xref: /qemu/target/i386/kvm/kvm.c (revision 6ff5da16000f908140723e164d33a0b51a6c4162)
1 /*
2  * QEMU KVM support
3  *
4  * Copyright (C) 2006-2008 Qumranet Technologies
5  * Copyright IBM, Corp. 2008
6  *
7  * Authors:
8  *  Anthony Liguori   <aliguori@us.ibm.com>
9  *
10  * This work is licensed under the terms of the GNU GPL, version 2 or later.
11  * See the COPYING file in the top-level directory.
12  *
13  */
14 
15 #include "qemu/osdep.h"
16 #include "qapi/qapi-events-run-state.h"
17 #include "qapi/error.h"
18 #include "qapi/visitor.h"
19 #include <math.h>
20 #include <sys/ioctl.h>
21 #include <sys/utsname.h>
22 #include <sys/syscall.h>
23 #include <sys/resource.h>
24 #include <sys/time.h>
25 
26 #include <linux/kvm.h>
27 #include <linux/kvm_para.h>
28 #include "standard-headers/asm-x86/kvm_para.h"
29 #include "hw/xen/interface/arch-x86/cpuid.h"
30 
31 #include "cpu.h"
32 #include "host-cpu.h"
33 #include "vmsr_energy.h"
34 #include "system/system.h"
35 #include "system/hw_accel.h"
36 #include "system/kvm_int.h"
37 #include "system/runstate.h"
38 #include "kvm_i386.h"
39 #include "../confidential-guest.h"
40 #include "sev.h"
41 #include "xen-emu.h"
42 #include "hyperv.h"
43 #include "hyperv-proto.h"
44 
45 #include "gdbstub/enums.h"
46 #include "qemu/host-utils.h"
47 #include "qemu/main-loop.h"
48 #include "qemu/ratelimit.h"
49 #include "qemu/config-file.h"
50 #include "qemu/error-report.h"
51 #include "qemu/memalign.h"
52 #include "hw/i386/x86.h"
53 #include "hw/i386/kvm/xen_evtchn.h"
54 #include "hw/i386/pc.h"
55 #include "hw/i386/apic.h"
56 #include "hw/i386/apic_internal.h"
57 #include "hw/i386/apic-msidef.h"
58 #include "hw/i386/intel_iommu.h"
59 #include "hw/i386/topology.h"
60 #include "hw/i386/x86-iommu.h"
61 #include "hw/i386/e820_memory_layout.h"
62 
63 #include "hw/xen/xen.h"
64 
65 #include "hw/pci/pci.h"
66 #include "hw/pci/msi.h"
67 #include "hw/pci/msix.h"
68 #include "migration/blocker.h"
69 #include "exec/memattrs.h"
70 #include "trace.h"
71 
72 #include CONFIG_DEVICES
73 
74 //#define DEBUG_KVM
75 
76 #ifdef DEBUG_KVM
77 #define DPRINTF(fmt, ...) \
78     do { fprintf(stderr, fmt, ## __VA_ARGS__); } while (0)
79 #else
80 #define DPRINTF(fmt, ...) \
81     do { } while (0)
82 #endif
83 
84 /*
85  * On older Intel CPUs, KVM uses vm86 mode to emulate 16-bit code directly.
86  * In order to use vm86 mode, an EPT identity map and a TSS  are needed.
87  * Since these must be part of guest physical memory, we need to allocate
88  * them, both by setting their start addresses in the kernel and by
89  * creating a corresponding e820 entry. We need 4 pages before the BIOS,
90  * so this value allows up to 16M BIOSes.
91  */
92 #define KVM_IDENTITY_BASE 0xfeffc000
93 
94 /* From arch/x86/kvm/lapic.h */
95 #define KVM_APIC_BUS_CYCLE_NS       1
96 #define KVM_APIC_BUS_FREQUENCY      (1000000000ULL / KVM_APIC_BUS_CYCLE_NS)
97 
98 /* A 4096-byte buffer can hold the 8-byte kvm_msrs header, plus
99  * 255 kvm_msr_entry structs */
100 #define MSR_BUF_SIZE 4096
101 
102 typedef bool QEMURDMSRHandler(X86CPU *cpu, uint32_t msr, uint64_t *val);
103 typedef bool QEMUWRMSRHandler(X86CPU *cpu, uint32_t msr, uint64_t val);
104 typedef struct {
105     uint32_t msr;
106     QEMURDMSRHandler *rdmsr;
107     QEMUWRMSRHandler *wrmsr;
108 } KVMMSRHandlers;
109 
110 static void kvm_init_msrs(X86CPU *cpu);
111 static int kvm_filter_msr(KVMState *s, uint32_t msr, QEMURDMSRHandler *rdmsr,
112                           QEMUWRMSRHandler *wrmsr);
113 
114 const KVMCapabilityInfo kvm_arch_required_capabilities[] = {
115     KVM_CAP_INFO(SET_TSS_ADDR),
116     KVM_CAP_INFO(EXT_CPUID),
117     KVM_CAP_INFO(MP_STATE),
118     KVM_CAP_INFO(SIGNAL_MSI),
119     KVM_CAP_INFO(IRQ_ROUTING),
120     KVM_CAP_INFO(DEBUGREGS),
121     KVM_CAP_INFO(XSAVE),
122     KVM_CAP_INFO(VCPU_EVENTS),
123     KVM_CAP_INFO(X86_ROBUST_SINGLESTEP),
124     KVM_CAP_INFO(MCE),
125     KVM_CAP_INFO(ADJUST_CLOCK),
126     KVM_CAP_INFO(SET_IDENTITY_MAP_ADDR),
127     KVM_CAP_LAST_INFO
128 };
129 
130 static bool has_msr_star;
131 static bool has_msr_hsave_pa;
132 static bool has_msr_tsc_aux;
133 static bool has_msr_tsc_adjust;
134 static bool has_msr_tsc_deadline;
135 static bool has_msr_feature_control;
136 static bool has_msr_misc_enable;
137 static bool has_msr_smbase;
138 static bool has_msr_bndcfgs;
139 static int lm_capable_kernel;
140 static bool has_msr_hv_hypercall;
141 static bool has_msr_hv_crash;
142 static bool has_msr_hv_reset;
143 static bool has_msr_hv_vpindex;
144 static bool hv_vpindex_settable;
145 static bool has_msr_hv_runtime;
146 static bool has_msr_hv_synic;
147 static bool has_msr_hv_stimer;
148 static bool has_msr_hv_frequencies;
149 static bool has_msr_hv_reenlightenment;
150 static bool has_msr_hv_syndbg_options;
151 static bool has_msr_xss;
152 static bool has_msr_umwait;
153 static bool has_msr_spec_ctrl;
154 static bool has_tsc_scale_msr;
155 static bool has_msr_tsx_ctrl;
156 static bool has_msr_virt_ssbd;
157 static bool has_msr_smi_count;
158 static bool has_msr_arch_capabs;
159 static bool has_msr_core_capabs;
160 static bool has_msr_vmx_vmfunc;
161 static bool has_msr_ucode_rev;
162 static bool has_msr_vmx_procbased_ctls2;
163 static bool has_msr_perf_capabs;
164 static bool has_msr_pkrs;
165 static bool has_msr_hwcr;
166 
167 static uint32_t has_architectural_pmu_version;
168 static uint32_t num_architectural_pmu_gp_counters;
169 static uint32_t num_architectural_pmu_fixed_counters;
170 
171 static int has_xsave2;
172 static int has_xcrs;
173 static int has_sregs2;
174 static int has_exception_payload;
175 static int has_triple_fault_event;
176 
177 static bool has_msr_mcg_ext_ctl;
178 
179 static struct kvm_cpuid2 *cpuid_cache;
180 static struct kvm_cpuid2 *hv_cpuid_cache;
181 static struct kvm_msr_list *kvm_feature_msrs;
182 
183 static KVMMSRHandlers msr_handlers[KVM_MSR_FILTER_MAX_RANGES];
184 
185 #define BUS_LOCK_SLICE_TIME 1000000000ULL /* ns */
186 static RateLimit bus_lock_ratelimit_ctrl;
187 static int kvm_get_one_msr(X86CPU *cpu, int index, uint64_t *value);
188 
189 static const char *vm_type_name[] = {
190     [KVM_X86_DEFAULT_VM] = "default",
191     [KVM_X86_SEV_VM] = "SEV",
192     [KVM_X86_SEV_ES_VM] = "SEV-ES",
193     [KVM_X86_SNP_VM] = "SEV-SNP",
194 };
195 
196 bool kvm_is_vm_type_supported(int type)
197 {
198     uint32_t machine_types;
199 
200     /*
201      * old KVM doesn't support KVM_CAP_VM_TYPES but KVM_X86_DEFAULT_VM
202      * is always supported
203      */
204     if (type == KVM_X86_DEFAULT_VM) {
205         return true;
206     }
207 
208     machine_types = kvm_check_extension(KVM_STATE(current_machine->accelerator),
209                                         KVM_CAP_VM_TYPES);
210     return !!(machine_types & BIT(type));
211 }
212 
213 int kvm_get_vm_type(MachineState *ms)
214 {
215     int kvm_type = KVM_X86_DEFAULT_VM;
216 
217     if (ms->cgs) {
218         if (!object_dynamic_cast(OBJECT(ms->cgs), TYPE_X86_CONFIDENTIAL_GUEST)) {
219             error_report("configuration type %s not supported for x86 guests",
220                          object_get_typename(OBJECT(ms->cgs)));
221             exit(1);
222         }
223         kvm_type = x86_confidential_guest_kvm_type(
224             X86_CONFIDENTIAL_GUEST(ms->cgs));
225     }
226 
227     if (!kvm_is_vm_type_supported(kvm_type)) {
228         error_report("vm-type %s not supported by KVM", vm_type_name[kvm_type]);
229         exit(1);
230     }
231 
232     return kvm_type;
233 }
234 
235 bool kvm_enable_hypercall(uint64_t enable_mask)
236 {
237     KVMState *s = KVM_STATE(current_accel());
238 
239     return !kvm_vm_enable_cap(s, KVM_CAP_EXIT_HYPERCALL, 0, enable_mask);
240 }
241 
242 bool kvm_has_smm(void)
243 {
244     return kvm_vm_check_extension(kvm_state, KVM_CAP_X86_SMM);
245 }
246 
247 bool kvm_has_adjust_clock_stable(void)
248 {
249     int ret = kvm_check_extension(kvm_state, KVM_CAP_ADJUST_CLOCK);
250 
251     return (ret & KVM_CLOCK_TSC_STABLE);
252 }
253 
254 bool kvm_has_exception_payload(void)
255 {
256     return has_exception_payload;
257 }
258 
259 static bool kvm_x2apic_api_set_flags(uint64_t flags)
260 {
261     KVMState *s = KVM_STATE(current_accel());
262 
263     return !kvm_vm_enable_cap(s, KVM_CAP_X2APIC_API, 0, flags);
264 }
265 
266 #define MEMORIZE(fn, _result) \
267     ({ \
268         static bool _memorized; \
269         \
270         if (_memorized) { \
271             return _result; \
272         } \
273         _memorized = true; \
274         _result = fn; \
275     })
276 
277 static bool has_x2apic_api;
278 
279 bool kvm_has_x2apic_api(void)
280 {
281     return has_x2apic_api;
282 }
283 
284 bool kvm_enable_x2apic(void)
285 {
286     return MEMORIZE(
287              kvm_x2apic_api_set_flags(KVM_X2APIC_API_USE_32BIT_IDS |
288                                       KVM_X2APIC_API_DISABLE_BROADCAST_QUIRK),
289              has_x2apic_api);
290 }
291 
292 bool kvm_hv_vpindex_settable(void)
293 {
294     return hv_vpindex_settable;
295 }
296 
297 static int kvm_get_tsc(CPUState *cs)
298 {
299     X86CPU *cpu = X86_CPU(cs);
300     CPUX86State *env = &cpu->env;
301     uint64_t value;
302     int ret;
303 
304     if (env->tsc_valid) {
305         return 0;
306     }
307 
308     env->tsc_valid = !runstate_is_running();
309 
310     ret = kvm_get_one_msr(cpu, MSR_IA32_TSC, &value);
311     if (ret < 0) {
312         return ret;
313     }
314 
315     env->tsc = value;
316     return 0;
317 }
318 
319 static inline void do_kvm_synchronize_tsc(CPUState *cpu, run_on_cpu_data arg)
320 {
321     kvm_get_tsc(cpu);
322 }
323 
324 void kvm_synchronize_all_tsc(void)
325 {
326     CPUState *cpu;
327 
328     if (kvm_enabled()) {
329         CPU_FOREACH(cpu) {
330             run_on_cpu(cpu, do_kvm_synchronize_tsc, RUN_ON_CPU_NULL);
331         }
332     }
333 }
334 
335 static struct kvm_cpuid2 *try_get_cpuid(KVMState *s, int max)
336 {
337     struct kvm_cpuid2 *cpuid;
338     int r, size;
339 
340     size = sizeof(*cpuid) + max * sizeof(*cpuid->entries);
341     cpuid = g_malloc0(size);
342     cpuid->nent = max;
343     r = kvm_ioctl(s, KVM_GET_SUPPORTED_CPUID, cpuid);
344     if (r == 0 && cpuid->nent >= max) {
345         r = -E2BIG;
346     }
347     if (r < 0) {
348         if (r == -E2BIG) {
349             g_free(cpuid);
350             return NULL;
351         } else {
352             fprintf(stderr, "KVM_GET_SUPPORTED_CPUID failed: %s\n",
353                     strerror(-r));
354             exit(1);
355         }
356     }
357     return cpuid;
358 }
359 
360 /* Run KVM_GET_SUPPORTED_CPUID ioctl(), allocating a buffer large enough
361  * for all entries.
362  */
363 static struct kvm_cpuid2 *get_supported_cpuid(KVMState *s)
364 {
365     struct kvm_cpuid2 *cpuid;
366     int max = 1;
367 
368     if (cpuid_cache != NULL) {
369         return cpuid_cache;
370     }
371     while ((cpuid = try_get_cpuid(s, max)) == NULL) {
372         max *= 2;
373     }
374     cpuid_cache = cpuid;
375     return cpuid;
376 }
377 
378 static bool host_tsx_broken(void)
379 {
380     int family, model, stepping;\
381     char vendor[CPUID_VENDOR_SZ + 1];
382 
383     host_cpu_vendor_fms(vendor, &family, &model, &stepping);
384 
385     /* Check if we are running on a Haswell host known to have broken TSX */
386     return !strcmp(vendor, CPUID_VENDOR_INTEL) &&
387            (family == 6) &&
388            ((model == 63 && stepping < 4) ||
389             model == 60 || model == 69 || model == 70);
390 }
391 
392 /* Returns the value for a specific register on the cpuid entry
393  */
394 static uint32_t cpuid_entry_get_reg(struct kvm_cpuid_entry2 *entry, int reg)
395 {
396     uint32_t ret = 0;
397     switch (reg) {
398     case R_EAX:
399         ret = entry->eax;
400         break;
401     case R_EBX:
402         ret = entry->ebx;
403         break;
404     case R_ECX:
405         ret = entry->ecx;
406         break;
407     case R_EDX:
408         ret = entry->edx;
409         break;
410     }
411     return ret;
412 }
413 
414 /* Find matching entry for function/index on kvm_cpuid2 struct
415  */
416 static struct kvm_cpuid_entry2 *cpuid_find_entry(struct kvm_cpuid2 *cpuid,
417                                                  uint32_t function,
418                                                  uint32_t index)
419 {
420     int i;
421     for (i = 0; i < cpuid->nent; ++i) {
422         if (cpuid->entries[i].function == function &&
423             cpuid->entries[i].index == index) {
424             return &cpuid->entries[i];
425         }
426     }
427     /* not found: */
428     return NULL;
429 }
430 
431 uint32_t kvm_arch_get_supported_cpuid(KVMState *s, uint32_t function,
432                                       uint32_t index, int reg)
433 {
434     struct kvm_cpuid2 *cpuid;
435     uint32_t ret = 0;
436     uint32_t cpuid_1_edx, unused;
437     uint64_t bitmask;
438 
439     cpuid = get_supported_cpuid(s);
440 
441     struct kvm_cpuid_entry2 *entry = cpuid_find_entry(cpuid, function, index);
442     if (entry) {
443         ret = cpuid_entry_get_reg(entry, reg);
444     }
445 
446     /* Fixups for the data returned by KVM, below */
447 
448     if (function == 1 && reg == R_EDX) {
449         /* KVM before 2.6.30 misreports the following features */
450         ret |= CPUID_MTRR | CPUID_PAT | CPUID_MCE | CPUID_MCA;
451         /* KVM never reports CPUID_HT but QEMU can support when vcpus > 1 */
452         ret |= CPUID_HT;
453     } else if (function == 1 && reg == R_ECX) {
454         /* We can set the hypervisor flag, even if KVM does not return it on
455          * GET_SUPPORTED_CPUID
456          */
457         ret |= CPUID_EXT_HYPERVISOR;
458         /* tsc-deadline flag is not returned by GET_SUPPORTED_CPUID, but it
459          * can be enabled if the kernel has KVM_CAP_TSC_DEADLINE_TIMER,
460          * and the irqchip is in the kernel.
461          */
462         if (kvm_irqchip_in_kernel() &&
463                 kvm_check_extension(s, KVM_CAP_TSC_DEADLINE_TIMER)) {
464             ret |= CPUID_EXT_TSC_DEADLINE_TIMER;
465         }
466 
467         /* x2apic is reported by GET_SUPPORTED_CPUID, but it can't be enabled
468          * without the in-kernel irqchip
469          */
470         if (!kvm_irqchip_in_kernel()) {
471             ret &= ~CPUID_EXT_X2APIC;
472         }
473 
474         if (enable_cpu_pm) {
475             int disable_exits = kvm_check_extension(s,
476                                                     KVM_CAP_X86_DISABLE_EXITS);
477 
478             if (disable_exits & KVM_X86_DISABLE_EXITS_MWAIT) {
479                 ret |= CPUID_EXT_MONITOR;
480             }
481         }
482     } else if (function == 6 && reg == R_EAX) {
483         ret |= CPUID_6_EAX_ARAT; /* safe to allow because of emulated APIC */
484     } else if (function == 7 && index == 0 && reg == R_EBX) {
485         /* Not new instructions, just an optimization.  */
486         uint32_t ebx;
487         host_cpuid(7, 0, &unused, &ebx, &unused, &unused);
488         ret |= ebx & CPUID_7_0_EBX_ERMS;
489 
490         if (host_tsx_broken()) {
491             ret &= ~(CPUID_7_0_EBX_RTM | CPUID_7_0_EBX_HLE);
492         }
493     } else if (function == 7 && index == 0 && reg == R_EDX) {
494         /* Not new instructions, just an optimization.  */
495         uint32_t edx;
496         host_cpuid(7, 0, &unused, &unused, &unused, &edx);
497         ret |= edx & CPUID_7_0_EDX_FSRM;
498 
499         /*
500          * Linux v4.17-v4.20 incorrectly return ARCH_CAPABILITIES on SVM hosts.
501          * We can detect the bug by checking if MSR_IA32_ARCH_CAPABILITIES is
502          * returned by KVM_GET_MSR_INDEX_LIST.
503          */
504         if (!has_msr_arch_capabs) {
505             ret &= ~CPUID_7_0_EDX_ARCH_CAPABILITIES;
506         }
507     } else if (function == 7 && index == 1 && reg == R_EAX) {
508         /* Not new instructions, just an optimization.  */
509         uint32_t eax;
510         host_cpuid(7, 1, &eax, &unused, &unused, &unused);
511         ret |= eax & (CPUID_7_1_EAX_FZRM | CPUID_7_1_EAX_FSRS | CPUID_7_1_EAX_FSRC);
512     } else if (function == 7 && index == 2 && reg == R_EDX) {
513         uint32_t edx;
514         host_cpuid(7, 2, &unused, &unused, &unused, &edx);
515         ret |= edx & CPUID_7_2_EDX_MCDT_NO;
516     } else if (function == 0xd && index == 0 &&
517                (reg == R_EAX || reg == R_EDX)) {
518         /*
519          * The value returned by KVM_GET_SUPPORTED_CPUID does not include
520          * features that still have to be enabled with the arch_prctl
521          * system call.  QEMU needs the full value, which is retrieved
522          * with KVM_GET_DEVICE_ATTR.
523          */
524         struct kvm_device_attr attr = {
525             .group = 0,
526             .attr = KVM_X86_XCOMP_GUEST_SUPP,
527             .addr = (unsigned long) &bitmask
528         };
529 
530         bool sys_attr = kvm_check_extension(s, KVM_CAP_SYS_ATTRIBUTES);
531         if (!sys_attr) {
532             return ret;
533         }
534 
535         int rc = kvm_ioctl(s, KVM_GET_DEVICE_ATTR, &attr);
536         if (rc < 0) {
537             if (rc != -ENXIO) {
538                 warn_report("KVM_GET_DEVICE_ATTR(0, KVM_X86_XCOMP_GUEST_SUPP) "
539                             "error: %d", rc);
540             }
541             return ret;
542         }
543         ret = (reg == R_EAX) ? bitmask : bitmask >> 32;
544     } else if (function == 0x80000001 && reg == R_ECX) {
545         /*
546          * It's safe to enable TOPOEXT even if it's not returned by
547          * GET_SUPPORTED_CPUID.  Unconditionally enabling TOPOEXT here allows
548          * us to keep CPU models including TOPOEXT runnable on older kernels.
549          */
550         ret |= CPUID_EXT3_TOPOEXT;
551     } else if (function == 0x80000001 && reg == R_EDX) {
552         /* On Intel, kvm returns cpuid according to the Intel spec,
553          * so add missing bits according to the AMD spec:
554          */
555         cpuid_1_edx = kvm_arch_get_supported_cpuid(s, 1, 0, R_EDX);
556         ret |= cpuid_1_edx & CPUID_EXT2_AMD_ALIASES;
557     } else if (function == 0x80000007 && reg == R_EBX) {
558         ret |= CPUID_8000_0007_EBX_OVERFLOW_RECOV | CPUID_8000_0007_EBX_SUCCOR;
559     } else if (function == KVM_CPUID_FEATURES && reg == R_EAX) {
560         /* kvm_pv_unhalt is reported by GET_SUPPORTED_CPUID, but it can't
561          * be enabled without the in-kernel irqchip
562          */
563         if (!kvm_irqchip_in_kernel()) {
564             ret &= ~CPUID_KVM_PV_UNHALT;
565         }
566         if (kvm_irqchip_is_split()) {
567             ret |= CPUID_KVM_MSI_EXT_DEST_ID;
568         }
569     } else if (function == KVM_CPUID_FEATURES && reg == R_EDX) {
570         ret |= CPUID_KVM_HINTS_REALTIME;
571     }
572 
573     if (current_machine->cgs) {
574         ret = x86_confidential_guest_mask_cpuid_features(
575             X86_CONFIDENTIAL_GUEST(current_machine->cgs),
576             function, index, reg, ret);
577     }
578     return ret;
579 }
580 
581 uint64_t kvm_arch_get_supported_msr_feature(KVMState *s, uint32_t index)
582 {
583     struct {
584         struct kvm_msrs info;
585         struct kvm_msr_entry entries[1];
586     } msr_data = {};
587     uint64_t value;
588     uint32_t ret, can_be_one, must_be_one;
589 
590     if (kvm_feature_msrs == NULL) { /* Host doesn't support feature MSRs */
591         return 0;
592     }
593 
594     /* Check if requested MSR is supported feature MSR */
595     int i;
596     for (i = 0; i < kvm_feature_msrs->nmsrs; i++)
597         if (kvm_feature_msrs->indices[i] == index) {
598             break;
599         }
600     if (i == kvm_feature_msrs->nmsrs) {
601         return 0; /* if the feature MSR is not supported, simply return 0 */
602     }
603 
604     msr_data.info.nmsrs = 1;
605     msr_data.entries[0].index = index;
606 
607     ret = kvm_ioctl(s, KVM_GET_MSRS, &msr_data);
608     if (ret != 1) {
609         error_report("KVM get MSR (index=0x%x) feature failed, %s",
610             index, strerror(-ret));
611         exit(1);
612     }
613 
614     value = msr_data.entries[0].data;
615     switch (index) {
616     case MSR_IA32_VMX_PROCBASED_CTLS2:
617         if (!has_msr_vmx_procbased_ctls2) {
618             /* KVM forgot to add these bits for some time, do this ourselves. */
619             if (kvm_arch_get_supported_cpuid(s, 0xD, 1, R_ECX) &
620                 CPUID_XSAVE_XSAVES) {
621                 value |= (uint64_t)VMX_SECONDARY_EXEC_XSAVES << 32;
622             }
623             if (kvm_arch_get_supported_cpuid(s, 1, 0, R_ECX) &
624                 CPUID_EXT_RDRAND) {
625                 value |= (uint64_t)VMX_SECONDARY_EXEC_RDRAND_EXITING << 32;
626             }
627             if (kvm_arch_get_supported_cpuid(s, 7, 0, R_EBX) &
628                 CPUID_7_0_EBX_INVPCID) {
629                 value |= (uint64_t)VMX_SECONDARY_EXEC_ENABLE_INVPCID << 32;
630             }
631             if (kvm_arch_get_supported_cpuid(s, 7, 0, R_EBX) &
632                 CPUID_7_0_EBX_RDSEED) {
633                 value |= (uint64_t)VMX_SECONDARY_EXEC_RDSEED_EXITING << 32;
634             }
635             if (kvm_arch_get_supported_cpuid(s, 0x80000001, 0, R_EDX) &
636                 CPUID_EXT2_RDTSCP) {
637                 value |= (uint64_t)VMX_SECONDARY_EXEC_RDTSCP << 32;
638             }
639         }
640         /* fall through */
641     case MSR_IA32_VMX_TRUE_PINBASED_CTLS:
642     case MSR_IA32_VMX_TRUE_PROCBASED_CTLS:
643     case MSR_IA32_VMX_TRUE_ENTRY_CTLS:
644     case MSR_IA32_VMX_TRUE_EXIT_CTLS:
645         /*
646          * Return true for bits that can be one, but do not have to be one.
647          * The SDM tells us which bits could have a "must be one" setting,
648          * so we can do the opposite transformation in make_vmx_msr_value.
649          */
650         must_be_one = (uint32_t)value;
651         can_be_one = (uint32_t)(value >> 32);
652         return can_be_one & ~must_be_one;
653 
654     default:
655         return value;
656     }
657 }
658 
659 static int kvm_get_mce_cap_supported(KVMState *s, uint64_t *mce_cap,
660                                      int *max_banks)
661 {
662     *max_banks = kvm_check_extension(s, KVM_CAP_MCE);
663     return kvm_ioctl(s, KVM_X86_GET_MCE_CAP_SUPPORTED, mce_cap);
664 }
665 
666 static void kvm_mce_inject(X86CPU *cpu, hwaddr paddr, int code)
667 {
668     CPUState *cs = CPU(cpu);
669     CPUX86State *env = &cpu->env;
670     uint64_t status = MCI_STATUS_VAL | MCI_STATUS_EN | MCI_STATUS_MISCV |
671                       MCI_STATUS_ADDRV;
672     uint64_t mcg_status = MCG_STATUS_MCIP | MCG_STATUS_RIPV;
673     int flags = 0;
674 
675     if (!IS_AMD_CPU(env)) {
676         status |= MCI_STATUS_S | MCI_STATUS_UC;
677         if (code == BUS_MCEERR_AR) {
678             status |= MCI_STATUS_AR | 0x134;
679             mcg_status |= MCG_STATUS_EIPV;
680         } else {
681             status |= 0xc0;
682         }
683     } else {
684         if (code == BUS_MCEERR_AR) {
685             status |= MCI_STATUS_UC | MCI_STATUS_POISON;
686             mcg_status |= MCG_STATUS_EIPV;
687         } else {
688             /* Setting the POISON bit for deferred errors indicates to the
689              * guest kernel that the address provided by the MCE is valid
690              * and usable which will ensure that the guest kernel will send
691              * a SIGBUS_AO signal to the guest process. This allows for
692              * more desirable behavior in the case that the guest process
693              * with poisoned memory has set the MCE_KILL_EARLY prctl flag
694              * which indicates that the process would prefer to handle or
695              * shutdown due to the poisoned memory condition before the
696              * memory has been accessed.
697              *
698              * While the POISON bit would not be set in a deferred error
699              * sent from hardware, the bit is not meaningful for deferred
700              * errors and can be reused in this scenario.
701              */
702             status |= MCI_STATUS_DEFERRED | MCI_STATUS_POISON;
703         }
704     }
705 
706     flags = cpu_x86_support_mca_broadcast(env) ? MCE_INJECT_BROADCAST : 0;
707     /* We need to read back the value of MSR_EXT_MCG_CTL that was set by the
708      * guest kernel back into env->mcg_ext_ctl.
709      */
710     cpu_synchronize_state(cs);
711     if (env->mcg_ext_ctl & MCG_EXT_CTL_LMCE_EN) {
712         mcg_status |= MCG_STATUS_LMCE;
713         flags = 0;
714     }
715 
716     cpu_x86_inject_mce(NULL, cpu, 9, status, mcg_status, paddr,
717                        (MCM_ADDR_PHYS << 6) | 0xc, flags);
718 }
719 
720 static void emit_hypervisor_memory_failure(MemoryFailureAction action, bool ar)
721 {
722     MemoryFailureFlags mff = {.action_required = ar, .recursive = false};
723 
724     qapi_event_send_memory_failure(MEMORY_FAILURE_RECIPIENT_HYPERVISOR, action,
725                                    &mff);
726 }
727 
728 static void hardware_memory_error(void *host_addr)
729 {
730     emit_hypervisor_memory_failure(MEMORY_FAILURE_ACTION_FATAL, true);
731     error_report("QEMU got Hardware memory error at addr %p", host_addr);
732     exit(1);
733 }
734 
735 void kvm_arch_on_sigbus_vcpu(CPUState *c, int code, void *addr)
736 {
737     X86CPU *cpu = X86_CPU(c);
738     CPUX86State *env = &cpu->env;
739     ram_addr_t ram_addr;
740     hwaddr paddr;
741 
742     /* If we get an action required MCE, it has been injected by KVM
743      * while the VM was running.  An action optional MCE instead should
744      * be coming from the main thread, which qemu_init_sigbus identifies
745      * as the "early kill" thread.
746      */
747     assert(code == BUS_MCEERR_AR || code == BUS_MCEERR_AO);
748 
749     if ((env->mcg_cap & MCG_SER_P) && addr) {
750         ram_addr = qemu_ram_addr_from_host(addr);
751         if (ram_addr != RAM_ADDR_INVALID &&
752             kvm_physical_memory_addr_from_host(c->kvm_state, addr, &paddr)) {
753             kvm_hwpoison_page_add(ram_addr);
754             kvm_mce_inject(cpu, paddr, code);
755 
756             /*
757              * Use different logging severity based on error type.
758              * If there is additional MCE reporting on the hypervisor, QEMU VA
759              * could be another source to identify the PA and MCE details.
760              */
761             if (code == BUS_MCEERR_AR) {
762                 error_report("Guest MCE Memory Error at QEMU addr %p and "
763                     "GUEST addr 0x%" HWADDR_PRIx " of type %s injected",
764                     addr, paddr, "BUS_MCEERR_AR");
765             } else {
766                  warn_report("Guest MCE Memory Error at QEMU addr %p and "
767                      "GUEST addr 0x%" HWADDR_PRIx " of type %s injected",
768                      addr, paddr, "BUS_MCEERR_AO");
769             }
770 
771             return;
772         }
773 
774         if (code == BUS_MCEERR_AO) {
775             warn_report("Hardware memory error at addr %p of type %s "
776                 "for memory used by QEMU itself instead of guest system!",
777                  addr, "BUS_MCEERR_AO");
778         }
779     }
780 
781     if (code == BUS_MCEERR_AR) {
782         hardware_memory_error(addr);
783     }
784 
785     /* Hope we are lucky for AO MCE, just notify a event */
786     emit_hypervisor_memory_failure(MEMORY_FAILURE_ACTION_IGNORE, false);
787 }
788 
789 static void kvm_queue_exception(CPUX86State *env,
790                                 int32_t exception_nr,
791                                 uint8_t exception_has_payload,
792                                 uint64_t exception_payload)
793 {
794     assert(env->exception_nr == -1);
795     assert(!env->exception_pending);
796     assert(!env->exception_injected);
797     assert(!env->exception_has_payload);
798 
799     env->exception_nr = exception_nr;
800 
801     if (has_exception_payload) {
802         env->exception_pending = 1;
803 
804         env->exception_has_payload = exception_has_payload;
805         env->exception_payload = exception_payload;
806     } else {
807         env->exception_injected = 1;
808 
809         if (exception_nr == EXCP01_DB) {
810             assert(exception_has_payload);
811             env->dr[6] = exception_payload;
812         } else if (exception_nr == EXCP0E_PAGE) {
813             assert(exception_has_payload);
814             env->cr[2] = exception_payload;
815         } else {
816             assert(!exception_has_payload);
817         }
818     }
819 }
820 
821 static void cpu_update_state(void *opaque, bool running, RunState state)
822 {
823     CPUX86State *env = opaque;
824 
825     if (running) {
826         env->tsc_valid = false;
827     }
828 }
829 
830 unsigned long kvm_arch_vcpu_id(CPUState *cs)
831 {
832     X86CPU *cpu = X86_CPU(cs);
833     return cpu->apic_id;
834 }
835 
836 #ifndef KVM_CPUID_SIGNATURE_NEXT
837 #define KVM_CPUID_SIGNATURE_NEXT                0x40000100
838 #endif
839 
840 static bool hyperv_enabled(X86CPU *cpu)
841 {
842     return kvm_check_extension(kvm_state, KVM_CAP_HYPERV) > 0 &&
843         ((cpu->hyperv_spinlock_attempts != HYPERV_SPINLOCK_NEVER_NOTIFY) ||
844          cpu->hyperv_features || cpu->hyperv_passthrough);
845 }
846 
847 /*
848  * Check whether target_freq is within conservative
849  * ntp correctable bounds (250ppm) of freq
850  */
851 static inline bool freq_within_bounds(int freq, int target_freq)
852 {
853         int max_freq = freq + (freq * 250 / 1000000);
854         int min_freq = freq - (freq * 250 / 1000000);
855 
856         if (target_freq >= min_freq && target_freq <= max_freq) {
857                 return true;
858         }
859 
860         return false;
861 }
862 
863 static int kvm_arch_set_tsc_khz(CPUState *cs)
864 {
865     X86CPU *cpu = X86_CPU(cs);
866     CPUX86State *env = &cpu->env;
867     int r, cur_freq;
868     bool set_ioctl = false;
869 
870     if (!env->tsc_khz) {
871         return 0;
872     }
873 
874     cur_freq = kvm_check_extension(cs->kvm_state, KVM_CAP_GET_TSC_KHZ) ?
875                kvm_vcpu_ioctl(cs, KVM_GET_TSC_KHZ) : -ENOTSUP;
876 
877     /*
878      * If TSC scaling is supported, attempt to set TSC frequency.
879      */
880     if (kvm_check_extension(cs->kvm_state, KVM_CAP_TSC_CONTROL)) {
881         set_ioctl = true;
882     }
883 
884     /*
885      * If desired TSC frequency is within bounds of NTP correction,
886      * attempt to set TSC frequency.
887      */
888     if (cur_freq != -ENOTSUP && freq_within_bounds(cur_freq, env->tsc_khz)) {
889         set_ioctl = true;
890     }
891 
892     r = set_ioctl ?
893         kvm_vcpu_ioctl(cs, KVM_SET_TSC_KHZ, env->tsc_khz) :
894         -ENOTSUP;
895 
896     if (r < 0) {
897         /* When KVM_SET_TSC_KHZ fails, it's an error only if the current
898          * TSC frequency doesn't match the one we want.
899          */
900         cur_freq = kvm_check_extension(cs->kvm_state, KVM_CAP_GET_TSC_KHZ) ?
