exception_index);
879 LOG_INT_STATE(env);
880 return 1;
881 } else if ((ret & 0xff00) == KQEMU_RET_EXCEPTION) {
882 env->exception_index = ret & 0xff;
883 env->error_code = kenv->error_code;
884 env->exception_is_int = 0;
885 env->exception_next_eip = 0;
886 #ifdef CONFIG_PROFILER
887 kqemu_ret_excp_count++;
888 #endif
889 LOG_INT("kqemu: exception v=%02x e=%04x:\n",
890 env->exception_index, env->error_code);
891 LOG_INT_STATE(env);
892 return 1;
893 } else if (ret == KQEMU_RET_INTR) {
894 #ifdef CONFIG_PROFILER
895 kqemu_ret_intr_count++;
896 #endif
897 LOG_INT_STATE(env);
898 return 0;
899 } else if (ret == KQEMU_RET_SOFTMMU) {
900 #ifdef CONFIG_PROFILER
901 {
902 unsigned long pc = env->eip + env->segs[R_CS].base;
903 kqemu_record_pc(pc);
904 }
905 #endif
906 LOG_INT_STATE(env);
907 return 2;
908 } else {
909 cpu_dump_state(env, stderr, fprintf, 0);
910 fprintf(stderr, "Unsupported return value: 0x%x\n", ret);
911 exit(1);
912 }
913 return 0;
914 }
915
kqemu_cpu_interrupt(CPUState * env)916 void kqemu_cpu_interrupt(CPUState *env)
917 {
918 #if defined(_WIN32)
919 /* cancelling the I/O request causes KQEMU to finish executing the
920 current block and successfully returning. */
921 CancelIo(kqemu_fd);
922 #endif
923 }
924
925 /*
926 QEMU paravirtualization interface. The current interface only
927 allows to modify the IF and IOPL flags when running in
928 kqemu.
929
930 At this point it is not very satisfactory. I leave it for reference
931 as it adds little complexity.
932 */
933
934 #define QPI_COMM_PAGE_PHYS_ADDR 0xff000000
935
qpi_mem_readb(void * opaque,target_phys_addr_t addr)936 static uint32_t qpi_mem_readb(void *opaque, target_phys_addr_t addr)
937 {
938 return 0;
939 }
940
qpi_mem_readw(void * opaque,target_phys_addr_t addr)941 static uint32_t qpi_mem_readw(void *opaque, target_phys_addr_t addr)
942 {
943 return 0;
944 }
945
qpi_mem_writeb(void * opaque,target_phys_addr_t addr,uint32_t val)946 static void qpi_mem_writeb(void *opaque, target_phys_addr_t addr, uint32_t val)
947 {
948 }
949
qpi_mem_writew(void * opaque,target_phys_addr_t addr,uint32_t val)950 static void qpi_mem_writew(void *opaque, target_phys_addr_t addr, uint32_t val)
951 {
952 }
953
qpi_mem_readl(void * opaque,target_phys_addr_t addr)954 static uint32_t qpi_mem_readl(void *opaque, target_phys_addr_t addr)
955 {
956 CPUState *env;
957
958 env = cpu_single_env;
959 if (!env)
960 return 0;
961 return env->eflags & (IF_MASK | IOPL_MASK);
962 }
963
964 /* Note: after writing to this address, the guest code must make sure
965 it is exiting the current TB. pushf/popf can be used for that
966 purpose. */
qpi_mem_writel(void * opaque,target_phys_addr_t addr,uint32_t val)967 static void qpi_mem_writel(void *opaque, target_phys_addr_t addr, uint32_t val)
968 {
969 CPUState *env;
970
971 env = cpu_single_env;
972 if (!env)
973 return;
974 env->eflags = (env->eflags & ~(IF_MASK | IOPL_MASK)) |
975 (val & (IF_MASK | IOPL_MASK));
976 }
977
978 static CPUReadMemoryFunc *qpi_mem_read[3] = {
979 qpi_mem_readb,
980 qpi_mem_readw,
981 qpi_mem_readl,
982 };
983
984 static CPUWriteMemoryFunc *qpi_mem_write[3] = {
985 qpi_mem_writeb,
986 qpi_mem_writew,
987 qpi_mem_writel,
988 };
989
qpi_init(void)990 static void qpi_init(void)
991 {
992 kqemu_comm_base = 0xff000000 | 1;
993 qpi_io_memory = cpu_register_io_memory(
994 qpi_mem_read,
995 qpi_mem_write, NULL);
996 cpu_register_physical_memory(kqemu_comm_base & ~0xfff,
997 0x1000, qpi_io_memory);
998 }
999 #endif
1000