901                    kvm_vcpu_ioctl(cs, KVM_GET_TSC_KHZ) :
902                    -ENOTSUP;
903         if (cur_freq <= 0 || cur_freq != env->tsc_khz) {
904             warn_report("TSC frequency mismatch between "
905                         "VM (%" PRId64 " kHz) and host (%d kHz), "
906                         "and TSC scaling unavailable",
907                         env->tsc_khz, cur_freq);
908             return r;
909         }
910     }
911 
912     return 0;
913 }
914 
915 static bool tsc_is_stable_and_known(CPUX86State *env)
916 {
917     if (!env->tsc_khz) {
918         return false;
919     }
920     return (env->features[FEAT_8000_0007_EDX] & CPUID_APM_INVTSC)
921         || env->user_tsc_khz;
922 }
923 
924 #define DEFAULT_EVMCS_VERSION ((1 << 8) | 1)
925 
926 static struct {
927     const char *desc;
928     struct {
929         uint32_t func;
930         int reg;
931         uint32_t bits;
932     } flags[2];
933     uint64_t dependencies;
934     bool skip_passthrough;
935 } kvm_hyperv_properties[] = {
936     [HYPERV_FEAT_RELAXED] = {
937         .desc = "relaxed timing (hv-relaxed)",
938         .flags = {
939             {.func = HV_CPUID_ENLIGHTMENT_INFO, .reg = R_EAX,
940              .bits = HV_RELAXED_TIMING_RECOMMENDED}
941         }
942     },
943     [HYPERV_FEAT_VAPIC] = {
944         .desc = "virtual APIC (hv-vapic)",
945         .flags = {
946             {.func = HV_CPUID_FEATURES, .reg = R_EAX,
947              .bits = HV_APIC_ACCESS_AVAILABLE}
948         }
949     },
950     [HYPERV_FEAT_TIME] = {
951         .desc = "clocksources (hv-time)",
952         .flags = {
953             {.func = HV_CPUID_FEATURES, .reg = R_EAX,
954              .bits = HV_TIME_REF_COUNT_AVAILABLE | HV_REFERENCE_TSC_AVAILABLE}
955         }
956     },
957     [HYPERV_FEAT_CRASH] = {
958         .desc = "crash MSRs (hv-crash)",
959         .flags = {
960             {.func = HV_CPUID_FEATURES, .reg = R_EDX,
961              .bits = HV_GUEST_CRASH_MSR_AVAILABLE}
962         }
963     },
964     [HYPERV_FEAT_RESET] = {
965         .desc = "reset MSR (hv-reset)",
966         .flags = {
967             {.func = HV_CPUID_FEATURES, .reg = R_EAX,
968              .bits = HV_RESET_AVAILABLE}
969         }
970     },
971     [HYPERV_FEAT_VPINDEX] = {
972         .desc = "VP_INDEX MSR (hv-vpindex)",
973         .flags = {
974             {.func = HV_CPUID_FEATURES, .reg = R_EAX,
975              .bits = HV_VP_INDEX_AVAILABLE}
976         }
977     },
978     [HYPERV_FEAT_RUNTIME] = {
979         .desc = "VP_RUNTIME MSR (hv-runtime)",
980         .flags = {
981             {.func = HV_CPUID_FEATURES, .reg = R_EAX,
982              .bits = HV_VP_RUNTIME_AVAILABLE}
983         }
984     },
985     [HYPERV_FEAT_SYNIC] = {
986         .desc = "synthetic interrupt controller (hv-synic)",
987         .flags = {
988             {.func = HV_CPUID_FEATURES, .reg = R_EAX,
989              .bits = HV_SYNIC_AVAILABLE}
990         }
991     },
992     [HYPERV_FEAT_STIMER] = {
993         .desc = "synthetic timers (hv-stimer)",
994         .flags = {
995             {.func = HV_CPUID_FEATURES, .reg = R_EAX,
996              .bits = HV_SYNTIMERS_AVAILABLE}
997         },
998         .dependencies = BIT(HYPERV_FEAT_SYNIC) | BIT(HYPERV_FEAT_TIME)
999     },
1000     [HYPERV_FEAT_FREQUENCIES] = {
1001         .desc = "frequency MSRs (hv-frequencies)",
1002         .flags = {
1003             {.func = HV_CPUID_FEATURES, .reg = R_EAX,
1004              .bits = HV_ACCESS_FREQUENCY_MSRS},
1005             {.func = HV_CPUID_FEATURES, .reg = R_EDX,
1006              .bits = HV_FREQUENCY_MSRS_AVAILABLE}
1007         }
1008     },
1009     [HYPERV_FEAT_REENLIGHTENMENT] = {
1010         .desc = "reenlightenment MSRs (hv-reenlightenment)",
1011         .flags = {
1012             {.func = HV_CPUID_FEATURES, .reg = R_EAX,
1013              .bits = HV_ACCESS_REENLIGHTENMENTS_CONTROL}
1014         }
1015     },
1016     [HYPERV_FEAT_TLBFLUSH] = {
1017         .desc = "paravirtualized TLB flush (hv-tlbflush)",
1018         .flags = {
1019             {.func = HV_CPUID_ENLIGHTMENT_INFO, .reg = R_EAX,
1020              .bits = HV_REMOTE_TLB_FLUSH_RECOMMENDED |
1021              HV_EX_PROCESSOR_MASKS_RECOMMENDED}
1022         },
1023         .dependencies = BIT(HYPERV_FEAT_VPINDEX)
1024     },
1025     [HYPERV_FEAT_EVMCS] = {
1026         .desc = "enlightened VMCS (hv-evmcs)",
1027         .flags = {
1028             {.func = HV_CPUID_ENLIGHTMENT_INFO, .reg = R_EAX,
1029              .bits = HV_ENLIGHTENED_VMCS_RECOMMENDED}
1030         },
1031         .dependencies = BIT(HYPERV_FEAT_VAPIC)
1032     },
1033     [HYPERV_FEAT_IPI] = {
1034         .desc = "paravirtualized IPI (hv-ipi)",
1035         .flags = {
1036             {.func = HV_CPUID_ENLIGHTMENT_INFO, .reg = R_EAX,
1037              .bits = HV_CLUSTER_IPI_RECOMMENDED |
1038              HV_EX_PROCESSOR_MASKS_RECOMMENDED}
1039         },
1040         .dependencies = BIT(HYPERV_FEAT_VPINDEX)
1041     },
1042     [HYPERV_FEAT_STIMER_DIRECT] = {
1043         .desc = "direct mode synthetic timers (hv-stimer-direct)",
1044         .flags = {
1045             {.func = HV_CPUID_FEATURES, .reg = R_EDX,
1046              .bits = HV_STIMER_DIRECT_MODE_AVAILABLE}
1047         },
1048         .dependencies = BIT(HYPERV_FEAT_STIMER)
1049     },
1050     [HYPERV_FEAT_AVIC] = {
1051         .desc = "AVIC/APICv support (hv-avic/hv-apicv)",
1052         .flags = {
1053             {.func = HV_CPUID_ENLIGHTMENT_INFO, .reg = R_EAX,
1054              .bits = HV_DEPRECATING_AEOI_RECOMMENDED}
1055         }
1056     },
1057     [HYPERV_FEAT_SYNDBG] = {
1058         .desc = "Enable synthetic kernel debugger channel (hv-syndbg)",
1059         .flags = {
1060             {.func = HV_CPUID_FEATURES, .reg = R_EDX,
1061              .bits = HV_FEATURE_DEBUG_MSRS_AVAILABLE}
1062         },
1063         .dependencies = BIT(HYPERV_FEAT_SYNIC) | BIT(HYPERV_FEAT_RELAXED),
1064         .skip_passthrough = true,
1065     },
1066     [HYPERV_FEAT_MSR_BITMAP] = {
1067         .desc = "enlightened MSR-Bitmap (hv-emsr-bitmap)",
1068         .flags = {
1069             {.func = HV_CPUID_NESTED_FEATURES, .reg = R_EAX,
1070              .bits = HV_NESTED_MSR_BITMAP}
1071         }
1072     },
1073     [HYPERV_FEAT_XMM_INPUT] = {
1074         .desc = "XMM fast hypercall input (hv-xmm-input)",
1075         .flags = {
1076             {.func = HV_CPUID_FEATURES, .reg = R_EDX,
1077              .bits = HV_HYPERCALL_XMM_INPUT_AVAILABLE}
1078         }
1079     },
1080     [HYPERV_FEAT_TLBFLUSH_EXT] = {
1081         .desc = "Extended gva ranges for TLB flush hypercalls (hv-tlbflush-ext)",
1082         .flags = {
1083             {.func = HV_CPUID_FEATURES, .reg = R_EDX,
1084              .bits = HV_EXT_GVA_RANGES_FLUSH_AVAILABLE}
1085         },
1086         .dependencies = BIT(HYPERV_FEAT_TLBFLUSH)
1087     },
1088     [HYPERV_FEAT_TLBFLUSH_DIRECT] = {
1089         .desc = "direct TLB flush (hv-tlbflush-direct)",
1090         .flags = {
1091             {.func = HV_CPUID_NESTED_FEATURES, .reg = R_EAX,
1092              .bits = HV_NESTED_DIRECT_FLUSH}
1093         },
1094         .dependencies = BIT(HYPERV_FEAT_VAPIC)
1095     },
1096 };
1097 
1098 static struct kvm_cpuid2 *try_get_hv_cpuid(CPUState *cs, int max,
1099                                            bool do_sys_ioctl)
1100 {
1101     struct kvm_cpuid2 *cpuid;
1102     int r, size;
1103 
1104     size = sizeof(*cpuid) + max * sizeof(*cpuid->entries);
1105     cpuid = g_malloc0(size);
1106     cpuid->nent = max;
1107 
1108     if (do_sys_ioctl) {
1109         r = kvm_ioctl(kvm_state, KVM_GET_SUPPORTED_HV_CPUID, cpuid);
1110     } else {
1111         r = kvm_vcpu_ioctl(cs, KVM_GET_SUPPORTED_HV_CPUID, cpuid);
1112     }
1113     if (r == 0 && cpuid->nent >= max) {
1114         r = -E2BIG;
1115     }
1116     if (r < 0) {
1117         if (r == -E2BIG) {
1118             g_free(cpuid);
1119             return NULL;
1120         } else {
1121             fprintf(stderr, "KVM_GET_SUPPORTED_HV_CPUID failed: %s\n",
1122                     strerror(-r));
1123             exit(1);
1124         }
1125     }
1126     return cpuid;
1127 }
1128 
1129 /*
1130  * Run KVM_GET_SUPPORTED_HV_CPUID ioctl(), allocating a buffer large enough
1131  * for all entries.
1132  */
1133 static struct kvm_cpuid2 *get_supported_hv_cpuid(CPUState *cs)
1134 {
1135     struct kvm_cpuid2 *cpuid;
1136     /* 0x40000000..0x40000005, 0x4000000A, 0x40000080..0x40000082 leaves */
1137     int max = 11;
1138     int i;
1139     bool do_sys_ioctl;
1140 
1141     do_sys_ioctl =
1142         kvm_check_extension(kvm_state, KVM_CAP_SYS_HYPERV_CPUID) > 0;
1143 
1144     /*
1145      * Non-empty KVM context is needed when KVM_CAP_SYS_HYPERV_CPUID is
1146      * unsupported, kvm_hyperv_expand_features() checks for that.
1147      */
1148     assert(do_sys_ioctl || cs->kvm_state);
1149 
1150     /*
1151      * When the buffer is too small, KVM_GET_SUPPORTED_HV_CPUID fails with
1152      * -E2BIG, however, it doesn't report back the right size. Keep increasing
1153      * it and re-trying until we succeed.
1154      */
1155     while ((cpuid = try_get_hv_cpuid(cs, max, do_sys_ioctl)) == NULL) {
1156         max++;
1157     }
1158 
1159     /*
1160      * KVM_GET_SUPPORTED_HV_CPUID does not set EVMCS CPUID bit before
1161      * KVM_CAP_HYPERV_ENLIGHTENED_VMCS is enabled but we want to get the
1162      * information early, just check for the capability and set the bit
1163      * manually.
1164      */
1165     if (!do_sys_ioctl && kvm_check_extension(cs->kvm_state,
1166                             KVM_CAP_HYPERV_ENLIGHTENED_VMCS) > 0) {
1167         for (i = 0; i < cpuid->nent; i++) {
1168             if (cpuid->entries[i].function == HV_CPUID_ENLIGHTMENT_INFO) {
1169                 cpuid->entries[i].eax |= HV_ENLIGHTENED_VMCS_RECOMMENDED;
1170             }
1171         }
1172     }
1173 
1174     return cpuid;
1175 }
1176 
1177 /*
1178  * When KVM_GET_SUPPORTED_HV_CPUID is not supported we fill CPUID feature
1179  * leaves from KVM_CAP_HYPERV* and present MSRs data.
1180  */
1181 static struct kvm_cpuid2 *get_supported_hv_cpuid_legacy(CPUState *cs)
1182 {
1183     X86CPU *cpu = X86_CPU(cs);
1184     struct kvm_cpuid2 *cpuid;
1185     struct kvm_cpuid_entry2 *entry_feat, *entry_recomm;
1186 
1187     /* HV_CPUID_FEATURES, HV_CPUID_ENLIGHTMENT_INFO */
1188     cpuid = g_malloc0(sizeof(*cpuid) + 2 * sizeof(*cpuid->entries));
1189     cpuid->nent = 2;
1190 
1191     /* HV_CPUID_VENDOR_AND_MAX_FUNCTIONS */
1192     entry_feat = &cpuid->entries[0];
1193     entry_feat->function = HV_CPUID_FEATURES;
1194 
1195     entry_recomm = &cpuid->entries[1];
1196     entry_recomm->function = HV_CPUID_ENLIGHTMENT_INFO;
1197     entry_recomm->ebx = cpu->hyperv_spinlock_attempts;
1198 
1199     if (kvm_check_extension(cs->kvm_state, KVM_CAP_HYPERV) > 0) {
1200         entry_feat->eax |= HV_HYPERCALL_AVAILABLE;
1201         entry_feat->eax |= HV_APIC_ACCESS_AVAILABLE;
1202         entry_feat->edx |= HV_CPU_DYNAMIC_PARTITIONING_AVAILABLE;
1203         entry_recomm->eax |= HV_RELAXED_TIMING_RECOMMENDED;
1204         entry_recomm->eax |= HV_APIC_ACCESS_RECOMMENDED;
1205     }
1206 
1207     if (kvm_check_extension(cs->kvm_state, KVM_CAP_HYPERV_TIME) > 0) {
1208         entry_feat->eax |= HV_TIME_REF_COUNT_AVAILABLE;
1209         entry_feat->eax |= HV_REFERENCE_TSC_AVAILABLE;
1210     }
1211 
1212     if (has_msr_hv_frequencies) {
1213         entry_feat->eax |= HV_ACCESS_FREQUENCY_MSRS;
1214         entry_feat->edx |= HV_FREQUENCY_MSRS_AVAILABLE;
1215     }
1216 
1217     if (has_msr_hv_crash) {
1218         entry_feat->edx |= HV_GUEST_CRASH_MSR_AVAILABLE;
1219     }
1220 
1221     if (has_msr_hv_reenlightenment) {
1222         entry_feat->eax |= HV_ACCESS_REENLIGHTENMENTS_CONTROL;
1223     }
1224 
1225     if (has_msr_hv_reset) {
1226         entry_feat->eax |= HV_RESET_AVAILABLE;
1227     }
1228 
1229     if (has_msr_hv_vpindex) {
1230         entry_feat->eax |= HV_VP_INDEX_AVAILABLE;
1231     }
1232 
1233     if (has_msr_hv_runtime) {
1234         entry_feat->eax |= HV_VP_RUNTIME_AVAILABLE;
1235     }
1236 
1237     if (has_msr_hv_synic) {
1238         unsigned int cap = cpu->hyperv_synic_kvm_only ?
1239             KVM_CAP_HYPERV_SYNIC : KVM_CAP_HYPERV_SYNIC2;
1240 
1241         if (kvm_check_extension(cs->kvm_state, cap) > 0) {
1242             entry_feat->eax |= HV_SYNIC_AVAILABLE;
1243         }
1244     }
1245 
1246     if (has_msr_hv_stimer) {
1247         entry_feat->eax |= HV_SYNTIMERS_AVAILABLE;
1248     }
1249 
1250     if (has_msr_hv_syndbg_options) {
1251         entry_feat->edx |= HV_GUEST_DEBUGGING_AVAILABLE;
1252         entry_feat->edx |= HV_FEATURE_DEBUG_MSRS_AVAILABLE;
1253         entry_feat->ebx |= HV_PARTITION_DEBUGGING_ALLOWED;
1254     }
1255 
1256     if (kvm_check_extension(cs->kvm_state,
1257                             KVM_CAP_HYPERV_TLBFLUSH) > 0) {
1258         entry_recomm->eax |= HV_REMOTE_TLB_FLUSH_RECOMMENDED;
1259         entry_recomm->eax |= HV_EX_PROCESSOR_MASKS_RECOMMENDED;
1260     }
1261 
1262     if (kvm_check_extension(cs->kvm_state,
1263                             KVM_CAP_HYPERV_ENLIGHTENED_VMCS) > 0) {
1264         entry_recomm->eax |= HV_ENLIGHTENED_VMCS_RECOMMENDED;
1265     }
1266 
1267     if (kvm_check_extension(cs->kvm_state,
1268                             KVM_CAP_HYPERV_SEND_IPI) > 0) {
1269         entry_recomm->eax |= HV_CLUSTER_IPI_RECOMMENDED;
1270         entry_recomm->eax |= HV_EX_PROCESSOR_MASKS_RECOMMENDED;
1271     }
1272 
1273     return cpuid;
1274 }
1275 
1276 static uint32_t hv_cpuid_get_host(CPUState *cs, uint32_t func, int reg)
1277 {
1278     struct kvm_cpuid_entry2 *entry;
1279     struct kvm_cpuid2 *cpuid;
1280 
1281     if (hv_cpuid_cache) {
1282         cpuid = hv_cpuid_cache;
1283     } else {
1284         if (kvm_check_extension(kvm_state, KVM_CAP_HYPERV_CPUID) > 0) {
1285             cpuid = get_supported_hv_cpuid(cs);
1286         } else {
1287             /*
1288              * 'cs->kvm_state' may be NULL when Hyper-V features are expanded
1289              * before KVM context is created but this is only done when
1290              * KVM_CAP_SYS_HYPERV_CPUID is supported and it implies
1291              * KVM_CAP_HYPERV_CPUID.
1292              */
1293             assert(cs->kvm_state);
1294 
1295             cpuid = get_supported_hv_cpuid_legacy(cs);
1296         }
1297         hv_cpuid_cache = cpuid;
1298     }
1299 
1300     if (!cpuid) {
1301         return 0;
1302     }
1303 
1304     entry = cpuid_find_entry(cpuid, func, 0);
1305     if (!entry) {
1306         return 0;
1307     }
1308 
1309     return cpuid_entry_get_reg(entry, reg);
1310 }
1311 
1312 static bool hyperv_feature_supported(CPUState *cs, int feature)
1313 {
1314     uint32_t func, bits;
1315     int i, reg;
1316 
1317     /*
1318      * kvm_hyperv_properties needs to define at least one CPUID flag which
1319      * must be used to detect the feature, it's hard to say whether it is
1320      * supported or not otherwise.
1321      */
1322     assert(kvm_hyperv_properties[feature].flags[0].func);
1323 
1324     for (i = 0; i < ARRAY_SIZE(kvm_hyperv_properties[feature].flags); i++) {
1325 
1326         func = kvm_hyperv_properties[feature].flags[i].func;
1327         reg = kvm_hyperv_properties[feature].flags[i].reg;
1328         bits = kvm_hyperv_properties[feature].flags[i].bits;
1329 
1330         if (!func) {
1331             continue;
1332         }
1333 
1334         if ((hv_cpuid_get_host(cs, func, reg) & bits) != bits) {
1335             return false;
1336         }
1337     }
1338 
1339     return true;
1340 }
1341 
1342 /* Checks that all feature dependencies are enabled */
1343 static bool hv_feature_check_deps(X86CPU *cpu, int feature, Error **errp)
1344 {
1345     uint64_t deps;
1346     int dep_feat;
1347 
1348     deps = kvm_hyperv_properties[feature].dependencies;
1349     while (deps) {
1350         dep_feat = ctz64(deps);
1351         if (!(hyperv_feat_enabled(cpu, dep_feat))) {
1352             error_setg(errp, "Hyper-V %s requires Hyper-V %s",
1353                        kvm_hyperv_properties[feature].desc,
1354                        kvm_hyperv_properties[dep_feat].desc);
1355             return false;
1356         }
1357         deps &= ~(1ull << dep_feat);
1358     }
1359 
1360     return true;
1361 }
1362 
1363 static uint32_t hv_build_cpuid_leaf(CPUState *cs, uint32_t func, int reg)
1364 {
1365     X86CPU *cpu = X86_CPU(cs);
1366     uint32_t r = 0;
1367     int i, j;
1368 
1369     for (i = 0; i < ARRAY_SIZE(kvm_hyperv_properties); i++) {
1370         if (!hyperv_feat_enabled(cpu, i)) {
1371             continue;
1372         }
1373 
1374         for (j = 0; j < ARRAY_SIZE(kvm_hyperv_properties[i].flags); j++) {
1375             if (kvm_hyperv_properties[i].flags[j].func != func) {
1376                 continue;
1377             }
1378             if (kvm_hyperv_properties[i].flags[j].reg != reg) {
1379                 continue;
1380             }
1381 
1382             r |= kvm_hyperv_properties[i].flags[j].bits;
1383         }
1384     }
1385 
1386     /* HV_CPUID_NESTED_FEATURES.EAX also encodes the supported eVMCS range */
1387     if (func == HV_CPUID_NESTED_FEATURES && reg == R_EAX) {
1388         if (hyperv_feat_enabled(cpu, HYPERV_FEAT_EVMCS)) {
1389             r |= DEFAULT_EVMCS_VERSION;
1390         }
1391     }
1392 
1393     return r;
1394 }
1395 
1396 /*
1397  * Expand Hyper-V CPU features. In partucular, check that all the requested
1398  * features are supported by the host and the sanity of the configuration
1399  * (that all the required dependencies are included). Also, this takes care
1400  * of 'hv_passthrough' mode and fills the environment with all supported
1401  * Hyper-V features.
1402  */
1403 bool kvm_hyperv_expand_features(X86CPU *cpu, Error **errp)
1404 {
1405     CPUState *cs = CPU(cpu);
1406     Error *local_err = NULL;
1407     int feat;
1408 
1409     if (!hyperv_enabled(cpu))
1410         return true;
1411 
1412     /*
1413      * When kvm_hyperv_expand_features is called at CPU feature expansion
1414      * time per-CPU kvm_state is not available yet so we can only proceed
1415      * when KVM_CAP_SYS_HYPERV_CPUID is supported.
1416      */
1417     if (!cs->kvm_state &&
1418         !kvm_check_extension(kvm_state, KVM_CAP_SYS_HYPERV_CPUID))
1419         return true;
1420 
1421     if (cpu->hyperv_passthrough) {
1422         cpu->hyperv_vendor_id[0] =
1423             hv_cpuid_get_host(cs, HV_CPUID_VENDOR_AND_MAX_FUNCTIONS, R_EBX);
1424         cpu->hyperv_vendor_id[1] =
1425             hv_cpuid_get_host(cs, HV_CPUID_VENDOR_AND_MAX_FUNCTIONS, R_ECX);
1426         cpu->hyperv_vendor_id[2] =
1427             hv_cpuid_get_host(cs, HV_CPUID_VENDOR_AND_MAX_FUNCTIONS, R_EDX);
1428         cpu->hyperv_vendor = g_realloc(cpu->hyperv_vendor,
1429                                        sizeof(cpu->hyperv_vendor_id) + 1);
1430         memcpy(cpu->hyperv_vendor, cpu->hyperv_vendor_id,
1431                sizeof(cpu->hyperv_vendor_id));
1432         cpu->hyperv_vendor[sizeof(cpu->hyperv_vendor_id)] = 0;
1433 
1434         cpu->hyperv_interface_id[0] =
1435             hv_cpuid_get_host(cs, HV_CPUID_INTERFACE, R_EAX);
1436         cpu->hyperv_interface_id[1] =
1437             hv_cpuid_get_host(cs, HV_CPUID_INTERFACE, R_EBX);
1438         cpu->hyperv_interface_id[2] =
1439             hv_cpuid_get_host(cs, HV_CPUID_INTERFACE, R_ECX);
1440         cpu->hyperv_interface_id[3] =
1441             hv_cpuid_get_host(cs, HV_CPUID_INTERFACE, R_EDX);
1442 
1443         cpu->hyperv_ver_id_build =
1444             hv_cpuid_get_host(cs, HV_CPUID_VERSION, R_EAX);
1445         cpu->hyperv_ver_id_major =
1446             hv_cpuid_get_host(cs, HV_CPUID_VERSION, R_EBX) >> 16;
1447         cpu->hyperv_ver_id_minor =
1448             hv_cpuid_get_host(cs, HV_CPUID_VERSION, R_EBX) & 0xffff;
1449         cpu->hyperv_ver_id_sp =
1450             hv_cpuid_get_host(cs, HV_CPUID_VERSION, R_ECX);
1451         cpu->hyperv_ver_id_sb =
1452             hv_cpuid_get_host(cs, HV_CPUID_VERSION, R_EDX) >> 24;
1453         cpu->hyperv_ver_id_sn =
1454             hv_cpuid_get_host(cs, HV_CPUID_VERSION, R_EDX) & 0xffffff;
1455 
1456         cpu->hv_max_vps = hv_cpuid_get_host(cs, HV_CPUID_IMPLEMENT_LIMITS,
1457                                             R_EAX);
1458         cpu->hyperv_limits[0] =
1459             hv_cpuid_get_host(cs, HV_CPUID_IMPLEMENT_LIMITS, R_EBX);
1460         cpu->hyperv_limits[1] =
1461             hv_cpuid_get_host(cs, HV_CPUID_IMPLEMENT_LIMITS, R_ECX);
1462         cpu->hyperv_limits[2] =
1463             hv_cpuid_get_host(cs, HV_CPUID_IMPLEMENT_LIMITS, R_EDX);
1464 
1465         cpu->hyperv_spinlock_attempts =
1466             hv_cpuid_get_host(cs, HV_CPUID_ENLIGHTMENT_INFO, R_EBX);
1467 
1468         /*
1469          * Mark feature as enabled in 'cpu->hyperv_features' as
1470          * hv_build_cpuid_leaf() uses this info to build guest CPUIDs.
1471          */
1472         for (feat = 0; feat < ARRAY_SIZE(kvm_hyperv_properties); feat++) {
1473             if (hyperv_feature_supported(cs, feat) &&
1474                 !kvm_hyperv_properties[feat].skip_passthrough) {
1475                 cpu->hyperv_features |= BIT(feat);
1476             }
1477         }
1478     } else {
1479         /* Check features availability and dependencies */
1480         for (feat = 0; feat < ARRAY_SIZE(kvm_hyperv_properties); feat++) {
1481             /* If the feature was not requested skip it. */
1482             if (!hyperv_feat_enabled(cpu, feat)) {
1483                 continue;
1484             }
1485 
1486             /* Check if the feature is supported by KVM */
1487             if (!hyperv_feature_supported(cs, feat)) {
1488                 error_setg(errp, "Hyper-V %s is not supported by kernel",
1489                            kvm_hyperv_properties[feat].desc);
1490                 return false;
1491             }
1492 
1493             /* Check dependencies */
1494             if (!hv_feature_check_deps(cpu, feat, &local_err)) {
1495                 error_propagate(errp, local_err);
1496                 return false;
1497             }
1498         }
1499     }
1500 
1501     /* Additional dependencies not covered by kvm_hyperv_properties[] */
1502     if (hyperv_feat_enabled(cpu, HYPERV_FEAT_SYNIC) &&
1503         !cpu->hyperv_synic_kvm_only &&
1504         !hyperv_feat_enabled(cpu, HYPERV_FEAT_VPINDEX)) {
1505         error_setg(errp, "Hyper-V %s requires Hyper-V %s",
1506                    kvm_hyperv_properties[HYPERV_FEAT_SYNIC].desc,
1507                    kvm_hyperv_properties[HYPERV_FEAT_VPINDEX].desc);
1508         return false;
1509     }
1510 
1511     return true;
1512 }
1513 
1514 /*
1515  * Fill in Hyper-V CPUIDs. Returns the number of entries filled in cpuid_ent.
1516  */
1517 static int hyperv_fill_cpuids(CPUState *cs,
1518                               struct kvm_cpuid_entry2 *cpuid_ent)
1519 {
1520     X86CPU *cpu = X86_CPU(cs);
1521     struct kvm_cpuid_entry2 *c;
1522     uint32_t signature[3];
1523     uint32_t cpuid_i = 0, max_cpuid_leaf = 0;
1524     uint32_t nested_eax =
1525         hv_build_cpuid_leaf(cs, HV_CPUID_NESTED_FEATURES, R_EAX);
1526 
1527     max_cpuid_leaf = nested_eax ? HV_CPUID_NESTED_FEATURES :
1528         HV_CPUID_IMPLEMENT_LIMITS;
1529 
1530     if (hyperv_feat_enabled(cpu, HYPERV_FEAT_SYNDBG)) {
1531         max_cpuid_leaf =
1532             MAX(max_cpuid_leaf, HV_CPUID_SYNDBG_PLATFORM_CAPABILITIES);
1533     }
1534 
1535     c = &cpuid_ent[cpuid_i++];
1536     c->function = HV_CPUID_VENDOR_AND_MAX_FUNCTIONS;
1537     c->eax = max_cpuid_leaf;
1538     c->ebx = cpu->hyperv_vendor_id[0];
1539     c->ecx = cpu->hyperv_vendor_id[1];
1540     c->edx = cpu->hyperv_vendor_id[2];
1541 
1542     c = &cpuid_ent[cpuid_i++];
1543     c->function = HV_CPUID_INTERFACE;
1544     c->eax = cpu->hyperv_interface_id[0];
1545     c->ebx = cpu->hyperv_interface_id[1];
1546     c->ecx = cpu->hyperv_interface_id[2];
1547     c->edx = cpu->hyperv_interface_id[3];
1548 
1549     c = &cpuid_ent[cpuid_i++];
1550     c->function = HV_CPUID_VERSION;
1551     c->eax = cpu->hyperv_ver_id_build;
1552     c->ebx = (uint32_t)cpu->hyperv_ver_id_major << 16 |
1553         cpu->hyperv_ver_id_minor;
1554     c->ecx = cpu->hyperv_ver_id_sp;
1555     c->edx = (uint32_t)cpu->hyperv_ver_id_sb << 24 |
1556         (cpu->hyperv_ver_id_sn & 0xffffff);
1557 
1558     c = &cpuid_ent[cpuid_i++];
1559     c->function = HV_CPUID_FEATURES;
1560     c->eax = hv_build_cpuid_leaf(cs, HV_CPUID_FEATURES, R_EAX);
1561     c->ebx = hv_build_cpuid_leaf(cs, HV_CPUID_FEATURES, R_EBX);
1562     c->edx = hv_build_cpuid_leaf(cs, HV_CPUID_FEATURES, R_EDX);
1563 
1564     /* Unconditionally required with any Hyper-V enlightenment */
1565     c->eax |= HV_HYPERCALL_AVAILABLE;
1566 
1567     /* SynIC and Vmbus devices require messages/signals hypercalls */
1568     if (hyperv_feat_enabled(cpu, HYPERV_FEAT_SYNIC) &&
1569         !cpu->hyperv_synic_kvm_only) {
1570         c->ebx |= HV_POST_MESSAGES | HV_SIGNAL_EVENTS;
1571     }
1572 
1573 
1574     /* Not exposed by KVM but needed to make CPU hotplug in Windows work */
1575     c->edx |= HV_CPU_DYNAMIC_PARTITIONING_AVAILABLE;
1576 
1577     c = &cpuid_ent[cpuid_i++];
1578     c->function = HV_CPUID_ENLIGHTMENT_INFO;
1579     c->eax = hv_build_cpuid_leaf(cs, HV_CPUID_ENLIGHTMENT_INFO, R_EAX);
1580     c->ebx = cpu->hyperv_spinlock_attempts;
1581 
1582     if (hyperv_feat_enabled(cpu, HYPERV_FEAT_VAPIC) &&
1583         !hyperv_feat_enabled(cpu, HYPERV_FEAT_AVIC)) {
1584         c->eax |= HV_APIC_ACCESS_RECOMMENDED;
1585     }
1586 
1587     if (cpu->hyperv_no_nonarch_cs == ON_OFF_AUTO_ON) {
1588         c->eax |= HV_NO_NONARCH_CORESHARING;
1589     } else if (cpu->hyperv_no_nonarch_cs == ON_OFF_AUTO_AUTO) {
1590         c->eax |= hv_cpuid_get_host(cs, HV_CPUID_ENLIGHTMENT_INFO, R_EAX) &
1591             HV_NO_NONARCH_CORESHARING;
1592     }
1593 
1594     c = &cpuid_ent[cpuid_i++];
1595     c->function = HV_CPUID_IMPLEMENT_LIMITS;
1596     c->eax = cpu->hv_max_vps;
1597     c->ebx = cpu->hyperv_limits[0];
1598     c->ecx = cpu->hyperv_limits[1];
1599     c->edx = cpu->hyperv_limits[2];
1600 
1601     if (nested_eax) {
1602         uint32_t function;
1603 
1604         /* Create zeroed 0x40000006..0x40000009 leaves */
1605         for (function = HV_CPUID_IMPLEMENT_LIMITS + 1;
1606              function < HV_CPUID_NESTED_FEATURES; function++) {
1607             c = &cpuid_ent[cpuid_i++];
1608             c->function = function;
1609         }
1610 
1611         c = &cpuid_ent[cpuid_i++];
1612         c->function = HV_CPUID_NESTED_FEATURES;
1613         c->eax = nested_eax;
1614     }
1615 
1616     if (hyperv_feat_enabled(cpu, HYPERV_FEAT_SYNDBG)) {
1617         c = &cpuid_ent[cpuid_i++];
1618         c->function = HV_CPUID_SYNDBG_VENDOR_AND_MAX_FUNCTIONS;
1619         c->eax = hyperv_feat_enabled(cpu, HYPERV_FEAT_EVMCS) ?
1620             HV_CPUID_NESTED_FEATURES : HV_CPUID_IMPLEMENT_LIMITS;
1621         memcpy(signature, "Microsoft VS", 12);
1622         c->eax = 0;
1623         c->ebx = signature[0];
1624         c->ecx = signature[1];
1625         c->edx = signature[2];
1626 
1627         c = &cpuid_ent[cpuid_i++];
1628         c->function = HV_CPUID_SYNDBG_INTERFACE;
1629         memcpy(signature, "VS#1\0\0\0\0\0\0\0\0", 12);
1630         c->eax = signature[0];
1631         c->ebx = 0;
1632         c->ecx = 0;
1633         c->edx = 0;
1634 
1635         c = &cpuid_ent[cpuid_i++];
1636         c->function = HV_CPUID_SYNDBG_PLATFORM_CAPABILITIES;
1637         c->eax = HV_SYNDBG_CAP_ALLOW_KERNEL_DEBUGGING;
1638         c->ebx = 0;
1639         c->ecx = 0;
1640         c->edx = 0;
1641     }
1642 
1643     return cpuid_i;
1644 }
1645 
1646 static Error *hv_passthrough_mig_blocker;
1647 static Error *hv_no_nonarch_cs_mig_blocker;
1648 
1649 /* Checks that the exposed eVMCS version range is supported by KVM */
1650 static bool evmcs_version_supported(uint16_t evmcs_version,
1651                                     uint16_t supported_evmcs_version)
1652 {
1653     uint8_t min_version = evmcs_version & 0xff;
1654     uint8_t max_version = evmcs_version >> 8;
1655     uint8_t min_supported_version = supported_evmcs_version & 0xff;
1656     uint8_t max_supported_version = supported_evmcs_version >> 8;
1657 
1658     return (min_version >= min_supported_version) &&
1659         (max_version <= max_supported_version);
1660 }
1661 
1662 static int hyperv_init_vcpu(X86CPU *cpu)
1663 {
1664     CPUState *cs = CPU(cpu);
1665     Error *local_err = NULL;
1666     int ret;
1667 
1668     if (cpu->hyperv_passthrough && hv_passthrough_mig_blocker == NULL) {
1669         error_setg(&hv_passthrough_mig_blocker,
1670                    "'hv-passthrough' CPU flag prevents migration, use explicit"
1671                    " set of hv-* flags instead");
1672         ret = migrate_add_blocker(&hv_passthrough_mig_blocker, &local_err);
1673         if (ret < 0) {
1674             error_report_err(local_err);
1675             return ret;
1676         }
1677     }
1678 
1679     if (cpu->hyperv_no_nonarch_cs == ON_OFF_AUTO_AUTO &&
1680         hv_no_nonarch_cs_mig_blocker == NULL) {
1681         error_setg(&hv_no_nonarch_cs_mig_blocker,
1682                    "'hv-no-nonarch-coresharing=auto' CPU flag prevents migration"
1683                    " use explicit 'hv-no-nonarch-coresharing=on' instead (but"
1684                    " make sure SMT is disabled and/or that vCPUs are properly"
1685                    " pinned)");
1686         ret = migrate_add_blocker(&hv_no_nonarch_cs_mig_blocker, &local_err);
1687         if (ret < 0) {
1688             error_report_err(local_err);
1689             return ret;
1690         }
1691     }
1692 
1693     if (hyperv_feat_enabled(cpu, HYPERV_FEAT_VPINDEX) && !hv_vpindex_settable) {
1694         /*
1695          * the kernel doesn't support setting vp_index; assert that its value
1696          * is in sync
1697          */
1698         uint64_t value;
1699 
1700         ret = kvm_get_one_msr(cpu, HV_X64_MSR_VP_INDEX, &value);
1701         if (ret < 0) {
1702             return ret;
1703         }
1704 
1705         if (value != hyperv_vp_index(CPU(cpu))) {
1706             error_report("kernel's vp_index != QEMU's vp_index");
1707             return -ENXIO;
1708         }
1709     }
1710 
1711     if (hyperv_feat_enabled(cpu, HYPERV_FEAT_SYNIC)) {
1712         uint32_t synic_cap = cpu->hyperv_synic_kvm_only ?
1713             KVM_CAP_HYPERV_SYNIC : KVM_CAP_HYPERV_SYNIC2;
1714         ret = kvm_vcpu_enable_cap(cs, synic_cap, 0);
1715         if (ret < 0) {
1716             error_report("failed to turn on HyperV SynIC in KVM: %s",
1717                          strerror(-ret));
1718             return ret;
1719         }
1720 
1721         if (!cpu->hyperv_synic_kvm_only) {
1722             ret = hyperv_x86_synic_add(cpu);
1723             if (ret < 0) {
1724                 error_report("failed to create HyperV SynIC: %s",
1725                              strerror(-ret));
1726                 return ret;
1727             }
1728         }
1729     }
1730 
1731     if (hyperv_feat_enabled(cpu, HYPERV_FEAT_EVMCS)) {
1732         uint16_t evmcs_version = DEFAULT_EVMCS_VERSION;
1733         uint16_t supported_evmcs_version;
1734 
1735         ret = kvm_vcpu_enable_cap(cs, KVM_CAP_HYPERV_ENLIGHTENED_VMCS, 0,
1736                                   (uintptr_t)&supported_evmcs_version);
1737 
1738         /*
1739          * KVM is required to support EVMCS ver.1. as that's what 'hv-evmcs'
1740          * option sets. Note: we hardcode the maximum supported eVMCS version
1741          * to '1' as well so 'hv-evmcs' feature is migratable even when (and if)
1742          * ver.2 is implemented. A new option (e.g. 'hv-evmcs=2') will then have
1743          * to be added.
1744          */
1745         if (ret < 0) {
1746             error_report("Hyper-V %s is not supported by kernel",
1747                          kvm_hyperv_properties[HYPERV_FEAT_EVMCS].desc);
1748             return ret;
1749         }
1750 
1751         if (!evmcs_version_supported(evmcs_version, supported_evmcs_version)) {
1752             error_report("eVMCS version range [%d..%d] is not supported by "
1753                          "kernel (supported: [%d..%d])", evmcs_version & 0xff,
1754                          evmcs_version >> 8, supported_evmcs_version & 0xff,
1755                          supported_evmcs_version >> 8);
1756             return -ENOTSUP;
1757         }
1758     }
1759 
1760     if (cpu->hyperv_enforce_cpuid) {
1761         ret = kvm_vcpu_enable_cap(cs, KVM_CAP_HYPERV_ENFORCE_CPUID, 0, 1);
1762         if (ret < 0) {
1763             error_report("failed to enable KVM_CAP_HYPERV_ENFORCE_CPUID: %s",
1764                          strerror(-ret));
1765             return ret;
1766         }
1767     }
1768 
1769     /* Skip SynIC and VP_INDEX since they are hard deps already */
1770     if (hyperv_feat_enabled(cpu, HYPERV_FEAT_STIMER) &&
1771         hyperv_feat_enabled(cpu, HYPERV_FEAT_VAPIC) &&
1772         hyperv_feat_enabled(cpu, HYPERV_FEAT_RUNTIME)) {
1773         hyperv_x86_set_vmbus_recommended_features_enabled();
1774     }
1775 
1776     return 0;
1777 }
1778 
1779 static Error *invtsc_mig_blocker;
1780 
1781 #define KVM_MAX_CPUID_ENTRIES  100
1782 
1783 static void kvm_init_xsave(CPUX86State *env)
1784 {
1785     if (has_xsave2) {
1786         env->xsave_buf_len = QEMU_ALIGN_UP(has_xsave2, 4096);
1787     } else {
1788         env->xsave_buf_len = sizeof(struct kvm_xsave);
1789     }
1790 
1791     env->xsave_buf = qemu_memalign(4096, env->xsave_buf_len);
1792     memset(env->xsave_buf, 0, env->xsave_buf_len);
1793     /*
1794      * The allocated storage must be large enough for all of the
1795      * possible XSAVE state components.
1796      */
1797     assert(kvm_arch_get_supported_cpuid(kvm_state, 0xd, 0, R_ECX) <=
1798            env->xsave_buf_len);
1799 }
1800 
1801 static void kvm_init_nested_state(CPUX86State *env)
1802 {
1803     struct kvm_vmx_nested_state_hdr *vmx_hdr;
1804     uint32_t size;
1805 
1806     if (!env->nested_state) {
1807         return;
1808     }
1809 
1810     size = env->nested_state->size;
1811 
1812     memset(env->nested_state, 0, size);
1813     env->nested_state->size = size;
1814 
1815     if (cpu_has_vmx(env)) {
1816         env->nested_state->format = KVM_STATE_NESTED_FORMAT_VMX;
1817         vmx_hdr = &env->nested_state->hdr.vmx;
1818         vmx_hdr->vmxon_pa = -1ull;
1819         vmx_hdr->vmcs12_pa = -1ull;
1820     } else if (cpu_has_svm(env)) {
1821         env->nested_state->format = KVM_STATE_NESTED_FORMAT_SVM;
1822     }
1823 }
1824 
1825 static uint32_t kvm_x86_build_cpuid(CPUX86State *env,
1826                                     struct kvm_cpuid_entry2 *entries,
1827                                     uint32_t cpuid_i)
1828 {
1829     uint32_t limit, i, j;
1830     uint32_t unused;
1831     struct kvm_cpuid_entry2 *c;
1832 
1833     cpu_x86_cpuid(env, 0, 0, &limit, &unused, &unused, &unused);
1834 
1835     for (i = 0; i <= limit; i++) {
1836         j = 0;
1837         if (cpuid_i == KVM_MAX_CPUID_ENTRIES) {
1838             goto full;
1839         }
1840         c = &entries[cpuid_i++];
1841         switch (i) {
1842         case 2: {
1843             /* Keep reading function 2 till all the input is received */
1844             int times;
1845 
1846             c->function = i;
1847             cpu_x86_cpuid(env, i, 0, &c->eax, &c->ebx, &c->ecx, &c->edx);
1848             times = c->eax & 0xff;
1849             if (times > 1) {
1850                 c->flags = KVM_CPUID_FLAG_STATEFUL_FUNC |
1851                            KVM_CPUID_FLAG_STATE_READ_NEXT;
1852             }
1853 
1854             for (j = 1; j < times; ++j) {
1855                 if (cpuid_i == KVM_MAX_CPUID_ENTRIES) {
1856                     goto full;
1857                 }
1858                 c = &entries[cpuid_i++];
1859                 c->function = i;
1860                 c->flags = KVM_CPUID_FLAG_STATEFUL_FUNC;
1861                 cpu_x86_cpuid(env, i, 0, &c->eax, &c->ebx, &c->ecx, &c->edx);
1862             }
1863             break;
1864         }
1865         case 0x1f:
1866             if (!x86_has_extended_topo(env->avail_cpu_topo)) {
1867                 cpuid_i--;
1868                 break;
1869             }
1870             /* fallthrough */
1871         case 4:
1872         case 0xb:
1873         case 0xd:
1874             for (j = 0; ; j++) {
1875                 c->function = i;
1876                 c->flags = KVM_CPUID_FLAG_SIGNIFCANT_INDEX;
1877                 c->index = j;
1878                 cpu_x86_cpuid(env, i, j, &c->eax, &c->ebx, &c->ecx, &c->edx);
1879 
1880                 if (i == 4 && c->eax == 0) {
1881                     break;
1882                 }
1883                 if (i == 0xb && !(c->ecx & 0xff00)) {
1884                     break;
1885                 }
1886                 if (i == 0x1f && !(c->ecx & 0xff00)) {
1887                     break;
1888                 }
1889                 if (i == 0xd && c->eax == 0) {
1890                     if (j < 63) {
1891                         continue;
1892                     } else {
1893                         cpuid_i--;
1894                         break;
1895                     }
1896                 }
1897                 if (cpuid_i == KVM_MAX_CPUID_ENTRIES) {
1898                     goto full;
1899                 }
1900                 c = &entries[cpuid_i++];
1901             }
1902             break;
1903         case 0x12:
1904             for (j = 0; ; j++) {
1905                 c->function = i;
1906                 c->flags = KVM_CPUID_FLAG_SIGNIFCANT_INDEX;
1907                 c->index = j;
1908                 cpu_x86_cpuid(env, i, j, &c->eax, &c->ebx, &c->ecx, &c->edx);
1909 
1910                 if (j > 1 && (c->eax & 0xf) != 1) {
1911                     break;
1912                 }
1913 
1914                 if (cpuid_i == KVM_MAX_CPUID_ENTRIES) {
1915                     goto full;
1916                 }
1917                 c = &entries[cpuid_i++];
1918             }
1919             break;
1920         case 0x7:
1921         case 0x14:
1922         case 0x1d:
1923         case 0x1e:
1924         case 0x24: {
1925             uint32_t times;
1926 
1927             c->function = i;
1928             c->index = 0;
1929             c->flags = KVM_CPUID_FLAG_SIGNIFCANT_INDEX;
1930             cpu_x86_cpuid(env, i, 0, &c->eax, &c->ebx, &c->ecx, &c->edx);
1931             times = c->eax;
1932 
1933             for (j = 1; j <= times; ++j) {
1934                 if (cpuid_i == KVM_MAX_CPUID_ENTRIES) {
1935                     goto full;
1936                 }
1937                 c = &entries[cpuid_i++];
1938                 c->function = i;
1939                 c->index = j;
1940                 c->flags = KVM_CPUID_FLAG_SIGNIFCANT_INDEX;
1941                 cpu_x86_cpuid(env, i, j, &c->eax, &c->ebx, &c->ecx, &c->edx);
1942             }
1943             break;
1944         }
1945         default:
1946             c->function = i;
1947             c->flags = 0;
1948             cpu_x86_cpuid(env, i, 0, &c->eax, &c->ebx, &c->ecx, &c->edx);
1949             if (!c->eax && !c->ebx && !c->ecx && !c->edx) {
1950                 /*
1951                  * KVM already returns all zeroes if a CPUID entry is missing,
1952                  * so we can omit it and avoid hitting KVM's 80-entry limit.
1953                  */
1954                 cpuid_i--;
1955             }
1956             break;
1957         }
1958     }
1959 
1960     if (limit >= 0x0a) {
1961         uint32_t eax, edx;
1962 
1963         cpu_x86_cpuid(env, 0x0a, 0, &eax, &unused, &unused, &edx);
1964 
1965         has_architectural_pmu_version = eax & 0xff;
1966         if (has_architectural_pmu_version > 0) {
1967             num_architectural_pmu_gp_counters = (eax & 0xff00) >> 8;
1968 
1969             /* Shouldn't be more than 32, since that's the number of bits
1970              * available in EBX to tell us _which_ counters are available.
1971              * Play it safe.
1972              */
1973             if (num_architectural_pmu_gp_counters > MAX_GP_COUNTERS) {
1974                 num_architectural_pmu_gp_counters = MAX_GP_COUNTERS;
1975             }
1976 
1977             if (has_architectural_pmu_version > 1) {
1978                 num_architectural_pmu_fixed_counters = edx & 0x1f;
1979 
1980                 if (num_architectural_pmu_fixed_counters > MAX_FIXED_COUNTERS) {
1981                     num_architectural_pmu_fixed_counters = MAX_FIXED_COUNTERS;
1982                 }
1983             }
1984         }
1985     }
1986 
1987     cpu_x86_cpuid(env, 0x80000000, 0, &limit, &unused, &unused, &unused);
1988 
1989     for (i = 0x80000000; i <= limit; i++) {
1990         j = 0;
1991         if (cpuid_i == KVM_MAX_CPUID_ENTRIES) {
1992             goto full;
1993         }
1994         c = &entries[cpuid_i++];
1995 
1996         switch (i) {
1997         case 0x8000001d:
1998             /* Query for all AMD cache information leaves */
1999             for (j = 0; ; j++) {
2000                 c->function = i;
2001                 c->flags = KVM_CPUID_FLAG_SIGNIFCANT_INDEX;
2002                 c->index = j;
2003                 cpu_x86_cpuid(env, i, j, &c->eax, &c->ebx, &c->ecx, &c->edx);
2004 
2005                 if (c->eax == 0) {
2006                     break;
2007                 }
2008                 if (cpuid_i == KVM_MAX_CPUID_ENTRIES) {
2009                     goto full;
2010                 }
2011                 c = &entries[cpuid_i++];
2012             }
2013             break;
2014         default:
2015             c->function = i;
2016             c->flags = 0;
2017             cpu_x86_cpuid(env, i, 0, &c->eax, &c->ebx, &c->ecx, &c->edx);
2018             if (!c->eax && !c->ebx && !c->ecx && !c->edx) {
2019                 /*
2020                  * KVM already returns all zeroes if a CPUID entry is missing,
2021                  * so we can omit it and avoid hitting KVM's 80-entry limit.
2022                  */
2023                 cpuid_i--;
2024             }
2025             break;
2026         }
2027     }
2028 
2029     /* Call Centaur's CPUID instructions they are supported. */
2030     if (env->cpuid_xlevel2 > 0) {
2031         cpu_x86_cpuid(env, 0xC0000000, 0, &limit, &unused, &unused, &unused);
2032 
2033         for (i = 0xC0000000; i <= limit; i++) {
2034             j = 0;
2035             if (cpuid_i == KVM_MAX_CPUID_ENTRIES) {
2036                 goto full;
2037             }
2038             c = &entries[cpuid_i++];
2039 
2040             c->function = i;
2041             c->flags = 0;
2042             cpu_x86_cpuid(env, i, 0, &c->eax, &c->ebx, &c->ecx, &c->edx);
2043         }
2044     }
2045 
2046     return cpuid_i;
2047 
2048 full:
2049     fprintf(stderr, "cpuid_data is full, no space for "
2050             "cpuid(eax:0x%x,ecx:0x%x)\n", i, j);
2051     abort();
2052 }
2053 
2054 int kvm_arch_init_vcpu(CPUState *cs)
2055 {
2056     struct {
2057         struct kvm_cpuid2 cpuid;
2058         struct kvm_cpuid_entry2 entries[KVM_MAX_CPUID_ENTRIES];
2059     } cpuid_data;
2060     /*
2061      * The kernel defines these structs with padding fields so there
2062      * should be no extra padding in our cpuid_data struct.
2063      */
2064     QEMU_BUILD_BUG_ON(sizeof(cpuid_data) !=
2065                       sizeof(struct kvm_cpuid2) +
2066                       sizeof(struct kvm_cpuid_entry2) * KVM_MAX_CPUID_ENTRIES);
2067 
2068     X86CPU *cpu = X86_CPU(cs);
2069     CPUX86State *env = &cpu->env;
2070     uint32_t cpuid_i;
2071     struct kvm_cpuid_entry2 *c;
2072     uint32_t signature[3];
2073     int kvm_base = KVM_CPUID_SIGNATURE;
2074     int max_nested_state_len;
2075     int r;
2076     Error *local_err = NULL;
2077 
2078     memset(&cpuid_data, 0, sizeof(cpuid_data));
2079 
2080     cpuid_i = 0;
2081 
2082     has_xsave2 = kvm_check_extension(cs->kvm_state, KVM_CAP_XSAVE2);
2083 
2084     r = kvm_arch_set_tsc_khz(cs);
2085     if (r < 0) {
2086         return r;
2087     }
2088 
2089     /* vcpu's TSC frequency is either specified by user, or following
2090      * the value used by KVM if the former is not present. In the
2091      * latter case, we query it from KVM and record in env->tsc_khz,
2092      * so that vcpu's TSC frequency can be migrated later via this field.
2093      */
2094     if (!env->tsc_khz) {
2095         r = kvm_check_extension(cs->kvm_state, KVM_CAP_GET_TSC_KHZ) ?
2096             kvm_vcpu_ioctl(cs, KVM_GET_TSC_KHZ) :
2097             -ENOTSUP;
2098         if (r > 0) {
2099             env->tsc_khz = r;
2100         }
2101     }
2102 
2103     env->apic_bus_freq = KVM_APIC_BUS_FREQUENCY;
2104 
2105     /*
2106      * kvm_hyperv_expand_features() is called here for the second time in case
2107      * KVM_CAP_SYS_HYPERV_CPUID is not supported. While we can't possibly handle
2108      * 'query-cpu-model-expansion' in this case as we don't have a KVM vCPU to
2109      * check which Hyper-V enlightenments are supported and which are not, we
2110      * can still proceed and check/expand Hyper-V enlightenments here so legacy
2111      * behavior is preserved.
2112      */
2113     if (!kvm_hyperv_expand_features(cpu, &local_err)) {
2114         error_report_err(local_err);
2115         return -ENOSYS;
2116     }
2117 
2118     if (hyperv_enabled(cpu)) {
2119         r = hyperv_init_vcpu(cpu);
2120         if (r) {
2121             return r;
2122         }
2123 
2124         cpuid_i = hyperv_fill_cpuids(cs, cpuid_data.entries);
2125         kvm_base = KVM_CPUID_SIGNATURE_NEXT;
2126         has_msr_hv_hypercall = true;
2127     }
2128 
2129     if (cs->kvm_state->xen_version) {
2130 #ifdef CONFIG_XEN_EMU
2131         struct kvm_cpuid_entry2 *xen_max_leaf;
2132 
2133         memcpy(signature, "XenVMMXenVMM", 12);
2134 
2135         xen_max_leaf = c = &cpuid_data.entries[cpuid_i++];
2136         c->function = kvm_base + XEN_CPUID_SIGNATURE;
2137         c->eax = kvm_base + XEN_CPUID_TIME;
2138         c->ebx = signature[0];
2139         c->ecx = signature[1];
2140         c->edx = signature[2];
2141 
2142         c = &cpuid_data.entries[cpuid_i++];
2143         c->function = kvm_base + XEN_CPUID_VENDOR;
2144         c->eax = cs->kvm_state->xen_version;
2145         c->ebx = 0;
2146         c->ecx = 0;
2147         c->edx = 0;
2148 
2149         c = &cpuid_data.entries[cpuid_i++];
2150         c->function = kvm_base + XEN_CPUID_HVM_MSR;
2151         /* Number of hypercall-transfer pages */
2152         c->eax = 1;
2153         /* Hypercall MSR base address */
2154         if (hyperv_enabled(cpu)) {
2155             c->ebx = XEN_HYPERCALL_MSR_HYPERV;
2156             kvm_xen_init(cs->kvm_state, c->ebx);
2157         } else {
2158             c->ebx = XEN_HYPERCALL_MSR;
2159         }
2160         c->ecx = 0;
2161         c->edx = 0;
2162 
2163         c = &cpuid_data.entries[cpuid_i++];
2164         c->function = kvm_base + XEN_CPUID_TIME;
2165         c->eax = ((!!tsc_is_stable_and_known(env) << 1) |
2166             (!!(env->features[FEAT_8000_0001_EDX] & CPUID_EXT2_RDTSCP) << 2));
2167         /* default=0 (emulate if necessary) */
2168         c->ebx = 0;
2169         /* guest tsc frequency */
2170         c->ecx = env->user_tsc_khz;
2171         /* guest tsc incarnation (migration count) */
2172         c->edx = 0;
2173 
2174         c = &cpuid_data.entries[cpuid_i++];
2175         c->function = kvm_base + XEN_CPUID_HVM;
2176         xen_max_leaf->eax = kvm_base + XEN_CPUID_HVM;
2177         if (cs->kvm_state->xen_version >= XEN_VERSION(4, 5)) {
2178             c->function = kvm_base + XEN_CPUID_HVM;
2179 
2180             if (cpu->xen_vapic) {
2181                 c->eax |= XEN_HVM_CPUID_APIC_ACCESS_VIRT;
2182                 c->eax |= XEN_HVM_CPUID_X2APIC_VIRT;
2183             }
2184 
2185             c->eax |= XEN_HVM_CPUID_IOMMU_MAPPINGS;
2186 
2187             if (cs->kvm_state->xen_version >= XEN_VERSION(4, 6)) {
2188                 c->eax |= XEN_HVM_CPUID_VCPU_ID_PRESENT;
2189                 c->ebx = cs->cpu_index;
2190             }
2191 
2192             if (cs->kvm_state->xen_version >= XEN_VERSION(4, 17)) {
2193                 c->eax |= XEN_HVM_CPUID_UPCALL_VECTOR;
2194             }
2195         }
2196 
2197         r = kvm_xen_init_vcpu(cs);
2198         if (r) {
2199             return r;
2200         }
2201 
2202         kvm_base += 0x100;
2203 #else /* CONFIG_XEN_EMU */
2204         /* This should never happen as kvm_arch_init() would have died first. */
2205         fprintf(stderr, "Cannot enable Xen CPUID without Xen support\n");
2206         abort();
2207 #endif
2208     } else if (cpu->expose_kvm) {
2209         memcpy(signature, "KVMKVMKVM\0\0\0", 12);
2210         c = &cpuid_data.entries[cpuid_i++];
2211         c->function = KVM_CPUID_SIGNATURE | kvm_base;
2212         c->eax = KVM_CPUID_FEATURES | kvm_base;
2213         c->ebx = signature[0];
2214         c->ecx = signature[1];
2215         c->edx = signature[2];
2216 
2217         c = &cpuid_data.entries[cpuid_i++];
2218         c->function = KVM_CPUID_FEATURES | kvm_base;
2219         c->eax = env->features[FEAT_KVM];
2220         c->edx = env->features[FEAT_KVM_HINTS];
2221     }
2222 
2223     if (cpu->kvm_pv_enforce_cpuid) {
2224         r = kvm_vcpu_enable_cap(cs, KVM_CAP_ENFORCE_PV_FEATURE_CPUID, 0, 1);
2225         if (r < 0) {
2226             fprintf(stderr,
2227                     "failed to enable KVM_CAP_ENFORCE_PV_FEATURE_CPUID: %s",
2228                     strerror(-r));
2229             abort();
2230         }
2231     }
2232 
2233     cpuid_i = kvm_x86_build_cpuid(env, cpuid_data.entries, cpuid_i);
2234     cpuid_data.cpuid.nent = cpuid_i;
2235 
2236     if (((env->cpuid_version >> 8)&0xF) >= 6
2237         && (env->features[FEAT_1_EDX] & (CPUID_MCE | CPUID_MCA)) ==
2238            (CPUID_MCE | CPUID_MCA)) {
2239         uint64_t mcg_cap, unsupported_caps;
2240         int banks;
2241         int ret;
2242 
2243         ret = kvm_get_mce_cap_supported(cs->kvm_state, &mcg_cap, &banks);
2244         if (ret < 0) {
2245             fprintf(stderr, "kvm_get_mce_cap_supported: %s", strerror(-ret));
2246             return ret;
2247         }
2248 
2249         if (banks < (env->mcg_cap & MCG_CAP_BANKS_MASK)) {
2250             error_report("kvm: Unsupported MCE bank count (QEMU = %d, KVM = %d)",
2251                          (int)(env->mcg_cap & MCG_CAP_BANKS_MASK), banks);
2252             return -ENOTSUP;
2253         }
2254 
2255         unsupported_caps = env->mcg_cap & ~(mcg_cap | MCG_CAP_BANKS_MASK);
2256         if (unsupported_caps) {
2257             if (unsupported_caps & MCG_LMCE_P) {
2258                 error_report("kvm: LMCE not supported");
2259                 return -ENOTSUP;
2260             }
2261             warn_report("Unsupported MCG_CAP bits: 0x%" PRIx64,
2262                         unsupported_caps);
2263         }
2264 
2265         env->mcg_cap &= mcg_cap | MCG_CAP_BANKS_MASK;
2266         ret = kvm_vcpu_ioctl(cs, KVM_X86_SETUP_MCE, &env->mcg_cap);
2267         if (ret < 0) {
2268             fprintf(stderr, "KVM_X86_SETUP_MCE: %s", strerror(-ret));
2269             return ret;
2270         }
2271     }
2272 
2273     cpu->vmsentry = qemu_add_vm_change_state_handler(cpu_update_state, env);
2274 
2275     c = cpuid_find_entry(&cpuid_data.cpuid, 1, 0);
2276     if (c) {
2277         has_msr_feature_control = !!(c->ecx & CPUID_EXT_VMX) ||
2278                                   !!(c->ecx & CPUID_EXT_SMX);
2279     }
2280 
2281     c = cpuid_find_entry(&cpuid_data.cpuid, 7, 0);
2282     if (c && (c->ebx & CPUID_7_0_EBX_SGX)) {
2283         has_msr_feature_control = true;
2284     }
2285 
2286     if (env->mcg_cap & MCG_LMCE_P) {
2287         has_msr_mcg_ext_ctl = has_msr_feature_control = true;
2288     }
2289 
2290     if (!env->user_tsc_khz) {
2291         if ((env->features[FEAT_8000_0007_EDX] & CPUID_APM_INVTSC) &&
2292             invtsc_mig_blocker == NULL) {
2293             error_setg(&invtsc_mig_blocker,
2294                        "State blocked by non-migratable CPU device"
2295                        " (invtsc flag)");
2296             r = migrate_add_blocker(&invtsc_mig_blocker, &local_err);
2297             if (r < 0) {
2298                 error_report_err(local_err);
2299                 return r;
2300             }
2301         }
2302     }
2303 
2304     if (cpu->vmware_cpuid_freq
2305         /* Guests depend on 0x40000000 to detect this feature, so only expose
2306          * it if KVM exposes leaf 0x40000000. (Conflicts with Hyper-V) */
2307         && cpu->expose_kvm
2308         && kvm_base == KVM_CPUID_SIGNATURE
2309         /* TSC clock must be stable and known for this feature. */
2310         && tsc_is_stable_and_known(env)) {
2311 
2312         c = &cpuid_data.entries[cpuid_i++];
2313         c->function = KVM_CPUID_SIGNATURE | 0x10;
2314         c->eax = env->tsc_khz;
2315         c->ebx = env->apic_bus_freq / 1000; /* Hz to KHz */
2316         c->ecx = c->edx = 0;
2317 
2318         c = cpuid_find_entry(&cpuid_data.cpuid, kvm_base, 0);
2319         c->eax = MAX(c->eax, KVM_CPUID_SIGNATURE | 0x10);
2320     }
2321 
2322     cpuid_data.cpuid.nent = cpuid_i;
2323 
2324     cpuid_data.cpuid.padding = 0;
2325     r = kvm_vcpu_ioctl(cs, KVM_SET_CPUID2, &cpuid_data);
2326     if (r) {
2327         goto fail;
2328     }
2329     kvm_init_xsave(env);
2330 
2331     max_nested_state_len = kvm_max_nested_state_length();
2332     if (max_nested_state_len > 0) {
2333         assert(max_nested_state_len >= offsetof(struct kvm_nested_state, data));
2334 
2335         if (cpu_has_vmx(env) || cpu_has_svm(env)) {
2336             env->nested_state = g_malloc0(max_nested_state_len);
2337             env->nested_state->size = max_nested_state_len;
2338 
2339             kvm_init_nested_state(env);
2340         }
2341     }
2342 
2343     cpu->kvm_msr_buf = g_malloc0(MSR_BUF_SIZE);
2344 
2345     if (!(env->features[FEAT_8000_0001_EDX] & CPUID_EXT2_RDTSCP)) {
2346         has_msr_tsc_aux = false;
2347     }
2348 
2349     kvm_init_msrs(cpu);
2350 
2351     return 0;
2352 
2353  fail:
2354     migrate_del_blocker(&invtsc_mig_blocker);
2355 
2356     return r;
2357 }
2358 
2359 int kvm_arch_destroy_vcpu(CPUState *cs)
2360 {
2361     X86CPU *cpu = X86_CPU(cs);
2362     CPUX86State *env = &cpu->env;
2363 
2364     g_free(env->xsave_buf);
2365 
2366     g_free(cpu->kvm_msr_buf);
2367     cpu->kvm_msr_buf = NULL;
2368 
2369     g_free(env->nested_state);
2370     env->nested_state = NULL;
2371 
2372     qemu_del_vm_change_state_handler(cpu->vmsentry);
2373 
2374     return 0;
2375 }
2376 
2377 void kvm_arch_reset_vcpu(X86CPU *cpu)
2378 {
2379     CPUX86State *env = &cpu->env;
2380 
2381     env->xcr0 = 1;
2382     if (kvm_irqchip_in_kernel()) {
2383         env->mp_state = cpu_is_bsp(cpu) ? KVM_MP_STATE_RUNNABLE :
2384                                           KVM_MP_STATE_UNINITIALIZED;
2385     } else {
2386         env->mp_state = KVM_MP_STATE_RUNNABLE;
2387     }
2388 
2389     /* enabled by default */
2390     env->poll_control_msr = 1;
2391 
2392     kvm_init_nested_state(env);
2393 
2394     sev_es_set_reset_vector(CPU(cpu));
2395 }
2396 
2397 void kvm_arch_after_reset_vcpu(X86CPU *cpu)
2398 {
2399     CPUX86State *env = &cpu->env;
2400     int i;
2401 
2402     /*
2403      * Reset SynIC after all other devices have been reset to let them remove
2404      * their SINT routes first.
2405      */
2406     if (hyperv_feat_enabled(cpu, HYPERV_FEAT_SYNIC)) {
2407         for (i = 0; i < ARRAY_SIZE(env->msr_hv_synic_sint); i++) {
2408             env->msr_hv_synic_sint[i] = HV_SINT_MASKED;
2409         }
2410 
2411         hyperv_x86_synic_reset(cpu);
2412     }
2413 }
2414 
2415 void kvm_arch_reset_parked_vcpu(unsigned long vcpu_id, int kvm_fd)
2416 {
2417     g_autofree struct kvm_msrs *msrs = NULL;
2418 
2419     msrs = g_malloc0(sizeof(*msrs) + sizeof(msrs->entries[0]));
2420     msrs->entries[0].index = MSR_IA32_TSC;
2421     msrs->entries[0].data = 1; /* match the value in x86_cpu_reset() */
2422     msrs->nmsrs++;
2423 
2424     if (ioctl(kvm_fd, KVM_SET_MSRS, msrs) != 1) {
2425         warn_report("parked vCPU %lu TSC reset failed: %d",
2426                     vcpu_id, errno);
2427     }
2428 }
2429 
2430 void kvm_arch_do_init_vcpu(X86CPU *cpu)
2431 {
2432     CPUX86State *env = &cpu->env;
2433 
2434     /* APs get directly into wait-for-SIPI state.  */
2435     if (env->mp_state == KVM_MP_STATE_UNINITIALIZED) {
2436         env->mp_state = KVM_MP_STATE_INIT_RECEIVED;
2437     }
2438 }
2439 
2440 static int kvm_get_supported_feature_msrs(KVMState *s)
2441 {
2442     int ret = 0;
2443 
2444     if (kvm_feature_msrs != NULL) {
2445         return 0;
2446     }
2447 
2448     if (!kvm_check_extension(s, KVM_CAP_GET_MSR_FEATURES)) {
2449         return 0;
2450     }
2451 
2452     struct kvm_msr_list msr_list;
2453 
2454     msr_list.nmsrs = 0;
2455     ret = kvm_ioctl(s, KVM_GET_MSR_FEATURE_INDEX_LIST, &msr_list);
2456     if (ret < 0 && ret != -E2BIG) {
2457         error_report("Fetch KVM feature MSR list failed: %s",
2458             strerror(-ret));
2459         return ret;
2460     }
2461 
2462     assert(msr_list.nmsrs > 0);
2463     kvm_feature_msrs = g_malloc0(sizeof(msr_list) +
2464                  msr_list.nmsrs * sizeof(msr_list.indices[0]));
2465 
2466     kvm_feature_msrs->nmsrs = msr_list.nmsrs;
2467     ret = kvm_ioctl(s, KVM_GET_MSR_FEATURE_INDEX_LIST, kvm_feature_msrs);
2468 
2469     if (ret < 0) {
2470         error_report("Fetch KVM feature MSR list failed: %s",
2471             strerror(-ret));
2472         g_free(kvm_feature_msrs);
2473         kvm_feature_msrs = NULL;
2474         return ret;
2475     }
2476 
2477     return 0;
2478 }
2479 
2480 static int kvm_get_supported_msrs(KVMState *s)
2481 {
2482     int ret = 0;
2483     struct kvm_msr_list msr_list, *kvm_msr_list;
2484 
2485     /*
2486      *  Obtain MSR list from KVM.  These are the MSRs that we must
2487      *  save/restore.
2488      */
2489     msr_list.nmsrs = 0;
2490     ret = kvm_ioctl(s, KVM_GET_MSR_INDEX_LIST, &msr_list);
2491     if (ret < 0 && ret != -E2BIG) {
2492         return ret;
2493     }
2494     /*
2495      * Old kernel modules had a bug and could write beyond the provided
2496      * memory. Allocate at least a safe amount of 1K.
2497      */
2498     kvm_msr_list = g_malloc0(MAX(1024, sizeof(msr_list) +
2499                                           msr_list.nmsrs *
2500                                           sizeof(msr_list.indices[0])));
2501 
2502     kvm_msr_list->nmsrs = msr_list.nmsrs;
2503     ret = kvm_ioctl(s, KVM_GET_MSR_INDEX_LIST, kvm_msr_list);
2504     if (ret >= 0) {
2505         int i;
2506 
2507         for (i = 0; i < kvm_msr_list->nmsrs; i++) {
2508             switch (kvm_msr_list->indices[i]) {
2509             case MSR_STAR:
2510                 has_msr_star = true;
2511                 break;
2512             case MSR_VM_HSAVE_PA:
2513                 has_msr_hsave_pa = true;
2514                 break;
2515             case MSR_TSC_AUX:
2516                 has_msr_tsc_aux = true;
2517                 break;
2518             case MSR_TSC_ADJUST:
2519                 has_msr_tsc_adjust = true;
2520                 break;
2521             case MSR_IA32_TSCDEADLINE:
2522                 has_msr_tsc_deadline = true;
2523                 break;
2524             case MSR_IA32_SMBASE:
2525                 has_msr_smbase = true;
2526                 break;
2527             case MSR_SMI_COUNT:
2528                 has_msr_smi_count = true;
2529                 break;
2530             case MSR_IA32_MISC_ENABLE:
2531                 has_msr_misc_enable = true;
2532                 break;
2533             case MSR_IA32_BNDCFGS:
2534                 has_msr_bndcfgs = true;
2535                 break;
2536             case MSR_IA32_XSS:
2537                 has_msr_xss = true;
2538                 break;
2539             case MSR_IA32_UMWAIT_CONTROL:
2540                 has_msr_umwait = true;
2541                 break;
2542             case HV_X64_MSR_CRASH_CTL:
2543                 has_msr_hv_crash = true;
2544                 break;
2545             case HV_X64_MSR_RESET:
2546                 has_msr_hv_reset = true;
2547                 break;
2548             case HV_X64_MSR_VP_INDEX:
2549                 has_msr_hv_vpindex = true;
2550                 break;
2551             case HV_X64_MSR_VP_RUNTIME:
2552                 has_msr_hv_runtime = true;
2553                 break;
2554             case HV_X64_MSR_SCONTROL:
2555                 has_msr_hv_synic = true;
2556                 break;
2557             case HV_X64_MSR_STIMER0_CONFIG:
2558                 has_msr_hv_stimer = true;
2559                 break;
2560             case HV_X64_MSR_TSC_FREQUENCY:
2561                 has_msr_hv_frequencies = true;
2562                 break;
2563             case HV_X64_MSR_REENLIGHTENMENT_CONTROL:
2564                 has_msr_hv_reenlightenment = true;
2565                 break;
2566             case HV_X64_MSR_SYNDBG_OPTIONS:
2567                 has_msr_hv_syndbg_options = true;
2568                 break;
2569             case MSR_IA32_SPEC_CTRL:
2570                 has_msr_spec_ctrl = true;
2571                 break;
2572             case MSR_AMD64_TSC_RATIO:
2573                 has_tsc_scale_msr = true;
2574                 break;
2575             case MSR_IA32_TSX_CTRL:
2576                 has_msr_tsx_ctrl = true;
2577                 break;
2578             case MSR_VIRT_SSBD:
2579                 has_msr_virt_ssbd = true;
2580                 break;
2581             case MSR_IA32_ARCH_CAPABILITIES:
2582                 has_msr_arch_capabs = true;
2583                 break;
2584             case MSR_IA32_CORE_CAPABILITY:
2585                 has_msr_core_capabs = true;
2586                 break;
2587             case MSR_IA32_PERF_CAPABILITIES:
2588                 has_msr_perf_capabs = true;
2589                 break;
2590             case MSR_IA32_VMX_VMFUNC:
2591                 has_msr_vmx_vmfunc = true;
2592                 break;
2593             case MSR_IA32_UCODE_REV:
2594                 has_msr_ucode_rev = true;
2595                 break;
2596             case MSR_IA32_VMX_PROCBASED_CTLS2:
2597                 has_msr_vmx_procbased_ctls2 = true;
2598                 break;
2599             case MSR_IA32_PKRS:
2600                 has_msr_pkrs = true;
2601                 break;
2602             case MSR_K7_HWCR:
2603                 has_msr_hwcr = true;
2604             }
2605         }
2606     }
2607 
2608     g_free(kvm_msr_list);
2609 
2610     return ret;
2611 }
2612 
2613 static bool kvm_rdmsr_core_thread_count(X86CPU *cpu,
2614                                         uint32_t msr,
2615                                         uint64_t *val)
2616 {
2617     *val = cpu_x86_get_msr_core_thread_count(cpu);
2618 
2619     return true;
2620 }
2621 
2622 static bool kvm_rdmsr_rapl_power_unit(X86CPU *cpu,
2623                                       uint32_t msr,
2624                                       uint64_t *val)
2625 {
2626 
2627     CPUState *cs = CPU(cpu);
2628 
2629     *val = cs->kvm_state->msr_energy.msr_unit;
2630 
2631     return true;
2632 }
2633 
2634 static bool kvm_rdmsr_pkg_power_limit(X86CPU *cpu,
2635                                       uint32_t msr,
2636                                       uint64_t *val)
2637 {
2638 
2639     CPUState *cs = CPU(cpu);
2640 
2641     *val = cs->kvm_state->msr_energy.msr_limit;
2642 
2643     return true;
2644 }
2645 
2646 static bool kvm_rdmsr_pkg_power_info(X86CPU *cpu,
2647                                      uint32_t msr,
2648                                      uint64_t *val)
2649 {
2650 
2651     CPUState *cs = CPU(cpu);
2652 
2653     *val = cs->kvm_state->msr_energy.msr_info;
2654 
2655     return true;
2656 }
2657 
2658 static bool kvm_rdmsr_pkg_energy_status(X86CPU *cpu,
2659                                         uint32_t msr,
2660                                         uint64_t *val)
2661 {
2662 
2663     CPUState *cs = CPU(cpu);
2664     *val = cs->kvm_state->msr_energy.msr_value[cs->cpu_index];
2665 
2666     return true;
2667 }
2668 
2669 static Notifier smram_machine_done;
2670 static KVMMemoryListener smram_listener;
2671 static AddressSpace smram_address_space;
2672 static MemoryRegion smram_as_root;
2673 static MemoryRegion smram_as_mem;
2674 
2675 static void register_smram_listener(Notifier *n, void *unused)
2676 {
2677     MemoryRegion *smram =
2678         (MemoryRegion *) object_resolve_path("/machine/smram", NULL);
2679 
2680     /* Outer container... */
2681     memory_region_init(&smram_as_root, OBJECT(kvm_state), "mem-container-smram", ~0ull);
2682     memory_region_set_enabled(&smram_as_root, true);
2683 
2684     /* ... with two regions inside: normal system memory with low
2685      * priority, and...
2686      */
2687     memory_region_init_alias(&smram_as_mem, OBJECT(kvm_state), "mem-smram",
2688                              get_system_memory(), 0, ~0ull);
2689     memory_region_add_subregion_overlap(&smram_as_root, 0, &smram_as_mem, 0);
2690     memory_region_set_enabled(&smram_as_mem, true);
2691 
2692     if (smram) {
2693         /* ... SMRAM with higher priority */
2694         memory_region_add_subregion_overlap(&smram_as_root, 0, smram, 10);
2695         memory_region_set_enabled(smram, true);
2696     }
2697 
2698     address_space_init(&smram_address_space, &smram_as_root, "KVM-SMRAM");
2699     kvm_memory_listener_register(kvm_state, &smram_listener,
2700                                  &smram_address_space, 1, "kvm-smram");
2701 }
2702 
2703 static void *kvm_msr_energy_thread(void *data)
2704 {
2705     KVMState *s = data;
2706     struct KVMMsrEnergy *vmsr = &s->msr_energy;
2707 
2708     g_autofree vmsr_package_energy_stat *pkg_stat = NULL;
2709     g_autofree vmsr_thread_stat *thd_stat = NULL;
2710     g_autofree CPUState *cpu = NULL;
2711     g_autofree unsigned int *vpkgs_energy_stat = NULL;
2712     unsigned int num_threads = 0;
2713 
2714     X86CPUTopoIDs topo_ids;
2715 
2716     rcu_register_thread();
2717 
2718     /* Allocate memory for each package energy status */
2719     pkg_stat = g_new0(vmsr_package_energy_stat, vmsr->host_topo.maxpkgs);
2720 
2721     /* Allocate memory for thread stats */
2722     thd_stat = g_new0(vmsr_thread_stat, 1);
2723 
2724     /* Allocate memory for holding virtual package energy counter */
2725     vpkgs_energy_stat = g_new0(unsigned int, vmsr->guest_vsockets);
2726 
2727     /* Populate the max tick of each packages */
2728     for (int i = 0; i < vmsr->host_topo.maxpkgs; i++) {
2729         /*
2730          * Max numbers of ticks per package
2731          * Time in second * Number of ticks/second * Number of cores/package
2732          * ex: 100 ticks/second/CPU, 12 CPUs per Package gives 1200 ticks max
2733          */
2734         vmsr->host_topo.maxticks[i] = (MSR_ENERGY_THREAD_SLEEP_US / 1000000)
2735                         * sysconf(_SC_CLK_TCK)
2736                         * vmsr->host_topo.pkg_cpu_count[i];
2737     }
2738 
2739     while (true) {
2740         /* Get all qemu threads id */
2741         g_autofree pid_t *thread_ids
2742             = vmsr_get_thread_ids(vmsr->pid, &num_threads);
2743 
2744         if (thread_ids == NULL) {
2745             goto clean;
2746         }
2747 
2748         thd_stat = g_renew(vmsr_thread_stat, thd_stat, num_threads);
2749         /* Unlike g_new0, g_renew0 function doesn't exist yet... */
2750         memset(thd_stat, 0, num_threads * sizeof(vmsr_thread_stat));
2751 
2752         /* Populate all the thread stats */
2753         for (int i = 0; i < num_threads; i++) {
2754             thd_stat[i].utime = g_new0(unsigned long long, 2);
2755             thd_stat[i].stime = g_new0(unsigned long long, 2);
2756             thd_stat[i].thread_id = thread_ids[i];
2757             vmsr_read_thread_stat(vmsr->pid,
2758                                   thd_stat[i].thread_id,
2759                                   &thd_stat[i].utime[0],
2760                                   &thd_stat[i].stime[0],
2761                                   &thd_stat[i].cpu_id);
2762             thd_stat[i].pkg_id =
2763                 vmsr_get_physical_package_id(thd_stat[i].cpu_id);
2764         }
2765 
2766         /* Retrieve all packages power plane energy counter */
2767         for (int i = 0; i < vmsr->host_topo.maxpkgs; i++) {
2768             for (int j = 0; j < num_threads; j++) {
2769                 /*
2770                  * Use the first thread we found that ran on the CPU
2771                  * of the package to read the packages energy counter
2772                  */
2773                 if (thd_stat[j].pkg_id == i) {
2774                     pkg_stat[i].e_start =
2775                     vmsr_read_msr(MSR_PKG_ENERGY_STATUS,
2776                                   thd_stat[j].cpu_id,
2777                                   thd_stat[j].thread_id,
2778                                   s->msr_energy.sioc);
2779                     break;
2780                 }
2781             }
2782         }
2783 
2784         /* Sleep a short period while the other threads are working */
2785         usleep(MSR_ENERGY_THREAD_SLEEP_US);
2786 
2787         /*
2788          * Retrieve all packages power plane energy counter
2789          * Calculate the delta of all packages
2790          */
2791         for (int i = 0; i < vmsr->host_topo.maxpkgs; i++) {
2792             for (int j = 0; j < num_threads; j++) {
2793                 /*
2794                  * Use the first thread we found that ran on the CPU
2795                  * of the package to read the packages energy counter
2796                  */
2797                 if (thd_stat[j].pkg_id == i) {
2798                     pkg_stat[i].e_end =
2799                     vmsr_read_msr(MSR_PKG_ENERGY_STATUS,
2800                                   thd_stat[j].cpu_id,
2801                                   thd_stat[j].thread_id,
2802                                   s->msr_energy.sioc);
2803                     /*
2804                      * Prevent the case we have migrate the VM
2805                      * during the sleep period or any other cases
2806                      * were energy counter might be lower after
2807                      * the sleep period.
2808                      */
2809                     if (pkg_stat[i].e_end > pkg_stat[i].e_start) {
2810                         pkg_stat[i].e_delta =
2811                             pkg_stat[i].e_end - pkg_stat[i].e_start;
2812                     } else {
2813                         pkg_stat[i].e_delta = 0;
2814                     }
2815                     break;
2816                 }
2817             }
2818         }
2819 
2820         /* Delta of ticks spend by each thread between the sample */
2821         for (int i = 0; i < num_threads; i++) {
2822             vmsr_read_thread_stat(vmsr->pid,
2823                                   thd_stat[i].thread_id,
2824                                   &thd_stat[i].utime[1],
2825                                   &thd_stat[i].stime[1],
2826                                   &thd_stat[i].cpu_id);
2827 
2828             if (vmsr->pid < 0) {
2829                 /*
2830                  * We don't count the dead thread
2831                  * i.e threads that existed before the sleep
2832                  * and not anymore
2833                  */
2834                 thd_stat[i].delta_ticks = 0;
2835             } else {
2836                 vmsr_delta_ticks(thd_stat, i);
2837             }
2838         }
2839 
2840         /*
2841          * Identify the vcpu threads
2842          * Calculate the number of vcpu per package
2843          */
2844         CPU_FOREACH(cpu) {
2845             for (int i = 0; i < num_threads; i++) {
2846                 if (cpu->thread_id == thd_stat[i].thread_id) {
2847                     thd_stat[i].is_vcpu = true;
2848                     thd_stat[i].vcpu_id = cpu->cpu_index;
2849                     pkg_stat[thd_stat[i].pkg_id].nb_vcpu++;
2850                     thd_stat[i].acpi_id = kvm_arch_vcpu_id(cpu);
2851                     break;
2852                 }
2853             }
2854         }
2855 
2856         /* Retrieve the virtual package number of each vCPU */
2857         for (int i = 0; i < vmsr->guest_cpu_list->len; i++) {
2858             for (int j = 0; j < num_threads; j++) {
2859                 if ((thd_stat[j].acpi_id ==
2860                         vmsr->guest_cpu_list->cpus[i].arch_id)
2861                     && (thd_stat[j].is_vcpu == true)) {
2862                     x86_topo_ids_from_apicid(thd_stat[j].acpi_id,
2863                         &vmsr->guest_topo_info, &topo_ids);
2864                     thd_stat[j].vpkg_id = topo_ids.pkg_id;
2865                 }
2866             }
2867         }
2868 
2869         /* Calculate the total energy of all non-vCPU thread */
2870         for (int i = 0; i < num_threads; i++) {
2871             if ((thd_stat[i].is_vcpu != true) &&
2872                 (thd_stat[i].delta_ticks > 0)) {
2873                 double temp;
2874                 temp = vmsr_get_ratio(pkg_stat[thd_stat[i].pkg_id].e_delta,
2875                     thd_stat[i].delta_ticks,
2876                     vmsr->host_topo.maxticks[thd_stat[i].pkg_id]);
2877                 pkg_stat[thd_stat[i].pkg_id].e_ratio
2878                     += (uint64_t)lround(temp);
2879             }
2880         }
2881 
2882         /* Calculate the ratio per non-vCPU thread of each package */
2883         for (int i = 0; i < vmsr->host_topo.maxpkgs; i++) {
2884             if (pkg_stat[i].nb_vcpu > 0) {
2885                 pkg_stat[i].e_ratio = pkg_stat[i].e_ratio / pkg_stat[i].nb_vcpu;
2886             }
2887         }
2888 
2889         /*
2890          * Calculate the energy for each Package:
2891          * Energy Package = sum of each vCPU energy that belongs to the package
2892          */
2893         for (int i = 0; i < num_threads; i++) {
2894             if ((thd_stat[i].is_vcpu == true) && \
2895                     (thd_stat[i].delta_ticks > 0)) {
2896                 double temp;
2897                 temp = vmsr_get_ratio(pkg_stat[thd_stat[i].pkg_id].e_delta,
2898                     thd_stat[i].delta_ticks,
2899                     vmsr->host_topo.maxticks[thd_stat[i].pkg_id]);
2900                 vpkgs_energy_stat[thd_stat[i].vpkg_id] +=
2901                     (uint64_t)lround(temp);
2902                 vpkgs_energy_stat[thd_stat[i].vpkg_id] +=
2903                     pkg_stat[thd_stat[i].pkg_id].e_ratio;
2904             }
2905         }
2906 
2907         /*
2908          * Finally populate the vmsr register of each vCPU with the total
2909          * package value to emulate the real hardware where each CPU return the
2910          * value of the package it belongs.
2911          */
2912         for (int i = 0; i < num_threads; i++) {
2913             if ((thd_stat[i].is_vcpu == true) && \
2914                     (thd_stat[i].delta_ticks > 0)) {
2915                 vmsr->msr_value[thd_stat[i].vcpu_id] = \
2916                                         vpkgs_energy_stat[thd_stat[i].vpkg_id];
2917           }
2918         }
2919 
2920         /* Freeing memory before zeroing the pointer */
2921         for (int i = 0; i < num_threads; i++) {
2922             g_free(thd_stat[i].utime);
2923             g_free(thd_stat[i].stime);
2924         }
2925    }
2926 
2927 clean:
2928     rcu_unregister_thread();
2929     return NULL;
2930 }
2931 
2932 static int kvm_msr_energy_thread_init(KVMState *s, MachineState *ms)
2933 {
2934     MachineClass *mc = MACHINE_GET_CLASS(ms);
2935     struct KVMMsrEnergy *r = &s->msr_energy;
2936 
2937     /*
2938      * Sanity check
2939      * 1. Host cpu must be Intel cpu
2940      * 2. RAPL must be enabled on the Host
2941      */
2942     if (!is_host_cpu_intel()) {
2943         error_report("The RAPL feature can only be enabled on hosts "
2944                      "with Intel CPU models");
2945         return -1;
2946     }
2947 
2948     if (!is_rapl_enabled()) {
2949         return -1;
2950     }
2951 
2952     /* Retrieve the virtual topology */
2953     vmsr_init_topo_info(&r->guest_topo_info, ms);
2954 
2955     /* Retrieve the number of vcpu */
2956     r->guest_vcpus = ms->smp.cpus;
2957 
2958     /* Retrieve the number of virtual sockets */
2959     r->guest_vsockets = ms->smp.sockets;
2960 
2961     /* Allocate register memory (MSR_PKG_STATUS) for each vcpu */
2962     r->msr_value = g_new0(uint64_t, r->guest_vcpus);
2963 
2964     /* Retrieve the CPUArchIDlist */
2965     r->guest_cpu_list = mc->possible_cpu_arch_ids(ms);
2966 
2967     /* Max number of cpus on the Host */
2968     r->host_topo.maxcpus = vmsr_get_maxcpus();
2969     if (r->host_topo.maxcpus == 0) {
2970         error_report("host max cpus = 0");
2971         return -1;
2972     }
2973 
2974     /* Max number of packages on the host */
2975     r->host_topo.maxpkgs = vmsr_get_max_physical_package(r->host_topo.maxcpus);
2976     if (r->host_topo.maxpkgs == 0) {
2977         error_report("host max pkgs = 0");
2978         return -1;
2979     }
2980 
2981     /* Allocate memory for each package on the host */
2982     r->host_topo.pkg_cpu_count = g_new0(unsigned int, r->host_topo.maxpkgs);
2983     r->host_topo.maxticks = g_new0(unsigned int, r->host_topo.maxpkgs);
2984 
2985     vmsr_count_cpus_per_package(r->host_topo.pkg_cpu_count,
2986                                 r->host_topo.maxpkgs);
2987     for (int i = 0; i < r->host_topo.maxpkgs; i++) {
2988         if (r->host_topo.pkg_cpu_count[i] == 0) {
2989             error_report("cpu per packages = 0 on package_%d", i);
2990             return -1;
2991         }
2992     }
2993 
2994     /* Get QEMU PID*/
2995     r->pid = getpid();
2996 
2997     /* Compute the socket path if necessary */
2998     if (s->msr_energy.socket_path == NULL) {
2999         s->msr_energy.socket_path = vmsr_compute_default_paths();
3000     }
3001 
3002     /* Open socket with vmsr helper */
3003     s->msr_energy.sioc = vmsr_open_socket(s->msr_energy.socket_path);
3004 
3005     if (s->msr_energy.sioc == NULL) {
3006         error_report("vmsr socket opening failed");
3007         return -1;
3008     }
3009 
3010     /* Those MSR values should not change */
3011     r->msr_unit  = vmsr_read_msr(MSR_RAPL_POWER_UNIT, 0, r->pid,
3012                                     s->msr_energy.sioc);
3013     r->msr_limit = vmsr_read_msr(MSR_PKG_POWER_LIMIT, 0, r->pid,
3014                                     s->msr_energy.sioc);
3015     r->msr_info  = vmsr_read_msr(MSR_PKG_POWER_INFO, 0, r->pid,
3016                                     s->msr_energy.sioc);
3017     if (r->msr_unit == 0 || r->msr_limit == 0 || r->msr_info == 0) {
3018         error_report("can't read any virtual msr");
3019         return -1;
3020     }
3021 
3022     qemu_thread_create(&r->msr_thr, "kvm-msr",
3023                        kvm_msr_energy_thread,
3024                        s, QEMU_THREAD_JOINABLE);
3025     return 0;
3026 }
3027 
3028 int kvm_arch_get_default_type(MachineState *ms)
3029 {
3030     return 0;
3031 }
3032 
3033 static int kvm_vm_enable_exception_payload(KVMState *s)
3034 {
3035     int ret = 0;
3036     has_exception_payload = kvm_check_extension(s, KVM_CAP_EXCEPTION_PAYLOAD);
3037     if (has_exception_payload) {
3038         ret = kvm_vm_enable_cap(s, KVM_CAP_EXCEPTION_PAYLOAD, 0, true);
3039         if (ret < 0) {
3040             error_report("kvm: Failed to enable exception payload cap: %s",
3041                          strerror(-ret));
3042         }
3043     }
3044 
3045     return ret;
3046 }
3047 
3048 static int kvm_vm_enable_triple_fault_event(KVMState *s)
3049 {
3050     int ret = 0;
3051     has_triple_fault_event = \
3052         kvm_check_extension(s,
3053                             KVM_CAP_X86_TRIPLE_FAULT_EVENT);
3054     if (has_triple_fault_event) {
3055         ret = kvm_vm_enable_cap(s, KVM_CAP_X86_TRIPLE_FAULT_EVENT, 0, true);
3056         if (ret < 0) {
3057             error_report("kvm: Failed to enable triple fault event cap: %s",
3058                          strerror(-ret));
3059         }
3060     }
3061     return ret;
3062 }
3063 
3064 static int kvm_vm_set_identity_map_addr(KVMState *s, uint64_t identity_base)
3065 {
3066     return kvm_vm_ioctl(s, KVM_SET_IDENTITY_MAP_ADDR, &identity_base);
3067 }
3068 
3069 static int kvm_vm_set_nr_mmu_pages(KVMState *s)
3070 {
3071     uint64_t shadow_mem;
3072     int ret = 0;
3073     shadow_mem = object_property_get_int(OBJECT(s),
3074                                          "kvm-shadow-mem",
3075                                          &error_abort);
3076     if (shadow_mem != -1) {
3077         shadow_mem /= 4096;
3078         ret = kvm_vm_ioctl(s, KVM_SET_NR_MMU_PAGES, shadow_mem);
3079     }
3080     return ret;
3081 }
3082 
3083 static int kvm_vm_set_tss_addr(KVMState *s, uint64_t tss_base)
3084 {
3085     return kvm_vm_ioctl(s, KVM_SET_TSS_ADDR, tss_base);
3086 }
3087 
3088 static int kvm_vm_enable_disable_exits(KVMState *s)
3089 {
3090     int disable_exits = kvm_check_extension(s, KVM_CAP_X86_DISABLE_EXITS);
3091 
3092     if (disable_exits) {
3093         disable_exits &= (KVM_X86_DISABLE_EXITS_MWAIT |
3094                           KVM_X86_DISABLE_EXITS_HLT |
3095                           KVM_X86_DISABLE_EXITS_PAUSE |
3096                           KVM_X86_DISABLE_EXITS_CSTATE);
3097     }
3098 
3099     return kvm_vm_enable_cap(s, KVM_CAP_X86_DISABLE_EXITS, 0,
3100                              disable_exits);
3101 }
3102 
3103 static int kvm_vm_enable_bus_lock_exit(KVMState *s)
3104 {
3105     int ret = 0;
3106     ret = kvm_check_extension(s, KVM_CAP_X86_BUS_LOCK_EXIT);
3107     if (!(ret & KVM_BUS_LOCK_DETECTION_EXIT)) {
3108         error_report("kvm: bus lock detection unsupported");
3109         return -ENOTSUP;
3110     }
3111     ret = kvm_vm_enable_cap(s, KVM_CAP_X86_BUS_LOCK_EXIT, 0,
3112                             KVM_BUS_LOCK_DETECTION_EXIT);
3113     if (ret < 0) {
3114         error_report("kvm: Failed to enable bus lock detection cap: %s",
3115                      strerror(-ret));
3116     }
3117 
3118     return ret;
3119 }
3120 
3121 static int kvm_vm_enable_notify_vmexit(KVMState *s)
3122 {
3123     int ret = 0;
3124     if (s->notify_vmexit != NOTIFY_VMEXIT_OPTION_DISABLE) {
3125         uint64_t notify_window_flags =
3126             ((uint64_t)s->notify_window << 32) |
3127             KVM_X86_NOTIFY_VMEXIT_ENABLED |
3128             KVM_X86_NOTIFY_VMEXIT_USER;
3129         ret = kvm_vm_enable_cap(s, KVM_CAP_X86_NOTIFY_VMEXIT, 0,
3130                                 notify_window_flags);
3131         if (ret < 0) {
3132             error_report("kvm: Failed to enable notify vmexit cap: %s",
3133                          strerror(-ret));
3134         }
3135     }
3136     return ret;
3137 }
3138 
3139 static int kvm_vm_enable_userspace_msr(KVMState *s)
3140 {
3141     int ret;
3142 
3143     ret = kvm_vm_enable_cap(s, KVM_CAP_X86_USER_SPACE_MSR, 0,
3144                             KVM_MSR_EXIT_REASON_FILTER);
3145     if (ret < 0) {
3146         error_report("Could not enable user space MSRs: %s",
3147                      strerror(-ret));
3148         exit(1);
3149     }
3150 
3151     ret = kvm_filter_msr(s, MSR_CORE_THREAD_COUNT,
3152                          kvm_rdmsr_core_thread_count, NULL);
3153     if (ret < 0) {
3154         error_report("Could not install MSR_CORE_THREAD_COUNT handler: %s",
3155                      strerror(-ret));
3156         exit(1);
3157     }
3158 
3159     return 0;
3160 }
3161 
3162 static int kvm_vm_enable_energy_msrs(KVMState *s)
3163 {
3164     int ret;
3165 
3166     if (s->msr_energy.enable == true) {
3167         ret = kvm_filter_msr(s, MSR_RAPL_POWER_UNIT,
3168                              kvm_rdmsr_rapl_power_unit, NULL);
3169         if (ret < 0) {
3170             error_report("Could not install MSR_RAPL_POWER_UNIT handler: %s",
3171                          strerror(-ret));
3172             return ret;
3173         }
3174 
3175         ret = kvm_filter_msr(s, MSR_PKG_POWER_LIMIT,
3176                              kvm_rdmsr_pkg_power_limit, NULL);
3177         if (ret < 0) {
3178             error_report("Could not install MSR_PKG_POWER_LIMIT handler: %s",
3179                          strerror(-ret));
3180             return ret;
3181         }
3182 
3183         ret = kvm_filter_msr(s, MSR_PKG_POWER_INFO,
3184                              kvm_rdmsr_pkg_power_info, NULL);
3185         if (ret < 0) {
3186             error_report("Could not install MSR_PKG_POWER_INFO handler: %s",
3187                          strerror(-ret));
3188             return ret;
3189         }
3190         ret = kvm_filter_msr(s, MSR_PKG_ENERGY_STATUS,
3191                              kvm_rdmsr_pkg_energy_status, NULL);
3192         if (ret < 0) {
3193             error_report("Could not install MSR_PKG_ENERGY_STATUS handler: %s",
3194                          strerror(-ret));
3195             return ret;
3196         }
3197     }
3198     return 0;
3199 }
3200 
3201 int kvm_arch_init(MachineState *ms, KVMState *s)
3202 {
3203     int ret;
3204     struct utsname utsname;
3205     Error *local_err = NULL;
3206 
3207     /*
3208      * Initialize SEV context, if required
3209      *
3210      * If no memory encryption is requested (ms->cgs == NULL) this is
3211      * a no-op.
3212      *
3213      * It's also a no-op if a non-SEV confidential guest support
3214      * mechanism is selected.  SEV is the only mechanism available to
3215      * select on x86 at present, so this doesn't arise, but if new
3216      * mechanisms are supported in future (e.g. TDX), they'll need
3217      * their own initialization either here or elsewhere.
3218      */
3219     if (ms->cgs) {
3220         ret = confidential_guest_kvm_init(ms->cgs, &local_err);
3221         if (ret < 0) {
3222             error_report_err(local_err);
3223             return ret;
3224         }
3225     }
3226 
3227     has_xcrs = kvm_check_extension(s, KVM_CAP_XCRS);
3228     has_sregs2 = kvm_check_extension(s, KVM_CAP_SREGS2) > 0;
3229 
3230     hv_vpindex_settable = kvm_check_extension(s, KVM_CAP_HYPERV_VP_INDEX);
3231 
3232     ret = kvm_vm_enable_exception_payload(s);
3233     if (ret < 0) {
3234         return ret;
3235     }
3236 
3237     ret = kvm_vm_enable_triple_fault_event(s);
3238     if (ret < 0) {
3239         return ret;
3240     }
3241 
3242     if (s->xen_version) {
3243 #ifdef CONFIG_XEN_EMU
3244         if (!object_dynamic_cast(OBJECT(ms), TYPE_PC_MACHINE)) {
3245             error_report("kvm: Xen support only available in PC machine");
3246             return -ENOTSUP;
3247         }
3248         /* hyperv_enabled() doesn't work yet. */
3249         uint32_t msr = XEN_HYPERCALL_MSR;
3250         ret = kvm_xen_init(s, msr);
3251         if (ret < 0) {
3252             return ret;
3253         }
3254 #else
3255         error_report("kvm: Xen support not enabled in qemu");
3256         return -ENOTSUP;
3257 #endif
3258     }
3259 
3260     ret = kvm_get_supported_msrs(s);
3261     if (ret < 0) {
3262         return ret;
3263     }
3264 
3265     ret = kvm_get_supported_feature_msrs(s);
3266     if (ret < 0) {
3267         return ret;
3268     }
3269 
3270     uname(&utsname);
3271     lm_capable_kernel = strcmp(utsname.machine, "x86_64") == 0;
3272 
3273     ret = kvm_vm_set_identity_map_addr(s, KVM_IDENTITY_BASE);
3274     if (ret < 0) {
3275         return ret;
3276     }
3277 
3278     /* Set TSS base one page after EPT identity map. */
3279     ret = kvm_vm_set_tss_addr(s, KVM_IDENTITY_BASE + 0x1000);
3280     if (ret < 0) {
3281         return ret;
3282     }
3283 
3284     /* Tell fw_cfg to notify the BIOS to reserve the range. */
3285     e820_add_entry(KVM_IDENTITY_BASE, 0x4000, E820_RESERVED);
3286 
3287     ret = kvm_vm_set_nr_mmu_pages(s);
3288     if (ret < 0) {
3289         return ret;
3290     }
3291 
3292     if (kvm_check_extension(s, KVM_CAP_X86_SMM) &&
3293         object_dynamic_cast(OBJECT(ms), TYPE_X86_MACHINE) &&
3294         x86_machine_is_smm_enabled(X86_MACHINE(ms))) {
3295         smram_machine_done.notify = register_smram_listener;
3296         qemu_add_machine_init_done_notifier(&smram_machine_done);
3297     }
3298 
3299     if (enable_cpu_pm) {
3300         ret = kvm_vm_enable_disable_exits(s);
3301         if (ret < 0) {
3302             error_report("kvm: guest stopping CPU not supported: %s",
3303                          strerror(-ret));
3304             return ret;
3305         }
3306     }
3307 
3308     if (object_dynamic_cast(OBJECT(ms), TYPE_X86_MACHINE)) {
3309         X86MachineState *x86ms = X86_MACHINE(ms);
3310 
3311         if (x86ms->bus_lock_ratelimit > 0) {
3312             ret = kvm_vm_enable_bus_lock_exit(s);
3313             if (ret < 0) {
3314                 return ret;
3315             }
3316             ratelimit_init(&bus_lock_ratelimit_ctrl);
3317             ratelimit_set_speed(&bus_lock_ratelimit_ctrl,
3318                                 x86ms->bus_lock_ratelimit, BUS_LOCK_SLICE_TIME);
3319         }
3320     }
3321 
3322     if (kvm_check_extension(s, KVM_CAP_X86_NOTIFY_VMEXIT)) {
3323         ret = kvm_vm_enable_notify_vmexit(s);
3324         if (ret < 0) {
3325             return ret;
3326         }
3327     }
3328 
3329     if (kvm_vm_check_extension(s, KVM_CAP_X86_USER_SPACE_MSR)) {
3330         ret = kvm_vm_enable_userspace_msr(s);
3331         if (ret < 0) {
3332             return ret;
3333         }
3334 
3335         if (s->msr_energy.enable == true) {
3336             ret = kvm_vm_enable_energy_msrs(s);
3337             if (ret < 0) {
3338                 return ret;
3339             }
3340 
3341             ret = kvm_msr_energy_thread_init(s, ms);
3342             if (ret < 0) {
3343                 error_report("kvm : error RAPL feature requirement not met");
3344                 return ret;
3345             }
3346         }
3347     }
3348 
3349     return 0;
3350 }
3351 
3352 static void set_v8086_seg(struct kvm_segment *lhs, const SegmentCache *rhs)
3353 {
3354     lhs->selector = rhs->selector;
3355     lhs->base = rhs->base;
3356     lhs->limit = rhs->limit;
3357     lhs->type = 3;
3358     lhs->present = 1;
3359     lhs->dpl = 3;
3360     lhs->db = 0;
3361     lhs->s = 1;
3362     lhs->l = 0;
3363     lhs->g = 0;
3364     lhs->avl = 0;
3365     lhs->unusable = 0;
3366 }
3367 
3368 static void set_seg(struct kvm_segment *lhs, const SegmentCache *rhs)
3369 {
3370     unsigned flags = rhs->flags;
3371     lhs->selector = rhs->selector;
3372     lhs->base = rhs->base;
3373     lhs->limit = rhs->limit;
3374     lhs->type = (flags >> DESC_TYPE_SHIFT) & 15;
3375     lhs->present = (flags & DESC_P_MASK) != 0;
3376     lhs->dpl = (flags >> DESC_DPL_SHIFT) & 3;
3377     lhs->db = (flags >> DESC_B_SHIFT) & 1;
3378     lhs->s = (flags & DESC_S_MASK) != 0;
3379     lhs->l = (flags >> DESC_L_SHIFT) & 1;
3380     lhs->g = (flags & DESC_G_MASK) != 0;
3381     lhs->avl = (flags & DESC_AVL_MASK) != 0;
3382     lhs->unusable = !lhs->present;
3383     lhs->padding = 0;
3384 }
3385 
3386 static void get_seg(SegmentCache *lhs, const struct kvm_segment *rhs)
3387 {
3388     lhs->selector = rhs->selector;
3389     lhs->base = rhs->base;
3390     lhs->limit = rhs->limit;
3391     lhs->flags = (rhs->type << DESC_TYPE_SHIFT) |
3392                  ((rhs->present && !rhs->unusable) * DESC_P_MASK) |
3393                  (rhs->dpl << DESC_DPL_SHIFT) |
3394                  (rhs->db << DESC_B_SHIFT) |
3395                  (rhs->s * DESC_S_MASK) |
3396                  (rhs->l << DESC_L_SHIFT) |
3397                  (rhs->g * DESC_G_MASK) |
3398                  (rhs->avl * DESC_AVL_MASK);
3399 }
3400 
3401 static void kvm_getput_reg(__u64 *kvm_reg, target_ulong *qemu_reg, int set)
3402 {
3403     if (set) {
3404         *kvm_reg = *qemu_reg;
3405     } else {
3406         *qemu_reg = *kvm_reg;
3407     }
3408 }
3409 
3410 static int kvm_getput_regs(X86CPU *cpu, int set)
3411 {
3412     CPUX86State *env = &cpu->env;
3413     struct kvm_regs regs;
3414     int ret = 0;
3415 
3416     if (!set) {
3417         ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_REGS, &regs);
3418         if (ret < 0) {
3419             return ret;
3420         }
3421     }
3422 
3423     kvm_getput_reg(&regs.rax, &env->regs[R_EAX], set);
3424     kvm_getput_reg(&regs.rbx, &env->regs[R_EBX], set);
3425     kvm_getput_reg(&regs.rcx, &env->regs[R_ECX], set);
3426     kvm_getput_reg(&regs.rdx, &env->regs[R_EDX], set);
3427     kvm_getput_reg(&regs.rsi, &env->regs[R_ESI], set);
3428     kvm_getput_reg(&regs.rdi, &env->regs[R_EDI], set);
3429     kvm_getput_reg(&regs.rsp, &env->regs[R_ESP], set);
3430     kvm_getput_reg(&regs.rbp, &env->regs[R_EBP], set);
3431 #ifdef TARGET_X86_64
3432     kvm_getput_reg(&regs.r8, &env->regs[8], set);
3433     kvm_getput_reg(&regs.r9, &env->regs[9], set);
3434     kvm_getput_reg(&regs.r10, &env->regs[10], set);
3435     kvm_getput_reg(&regs.r11, &env->regs[11], set);
3436     kvm_getput_reg(&regs.r12, &env->regs[12], set);
3437     kvm_getput_reg(&regs.r13, &env->regs[13], set);
3438     kvm_getput_reg(&regs.r14, &env->regs[14], set);
3439     kvm_getput_reg(&regs.r15, &env->regs[15], set);
3440 #endif
3441 
3442     kvm_getput_reg(&regs.rflags, &env->eflags, set);
3443     kvm_getput_reg(&regs.rip, &env->eip, set);
3444 
3445     if (set) {
3446         ret = kvm_vcpu_ioctl(CPU(cpu), KVM_SET_REGS, &regs);
3447     }
3448 
3449     return ret;
3450 }
3451 
3452 static int kvm_put_xsave(X86CPU *cpu)
3453 {
3454     CPUX86State *env = &cpu->env;
3455     void *xsave = env->xsave_buf;
3456 
3457     x86_cpu_xsave_all_areas(cpu, xsave, env->xsave_buf_len);
3458 
3459     return kvm_vcpu_ioctl(CPU(cpu), KVM_SET_XSAVE, xsave);
3460 }
3461 
3462 static int kvm_put_xcrs(X86CPU *cpu)
3463 {
3464     CPUX86State *env = &cpu->env;
3465     struct kvm_xcrs xcrs = {};
3466 
3467     if (!has_xcrs) {
3468         return 0;
3469     }
3470 
3471     xcrs.nr_xcrs = 1;
3472     xcrs.flags = 0;
3473     xcrs.xcrs[0].xcr = 0;
3474     xcrs.xcrs[0].value = env->xcr0;
3475     return kvm_vcpu_ioctl(CPU(cpu), KVM_SET_XCRS, &xcrs);
3476 }
3477 
3478 static int kvm_put_sregs(X86CPU *cpu)
3479 {
3480     CPUX86State *env = &cpu->env;
3481     struct kvm_sregs sregs;
3482 
3483     /*
3484      * The interrupt_bitmap is ignored because KVM_SET_SREGS is
3485      * always followed by KVM_SET_VCPU_EVENTS.
3486      */
3487     memset(sregs.interrupt_bitmap, 0, sizeof(sregs.interrupt_bitmap));
3488 
3489     if ((env->eflags & VM_MASK)) {
3490         set_v8086_seg(&sregs.cs, &env->segs[R_CS]);
3491         set_v8086_seg(&sregs.ds, &env->segs[R_DS]);
3492         set_v8086_seg(&sregs.es, &env->segs[R_ES]);
3493         set_v8086_seg(&sregs.fs, &env->segs[R_FS]);
3494         set_v8086_seg(&sregs.gs, &env->segs[R_GS]);
3495         set_v8086_seg(&sregs.ss, &env->segs[R_SS]);
3496     } else {
3497         set_seg(&sregs.cs, &env->segs[R_CS]);
3498         set_seg(&sregs.ds, &env->segs[R_DS]);
3499         set_seg(&sregs.es, &env->segs[R_ES]);
3500         set_seg(&sregs.fs, &env->segs[R_FS]);
3501         set_seg(&sregs.gs, &env->segs[R_GS]);
3502         set_seg(&sregs.ss, &env->segs[R_SS]);
3503     }
3504 
3505     set_seg(&sregs.tr, &env->tr);
3506     set_seg(&sregs.ldt, &env->ldt);
3507 
3508     sregs.idt.limit = env->idt.limit;
3509     sregs.idt.base = env->idt.base;
3510     memset(sregs.idt.padding, 0, sizeof sregs.idt.padding);
3511     sregs.gdt.limit = env->gdt.limit;
3512     sregs.gdt.base = env->gdt.base;
3513     memset(sregs.gdt.padding, 0, sizeof sregs.gdt.padding);
3514 
3515     sregs.cr0 = env->cr[0];
3516     sregs.cr2 = env->cr[2];
3517     sregs.cr3 = env->cr[3];
3518     sregs.cr4 = env->cr[4];
3519 
3520     sregs.cr8 = cpu_get_apic_tpr(cpu->apic_state);
3521     sregs.apic_base = cpu_get_apic_base(cpu->apic_state);
3522 
3523     sregs.efer = env->efer;
3524 
3525     return kvm_vcpu_ioctl(CPU(cpu), KVM_SET_SREGS, &sregs);
3526 }
3527 
3528 static int kvm_put_sregs2(X86CPU *cpu)
3529 {
3530     CPUX86State *env = &cpu->env;
3531     struct kvm_sregs2 sregs;
3532     int i;
3533 
3534     sregs.flags = 0;
3535 
3536     if ((env->eflags & VM_MASK)) {
3537         set_v8086_seg(&sregs.cs, &env->segs[R_CS]);
3538         set_v8086_seg(&sregs.ds, &env->segs[R_DS]);
3539         set_v8086_seg(&sregs.es, &env->segs[R_ES]);
3540         set_v8086_seg(&sregs.fs, &env->segs[R_FS]);
3541         set_v8086_seg(&sregs.gs, &env->segs[R_GS]);
3542         set_v8086_seg(&sregs.ss, &env->segs[R_SS]);
3543     } else {
3544         set_seg(&sregs.cs, &env->segs[R_CS]);
3545         set_seg(&sregs.ds, &env->segs[R_DS]);
3546         set_seg(&sregs.es, &env->segs[R_ES]);
3547         set_seg(&sregs.fs, &env->segs[R_FS]);
3548         set_seg(&sregs.gs, &env->segs[R_GS]);
3549         set_seg(&sregs.ss, &env->segs[R_SS]);
3550     }
3551 
3552     set_seg(&sregs.tr, &env->tr);
3553     set_seg(&sregs.ldt, &env->ldt);
3554 
3555     sregs.idt.limit = env->idt.limit;
3556     sregs.idt.base = env->idt.base;
3557     memset(sregs.idt.padding, 0, sizeof sregs.idt.padding);
3558     sregs.gdt.limit = env->gdt.limit;
3559     sregs.gdt.base = env->gdt.base;
3560     memset(sregs.gdt.padding, 0, sizeof sregs.gdt.padding);
3561 
3562     sregs.cr0 = env->cr[0];
3563     sregs.cr2 = env->cr[2];
3564     sregs.cr3 = env->cr[3];
3565     sregs.cr4 = env->cr[4];
3566 
3567     sregs.cr8 = cpu_get_apic_tpr(cpu->apic_state);
3568     sregs.apic_base = cpu_get_apic_base(cpu->apic_state);
3569 
3570     sregs.efer = env->efer;
3571 
3572     if (env->pdptrs_valid) {
3573         for (i = 0; i < 4; i++) {
3574             sregs.pdptrs[i] = env->pdptrs[i];
3575         }
3576         sregs.flags |= KVM_SREGS2_FLAGS_PDPTRS_VALID;
3577     }
3578 
3579     return kvm_vcpu_ioctl(CPU(cpu), KVM_SET_SREGS2, &sregs);
3580 }
3581 
3582 
3583 static void kvm_msr_buf_reset(X86CPU *cpu)
3584 {
3585     memset(cpu->kvm_msr_buf, 0, MSR_BUF_SIZE);
3586 }
3587 
3588 static void kvm_msr_entry_add(X86CPU *cpu, uint32_t index, uint64_t value)
3589 {
3590     struct kvm_msrs *msrs = cpu->kvm_msr_buf;
3591     void *limit = ((void *)msrs) + MSR_BUF_SIZE;
3592     struct kvm_msr_entry *entry = &msrs->entries[msrs->nmsrs];
3593 
3594     assert((void *)(entry + 1) <= limit);
3595 
3596     entry->index = index;
3597     entry->reserved = 0;
3598     entry->data = value;
3599     msrs->nmsrs++;
3600 }
3601 
3602 static int kvm_put_one_msr(X86CPU *cpu, int index, uint64_t value)
3603 {
3604     kvm_msr_buf_reset(cpu);
3605     kvm_msr_entry_add(cpu, index, value);
3606 
3607     return kvm_vcpu_ioctl(CPU(cpu), KVM_SET_MSRS, cpu->kvm_msr_buf);
3608 }
3609 
3610 static int kvm_get_one_msr(X86CPU *cpu, int index, uint64_t *value)
3611 {
3612     int ret;
3613     struct {
3614         struct kvm_msrs info;
3615         struct kvm_msr_entry entries[1];
3616     } msr_data = {
3617         .info.nmsrs = 1,
3618         .entries[0].index = index,
3619     };
3620 
3621     ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_MSRS, &msr_data);
3622     if (ret < 0) {
3623         return ret;
3624     }
3625     assert(ret == 1);
3626     *value = msr_data.entries[0].data;
3627     return ret;
3628 }
3629 void kvm_put_apicbase(X86CPU *cpu, uint64_t value)
3630 {
3631     int ret;
3632 
3633     ret = kvm_put_one_msr(cpu, MSR_IA32_APICBASE, value);
3634     assert(ret == 1);
3635 }
3636 
3637 static int kvm_put_tscdeadline_msr(X86CPU *cpu)
3638 {
3639     CPUX86State *env = &cpu->env;
3640     int ret;
3641 
3642     if (!has_msr_tsc_deadline) {
3643         return 0;
3644     }
3645 
3646     ret = kvm_put_one_msr(cpu, MSR_IA32_TSCDEADLINE, env->tsc_deadline);
3647     if (ret < 0) {
3648         return ret;
3649     }
3650 
3651     assert(ret == 1);
3652     return 0;
3653 }
3654 
3655 /*
3656  * Provide a separate write service for the feature control MSR in order to
3657  * kick the VCPU out of VMXON or even guest mode on reset. This has to be done
3658  * before writing any other state because forcibly leaving nested mode
3659  * invalidates the VCPU state.
3660  */
3661 static int kvm_put_msr_feature_control(X86CPU *cpu)
3662 {
3663     int ret;
3664 
3665     if (!has_msr_feature_control) {
3666         return 0;
3667     }
3668 
3669     ret = kvm_put_one_msr(cpu, MSR_IA32_FEATURE_CONTROL,
3670                           cpu->env.msr_ia32_feature_control);
3671     if (ret < 0) {
3672         return ret;
3673     }
3674 
3675     assert(ret == 1);
3676     return 0;
3677 }
3678 
3679 static uint64_t make_vmx_msr_value(uint32_t index, uint32_t features)
3680 {
3681     uint32_t default1, can_be_one, can_be_zero;
3682     uint32_t must_be_one;
3683 
3684     switch (index) {
3685     case MSR_IA32_VMX_TRUE_PINBASED_CTLS:
3686         default1 = 0x00000016;
3687         break;
3688     case MSR_IA32_VMX_TRUE_PROCBASED_CTLS:
3689         default1 = 0x0401e172;
3690         break;
3691     case MSR_IA32_VMX_TRUE_ENTRY_CTLS:
3692         default1 = 0x000011ff;
3693         break;
3694     case MSR_IA32_VMX_TRUE_EXIT_CTLS:
3695         default1 = 0x00036dff;
3696         break;
3697     case MSR_IA32_VMX_PROCBASED_CTLS2:
3698         default1 = 0;
3699         break;
3700     default:
3701         abort();
3702     }
3703 
3704     /* If a feature bit is set, the control can be either set or clear.
3705      * Otherwise the value is limited to either 0 or 1 by default1.
3706      */
3707     can_be_one = features | default1;
3708     can_be_zero = features | ~default1;
3709     must_be_one = ~can_be_zero;
3710 
3711     /*
3712      * Bit 0:31 -> 0 if the control bit can be zero (i.e. 1 if it must be one).
3713      * Bit 32:63 -> 1 if the control bit can be one.
3714      */
3715     return must_be_one | (((uint64_t)can_be_one) << 32);
3716 }
3717 
3718 static void kvm_msr_entry_add_vmx(X86CPU *cpu, FeatureWordArray f)
3719 {
3720     uint64_t kvm_vmx_basic =
3721         kvm_arch_get_supported_msr_feature(kvm_state,
3722                                            MSR_IA32_VMX_BASIC);
3723 
3724     if (!kvm_vmx_basic) {
3725         /* If the kernel doesn't support VMX feature (kvm_intel.nested=0),
3726          * then kvm_vmx_basic will be 0 and KVM_SET_MSR will fail.
3727          */
3728         return;
3729     }
3730 
3731     uint64_t kvm_vmx_misc =
3732         kvm_arch_get_supported_msr_feature(kvm_state,
3733                                            MSR_IA32_VMX_MISC);
3734     uint64_t kvm_vmx_ept_vpid =
3735         kvm_arch_get_supported_msr_feature(kvm_state,
3736                                            MSR_IA32_VMX_EPT_VPID_CAP);
3737 
3738     /*
3739      * If the guest is 64-bit, a value of 1 is allowed for the host address
3740      * space size vmexit control.
3741      */
3742     uint64_t fixed_vmx_exit = f[FEAT_8000_0001_EDX] & CPUID_EXT2_LM
3743         ? (uint64_t)VMX_VM_EXIT_HOST_ADDR_SPACE_SIZE << 32 : 0;
3744 
3745     /*
3746      * Bits 0-30, 32-44 and 50-53 come from the host.  KVM should
3747      * not change them for backwards compatibility.
3748      */
3749     uint64_t fixed_vmx_basic = kvm_vmx_basic &
3750         (MSR_VMX_BASIC_VMCS_REVISION_MASK |
3751          MSR_VMX_BASIC_VMXON_REGION_SIZE_MASK |
3752          MSR_VMX_BASIC_VMCS_MEM_TYPE_MASK);
3753 
3754     /*
3755      * Same for bits 0-4 and 25-27.  Bits 16-24 (CR3 target count) can
3756      * change in the future but are always zero for now, clear them to be
3757      * future proof.  Bits 32-63 in theory could change, though KVM does
3758      * not support dual-monitor treatment and probably never will; mask
3759      * them out as well.
3760      */
3761     uint64_t fixed_vmx_misc = kvm_vmx_misc &
3762         (MSR_VMX_MISC_PREEMPTION_TIMER_SHIFT_MASK |
3763          MSR_VMX_MISC_MAX_MSR_LIST_SIZE_MASK);
3764 
3765     /*
3766      * EPT memory types should not change either, so we do not bother
3767      * adding features for them.
3768      */
3769     uint64_t fixed_vmx_ept_mask =
3770             (f[FEAT_VMX_SECONDARY_CTLS] & VMX_SECONDARY_EXEC_ENABLE_EPT ?
3771              MSR_VMX_EPT_UC | MSR_VMX_EPT_WB : 0);
3772     uint64_t fixed_vmx_ept_vpid = kvm_vmx_ept_vpid & fixed_vmx_ept_mask;
3773 
3774     kvm_msr_entry_add(cpu, MSR_IA32_VMX_TRUE_PROCBASED_CTLS,
3775                       make_vmx_msr_value(MSR_IA32_VMX_TRUE_PROCBASED_CTLS,
3776                                          f[FEAT_VMX_PROCBASED_CTLS]));
3777     kvm_msr_entry_add(cpu, MSR_IA32_VMX_TRUE_PINBASED_CTLS,
3778                       make_vmx_msr_value(MSR_IA32_VMX_TRUE_PINBASED_CTLS,
3779                                          f[FEAT_VMX_PINBASED_CTLS]));
3780     kvm_msr_entry_add(cpu, MSR_IA32_VMX_TRUE_EXIT_CTLS,
3781                       make_vmx_msr_value(MSR_IA32_VMX_TRUE_EXIT_CTLS,
3782                                          f[FEAT_VMX_EXIT_CTLS]) | fixed_vmx_exit);
3783     kvm_msr_entry_add(cpu, MSR_IA32_VMX_TRUE_ENTRY_CTLS,
3784                       make_vmx_msr_value(MSR_IA32_VMX_TRUE_ENTRY_CTLS,
3785                                          f[FEAT_VMX_ENTRY_CTLS]));
3786     kvm_msr_entry_add(cpu, MSR_IA32_VMX_PROCBASED_CTLS2,
3787                       make_vmx_msr_value(MSR_IA32_VMX_PROCBASED_CTLS2,
3788                                          f[FEAT_VMX_SECONDARY_CTLS]));
3789     kvm_msr_entry_add(cpu, MSR_IA32_VMX_EPT_VPID_CAP,
3790                       f[FEAT_VMX_EPT_VPID_CAPS] | fixed_vmx_ept_vpid);
3791     kvm_msr_entry_add(cpu, MSR_IA32_VMX_BASIC,
3792                       f[FEAT_VMX_BASIC] | fixed_vmx_basic);
3793     kvm_msr_entry_add(cpu, MSR_IA32_VMX_MISC,
3794                       f[FEAT_VMX_MISC] | fixed_vmx_misc);
3795     if (has_msr_vmx_vmfunc) {
3796         kvm_msr_entry_add(cpu, MSR_IA32_VMX_VMFUNC, f[FEAT_VMX_VMFUNC]);
3797     }
3798 
3799     /*
3800      * Just to be safe, write these with constant values.  The CRn_FIXED1
3801      * MSRs are generated by KVM based on the vCPU's CPUID.
3802      */
3803     kvm_msr_entry_add(cpu, MSR_IA32_VMX_CR0_FIXED0,
3804                       CR0_PE_MASK | CR0_PG_MASK | CR0_NE_MASK);
3805     kvm_msr_entry_add(cpu, MSR_IA32_VMX_CR4_FIXED0,
3806                       CR4_VMXE_MASK);
3807 
3808     if (f[FEAT_7_1_EAX] & CPUID_7_1_EAX_FRED) {
3809         /* FRED injected-event data (0x2052).  */
3810         kvm_msr_entry_add(cpu, MSR_IA32_VMX_VMCS_ENUM, 0x52);
3811     } else if (f[FEAT_VMX_EXIT_CTLS] &
3812                VMX_VM_EXIT_ACTIVATE_SECONDARY_CONTROLS) {
3813         /* Secondary VM-exit controls (0x2044).  */
3814         kvm_msr_entry_add(cpu, MSR_IA32_VMX_VMCS_ENUM, 0x44);
3815     } else if (f[FEAT_VMX_SECONDARY_CTLS] & VMX_SECONDARY_EXEC_TSC_SCALING) {
3816         /* TSC multiplier (0x2032).  */
3817         kvm_msr_entry_add(cpu, MSR_IA32_VMX_VMCS_ENUM, 0x32);
3818     } else {
3819         /* Preemption timer (0x482E).  */
3820         kvm_msr_entry_add(cpu, MSR_IA32_VMX_VMCS_ENUM, 0x2E);
3821     }
3822 }
3823 
3824 static void kvm_msr_entry_add_perf(X86CPU *cpu, FeatureWordArray f)
3825 {
3826     uint64_t kvm_perf_cap =
3827         kvm_arch_get_supported_msr_feature(kvm_state,
3828                                            MSR_IA32_PERF_CAPABILITIES);
3829 
3830     if (kvm_perf_cap) {
3831         kvm_msr_entry_add(cpu, MSR_IA32_PERF_CAPABILITIES,
3832                         kvm_perf_cap & f[FEAT_PERF_CAPABILITIES]);
3833     }
3834 }
3835 
3836 static int kvm_buf_set_msrs(X86CPU *cpu)
3837 {
3838     int ret = kvm_vcpu_ioctl(CPU(cpu), KVM_SET_MSRS, cpu->kvm_msr_buf);
3839     if (ret < 0) {
3840         return ret;
3841     }
3842 
3843     if (ret < cpu->kvm_msr_buf->nmsrs) {
3844         struct kvm_msr_entry *e = &cpu->kvm_msr_buf->entries[ret];
3845         error_report("error: failed to set MSR 0x%" PRIx32 " to 0x%" PRIx64,
3846                      (uint32_t)e->index, (uint64_t)e->data);
3847     }
3848 
3849     assert(ret == cpu->kvm_msr_buf->nmsrs);
3850     return 0;
3851 }
3852 
3853 static void kvm_init_msrs(X86CPU *cpu)
3854 {
3855     CPUX86State *env = &cpu->env;
3856 
3857     kvm_msr_buf_reset(cpu);
3858     if (has_msr_arch_capabs) {
3859         kvm_msr_entry_add(cpu, MSR_IA32_ARCH_CAPABILITIES,
3860                           env->features[FEAT_ARCH_CAPABILITIES]);
3861     }
3862 
3863     if (has_msr_core_capabs) {
3864         kvm_msr_entry_add(cpu, MSR_IA32_CORE_CAPABILITY,
3865                           env->features[FEAT_CORE_CAPABILITY]);
3866     }
3867 
3868     if (has_msr_perf_capabs && cpu->enable_pmu) {
3869         kvm_msr_entry_add_perf(cpu, env->features);
3870     }
3871 
3872     if (has_msr_ucode_rev) {
3873         kvm_msr_entry_add(cpu, MSR_IA32_UCODE_REV, cpu->ucode_rev);
3874     }
3875 
3876     /*
3877      * Older kernels do not include VMX MSRs in KVM_GET_MSR_INDEX_LIST, but
3878      * all kernels with MSR features should have them.
3879      */
3880     if (kvm_feature_msrs && cpu_has_vmx(env)) {
3881         kvm_msr_entry_add_vmx(cpu, env->features);
3882     }
3883 
3884     assert(kvm_buf_set_msrs(cpu) == 0);
3885 }
3886 
3887 static int kvm_put_msrs(X86CPU *cpu, int level)
3888 {
3889     CPUX86State *env = &cpu->env;
3890     int i;
3891 
3892     kvm_msr_buf_reset(cpu);
3893 
3894     kvm_msr_entry_add(cpu, MSR_IA32_SYSENTER_CS, env->sysenter_cs);
3895     kvm_msr_entry_add(cpu, MSR_IA32_SYSENTER_ESP, env->sysenter_esp);
3896     kvm_msr_entry_add(cpu, MSR_IA32_SYSENTER_EIP, env->sysenter_eip);
3897     kvm_msr_entry_add(cpu, MSR_PAT, env->pat);
3898     if (has_msr_star) {
3899         kvm_msr_entry_add(cpu, MSR_STAR, env->star);
3900     }
3901     if (has_msr_hsave_pa) {
3902         kvm_msr_entry_add(cpu, MSR_VM_HSAVE_PA, env->vm_hsave);
3903     }
3904     if (has_msr_tsc_aux) {
3905         kvm_msr_entry_add(cpu, MSR_TSC_AUX, env->tsc_aux);
3906     }
3907     if (has_msr_tsc_adjust) {
3908         kvm_msr_entry_add(cpu, MSR_TSC_ADJUST, env->tsc_adjust);
3909     }
3910     if (has_msr_misc_enable) {
3911         kvm_msr_entry_add(cpu, MSR_IA32_MISC_ENABLE,
3912                           env->msr_ia32_misc_enable);
3913     }
3914     if (has_msr_smbase) {
3915         kvm_msr_entry_add(cpu, MSR_IA32_SMBASE, env->smbase);
3916     }
3917     if (has_msr_smi_count) {
3918         kvm_msr_entry_add(cpu, MSR_SMI_COUNT, env->msr_smi_count);
3919     }
3920     if (has_msr_pkrs) {
3921         kvm_msr_entry_add(cpu, MSR_IA32_PKRS, env->pkrs);
3922     }
3923     if (has_msr_bndcfgs) {
3924         kvm_msr_entry_add(cpu, MSR_IA32_BNDCFGS, env->msr_bndcfgs);
3925     }
3926     if (has_msr_xss) {
3927         kvm_msr_entry_add(cpu, MSR_IA32_XSS, env->xss);
3928     }
3929     if (has_msr_umwait) {
3930         kvm_msr_entry_add(cpu, MSR_IA32_UMWAIT_CONTROL, env->umwait);
3931     }
3932     if (has_msr_spec_ctrl) {
3933         kvm_msr_entry_add(cpu, MSR_IA32_SPEC_CTRL, env->spec_ctrl);
3934     }
3935     if (has_tsc_scale_msr) {
3936         kvm_msr_entry_add(cpu, MSR_AMD64_TSC_RATIO, env->amd_tsc_scale_msr);
3937     }
3938 
3939     if (has_msr_tsx_ctrl) {
3940         kvm_msr_entry_add(cpu, MSR_IA32_TSX_CTRL, env->tsx_ctrl);
3941     }
3942     if (has_msr_virt_ssbd) {
3943         kvm_msr_entry_add(cpu, MSR_VIRT_SSBD, env->virt_ssbd);
3944     }
3945     if (has_msr_hwcr) {
3946         kvm_msr_entry_add(cpu, MSR_K7_HWCR, env->msr_hwcr);
3947     }
3948 
3949 #ifdef TARGET_X86_64
3950     if (lm_capable_kernel) {
3951         kvm_msr_entry_add(cpu, MSR_CSTAR, env->cstar);
3952         kvm_msr_entry_add(cpu, MSR_KERNELGSBASE, env->kernelgsbase);
3953         kvm_msr_entry_add(cpu, MSR_FMASK, env->fmask);
3954         kvm_msr_entry_add(cpu, MSR_LSTAR, env->lstar);
3955         if (env->features[FEAT_7_1_EAX] & CPUID_7_1_EAX_FRED) {
3956             kvm_msr_entry_add(cpu, MSR_IA32_FRED_RSP0, env->fred_rsp0);
3957             kvm_msr_entry_add(cpu, MSR_IA32_FRED_RSP1, env->fred_rsp1);
3958             kvm_msr_entry_add(cpu, MSR_IA32_FRED_RSP2, env->fred_rsp2);
3959             kvm_msr_entry_add(cpu, MSR_IA32_FRED_RSP3, env->fred_rsp3);
3960             kvm_msr_entry_add(cpu, MSR_IA32_FRED_STKLVLS, env->fred_stklvls);
3961             kvm_msr_entry_add(cpu, MSR_IA32_FRED_SSP1, env->fred_ssp1);
3962             kvm_msr_entry_add(cpu, MSR_IA32_FRED_SSP2, env->fred_ssp2);
3963             kvm_msr_entry_add(cpu, MSR_IA32_FRED_SSP3, env->fred_ssp3);
3964             kvm_msr_entry_add(cpu, MSR_IA32_FRED_CONFIG, env->fred_config);
3965         }
3966     }
3967 #endif
3968 
3969     /*
3970      * The following MSRs have side effects on the guest or are too heavy
3971      * for normal writeback. Limit them to reset or full state updates.
3972      */
3973     if (level >= KVM_PUT_RESET_STATE) {
3974         kvm_msr_entry_add(cpu, MSR_IA32_TSC, env->tsc);
3975         if (env->features[FEAT_KVM] & (CPUID_KVM_CLOCK | CPUID_KVM_CLOCK2)) {
3976             kvm_msr_entry_add(cpu, MSR_KVM_SYSTEM_TIME, env->system_time_msr);
3977             kvm_msr_entry_add(cpu, MSR_KVM_WALL_CLOCK, env->wall_clock_msr);
3978         }
3979         if (env->features[FEAT_KVM] & CPUID_KVM_ASYNCPF_INT) {
3980             kvm_msr_entry_add(cpu, MSR_KVM_ASYNC_PF_INT, env->async_pf_int_msr);
3981         }
3982         if (env->features[FEAT_KVM] & CPUID_KVM_ASYNCPF) {
3983             kvm_msr_entry_add(cpu, MSR_KVM_ASYNC_PF_EN, env->async_pf_en_msr);
3984         }
3985         if (env->features[FEAT_KVM] & CPUID_KVM_PV_EOI) {
3986             kvm_msr_entry_add(cpu, MSR_KVM_PV_EOI_EN, env->pv_eoi_en_msr);
3987         }
3988         if (env->features[FEAT_KVM] & CPUID_KVM_STEAL_TIME) {
3989             kvm_msr_entry_add(cpu, MSR_KVM_STEAL_TIME, env->steal_time_msr);
3990         }
3991 
3992         if (env->features[FEAT_KVM] & CPUID_KVM_POLL_CONTROL) {
3993             kvm_msr_entry_add(cpu, MSR_KVM_POLL_CONTROL, env->poll_control_msr);
3994         }
3995 
3996         if (has_architectural_pmu_version > 0) {
3997             if (has_architectural_pmu_version > 1) {
3998                 /* Stop the counter.  */
3999                 kvm_msr_entry_add(cpu, MSR_CORE_PERF_FIXED_CTR_CTRL, 0);
4000                 kvm_msr_entry_add(cpu, MSR_CORE_PERF_GLOBAL_CTRL, 0);
4001             }
4002 
4003             /* Set the counter values.  */
4004             for (i = 0; i < num_architectural_pmu_fixed_counters; i++) {
4005                 kvm_msr_entry_add(cpu, MSR_CORE_PERF_FIXED_CTR0 + i,
4006                                   env->msr_fixed_counters[i]);
4007             }
4008             for (i = 0; i < num_architectural_pmu_gp_counters; i++) {
4009                 kvm_msr_entry_add(cpu, MSR_P6_PERFCTR0 + i,
4010                                   env->msr_gp_counters[i]);
4011                 kvm_msr_entry_add(cpu, MSR_P6_EVNTSEL0 + i,
4012                                   env->msr_gp_evtsel[i]);
4013             }
4014             if (has_architectural_pmu_version > 1) {
4015                 kvm_msr_entry_add(cpu, MSR_CORE_PERF_GLOBAL_STATUS,
4016                                   env->msr_global_status);
4017                 kvm_msr_entry_add(cpu, MSR_CORE_PERF_GLOBAL_OVF_CTRL,
4018                                   env->msr_global_ovf_ctrl);
4019 
4020                 /* Now start the PMU.  */
4021                 kvm_msr_entry_add(cpu, MSR_CORE_PERF_FIXED_CTR_CTRL,
4022                                   env->msr_fixed_ctr_ctrl);
4023                 kvm_msr_entry_add(cpu, MSR_CORE_PERF_GLOBAL_CTRL,
4024                                   env->msr_global_ctrl);
4025             }
4026         }
4027         /*
4028          * Hyper-V partition-wide MSRs: to avoid clearing them on cpu hot-add,
4029          * only sync them to KVM on the first cpu
4030          */
4031         if (current_cpu == first_cpu) {
4032             if (has_msr_hv_hypercall) {
4033                 kvm_msr_entry_add(cpu, HV_X64_MSR_GUEST_OS_ID,
4034                                   env->msr_hv_guest_os_id);
4035                 kvm_msr_entry_add(cpu, HV_X64_MSR_HYPERCALL,
4036                                   env->msr_hv_hypercall);
4037             }
4038             if (hyperv_feat_enabled(cpu, HYPERV_FEAT_TIME)) {
4039                 kvm_msr_entry_add(cpu, HV_X64_MSR_REFERENCE_TSC,
4040                                   env->msr_hv_tsc);
4041             }
4042             if (hyperv_feat_enabled(cpu, HYPERV_FEAT_REENLIGHTENMENT)) {
4043                 kvm_msr_entry_add(cpu, HV_X64_MSR_REENLIGHTENMENT_CONTROL,
4044                                   env->msr_hv_reenlightenment_control);
4045                 kvm_msr_entry_add(cpu, HV_X64_MSR_TSC_EMULATION_CONTROL,
4046                                   env->msr_hv_tsc_emulation_control);
4047                 kvm_msr_entry_add(cpu, HV_X64_MSR_TSC_EMULATION_STATUS,
4048                                   env->msr_hv_tsc_emulation_status);
4049             }
4050             if (hyperv_feat_enabled(cpu, HYPERV_FEAT_SYNDBG) &&
4051                 has_msr_hv_syndbg_options) {
4052                 kvm_msr_entry_add(cpu, HV_X64_MSR_SYNDBG_OPTIONS,
4053                                   hyperv_syndbg_query_options());
4054             }
4055         }
4056         if (hyperv_feat_enabled(cpu, HYPERV_FEAT_VAPIC)) {
4057             kvm_msr_entry_add(cpu, HV_X64_MSR_APIC_ASSIST_PAGE,
4058                               env->msr_hv_vapic);
4059         }
4060         if (has_msr_hv_crash) {
4061             int j;
4062 
4063             for (j = 0; j < HV_CRASH_PARAMS; j++)
4064                 kvm_msr_entry_add(cpu, HV_X64_MSR_CRASH_P0 + j,
4065                                   env->msr_hv_crash_params[j]);
4066 
4067             kvm_msr_entry_add(cpu, HV_X64_MSR_CRASH_CTL, HV_CRASH_CTL_NOTIFY);
4068         }
4069         if (has_msr_hv_runtime) {
4070             kvm_msr_entry_add(cpu, HV_X64_MSR_VP_RUNTIME, env->msr_hv_runtime);
4071         }
4072         if (hyperv_feat_enabled(cpu, HYPERV_FEAT_VPINDEX)
4073             && hv_vpindex_settable) {
4074             kvm_msr_entry_add(cpu, HV_X64_MSR_VP_INDEX,
4075                               hyperv_vp_index(CPU(cpu)));
4076         }
4077         if (hyperv_feat_enabled(cpu, HYPERV_FEAT_SYNIC)) {
4078             int j;
4079 
4080             kvm_msr_entry_add(cpu, HV_X64_MSR_SVERSION, HV_SYNIC_VERSION);
4081 
4082             kvm_msr_entry_add(cpu, HV_X64_MSR_SCONTROL,
4083                               env->msr_hv_synic_control);
4084             kvm_msr_entry_add(cpu, HV_X64_MSR_SIEFP,
4085                               env->msr_hv_synic_evt_page);
4086             kvm_msr_entry_add(cpu, HV_X64_MSR_SIMP,
4087                               env->msr_hv_synic_msg_page);
4088 
4089             for (j = 0; j < ARRAY_SIZE(env->msr_hv_synic_sint); j++) {
4090                 kvm_msr_entry_add(cpu, HV_X64_MSR_SINT0 + j,
4091                                   env->msr_hv_synic_sint[j]);
4092             }
4093         }
4094         if (has_msr_hv_stimer) {
4095             int j;
4096 
4097             for (j = 0; j < ARRAY_SIZE(env->msr_hv_stimer_config); j++) {
4098                 kvm_msr_entry_add(cpu, HV_X64_MSR_STIMER0_CONFIG + j * 2,
4099                                 env->msr_hv_stimer_config[j]);
4100             }
4101 
4102             for (j = 0; j < ARRAY_SIZE(env->msr_hv_stimer_count); j++) {
4103                 kvm_msr_entry_add(cpu, HV_X64_MSR_STIMER0_COUNT + j * 2,
4104                                 env->msr_hv_stimer_count[j]);
4105             }
4106         }
4107         if (env->features[FEAT_1_EDX] & CPUID_MTRR) {
4108             uint64_t phys_mask = MAKE_64BIT_MASK(0, cpu->phys_bits);
4109 
4110             kvm_msr_entry_add(cpu, MSR_MTRRdefType, env->mtrr_deftype);
4111             kvm_msr_entry_add(cpu, MSR_MTRRfix64K_00000, env->mtrr_fixed[0]);
4112             kvm_msr_entry_add(cpu, MSR_MTRRfix16K_80000, env->mtrr_fixed[1]);
4113             kvm_msr_entry_add(cpu, MSR_MTRRfix16K_A0000, env->mtrr_fixed[2]);
4114             kvm_msr_entry_add(cpu, MSR_MTRRfix4K_C0000, env->mtrr_fixed[3]);
4115             kvm_msr_entry_add(cpu, MSR_MTRRfix4K_C8000, env->mtrr_fixed[4]);
4116             kvm_msr_entry_add(cpu, MSR_MTRRfix4K_D0000, env->mtrr_fixed[5]);
4117             kvm_msr_entry_add(cpu, MSR_MTRRfix4K_D8000, env->mtrr_fixed[6]);
4118             kvm_msr_entry_add(cpu, MSR_MTRRfix4K_E0000, env->mtrr_fixed[7]);
4119             kvm_msr_entry_add(cpu, MSR_MTRRfix4K_E8000, env->mtrr_fixed[8]);
4120             kvm_msr_entry_add(cpu, MSR_MTRRfix4K_F0000, env->mtrr_fixed[9]);
4121             kvm_msr_entry_add(cpu, MSR_MTRRfix4K_F8000, env->mtrr_fixed[10]);
4122             for (i = 0; i < MSR_MTRRcap_VCNT; i++) {
4123                 /* The CPU GPs if we write to a bit above the physical limit of
4124                  * the host CPU (and KVM emulates that)
4125                  */
4126                 uint64_t mask = env->mtrr_var[i].mask;
4127                 mask &= phys_mask;
4128 
4129                 kvm_msr_entry_add(cpu, MSR_MTRRphysBase(i),
4130                                   env->mtrr_var[i].base);
4131                 kvm_msr_entry_add(cpu, MSR_MTRRphysMask(i), mask);
4132             }
4133         }
4134         if (env->features[FEAT_7_0_EBX] & CPUID_7_0_EBX_INTEL_PT) {
4135             int addr_num = kvm_arch_get_supported_cpuid(kvm_state,
4136                                                     0x14, 1, R_EAX) & 0x7;
4137 
4138             kvm_msr_entry_add(cpu, MSR_IA32_RTIT_CTL,
4139                             env->msr_rtit_ctrl);
4140             kvm_msr_entry_add(cpu, MSR_IA32_RTIT_STATUS,
4141                             env->msr_rtit_status);
4142             kvm_msr_entry_add(cpu, MSR_IA32_RTIT_OUTPUT_BASE,
4143                             env->msr_rtit_output_base);
4144             kvm_msr_entry_add(cpu, MSR_IA32_RTIT_OUTPUT_MASK,
4145                             env->msr_rtit_output_mask);
4146             kvm_msr_entry_add(cpu, MSR_IA32_RTIT_CR3_MATCH,
4147                             env->msr_rtit_cr3_match);
4148             for (i = 0; i < addr_num; i++) {
4149                 kvm_msr_entry_add(cpu, MSR_IA32_RTIT_ADDR0_A + i,
4150                             env->msr_rtit_addrs[i]);
4151             }
4152         }
4153 
4154         if (env->features[FEAT_7_0_ECX] & CPUID_7_0_ECX_SGX_LC) {
4155             kvm_msr_entry_add(cpu, MSR_IA32_SGXLEPUBKEYHASH0,
4156                               env->msr_ia32_sgxlepubkeyhash[0]);
4157             kvm_msr_entry_add(cpu, MSR_IA32_SGXLEPUBKEYHASH1,
4158                               env->msr_ia32_sgxlepubkeyhash[1]);
4159             kvm_msr_entry_add(cpu, MSR_IA32_SGXLEPUBKEYHASH2,
4160                               env->msr_ia32_sgxlepubkeyhash[2]);
4161             kvm_msr_entry_add(cpu, MSR_IA32_SGXLEPUBKEYHASH3,
4162                               env->msr_ia32_sgxlepubkeyhash[3]);
4163         }
4164 
4165         if (env->features[FEAT_XSAVE] & CPUID_D_1_EAX_XFD) {
4166             kvm_msr_entry_add(cpu, MSR_IA32_XFD,
4167                               env->msr_xfd);
4168             kvm_msr_entry_add(cpu, MSR_IA32_XFD_ERR,
4169                               env->msr_xfd_err);
4170         }
4171 
4172         if (kvm_enabled() && cpu->enable_pmu &&
4173             (env->features[FEAT_7_0_EDX] & CPUID_7_0_EDX_ARCH_LBR)) {
4174             uint64_t depth;
4175             int ret;
4176 
4177             /*
4178              * Only migrate Arch LBR states when the host Arch LBR depth
4179              * equals that of source guest's, this is to avoid mismatch
4180              * of guest/host config for the msr hence avoid unexpected
4181              * misbehavior.
4182              */
4183             ret = kvm_get_one_msr(cpu, MSR_ARCH_LBR_DEPTH, &depth);
4184 
4185             if (ret == 1 && !!depth && depth == env->msr_lbr_depth) {
4186                 kvm_msr_entry_add(cpu, MSR_ARCH_LBR_CTL, env->msr_lbr_ctl);
4187                 kvm_msr_entry_add(cpu, MSR_ARCH_LBR_DEPTH, env->msr_lbr_depth);
4188 
4189                 for (i = 0; i < ARCH_LBR_NR_ENTRIES; i++) {
4190                     if (!env->lbr_records[i].from) {
4191                         continue;
4192                     }
4193                     kvm_msr_entry_add(cpu, MSR_ARCH_LBR_FROM_0 + i,
4194                                       env->lbr_records[i].from);
4195                     kvm_msr_entry_add(cpu, MSR_ARCH_LBR_TO_0 + i,
4196                                       env->lbr_records[i].to);
4197                     kvm_msr_entry_add(cpu, MSR_ARCH_LBR_INFO_0 + i,
4198                                       env->lbr_records[i].info);
4199                 }
4200             }
4201         }
4202 
4203         /* Note: MSR_IA32_FEATURE_CONTROL is written separately, see
4204          *       kvm_put_msr_feature_control. */
4205     }
4206 
4207     if (env->mcg_cap) {
4208         kvm_msr_entry_add(cpu, MSR_MCG_STATUS, env->mcg_status);
4209         kvm_msr_entry_add(cpu, MSR_MCG_CTL, env->mcg_ctl);
4210         if (has_msr_mcg_ext_ctl) {
4211             kvm_msr_entry_add(cpu, MSR_MCG_EXT_CTL, env->mcg_ext_ctl);
4212         }
4213         for (i = 0; i < (env->mcg_cap & 0xff) * 4; i++) {
4214             kvm_msr_entry_add(cpu, MSR_MC0_CTL + i, env->mce_banks[i]);
4215         }
4216     }
4217 
4218     return kvm_buf_set_msrs(cpu);
4219 }
4220 
4221 
4222 static int kvm_get_xsave(X86CPU *cpu)
4223 {
4224     CPUX86State *env = &cpu->env;
4225     void *xsave = env->xsave_buf;
4226     unsigned long type;
4227     int ret;
4228 
4229     type = has_xsave2 ? KVM_GET_XSAVE2 : KVM_GET_XSAVE;
4230     ret = kvm_vcpu_ioctl(CPU(cpu), type, xsave);
4231     if (ret < 0) {
4232         return ret;
4233     }
4234     x86_cpu_xrstor_all_areas(cpu, xsave, env->xsave_buf_len);
4235 
4236     return 0;
4237 }
4238 
4239 static int kvm_get_xcrs(X86CPU *cpu)
4240 {
4241     CPUX86State *env = &cpu->env;
4242     int i, ret;
4243     struct kvm_xcrs xcrs;
4244 
4245     if (!has_xcrs) {
4246         return 0;
4247     }
4248 
4249     ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_XCRS, &xcrs);
4250     if (ret < 0) {
4251         return ret;
4252     }
4253 
4254     for (i = 0; i < xcrs.nr_xcrs; i++) {
4255         /* Only support xcr0 now */
4256         if (xcrs.xcrs[i].xcr == 0) {
4257             env->xcr0 = xcrs.xcrs[i].value;
4258             break;
4259         }
4260     }
4261     return 0;
4262 }
4263 
4264 static int kvm_get_sregs(X86CPU *cpu)
4265 {
4266     CPUX86State *env = &cpu->env;
4267     struct kvm_sregs sregs;
4268     int ret;
4269 
4270     ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_SREGS, &sregs);
4271     if (ret < 0) {
4272         return ret;
4273     }
4274 
4275     /*
4276      * The interrupt_bitmap is ignored because KVM_GET_SREGS is
4277      * always preceded by KVM_GET_VCPU_EVENTS.
4278      */
4279 
4280     get_seg(&env->segs[R_CS], &sregs.cs);
4281     get_seg(&env->segs[R_DS], &sregs.ds);
4282     get_seg(&env->segs[R_ES], &sregs.es);
4283     get_seg(&env->segs[R_FS], &sregs.fs);
4284     get_seg(&env->segs[R_GS], &sregs.gs);
4285     get_seg(&env->segs[R_SS], &sregs.ss);
4286 
4287     get_seg(&env->tr, &sregs.tr);
4288     get_seg(&env->ldt, &sregs.ldt);
4289 
4290     env->idt.limit = sregs.idt.limit;
4291     env->idt.base = sregs.idt.base;
4292     env->gdt.limit = sregs.gdt.limit;
4293     env->gdt.base = sregs.gdt.base;
4294 
4295     env->cr[0] = sregs.cr0;
4296     env->cr[2] = sregs.cr2;
4297     env->cr[3] = sregs.cr3;
4298     env->cr[4] = sregs.cr4;
4299 
4300     env->efer = sregs.efer;
4301     if (sev_es_enabled() && env->efer & MSR_EFER_LME &&
4302         env->cr[0] & CR0_PG_MASK) {
4303         env->efer |= MSR_EFER_LMA;
4304     }
4305 
4306     /* changes to apic base and cr8/tpr are read back via kvm_arch_post_run */
4307     x86_update_hflags(env);
4308 
4309     return 0;
4310 }
4311 
4312 static int kvm_get_sregs2(X86CPU *cpu)
4313 {
4314     CPUX86State *env = &cpu->env;
4315     struct kvm_sregs2 sregs;
4316     int i, ret;
4317 
4318     ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_SREGS2, &sregs);
4319     if (ret < 0) {
4320         return ret;
4321     }
4322 
4323     get_seg(&env->segs[R_CS], &sregs.cs);
4324     get_seg(&env->segs[R_DS], &sregs.ds);
4325     get_seg(&env->segs[R_ES], &sregs.es);
4326     get_seg(&env->segs[R_FS], &sregs.fs);
4327     get_seg(&env->segs[R_GS], &sregs.gs);
4328     get_seg(&env->segs[R_SS], &sregs.ss);
4329 
4330     get_seg(&env->tr, &sregs.tr);
4331     get_seg(&env->ldt, &sregs.ldt);
4332 
4333     env->idt.limit = sregs.idt.limit;
4334     env->idt.base = sregs.idt.base;
4335     env->gdt.limit = sregs.gdt.limit;
4336     env->gdt.base = sregs.gdt.base;
4337 
4338     env->cr[0] = sregs.cr0;
4339     env->cr[2] = sregs.cr2;
4340     env->cr[3] = sregs.cr3;
4341     env->cr[4] = sregs.cr4;
4342 
4343     env->efer = sregs.efer;
4344     if (sev_es_enabled() && env->efer & MSR_EFER_LME &&
4345         env->cr[0] & CR0_PG_MASK) {
4346         env->efer |= MSR_EFER_LMA;
4347     }
4348 
4349     env->pdptrs_valid = sregs.flags & KVM_SREGS2_FLAGS_PDPTRS_VALID;
4350 
4351     if (env->pdptrs_valid) {
4352         for (i = 0; i < 4; i++) {
4353             env->pdptrs[i] = sregs.pdptrs[i];
4354         }
4355     }
4356 
4357     /* changes to apic base and cr8/tpr are read back via kvm_arch_post_run */
4358     x86_update_hflags(env);
4359 
4360     return 0;
4361 }
4362 
4363 static int kvm_get_msrs(X86CPU *cpu)
4364 {
4365     CPUX86State *env = &cpu->env;
4366     struct kvm_msr_entry *msrs = cpu->kvm_msr_buf->entries;
4367     int ret, i;
4368     uint64_t mtrr_top_bits;
4369 
4370     kvm_msr_buf_reset(cpu);
4371 
4372     kvm_msr_entry_add(cpu, MSR_IA32_SYSENTER_CS, 0);
4373     kvm_msr_entry_add(cpu, MSR_IA32_SYSENTER_ESP, 0);
4374     kvm_msr_entry_add(cpu, MSR_IA32_SYSENTER_EIP, 0);
4375     kvm_msr_entry_add(cpu, MSR_PAT, 0);
4376     if (has_msr_star) {
4377         kvm_msr_entry_add(cpu, MSR_STAR, 0);
4378     }
4379     if (has_msr_hsave_pa) {
4380         kvm_msr_entry_add(cpu, MSR_VM_HSAVE_PA, 0);
4381     }
4382     if (has_msr_tsc_aux) {
4383         kvm_msr_entry_add(cpu, MSR_TSC_AUX, 0);
4384     }
4385     if (has_msr_tsc_adjust) {
4386         kvm_msr_entry_add(cpu, MSR_TSC_ADJUST, 0);
4387     }
4388     if (has_msr_tsc_deadline) {
4389         kvm_msr_entry_add(cpu, MSR_IA32_TSCDEADLINE, 0);
4390     }
4391     if (has_msr_misc_enable) {
4392         kvm_msr_entry_add(cpu, MSR_IA32_MISC_ENABLE, 0);
4393     }
4394     if (has_msr_smbase) {
4395         kvm_msr_entry_add(cpu, MSR_IA32_SMBASE, 0);
4396     }
4397     if (has_msr_smi_count) {
4398         kvm_msr_entry_add(cpu, MSR_SMI_COUNT, 0);
4399     }
4400     if (has_msr_feature_control) {
4401         kvm_msr_entry_add(cpu, MSR_IA32_FEATURE_CONTROL, 0);
4402     }
4403     if (has_msr_pkrs) {
4404         kvm_msr_entry_add(cpu, MSR_IA32_PKRS, 0);
4405     }
4406     if (has_msr_bndcfgs) {
4407         kvm_msr_entry_add(cpu, MSR_IA32_BNDCFGS, 0);
4408     }
4409     if (has_msr_xss) {
4410         kvm_msr_entry_add(cpu, MSR_IA32_XSS, 0);
4411     }
4412     if (has_msr_umwait) {
4413         kvm_msr_entry_add(cpu, MSR_IA32_UMWAIT_CONTROL, 0);
4414     }
4415     if (has_msr_spec_ctrl) {
4416         kvm_msr_entry_add(cpu, MSR_IA32_SPEC_CTRL, 0);
4417     }
4418     if (has_tsc_scale_msr) {
4419         kvm_msr_entry_add(cpu, MSR_AMD64_TSC_RATIO, 0);
4420     }
4421 
4422     if (has_msr_tsx_ctrl) {
4423         kvm_msr_entry_add(cpu, MSR_IA32_TSX_CTRL, 0);
4424     }
4425     if (has_msr_virt_ssbd) {
4426         kvm_msr_entry_add(cpu, MSR_VIRT_SSBD, 0);
4427     }
4428     if (!env->tsc_valid) {
4429         kvm_msr_entry_add(cpu, MSR_IA32_TSC, 0);
4430         env->tsc_valid = !runstate_is_running();
4431     }
4432     if (has_msr_hwcr) {
4433         kvm_msr_entry_add(cpu, MSR_K7_HWCR, 0);
4434     }
4435 
4436 #ifdef TARGET_X86_64
4437     if (lm_capable_kernel) {
4438         kvm_msr_entry_add(cpu, MSR_CSTAR, 0);
4439         kvm_msr_entry_add(cpu, MSR_KERNELGSBASE, 0);
4440         kvm_msr_entry_add(cpu, MSR_FMASK, 0);
4441         kvm_msr_entry_add(cpu, MSR_LSTAR, 0);
4442         if (env->features[FEAT_7_1_EAX] & CPUID_7_1_EAX_FRED) {
4443             kvm_msr_entry_add(cpu, MSR_IA32_FRED_RSP0, 0);
4444             kvm_msr_entry_add(cpu, MSR_IA32_FRED_RSP1, 0);
4445             kvm_msr_entry_add(cpu, MSR_IA32_FRED_RSP2, 0);
4446             kvm_msr_entry_add(cpu, MSR_IA32_FRED_RSP3, 0);
4447             kvm_msr_entry_add(cpu, MSR_IA32_FRED_STKLVLS, 0);
4448             kvm_msr_entry_add(cpu, MSR_IA32_FRED_SSP1, 0);
4449             kvm_msr_entry_add(cpu, MSR_IA32_FRED_SSP2, 0);
4450             kvm_msr_entry_add(cpu, MSR_IA32_FRED_SSP3, 0);
4451             kvm_msr_entry_add(cpu, MSR_IA32_FRED_CONFIG, 0);
4452         }
4453     }
4454 #endif
4455     if (env->features[FEAT_KVM] & (CPUID_KVM_CLOCK | CPUID_KVM_CLOCK2)) {
4456         kvm_msr_entry_add(cpu, MSR_KVM_SYSTEM_TIME, 0);
4457         kvm_msr_entry_add(cpu, MSR_KVM_WALL_CLOCK, 0);
4458     }
4459     if (env->features[FEAT_KVM] & CPUID_KVM_ASYNCPF_INT) {
4460         kvm_msr_entry_add(cpu, MSR_KVM_ASYNC_PF_INT, 0);
4461     }
4462     if (env->features[FEAT_KVM] & CPUID_KVM_ASYNCPF) {
4463         kvm_msr_entry_add(cpu, MSR_KVM_ASYNC_PF_EN, 0);
4464     }
4465     if (env->features[FEAT_KVM] & CPUID_KVM_PV_EOI) {
4466         kvm_msr_entry_add(cpu, MSR_KVM_PV_EOI_EN, 0);
4467     }
4468     if (env->features[FEAT_KVM] & CPUID_KVM_STEAL_TIME) {
4469         kvm_msr_entry_add(cpu, MSR_KVM_STEAL_TIME, 0);
4470     }
4471     if (env->features[FEAT_KVM] & CPUID_KVM_POLL_CONTROL) {
4472         kvm_msr_entry_add(cpu, MSR_KVM_POLL_CONTROL, 1);
4473     }
4474     if (has_architectural_pmu_version > 0) {
4475         if (has_architectural_pmu_version > 1) {
4476             kvm_msr_entry_add(cpu, MSR_CORE_PERF_FIXED_CTR_CTRL, 0);
4477             kvm_msr_entry_add(cpu, MSR_CORE_PERF_GLOBAL_CTRL, 0);
4478             kvm_msr_entry_add(cpu, MSR_CORE_PERF_GLOBAL_STATUS, 0);
4479             kvm_msr_entry_add(cpu, MSR_CORE_PERF_GLOBAL_OVF_CTRL, 0);
4480         }
4481         for (i = 0; i < num_architectural_pmu_fixed_counters; i++) {
4482             kvm_msr_entry_add(cpu, MSR_CORE_PERF_FIXED_CTR0 + i, 0);
4483         }
4484         for (i = 0; i < num_architectural_pmu_gp_counters; i++) {
4485             kvm_msr_entry_add(cpu, MSR_P6_PERFCTR0 + i, 0);
4486             kvm_msr_entry_add(cpu, MSR_P6_EVNTSEL0 + i, 0);
4487         }
4488     }
4489 
4490     if (env->mcg_cap) {
4491         kvm_msr_entry_add(cpu, MSR_MCG_STATUS, 0);
4492         kvm_msr_entry_add(cpu, MSR_MCG_CTL, 0);
4493         if (has_msr_mcg_ext_ctl) {
4494             kvm_msr_entry_add(cpu, MSR_MCG_EXT_CTL, 0);
4495         }
4496         for (i = 0; i < (env->mcg_cap & 0xff) * 4; i++) {
4497             kvm_msr_entry_add(cpu, MSR_MC0_CTL + i, 0);
4498         }
4499     }
4500 
4501     if (has_msr_hv_hypercall) {
4502         kvm_msr_entry_add(cpu, HV_X64_MSR_HYPERCALL, 0);
4503         kvm_msr_entry_add(cpu, HV_X64_MSR_GUEST_OS_ID, 0);
4504     }
4505     if (hyperv_feat_enabled(cpu, HYPERV_FEAT_VAPIC)) {
4506         kvm_msr_entry_add(cpu, HV_X64_MSR_APIC_ASSIST_PAGE, 0);
4507     }
4508     if (hyperv_feat_enabled(cpu, HYPERV_FEAT_TIME)) {
4509         kvm_msr_entry_add(cpu, HV_X64_MSR_REFERENCE_TSC, 0);
4510     }
4511     if (hyperv_feat_enabled(cpu, HYPERV_FEAT_REENLIGHTENMENT)) {
4512         kvm_msr_entry_add(cpu, HV_X64_MSR_REENLIGHTENMENT_CONTROL, 0);
4513         kvm_msr_entry_add(cpu, HV_X64_MSR_TSC_EMULATION_CONTROL, 0);
4514         kvm_msr_entry_add(cpu, HV_X64_MSR_TSC_EMULATION_STATUS, 0);
4515     }
4516     if (has_msr_hv_syndbg_options) {
4517         kvm_msr_entry_add(cpu, HV_X64_MSR_SYNDBG_OPTIONS, 0);
4518     }
4519     if (has_msr_hv_crash) {
4520         int j;
4521 
4522         for (j = 0; j < HV_CRASH_PARAMS; j++) {
4523             kvm_msr_entry_add(cpu, HV_X64_MSR_CRASH_P0 + j, 0);
4524         }
4525     }
4526     if (has_msr_hv_runtime) {
4527         kvm_msr_entry_add(cpu, HV_X64_MSR_VP_RUNTIME, 0);
4528     }
4529     if (hyperv_feat_enabled(cpu, HYPERV_FEAT_SYNIC)) {
4530         uint32_t msr;
4531 
4532         kvm_msr_entry_add(cpu, HV_X64_MSR_SCONTROL, 0);
4533         kvm_msr_entry_add(cpu, HV_X64_MSR_SIEFP, 0);
4534         kvm_msr_entry_add(cpu, HV_X64_MSR_SIMP, 0);
4535         for (msr = HV_X64_MSR_SINT0; msr <= HV_X64_MSR_SINT15; msr++) {
4536             kvm_msr_entry_add(cpu, msr, 0);
4537         }
4538     }
4539     if (has_msr_hv_stimer) {
4540         uint32_t msr;
4541 
4542         for (msr = HV_X64_MSR_STIMER0_CONFIG; msr <= HV_X64_MSR_STIMER3_COUNT;
4543              msr++) {
4544             kvm_msr_entry_add(cpu, msr, 0);
4545         }
4546     }
4547     if (env->features[FEAT_1_EDX] & CPUID_MTRR) {
4548         kvm_msr_entry_add(cpu, MSR_MTRRdefType, 0);
4549         kvm_msr_entry_add(cpu, MSR_MTRRfix64K_00000, 0);
4550         kvm_msr_entry_add(cpu, MSR_MTRRfix16K_80000, 0);
4551         kvm_msr_entry_add(cpu, MSR_MTRRfix16K_A0000, 0);
4552         kvm_msr_entry_add(cpu, MSR_MTRRfix4K_C0000, 0);
4553         kvm_msr_entry_add(cpu, MSR_MTRRfix4K_C8000, 0);
4554         kvm_msr_entry_add(cpu, MSR_MTRRfix4K_D0000, 0);
4555         kvm_msr_entry_add(cpu, MSR_MTRRfix4K_D8000, 0);
4556         kvm_msr_entry_add(cpu, MSR_MTRRfix4K_E0000, 0);
4557         kvm_msr_entry_add(cpu, MSR_MTRRfix4K_E8000, 0);
4558         kvm_msr_entry_add(cpu, MSR_MTRRfix4K_F0000, 0);
4559         kvm_msr_entry_add(cpu, MSR_MTRRfix4K_F8000, 0);
4560         for (i = 0; i < MSR_MTRRcap_VCNT; i++) {
4561             kvm_msr_entry_add(cpu, MSR_MTRRphysBase(i), 0);
4562             kvm_msr_entry_add(cpu, MSR_MTRRphysMask(i), 0);
4563         }
4564     }
4565 
4566     if (env->features[FEAT_7_0_EBX] & CPUID_7_0_EBX_INTEL_PT) {
4567         int addr_num =
4568             kvm_arch_get_supported_cpuid(kvm_state, 0x14, 1, R_EAX) & 0x7;
4569 
4570         kvm_msr_entry_add(cpu, MSR_IA32_RTIT_CTL, 0);
4571         kvm_msr_entry_add(cpu, MSR_IA32_RTIT_STATUS, 0);
4572         kvm_msr_entry_add(cpu, MSR_IA32_RTIT_OUTPUT_BASE, 0);
4573         kvm_msr_entry_add(cpu, MSR_IA32_RTIT_OUTPUT_MASK, 0);
4574         kvm_msr_entry_add(cpu, MSR_IA32_RTIT_CR3_MATCH, 0);
4575         for (i = 0; i < addr_num; i++) {
4576             kvm_msr_entry_add(cpu, MSR_IA32_RTIT_ADDR0_A + i, 0);
4577         }
4578     }
4579 
4580     if (env->features[FEAT_7_0_ECX] & CPUID_7_0_ECX_SGX_LC) {
4581         kvm_msr_entry_add(cpu, MSR_IA32_SGXLEPUBKEYHASH0, 0);
4582         kvm_msr_entry_add(cpu, MSR_IA32_SGXLEPUBKEYHASH1, 0);
4583         kvm_msr_entry_add(cpu, MSR_IA32_SGXLEPUBKEYHASH2, 0);
4584         kvm_msr_entry_add(cpu, MSR_IA32_SGXLEPUBKEYHASH3, 0);
4585     }
4586 
4587     if (env->features[FEAT_XSAVE] & CPUID_D_1_EAX_XFD) {
4588         kvm_msr_entry_add(cpu, MSR_IA32_XFD, 0);
4589         kvm_msr_entry_add(cpu, MSR_IA32_XFD_ERR, 0);
4590     }
4591 
4592     if (kvm_enabled() && cpu->enable_pmu &&
4593         (env->features[FEAT_7_0_EDX] & CPUID_7_0_EDX_ARCH_LBR)) {
4594         uint64_t depth;
4595 
4596         ret = kvm_get_one_msr(cpu, MSR_ARCH_LBR_DEPTH, &depth);
4597         if (ret == 1 && depth == ARCH_LBR_NR_ENTRIES) {
4598             kvm_msr_entry_add(cpu, MSR_ARCH_LBR_CTL, 0);
4599             kvm_msr_entry_add(cpu, MSR_ARCH_LBR_DEPTH, 0);
4600 
4601             for (i = 0; i < ARCH_LBR_NR_ENTRIES; i++) {
4602                 kvm_msr_entry_add(cpu, MSR_ARCH_LBR_FROM_0 + i, 0);
4603                 kvm_msr_entry_add(cpu, MSR_ARCH_LBR_TO_0 + i, 0);
4604                 kvm_msr_entry_add(cpu, MSR_ARCH_LBR_INFO_0 + i, 0);
4605             }
4606         }
4607     }
4608 
4609     ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_MSRS, cpu->kvm_msr_buf);
4610     if (ret < 0) {
4611         return ret;
4612     }
4613 
4614     if (ret < cpu->kvm_msr_buf->nmsrs) {
4615         struct kvm_msr_entry *e = &cpu->kvm_msr_buf->entries[ret];
4616         error_report("error: failed to get MSR 0x%" PRIx32,
4617                      (uint32_t)e->index);
4618     }
4619 
4620     assert(ret == cpu->kvm_msr_buf->nmsrs);
4621     /*
4622      * MTRR masks: Each mask consists of 5 parts
4623      * a  10..0: must be zero
4624      * b  11   : valid bit
4625      * c n-1.12: actual mask bits
4626      * d  51..n: reserved must be zero
4627      * e  63.52: reserved must be zero
4628      *
4629      * 'n' is the number of physical bits supported by the CPU and is
4630      * apparently always <= 52.   We know our 'n' but don't know what
4631      * the destinations 'n' is; it might be smaller, in which case
4632      * it masks (c) on loading. It might be larger, in which case
4633      * we fill 'd' so that d..c is consistent irrespetive of the 'n'
4634      * we're migrating to.
4635      */
4636 
4637     if (cpu->fill_mtrr_mask) {
4638         QEMU_BUILD_BUG_ON(TARGET_PHYS_ADDR_SPACE_BITS > 52);
4639         assert(cpu->phys_bits <= TARGET_PHYS_ADDR_SPACE_BITS);
4640         mtrr_top_bits = MAKE_64BIT_MASK(cpu->phys_bits, 52 - cpu->phys_bits);
4641     } else {
4642         mtrr_top_bits = 0;
4643     }
4644 
4645     for (i = 0; i < ret; i++) {
4646         uint32_t index = msrs[i].index;
4647         switch (index) {
4648         case MSR_IA32_SYSENTER_CS:
4649             env->sysenter_cs = msrs[i].data;
4650             break;
4651         case MSR_IA32_SYSENTER_ESP:
4652             env->sysenter_esp = msrs[i].data;
4653             break;
4654         case MSR_IA32_SYSENTER_EIP:
4655             env->sysenter_eip = msrs[i].data;
4656             break;
4657         case MSR_PAT:
4658             env->pat = msrs[i].data;
4659             break;
4660         case MSR_STAR:
4661             env->star = msrs[i].data;
4662             break;
4663 #ifdef TARGET_X86_64
4664         case MSR_CSTAR:
4665             env->cstar = msrs[i].data;
4666             break;
4667         case MSR_KERNELGSBASE:
4668             env->kernelgsbase = msrs[i].data;
4669             break;
4670         case MSR_FMASK:
4671             env->fmask = msrs[i].data;
4672             break;
4673         case MSR_LSTAR:
4674             env->lstar = msrs[i].data;
4675             break;
4676         case MSR_IA32_FRED_RSP0:
4677             env->fred_rsp0 = msrs[i].data;
4678             break;
4679         case MSR_IA32_FRED_RSP1:
4680             env->fred_rsp1 = msrs[i].data;
4681             break;
4682         case MSR_IA32_FRED_RSP2:
4683             env->fred_rsp2 = msrs[i].data;
4684             break;
4685         case MSR_IA32_FRED_RSP3:
4686             env->fred_rsp3 = msrs[i].data;
4687             break;
4688         case MSR_IA32_FRED_STKLVLS:
4689             env->fred_stklvls = msrs[i].data;
4690             break;
4691         case MSR_IA32_FRED_SSP1:
4692             env->fred_ssp1 = msrs[i].data;
4693             break;
4694         case MSR_IA32_FRED_SSP2:
4695             env->fred_ssp2 = msrs[i].data;
4696             break;
4697         case MSR_IA32_FRED_SSP3:
4698             env->fred_ssp3 = msrs[i].data;
4699             break;
4700         case MSR_IA32_FRED_CONFIG:
4701             env->fred_config = msrs[i].data;
4702             break;
4703 #endif
4704         case MSR_IA32_TSC:
4705             env->tsc = msrs[i].data;
4706             break;
4707         case MSR_TSC_AUX:
4708             env->tsc_aux = msrs[i].data;
4709             break;
4710         case MSR_TSC_ADJUST:
4711             env->tsc_adjust = msrs[i].data;
4712             break;
4713         case MSR_IA32_TSCDEADLINE:
4714             env->tsc_deadline = msrs[i].data;
4715             break;
4716         case MSR_VM_HSAVE_PA:
4717             env->vm_hsave = msrs[i].data;
4718             break;
4719         case MSR_KVM_SYSTEM_TIME:
4720             env->system_time_msr = msrs[i].data;
4721             break;
4722         case MSR_KVM_WALL_CLOCK:
4723             env->wall_clock_msr = msrs[i].data;
4724             break;
4725         case MSR_MCG_STATUS:
4726             env->mcg_status = msrs[i].data;
4727             break;
4728         case MSR_MCG_CTL:
4729             env->mcg_ctl = msrs[i].data;
4730             break;
4731         case MSR_MCG_EXT_CTL:
4732             env->mcg_ext_ctl = msrs[i].data;
4733             break;
4734         case MSR_IA32_MISC_ENABLE:
4735             env->msr_ia32_misc_enable = msrs[i].data;
4736             break;
4737         case MSR_IA32_SMBASE:
4738             env->smbase = msrs[i].data;
4739             break;
4740         case MSR_SMI_COUNT:
4741             env->msr_smi_count = msrs[i].data;
4742             break;
4743         case MSR_IA32_FEATURE_CONTROL:
4744             env->msr_ia32_feature_control = msrs[i].data;
4745             break;
4746         case MSR_IA32_BNDCFGS:
4747             env->msr_bndcfgs = msrs[i].data;
4748             break;
4749         case MSR_IA32_XSS:
4750             env->xss = msrs[i].data;
4751             break;
4752         case MSR_IA32_UMWAIT_CONTROL:
4753             env->umwait = msrs[i].data;
4754             break;
4755         case MSR_IA32_PKRS:
4756             env->pkrs = msrs[i].data;
4757             break;
4758         default:
4759             if (msrs[i].index >= MSR_MC0_CTL &&
4760                 msrs[i].index < MSR_MC0_CTL + (env->mcg_cap & 0xff) * 4) {
4761                 env->mce_banks[msrs[i].index - MSR_MC0_CTL] = msrs[i].data;
4762             }
4763             break;
4764         case MSR_KVM_ASYNC_PF_EN:
4765             env->async_pf_en_msr = msrs[i].data;
4766             break;
4767         case MSR_KVM_ASYNC_PF_INT:
4768             env->async_pf_int_msr = msrs[i].data;
4769             break;
4770         case MSR_KVM_PV_EOI_EN:
4771             env->pv_eoi_en_msr = msrs[i].data;
4772             break;
4773         case MSR_KVM_STEAL_TIME:
4774             env->steal_time_msr = msrs[i].data;
4775             break;
4776         case MSR_KVM_POLL_CONTROL: {
4777             env->poll_control_msr = msrs[i].data;
4778             break;
4779         }
4780         case MSR_CORE_PERF_FIXED_CTR_CTRL:
4781             env->msr_fixed_ctr_ctrl = msrs[i].data;
4782             break;
4783         case MSR_CORE_PERF_GLOBAL_CTRL:
4784             env->msr_global_ctrl = msrs[i].data;
4785             break;
4786         case MSR_CORE_PERF_GLOBAL_STATUS:
4787             env->msr_global_status = msrs[i].data;
4788             break;
4789         case MSR_CORE_PERF_GLOBAL_OVF_CTRL:
4790             env->msr_global_ovf_ctrl = msrs[i].data;
4791             break;
4792         case MSR_CORE_PERF_FIXED_CTR0 ... MSR_CORE_PERF_FIXED_CTR0 + MAX_FIXED_COUNTERS - 1:
4793             env->msr_fixed_counters[index - MSR_CORE_PERF_FIXED_CTR0] = msrs[i].data;
4794             break;
4795         case MSR_P6_PERFCTR0 ... MSR_P6_PERFCTR0 + MAX_GP_COUNTERS - 1:
4796             env->msr_gp_counters[index - MSR_P6_PERFCTR0] = msrs[i].data;
4797             break;
4798         case MSR_P6_EVNTSEL0 ... MSR_P6_EVNTSEL0 + MAX_GP_COUNTERS - 1:
4799             env->msr_gp_evtsel[index - MSR_P6_EVNTSEL0] = msrs[i].data;
4800             break;
4801         case HV_X64_MSR_HYPERCALL:
4802             env->msr_hv_hypercall = msrs[i].data;
4803             break;
4804         case HV_X64_MSR_GUEST_OS_ID:
4805             env->msr_hv_guest_os_id = msrs[i].data;
4806             break;
4807         case HV_X64_MSR_APIC_ASSIST_PAGE:
4808             env->msr_hv_vapic = msrs[i].data;
4809             break;
4810         case HV_X64_MSR_REFERENCE_TSC:
4811             env->msr_hv_tsc = msrs[i].data;
4812             break;
4813         case HV_X64_MSR_CRASH_P0 ... HV_X64_MSR_CRASH_P4:
4814             env->msr_hv_crash_params[index - HV_X64_MSR_CRASH_P0] = msrs[i].data;
4815             break;
4816         case HV_X64_MSR_VP_RUNTIME:
4817             env->msr_hv_runtime = msrs[i].data;
4818             break;
4819         case HV_X64_MSR_SCONTROL:
4820             env->msr_hv_synic_control = msrs[i].data;
4821             break;
4822         case HV_X64_MSR_SIEFP:
4823             env->msr_hv_synic_evt_page = msrs[i].data;
4824             break;
4825         case HV_X64_MSR_SIMP:
4826             env->msr_hv_synic_msg_page = msrs[i].data;
4827             break;
4828         case HV_X64_MSR_SINT0 ... HV_X64_MSR_SINT15:
4829             env->msr_hv_synic_sint[index - HV_X64_MSR_SINT0] = msrs[i].data;
4830             break;
4831         case HV_X64_MSR_STIMER0_CONFIG:
4832         case HV_X64_MSR_STIMER1_CONFIG:
4833         case HV_X64_MSR_STIMER2_CONFIG:
4834         case HV_X64_MSR_STIMER3_CONFIG:
4835             env->msr_hv_stimer_config[(index - HV_X64_MSR_STIMER0_CONFIG)/2] =
4836                                 msrs[i].data;
4837             break;
4838         case HV_X64_MSR_STIMER0_COUNT:
4839         case HV_X64_MSR_STIMER1_COUNT:
4840         case HV_X64_MSR_STIMER2_COUNT:
4841         case HV_X64_MSR_STIMER3_COUNT:
4842             env->msr_hv_stimer_count[(index - HV_X64_MSR_STIMER0_COUNT)/2] =
4843                                 msrs[i].data;
4844             break;
4845         case HV_X64_MSR_REENLIGHTENMENT_CONTROL:
4846             env->msr_hv_reenlightenment_control = msrs[i].data;
4847             break;
4848         case HV_X64_MSR_TSC_EMULATION_CONTROL:
4849             env->msr_hv_tsc_emulation_control = msrs[i].data;
4850             break;
4851         case HV_X64_MSR_TSC_EMULATION_STATUS:
4852             env->msr_hv_tsc_emulation_status = msrs[i].data;
4853             break;
4854         case HV_X64_MSR_SYNDBG_OPTIONS:
4855             env->msr_hv_syndbg_options = msrs[i].data;
4856             break;
4857         case MSR_MTRRdefType:
4858             env->mtrr_deftype = msrs[i].data;
4859             break;
4860         case MSR_MTRRfix64K_00000:
4861             env->mtrr_fixed[0] = msrs[i].data;
4862             break;
4863         case MSR_MTRRfix16K_80000:
4864             env->mtrr_fixed[1] = msrs[i].data;
4865             break;
4866         case MSR_MTRRfix16K_A0000:
4867             env->mtrr_fixed[2] = msrs[i].data;
4868             break;
4869         case MSR_MTRRfix4K_C0000:
4870             env->mtrr_fixed[3] = msrs[i].data;
4871             break;
4872         case MSR_MTRRfix4K_C8000:
4873             env->mtrr_fixed[4] = msrs[i].data;
4874             break;
4875         case MSR_MTRRfix4K_D0000:
4876             env->mtrr_fixed[5] = msrs[i].data;
4877             break;
4878         case MSR_MTRRfix4K_D8000:
4879             env->mtrr_fixed[6] = msrs[i].data;
4880             break;
4881         case MSR_MTRRfix4K_E0000:
4882             env->mtrr_fixed[7] = msrs[i].data;
4883             break;
4884         case MSR_MTRRfix4K_E8000:
4885             env->mtrr_fixed[8] = msrs[i].data;
4886             break;
4887         case MSR_MTRRfix4K_F0000:
4888             env->mtrr_fixed[9] = msrs[i].data;
4889             break;
4890         case MSR_MTRRfix4K_F8000:
4891             env->mtrr_fixed[10] = msrs[i].data;
4892             break;
4893         case MSR_MTRRphysBase(0) ... MSR_MTRRphysMask(MSR_MTRRcap_VCNT - 1):
4894             if (index & 1) {
4895                 env->mtrr_var[MSR_MTRRphysIndex(index)].mask = msrs[i].data |
4896                                                                mtrr_top_bits;
4897             } else {
4898                 env->mtrr_var[MSR_MTRRphysIndex(index)].base = msrs[i].data;
4899             }
4900             break;
4901         case MSR_IA32_SPEC_CTRL:
4902             env->spec_ctrl = msrs[i].data;
4903             break;
4904         case MSR_AMD64_TSC_RATIO:
4905             env->amd_tsc_scale_msr = msrs[i].data;
4906             break;
4907         case MSR_IA32_TSX_CTRL:
4908             env->tsx_ctrl = msrs[i].data;
4909             break;
4910         case MSR_VIRT_SSBD:
4911             env->virt_ssbd = msrs[i].data;
4912             break;
4913         case MSR_IA32_RTIT_CTL:
4914             env->msr_rtit_ctrl = msrs[i].data;
4915             break;
4916         case MSR_IA32_RTIT_STATUS:
4917             env->msr_rtit_status = msrs[i].data;
4918             break;
4919         case MSR_IA32_RTIT_OUTPUT_BASE:
4920             env->msr_rtit_output_base = msrs[i].data;
4921             break;
4922         case MSR_IA32_RTIT_OUTPUT_MASK:
4923             env->msr_rtit_output_mask = msrs[i].data;
4924             break;
4925         case MSR_IA32_RTIT_CR3_MATCH:
4926             env->msr_rtit_cr3_match = msrs[i].data;
4927             break;
4928         case MSR_IA32_RTIT_ADDR0_A ... MSR_IA32_RTIT_ADDR3_B:
4929             env->msr_rtit_addrs[index - MSR_IA32_RTIT_ADDR0_A] = msrs[i].data;
4930             break;
4931         case MSR_IA32_SGXLEPUBKEYHASH0 ... MSR_IA32_SGXLEPUBKEYHASH3:
4932             env->msr_ia32_sgxlepubkeyhash[index - MSR_IA32_SGXLEPUBKEYHASH0] =
4933                            msrs[i].data;
4934             break;
4935         case MSR_IA32_XFD:
4936             env->msr_xfd = msrs[i].data;
4937             break;
4938         case MSR_IA32_XFD_ERR:
4939             env->msr_xfd_err = msrs[i].data;
4940             break;
4941         case MSR_ARCH_LBR_CTL:
4942             env->msr_lbr_ctl = msrs[i].data;
4943             break;
4944         case MSR_ARCH_LBR_DEPTH:
4945             env->msr_lbr_depth = msrs[i].data;
4946             break;
4947         case MSR_ARCH_LBR_FROM_0 ... MSR_ARCH_LBR_FROM_0 + 31:
4948             env->lbr_records[index - MSR_ARCH_LBR_FROM_0].from = msrs[i].data;
4949             break;
4950         case MSR_ARCH_LBR_TO_0 ... MSR_ARCH_LBR_TO_0 + 31:
4951             env->lbr_records[index - MSR_ARCH_LBR_TO_0].to = msrs[i].data;
4952             break;
4953         case MSR_ARCH_LBR_INFO_0 ... MSR_ARCH_LBR_INFO_0 + 31:
4954             env->lbr_records[index - MSR_ARCH_LBR_INFO_0].info = msrs[i].data;
4955             break;
4956         case MSR_K7_HWCR:
4957             env->msr_hwcr = msrs[i].data;
4958             break;
4959         }
4960     }
4961 
4962     return 0;
4963 }
4964 
4965 static int kvm_put_mp_state(X86CPU *cpu)
4966 {
4967     struct kvm_mp_state mp_state = { .mp_state = cpu->env.mp_state };
4968 
4969     return kvm_vcpu_ioctl(CPU(cpu), KVM_SET_MP_STATE, &mp_state);
4970 }
4971 
4972 static int kvm_get_mp_state(X86CPU *cpu)
4973 {
4974     CPUState *cs = CPU(cpu);
4975     CPUX86State *env = &cpu->env;
4976     struct kvm_mp_state mp_state;
4977     int ret;
4978 
4979     ret = kvm_vcpu_ioctl(cs, KVM_GET_MP_STATE, &mp_state);
4980     if (ret < 0) {
4981         return ret;
4982     }
4983     env->mp_state = mp_state.mp_state;
4984     if (kvm_irqchip_in_kernel()) {
4985         cs->halted = (mp_state.mp_state == KVM_MP_STATE_HALTED);
4986     }
4987     return 0;
4988 }
4989 
4990 static int kvm_get_apic(X86CPU *cpu)
4991 {
4992     DeviceState *apic = cpu->apic_state;
4993     struct kvm_lapic_state kapic;
4994     int ret;
4995 
4996     if (apic && kvm_irqchip_in_kernel()) {
4997         ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_LAPIC, &kapic);
4998         if (ret < 0) {
4999             return ret;
5000         }
5001 
5002         kvm_get_apic_state(apic, &kapic);
5003     }
5004     return 0;
5005 }
5006 
5007 static int kvm_put_vcpu_events(X86CPU *cpu, int level)
5008 {
5009     CPUState *cs = CPU(cpu);
5010     CPUX86State *env = &cpu->env;
5011     struct kvm_vcpu_events events = {};
5012 
5013     events.flags = 0;
5014 
5015     if (has_exception_payload) {
5016         events.flags |= KVM_VCPUEVENT_VALID_PAYLOAD;
5017         events.exception.pending = env->exception_pending;
5018         events.exception_has_payload = env->exception_has_payload;
5019         events.exception_payload = env->exception_payload;
5020     }
5021     events.exception.nr = env->exception_nr;
5022     events.exception.injected = env->exception_injected;
5023     events.exception.has_error_code = env->has_error_code;
5024     events.exception.error_code = env->error_code;
5025 
5026     events.interrupt.injected = (env->interrupt_injected >= 0);
5027     events.interrupt.nr = env->interrupt_injected;
5028     events.interrupt.soft = env->soft_interrupt;
5029 
5030     events.nmi.injected = env->nmi_injected;
5031     events.nmi.pending = env->nmi_pending;
5032     events.nmi.masked = !!(env->hflags2 & HF2_NMI_MASK);
5033 
5034     events.sipi_vector = env->sipi_vector;
5035 
5036     if (has_msr_smbase) {
5037         events.flags |= KVM_VCPUEVENT_VALID_SMM;
5038         events.smi.smm = !!(env->hflags & HF_SMM_MASK);
5039         events.smi.smm_inside_nmi = !!(env->hflags2 & HF2_SMM_INSIDE_NMI_MASK);
5040         if (kvm_irqchip_in_kernel()) {
5041             /* As soon as these are moved to the kernel, remove them
5042              * from cs->interrupt_request.
5043              */
5044             events.smi.pending = cs->interrupt_request & CPU_INTERRUPT_SMI;
5045             events.smi.latched_init = cs->interrupt_request & CPU_INTERRUPT_INIT;
5046             cs->interrupt_request &= ~(CPU_INTERRUPT_INIT | CPU_INTERRUPT_SMI);
5047         } else {
5048             /* Keep these in cs->interrupt_request.  */
5049             events.smi.pending = 0;
5050             events.smi.latched_init = 0;
5051         }
5052     }
5053 
5054     if (level >= KVM_PUT_RESET_STATE) {
5055         events.flags |= KVM_VCPUEVENT_VALID_NMI_PENDING;
5056         if (env->mp_state == KVM_MP_STATE_SIPI_RECEIVED) {
5057             events.flags |= KVM_VCPUEVENT_VALID_SIPI_VECTOR;
5058         }
5059     }
5060 
5061     if (has_triple_fault_event) {
5062         events.flags |= KVM_VCPUEVENT_VALID_TRIPLE_FAULT;
5063         events.triple_fault.pending = env->triple_fault_pending;
5064     }
5065 
5066     return kvm_vcpu_ioctl(CPU(cpu), KVM_SET_VCPU_EVENTS, &events);
5067 }
5068 
5069 static int kvm_get_vcpu_events(X86CPU *cpu)
5070 {
5071     CPUX86State *env = &cpu->env;
5072     struct kvm_vcpu_events events;
5073     int ret;
5074 
5075     memset(&events, 0, sizeof(events));
5076     ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_VCPU_EVENTS, &events);
5077     if (ret < 0) {
5078        return ret;
5079     }
5080 
5081     if (events.flags & KVM_VCPUEVENT_VALID_PAYLOAD) {
5082         env->exception_pending = events.exception.pending;
5083         env->exception_has_payload = events.exception_has_payload;
5084         env->exception_payload = events.exception_payload;
5085     } else {
5086         env->exception_pending = 0;
5087         env->exception_has_payload = false;
5088     }
5089     env->exception_injected = events.exception.injected;
5090     env->exception_nr =
5091         (env->exception_pending || env->exception_injected) ?
5092         events.exception.nr : -1;
5093     env->has_error_code = events.exception.has_error_code;
5094     env->error_code = events.exception.error_code;
5095 
5096     env->interrupt_injected =
5097         events.interrupt.injected ? events.interrupt.nr : -1;
5098     env->soft_interrupt = events.interrupt.soft;
5099 
5100     env->nmi_injected = events.nmi.injected;
5101     env->nmi_pending = events.nmi.pending;
5102     if (events.nmi.masked) {
5103         env->hflags2 |= HF2_NMI_MASK;
5104     } else {
5105         env->hflags2 &= ~HF2_NMI_MASK;
5106     }
5107 
5108     if (events.flags & KVM_VCPUEVENT_VALID_SMM) {
5109         if (events.smi.smm) {
5110             env->hflags |= HF_SMM_MASK;
5111         } else {
5112             env->hflags &= ~HF_SMM_MASK;
5113         }
5114         if (events.smi.pending) {
5115             cpu_interrupt(CPU(cpu), CPU_INTERRUPT_SMI);
5116         } else {
5117             cpu_reset_interrupt(CPU(cpu), CPU_INTERRUPT_SMI);
5118         }
5119         if (events.smi.smm_inside_nmi) {
5120             env->hflags2 |= HF2_SMM_INSIDE_NMI_MASK;
5121         } else {
5122             env->hflags2 &= ~HF2_SMM_INSIDE_NMI_MASK;
5123         }
5124         if (events.smi.latched_init) {
5125             cpu_interrupt(CPU(cpu), CPU_INTERRUPT_INIT);
5126         } else {
5127             cpu_reset_interrupt(CPU(cpu), CPU_INTERRUPT_INIT);
5128         }
5129     }
5130 
5131     if (events.flags & KVM_VCPUEVENT_VALID_TRIPLE_FAULT) {
5132         env->triple_fault_pending = events.triple_fault.pending;
5133     }
5134 
5135     env->sipi_vector = events.sipi_vector;
5136 
5137     return 0;
5138 }
5139 
5140 static int kvm_put_debugregs(X86CPU *cpu)
5141 {
5142     CPUX86State *env = &cpu->env;
5143     struct kvm_debugregs dbgregs;
5144     int i;
5145 
5146     memset(&dbgregs, 0, sizeof(dbgregs));
5147     for (i = 0; i < 4; i++) {
5148         dbgregs.db[i] = env->dr[i];
5149     }
5150     dbgregs.dr6 = env->dr[6];
5151     dbgregs.dr7 = env->dr[7];
5152     dbgregs.flags = 0;
5153 
5154     return kvm_vcpu_ioctl(CPU(cpu), KVM_SET_DEBUGREGS, &dbgregs);
5155 }
5156 
5157 static int kvm_get_debugregs(X86CPU *cpu)
5158 {
5159     CPUX86State *env = &cpu->env;
5160     struct kvm_debugregs dbgregs;
5161     int i, ret;
5162 
5163     ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_DEBUGREGS, &dbgregs);
5164     if (ret < 0) {
5165         return ret;
5166     }
5167     for (i = 0; i < 4; i++) {
5168         env->dr[i] = dbgregs.db[i];
5169     }
5170     env->dr[4] = env->dr[6] = dbgregs.dr6;
5171     env->dr[5] = env->dr[7] = dbgregs.dr7;
5172 
5173     return 0;
5174 }
5175 
5176 static int kvm_put_nested_state(X86CPU *cpu)
5177 {
5178     CPUX86State *env = &cpu->env;
5179     int max_nested_state_len = kvm_max_nested_state_length();
5180 
5181     if (!env->nested_state) {
5182         return 0;
5183     }
5184 
5185     /*
5186      * Copy flags that are affected by reset from env->hflags and env->hflags2.
5187      */
5188     if (env->hflags & HF_GUEST_MASK) {
5189         env->nested_state->flags |= KVM_STATE_NESTED_GUEST_MODE;
5190     } else {
5191         env->nested_state->flags &= ~KVM_STATE_NESTED_GUEST_MODE;
5192     }
5193 
5194     /* Don't set KVM_STATE_NESTED_GIF_SET on VMX as it is illegal */
5195     if (cpu_has_svm(env) && (env->hflags2 & HF2_GIF_MASK)) {
5196         env->nested_state->flags |= KVM_STATE_NESTED_GIF_SET;
5197     } else {
5198         env->nested_state->flags &= ~KVM_STATE_NESTED_GIF_SET;
5199     }
5200 
5201     assert(env->nested_state->size <= max_nested_state_len);
5202     return kvm_vcpu_ioctl(CPU(cpu), KVM_SET_NESTED_STATE, env->nested_state);
5203 }
5204 
5205 static int kvm_get_nested_state(X86CPU *cpu)
5206 {
5207     CPUX86State *env = &cpu->env;
5208     int max_nested_state_len = kvm_max_nested_state_length();
5209     int ret;
5210 
5211     if (!env->nested_state) {
5212         return 0;
5213     }
5214 
5215     /*
5216      * It is possible that migration restored a smaller size into
5217      * nested_state->hdr.size than what our kernel support.
5218      * We preserve migration origin nested_state->hdr.size for
5219      * call to KVM_SET_NESTED_STATE but wish that our next call
5220      * to KVM_GET_NESTED_STATE will use max size our kernel support.
5221      */
5222     env->nested_state->size = max_nested_state_len;
5223 
5224     ret = kvm_vcpu_ioctl(CPU(cpu), KVM_GET_NESTED_STATE, env->nested_state);
5225     if (ret < 0) {
5226         return ret;
5227     }
5228 
5229     /*
5230      * Copy flags that are affected by reset to env->hflags and env->hflags2.
5231      */
5232     if (env->nested_state->flags & KVM_STATE_NESTED_GUEST_MODE) {
5233         env->hflags |= HF_GUEST_MASK;
5234     } else {
5235         env->hflags &= ~HF_GUEST_MASK;
5236     }
5237 
5238     /* Keep HF2_GIF_MASK set on !SVM as x86_cpu_pending_interrupt() needs it */
5239     if (cpu_has_svm(env)) {
5240         if (env->nested_state->flags & KVM_STATE_NESTED_GIF_SET) {
5241             env->hflags2 |= HF2_GIF_MASK;
5242         } else {
5243             env->hflags2 &= ~HF2_GIF_MASK;
5244         }
5245     }
5246 
5247     return ret;
5248 }
5249 
5250 int kvm_arch_put_registers(CPUState *cpu, int level, Error **errp)
5251 {
5252     X86CPU *x86_cpu = X86_CPU(cpu);
5253     int ret;
5254 
5255     assert(cpu_is_stopped(cpu) || qemu_cpu_is_self(cpu));
5256 
5257     /*
5258      * Put MSR_IA32_FEATURE_CONTROL first, this ensures the VM gets out of VMX
5259      * root operation upon vCPU reset. kvm_put_msr_feature_control() should also
5260      * precede kvm_put_nested_state() when 'real' nested state is set.
5261      */
5262     if (level >= KVM_PUT_RESET_STATE) {
5263         ret = kvm_put_msr_feature_control(x86_cpu);
5264         if (ret < 0) {
5265             error_setg_errno(errp, -ret, "Failed to set feature control MSR");
5266             return ret;
5267         }
5268     }
5269 
5270     /* must be before kvm_put_nested_state so that EFER.SVME is set */
5271     ret = has_sregs2 ? kvm_put_sregs2(x86_cpu) : kvm_put_sregs(x86_cpu);
5272     if (ret < 0) {
5273         error_setg_errno(errp, -ret, "Failed to set special registers");
5274         return ret;
5275     }
5276 
5277     if (level >= KVM_PUT_RESET_STATE) {
5278         ret = kvm_put_nested_state(x86_cpu);
5279         if (ret < 0) {
5280             error_setg_errno(errp, -ret, "Failed to set nested state");
5281             return ret;
5282         }
5283     }
5284 
5285     if (level == KVM_PUT_FULL_STATE) {
5286         /* We don't check for kvm_arch_set_tsc_khz() errors here,
5287          * because TSC frequency mismatch shouldn't abort migration,
5288          * unless the user explicitly asked for a more strict TSC
5289          * setting (e.g. using an explicit "tsc-freq" option).
5290          */
5291         kvm_arch_set_tsc_khz(cpu);
5292     }
5293 
5294 #ifdef CONFIG_XEN_EMU
5295     if (xen_mode == XEN_EMULATE && level == KVM_PUT_FULL_STATE) {
5296         ret = kvm_put_xen_state(cpu);
5297         if (ret < 0) {
5298             error_setg_errno(errp, -ret, "Failed to set Xen state");
5299             return ret;
5300         }
5301     }
5302 #endif
5303 
5304     ret = kvm_getput_regs(x86_cpu, 1);
5305     if (ret < 0) {
5306         error_setg_errno(errp, -ret, "Failed to set general purpose registers");
5307         return ret;
5308     }
5309     ret = kvm_put_xsave(x86_cpu);
5310     if (ret < 0) {
5311         error_setg_errno(errp, -ret, "Failed to set XSAVE");
5312         return ret;
5313     }
5314     ret = kvm_put_xcrs(x86_cpu);
5315     if (ret < 0) {
5316         error_setg_errno(errp, -ret, "Failed to set XCRs");
5317         return ret;
5318     }
5319     ret = kvm_put_msrs(x86_cpu, level);
5320     if (ret < 0) {
5321         error_setg_errno(errp, -ret, "Failed to set MSRs");
5322         return ret;
5323     }
5324     ret = kvm_put_vcpu_events(x86_cpu, level);
5325     if (ret < 0) {
5326         error_setg_errno(errp, -ret, "Failed to set vCPU events");
5327         return ret;
5328     }
5329     if (level >= KVM_PUT_RESET_STATE) {
5330         ret = kvm_put_mp_state(x86_cpu);
5331         if (ret < 0) {
5332             error_setg_errno(errp, -ret, "Failed to set MP state");
5333             return ret;
5334         }
5335     }
5336 
5337     ret = kvm_put_tscdeadline_msr(x86_cpu);
5338     if (ret < 0) {
5339         error_setg_errno(errp, -ret, "Failed to set TSC deadline MSR");
5340         return ret;
5341     }
5342     ret = kvm_put_debugregs(x86_cpu);
5343     if (ret < 0) {
5344         error_setg_errno(errp, -ret, "Failed to set debug registers");
5345         return ret;
5346     }
5347     return 0;
5348 }
5349 
5350 int kvm_arch_get_registers(CPUState *cs, Error **errp)
5351 {
5352     X86CPU *cpu = X86_CPU(cs);
5353     int ret;
5354 
5355     assert(cpu_is_stopped(cs) || qemu_cpu_is_self(cs));
5356 
5357     ret = kvm_get_vcpu_events(cpu);
5358     if (ret < 0) {
5359         error_setg_errno(errp, -ret, "Failed to get vCPU events");
5360         goto out;
5361     }
5362     /*
5363      * KVM_GET_MPSTATE can modify CS and RIP, call it before
5364      * KVM_GET_REGS and KVM_GET_SREGS.
5365      */
5366     ret = kvm_get_mp_state(cpu);
5367     if (ret < 0) {
5368         error_setg_errno(errp, -ret, "Failed to get MP state");
5369         goto out;
5370     }
5371     ret = kvm_getput_regs(cpu, 0);
5372     if (ret < 0) {
5373         error_setg_errno(errp, -ret, "Failed to get general purpose registers");
5374         goto out;
5375     }
5376     ret = kvm_get_xsave(cpu);
5377     if (ret < 0) {
5378         error_setg_errno(errp, -ret, "Failed to get XSAVE");
5379         goto out;
5380     }
5381     ret = kvm_get_xcrs(cpu);
5382     if (ret < 0) {
5383         error_setg_errno(errp, -ret, "Failed to get XCRs");
5384         goto out;
5385     }
5386     ret = has_sregs2 ? kvm_get_sregs2(cpu) : kvm_get_sregs(cpu);
5387     if (ret < 0) {
5388         error_setg_errno(errp, -ret, "Failed to get special registers");
5389         goto out;
5390     }
5391     ret = kvm_get_msrs(cpu);
5392     if (ret < 0) {
5393         error_setg_errno(errp, -ret, "Failed to get MSRs");
5394         goto out;
5395     }
5396     ret = kvm_get_apic(cpu);
5397     if (ret < 0) {
5398         error_setg_errno(errp, -ret, "Failed to get APIC");
5399         goto out;
5400     }
5401     ret = kvm_get_debugregs(cpu);
5402     if (ret < 0) {
5403         error_setg_errno(errp, -ret, "Failed to get debug registers");
5404         goto out;
5405     }
5406     ret = kvm_get_nested_state(cpu);
5407     if (ret < 0) {
5408         error_setg_errno(errp, -ret, "Failed to get nested state");
5409         goto out;
5410     }
5411 #ifdef CONFIG_XEN_EMU
5412     if (xen_mode == XEN_EMULATE) {
5413         ret = kvm_get_xen_state(cs);
5414         if (ret < 0) {
5415             error_setg_errno(errp, -ret, "Failed to get Xen state");
5416             goto out;
5417         }
5418     }
5419 #endif
5420     ret = 0;
5421  out:
5422     cpu_sync_bndcs_hflags(&cpu->env);
5423     return ret;
5424 }
5425 
5426 void kvm_arch_pre_run(CPUState *cpu, struct kvm_run *run)
5427 {
5428     X86CPU *x86_cpu = X86_CPU(cpu);
5429     CPUX86State *env = &x86_cpu->env;
5430     int ret;
5431 
5432     /* Inject NMI */
5433     if (cpu->interrupt_request & (CPU_INTERRUPT_NMI | CPU_INTERRUPT_SMI)) {
5434         if (cpu->interrupt_request & CPU_INTERRUPT_NMI) {
5435             bql_lock();
5436             cpu->interrupt_request &= ~CPU_INTERRUPT_NMI;
5437             bql_unlock();
5438             DPRINTF("injected NMI\n");
5439             ret = kvm_vcpu_ioctl(cpu, KVM_NMI);
5440             if (ret < 0) {
5441                 fprintf(stderr, "KVM: injection failed, NMI lost (%s)\n",
5442                         strerror(-ret));
5443             }
5444         }
5445         if (cpu->interrupt_request & CPU_INTERRUPT_SMI) {
5446             bql_lock();
5447             cpu->interrupt_request &= ~CPU_INTERRUPT_SMI;
5448             bql_unlock();
5449             DPRINTF("injected SMI\n");
5450             ret = kvm_vcpu_ioctl(cpu, KVM_SMI);
5451             if (ret < 0) {
5452                 fprintf(stderr, "KVM: injection failed, SMI lost (%s)\n",
5453                         strerror(-ret));
5454             }
5455         }
5456     }
5457 
5458     if (!kvm_pic_in_kernel()) {
5459         bql_lock();
5460     }
5461 
5462     /* Force the VCPU out of its inner loop to process any INIT requests
5463      * or (for userspace APIC, but it is cheap to combine the checks here)
5464      * pending TPR access reports.
5465      */
5466     if (cpu->interrupt_request & (CPU_INTERRUPT_INIT | CPU_INTERRUPT_TPR)) {
5467         if ((cpu->interrupt_request & CPU_INTERRUPT_INIT) &&
5468             !(env->hflags & HF_SMM_MASK)) {
5469             cpu->exit_request = 1;
5470         }
5471         if (cpu->interrupt_request & CPU_INTERRUPT_TPR) {
5472             cpu->exit_request = 1;
5473         }
5474     }
5475 
5476     if (!kvm_pic_in_kernel()) {
5477         /* Try to inject an interrupt if the guest can accept it */
5478         if (run->ready_for_interrupt_injection &&
5479             (cpu->interrupt_request & CPU_INTERRUPT_HARD) &&
5480             (env->eflags & IF_MASK)) {
5481             int irq;
5482 
5483             cpu->interrupt_request &= ~CPU_INTERRUPT_HARD;
5484             irq = cpu_get_pic_interrupt(env);
5485             if (irq >= 0) {
5486                 struct kvm_interrupt intr;
5487 
5488                 intr.irq = irq;
5489                 DPRINTF("injected interrupt %d\n", irq);
5490                 ret = kvm_vcpu_ioctl(cpu, KVM_INTERRUPT, &intr);
5491                 if (ret < 0) {
5492                     fprintf(stderr,
5493                             "KVM: injection failed, interrupt lost (%s)\n",
5494                             strerror(-ret));
5495                 }
5496             }
5497         }
5498 
5499         /* If we have an interrupt but the guest is not ready to receive an
5500          * interrupt, request an interrupt window exit.  This will
5501          * cause a return to userspace as soon as the guest is ready to
5502          * receive interrupts. */
5503         if ((cpu->interrupt_request & CPU_INTERRUPT_HARD)) {
5504             run->request_interrupt_window = 1;
5505         } else {
5506             run->request_interrupt_window = 0;
5507         }
5508 
5509         DPRINTF("setting tpr\n");
5510         run->cr8 = cpu_get_apic_tpr(x86_cpu->apic_state);
5511 
5512         bql_unlock();
5513     }
5514 }
5515 
5516 static void kvm_rate_limit_on_bus_lock(void)
5517 {
5518     uint64_t delay_ns = ratelimit_calculate_delay(&bus_lock_ratelimit_ctrl, 1);
5519 
5520     if (delay_ns) {
5521         g_usleep(delay_ns / SCALE_US);
5522     }
5523 }
5524 
5525 MemTxAttrs kvm_arch_post_run(CPUState *cpu, struct kvm_run *run)
5526 {
5527     X86CPU *x86_cpu = X86_CPU(cpu);
5528     CPUX86State *env = &x86_cpu->env;
5529 
5530     if (run->flags & KVM_RUN_X86_SMM) {
5531         env->hflags |= HF_SMM_MASK;
5532     } else {
5533         env->hflags &= ~HF_SMM_MASK;
5534     }
5535     if (run->if_flag) {
5536         env->eflags |= IF_MASK;
5537     } else {
5538         env->eflags &= ~IF_MASK;
5539     }
5540     if (run->flags & KVM_RUN_X86_BUS_LOCK) {
5541         kvm_rate_limit_on_bus_lock();
5542     }
5543 
5544 #ifdef CONFIG_XEN_EMU
5545     /*
5546      * If the callback is asserted as a GSI (or PCI INTx) then check if
5547      * vcpu_info->evtchn_upcall_pending has been cleared, and deassert
5548      * the callback IRQ if so. Ideally we could hook into the PIC/IOAPIC
5549      * EOI and only resample then, exactly how the VFIO eventfd pairs
5550      * are designed to work for level triggered interrupts.
5551      */
5552     if (x86_cpu->env.xen_callback_asserted) {
5553         kvm_xen_maybe_deassert_callback(cpu);
5554     }
5555 #endif
5556 
5557     /* We need to protect the apic state against concurrent accesses from
5558      * different threads in case the userspace irqchip is used. */
5559     if (!kvm_irqchip_in_kernel()) {
5560         bql_lock();
5561     }
5562     cpu_set_apic_tpr(x86_cpu->apic_state, run->cr8);
5563     cpu_set_apic_base(x86_cpu->apic_state, run->apic_base);
5564     if (!kvm_irqchip_in_kernel()) {
5565         bql_unlock();
5566     }
5567     return cpu_get_mem_attrs(env);
5568 }
5569 
5570 int kvm_arch_process_async_events(CPUState *cs)
5571 {
5572     X86CPU *cpu = X86_CPU(cs);
5573     CPUX86State *env = &cpu->env;
5574 
5575     if (cs->interrupt_request & CPU_INTERRUPT_MCE) {
5576         /* We must not raise CPU_INTERRUPT_MCE if it's not supported. */
5577         assert(env->mcg_cap);
5578 
5579         cs->interrupt_request &= ~CPU_INTERRUPT_MCE;
5580 
5581         kvm_cpu_synchronize_state(cs);
5582 
5583         if (env->exception_nr == EXCP08_DBLE) {
5584             /* this means triple fault */
5585             qemu_system_reset_request(SHUTDOWN_CAUSE_GUEST_RESET);
5586             cs->exit_request = 1;
5587             return 0;
5588         }
5589         kvm_queue_exception(env, EXCP12_MCHK, 0, 0);
5590         env->has_error_code = 0;
5591 
5592         cs->halted = 0;
5593         if (kvm_irqchip_in_kernel() && env->mp_state == KVM_MP_STATE_HALTED) {
5594             env->mp_state = KVM_MP_STATE_RUNNABLE;
5595         }
5596     }
5597 
5598     if ((cs->interrupt_request & CPU_INTERRUPT_INIT) &&
5599         !(env->hflags & HF_SMM_MASK)) {
5600         kvm_cpu_synchronize_state(cs);
5601         do_cpu_init(cpu);
5602     }
5603 
5604     if (kvm_irqchip_in_kernel()) {
5605         return 0;
5606     }
5607 
5608     if (cs->interrupt_request & CPU_INTERRUPT_POLL) {
5609         cs->interrupt_request &= ~CPU_INTERRUPT_POLL;
5610         apic_poll_irq(cpu->apic_state);
5611     }
5612     if (((cs->interrupt_request & CPU_INTERRUPT_HARD) &&
5613          (env->eflags & IF_MASK)) ||
5614         (cs->interrupt_request & CPU_INTERRUPT_NMI)) {
5615         cs->halted = 0;
5616     }
5617     if (cs->interrupt_request & CPU_INTERRUPT_SIPI) {
5618         kvm_cpu_synchronize_state(cs);
5619         do_cpu_sipi(cpu);
5620     }
5621     if (cs->interrupt_request & CPU_INTERRUPT_TPR) {
5622         cs->interrupt_request &= ~CPU_INTERRUPT_TPR;
5623         kvm_cpu_synchronize_state(cs);
5624         apic_handle_tpr_access_report(cpu->apic_state, env->eip,
5625                                       env->tpr_access_type);
5626     }
5627 
5628     return cs->halted;
5629 }
5630 
5631 static int kvm_handle_halt(X86CPU *cpu)
5632 {
5633     CPUState *cs = CPU(cpu);
5634     CPUX86State *env = &cpu->env;
5635 
5636     if (!((cs->interrupt_request & CPU_INTERRUPT_HARD) &&
5637           (env->eflags & IF_MASK)) &&
5638         !(cs->interrupt_request & CPU_INTERRUPT_NMI)) {
5639         cs->halted = 1;
5640         return EXCP_HLT;
5641     }
5642 
5643     return 0;
5644 }
5645 
5646 static int kvm_handle_tpr_access(X86CPU *cpu)
5647 {
5648     CPUState *cs = CPU(cpu);
5649     struct kvm_run *run = cs->kvm_run;
5650 
5651     apic_handle_tpr_access_report(cpu->apic_state, run->tpr_access.rip,
5652                                   run->tpr_access.is_write ? TPR_ACCESS_WRITE
5653                                                            : TPR_ACCESS_READ);
5654     return 1;
5655 }
5656 
5657 int kvm_arch_insert_sw_breakpoint(CPUState *cs, struct kvm_sw_breakpoint *bp)
5658 {
5659     static const uint8_t int3 = 0xcc;
5660 
5661     if (cpu_memory_rw_debug(cs, bp->pc, (uint8_t *)&bp->saved_insn, 1, 0) ||
5662         cpu_memory_rw_debug(cs, bp->pc, (uint8_t *)&int3, 1, 1)) {
5663         return -EINVAL;
5664     }
5665     return 0;
5666 }
5667 
5668 int kvm_arch_remove_sw_breakpoint(CPUState *cs, struct kvm_sw_breakpoint *bp)
5669 {
5670     uint8_t int3;
5671 
5672     if (cpu_memory_rw_debug(cs, bp->pc, &int3, 1, 0)) {
5673         return -EINVAL;
5674     }
5675     if (int3 != 0xcc) {
5676         return 0;
5677     }
5678     if (cpu_memory_rw_debug(cs, bp->pc, (uint8_t *)&bp->saved_insn, 1, 1)) {
5679         return -EINVAL;
5680     }
5681     return 0;
5682 }
5683 
5684 static struct {
5685     target_ulong addr;
5686     int len;
5687     int type;
5688 } hw_breakpoint[4];
5689 
5690 static int nb_hw_breakpoint;
5691 
5692 static int find_hw_breakpoint(target_ulong addr, int len, int type)
5693 {
5694     int n;
5695 
5696     for (n = 0; n < nb_hw_breakpoint; n++) {
5697         if (hw_breakpoint[n].addr == addr && hw_breakpoint[n].type == type &&
5698             (hw_breakpoint[n].len == len || len == -1)) {
5699             return n;
5700         }
5701     }
5702     return -1;
5703 }
5704 
5705 int kvm_arch_insert_hw_breakpoint(vaddr addr, vaddr len, int type)
5706 {
5707     switch (type) {
5708     case GDB_BREAKPOINT_HW:
5709         len = 1;
5710         break;
5711     case GDB_WATCHPOINT_WRITE:
5712     case GDB_WATCHPOINT_ACCESS:
5713         switch (len) {
5714         case 1:
5715             break;
5716         case 2:
5717         case 4:
5718         case 8:
5719             if (addr & (len - 1)) {
5720                 return -EINVAL;
5721             }
5722             break;
5723         default:
5724             return -EINVAL;
5725         }
5726         break;
5727     default:
5728         return -ENOSYS;
5729     }
5730 
5731     if (nb_hw_breakpoint == 4) {
5732         return -ENOBUFS;
5733     }
5734     if (find_hw_breakpoint(addr, len, type) >= 0) {
5735         return -EEXIST;
5736     }
5737     hw_breakpoint[nb_hw_breakpoint].addr = addr;
5738     hw_breakpoint[nb_hw_breakpoint].len = len;
5739     hw_breakpoint[nb_hw_breakpoint].type = type;
5740     nb_hw_breakpoint++;
5741 
5742     return 0;
5743 }
5744 
5745 int kvm_arch_remove_hw_breakpoint(vaddr addr, vaddr len, int type)
5746 {
5747     int n;
5748 
5749     n = find_hw_breakpoint(addr, (type == GDB_BREAKPOINT_HW) ? 1 : len, type);
5750     if (n < 0) {
5751         return -ENOENT;
5752     }
5753     nb_hw_breakpoint--;
5754     hw_breakpoint[n] = hw_breakpoint[nb_hw_breakpoint];
5755 
5756     return 0;
5757 }
5758 
5759 void kvm_arch_remove_all_hw_breakpoints(void)
5760 {
5761     nb_hw_breakpoint = 0;
5762 }
5763 
5764 static CPUWatchpoint hw_watchpoint;
5765 
5766 static int kvm_handle_debug(X86CPU *cpu,
5767                             struct kvm_debug_exit_arch *arch_info)
5768 {
5769     CPUState *cs = CPU(cpu);
5770     CPUX86State *env = &cpu->env;
5771     int ret = 0;
5772     int n;
5773 
5774     if (arch_info->exception == EXCP01_DB) {
5775         if (arch_info->dr6 & DR6_BS) {
5776             if (cs->singlestep_enabled) {
5777                 ret = EXCP_DEBUG;
5778             }
5779         } else {
5780             for (n = 0; n < 4; n++) {
5781                 if (arch_info->dr6 & (1 << n)) {
5782                     switch ((arch_info->dr7 >> (16 + n*4)) & 0x3) {
5783                     case 0x0:
5784                         ret = EXCP_DEBUG;
5785                         break;
5786                     case 0x1:
5787                         ret = EXCP_DEBUG;
5788                         cs->watchpoint_hit = &hw_watchpoint;
5789                         hw_watchpoint.vaddr = hw_breakpoint[n].addr;
5790                         hw_watchpoint.flags = BP_MEM_WRITE;
5791                         break;
5792                     case 0x3:
5793                         ret = EXCP_DEBUG;
5794                         cs->watchpoint_hit = &hw_watchpoint;
5795                         hw_watchpoint.vaddr = hw_breakpoint[n].addr;
5796                         hw_watchpoint.flags = BP_MEM_ACCESS;
5797                         break;
5798                     }
5799                 }
5800             }
5801         }
5802     } else if (kvm_find_sw_breakpoint(cs, arch_info->pc)) {
5803         ret = EXCP_DEBUG;
5804     }
5805     if (ret == 0) {
5806         cpu_synchronize_state(cs);
5807         assert(env->exception_nr == -1);
5808 
5809         /* pass to guest */
5810         kvm_queue_exception(env, arch_info->exception,
5811                             arch_info->exception == EXCP01_DB,
5812                             arch_info->dr6);
5813         env->has_error_code = 0;
5814     }
5815 
5816     return ret;
5817 }
5818 
5819 void kvm_arch_update_guest_debug(CPUState *cpu, struct kvm_guest_debug *dbg)
5820 {
5821     const uint8_t type_code[] = {
5822         [GDB_BREAKPOINT_HW] = 0x0,
5823         [GDB_WATCHPOINT_WRITE] = 0x1,
5824         [GDB_WATCHPOINT_ACCESS] = 0x3
5825     };
5826     const uint8_t len_code[] = {
5827         [1] = 0x0, [2] = 0x1, [4] = 0x3, [8] = 0x2
5828     };
5829     int n;
5830 
5831     if (kvm_sw_breakpoints_active(cpu)) {
5832         dbg->control |= KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_SW_BP;
5833     }
5834     if (nb_hw_breakpoint > 0) {
5835         dbg->control |= KVM_GUESTDBG_ENABLE | KVM_GUESTDBG_USE_HW_BP;
5836         dbg->arch.debugreg[7] = 0x0600;
5837         for (n = 0; n < nb_hw_breakpoint; n++) {
5838             dbg->arch.debugreg[n] = hw_breakpoint[n].addr;
5839             dbg->arch.debugreg[7] |= (2 << (n * 2)) |
5840                 (type_code[hw_breakpoint[n].type] << (16 + n*4)) |
5841                 ((uint32_t)len_code[hw_breakpoint[n].len] << (18 + n*4));
5842         }
5843     }
5844 }
5845 
5846 static int kvm_install_msr_filters(KVMState *s)
5847 {
5848     uint64_t zero = 0;
5849     struct kvm_msr_filter filter = {
5850         .flags = KVM_MSR_FILTER_DEFAULT_ALLOW,
5851     };
5852     int i, j = 0;
5853 
5854     QEMU_BUILD_BUG_ON(ARRAY_SIZE(msr_handlers) != ARRAY_SIZE(filter.ranges));
5855     for (i = 0; i < ARRAY_SIZE(msr_handlers); i++) {
5856         KVMMSRHandlers *handler = &msr_handlers[i];
5857         if (handler->msr) {
5858             struct kvm_msr_filter_range *range = &filter.ranges[j++];
5859 
5860             *range = (struct kvm_msr_filter_range) {
5861                 .flags = 0,
5862                 .nmsrs = 1,
5863                 .base = handler->msr,
5864                 .bitmap = (__u8 *)&zero,
5865             };
5866 
5867             if (handler->rdmsr) {
5868                 range->flags |= KVM_MSR_FILTER_READ;
5869             }
5870 
5871             if (handler->wrmsr) {
5872                 range->flags |= KVM_MSR_FILTER_WRITE;
5873             }
5874         }
5875     }
5876 
5877     return kvm_vm_ioctl(s, KVM_X86_SET_MSR_FILTER, &filter);
5878 }
5879 
5880 static int kvm_filter_msr(KVMState *s, uint32_t msr, QEMURDMSRHandler *rdmsr,
5881                           QEMUWRMSRHandler *wrmsr)
5882 {
5883     int i, ret;
5884 
5885     for (i = 0; i < ARRAY_SIZE(msr_handlers); i++) {
5886         if (!msr_handlers[i].msr) {
5887             msr_handlers[i] = (KVMMSRHandlers) {
5888                 .msr = msr,
5889                 .rdmsr = rdmsr,
5890                 .wrmsr = wrmsr,
5891             };
5892 
5893             ret = kvm_install_msr_filters(s);
5894             if (ret) {
5895                 msr_handlers[i] = (KVMMSRHandlers) { };
5896                 return ret;
5897             }
5898 
5899             return 0;
5900         }
5901     }
5902 
5903     return -EINVAL;
5904 }
5905 
5906 static int kvm_handle_rdmsr(X86CPU *cpu, struct kvm_run *run)
5907 {
5908     int i;
5909     bool r;
5910 
5911     for (i = 0; i < ARRAY_SIZE(msr_handlers); i++) {
5912         KVMMSRHandlers *handler = &msr_handlers[i];
5913         if (run->msr.index == handler->msr) {
5914             if (handler->rdmsr) {
5915                 r = handler->rdmsr(cpu, handler->msr,
5916                                    (uint64_t *)&run->msr.data);
5917                 run->msr.error = r ? 0 : 1;
5918                 return 0;
5919             }
5920         }
5921     }
5922 
5923     g_assert_not_reached();
5924 }
5925 
5926 static int kvm_handle_wrmsr(X86CPU *cpu, struct kvm_run *run)
5927 {
5928     int i;
5929     bool r;
5930 
5931     for (i = 0; i < ARRAY_SIZE(msr_handlers); i++) {
5932         KVMMSRHandlers *handler = &msr_handlers[i];
5933         if (run->msr.index == handler->msr) {
5934             if (handler->wrmsr) {
5935                 r = handler->wrmsr(cpu, handler->msr, run->msr.data);
5936                 run->msr.error = r ? 0 : 1;
5937                 return 0;
5938             }
5939         }
5940     }
5941 
5942     g_assert_not_reached();
5943 }
5944 
5945 static bool has_sgx_provisioning;
5946 
5947 static bool __kvm_enable_sgx_provisioning(KVMState *s)
5948 {
5949     int fd, ret;
5950 
5951     if (!kvm_vm_check_extension(s, KVM_CAP_SGX_ATTRIBUTE)) {
5952         return false;
5953     }
5954 
5955     fd = qemu_open_old("/dev/sgx_provision", O_RDONLY);
5956     if (fd < 0) {
5957         return false;
5958     }
5959 
5960     ret = kvm_vm_enable_cap(s, KVM_CAP_SGX_ATTRIBUTE, 0, fd);
5961     if (ret) {
5962         error_report("Could not enable SGX PROVISIONKEY: %s", strerror(-ret));
5963         exit(1);
5964     }
5965     close(fd);
5966     return true;
5967 }
5968 
5969 bool kvm_enable_sgx_provisioning(KVMState *s)
5970 {
5971     return MEMORIZE(__kvm_enable_sgx_provisioning(s), has_sgx_provisioning);
5972 }
5973 
5974 static bool host_supports_vmx(void)
5975 {
5976     uint32_t ecx, unused;
5977 
5978     host_cpuid(1, 0, &unused, &unused, &ecx, &unused);
5979     return ecx & CPUID_EXT_VMX;
5980 }
5981 
5982 /*
5983  * Currently the handling here only supports use of KVM_HC_MAP_GPA_RANGE
5984  * to service guest-initiated memory attribute update requests so that
5985  * KVM_SET_MEMORY_ATTRIBUTES can update whether or not a page should be
5986  * backed by the private memory pool provided by guest_memfd, and as such
5987  * is only applicable to guest_memfd-backed guests (e.g. SNP/TDX).
5988  *
5989  * Other other use-cases for KVM_HC_MAP_GPA_RANGE, such as for SEV live
5990  * migration, are not implemented here currently.
5991  *
5992  * For the guest_memfd use-case, these exits will generally be synthesized
5993  * by KVM based on platform-specific hypercalls, like GHCB requests in the
5994  * case of SEV-SNP, and not issued directly within the guest though the
5995  * KVM_HC_MAP_GPA_RANGE hypercall. So in this case, KVM_HC_MAP_GPA_RANGE is
5996  * not actually advertised to guests via the KVM CPUID feature bit, as
5997  * opposed to SEV live migration where it would be. Since it is unlikely the
5998  * SEV live migration use-case would be useful for guest-memfd backed guests,
5999  * because private/shared page tracking is already provided through other
6000  * means, these 2 use-cases should be treated as being mutually-exclusive.
6001  */
6002 static int kvm_handle_hc_map_gpa_range(struct kvm_run *run)
6003 {
6004     uint64_t gpa, size, attributes;
6005 
6006     if (!machine_require_guest_memfd(current_machine))
6007         return -EINVAL;
6008 
6009     gpa = run->hypercall.args[0];
6010     size = run->hypercall.args[1] * TARGET_PAGE_SIZE;
6011     attributes = run->hypercall.args[2];
6012 
6013     trace_kvm_hc_map_gpa_range(gpa, size, attributes, run->hypercall.flags);
6014 
6015     return kvm_convert_memory(gpa, size, attributes & KVM_MAP_GPA_RANGE_ENCRYPTED);
6016 }
6017 
6018 static int kvm_handle_hypercall(struct kvm_run *run)
6019 {
6020     if (run->hypercall.nr == KVM_HC_MAP_GPA_RANGE)
6021         return kvm_handle_hc_map_gpa_range(run);
6022 
6023     return -EINVAL;
6024 }
6025 
6026 #define VMX_INVALID_GUEST_STATE 0x80000021
6027 
6028 int kvm_arch_handle_exit(CPUState *cs, struct kvm_run *run)
6029 {
6030     X86CPU *cpu = X86_CPU(cs);
6031     uint64_t code;
6032     int ret;
6033     bool ctx_invalid;
6034     KVMState *state;
6035 
6036     switch (run->exit_reason) {
6037     case KVM_EXIT_HLT:
6038         DPRINTF("handle_hlt\n");
6039         bql_lock();
6040         ret = kvm_handle_halt(cpu);
6041         bql_unlock();
6042         break;
6043     case KVM_EXIT_SET_TPR:
6044         ret = 0;
6045         break;
6046     case KVM_EXIT_TPR_ACCESS:
6047         bql_lock();
6048         ret = kvm_handle_tpr_access(cpu);
6049         bql_unlock();
6050         break;
6051     case KVM_EXIT_FAIL_ENTRY:
6052         code = run->fail_entry.hardware_entry_failure_reason;
6053         fprintf(stderr, "KVM: entry failed, hardware error 0x%" PRIx64 "\n",
6054                 code);
6055         if (host_supports_vmx() && code == VMX_INVALID_GUEST_STATE) {
6056             fprintf(stderr,
6057                     "\nIf you're running a guest on an Intel machine without "
6058                         "unrestricted mode\n"
6059                     "support, the failure can be most likely due to the guest "
6060                         "entering an invalid\n"
6061                     "state for Intel VT. For example, the guest maybe running "
6062                         "in big real mode\n"
6063                     "which is not supported on less recent Intel processors."
6064                         "\n\n");
6065         }
6066         ret = -1;
6067         break;
6068     case KVM_EXIT_EXCEPTION:
6069         fprintf(stderr, "KVM: exception %d exit (error code 0x%x)\n",
6070                 run->ex.exception, run->ex.error_code);
6071         ret = -1;
6072         break;
6073     case KVM_EXIT_DEBUG:
6074         DPRINTF("kvm_exit_debug\n");
6075         bql_lock();
6076         ret = kvm_handle_debug(cpu, &run->debug.arch);
6077         bql_unlock();
6078         break;
6079     case KVM_EXIT_HYPERV:
6080         ret = kvm_hv_handle_exit(cpu, &run->hyperv);
6081         break;
6082     case KVM_EXIT_IOAPIC_EOI:
6083         ioapic_eoi_broadcast(run->eoi.vector);
6084         ret = 0;
6085         break;
6086     case KVM_EXIT_X86_BUS_LOCK:
6087         /* already handled in kvm_arch_post_run */
6088         ret = 0;
6089         break;
6090     case KVM_EXIT_NOTIFY:
6091         ctx_invalid = !!(run->notify.flags & KVM_NOTIFY_CONTEXT_INVALID);
6092         state = KVM_STATE(current_accel());
6093         if (ctx_invalid ||
6094             state->notify_vmexit == NOTIFY_VMEXIT_OPTION_INTERNAL_ERROR) {
6095             warn_report("KVM internal error: Encountered a notify exit "
6096                         "with invalid context in guest.");
6097             ret = -1;
6098         } else {
6099             warn_report_once("KVM: Encountered a notify exit with valid "
6100                              "context in guest. "
6101                              "The guest could be misbehaving.");
6102             ret = 0;
6103         }
6104         break;
6105     case KVM_EXIT_X86_RDMSR:
6106         /* We only enable MSR filtering, any other exit is bogus */
6107         assert(run->msr.reason == KVM_MSR_EXIT_REASON_FILTER);
6108         ret = kvm_handle_rdmsr(cpu, run);
6109         break;
6110     case KVM_EXIT_X86_WRMSR:
6111         /* We only enable MSR filtering, any other exit is bogus */
6112         assert(run->msr.reason == KVM_MSR_EXIT_REASON_FILTER);
6113         ret = kvm_handle_wrmsr(cpu, run);
6114         break;
6115 #ifdef CONFIG_XEN_EMU
6116     case KVM_EXIT_XEN:
6117         ret = kvm_xen_handle_exit(cpu, &run->xen);
6118         break;
6119 #endif
6120     case KVM_EXIT_HYPERCALL:
6121         ret = kvm_handle_hypercall(run);
6122         break;
6123     default:
6124         fprintf(stderr, "KVM: unknown exit reason %d\n", run->exit_reason);
6125         ret = -1;
6126         break;
6127     }
6128 
6129     return ret;
6130 }
6131 
6132 bool kvm_arch_stop_on_emulation_error(CPUState *cs)
6133 {
6134     X86CPU *cpu = X86_CPU(cs);
6135     CPUX86State *env = &cpu->env;
6136 
6137     kvm_cpu_synchronize_state(cs);
6138     return !(env->cr[0] & CR0_PE_MASK) ||
6139            ((env->segs[R_CS].selector  & 3) != 3);
6140 }
6141 
6142 void kvm_arch_init_irq_routing(KVMState *s)
6143 {
6144     /* We know at this point that we're using the in-kernel
6145      * irqchip, so we can use irqfds, and on x86 we know
6146      * we can use msi via irqfd and GSI routing.
6147      */
6148     kvm_msi_via_irqfd_allowed = true;
6149     kvm_gsi_routing_allowed = true;
6150 
6151     if (kvm_irqchip_is_split()) {
6152         KVMRouteChange c = kvm_irqchip_begin_route_changes(s);
6153         int i;
6154 
6155         /* If the ioapic is in QEMU and the lapics are in KVM, reserve
6156            MSI routes for signaling interrupts to the local apics. */
6157         for (i = 0; i < IOAPIC_NUM_PINS; i++) {
6158             if (kvm_irqchip_add_msi_route(&c, 0, NULL) < 0) {
6159                 error_report("Could not enable split IRQ mode.");
6160                 exit(1);
6161             }
6162         }
6163         kvm_irqchip_commit_route_changes(&c);
6164     }
6165 }
6166 
6167 int kvm_arch_irqchip_create(KVMState *s)
6168 {
6169     int ret;
6170     if (kvm_kernel_irqchip_split()) {
6171         ret = kvm_vm_enable_cap(s, KVM_CAP_SPLIT_IRQCHIP, 0, 24);
6172         if (ret) {
6173             error_report("Could not enable split irqchip mode: %s",
6174                          strerror(-ret));
6175             exit(1);
6176         } else {
6177             DPRINTF("Enabled KVM_CAP_SPLIT_IRQCHIP\n");
6178             kvm_split_irqchip = true;
6179             return 1;
6180         }
6181     } else {
6182         return 0;
6183     }
6184 }
6185 
6186 uint64_t kvm_swizzle_msi_ext_dest_id(uint64_t address)
6187 {
6188     CPUX86State *env;
6189     uint64_t ext_id;
6190 
6191     if (!first_cpu) {
6192         return address;
6193     }
6194     env = &X86_CPU(first_cpu)->env;
6195     if (!(env->features[FEAT_KVM] & CPUID_KVM_MSI_EXT_DEST_ID)) {
6196         return address;
6197     }
6198 
6199     /*
6200      * If the remappable format bit is set, or the upper bits are
6201      * already set in address_hi, or the low extended bits aren't
6202      * there anyway, do nothing.
6203      */
6204     ext_id = address & (0xff << MSI_ADDR_DEST_IDX_SHIFT);
6205     if (!ext_id || (ext_id & (1 << MSI_ADDR_DEST_IDX_SHIFT)) || (address >> 32)) {
6206         return address;
6207     }
6208 
6209     address &= ~ext_id;
6210     address |= ext_id << 35;
6211     return address;
6212 }
6213 
6214 int kvm_arch_fixup_msi_route(struct kvm_irq_routing_entry *route,
6215                              uint64_t address, uint32_t data, PCIDevice *dev)
6216 {
6217     X86IOMMUState *iommu = x86_iommu_get_default();
6218 
6219     if (iommu) {
6220         X86IOMMUClass *class = X86_IOMMU_DEVICE_GET_CLASS(iommu);
6221 
6222         if (class->int_remap) {
6223             int ret;
6224             MSIMessage src, dst;
6225 
6226             src.address = route->u.msi.address_hi;
6227             src.address <<= VTD_MSI_ADDR_HI_SHIFT;
6228             src.address |= route->u.msi.address_lo;
6229             src.data = route->u.msi.data;
6230 
6231             ret = class->int_remap(iommu, &src, &dst, dev ?     \
6232                                    pci_requester_id(dev) :      \
6233                                    X86_IOMMU_SID_INVALID);
6234             if (ret) {
6235                 trace_kvm_x86_fixup_msi_error(route->gsi);
6236                 return 1;
6237             }
6238 
6239             /*
6240              * Handled untranslated compatibility format interrupt with
6241              * extended destination ID in the low bits 11-5. */
6242             dst.address = kvm_swizzle_msi_ext_dest_id(dst.address);
6243 
6244             route->u.msi.address_hi = dst.address >> VTD_MSI_ADDR_HI_SHIFT;
6245             route->u.msi.address_lo = dst.address & VTD_MSI_ADDR_LO_MASK;
6246             route->u.msi.data = dst.data;
6247             return 0;
6248         }
6249     }
6250 
6251 #ifdef CONFIG_XEN_EMU
6252     if (xen_mode == XEN_EMULATE) {
6253         int handled = xen_evtchn_translate_pirq_msi(route, address, data);
6254 
6255         /*
6256          * If it was a PIRQ and successfully routed (handled == 0) or it was
6257          * an error (handled < 0), return. If it wasn't a PIRQ, keep going.
6258          */
6259         if (handled <= 0) {
6260             return handled;
6261         }
6262     }
6263 #endif
6264 
6265     address = kvm_swizzle_msi_ext_dest_id(address);
6266     route->u.msi.address_hi = address >> VTD_MSI_ADDR_HI_SHIFT;
6267     route->u.msi.address_lo = address & VTD_MSI_ADDR_LO_MASK;
6268     return 0;
6269 }
6270 
6271 typedef struct MSIRouteEntry MSIRouteEntry;
6272 
6273 struct MSIRouteEntry {
6274     PCIDevice *dev;             /* Device pointer */
6275     int vector;                 /* MSI/MSIX vector index */
6276     int virq;                   /* Virtual IRQ index */
6277     QLIST_ENTRY(MSIRouteEntry) list;
6278 };
6279 
6280 /* List of used GSI routes */
6281 static QLIST_HEAD(, MSIRouteEntry) msi_route_list = \
6282     QLIST_HEAD_INITIALIZER(msi_route_list);
6283 
6284 void kvm_update_msi_routes_all(void *private, bool global,
6285                                uint32_t index, uint32_t mask)
6286 {
6287     int cnt = 0, vector;
6288     MSIRouteEntry *entry;
6289     MSIMessage msg;
6290     PCIDevice *dev;
6291 
6292     /* TODO: explicit route update */
6293     QLIST_FOREACH(entry, &msi_route_list, list) {
6294         cnt++;
6295         vector = entry->vector;
6296         dev = entry->dev;
6297         if (msix_enabled(dev) && !msix_is_masked(dev, vector)) {
6298             msg = msix_get_message(dev, vector);
6299         } else if (msi_enabled(dev) && !msi_is_masked(dev, vector)) {
6300             msg = msi_get_message(dev, vector);
6301         } else {
6302             /*
6303              * Either MSI/MSIX is disabled for the device, or the
6304              * specific message was masked out.  Skip this one.
6305              */
6306             continue;
6307         }
6308         kvm_irqchip_update_msi_route(kvm_state, entry->virq, msg, dev);
6309     }
6310     kvm_irqchip_commit_routes(kvm_state);
6311     trace_kvm_x86_update_msi_routes(cnt);
6312 }
6313 
6314 int kvm_arch_add_msi_route_post(struct kvm_irq_routing_entry *route,
6315                                 int vector, PCIDevice *dev)
6316 {
6317     static bool notify_list_inited = false;
6318     MSIRouteEntry *entry;
6319 
6320     if (!dev) {
6321         /* These are (possibly) IOAPIC routes only used for split
6322          * kernel irqchip mode, while what we are housekeeping are
6323          * PCI devices only. */
6324         return 0;
6325     }
6326 
6327     entry = g_new0(MSIRouteEntry, 1);
6328     entry->dev = dev;
6329     entry->vector = vector;
6330     entry->virq = route->gsi;
6331     QLIST_INSERT_HEAD(&msi_route_list, entry, list);
6332 
6333     trace_kvm_x86_add_msi_route(route->gsi);
6334 
6335     if (!notify_list_inited) {
6336         /* For the first time we do add route, add ourselves into
6337          * IOMMU's IEC notify list if needed. */
6338         X86IOMMUState *iommu = x86_iommu_get_default();
6339         if (iommu) {
6340             x86_iommu_iec_register_notifier(iommu,
6341                                             kvm_update_msi_routes_all,
6342                                             NULL);
6343         }
6344         notify_list_inited = true;
6345     }
6346     return 0;
6347 }
6348 
6349 int kvm_arch_release_virq_post(int virq)
6350 {
6351     MSIRouteEntry *entry, *next;
6352     QLIST_FOREACH_SAFE(entry, &msi_route_list, list, next) {
6353         if (entry->virq == virq) {
6354             trace_kvm_x86_remove_msi_route(virq);
6355             QLIST_REMOVE(entry, list);
6356             g_free(entry);
6357             break;
6358         }
6359     }
6360     return 0;
6361 }
6362 
6363 int kvm_arch_msi_data_to_gsi(uint32_t data)
6364 {
6365     abort();
6366 }
6367 
6368 bool kvm_has_waitpkg(void)
6369 {
6370     return has_msr_umwait;
6371 }
6372 
6373 #define ARCH_REQ_XCOMP_GUEST_PERM       0x1025
6374 
6375 void kvm_request_xsave_components(X86CPU *cpu, uint64_t mask)
6376 {
6377     KVMState *s = kvm_state;
6378     uint64_t supported;
6379 
6380     mask &= XSTATE_DYNAMIC_MASK;
6381     if (!mask) {
6382         return;
6383     }
6384     /*
6385      * Just ignore bits that are not in CPUID[EAX=0xD,ECX=0].
6386      * ARCH_REQ_XCOMP_GUEST_PERM would fail, and QEMU has warned
6387      * about them already because they are not supported features.
6388      */
6389     supported = kvm_arch_get_supported_cpuid(s, 0xd, 0, R_EAX);
6390     supported |= (uint64_t)kvm_arch_get_supported_cpuid(s, 0xd, 0, R_EDX) << 32;
6391     mask &= supported;
6392 
6393     while (mask) {
6394         int bit = ctz64(mask);
6395         int rc = syscall(SYS_arch_prctl, ARCH_REQ_XCOMP_GUEST_PERM, bit);
6396         if (rc) {
6397             /*
6398              * Older kernel version (<5.17) do not support
6399              * ARCH_REQ_XCOMP_GUEST_PERM, but also do not return
6400              * any dynamic feature from kvm_arch_get_supported_cpuid.
6401              */
6402             warn_report("prctl(ARCH_REQ_XCOMP_GUEST_PERM) failure "
6403                         "for feature bit %d", bit);
6404         }
6405         mask &= ~BIT_ULL(bit);
6406     }
6407 }
6408 
6409 static int kvm_arch_get_notify_vmexit(Object *obj, Error **errp)
6410 {
6411     KVMState *s = KVM_STATE(obj);
6412     return s->notify_vmexit;
6413 }
6414 
6415 static void kvm_arch_set_notify_vmexit(Object *obj, int value, Error **errp)
6416 {
6417     KVMState *s = KVM_STATE(obj);
6418 
6419     if (s->fd != -1) {
6420         error_setg(errp, "Cannot set properties after the accelerator has been initialized");
6421         return;
6422     }
6423 
6424     s->notify_vmexit = value;
6425 }
6426 
6427 static void kvm_arch_get_notify_window(Object *obj, Visitor *v,
6428                                        const char *name, void *opaque,
6429                                        Error **errp)
6430 {
6431     KVMState *s = KVM_STATE(obj);
6432     uint32_t value = s->notify_window;
6433 
6434     visit_type_uint32(v, name, &value, errp);
6435 }
6436 
6437 static void kvm_arch_set_notify_window(Object *obj, Visitor *v,
6438                                        const char *name, void *opaque,
6439                                        Error **errp)
6440 {
6441     KVMState *s = KVM_STATE(obj);
6442     uint32_t value;
6443 
6444     if (s->fd != -1) {
6445         error_setg(errp, "Cannot set properties after the accelerator has been initialized");
6446         return;
6447     }
6448 
6449     if (!visit_type_uint32(v, name, &value, errp)) {
6450         return;
6451     }
6452 
6453     s->notify_window = value;
6454 }
6455 
6456 static void kvm_arch_get_xen_version(Object *obj, Visitor *v,
6457                                      const char *name, void *opaque,
6458                                      Error **errp)
6459 {
6460     KVMState *s = KVM_STATE(obj);
6461     uint32_t value = s->xen_version;
6462 
6463     visit_type_uint32(v, name, &value, errp);
6464 }
6465 
6466 static void kvm_arch_set_xen_version(Object *obj, Visitor *v,
6467                                      const char *name, void *opaque,
6468                                      Error **errp)
6469 {
6470     KVMState *s = KVM_STATE(obj);
6471     Error *error = NULL;
6472     uint32_t value;
6473 
6474     visit_type_uint32(v, name, &value, &error);
6475     if (error) {
6476         error_propagate(errp, error);
6477         return;
6478     }
6479 
6480     s->xen_version = value;
6481     if (value && xen_mode == XEN_DISABLED) {
6482         xen_mode = XEN_EMULATE;
6483     }
6484 }
6485 
6486 static void kvm_arch_get_xen_gnttab_max_frames(Object *obj, Visitor *v,
6487                                                const char *name, void *opaque,
6488                                                Error **errp)
6489 {
6490     KVMState *s = KVM_STATE(obj);
6491     uint16_t value = s->xen_gnttab_max_frames;
6492 
6493     visit_type_uint16(v, name, &value, errp);
6494 }
6495 
6496 static void kvm_arch_set_xen_gnttab_max_frames(Object *obj, Visitor *v,
6497                                                const char *name, void *opaque,
6498                                                Error **errp)
6499 {
6500     KVMState *s = KVM_STATE(obj);
6501     Error *error = NULL;
6502     uint16_t value;
6503 
6504     visit_type_uint16(v, name, &value, &error);
6505     if (error) {
6506         error_propagate(errp, error);
6507         return;
6508     }
6509 
6510     s->xen_gnttab_max_frames = value;
6511 }
6512 
6513 static void kvm_arch_get_xen_evtchn_max_pirq(Object *obj, Visitor *v,
6514                                              const char *name, void *opaque,
6515                                              Error **errp)
6516 {
6517     KVMState *s = KVM_STATE(obj);
6518     uint16_t value = s->xen_evtchn_max_pirq;
6519 
6520     visit_type_uint16(v, name, &value, errp);
6521 }
6522 
6523 static void kvm_arch_set_xen_evtchn_max_pirq(Object *obj, Visitor *v,
6524                                              const char *name, void *opaque,
6525                                              Error **errp)
6526 {
6527     KVMState *s = KVM_STATE(obj);
6528     Error *error = NULL;
6529     uint16_t value;
6530 
6531     visit_type_uint16(v, name, &value, &error);
6532     if (error) {
6533         error_propagate(errp, error);
6534         return;
6535     }
6536 
6537     s->xen_evtchn_max_pirq = value;
6538 }
6539 
6540 void kvm_arch_accel_class_init(ObjectClass *oc)
6541 {
6542     object_class_property_add_enum(oc, "notify-vmexit", "NotifyVMexitOption",
6543                                    &NotifyVmexitOption_lookup,
6544                                    kvm_arch_get_notify_vmexit,
6545                                    kvm_arch_set_notify_vmexit);
6546     object_class_property_set_description(oc, "notify-vmexit",
6547                                           "Enable notify VM exit");
6548 
6549     object_class_property_add(oc, "notify-window", "uint32",
6550                               kvm_arch_get_notify_window,
6551                               kvm_arch_set_notify_window,
6552                               NULL, NULL);
6553     object_class_property_set_description(oc, "notify-window",
6554                                           "Clock cycles without an event window "
6555                                           "after which a notification VM exit occurs");
6556 
6557     object_class_property_add(oc, "xen-version", "uint32",
6558                               kvm_arch_get_xen_version,
6559                               kvm_arch_set_xen_version,
6560                               NULL, NULL);
6561     object_class_property_set_description(oc, "xen-version",
6562                                           "Xen version to be emulated "
6563                                           "(in XENVER_version form "
6564                                           "e.g. 0x4000a for 4.10)");
6565 
6566     object_class_property_add(oc, "xen-gnttab-max-frames", "uint16",
6567                               kvm_arch_get_xen_gnttab_max_frames,
6568                               kvm_arch_set_xen_gnttab_max_frames,
6569                               NULL, NULL);
6570     object_class_property_set_description(oc, "xen-gnttab-max-frames",
6571                                           "Maximum number of grant table frames");
6572 
6573     object_class_property_add(oc, "xen-evtchn-max-pirq", "uint16",
6574                               kvm_arch_get_xen_evtchn_max_pirq,
6575                               kvm_arch_set_xen_evtchn_max_pirq,
6576                               NULL, NULL);
6577     object_class_property_set_description(oc, "xen-evtchn-max-pirq",
6578                                           "Maximum number of Xen PIRQs");
6579 }
6580 
6581 void kvm_set_max_apic_id(uint32_t max_apic_id)
6582 {
6583     kvm_vm_enable_cap(kvm_state, KVM_CAP_MAX_VCPU_ID, 0, max_apic_id);
6584 }
6585